chore: resolve PR #65 conflicts

.github/workflows/claude-code-review.yml

@@ -10,6 +10,8 @@ on:
     #   - "src/**/*.js"
     #   - "src/**/*.jsx"
 
+permissions: {}
+
 jobs:
   claude-review:
     if: github.event.pull_request.head.repo.full_name == github.repository
@@ -60,6 +62,7 @@ jobs:
         uses: anthropics/claude-code-action@2cc1ac1331eac7a6a96d716dd204dd2888d0fcd2 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          allowed_bots: 'prd-carapulse'
           claude_args: "--model claude-opus-4-6"
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'

.github/workflows/claude.yml

@@ -10,6 +10,8 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions: {}
+
 jobs:
   claude:
     if: |

.github/workflows/scorecards.yml

@@ -14,8 +14,7 @@ on:
   push:
     branches: ["main"]
 
-# Declare default permissions as read only.
-permissions: read-all
+permissions: {}
 
 jobs:
   analysis:

architecture/evm/eth_call.go

@@ -89,6 +89,13 @@ func projectPreForward_eth_call(ctx context.Context, network common.Network, nq
 		return false, nil, nil
 	}
 
+	// Diagnostic mode: skip eth_call-specific pre-forward (multicall3 batching,
+	// param normalization, cache pre-check) so the request reaches Network.Forward
+	// unwrapped and each upstream is probed with the original payload.
+	if nq.ShouldCheckAllUpstreams() {
+		return false, nil, nil
+	}
+
 	// Normalize params: ensure block param is present
 	jrq.RLock()
 	paramsLen := len(jrq.Params)

common/postgresql_identifier.go

@@ -0,0 +1,44 @@
+package common
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+)
+
+// ValidatePostgreSQLTableIdentifier rejects table identifiers that cannot be
+// safely interpolated after pgx identifier quoting.
+func ValidatePostgreSQLTableIdentifier(name string) error {
+	_, err := PostgreSQLTableIdentifierParts(name)
+	return err
+}
+
+// PostgreSQLTableIdentifierParts returns one table component or schema/table
+// components after validating each component as an unquoted PostgreSQL identifier.
+func PostgreSQLTableIdentifierParts(name string) ([]string, error) {
+	parts := strings.Split(name, ".")
+	if len(parts) > 2 {
+		return nil, fmt.Errorf("postgres table identifier %q: too many qualifying parts", name)
+	}
+	for _, part := range parts {
+		if !isPostgreSQLIdentifierComponent(part) {
+			return nil, fmt.Errorf("postgres table identifier %q: invalid component %q", name, part)
+		}
+	}
+	return parts, nil
+}
+
+func isPostgreSQLIdentifierComponent(name string) bool {
+	for i, r := range name {
+		if i == 0 {
+			if r != '_' && !unicode.IsLetter(r) {
+				return false
+			}
+			continue
+		}
+		if r != '_' && r != '$' && !unicode.IsLetter(r) && !unicode.IsDigit(r) {
+			return false
+		}
+	}
+	return name != ""
+}

common/postgresql_identifier_test.go

@@ -0,0 +1,54 @@
+package common
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPostgreSQLConnectorConfigValidateTableIdentifier(t *testing.T) {
+	baseConfig := func(table string) *PostgreSQLConnectorConfig {
+		return &PostgreSQLConnectorConfig{
+			Table:         table,
+			ConnectionUri: "postgres://user:pass@localhost/db?sslmode=disable",
+			InitTimeout:   Duration(time.Second),
+			GetTimeout:    Duration(time.Second),
+			SetTimeout:    Duration(time.Second),
+			MinConns:      1,
+			MaxConns:      2,
+		}
+	}
+
+	for _, table := range []string{
+		"erpc_json_rpc_cache",
+		"myschema.cache",
+		"_schema.table_1",
+		"CamelCase",
+		"schema.cache$2026",
+		"\u00e9rpc_cache",
+	} {
+		t.Run("valid_"+table, func(t *testing.T) {
+			require.NoError(t, baseConfig(table).Validate())
+		})
+	}
+
+	for _, table := range []string{
+		"; DROP TABLE foo; --",
+		"schema.table.extra",
+		"bad-name",
+		"1table",
+		".table",
+		"schema.",
+		"schema.*",
+		"$table",
+		"schema.$cache",
+		"table name",
+	} {
+		t.Run("invalid_"+table, func(t *testing.T) {
+			err := baseConfig(table).Validate()
+			require.Error(t, err)
+			require.ErrorContains(t, err, "database.*.connector.postgresql.table is invalid")
+		})
+	}
+}

common/request.go

@@ -44,6 +44,7 @@ const (
 	headerDirectiveSkipCacheRead              = "X-ERPC-Skip-Cache-Read"
 	headerDirectiveCacheMaxAge                = "X-ERPC-Cache-Max-Age"
 	headerDirectiveUseUpstream                = "X-ERPC-Use-Upstream"
+	headerDirectiveCheckAllUpstreams          = "X-ERPC-Check-All-Upstreams"
 	headerDirectiveSkipInterpolation          = "X-ERPC-Skip-Interpolation"
 	headerDirectiveEnforceHighestBlock        = "X-ERPC-Enforce-Highest-Block"
 	headerDirectiveEnforceGetLogsRange        = "X-ERPC-Enforce-GetLogs-Range"
@@ -70,6 +71,7 @@ const (
 	queryDirectiveSkipCacheRead              = "skip-cache-read"
 	queryDirectiveCacheMaxAge                = "cache-max-age"
 	queryDirectiveUseUpstream                = "use-upstream"
+	queryDirectiveCheckAllUpstreams          = "check-all-upstreams"
 	queryDirectiveSkipInterpolation          = "skip-interpolation"
 	queryDirectiveEnforceHighestBlock        = "enforce-highest-block"
 	queryDirectiveEnforceGetLogsRange        = "enforce-getlogs-range"
@@ -96,6 +98,7 @@ var directiveKeyRegistry = []directiveKeyNames{
 	{header: headerDirectiveSkipCacheRead, query: queryDirectiveSkipCacheRead},
 	{header: headerDirectiveCacheMaxAge, query: queryDirectiveCacheMaxAge},
 	{header: headerDirectiveUseUpstream, query: queryDirectiveUseUpstream},
+	{header: headerDirectiveCheckAllUpstreams, query: queryDirectiveCheckAllUpstreams},
 	{header: headerDirectiveSkipInterpolation, query: queryDirectiveSkipInterpolation},
 	{header: headerDirectiveEnforceHighestBlock, query: queryDirectiveEnforceHighestBlock},
 	{header: headerDirectiveEnforceGetLogsRange, query: queryDirectiveEnforceGetLogsRange},
@@ -151,6 +154,16 @@ type RequestDirectives struct {
 	// For example "alchemy" or "my-own-*", etc.
 	UseUpstream string `json:"useUpstream,omitempty"`
 
+	// CheckAllUpstreams instructs the network to execute this request against
+	// every selected upstream and return a diagnostic result instead of the
+	// first usable upstream response. It is intended for probing provider-specific
+	// limits such as calldata, returndata, and gas limits.
+	//
+	// Setting this also bypasses request multiplexing and cache reads/writes
+	// for the originating request, and disables eth_call multicall3 batching,
+	// so each upstream is probed with the original payload.
+	CheckAllUpstreams bool `json:"checkAllUpstreams,omitempty"`
+
 	// Instruct the proxy to bypass method exclusion checks.
 	ByPassMethodExclusion bool `json:"-"`
 
@@ -247,6 +260,7 @@ func (d *RequestDirectives) Clone() *RequestDirectives {
 		SkipCacheRead:                   d.SkipCacheRead,
 		CacheMaxAgeSeconds:              nil,
 		UseUpstream:                     d.UseUpstream,
+		CheckAllUpstreams:               d.CheckAllUpstreams,
 		ByPassMethodExclusion:           d.ByPassMethodExclusion,
 		SkipInterpolation:               d.SkipInterpolation,
 		EnforceHighestBlock:             d.EnforceHighestBlock,
@@ -733,6 +747,9 @@ func (r *NormalizedRequest) EnrichFromHttp(headers http.Header, queryArgs url.Va
 	if hv := headers.Get(headerDirectiveUseUpstream); hv != "" {
 		r.directives.UseUpstream = hv
 	}
+	if hv := headers.Get(headerDirectiveCheckAllUpstreams); hv != "" {
+		r.directives.CheckAllUpstreams = strings.ToLower(strings.TrimSpace(hv)) == "true"
+	}
 	if hv := headers.Get(headerDirectiveSkipInterpolation); hv != "" {
 		r.directives.SkipInterpolation = strings.ToLower(strings.TrimSpace(hv)) == "true"
 	}
@@ -801,6 +818,9 @@ func (r *NormalizedRequest) EnrichFromHttp(headers http.Header, queryArgs url.Va
 	if useUpstream := queryArgs.Get(queryDirectiveUseUpstream); useUpstream != "" {
 		r.directives.UseUpstream = strings.TrimSpace(useUpstream)
 	}
+	if checkAllUpstreams := queryArgs.Get(queryDirectiveCheckAllUpstreams); checkAllUpstreams != "" {
+		r.directives.CheckAllUpstreams = strings.ToLower(strings.TrimSpace(checkAllUpstreams)) == "true"
+	}
 
 	if retryEmpty := queryArgs.Get(queryDirectiveRetryEmpty); retryEmpty != "" {
 		r.directives.RetryEmpty = strings.ToLower(strings.TrimSpace(retryEmpty)) == "true"
@@ -924,6 +944,13 @@ func (r *NormalizedRequest) CacheMaxAgeExplicit() bool {
 	return r.directives.CacheMaxAgeExplicit
 }
 
+func (r *NormalizedRequest) ShouldCheckAllUpstreams() bool {
+	if r == nil || r.directives == nil {
+		return false
+	}
+	return r.directives.CheckAllUpstreams
+}
+
 func (r *NormalizedRequest) Directives() *RequestDirectives {
 	if r == nil {
 		return nil

common/request_test.go

@@ -372,6 +372,73 @@ func TestEnrichFromHttp_CacheMaxAgeDirective(t *testing.T) {
 	})
 }
 
+func TestEnrichFromHttp_CheckAllUpstreamsDirective(t *testing.T) {
+	t.Run("header_sets_directive", func(t *testing.T) {
+		req := NewNormalizedRequest([]byte(`{"jsonrpc":"2.0","id":1,"method":"eth_call"}`))
+		headers := http.Header{}
+		headers.Set("X-ERPC-Check-All-Upstreams", "true")
+
+		req.EnrichFromHttp(headers, nil, UserAgentTrackingModeSimplified)
+
+		if dir := req.Directives(); dir == nil || !dir.CheckAllUpstreams {
+			t.Fatalf("expected CheckAllUpstreams=true after header directive")
+		}
+	})
+
+	t.Run("query_sets_directive", func(t *testing.T) {
+		req := NewNormalizedRequest([]byte(`{"jsonrpc":"2.0","id":1,"method":"eth_call"}`))
+		query := url.Values{}
+		query.Set("check-all-upstreams", "true")
+
+		req.EnrichFromHttp(nil, query, UserAgentTrackingModeSimplified)
+
+		if dir := req.Directives(); dir == nil || !dir.CheckAllUpstreams {
+			t.Fatalf("expected CheckAllUpstreams=true after query directive")
+		}
+	})
+
+	t.Run("parsing_edge_cases", func(t *testing.T) {
+		cases := []struct {
+			value   string
+			enabled bool
+		}{
+			{"true", true},
+			{"TRUE", true},
+			{" true ", true},
+			{"false", false},
+			{"FALSE", false},
+			{"1", false},  // only literal "true" (case-insensitive) enables
+			{"yes", false},
+			{"", false},   // empty value should leave directive unchanged
+		}
+		for _, tc := range cases {
+			t.Run("header="+tc.value, func(t *testing.T) {
+				req := NewNormalizedRequest([]byte(`{"jsonrpc":"2.0","id":1,"method":"eth_call"}`))
+				headers := http.Header{}
+				if tc.value != "" {
+					headers.Set("X-ERPC-Check-All-Upstreams", tc.value)
+				}
+				req.EnrichFromHttp(headers, nil, UserAgentTrackingModeSimplified)
+				if got := req.Directives() != nil && req.Directives().CheckAllUpstreams; got != tc.enabled {
+					t.Fatalf("value=%q: expected CheckAllUpstreams=%v, got %v", tc.value, tc.enabled, got)
+				}
+			})
+		}
+	})
+}
+
+func TestShouldCheckAllUpstreams_NilSafety(t *testing.T) {
+	var nilReq *NormalizedRequest
+	if nilReq.ShouldCheckAllUpstreams() {
+		t.Fatalf("expected false from nil receiver")
+	}
+
+	req := NewNormalizedRequest([]byte(`{"jsonrpc":"2.0","id":1,"method":"eth_call"}`))
+	if req.ShouldCheckAllUpstreams() {
+		t.Fatalf("expected false from request with no directives set")
+	}
+}
+
 // TestHeaderOverridesConfigDefault_ValidateTransactionsRoot verifies that when the
 // config defaults set ValidateTransactionsRoot=true, a header/query-string can
 // override it to false.

common/validation.go

@@ -555,6 +555,9 @@ func (p *PostgreSQLConnectorConfig) Validate() error {
 	if p.Table == "" {
 		return fmt.Errorf("database.*.connector.postgresql.table is required")
 	}
+	if err := ValidatePostgreSQLTableIdentifier(p.Table); err != nil {
+		return fmt.Errorf("database.*.connector.postgresql.table is invalid: %w", err)
+	}
 	if p.MinConns == 0 {
 		return fmt.Errorf("database.*.connector.postgresql.minConns is required")
 	}