befly 3.15.1 → 3.15.2

package/dist/checks/checkConfig.js

@@ -1,4 +1,3 @@
-const DB_DIALECT_SET = new Set(["mysql", "postgresql", "sqlite"]);
 function isNonEmptyString(value) {
     return typeof value === "string" && value.trim().length > 0;
 }
@@ -8,39 +7,11 @@ function isValidPort(value) {
 function isValidNonNegativeInt(value) {
     return typeof value === "number" && Number.isFinite(value) && value >= 0 && Math.floor(value) === value;
 }
-function normalizeDbDialect(dialect) {
-    const d = String(dialect || "")
-        .toLowerCase()
-        .trim();
-    if (d === "postgresql")
-        return "postgresql";
-    if (d === "sqlite")
-        return "sqlite";
-    if (d === "mysql")
-        return "mysql";
-    return d;
-}
 function validateDbConfig(db) {
     if (!db) {
         throw new Error("配置错误：缺少 db 配置（config.db）");
     }
-    const dialect = normalizeDbDialect(db.dialect);
-    if (!DB_DIALECT_SET.has(dialect)) {
-        throw new Error(`配置错误：db.dialect 只允许 mysql/postgresql/sqlite，当前值=${String(db.dialect)}`);
-    }
-    // sqlite：database 表示文件路径或 ":memory:"；这里要求非空。
-    if (dialect === "sqlite") {
-        if (!isNonEmptyString(db.database)) {
-            throw new Error(`配置错误：db.dialect=sqlite 时必须设置 db.database（sqlite 文件路径或 :memory:），当前值=${String(db.database)}`);
-        }
-        if (db.poolMax !== undefined) {
-            if (typeof db.poolMax !== "number" || !Number.isFinite(db.poolMax) || db.poolMax <= 0) {
-                throw new Error(`配置错误：db.poolMax 必须为正数，当前值=${String(db.poolMax)}`);
-            }
-        }
-        return;
-    }
-    // mysql/postgresql：必须提供 host/port/username/password/database
+    // MySQL：必须提供 host/port/username/password/database
     if (!isNonEmptyString(db.host)) {
         throw new Error(`配置错误：db.host 必须为非空字符串，当前值=${String(db.host)}`);
     }

package/dist/checks/checkTable.js

@@ -88,10 +88,13 @@ const LOWER_CAMEL_CASE_REGEX = /^_?[a-z][a-z0-9]*(?:[A-Z][a-z0-9]*)*$/;
  * 必须为中文、数字、字母、下划线、短横线、空格
  */
 const FIELD_NAME_REGEX = /^[\u4e00-\u9fa5a-zA-Z0-9 _-]+$/;
-/**
- * VARCHAR 最大长度限制
- */
-const MAX_VARCHAR_LENGTH = 65535;
+// MySQL VARCHAR 最大长度（utf8mb4 下受行大小限制；本项目采用保守上限，用于表定义校验）
+const MAX_VARCHAR_LENGTH = 16383;
+// 项目索引策略（更简单、更保守）：
+// - index=true: 只允许 max<=500
+// - unique=true: 只允许 max<=180
+const MAX_INDEX_STRING_LENGTH_FOR_INDEX = 500;
+const MAX_INDEX_STRING_LENGTH_FOR_UNIQUE = 180;
 /**
  * 检查表定义文件
  * @throws 当检查失败时抛出异常
@@ -261,6 +264,16 @@ export async function checkTable(tables) {
                         Logger.warn(`${tablePrefix}${fileName} 文件 ${colKey} 最大长度 ${fieldMax} 越界，` + `${fieldType} 类型长度必须在 1..${MAX_VARCHAR_LENGTH} 范围内`);
                         hasError = true;
                     }
+                    else {
+                        if (field.index === true && fieldMax > MAX_INDEX_STRING_LENGTH_FOR_INDEX) {
+                            Logger.warn(`${tablePrefix}${fileName} 文件 ${colKey} 设置了 index=true，` + `但 max=${fieldMax} 超出允许范围（要求 <= ${MAX_INDEX_STRING_LENGTH_FOR_INDEX}）`);
+                            hasError = true;
+                        }
+                        if (field.unique === true && fieldMax > MAX_INDEX_STRING_LENGTH_FOR_UNIQUE) {
+                            Logger.warn(`${tablePrefix}${fileName} 文件 ${colKey} 设置了 unique=true，` + `但 max=${fieldMax} 超出允许范围（要求 <= ${MAX_INDEX_STRING_LENGTH_FOR_UNIQUE}）`);
+                            hasError = true;
+                        }
+                    }
                     // default 规则（table 定义专用）：
                     // - string：default 若存在且非 null，必须为 string
                     // - array_*_string：default 若存在且非 null，必须为 string，且建议为 JSON 数组字符串（如 "[]"）

package/dist/index.js

@@ -25,7 +25,7 @@ import { syncApi } from "./sync/syncApi";
 import { syncCache } from "./sync/syncCache";
 import { syncDev } from "./sync/syncDev";
 import { syncMenu } from "./sync/syncMenu";
-import { syncTable } from "./sync/syncTable";
+import { SyncTable } from "./sync/syncTable";
 // 工具
 import { calcPerfTime } from "./utils/calcPerfTime";
 import { getProcessRole } from "./utils/processInfo";
@@ -92,7 +92,7 @@ export class Befly {
             // 注意：这里不做兼容别名（例如 dbHelper=db），要求上下文必须注入标准字段。
             this.assertStartContextReady();
             // 5. 自动同步 (仅主进程执行，避免集群模式下重复执行)
-            await syncTable(this.context, tables);
+            await new SyncTable(this.context).run(tables);
             await syncApi(this.context, apis);
             await syncMenu(this.context, checkedMenus);
             const devEmail = this.config.devEmail;

package/dist/lib/cacheKeys.d.ts

@@ -18,6 +18,4 @@ export declare class CacheKeys {
      * - member: url.pathname（例如 /api/user/login；与 method 无关）
      */
     static roleApis(roleCode: string): string;
-    /** 表结构缓存 */
-    static tableColumns(table: string): string;
 }

package/dist/lib/cacheKeys.js

@@ -26,8 +26,4 @@ export class CacheKeys {
     static roleApis(roleCode) {
         return `role:apis:${roleCode}`;
     }
-    /** 表结构缓存 */
-    static tableColumns(table) {
-        return `table:columns:${table}`;
-    }
 }

package/dist/lib/connect.d.ts

@@ -14,6 +14,8 @@ export declare class Connect {
     private static sqlConnectedAt;
     private static redisConnectedAt;
     private static sqlPoolMax;
+    private static mysqlVersionText;
+    private static mysqlVersionMajor;
     /**
      * 连接 SQL 数据库
      * @returns SQL 客户端实例
@@ -69,6 +71,8 @@ export declare class Connect {
             connectedAt: number | null;
             uptime: number | null;
             poolMax: number;
+            mysqlVersionText: string | null;
+            mysqlVersionMajor: number | null;
         };
         redis: {
             connected: boolean;

package/dist/lib/connect.js

@@ -15,6 +15,9 @@ export class Connect {
     static sqlConnectedAt = null;
     static redisConnectedAt = null;
     static sqlPoolMax = 1;
+    // MySQL 版本信息（用于启动期校验与监控）
+    static mysqlVersionText = null;
+    static mysqlVersionMajor = null;
     // ========================================
     // SQL 连接管理
     // ========================================
@@ -24,51 +27,50 @@ export class Connect {
      */
     static async connectSql(dbConfig) {
         const config = dbConfig || {};
-        // 构建数据库连接字符串
-        const dialect = config.dialect || "mysql";
-        const host = config.host || "127.0.0.1";
-        const port = config.port || 3306;
-        const user = encodeURIComponent(config.username || "root");
-        const password = encodeURIComponent(config.password || "root");
-        const database = encodeURIComponent(config.database || "befly_demo");
-        let finalUrl;
-        if (dialect === "sqlite") {
-            finalUrl = database;
+        // 构建 MySQL 连接字符串（不做隐式默认；缺失直接报错，避免连错库/错密码）
+        const host = typeof config.host === "string" ? config.host.trim() : "";
+        const port = typeof config.port === "number" ? config.port : NaN;
+        const username = typeof config.username === "string" ? config.username.trim() : "";
+        const password = config.password === undefined ? "" : typeof config.password === "string" ? config.password : "";
+        const database = typeof config.database === "string" ? config.database.trim() : "";
+        if (!host) {
+            throw new Error("数据库配置不完整：db.host 缺失");
         }
-        else {
-            if (!host || !database) {
-                throw new Error("数据库配置不完整，请检查配置参数");
-            }
-            finalUrl = `${dialect}://${user}:${password}@${host}:${port}/${database}`;
+        if (!Number.isFinite(port) || port < 1 || port > 65535) {
+            throw new Error(`数据库配置不完整：db.port 非法（当前值：${String(config.port)}）`);
         }
-        let sql;
-        if (dialect === "sqlite") {
-            sql = new SQL(finalUrl);
+        if (!username) {
+            throw new Error("数据库配置不完整：db.username 缺失");
         }
-        else {
-            sql = new SQL({
-                url: finalUrl,
-                max: config.poolMax ?? 1,
-                bigint: false
-            });
+        if (!database) {
+            throw new Error("数据库配置不完整：db.database 缺失");
         }
+        const user = encodeURIComponent(username);
+        const pass = encodeURIComponent(password);
+        const db = encodeURIComponent(database);
+        const finalUrl = `mysql://${user}:${pass}@${host}:${port}/${db}`;
+        const sql = new SQL({
+            url: finalUrl,
+            max: config.poolMax ?? 1,
+            bigint: false
+        });
         try {
             const timeout = 30000;
             const healthCheckPromise = (async () => {
-                let version = "";
-                if (dialect === "sqlite") {
-                    const v = await sql `SELECT sqlite_version() AS version`;
-                    version = v?.[0]?.version;
-                }
-                else if (dialect === "postgresql") {
-                    const v = await sql `SELECT version() AS version`;
-                    version = v?.[0]?.version;
+                const v = await sql `SELECT VERSION() AS version`;
+                const versionText = typeof v?.[0]?.version === "string" ? v?.[0]?.version : String(v?.[0]?.version || "");
+                // 常见格式：8.0.36 / 8.0.36-xxx
+                const majorText = versionText.split(".")[0];
+                const major = Number(majorText);
+                if (!Number.isFinite(major)) {
+                    throw new Error(`无法解析 MySQL 版本信息: ${versionText}`);
                 }
-                else {
-                    const v = await sql `SELECT VERSION() AS version`;
-                    version = v?.[0]?.version;
+                if (major < 8) {
+                    throw new Error(`仅支持 MySQL 8.0+，当前版本：${versionText}`);
                 }
-                return version;
+                this.mysqlVersionText = versionText;
+                this.mysqlVersionMajor = major;
+                return versionText;
             })();
             const timeoutPromise = new Promise((_, reject) => {
                 setTimeout(() => {
@@ -132,11 +134,13 @@ export class Connect {
             const password = config.password || "";
             const db = config.db || 0;
             let auth = "";
-            if (username && password) {
-                auth = `${username}:${password}@`;
+            const encodedUsername = username ? encodeURIComponent(username) : "";
+            const encodedPassword = password ? encodeURIComponent(password) : "";
+            if (encodedUsername && encodedPassword) {
+                auth = `${encodedUsername}:${encodedPassword}@`;
             }
-            else if (password) {
-                auth = `:${password}@`;
+            else if (encodedPassword) {
+                auth = `:${encodedPassword}@`;
             }
             const url = `redis://${auth}${host}:${port}/${db}`;
             const redis = new RedisClient(url, {
@@ -228,7 +232,9 @@ export class Connect {
                 connected: this.sqlClient !== null,
                 connectedAt: this.sqlConnectedAt,
                 uptime: this.sqlConnectedAt ? now - this.sqlConnectedAt : null,
-                poolMax: this.sqlPoolMax
+                poolMax: this.sqlPoolMax,
+                mysqlVersionText: this.mysqlVersionText,
+                mysqlVersionMajor: this.mysqlVersionMajor
             },
             redis: {
                 connected: this.redisClient !== null,
@@ -261,5 +267,7 @@ export class Connect {
         this.sqlConnectedAt = null;
         this.redisConnectedAt = null;
         this.sqlPoolMax = 1;
+        this.mysqlVersionText = null;
+        this.mysqlVersionMajor = null;
     }
 }

package/dist/lib/dbHelper.d.ts

@@ -4,7 +4,6 @@
  */
 import type { WhereConditions, SqlValue } from "../types/common";
 import type { QueryOptions, InsertOptions, UpdateOptions, DeleteOptions, DbPageResult, DbListResult, TransactionCallback, DbResult, ListSql } from "../types/database";
-import type { DbDialect } from "./dbDialect";
 type RedisCacheLike = {
     getObject<T = unknown>(key: string): Promise<T | null>;
     setObject<T = unknown>(key: string, obj: T, ttl?: number | null): Promise<string | null>;
@@ -18,7 +17,7 @@ type SqlClientLike = {
  */
 export declare class DbHelper {
     private redis;
-    private dialect;
+    private dbName;
     private sql;
     private isTransaction;
     /**
@@ -28,8 +27,8 @@ export declare class DbHelper {
      */
     constructor(options: {
         redis: RedisCacheLike;
+        dbName: string;
         sql?: SqlClientLike | null;
-        dialect?: DbDialect;
     });
     private createSqlBuilder;
     private getTableColumns;

package/dist/lib/dbHelper.js

@@ -4,16 +4,22 @@
  */
 import { convertBigIntFields } from "../utils/convertBigIntFields";
 import { fieldClear } from "../utils/fieldClear";
-import { toSqlParams } from "../utils/sqlParams";
-import { toNumberFromSql } from "../utils/sqlResult";
+import { toNumberFromSql, toSqlParams } from "../utils/sqlUtil";
 import { arrayKeysToCamel, isPlainObject, keysToCamel, snakeCase } from "../utils/util";
-import { CacheKeys } from "./cacheKeys";
-import { MySqlDialect } from "./dbDialect";
 import { DbUtils } from "./dbUtils";
 import { Logger } from "./logger";
 import { SqlBuilder } from "./sqlBuilder";
 import { SqlCheck } from "./sqlCheck";
-const TABLE_COLUMNS_CACHE_TTL_SECONDS = 3600;
+function quoteIdentMySql(identifier) {
+    if (typeof identifier !== "string") {
+        throw new Error(`quoteIdentifier 需要字符串类型标识符 (identifier: ${String(identifier)})`);
+    }
+    const trimmed = identifier.trim();
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed)) {
+        throw new Error(`无效的 SQL 标识符: ${trimmed}`);
+    }
+    return `\`${trimmed}\``;
+}
 function hasBegin(sql) {
     return typeof sql.begin === "function";
 }
@@ -35,7 +41,7 @@ class DbSqlError extends Error {
  */
 export class DbHelper {
     redis;
-    dialect;
+    dbName;
     sql = null;
     isTransaction = false;
     /**
@@ -45,38 +51,35 @@ export class DbHelper {
      */
     constructor(options) {
         this.redis = options.redis;
+        if (typeof options.dbName !== "string" || options.dbName.trim() === "") {
+            throw new Error("DbHelper 初始化失败：dbName 必须为非空字符串");
+        }
+        this.dbName = options.dbName;
         this.sql = options.sql || null;
         this.isTransaction = Boolean(options.sql);
-        // 默认使用 MySQL 方言（当前 core 的表结构/语法也主要基于 MySQL）
-        this.dialect = options.dialect ? options.dialect : new MySqlDialect();
     }
     createSqlBuilder() {
-        return new SqlBuilder({ quoteIdent: this.dialect.quoteIdent.bind(this.dialect) });
+        return new SqlBuilder({ quoteIdent: quoteIdentMySql });
     }
     /**
-     * 获取表的所有字段名（Redis 缓存）
+     * 获取表的所有字段名
      * @param table - 表名（下划线格式）
      * @returns 字段名数组（下划线格式）
      */
     async getTableColumns(table) {
-        // 1. 先查 Redis 缓存
-        const cacheKey = CacheKeys.tableColumns(table);
-        const columns = await this.redis.getObject(cacheKey);
-        if (columns && columns.length > 0) {
-            return columns;
-        }
-        // 2. 缓存未命中，查询数据库
-        const query = this.dialect.getTableColumnsQuery(table);
-        const execRes = await this.executeSelect(query.sql, query.params);
+        // 查询数据库
+        const quotedTable = quoteIdentMySql(table);
+        const execRes = await this.executeSelect(`SHOW COLUMNS FROM ${quotedTable}`, []);
         const result = execRes.data;
         if (!result || result.length === 0) {
             throw new Error(`表 ${table} 不存在或没有字段`);
         }
-        const columnNames = this.dialect.getTableColumnsFromResult(result);
-        // 3. 写入 Redis 缓存
-        const cacheRes = await this.redis.setObject(cacheKey, columnNames, TABLE_COLUMNS_CACHE_TTL_SECONDS);
-        if (cacheRes === null) {
-            Logger.warn({ table: table, cacheKey: cacheKey, msg: "表字段缓存写入 Redis 失败" });
+        const columnNames = [];
+        for (const row of result) {
+            const name = row["Field"];
+            if (typeof name === "string" && name.length > 0) {
+                columnNames.push(name);
+            }
         }
         return columnNames;
     }
@@ -215,8 +218,7 @@ export class DbHelper {
     async tableExists(tableName) {
         // 将表名转换为下划线格式
         const snakeTableName = snakeCase(tableName);
-        const query = this.dialect.tableExistsQuery(snakeTableName);
-        const execRes = await this.executeSelect(query.sql, query.params);
+        const execRes = await this.executeSelect("SELECT COUNT(*) as count FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ?", [snakeTableName]);
         const exists = (execRes.data?.[0]?.count || 0) > 0;
         return {
             data: exists,
@@ -608,7 +610,7 @@ export class DbHelper {
             table: snakeTable,
             idField: "id",
             ids: ids,
-            quoteIdent: this.dialect.quoteIdent.bind(this.dialect)
+            quoteIdent: quoteIdentMySql
         });
         const execRes = await this.executeRun(query.sql, query.params);
         const changes = toNumberFromSql(execRes.data?.changes);
@@ -649,7 +651,7 @@ export class DbHelper {
             idField: "id",
             rows: processedList,
             fields: fields,
-            quoteIdent: this.dialect.quoteIdent.bind(this.dialect),
+            quoteIdent: quoteIdentMySql,
             updatedAtField: "updated_at",
             updatedAtValue: now,
             stateField: "state",
@@ -766,7 +768,7 @@ export class DbHelper {
         // 使用 Bun SQL 的 begin 方法开启事务
         // begin 方法会自动处理 commit/rollback
         return await sql.begin(async (tx) => {
-            const trans = new DbHelper({ redis: this.redis, sql: tx, dialect: this.dialect });
+            const trans = new DbHelper({ redis: this.redis, dbName: this.dbName, sql: tx });
             return await callback(trans);
         });
     }
@@ -781,29 +783,29 @@ export class DbHelper {
      * @param options.table - 表名（支持小驼峰或下划线格式，会自动转换）
      */
     async exists(options) {
-        const prepareOptions = {
-            table: options.table,
-            page: 1,
-            limit: 1
-        };
-        if (options.where !== undefined)
-            prepareOptions.where = options.where;
-        if (options.joins !== undefined)
-            prepareOptions.joins = options.joins;
-        const { table, where, tableQualifier } = await this.prepareQueryOptions(prepareOptions);
-        // 使用 COUNT(1) 性能更好
-        const builder = this.createSqlBuilder()
-            .selectRaw("COUNT(1) as cnt")
-            .from(table)
-            .where(DbUtils.addDefaultStateFilter(where, tableQualifier, false))
-            .limit(1);
+        if (Array.isArray(options.joins) && options.joins.length > 0) {
+            throw new Error("exists 不支持 joins（请使用显式 query 或拆分查询）");
+        }
+        const rawTable = typeof options.table === "string" ? options.table.trim() : "";
+        if (!rawTable) {
+            throw new Error("exists.table 不能为空");
+        }
+        if (rawTable.includes(" ")) {
+            throw new Error(`exists 不支持别名表写法（table: ${rawTable}）`);
+        }
+        if (rawTable.includes(".")) {
+            throw new Error(`exists 不支持 schema.table 写法（table: ${rawTable}）`);
+        }
+        const snakeTable = snakeCase(rawTable);
+        const cleanWhere = fieldClear(options.where || {}, { excludeValues: [null, undefined] });
+        const snakeWhere = DbUtils.whereKeysToSnake(cleanWhere);
+        const whereFiltered = DbUtils.addDefaultStateFilter(snakeWhere, snakeTable, false);
+        // 使用 COUNT(1) 实现：语义清晰、适配现有返回结构
+        const builder = this.createSqlBuilder().selectRaw("COUNT(1) as cnt").from(snakeTable).where(whereFiltered).limit(1);
         const { sql, params } = builder.toSelectSql();
         const execRes = await this.executeSelect(sql, params);
         const exists = (execRes.data?.[0]?.cnt || 0) > 0;
-        return {
-            data: exists,
-            sql: execRes.sql
-        };
+        return { data: exists, sql: execRes.sql };
     }
     /**
      * 查询单个字段值（带字段名验证）
@@ -811,6 +813,20 @@ export class DbHelper {
      */
     async getFieldValue(options) {
         const field = options.field;
+        if (Array.isArray(options.joins) && options.joins.length > 0) {
+            throw new Error("getFieldValue 不支持 joins（请使用 getOne/getList 并自行取字段）");
+        }
+        const rawTable = typeof options.table === "string" ? options.table.trim() : "";
+        if (!rawTable) {
+            throw new Error("getFieldValue.table 不能为空");
+        }
+        if (rawTable.includes(" ")) {
+            throw new Error(`getFieldValue 不支持别名表写法（table: ${rawTable}）`);
+        }
+        if (rawTable.includes(".")) {
+            throw new Error(`getFieldValue 不支持 schema.table 写法（table: ${rawTable}）`);
+        }
+        // （其余逻辑保持不变）
         // 验证字段名格式（只允许字母、数字、下划线）
         if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(field)) {
             throw new Error(`无效的字段名: ${field}，只允许字母、数字和下划线`);
@@ -895,8 +911,8 @@ export class DbHelper {
         const builder = this.createSqlBuilder().where(whereFiltered);
         const { sql: whereClause, params: whereParams } = builder.getWhereConditions();
         // 构建安全的 UPDATE SQL（表名和字段名使用反引号转义，已经是下划线格式）
-        const quotedTable = this.dialect.quoteIdent(snakeTable);
-        const quotedField = this.dialect.quoteIdent(snakeField);
+        const quotedTable = quoteIdentMySql(snakeTable);
+        const quotedField = quoteIdentMySql(snakeField);
         const sql = whereClause ? `UPDATE ${quotedTable} SET ${quotedField} = ${quotedField} + ? WHERE ${whereClause}` : `UPDATE ${quotedTable} SET ${quotedField} = ${quotedField} + ?`;
         const execRes = await this.executeRun(sql, [value, ...whereParams]);
         const changes = toNumberFromSql(execRes.data?.changes);

package/dist/lib/dbUtils.js

@@ -1,5 +1,6 @@
 import { fieldClear } from "../utils/fieldClear";
 import { keysToSnake, snakeCase } from "../utils/util";
+import { SqlCheck } from "./sqlCheck";
 export class DbUtils {
     static parseTableRef(tableRef) {
         if (typeof tableRef !== "string") {
@@ -92,11 +93,7 @@ export class DbUtils {
         // 情况2：指定包含字段
         if (classified.type === "include") {
             return classified.fields.map((field) => {
-                // 保留函数和特殊字段
-                if (field.includes("(") || field.includes(" ")) {
-                    return field;
-                }
-                return snakeCase(field);
+                return DbUtils.processJoinField(field);
             });
         }
         // 情况3：排除字段
@@ -124,6 +121,11 @@ export class DbUtils {
         if (fields.some((f) => !f || typeof f !== "string" || f.trim() === "")) {
             throw new Error("fields 不能包含空字符串或无效值");
         }
+        // 统一禁止函数/表达式：复杂表达式请使用 selectRaw/whereRaw
+        for (const rawField of fields) {
+            const checkField = rawField.startsWith("!") ? rawField.substring(1) : rawField;
+            SqlCheck.assertNoExprField(checkField);
+        }
         // 统计包含字段和排除字段
         const includeFields = fields.filter((f) => !f.startsWith("!"));
         const excludeFields = fields.filter((f) => f.startsWith("!"));
@@ -161,8 +163,10 @@ export class DbUtils {
         });
     }
     static processJoinField(field) {
-        // 跳过函数、星号、已处理的字段
-        if (field.includes("(") || field === "*" || field.startsWith("`")) {
+        // 统一禁止函数/表达式：复杂表达式请使用 SqlBuilder.selectRaw
+        SqlCheck.assertNoExprField(field);
+        // 跳过星号、已引用字段
+        if (field === "*" || field.startsWith("`")) {
             return field;
         }
         // 处理别名 AS
@@ -200,6 +204,8 @@ export class DbUtils {
         if (key === "$or" || key === "$and") {
             return key;
         }
+        // 统一禁止函数/表达式：复杂表达式请使用 whereRaw
+        SqlCheck.assertNoExprField(key);
         // 处理带操作符的字段名（如 user.userId$gt）
         if (key.includes("$")) {
             const lastDollarIndex = key.lastIndexOf("$");
@@ -328,6 +334,8 @@ export class DbUtils {
                 result[key] = Array.isArray(value) ? value.map((item) => DbUtils.whereKeysToSnake(item)) : [];
                 continue;
             }
+            // 统一禁止函数/表达式：复杂表达式请使用 whereRaw
+            SqlCheck.assertNoExprField(key);
             // 处理带操作符的字段名（如 userId$gt）
             if (key.includes("$")) {
                 const lastDollarIndex = key.lastIndexOf("$");

package/dist/plugins/db.js

@@ -3,7 +3,6 @@
  * 初始化数据库连接和 SQL 管理器
  */
 import { Connect } from "../lib/connect";
-import { getDialectByName } from "../lib/dbDialect";
 import { DbHelper } from "../lib/dbHelper";
 import { Logger } from "../lib/logger";
 /**
@@ -15,16 +14,17 @@ const dbPlugin = {
     deps: ["logger", "redis"],
     async handler(befly) {
         const env = befly.config?.nodeEnv;
+        const dbName = String(befly.config?.db?.database || "");
+        if (!dbName) {
+            throw new Error("数据库初始化失败：befly.config.db.database 缺失");
+        }
         if (!befly.redis) {
             throw new Error("Redis 未初始化");
         }
         try {
             const sql = Connect.getSql();
-            const rawDbDialect = befly.config?.db?.dialect;
-            const dialectName = rawDbDialect === "postgresql" || rawDbDialect === "sqlite" ? rawDbDialect : "mysql";
-            const dialect = getDialectByName(dialectName);
             // 创建数据库管理器实例
-            const dbManager = new DbHelper({ redis: befly.redis, sql: sql, dialect: dialect });
+            const dbManager = new DbHelper({ redis: befly.redis, dbName: dbName, sql: sql });
             return dbManager;
         }
         catch (error) {

package/dist/sync/syncDev.js

@@ -145,6 +145,8 @@ export async function syncDev(ctx, config = {}) {
                     code: roleConfig.code,
                     name: roleConfig.name,
                     description: roleConfig.description,
+                    menus: [],
+                    apis: [],
                     sort: roleConfig.sort
                 }
             });