/**
 * SQL identifier validation to prevent injection via table/column names.
 *
 * Allows: letters, digits, underscores, dots (schema.table),
 * parentheses/spaces (COUNT(*), table aliases), equals (JOIN ON),
 * commas (multi-column expressions), and well-formed double-quoted identifiers
 * ("tblFoo", for case-sensitive names PostgreSQL would otherwise fold).
 * Rejects: single quotes, stray/unbalanced double quotes, semicolons,
 * comment markers (--), slashes, backslashes, and other characters that could
 * alter SQL structure.
 */
/**
 * Validate that a string is a safe SQL identifier or expression.
 * Throws if the string contains potentially dangerous characters.
 *
 * Double-quoted identifiers are accepted so callers can reach tables and
 * columns whose names PostgreSQL would otherwise fold to lower case
 * (`ON "tblFoo".id = orders."userId"`). They are checked by substitution:
 * every well-formed `"ident"` is replaced with a bare identifier, then the
 * remainder must satisfy the unquoted rule. A quote that survives that pass is
 * unbalanced or wraps something other than a plain identifier — either way it
 * could break out of the quoting, so the whole string is rejected.
 *
 * @param identifier - The identifier or expression to validate
 * @throws Error if identifier contains unsafe characters
 */
export declare function validateIdentifier(identifier: string): void;
/**
 * Validate that a string is a bare column reference.
 *
 * Use wherever a column name is concatenated into SQL outside the schema
 * whitelist (e.g. the subquery branch of `whereIn`), where the looser
 * `validateIdentifier` would let an expression through.
 *
 * @param column - The column reference to validate
 * @throws Error if the column is not a plain (optionally qualified) identifier
 */
export declare function validateColumnName(column: string): void;
/**
 * Wrap an identifier in double quotes, preserving its original letter case.
 *
 * PostgreSQL folds unquoted identifiers to lower case before resolving them, so
 * a table created as `CREATE TABLE "settings_hangXe"` (what most ORMs emit) is
 * unreachable through a bare `settings_hangXe` reference — PG looks up
 * `settings_hangxe` and reports `relation "settings_hangxe" does not exist`.
 *
 * Each dot-separated part is quoted individually: `public.tblFoo` becomes
 * `"public"."tblFoo"`, not `"public.tblFoo"` (which would name a single table
 * containing a dot).
 *
 * The name is validated as a plain identifier first, so no `"` from the caller
 * can ever reach the output — the quotes are ours, never theirs.
 *
 * @param name - Plain identifier, optionally qualified (`table`, `schema.table`)
 * @returns The quoted form, e.g. `"settings_hangXe"`
 * @throws Error if the name is not a plain (optionally qualified) identifier
 */
export declare function quoteIdentifier(name: string): string;
/**
 * Validate that a string is usable as an output alias (`expr AS alias`).
 *
 * Stricter than `validateColumnName`: no dots, no expressions. Use wherever an
 * alias is concatenated into SQL (e.g. `QueryBuilderOptions.aliases`).
 *
 * @param alias - The alias to validate
 * @throws Error if the alias is not a plain unqualified identifier
 */
export declare function validateAliasName(alias: string): void;
//# sourceMappingURL=identifier-validation.d.ts.map