@syncular/server 0.0.1-73 → 0.0.1-83

package/dist/blobs/adapters/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../src/blobs/adapters/database.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAIV,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,IAAI,CACF,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAC3E,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC,CAAC;CACX;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAiDrE;AAQD,MAAM,WAAW,iCAAiC,CAChD,EAAE,SAAS,WAAW,GAAG,WAAW;IAEpC,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,WAAW,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,CAAC,EAAE,SAAS,WAAW,EACrE,OAAO,EAAE,iCAAiC,CAAC,EAAE,CAAC,GAC7C,kBAAkB,CAiGpB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,SAAS,WAAW,EAC9D,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CAClB,GACA,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,SAAS,WAAW,EAC/D,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoBtE"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../src/blobs/adapters/database.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAIV,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,IAAI,CACF,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAC3E,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC,CAAC;CACX;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CA8DrE;AAoBD,MAAM,WAAW,iCAAiC,CAChD,EAAE,SAAS,WAAW,GAAG,WAAW;IAEpC,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,WAAW,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,CAAC,EAAE,SAAS,WAAW,EACrE,OAAO,EAAE,iCAAiC,CAAC,EAAE,CAAC,GAC7C,kBAAkB,CAiGpB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,SAAS,WAAW,EAC9D,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CAClB,GACA,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,SAAS,WAAW,EAC/D,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoBtE"}

package/dist/blobs/adapters/database.js

@@ -11,11 +11,21 @@ import { sql } from 'kysely';
  */
 export function createHmacTokenSigner(secret) {
     const encoder = new TextEncoder();
+    const keyPromise = crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
     async function hmacSign(data) {
-        const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+        const key = await keyPromise;
         const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(data));
         return bufferToHex(new Uint8Array(signature));
     }
+    async function hmacVerify(data, signatureHex) {
+        const parsedSignature = hexToBuffer(signatureHex);
+        if (!parsedSignature)
+            return false;
+        const signature = new Uint8Array(parsedSignature.length);
+        signature.set(parsedSignature);
+        const key = await keyPromise;
+        return crypto.subtle.verify('HMAC', key, signature, encoder.encode(data));
+    }
     return {
         async sign(payload, _expiresIn) {
             const data = JSON.stringify(payload);
@@ -27,8 +37,8 @@ export function createHmacTokenSigner(secret) {
             const [dataB64, sig] = token.split('.');
             if (!dataB64 || !sig)
                 return null;
-            const expectedSig = await hmacSign(dataB64);
-            if (sig !== expectedSig)
+            const isValidSig = await hmacVerify(dataB64, sig);
+            if (!isValidSig)
                 return null;
             try {
                 const data = JSON.parse(atob(dataB64));
@@ -47,6 +57,18 @@ function bufferToHex(buffer) {
         .map((b) => b.toString(16).padStart(2, '0'))
         .join('');
 }
+function hexToBuffer(hex) {
+    if (hex.length === 0 || hex.length % 2 !== 0)
+        return null;
+    if (!/^[0-9a-f]+$/i.test(hex))
+        return null;
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        const pair = hex.slice(i, i + 2);
+        out[i / 2] = Number.parseInt(pair, 16);
+    }
+    return out;
+}
 /**
  * Create a database blob storage adapter.
  *

package/dist/blobs/adapters/database.js.map

@@ -1 +1 @@
-{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/blobs/adapters/database.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAe,GAAG,EAAE,MAAM,QAAQ,CAAC;AA6B1C;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAmB;IACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAElC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAmB;QACrD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAAA,CAC/C;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;QAAA,CAC5B;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE;YAClB,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAElC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;YAErC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAIpC,CAAC;gBAEF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAE7C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QAAA,CACF;KACF,CAAC;AAAA,CACH;AAED,SAAS,WAAW,CAAC,MAAkB,EAAU;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,CACb;AAaD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA8C,EAC1B;IACpB,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE7C,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,IAAI,EAAE,UAAU;QAEhB,KAAK,CAAC,UAAU,CAAC,IAA2B,EAA6B;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAClC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAChD,IAAI,CAAC,SAAS,CACf,CAAC;YAEF,8CAA8C;YAC9C,MAAM,GAAG,GAAG,GAAG,iBAAiB,UAAU,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAEpH,OAAO;gBACL,GAAG;gBACH,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,IAAI,CAAC,QAAQ;oBAC7B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC;aACF,CAAC;QAAA,CACH;QAED,KAAK,CAAC,YAAY,CAAC,IAA6B,EAAmB;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAClC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAClD,IAAI,CAAC,SAAS,CACf,CAAC;YAEF,OAAO,GAAG,iBAAiB,UAAU,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAAA,CAClH;QAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAoB;YAC3C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAkB;;eAEpC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;uBACf,IAAI;;OAEpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAAA,CAClC;QAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAiB;YACxC,MAAM,GAAG,CAAA;sBACO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;uBACtB,IAAI;OACpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAA,CACf;QAED,KAAK,CAAC,WAAW,CACf,IAAY,EACyC;YACrD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAqC;;eAEvD,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;uBACf,IAAI;;OAEpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE9B,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEtB,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,GAAG,CAAC,SAAS;aACxB,CAAC;QAAA,CACH;QAED,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,IAAgB,EAChB,QAAkC,EACnB;YACf,MAAM,QAAQ,GACZ,OAAO,QAAQ,EAAE,QAAQ,KAAK,QAAQ;gBACpC,CAAC,CAAC,QAAQ,CAAC,QAAQ;gBACnB,CAAC,CAAC,0BAA0B,CAAC;YACjC,MAAM,mBAAmB,CAAC,EAAE,EAAE;gBAC5B,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,MAAM;gBACjB,QAAQ;gBACR,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;QAAA,CACJ;QAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAA8B;YAClD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACpD,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;QAAA,CAC7B;KACF,CAAC;AAAA,CACH;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAc,EACd,IAKC,EACc;IACf,MAAM,GAAG,CAAA;kBACO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;;;;;;;;QAQjC,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,IAAI;QACT,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;GAG7B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,CACf;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAc,EACd,IAAY,EAC0D;IACtE,MAAM,SAAS,GAAG,MAAM,GAAG,CAIzB;;WAEO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;mBACf,IAAI;;GAEpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC;AAAA,CACH"}
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/blobs/adapters/database.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAe,GAAG,EAAE,MAAM,QAAQ,CAAC;AA6B1C;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAmB;IACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IAEF,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAmB;QACrD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAAA,CAC/C;IAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,YAAoB,EACF;QAClB,MAAM,eAAe,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACzD,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAAA,CAC3E;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;QAAA,CAC5B;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE;YAClB,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAElC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAIpC,CAAC;gBAEF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAE7C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QAAA,CACF;KACF,CAAC;AAAA,CACH;AAED,SAAS,WAAW,CAAC,MAAkB,EAAU;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,CACb;AAED,SAAS,WAAW,CAAC,GAAW,EAAqB;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AAAA,CACZ;AAaD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA8C,EAC1B;IACpB,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE7C,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,IAAI,EAAE,UAAU;QAEhB,KAAK,CAAC,UAAU,CAAC,IAA2B,EAA6B;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAClC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAChD,IAAI,CAAC,SAAS,CACf,CAAC;YAEF,8CAA8C;YAC9C,MAAM,GAAG,GAAG,GAAG,iBAAiB,UAAU,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAEpH,OAAO;gBACL,GAAG;gBACH,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,IAAI,CAAC,QAAQ;oBAC7B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC;aACF,CAAC;QAAA,CACH;QAED,KAAK,CAAC,YAAY,CAAC,IAA6B,EAAmB;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAClC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAClD,IAAI,CAAC,SAAS,CACf,CAAC;YAEF,OAAO,GAAG,iBAAiB,UAAU,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAAA,CAClH;QAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAoB;YAC3C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAkB;;eAEpC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;uBACf,IAAI;;OAEpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAAA,CAClC;QAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAiB;YACxC,MAAM,GAAG,CAAA;sBACO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;uBACtB,IAAI;OACpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAA,CACf;QAED,KAAK,CAAC,WAAW,CACf,IAAY,EACyC;YACrD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAqC;;eAEvD,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;uBACf,IAAI;;OAEpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE9B,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEtB,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,GAAG,CAAC,SAAS;aACxB,CAAC;QAAA,CACH;QAED,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,IAAgB,EAChB,QAAkC,EACnB;YACf,MAAM,QAAQ,GACZ,OAAO,QAAQ,EAAE,QAAQ,KAAK,QAAQ;gBACpC,CAAC,CAAC,QAAQ,CAAC,QAAQ;gBACnB,CAAC,CAAC,0BAA0B,CAAC;YACjC,MAAM,mBAAmB,CAAC,EAAE,EAAE;gBAC5B,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,MAAM;gBACjB,QAAQ;gBACR,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;QAAA,CACJ;QAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAA8B;YAClD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACpD,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;QAAA,CAC7B;KACF,CAAC;AAAA,CACH;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAc,EACd,IAKC,EACc;IACf,MAAM,GAAG,CAAA;kBACO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;;;;;;;;QAQjC,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,IAAI;QACT,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;GAG7B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,CACf;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAc,EACd,IAAY,EAC0D;IACtE,MAAM,SAAS,GAAG,MAAM,GAAG,CAIzB;;WAEO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;mBACf,IAAI;;GAEpB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC;AAAA,CACH"}

package/dist/blobs/index.js

@@ -1,9 +1,9 @@
 /**
  * @syncular/server - Blob storage exports
  */
-export * from './adapters/database';
-export * from './adapters/s3';
-export * from './manager';
-export * from './migrate';
-export * from './types';
+export * from './adapters/database.js';
+export * from './adapters/s3.js';
+export * from './manager.js';
+export * from './migrate.js';
+export * from './types.js';
 //# sourceMappingURL=index.js.map

package/dist/dialect/base.js

@@ -5,7 +5,7 @@
  * database-specific sync dialect implementations.
  */
 import { sql } from 'kysely';
-import { coerceIsoString, coerceNumber, parseScopes } from './helpers';
+import { coerceIsoString, coerceNumber, parseScopes } from './helpers.js';
 /**
  * Abstract base class for server sync dialects.
  *

package/dist/dialect/index.js

@@ -1,7 +1,7 @@
 /**
  * @syncular/server - Dialect exports
  */
-export * from './base';
-export * from './helpers';
-export * from './types';
+export * from './base.js';
+export * from './helpers.js';
+export * from './types.js';
 //# sourceMappingURL=index.js.map

package/dist/helpers/index.js

@@ -3,8 +3,8 @@
  *
  * Convenience helpers for implementing server table handlers.
  */
-export * from './conflict';
-export * from './emitted-change';
-export * from './paginate';
-export * from './scope-strings';
+export * from './conflict.js';
+export * from './emitted-change.js';
+export * from './paginate.js';
+export * from './scope-strings.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js

@@ -8,20 +8,20 @@
  * - blob/media storage
  */
 export * from '@syncular/core';
-export * from './blobs';
-export * from './clients';
-export * from './compaction';
-export * from './dialect';
-export * from './helpers';
-export * from './migrate';
-export * from './proxy';
-export * from './prune';
-export * from './pull';
-export * from './push';
-export * from './realtime';
-export * from './schema';
-export * from './shapes';
-export * from './snapshot-chunks';
-export * from './stats';
-export * from './subscriptions';
+export * from './blobs/index.js';
+export * from './clients.js';
+export * from './compaction.js';
+export * from './dialect/index.js';
+export * from './helpers/index.js';
+export * from './migrate.js';
+export * from './proxy/index.js';
+export * from './prune.js';
+export * from './pull.js';
+export * from './push.js';
+export * from './realtime/index.js';
+export * from './schema.js';
+export * from './shapes/index.js';
+export * from './snapshot-chunks.js';
+export * from './stats.js';
+export * from './subscriptions/index.js';
 //# sourceMappingURL=index.js.map

package/dist/proxy/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/proxy/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAO5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,qBAAqB,CAAC,EAAE,SAAS,UAAU,GAAG,UAAU;IACvE,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,0BAA0B;IAC1B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,gDAAgD;IAChD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,uCAAuC;IACvC,GAAG,EAAE,iBAAiB,CAAC;IACvB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,SAAS,OAAO,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,UAAU,EAC3D,IAAI,EAAE,qBAAqB,CAAC,EAAE,CAAC,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CAmDlC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/proxy/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQ5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,qBAAqB,CAAC,EAAE,SAAS,UAAU,GAAG,UAAU;IACvE,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,0BAA0B;IAC1B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,gDAAgD;IAChD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,uCAAuC;IACvC,GAAG,EAAE,iBAAiB,CAAC;IACvB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,SAAS,OAAO,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,UAAU,EAC3D,IAAI,EAAE,qBAAqB,CAAC,EAAE,CAAC,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CAyDlC"}

package/dist/proxy/handler.js

@@ -4,8 +4,8 @@
  * Executes proxied queries with automatic oplog generation for mutations.
  */
 import { sql } from 'kysely';
-import { appendReturning, detectMutation, hasReturningClause, } from './mutation-detector';
-import { createOplogEntries } from './oplog';
+import { appendReturning, detectMutation, hasReturningClause, hasReturningWildcard, } from './mutation-detector.js';
+import { createOplogEntries } from './oplog.js';
 /**
  * Build a raw SQL query with parameters using Kysely's sql helper.
  *
@@ -72,8 +72,11 @@ export async function executeProxyQuery(args) {
         };
     }
     // Mutation with registered shape - append RETURNING * and create oplog
-    const needsReturning = !hasReturningClause(sqlQuery);
-    const finalSql = needsReturning ? appendReturning(sqlQuery) : sqlQuery;
+    const hasReturning = hasReturningClause(sqlQuery);
+    if (hasReturning && !hasReturningWildcard(sqlQuery)) {
+        throw new Error(`Proxy mutation on synced table "${mutation.tableName}" must use RETURNING * (or omit RETURNING)`);
+    }
+    const finalSql = hasReturning ? sqlQuery : appendReturning(sqlQuery);
     const result = await buildRawQuery(finalSql, parameters).execute(db);
     const affectedRows = result.rows;
     if (affectedRows.length === 0) {

package/dist/proxy/handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/proxy/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,cAAc,EACd,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AA8B7C;;;;GAIG;AACH,SAAS,aAAa,CACpB,QAAgB,EAChB,UAA8B,EACT;IACrB,qCAAqC;IACrC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,UAAU,CAAC;IAC9B,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,oCAAoC;QACpC,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;YACtD,qDAAqD;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,CAAC;IAED,yCAAyC;IACzC,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,0BAA0B;IAC1B,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CACrC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA+B,EACG;IAClC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,8CAA8C;QAC9C,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEvE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAiC,CAAC;IAE9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,uBAAuB;IACvB,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,kBAAkB,CAAC;QAC7D,GAAG,EAAE,EAAE;QACP,OAAO;QACP,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,MAAM;QAC7B,SAAS;QACT,cAAc;KACf,CAAC;AAAA,CACH"}
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/proxy/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AA8B7C;;;;GAIG;AACH,SAAS,aAAa,CACpB,QAAgB,EAChB,UAA8B,EACT;IACrB,qCAAqC;IACrC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,UAAU,CAAC;IAC9B,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,oCAAoC;QACpC,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;YACtD,qDAAqD;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,CAAC;IAED,yCAAyC;IACzC,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,0BAA0B;IAC1B,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CACrC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA+B,EACG;IAClC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,8CAA8C;QAC9C,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,YAAY,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,CAAC,SAAS,4CAA4C,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAiC,CAAC;IAE9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,uBAAuB;IACvB,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,kBAAkB,CAAC;QAC7D,GAAG,EAAE,EAAE;QACP,OAAO;QACP,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,MAAM;QAC7B,SAAS;QACT,cAAc;KACf,CAAC;AAAA,CACH"}

package/dist/proxy/index.js

@@ -4,11 +4,11 @@
  * Server-side proxy functionality for database access.
  */
 // Query execution
-export { executeProxyQuery, } from './handler';
+export { executeProxyQuery, } from './handler.js';
 // Mutation detection
-export { detectMutation } from './mutation-detector';
+export { detectMutation } from './mutation-detector.js';
 // Oplog creation
 // Registry
-export { ProxyTableRegistry } from './registry';
+export { ProxyTableRegistry } from './registry.js';
 // Types
 //# sourceMappingURL=index.js.map

package/dist/proxy/mutation-detector.d.ts

@@ -21,6 +21,10 @@ export declare function detectMutation(sql: string): DetectedMutation | null;
  * Check if SQL already has a RETURNING clause.
  */
 export declare function hasReturningClause(sql: string): boolean;
+/**
+ * Check if SQL has a wildcard RETURNING clause (RETURNING * or alias.*).
+ */
+export declare function hasReturningWildcard(sql: string): boolean;
 /**
  * Append RETURNING * to a mutation query if not already present.
  *

package/dist/proxy/mutation-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mutation-detector.d.ts","sourceRoot":"","sources":["../../src/proxy/mutation-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAqCnE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQnD"}
+{"version":3,"file":"mutation-detector.d.ts","sourceRoot":"","sources":["../../src/proxy/mutation-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAyMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CA2BnE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQnD"}

package/dist/proxy/mutation-detector.js

@@ -3,6 +3,187 @@
  *
  * Detects whether a SQL query is a mutation (INSERT/UPDATE/DELETE).
  */
+function isWordStart(ch) {
+    return /[A-Za-z_]/.test(ch);
+}
+function isWordPart(ch) {
+    return /[A-Za-z0-9_$]/.test(ch);
+}
+function skipLeadingNoise(sql) {
+    let index = 0;
+    while (index < sql.length) {
+        while (index < sql.length && /[\s;]/.test(sql[index])) {
+            index += 1;
+        }
+        if (sql.startsWith('--', index)) {
+            index += 2;
+            while (index < sql.length && sql[index] !== '\n') {
+                index += 1;
+            }
+            continue;
+        }
+        if (sql.startsWith('/*', index)) {
+            const end = sql.indexOf('*/', index + 2);
+            if (end === -1)
+                return '';
+            index = end + 2;
+            continue;
+        }
+        break;
+    }
+    return sql.slice(index);
+}
+function extractMainStatement(sql) {
+    const normalized = skipLeadingNoise(sql);
+    if (!normalized.toLowerCase().startsWith('with')) {
+        return normalized;
+    }
+    const lower = normalized.toLowerCase();
+    const rootKeywords = new Set(['insert', 'update', 'delete', 'select']);
+    let index = 0;
+    let depth = 0;
+    let inSingleQuote = false;
+    let inDoubleQuote = false;
+    let inLineComment = false;
+    let inBlockComment = false;
+    while (index < normalized.length) {
+        const ch = normalized[index];
+        const next = normalized[index + 1];
+        if (inLineComment) {
+            if (ch === '\n')
+                inLineComment = false;
+            index += 1;
+            continue;
+        }
+        if (inBlockComment) {
+            if (ch === '*' && next === '/') {
+                inBlockComment = false;
+                index += 2;
+                continue;
+            }
+            index += 1;
+            continue;
+        }
+        if (inSingleQuote) {
+            if (ch === "'" && next === "'") {
+                index += 2;
+                continue;
+            }
+            if (ch === "'")
+                inSingleQuote = false;
+            index += 1;
+            continue;
+        }
+        if (inDoubleQuote) {
+            if (ch === '"' && next === '"') {
+                index += 2;
+                continue;
+            }
+            if (ch === '"')
+                inDoubleQuote = false;
+            index += 1;
+            continue;
+        }
+        if (ch === '-' && next === '-') {
+            inLineComment = true;
+            index += 2;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            inBlockComment = true;
+            index += 2;
+            continue;
+        }
+        if (ch === "'") {
+            inSingleQuote = true;
+            index += 1;
+            continue;
+        }
+        if (ch === '"') {
+            inDoubleQuote = true;
+            index += 1;
+            continue;
+        }
+        if (ch === '(') {
+            depth += 1;
+            index += 1;
+            continue;
+        }
+        if (ch === ')') {
+            if (depth > 0)
+                depth -= 1;
+            index += 1;
+            continue;
+        }
+        if (depth === 0 && isWordStart(ch)) {
+            const tokenStart = index;
+            index += 1;
+            while (index < normalized.length && isWordPart(normalized[index])) {
+                index += 1;
+            }
+            const token = lower.slice(tokenStart, index);
+            if (token !== 'with' &&
+                token !== 'recursive' &&
+                rootKeywords.has(token)) {
+                return normalized.slice(tokenStart);
+            }
+            continue;
+        }
+        index += 1;
+    }
+    return normalized;
+}
+function parseIdentifier(input, startIndex) {
+    let index = startIndex;
+    while (index < input.length && /\s/.test(input[index])) {
+        index += 1;
+    }
+    if (index >= input.length)
+        return null;
+    if (input[index] === '"') {
+        index += 1;
+        let value = '';
+        while (index < input.length) {
+            const ch = input[index];
+            if (ch === '"' && input[index + 1] === '"') {
+                value += '"';
+                index += 2;
+                continue;
+            }
+            if (ch === '"') {
+                index += 1;
+                return { name: value, nextIndex: index };
+            }
+            value += ch;
+            index += 1;
+        }
+        return null;
+    }
+    if (!isWordStart(input[index]))
+        return null;
+    const first = index;
+    index += 1;
+    while (index < input.length && isWordPart(input[index])) {
+        index += 1;
+    }
+    return { name: input.slice(first, index), nextIndex: index };
+}
+function parseTargetTable(input) {
+    const first = parseIdentifier(input, 0);
+    if (!first)
+        return null;
+    let index = first.nextIndex;
+    while (index < input.length && /\s/.test(input[index])) {
+        index += 1;
+    }
+    if (input[index] !== '.') {
+        return first.name;
+    }
+    const second = parseIdentifier(input, index + 1);
+    if (!second)
+        return null;
+    return second.name;
+}
 /**
  * Detect if a SQL query is a mutation and extract table info.
  *
@@ -10,30 +191,25 @@
  * @returns Mutation info if detected, null for read queries
  */
 export function detectMutation(sql) {
-    const trimmed = sql.trim();
-    // INSERT INTO [schema.]table
-    const insertMatch = trimmed.match(/^\s*INSERT\s+INTO\s+(?:["']?(\w+)["']?\.)?["']?(\w+)["']?/i);
-    if (insertMatch) {
-        return {
-            operation: 'upsert',
-            tableName: insertMatch[2],
-        };
-    }
-    // UPDATE [schema.]table
-    const updateMatch = trimmed.match(/^\s*UPDATE\s+(?:["']?(\w+)["']?\.)?["']?(\w+)["']?/i);
-    if (updateMatch) {
-        return {
-            operation: 'upsert',
-            tableName: updateMatch[2],
-        };
-    }
-    // DELETE FROM [schema.]table
-    const deleteMatch = trimmed.match(/^\s*DELETE\s+FROM\s+(?:["']?(\w+)["']?\.)?["']?(\w+)["']?/i);
-    if (deleteMatch) {
-        return {
-            operation: 'delete',
-            tableName: deleteMatch[2],
-        };
+    const statement = extractMainStatement(sql).trimStart();
+    const lower = statement.toLowerCase();
+    if (lower.startsWith('insert')) {
+        const tableName = parseTargetTable(statement.replace(/^insert\s+into\s+/i, ''));
+        if (!tableName)
+            return null;
+        return { operation: 'upsert', tableName };
+    }
+    if (lower.startsWith('update')) {
+        const tableName = parseTargetTable(statement.replace(/^update\s+/i, ''));
+        if (!tableName)
+            return null;
+        return { operation: 'upsert', tableName };
+    }
+    if (lower.startsWith('delete')) {
+        const tableName = parseTargetTable(statement.replace(/^delete\s+from\s+/i, ''));
+        if (!tableName)
+            return null;
+        return { operation: 'delete', tableName };
     }
     return null;
 }
@@ -44,6 +220,15 @@ export function hasReturningClause(sql) {
     // Simple check - look for RETURNING keyword not in a string
     return /\bRETURNING\b/i.test(sql);
 }
+/**
+ * Check if SQL has a wildcard RETURNING clause (RETURNING * or alias.*).
+ */
+export function hasReturningWildcard(sql) {
+    const match = sql.match(/\bRETURNING\b([\s\S]*)$/i);
+    if (!match)
+        return false;
+    return /(^|,)\s*(?:[A-Za-z_][A-Za-z0-9_$]*\.)?\*/i.test(match[1]);
+}
 /**
  * Append RETURNING * to a mutation query if not already present.
  *

package/dist/proxy/mutation-detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"mutation-detector.js","sourceRoot":"","sources":["../../src/proxy/mutation-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAA2B;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3B,6BAA6B;IAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,4DAA4D,CAC7D,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,WAAW,CAAC,CAAC,CAAE;SAC3B,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,qDAAqD,CACtD,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,WAAW,CAAC,CAAC,CAAE;SAC3B,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,4DAA4D,CAC7D,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,WAAW,CAAC,CAAC,CAAE;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AAAA,CACb;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAW;IACvD,4DAA4D;IAC5D,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAAA,CACnC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAU;IACnD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uCAAuC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,OAAO,cAAc,CAAC;AAAA,CACjC"}
+{"version":3,"file":"mutation-detector.js","sourceRoot":"","sources":["../../src/proxy/mutation-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,SAAS,WAAW,CAAC,EAAU,EAAW;IACxC,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,CAC7B;AAED,SAAS,UAAU,CAAC,EAAU,EAAW;IACvC,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,CACjC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAU;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;YACvD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QAED,MAAM;IACR,CAAC;IAED,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAAA,CACzB;AAED,SAAS,oBAAoB,CAAC,GAAW,EAAU;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEvE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAEnC,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,IAAI;gBAAE,aAAa,GAAG,KAAK,CAAC;YACvC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,cAAc,GAAG,KAAK,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,aAAa,GAAG,KAAK,CAAC;YACtC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,aAAa,GAAG,KAAK,CAAC;YACtC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,aAAa,GAAG,IAAI,CAAC;YACrB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,cAAc,GAAG,IAAI,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,aAAa,GAAG,IAAI,CAAC;YACrB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,aAAa,GAAG,IAAI,CAAC;YACrB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,IAAI,CAAC,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,KAAK,KAAK,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;gBACnE,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC7C,IACE,KAAK,KAAK,MAAM;gBAChB,KAAK,KAAK,WAAW;gBACrB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EACvB,CAAC;gBACD,OAAO,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,UAAU,CAAC;AAAA,CACnB;AAED,SAAS,eAAe,CACtB,KAAa,EACb,UAAkB,EAC0B;IAC5C,IAAI,KAAK,GAAG,UAAU,CAAC;IACvB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;QACxD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;YACzB,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3C,KAAK,IAAI,GAAG,CAAC;gBACb,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC3C,CAAC;YACD,KAAK,IAAI,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,CAAC;IACX,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;QACzD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,CAC9D;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAiB;IACtD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC;IAC5B,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;QACxD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,MAAM,CAAC,IAAI,CAAC;AAAA,CACpB;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAA2B;IACnE,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEtC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAC5C,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAC5C,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AAAA,CACb;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAW;IACvD,4DAA4D;IAC5D,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAAA,CACnC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAW;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CACnE;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAU;IACnD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uCAAuC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,OAAO,cAAc,CAAC;AAAA,CACjC"}

package/dist/pull.js

@@ -1,8 +1,8 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { promisify } from 'node:util';
 import { gzip, gzipSync } from 'node:zlib';
-import { insertSnapshotChunk, readSnapshotChunkRefByPageKey, } from './snapshot-chunks';
-import { resolveEffectiveScopesForSubscriptions } from './subscriptions/resolve';
+import { insertSnapshotChunk, readSnapshotChunkRefByPageKey, } from './snapshot-chunks.js';
+import { resolveEffectiveScopesForSubscriptions } from './subscriptions/resolve.js';
 const gzipAsync = promisify(gzip);
 const ASYNC_GZIP_MIN_BYTES = 64 * 1024;
 async function compressSnapshotNdjson(ndjson) {

package/dist/realtime/index.js

@@ -1,2 +1,2 @@
-export { InMemorySyncRealtimeBroadcaster } from './in-memory';
+export { InMemorySyncRealtimeBroadcaster } from './in-memory.js';
 //# sourceMappingURL=index.js.map

package/dist/shapes/index.js

@@ -1,4 +1,4 @@
-export * from './create-handler';
-export * from './registry';
-export * from './types';
+export * from './create-handler.js';
+export * from './registry.js';
+export * from './types.js';
 //# sourceMappingURL=index.js.map

package/dist/snapshot-chunks/adapters/s3.js

@@ -3,7 +3,7 @@
  *
  * Stores snapshot chunk bodies in S3/R2/MinIO with metadata in database.
  */
-import { createDbMetadataChunkStorage } from '../db-metadata';
+import { createDbMetadataChunkStorage } from '../db-metadata.js';
 /**
  * Create S3-compatible snapshot chunk storage.
  *

package/dist/snapshot-chunks/index.js

@@ -3,7 +3,7 @@
  *
  * Separates chunk metadata (database) from body content (blob storage).
  */
-export * from './adapters/s3';
-export * from './db-metadata';
-export * from './types';
+export * from './adapters/s3.js';
+export * from './db-metadata.js';
+export * from './types.js';
 //# sourceMappingURL=index.js.map

package/dist/subscriptions/index.js

@@ -1,2 +1,2 @@
-export * from './resolve';
+export * from './resolve.js';
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/server",
-  "version": "0.0.1-73",
+  "version": "0.0.1-83",
   "description": "Server-side sync engine with push/pull, pruning, and snapshot support",
   "license": "MIT",
   "author": "Benjamin Kniffler",

package/src/blobs/adapters/database.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, test } from 'bun:test';
+import { createHmacTokenSigner } from './database';
+
+describe('createHmacTokenSigner', () => {
+  test('verifies valid signed tokens', async () => {
+    const signer = createHmacTokenSigner('test-secret');
+    const payload = {
+      hash: 'sha256:abc',
+      action: 'upload' as const,
+      expiresAt: Date.now() + 60_000,
+    };
+
+    const token = await signer.sign(payload, 60);
+    const decoded = await signer.verify(token);
+
+    expect(decoded).toEqual(payload);
+  });
+
+  test('rejects tampered signatures', async () => {
+    const signer = createHmacTokenSigner('test-secret');
+    const payload = {
+      hash: 'sha256:def',
+      action: 'download' as const,
+      expiresAt: Date.now() + 60_000,
+    };
+
+    const token = await signer.sign(payload, 60);
+    const [data, sig] = token.split('.');
+    if (!data || !sig) {
+      throw new Error('Expected signed token with payload and signature');
+    }
+    const replacement = sig.endsWith('0') ? '1' : '0';
+    const tamperedSig = `${sig.slice(0, -1)}${replacement}`;
+    const tamperedToken = `${data}.${tamperedSig}`;
+
+    expect(await signer.verify(tamperedToken)).toBeNull();
+  });
+
+  test('rejects malformed hex signatures', async () => {
+    const signer = createHmacTokenSigner('test-secret');
+    const payload = {
+      hash: 'sha256:ghi',
+      action: 'upload' as const,
+      expiresAt: Date.now() + 60_000,
+    };
+
+    const token = await signer.sign(payload, 60);
+    const [data] = token.split('.');
+    if (!data) {
+      throw new Error('Expected signed token payload segment');
+    }
+
+    expect(await signer.verify(`${data}.not-hex-signature`)).toBeNull();
+  });
+
+  test('rejects expired tokens', async () => {
+    const signer = createHmacTokenSigner('test-secret');
+    const payload = {
+      hash: 'sha256:jkl',
+      action: 'upload' as const,
+      expiresAt: Date.now() - 1,
+    };
+
+    const token = await signer.sign(payload, 60);
+    expect(await signer.verify(token)).toBeNull();
+  });
+});

package/src/blobs/adapters/database.ts

@@ -46,15 +46,16 @@ export interface BlobTokenSigner {
  */
 export function createHmacTokenSigner(secret: string): BlobTokenSigner {
   const encoder = new TextEncoder();
+  const keyPromise = crypto.subtle.importKey(
+    'raw',
+    encoder.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign', 'verify']
+  );
 
   async function hmacSign(data: string): Promise<string> {
-    const key = await crypto.subtle.importKey(
-      'raw',
-      encoder.encode(secret),
-      { name: 'HMAC', hash: 'SHA-256' },
-      false,
-      ['sign']
-    );
+    const key = await keyPromise;
     const signature = await crypto.subtle.sign(
       'HMAC',
       key,
@@ -63,6 +64,18 @@ export function createHmacTokenSigner(secret: string): BlobTokenSigner {
     return bufferToHex(new Uint8Array(signature));
   }
 
+  async function hmacVerify(
+    data: string,
+    signatureHex: string
+  ): Promise<boolean> {
+    const parsedSignature = hexToBuffer(signatureHex);
+    if (!parsedSignature) return false;
+    const signature = new Uint8Array(parsedSignature.length);
+    signature.set(parsedSignature);
+    const key = await keyPromise;
+    return crypto.subtle.verify('HMAC', key, signature, encoder.encode(data));
+  }
+
   return {
     async sign(payload, _expiresIn) {
       const data = JSON.stringify(payload);
@@ -75,8 +88,8 @@ export function createHmacTokenSigner(secret: string): BlobTokenSigner {
       const [dataB64, sig] = token.split('.');
       if (!dataB64 || !sig) return null;
 
-      const expectedSig = await hmacSign(dataB64);
-      if (sig !== expectedSig) return null;
+      const isValidSig = await hmacVerify(dataB64, sig);
+      if (!isValidSig) return null;
 
       try {
         const data = JSON.parse(atob(dataB64)) as {
@@ -101,6 +114,18 @@ function bufferToHex(buffer: Uint8Array): string {
     .join('');
 }
 
+function hexToBuffer(hex: string): Uint8Array | null {
+  if (hex.length === 0 || hex.length % 2 !== 0) return null;
+  if (!/^[0-9a-f]+$/i.test(hex)) return null;
+
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < hex.length; i += 2) {
+    const pair = hex.slice(i, i + 2);
+    out[i / 2] = Number.parseInt(pair, 16);
+  }
+  return out;
+}
+
 export interface DatabaseBlobStorageAdapterOptions<
   DB extends SyncBlobsDb = SyncBlobsDb,
 > {

package/src/proxy/handler.test.ts

@@ -0,0 +1,120 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import type { Kysely } from 'kysely';
+import { createBunSqliteDb } from '../../../dialect-bun-sqlite/src';
+import { createSqliteServerDialect } from '../../../server-dialect-sqlite/src';
+import { ensureSyncSchema } from '../migrate';
+import type { SyncCoreDb } from '../schema';
+import { executeProxyQuery } from './handler';
+import { ProxyTableRegistry } from './registry';
+
+interface TasksTable {
+  id: string;
+  user_id: string;
+  title: string;
+  server_version: number;
+}
+
+interface ProxyTestDb extends SyncCoreDb {
+  tasks: TasksTable;
+}
+
+describe('executeProxyQuery', () => {
+  let db: Kysely<ProxyTestDb>;
+  const dialect = createSqliteServerDialect();
+  const shapes = new ProxyTableRegistry().register({
+    table: 'tasks',
+    computeScopes: (row) => ({
+      user_id: String(row.user_id),
+    }),
+  });
+
+  beforeEach(async () => {
+    db = createBunSqliteDb<ProxyTestDb>({ path: ':memory:' });
+    await ensureSyncSchema(db, dialect);
+
+    await db.schema
+      .createTable('tasks')
+      .addColumn('id', 'text', (col) => col.primaryKey())
+      .addColumn('user_id', 'text', (col) => col.notNull())
+      .addColumn('title', 'text', (col) => col.notNull())
+      .addColumn('server_version', 'integer', (col) => col.notNull())
+      .execute();
+
+    await db
+      .insertInto('tasks')
+      .values({
+        id: 't1',
+        user_id: 'u1',
+        title: 'old title',
+        server_version: 1,
+      })
+      .execute();
+  });
+
+  afterEach(async () => {
+    await db.destroy();
+  });
+
+  it('tracks comment-prefixed mutations in the sync oplog', async () => {
+    const result = await executeProxyQuery({
+      db,
+      dialect,
+      shapes,
+      ctx: { actorId: 'actor-1', clientId: 'proxy-client-1' },
+      sqlQuery:
+        '/* admin */ UPDATE tasks SET title = $1, server_version = server_version + 1 WHERE id = $2',
+      parameters: ['new title', 't1'],
+    });
+
+    expect(result.rowCount).toBe(1);
+    expect(result.commitSeq).toBeGreaterThan(0);
+
+    const commitCount = await db
+      .selectFrom('sync_commits')
+      .select(({ fn }) => fn.countAll().as('count'))
+      .executeTakeFirstOrThrow();
+    expect(Number(commitCount.count)).toBe(1);
+
+    const changeCount = await db
+      .selectFrom('sync_changes')
+      .select(({ fn }) => fn.countAll().as('count'))
+      .executeTakeFirstOrThrow();
+    expect(Number(changeCount.count)).toBe(1);
+
+    const updated = await db
+      .selectFrom('tasks')
+      .select(['title', 'server_version'])
+      .where('id', '=', 't1')
+      .executeTakeFirstOrThrow();
+    expect(updated.title).toBe('new title');
+    expect(updated.server_version).toBe(2);
+  });
+
+  it('rejects non-wildcard RETURNING on synced-table mutations', async () => {
+    await expect(
+      executeProxyQuery({
+        db,
+        dialect,
+        shapes,
+        ctx: { actorId: 'actor-1', clientId: 'proxy-client-1' },
+        sqlQuery: 'UPDATE tasks SET title = $1 WHERE id = $2 RETURNING id',
+        parameters: ['blocked title', 't1'],
+      })
+    ).rejects.toThrow(
+      'Proxy mutation on synced table "tasks" must use RETURNING * (or omit RETURNING)'
+    );
+
+    const commitCount = await db
+      .selectFrom('sync_commits')
+      .select(({ fn }) => fn.countAll().as('count'))
+      .executeTakeFirstOrThrow();
+    expect(Number(commitCount.count)).toBe(0);
+
+    const row = await db
+      .selectFrom('tasks')
+      .select(['title'])
+      .where('id', '=', 't1')
+      .executeTakeFirstOrThrow();
+    expect(row.title).toBe('old title');
+  });
+});

package/src/proxy/handler.ts

@@ -12,6 +12,7 @@ import {
   appendReturning,
   detectMutation,
   hasReturningClause,
+  hasReturningWildcard,
 } from './mutation-detector';
 import { createOplogEntries } from './oplog';
 import type { ProxyTableRegistry } from './registry';
@@ -122,8 +123,14 @@ export async function executeProxyQuery<DB extends SyncCoreDb>(
   }
 
   // Mutation with registered shape - append RETURNING * and create oplog
-  const needsReturning = !hasReturningClause(sqlQuery);
-  const finalSql = needsReturning ? appendReturning(sqlQuery) : sqlQuery;
+  const hasReturning = hasReturningClause(sqlQuery);
+  if (hasReturning && !hasReturningWildcard(sqlQuery)) {
+    throw new Error(
+      `Proxy mutation on synced table "${mutation.tableName}" must use RETURNING * (or omit RETURNING)`
+    );
+  }
+
+  const finalSql = hasReturning ? sqlQuery : appendReturning(sqlQuery);
 
   const result = await buildRawQuery(finalSql, parameters).execute(db);
   const affectedRows = result.rows as Record<string, unknown>[];

package/src/proxy/mutation-detector.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, it } from 'bun:test';
+import {
+  appendReturning,
+  detectMutation,
+  hasReturningWildcard,
+} from './mutation-detector';
+
+describe('detectMutation', () => {
+  it('detects comment-prefixed update statements', () => {
+    const detected = detectMutation(`
+      /* admin tooling */
+      UPDATE tasks
+      SET title = 'updated'
+      WHERE id = 't1'
+    `);
+
+    expect(detected).toEqual({
+      operation: 'upsert',
+      tableName: 'tasks',
+    });
+  });
+
+  it('detects cte-prefixed update statements', () => {
+    const detected = detectMutation(`
+      WITH touched AS (
+        SELECT id FROM tasks WHERE id = 't1'
+      )
+      UPDATE tasks
+      SET title = 'updated'
+      WHERE id IN (SELECT id FROM touched)
+    `);
+
+    expect(detected).toEqual({
+      operation: 'upsert',
+      tableName: 'tasks',
+    });
+  });
+
+  it('returns null for cte-prefixed read queries', () => {
+    const detected = detectMutation(`
+      WITH filtered AS (
+        SELECT id FROM tasks WHERE user_id = 'u1'
+      )
+      SELECT * FROM filtered
+    `);
+
+    expect(detected).toBeNull();
+  });
+});
+
+describe('returning helpers', () => {
+  it('recognizes wildcard RETURNING clauses', () => {
+    expect(
+      hasReturningWildcard('UPDATE tasks SET title = $1 RETURNING *')
+    ).toBe(true);
+    expect(
+      hasReturningWildcard(
+        'UPDATE tasks SET title = $1 RETURNING tasks.id, tasks.*'
+      )
+    ).toBe(true);
+    expect(
+      hasReturningWildcard('UPDATE tasks SET title = $1 RETURNING id')
+    ).toBe(false);
+  });
+
+  it('appends RETURNING * when missing', () => {
+    expect(appendReturning('UPDATE tasks SET title = $1')).toBe(
+      'UPDATE tasks SET title = $1 RETURNING *'
+    );
+  });
+});

package/src/proxy/mutation-detector.ts

@@ -13,6 +13,205 @@ export interface DetectedMutation {
   tableName: string;
 }
 
+function isWordStart(ch: string): boolean {
+  return /[A-Za-z_]/.test(ch);
+}
+
+function isWordPart(ch: string): boolean {
+  return /[A-Za-z0-9_$]/.test(ch);
+}
+
+function skipLeadingNoise(sql: string): string {
+  let index = 0;
+  while (index < sql.length) {
+    while (index < sql.length && /[\s;]/.test(sql[index]!)) {
+      index += 1;
+    }
+
+    if (sql.startsWith('--', index)) {
+      index += 2;
+      while (index < sql.length && sql[index] !== '\n') {
+        index += 1;
+      }
+      continue;
+    }
+
+    if (sql.startsWith('/*', index)) {
+      const end = sql.indexOf('*/', index + 2);
+      if (end === -1) return '';
+      index = end + 2;
+      continue;
+    }
+
+    break;
+  }
+
+  return sql.slice(index);
+}
+
+function extractMainStatement(sql: string): string {
+  const normalized = skipLeadingNoise(sql);
+  if (!normalized.toLowerCase().startsWith('with')) {
+    return normalized;
+  }
+
+  const lower = normalized.toLowerCase();
+  const rootKeywords = new Set(['insert', 'update', 'delete', 'select']);
+
+  let index = 0;
+  let depth = 0;
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inLineComment = false;
+  let inBlockComment = false;
+
+  while (index < normalized.length) {
+    const ch = normalized[index]!;
+    const next = normalized[index + 1];
+
+    if (inLineComment) {
+      if (ch === '\n') inLineComment = false;
+      index += 1;
+      continue;
+    }
+    if (inBlockComment) {
+      if (ch === '*' && next === '/') {
+        inBlockComment = false;
+        index += 2;
+        continue;
+      }
+      index += 1;
+      continue;
+    }
+    if (inSingleQuote) {
+      if (ch === "'" && next === "'") {
+        index += 2;
+        continue;
+      }
+      if (ch === "'") inSingleQuote = false;
+      index += 1;
+      continue;
+    }
+    if (inDoubleQuote) {
+      if (ch === '"' && next === '"') {
+        index += 2;
+        continue;
+      }
+      if (ch === '"') inDoubleQuote = false;
+      index += 1;
+      continue;
+    }
+
+    if (ch === '-' && next === '-') {
+      inLineComment = true;
+      index += 2;
+      continue;
+    }
+    if (ch === '/' && next === '*') {
+      inBlockComment = true;
+      index += 2;
+      continue;
+    }
+    if (ch === "'") {
+      inSingleQuote = true;
+      index += 1;
+      continue;
+    }
+    if (ch === '"') {
+      inDoubleQuote = true;
+      index += 1;
+      continue;
+    }
+    if (ch === '(') {
+      depth += 1;
+      index += 1;
+      continue;
+    }
+    if (ch === ')') {
+      if (depth > 0) depth -= 1;
+      index += 1;
+      continue;
+    }
+
+    if (depth === 0 && isWordStart(ch)) {
+      const tokenStart = index;
+      index += 1;
+      while (index < normalized.length && isWordPart(normalized[index]!)) {
+        index += 1;
+      }
+      const token = lower.slice(tokenStart, index);
+      if (
+        token !== 'with' &&
+        token !== 'recursive' &&
+        rootKeywords.has(token)
+      ) {
+        return normalized.slice(tokenStart);
+      }
+      continue;
+    }
+
+    index += 1;
+  }
+
+  return normalized;
+}
+
+function parseIdentifier(
+  input: string,
+  startIndex: number
+): { name: string; nextIndex: number } | null {
+  let index = startIndex;
+  while (index < input.length && /\s/.test(input[index]!)) {
+    index += 1;
+  }
+  if (index >= input.length) return null;
+
+  if (input[index] === '"') {
+    index += 1;
+    let value = '';
+    while (index < input.length) {
+      const ch = input[index]!;
+      if (ch === '"' && input[index + 1] === '"') {
+        value += '"';
+        index += 2;
+        continue;
+      }
+      if (ch === '"') {
+        index += 1;
+        return { name: value, nextIndex: index };
+      }
+      value += ch;
+      index += 1;
+    }
+    return null;
+  }
+
+  if (!isWordStart(input[index]!)) return null;
+  const first = index;
+  index += 1;
+  while (index < input.length && isWordPart(input[index]!)) {
+    index += 1;
+  }
+  return { name: input.slice(first, index), nextIndex: index };
+}
+
+function parseTargetTable(input: string): string | null {
+  const first = parseIdentifier(input, 0);
+  if (!first) return null;
+
+  let index = first.nextIndex;
+  while (index < input.length && /\s/.test(input[index]!)) {
+    index += 1;
+  }
+  if (input[index] !== '.') {
+    return first.name;
+  }
+
+  const second = parseIdentifier(input, index + 1);
+  if (!second) return null;
+  return second.name;
+}
+
 /**
  * Detect if a SQL query is a mutation and extract table info.
  *
@@ -20,39 +219,29 @@ export interface DetectedMutation {
  * @returns Mutation info if detected, null for read queries
  */
 export function detectMutation(sql: string): DetectedMutation | null {
-  const trimmed = sql.trim();
-
-  // INSERT INTO [schema.]table
-  const insertMatch = trimmed.match(
-    /^\s*INSERT\s+INTO\s+(?:["']?(\w+)["']?\.)?["']?(\w+)["']?/i
-  );
-  if (insertMatch) {
-    return {
-      operation: 'upsert',
-      tableName: insertMatch[2]!,
-    };
+  const statement = extractMainStatement(sql).trimStart();
+  const lower = statement.toLowerCase();
+
+  if (lower.startsWith('insert')) {
+    const tableName = parseTargetTable(
+      statement.replace(/^insert\s+into\s+/i, '')
+    );
+    if (!tableName) return null;
+    return { operation: 'upsert', tableName };
   }
 
-  // UPDATE [schema.]table
-  const updateMatch = trimmed.match(
-    /^\s*UPDATE\s+(?:["']?(\w+)["']?\.)?["']?(\w+)["']?/i
-  );
-  if (updateMatch) {
-    return {
-      operation: 'upsert',
-      tableName: updateMatch[2]!,
-    };
+  if (lower.startsWith('update')) {
+    const tableName = parseTargetTable(statement.replace(/^update\s+/i, ''));
+    if (!tableName) return null;
+    return { operation: 'upsert', tableName };
   }
 
-  // DELETE FROM [schema.]table
-  const deleteMatch = trimmed.match(
-    /^\s*DELETE\s+FROM\s+(?:["']?(\w+)["']?\.)?["']?(\w+)["']?/i
-  );
-  if (deleteMatch) {
-    return {
-      operation: 'delete',
-      tableName: deleteMatch[2]!,
-    };
+  if (lower.startsWith('delete')) {
+    const tableName = parseTargetTable(
+      statement.replace(/^delete\s+from\s+/i, '')
+    );
+    if (!tableName) return null;
+    return { operation: 'delete', tableName };
   }
 
   return null;
@@ -66,6 +255,15 @@ export function hasReturningClause(sql: string): boolean {
   return /\bRETURNING\b/i.test(sql);
 }
 
+/**
+ * Check if SQL has a wildcard RETURNING clause (RETURNING * or alias.*).
+ */
+export function hasReturningWildcard(sql: string): boolean {
+  const match = sql.match(/\bRETURNING\b([\s\S]*)$/i);
+  if (!match) return false;
+  return /(^|,)\s*(?:[A-Za-z_][A-Za-z0-9_$]*\.)?\*/i.test(match[1]);
+}
+
 /**
  * Append RETURNING * to a mutation query if not already present.
  *