jsql-neo 4.0.2 → 4.1.0

package/lib/mysql_server.js

@@ -6,7 +6,9 @@
 
 const net = require('net');
 const crypto = require('crypto');
-const { executeSQL } = require('./sql');
+const path = require('path');
+const fs = require('fs');
+const { executeSQL, parseSQL, splitStatements } = require('./sql');
 const Database = require('./database');
 
 const SERVER_VERSION = '8.0.0-jsql-neo';
@@ -162,7 +164,7 @@ function columnTypeFromSchema(def) {
   return MYSQL_TYPE_VAR_STRING;
 }
 
-function resultSetPacket(result, tableSchema, baseSeq) {
+function resultSetPacket(result, tableSchema, baseSeq, rawRow) {
   const packets = [];
   let sequence = baseSeq || 0;
   const push = (buf) => {
@@ -174,12 +176,28 @@ function resultSetPacket(result, tableSchema, baseSeq) {
     packets.push(buf);
   };
 
+  const inferType = (name, value) => {
+    if (tableSchema && tableSchema[name]) return columnTypeFromSchema(tableSchema[name]);
+    if (value === null || value === undefined) return MYSQL_TYPE_NULL;
+    if (typeof value === 'number') return Number.isInteger(value) ? MYSQL_TYPE_LONGLONG : MYSQL_TYPE_DOUBLE;
+    if (typeof value === 'boolean') return MYSQL_TYPE_TINY;
+    if (typeof value === 'object') return MYSQL_TYPE_JSON;
+    return MYSQL_TYPE_VAR_STRING;
+  };
+
   push(encodeLenenc((result.columns || []).length));
-  for (const name of result.columns || []) {
+  const sampleRow = (result.rows && result.rows[0]) || null;
+  for (let ci = 0; ci < (result.columns || []).length; ci++) {
+    const name = result.columns[ci];
+    let sample;
+    if (sampleRow !== null) {
+      if (Array.isArray(sampleRow)) sample = sampleRow[ci];
+      else sample = sampleRow[name];
+    }
     const col = {
       name,
       table: result.table || '',
-      type: tableSchema && tableSchema[name] ? columnTypeFromSchema(tableSchema[name]) : MYSQL_TYPE_VAR_STRING,
+      type: inferType(name, sample),
       length: 1024,
     };
     push(columnDefinition(col));
@@ -192,6 +210,8 @@ function resultSetPacket(result, tableSchema, baseSeq) {
       const v = row[i];
       if (v === null || v === undefined) {
         parts.push(Buffer.from([0xfb]));
+      } else if (typeof v === 'boolean') {
+        parts.push(encodeLenencString(v ? '1' : '0'));
       } else if (typeof v === 'object') {
         parts.push(encodeLenencString(JSON.stringify(v)));
       } else {
@@ -227,9 +247,22 @@ class MysqlConnection {
     }
     this.socket.on('data', chunk => this._onData(chunk));
     this.socket.on('error', () => {});
+    this._armIdleTimer();
     this._send(handshakePacket(this.connectionId, this.seed));
   }
 
+  _armIdleTimer() {
+    if (this._idleTimer) { clearTimeout(this._idleTimer); this._idleTimer = null; }
+    const ttl = this.server.idleTimeout;
+    if (!this.authenticated) return;
+    if (ttl <= 0) return;
+    this._idleTimer = setTimeout(() => {
+      this.server._onSecurityEvent({ type: 'idle-timeout', user: this.user, remote: this.socket.remoteAddress });
+      this.socket.destroy();
+    }, ttl);
+    this._idleTimer.unref();
+  }
+
   _send(payload) {
     if (!this.socket.writable) return;
     const header = Buffer.alloc(4);
@@ -241,6 +274,7 @@ class MysqlConnection {
 
   _onData(chunk) {
     this.buffer = Buffer.concat([this.buffer, chunk]);
+    this._armIdleTimer();
     if (this.buffer.length > this.server.maxPacketSize + 4) {
       this._malicious('packet exceeds maxPacketSize (' + this.server.maxPacketSize + ')');
       return;
@@ -280,12 +314,13 @@ class MysqlConnection {
         case 0x01: this.socket.end(); break; // COM_QUIT
         case 0x02: { // COM_INIT_DB
           const db = body.toString('utf8');
-          if (!/^[a-zA-Z0-9_$.\-]+$/.test(db)) {
+          if (!this.server._safeDbName(db)) {
             this._malicious('COM_INIT_DB with invalid database name');
             return;
           }
-          this.currentDb = db;
-          this._send(okPacket());
+          this.server._switchDb(this, db)
+            .then(() => this._send(okPacket()))
+            .catch(e => this._send(errPacket(e.code || 1049, e.message)));
           break;
         }
         case 0x03: {
@@ -297,6 +332,7 @@ class MysqlConnection {
           this._handleQuery(sql);
           break;
         }
+        case 0x11: this._handleChangeUser(body, cmdSeq); break; // COM_CHANGE_USER
         case 0x0e: this._send(okPacket()); break; // COM_PING
         case 0x1f: this._send(okPacket()); break; // COM_RESET_CONNECTION
         case 0x0a: { // COM_PROCESS_INFO
@@ -318,7 +354,56 @@ class MysqlConnection {
     }
   }
 
-  _handleAuth(payload) {
+  _handleChangeUser(body, cmdSeq) {
+    (async () => {
+      try {
+        let pos = 0;
+        const userEnd = body.indexOf(0, pos);
+        if (userEnd === -1) throw new Error('malformed COM_CHANGE_USER');
+        const user = body.slice(pos, userEnd).toString('utf8');
+        pos = userEnd + 1;
+        const lenenc = parseLenenc(body, pos);
+        let authResponse = Buffer.alloc(0);
+        if (lenenc.value !== null) {
+          authResponse = body.slice(pos + lenenc.size, pos + lenenc.size + lenenc.value);
+          pos += lenenc.size + lenenc.value;
+        } else {
+          pos += lenenc.size;
+        }
+        let db = null;
+        if (pos < body.length) {
+          const dbEnd = body.indexOf(0, pos);
+          if (dbEnd !== -1) {
+            db = body.slice(pos, dbEnd).toString('utf8');
+          }
+        }
+        const valid = this.server._checkAuth(user, authResponse, this.seed);
+        if (!valid) {
+          this._send(errPacket(1045, `Access denied for user '${user}'`));
+          return;
+        }
+        if (db) {
+          if (!this.server._canAccessDb(user, db)) {
+            this._send(errPacket(1044, `Access denied for user '${user}' to database '${db}'`));
+            return;
+          }
+          try {
+            await this.server._getDatabase(db);
+          } catch (e) {
+            this._send(errPacket(1049, `Unknown database '${db}'`));
+            return;
+          }
+        }
+        this.user = user;
+        this.currentDb = db;
+        this._send(okPacket());
+      } catch (e) {
+        this._send(errPacket(toMysqlErrno(e), e.message));
+      }
+    })();
+  }
+
+  async _handleAuth(payload) {
     try {
       const caps = payload.readUInt32LE(0);
       let pos = 32; // 4 caps + 4 maxpacket + 1 charset + 23 reserved
@@ -365,6 +450,22 @@ class MysqlConnection {
       this.multiStatements = !!(caps & CLIENT_MULTI_STATEMENTS);
       this.authenticated = true;
       if (this._authTimer) { clearTimeout(this._authTimer); this._authTimer = null; }
+      this._armIdleTimer();
+      if (db) {
+        if (!this.server._canAccessDb(this.user, db)) {
+          this._send(errPacket(1044, `Access denied for user '${this.user}' to database '${db}'`));
+          this.socket.end();
+          return;
+        }
+        try {
+          await this.server._getDatabase(db);
+          this.currentDb = db;
+        } catch (e) {
+          this._send(errPacket(1049, `Unknown database '${db}'`));
+          this.socket.end();
+          return;
+        }
+      }
       this._send(okPacket());
     } catch (e) {
       this._send(errPacket(1105, 'auth failed: ' + e.message));
@@ -375,17 +476,64 @@ class MysqlConnection {
   _handleQuery(sql) {
     (async () => {
       try {
-        const results = await executeSQL(this.server._engine, sql, {
-          allowComments: this.server.allowComments,
-          safety: this.server.safety,
-          maxStatements: this.multiStatements ? null : 1,
-        });
-        const list = Array.isArray(results) ? results : [results];
-        for (const r of list) {
+        const statements = splitStatements(sql);
+        if (statements.length > 1 && !this.multiStatements) {
+          throw new Error(`too many statements (${statements.length} > 1)`);
+        }
+        for (const stmtSql of statements) {
+          const stmt = parseSQL(stmtSql);
+          switch (stmt.type) {
+            case 'use': {
+              if (!this.server._canAccessDb(this.user, stmt.database)) {
+                this._send(errPacket(1044, `Access denied for user '${this.user}' to database '${stmt.database}'`));
+                continue;
+              }
+              try {
+                await this.server._getDatabase(stmt.database);
+                this.currentDb = stmt.database;
+                this._send(okPacket());
+              } catch (e) {
+                this._send(errPacket(1049, `Unknown database '${stmt.database}'`));
+              }
+              continue;
+            }
+            case 'showDatabases': {
+              const dbs = await this.server.listDatabases();
+              const allowed = this.server._userDbList(this.user);
+              const names = allowed === null ? dbs : dbs.filter(n => allowed.includes(n));
+              const { packets, sequence } = resultSetPacket({
+                type: 'showDatabases', columns: ['Database'], rows: names.map(n => [n]),
+              }, null, this.sequence);
+              this.sequence = sequence;
+              this.socket.write(Buffer.concat(packets));
+              continue;
+            }
+            case 'createDatabase': {
+              if (!this.server._canAccessDb(this.user, stmt.database)) {
+                this._send(errPacket(1044, `Access denied for user '${this.user}' to database '${stmt.database}'`));
+                continue;
+              }
+              await this.server.createDatabase(stmt.database, { ifNotExists: stmt.ifNotExists });
+              this._send(okPacket());
+              continue;
+            }
+            case 'dropDatabase': {
+              await this.server.dropDatabase(stmt.database, { ifExists: stmt.ifExists });
+              this._send(okPacket());
+              continue;
+            }
+            default:
+              break;
+          }
+          const engine = await this.server._getEngine(this.currentDb);
+          const r = await executeSQL(engine, stmtSql, {
+            allowComments: this.server.allowComments,
+            safety: this.server.safety,
+            maxStatements: 1,
+          });
           if (r.type === 'select' || r.type === 'showTables' || r.type === 'showDatabases' || r.type === 'describe') {
             let schema = null;
             if (r.table) {
-              const engine = this.server._engine;
               schema = engine.getTableSchema
                 ? await engine.getTableSchema(r.table)
                 : (engine._schemas ? engine._schemas[r.table] : null);
@@ -413,13 +561,16 @@ class MysqlServer {
     this.password = options.password || null;
     this.auth = options.auth || null;
     this.safety = options.safety !== false;
-    this.allowComments = options.allowComments !== false;
+    this.allowComments = options.allowComments === true;
     this.maxPacketSize = options.maxPacketSize || 1024 * 1024;
     this.handshakeTimeout = options.handshakeTimeout != null ? options.handshakeTimeout : 10000;
+    this.idleTimeout = options.idleTimeout != null ? options.idleTimeout : 300000;
     this.maxAuthFails = options.maxAuthFails || 3;
     this.maxConnections = options.maxConnections || 128;
     this._engine = null;
     this._ownEngine = false;
+    this._databases = new Map();
+    this._dbDir = options.dataDir ? path.resolve(options.dataDir) : null;
     this._connectionCounter = 0;
     this._sockets = new Set();
     this._securityHandler = typeof options.onSecurityEvent === 'function' ? options.onSecurityEvent : null;
@@ -431,7 +582,13 @@ class MysqlServer {
     }
   }
 
-  async _getEngine() {
+  async _getEngine(dbName) {
+    if (dbName) return this._getDatabase(dbName);
+    if (this._dbDir) {
+      const err = new Error(`No database selected`);
+      err.code = 1046;
+      throw err;
+    }
     if (this._engine) return this._engine;
     if (this.options.engine || this.options.database) {
       this._engine = this.options.engine || this.options.database;
@@ -444,10 +601,133 @@ class MysqlServer {
     return this._engine;
   }
 
+  _safeDbName(name) {
+    if (typeof name !== 'string' || name.length === 0 || name.length > 64) return false;
+    if (!/^[a-zA-Z0-9_$.\-]+$/.test(name)) return false;
+    if (name === '.' || name === '..' || name.includes('..')) return false;
+    return true;
+  }
+
+  _dbPath(name) {
+    if (!this._dbDir) return null;
+    if (!this._safeDbName(name)) return null;
+    return path.join(this._dbDir, name);
+  }
+
+  async _getDatabase(name) {
+    if (!this._safeDbName(name)) {
+      const err = new Error(`Unknown database '${name}'`);
+      err.code = 1049;
+      throw err;
+    }
+    if (this._databases.has(name)) return this._databases.get(name);
+    const dir = this._dbPath(name);
+    if (dir && !fs.existsSync(dir)) {
+      const err = new Error(`Unknown database '${name}'`);
+      err.code = 1049;
+      throw err;
+    }
+    const engine = dir ? new Database(dir, { mode: 'hybrid' }) : new Database(':memory:');
+    if (typeof engine.start === 'function') await engine.start();
+    this._databases.set(name, engine);
+    return engine;
+  }
+
+  async listDatabases() {
+    if (!this._dbDir) return ['jsql'];
+    let names = [];
+    if (fs.existsSync(this._dbDir)) {
+      names = fs.readdirSync(this._dbDir).filter(n => {
+        const p = path.join(this._dbDir, n);
+        return fs.statSync(p).isDirectory() && this._safeDbName(n);
+      });
+    }
+    for (const n of this._databases.keys()) {
+      if (!names.includes(n)) names.push(n);
+    }
+    return names.sort();
+  }
+
+  async createDatabase(name, opts = {}) {
+    if (!this._safeDbName(name)) {
+      const err = new Error(`Invalid database name '${name}'`);
+      err.code = 1105;
+      throw err;
+    }
+    if (this._databases.has(name)) {
+      if (opts.ifNotExists) return this._databases.get(name);
+      const err = new Error(`Can't create database '${name}'; database exists`);
+      err.code = 1007;
+      throw err;
+    }
+    const dir = this._dbPath(name);
+    if (dir && fs.existsSync(dir)) {
+      if (opts.ifNotExists) return this._getDatabase(name);
+      const err = new Error(`Can't create database '${name}'; database exists`);
+      err.code = 1007;
+      throw err;
+    }
+    if (dir) fs.mkdirSync(dir, { recursive: true });
+    const engine = dir ? new Database(dir, { mode: 'hybrid' }) : new Database(':memory:');
+    if (typeof engine.start === 'function') await engine.start();
+    this._databases.set(name, engine);
+    return engine;
+  }
+
+  async dropDatabase(name, opts = {}) {
+    if (!this._safeDbName(name)) {
+      const err = new Error(`Unknown database '${name}'`);
+      err.code = 1049;
+      throw err;
+    }
+    const engine = this._databases.get(name);
+    if (!engine) {
+      if (opts.ifExists) return;
+      const err = new Error(`Can't drop database '${name}'; database doesn't exist`);
+      err.code = 1008;
+      throw err;
+    }
+    if (typeof engine.stop === 'function') {
+      try { await engine.stop(); } catch (e) {}
+    }
+    this._databases.delete(name);
+    const dir = this._dbPath(name);
+    if (dir && fs.existsSync(dir)) {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  }
+
+  _userDbList(user) {
+    if (!this.auth) return null;
+    const entry = this.auth[user];
+    if (entry && typeof entry === 'object') {
+      if (Array.isArray(entry.databases)) return entry.databases;
+      return null;
+    }
+    return [];
+  }
+
+  _canAccessDb(user, dbName) {
+    const list = this._userDbList(user);
+    if (list === null) return true;
+    return list.includes(dbName);
+  }
+
+  async _switchDb(conn, dbName) {
+    if (!this._canAccessDb(conn.user, dbName)) {
+      const err = new Error(`Access denied for user '${conn.user}' to database '${dbName}'`);
+      err.code = 1044;
+      throw err;
+    }
+    await this._getDatabase(dbName);
+    conn.currentDb = dbName;
+  }
+
   _checkAuth(user, authResponse, seed) {
     if (this.auth) {
       if (!Object.prototype.hasOwnProperty.call(this.auth, user)) return false;
-      const pwd = this.auth[user];
+      const entry = this.auth[user];
+      const pwd = entry && typeof entry === 'object' ? entry.password : entry;
       if (!pwd) return authResponse.length === 0;
       const pwdHash1 = crypto.createHash('sha1').update(pwd).digest();
       const pwdHash2 = crypto.createHash('sha1').update(pwdHash1).digest();
@@ -456,7 +736,11 @@ class MysqlServer {
       for (let i = 0; i < 20; i++) expected[i] = pwdHash1[i] ^ seedHash[i];
       return authResponse.length === 20 && crypto.timingSafeEqual(expected, authResponse);
     }
-    if (this.user === null) return true;
+    if (this.user === null) {
+      // 未配置认证：默认拒绝所有登录（防配置遗漏导致认证旁路）。
+      // 仅当显式设置 noAuth: true 时允许无认证连接（仅限本地开发）。
+      return this.options.noAuth === true;
+    }
     if (user !== this.user) return false;
     if (!this.password) return authResponse.length === 0;
     const pwdHash1 = crypto.createHash('sha1').update(this.password).digest();
@@ -468,7 +752,8 @@ class MysqlServer {
   }
 
   listen(cb) {
-    this._getEngine().then(() => {
+    const ready = this._dbDir ? Promise.resolve() : this._getEngine();
+    ready.then(() => {
       this._server = net.createServer(socket => {
         if (this._sockets.size >= this.maxConnections) {
           this._onSecurityEvent({ type: 'max-connections', remote: socket.remoteAddress });
@@ -494,8 +779,16 @@ class MysqlServer {
   close(cb) {
     const done = () => {
       for (const s of this._sockets) s.destroy();
+      const stops = [];
       if (this._ownEngine && this._engine && typeof this._engine.stop === 'function') {
-        this._engine.stop().then(() => cb && cb()).catch(() => cb && cb());
+        stops.push(this._engine.stop());
+      }
+      for (const engine of this._databases.values()) {
+        if (engine && typeof engine.stop === 'function') stops.push(engine.stop());
+      }
+      this._databases.clear();
+      if (stops.length > 0) {
+        Promise.allSettled(stops).then(() => cb && cb());
       } else if (cb) cb();
     };
     if (this._server) {

package/lib/native_client.js

@@ -11,16 +11,9 @@ function encodeBatch(rows) {
   if (rows.length === 0) return new Uint8Array(0);
   const fieldNames = Object.keys(rows[0]);
   const nFields = fieldNames.length;
-  const est = 100 + rows.length * 160;
-  let buf = Buffer.allocUnsafe(est);
+  const est = 100 + rows.length * 120;
+  const buf = Buffer.allocUnsafe(est);
   let off = 0;
-  const ensure = (n) => {
-    if (off + n > buf.length) {
-      const nb = Buffer.allocUnsafe(Math.max(buf.length * 2, off + n));
-      buf.copy(nb, 0, 0, off);
-      buf = nb;
-    }
-  };
 
   off = buf.writeUInt8(nFields, off);
   for (let fi = 0; fi < nFields; fi++) {
@@ -41,12 +34,19 @@ function encodeBatch(rows) {
         if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
         else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
       } else if (typeof v === 'string') {
-        const sl = Buffer.byteLength(v, 'utf8');
-        ensure(5 + sl);
         off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(v, 'utf8');
         off = buf.writeUInt32LE(sl, off);
         off += buf.write(v, off, sl, 'utf8');
-      } else { off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off); }
+      } else if (typeof v === 'boolean') {
+        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
+      } else {
+        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+        off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(s, 'utf8');
+        off = buf.writeUInt32LE(sl, off);
+        off += buf.write(s, off, sl, 'utf8');
+      }
     }
     if (nFields >= 2) {
       const v = row[fieldNames[1]];
@@ -55,12 +55,19 @@ function encodeBatch(rows) {
         if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
         else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
       } else if (typeof v === 'string') {
-        const sl = Buffer.byteLength(v, 'utf8');
-        ensure(5 + sl);
         off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(v, 'utf8');
         off = buf.writeUInt32LE(sl, off);
         off += buf.write(v, off, sl, 'utf8');
-      } else { off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off); }
+      } else if (typeof v === 'boolean') {
+        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
+      } else {
+        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+        off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(s, 'utf8');
+        off = buf.writeUInt32LE(sl, off);
+        off += buf.write(s, off, sl, 'utf8');
+      }
     }
     if (nFields >= 3) {
       const v = row[fieldNames[2]];
@@ -69,12 +76,19 @@ function encodeBatch(rows) {
         if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
         else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
       } else if (typeof v === 'string') {
-        const sl = Buffer.byteLength(v, 'utf8');
-        ensure(5 + sl);
         off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(v, 'utf8');
         off = buf.writeUInt32LE(sl, off);
         off += buf.write(v, off, sl, 'utf8');
-      } else { off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off); }
+      } else if (typeof v === 'boolean') {
+        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
+      } else {
+        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+        off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(s, 'utf8');
+        off = buf.writeUInt32LE(sl, off);
+        off += buf.write(s, off, sl, 'utf8');
+      }
     }
     if (nFields >= 4) {
       const v = row[fieldNames[3]];
@@ -83,12 +97,19 @@ function encodeBatch(rows) {
         if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
         else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
       } else if (typeof v === 'string') {
-        const sl = Buffer.byteLength(v, 'utf8');
-        ensure(5 + sl);
         off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(v, 'utf8');
         off = buf.writeUInt32LE(sl, off);
         off += buf.write(v, off, sl, 'utf8');
-      } else { off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off); }
+      } else if (typeof v === 'boolean') {
+        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
+      } else {
+        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+        off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(s, 'utf8');
+        off = buf.writeUInt32LE(sl, off);
+        off += buf.write(s, off, sl, 'utf8');
+      }
     }
     if (nFields >= 5) {
       const v = row[fieldNames[4]];
@@ -97,12 +118,19 @@ function encodeBatch(rows) {
         if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
         else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
       } else if (typeof v === 'string') {
-        const sl = Buffer.byteLength(v, 'utf8');
-        ensure(5 + sl);
         off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(v, 'utf8');
         off = buf.writeUInt32LE(sl, off);
         off += buf.write(v, off, sl, 'utf8');
-      } else { off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off); }
+      } else if (typeof v === 'boolean') {
+        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
+      } else {
+        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+        off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(s, 'utf8');
+        off = buf.writeUInt32LE(sl, off);
+        off += buf.write(s, off, sl, 'utf8');
+      }
     }
     for (let fi = 5; fi < nFields; fi++) {
       const v = row[fieldNames[fi]];
@@ -111,12 +139,19 @@ function encodeBatch(rows) {
         if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
         else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
       } else if (typeof v === 'string') {
-        const sl = Buffer.byteLength(v, 'utf8');
-        ensure(5 + sl);
         off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(v, 'utf8');
         off = buf.writeUInt32LE(sl, off);
         off += buf.write(v, off, sl, 'utf8');
-      } else { off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off); }
+      } else if (typeof v === 'boolean') {
+        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
+      } else {
+        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+        off = buf.writeUInt8(STR_TAG, off);
+        const sl = Buffer.byteLength(s, 'utf8');
+        off = buf.writeUInt32LE(sl, off);
+        off += buf.write(s, off, sl, 'utf8');
+      }
     }
   }
 
@@ -241,6 +276,10 @@ class JSQL {
         this._tableNames = new Set(r.tables);
         if (r.schemas) this._schemas = r.schemas;
       }
+    } else {
+      JSON.parse(native.jsqlOpen('', 'memory'));
+    }
+    if (this._mode !== 'memory') {
       if (this._flushInterval > 0) {
         this._diskFlushTimer = setInterval(() => {
           try { native.jsqlFlushDirty(); } catch (e) { /* ignore */ }
@@ -341,11 +380,16 @@ class JSQL {
     if (!this._runHooks('beforeInsert', [table, filtered])) return [];
     if (arr.length > 1) {
       await this._flush();
-      const r = await this._insertBatch(table, arr);
-      if (r && r.error) throw new Error(r.error);
-      this._emit('insert', { table, count: arr.length, ids: r });
-      this._runHooks('afterInsert', [table, filtered, r]);
-      return r;
+      let result;
+      for (let i = 0; i < arr.length; i += this._flushThreshold) {
+        const chunk = arr.slice(i, i + this._flushThreshold);
+        const r = await this._insertBatch(table, chunk);
+        if (r && r.error) throw new Error(r.error);
+        if (!result) result = r;
+      }
+      this._emit('insert', { table, count: arr.length, ids: result });
+      this._runHooks('afterInsert', [table, filtered, result]);
+      return result;
     }
     if (!this._buffer[table]) this._buffer[table] = [];
     this._buffer[table].push(arr[0]);
@@ -473,6 +517,25 @@ class JSQL {
     this._runHooks('onStop', []);
     this._emit('stop', {});
   }
+
+  async beginTx() {
+    this._flushOpsNow();
+    const r = JSON.parse(native.jsqlBeginTx());
+    if (r && r.ok === false) throw new Error(r.error || 'begin transaction failed');
+    return r.txId;
+  }
+
+  async commitTx(txId) {
+    const r = JSON.parse(native.jsqlCommitTx(String(txId)));
+    if (r && r.ok === false) throw new Error(r.error || 'commit transaction failed');
+    return true;
+  }
+
+  async rollbackTx(txId) {
+    const r = JSON.parse(native.jsqlRollbackTx(String(txId)));
+    if (r && r.ok === false) throw new Error(r.error || 'rollback transaction failed');
+    return true;
+  }
 }
 
 module.exports = { JSQL };