fix: the fifteen bugs found by the 2026-07-28 audit

[tiagolauer]

Fixes every issue opened by the 2026-07-28 audit: #228, #229, #230, #231, #232, #233, #234, #235, #236, #237, #238, #239, #240, #241, #242.

One commit per issue, in dependency order — #229 lands before #233 (once strict mode validates the WHERE of a write, the fabricated source would have made every unqualified column ambiguous), and #228 before #238. A single branch rather than a stack: #224 was marked merged while its content never reached master, and this is fifteen changes.

Every fix ships its regression test, and each test was checked to fail against the pre-fix code.

The three that shared a root cause

#228, #229 and #230 were all the same trap: a conditional type whose left side resolves to never.

Alias<X> extends { shape: infer S extends string } ? A : B   // never resolves to A, with S inferred as `string`
T extends string ? A : B                                     // T is a naked type parameter and never, so it distributes to never

• UPDATE/DELETE without FROM/USING gets a phantom source, so strict mode reports a false ambiguous column on RETURNING #229 — SplitAtTopLevelKeyword is never when there is no FROM/USING clause, so ParseFromClause was handed the type string as a table name. ResolveKey<DB, string> matches every table, so every RETURNING column looked like it came from two sources: delete from users where id = 1 returning id returned QueryTypeError<"ambiguous column: id">. Non-strict mode borrowed columns from unrelated tables instead of resolving them to unknown.
• Params collapses to [never] when a $ placeholder carries a cast ($1::int) or a name ($id) #228 — DigitsToCounter is never for anything that isn't all digits, so $1::int and $id were routed into the numbered bucket at slot 0. Two of them intersected into never: a parameter tuple no argument can satisfy. Casts also now bind by index, which is what CleanScanToken stripping them buys.
• Params is never for INSERT ... SELECT, so the query cannot be called at all #230 — AfterValues extends string distributed over never, so an INSERT with no VALUES clause collapsed the whole conditional instead of reaching the documented unknown[]. db.query('insert into users (id, name) select ...') could not be written at all — a rest parameter typed never rejects even the zero-argument call.

The guard used throughout the codebase is [X] extends [never] ? ... : ...; these three were the places it was missing.

Type layer

• OUTPUT $action is counted as a placeholder: extra argument and a false placeholder-style error on MERGE #231 — $action is a MERGE pseudo-column, and ResolveColumnType already typed it as such, but IsPlaceholder matched any $…. So a MERGE with output $action demanded an extra argument and reported the query as dollar-styled, failing the placeholder-style check against the mssql executor — the only dialect that has MERGE OUTPUT at all.
• a semicolon inside a quoted identifier is read as a stacked statement #232 — quoted identifiers are deliberately left intact by the masking pass, which makes their bodies the last place raw punctuation survives. Two things read that punctuation as SQL: the stacked-statement guard, and RemoveSemicolons, which scrubbed every semicolon rather than the trailing one and so mangled "id;x" even once the guard passed. Both fixed; all three quoting styles covered.
• strict mode never checks the WHERE clause of an UPDATE/DELETE without RETURNING #233 — a write without RETURNING projects nothing, and the empty-row short circuit returned before the clause check ran. Strict mode is documented as covering the WHERE clause; it skipped the two statements where a wrong condition costs the most.
• :name placeholders type to an empty tuple even though the node:sqlite adapter binds them #238 — SQLITE_PARAM_PREFIXES has bound : since the adapter was written, but the type layer produced an empty tuple for where id = :id and strict mode reported :id as an unknown column.

Runtime

• the named-parameter scanners don't skip SQL comments, so every binding after a comment shifts #234 — both parameter scanners walked past -- and /* */ comments as if they were SQL. Binding is positional, so a @word in a comment ate one value and the last real placeholder got null. Params<DB, Q> is computed from text that does strip comments, so nothing at compile time could see the disagreement. The two near-identical loops are now one walker.
• createMssqlExecutor(request) throws on the second query and leaks parameters between calls #235 — MssqlQueryable accepts a Request, node-mssql refuses input() for a name it has already declared, and nothing clears the bag between calls. So a caller-supplied Request worked exactly once per parameter name. The test fake now mirrors node-mssql's real input() contract instead of accepting everything.
• node:sqlite: WITH ... INSERT reports no rowCount, and INSERT ... RETURNING reports no meta at all #237 — a CTE-led write was classified by its first word (with) and lost its row count; a write with RETURNING goes down all() and reported no metadata at all. The RETURNING counters are read back off the connection best-effort: metadata is the bonus, the rows are the answer.

CLI and editor plugin

• CLI: --url file:./app.db is detected as SQLite but the file: prefix is never stripped #236 — file:./app.db was detected as SQLite but the prefix was never stripped, so the file was reported missing under a path nobody wrote.
• CLI: a SQL Server named instance (host\INSTANCE) fails with a bare Invalid URL #239 — host\INSTANCE is the default Windows shape and a backslash is a forbidden host character, so new URL rejected it outright. Now parsed into the driver's instanceName, and a genuinely malformed URL gets a message saying what a valid one looks like — carrying no part of the URL, so a password cannot leak through it.
• CLI: --table/--exclude names that match no table are silently ignored #240 — --table users,ordrs generated a schema without the typo'd table and printed Wrote ./schema.ts. Now an error. An unmatched --exclude only warns: excluding a table that isn't there is still the outcome asked for.
• CLI: boolean flags accept a value, so --check=false turns the check on #241 — --check=false turned the check on and exited 1 on drift.
• ts-plugin: from a join b loses the joined table, producing a false unknown alias #242 — the plugin's source scanner consumed the word after a table as a candidate alias. With no alias on the first table that word was the next join keyword, so the joined table was never scanned and every reference to it read as an unknown alias. Only the bare a join b broke — with inner join or an alias the consumed word was something else — which is exactly the shape the existing tests covered. JOIN ... USING and comma-joined FROM lists are handled too, and findSourceByAlias now falls back to the table name like the type-level resolver, so a source the heuristic misses means no diagnostic rather than a wrong one.

Verification

• 179 runtime tests (was 156) and 4 tsconfigs green; 153 ts-plugin tests (was 142) green.
• Type budget: 170,045 instantiations, 92% of the 185,000 ceiling (baseline was 166,512 / 90%). The +2.1% is the case-insensitive $action strip and the quoted-identifier mask, both on paths every query touches. Under budget, so the ceiling is left where it is.
• Integration tests not run here — they need the compose stack.

🤖 Generated with Claude Code