jsql-neo 5.0.0 → 5.1.0

package/README.md

@@ -154,9 +154,20 @@ MySQL DDL forms (`int unsigned`, `auto_increment`, `ENGINE=InnoDB`, `DEFAULT CHA
 
 ```js
 const { createMysqlServer } = require('jsql-neo');
+// 开发环境：本地无认证
 createMysqlServer({ port: 3306, dataDir: './data', noAuth: true }).listen();
+
+// 生产环境：用户名/密码 + 每用户数据库白名单（ACL）
+createMysqlServer({
+  port: 3306,
+  dataDir: './data',
+  auth: { app: { password: 's3cret', databases: ['app', 'analytics'] } },
+}).listen();
 ```
 
+`auth` 里的 `databases` 数组即该用户的数据库白名单：越权访问（跨库引用、`SHOW TABLES FROM db`、
+`DROP DATABASE`）统一返回 `ER_DBACCESS_DENIED_ERROR` (1044)。省略 `databases` 时不限制库。
+
 ---
 
 ## Speak Redis
@@ -176,9 +187,15 @@ Snapshot persistence to `data.rdb.json` — debounced writes (500ms) plus a guar
 
 ```js
 const { createRedisServer } = require('jsql-neo');
+// 本地无认证
 createRedisServer({ port: 6379, dataDir: './redis-data' }).listen();
+
+// 带密码：每连接独立认证，任一客户端 AUTH 成功不影响其它连接
+createRedisServer({ port: 6379, dataDir: './redis-data', password: 's3cret' }).listen();
 ```
 
+设置了 `password` 后，未认证连接上的命令返回 `NOAUTH Authentication required.`；认证状态按连接隔离。
+
 ---
 
 ## Toolbox — everything included
@@ -202,6 +219,18 @@ createRedisServer({ port: 6379, dataDir: './redis-data' }).listen();
 A zero-dependency HTTP management console: browse databases and tables, run SQL in the browser,
 see results as a table. Perfect for dev tools, admin panels, and demos.
 
+> **安全默认值（5.1.0）**：默认只监听 `127.0.0.1`（不再暴露到所有网卡）。生产环境请设置
+> `authToken`，所有 `/api/*` 请求需携带 `Authorization: Bearer <token>`，未认证返回 401。
+
+```js
+const { WebUI } = require('jsql-neo');
+const ui = new WebUI({ port: 8080, dataDir: './data', authToken: 'change-me' });
+await ui.start();
+```
+
+可用选项：`host`（默认 `127.0.0.1`）、`port`、`dataDir`、`readonly`、`authToken`（Bearer 认证）、
+`allowOrigin`（CORS 允许的源；不设置时开启认证仅回显请求 Origin，未开启认证时为 `*`）。
+
 ### Migration tools (`migrate`)
 
 ```js
@@ -210,6 +239,11 @@ await importDumpFile(db, './backup.sql', { strict: true });   // real mysqldump
 await exportToFile(db, 'users', './users.csv');               // CSV round-trip
 ```
 
+`importFromJSON` / `importDumpFile` 从 5.1.0 起：
+
+- 兼容两种 JSON 形状：整库 `{ "users": { schema, rows } }` 与单表 `{ table, schema, rows }`。
+- 目标表已存在时**默认抛错**，不会静默覆盖；需显式传入 `{ overwrite: true }` 才重建表。
+
 ### Browser playground
 
 `examples/playground/` is a self-contained SQL sandbox — the **entire engine runs in your browser**
@@ -284,6 +318,6 @@ CI (`.github/workflows/ci.yml`): engine smoke tests on Node 18/20/22 + a full OR
 
 ## License
 
-MIT — use it, ship it, love it.
+[Apache-2.0](LICENSE) — free to use, modify, and distribute with attribution.
 
 *JSQL-NEO: Rust-powered. Protocol-native. One package.*

package/bin/jsql

@@ -23,10 +23,10 @@ const RAW_ARGV = process.argv.slice(2);
 
 const cli = yaggs()
   .usage('jsql <command> [options]')
-  .option('help', { alias: 'h', type: 'boolean', description: 'Show help' })
+  .option('help', { alias: ['h'], type: 'boolean', description: 'Show help' })
   .command('mod', 'Module management', (sub) => {
     sub.option('address', {
-      alias: 'a',
+      alias: ['a'],
       type: 'string',
       description: 'Path to module file'
     });
@@ -149,7 +149,7 @@ const cli = yaggs()
     } catch (e) { fail(e); }
   })
   .command('serve', 'Run the MySQL-compatible server in the foreground', (sub) => {
-    sub.option('port', { alias: 'p', type: 'number', description: 'Listen port (default 3306)' });
+    sub.option('port', { alias: ['p'], type: 'number', description: 'Listen port (default 3306)' });
     sub.option('host', { type: 'string', description: 'Listen host (default 127.0.0.1)' });
     sub.option('data-dir', { type: 'string', description: 'Directory to store databases' });
     sub.option('no-auth', { type: 'boolean', description: 'Allow connections without authentication' });
@@ -194,26 +194,29 @@ const cli = yaggs()
     } catch (e) { console.error(`Error: ${e.message}`); process.exitCode = 1; }
   })
   .command('ui', 'Serve the built-in web management console', (sub) => {
-    sub.option('port', { alias: 'p', type: 'number', description: 'HTTP port (default 8080)' });
-    sub.option('host', { type: 'string', description: 'Listen host (default 0.0.0.0)' });
+    sub.option('port', { alias: ['p'], type: 'number', description: 'HTTP port (default 8080)' });
+    sub.option('host', { type: 'string', description: 'Listen host (default 127.0.0.1)' });
     sub.option('data-dir', { type: 'string', description: 'Directory containing *.json databases (default .)' });
+    sub.option('auth-token', { type: 'string', description: 'Require this Bearer token for /api/*' });
     sub.option('readonly', { type: 'boolean', description: 'Never write back to disk' });
   }, async (argv) => {
     const { WebUI } = require('../lib/web_ui');
     const ui = new WebUI({
       port: argv.port != null ? argv.port : 8080,
-      host: argv.host || '0.0.0.0',
+      host: argv.host,
       dataDir: argv['data-dir'] || '.',
+      authToken: argv['auth-token'],
       readonly: argv.readonly === true,
     });
     try {
       const port = await ui.start();
-      console.log(`JSQL-NEO web UI on http://${argv.host || '0.0.0.0'}:${port} (data: ${ui.dataDir})`);
+      const host = argv.host || ui.host;
+      console.log(`JSQL-NEO web UI on http://${host}:${port} (data: ${ui.dataDir})${ui.authToken ? ' [auth]' : ''}`);
       setInterval(() => {}, 1 << 30);
     } catch (e) { console.error(`Error: ${e.message}`); process.exitCode = 1; }
   })
   .command('redis', 'Run the Redis-compatible server', (sub) => {
-    sub.option('port', { alias: 'p', type: 'number', description: 'Listen port (default 6379)' });
+    sub.option('port', { alias: ['p'], type: 'number', description: 'Listen port (default 6379)' });
     sub.option('host', { type: 'string', description: 'Listen host (default 127.0.0.1)' });
     sub.option('data-dir', { type: 'string', description: 'Directory for data.rdb.json snapshot' });
     sub.option('auth', { type: 'string', description: 'Require this password for AUTH' });
@@ -235,10 +238,10 @@ const cli = yaggs()
     console.log(require('../package.json').version);
   })
   .command('server', 'Run the MySQL-compatible server in background', (sub) => {
-    sub.option('port', { alias: 'p', type: 'number', description: 'Listen port (default 3306)' });
+    sub.option('port', { alias: ['p'], type: 'number', description: 'Listen port (default 3306)' });
     sub.option('host', { type: 'string', description: 'Listen host (default 127.0.0.1)' });
     sub.option('data-dir', { type: 'string', description: 'Directory to store databases (default in-memory)' });
-    sub.option('auth', { alias: 'a', type: 'string', description: 'User credential: user:password[:db1,db2] (repeatable)' });
+    sub.option('auth', { alias: ['a'], type: 'string', description: 'User credential: user:password[:db1,db2] (repeatable)' });
     sub.option('config', { type: 'string', description: 'Path to config file (JSON)' });
     sub.option('no-auth', { type: 'boolean', description: 'Allow connections without authentication (local dev only)' });
   }, (argv) => {

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v3.1.0 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v5.1.0 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');
@@ -46,6 +46,8 @@ function enableMySQLCompat() {
       if (seen.has(resolved)) return;
       if (!fs.existsSync(resolved)) return;
       seen.add(resolved);
+      // 不覆盖已加载的真实 mysql2，避免全局劫持副作用
+      if (require.cache[resolved]) return;
       require.cache[resolved] = { exports: mod, id: resolved, filename: resolved, loaded: true, children: [] };
     } catch (e) { /* ignore */ }
   };

package/lib/btree.js

@@ -153,17 +153,35 @@ class BTree {
     }
 
     /**
-     * 大于查询
+     * 大于查询（严格开区间，不含 min 本身）
      */
     greaterThan(min) {
-        return this.range(min, Infinity);
+        const result = [];
+        let node = this._findLeaf(min);
+        while (node) {
+            for (let i = 0; i < node.keys.length; i++) {
+                if (node.keys[i] > min) result.push(...node.values[i]);
+            }
+            node = node.next;
+        }
+        return result;
     }
 
     /**
-     * 小于查询
+     * 小于查询（严格开区间，不含 max 本身）
      */
     lessThan(max) {
-        return this.range(-Infinity, max);
+        const result = [];
+        let node = this._root;
+        while (!node.leaf) node = node.children[0];
+        while (node) {
+            for (let i = 0; i < node.keys.length; i++) {
+                if (node.keys[i] < max) result.push(...node.values[i]);
+                else return result;
+            }
+            node = node.next;
+        }
+        return result;
     }
 
     _findLeaf(key) {

package/lib/database.js

@@ -12,6 +12,25 @@ const Table = require('./table');
 const { createError } = require('./errors');
 const JSQLFormat = require('./jsql_format');
 
+/**
+ * 解析字段简写类型字符串，如 'integer primary key'、'string unique'、
+ * 'integer primary key auto_increment'、'datetime default now'
+ * @param {string} str - 简写字符串（已小写化）
+ * @returns {object} { type, primaryKey, unique, autoIncrement, required, ... }
+ */
+function parseFieldShorthand(str) {
+    const def = { type: str };
+    if (/\bprimary\s+key\b/.test(str)) { def.primaryKey = true; def.type = str.replace(/\bprimary\s+key\b/g, '').trim() || def.type; }
+    if (/\bauto_?increment\b/.test(str)) { def.autoIncrement = true; def.type = str.replace(/\bauto_?increment\b/g, '').trim() || def.type; }
+    if (/\bnot\s+null\b/.test(str)) { def.required = true; def.type = str.replace(/\bnot\s+null\b/g, '').trim() || def.type; }
+    if (/\bunique\b/.test(str)) { def.unique = true; def.type = str.replace(/\bunique\b/g, '').trim() || def.type; }
+    if (/\bdefault\s+(\S+)/.test(str)) {
+        def.default = RegExp.$1.replace(/^['"]|['"]$/g, '');
+        def.type = str.replace(/\bdefault\s+\S+/g, '').trim() || def.type;
+    }
+    return def;
+}
+
 class Database {
     /**
      * @param {string} filePath - 数据库文件/目录路径，传 null 或 ':memory:' 使用内存模式
@@ -423,7 +442,7 @@ class Database {
         }
         const normalized = {};
         for (const [field, def] of Object.entries(schema || {})) {
-            if (typeof def === 'string') normalized[field] = { type: def.toLowerCase() };
+            if (typeof def === 'string') normalized[field] = parseFieldShorthand(def.toLowerCase());
             else normalized[field] = def;
         }
         const table = new Table(name, normalized, this);
@@ -872,9 +891,9 @@ class Database {
         };
 
         if (level === 'REPEATABLE_READ') {
-            // 快照：保存当前所有数据
+            // 快照：保存当前所有数据（深拷贝，保证嵌套对象可回滚）
             for (const [name, table] of Object.entries(this._tables)) {
-                this._transaction.rows[name] = table._rows.map(r => ({ ...r }));
+                this._transaction.rows[name] = JSON.parse(JSON.stringify(table._rows));
                 this._transaction.autoIncrements[name] = table._autoIncrement;
             }
         } else {
@@ -1191,7 +1210,7 @@ class Database {
         const ids = [];
         for (const row of arr) {
             const r = table.insert(row);
-            ids.push(pk ? r[pk] : (table._rows.indexOf(r) + 1));
+            ids.push(pk ? r[pk] : table._rows.length);
         }
         this._emit('insert', { table: tableName, count: arr.length, ids });
         this._runHooks('afterInsert', [tableName, arr, ids]);
@@ -1221,9 +1240,10 @@ class Database {
         const table = this._ensureTable(tableName);
         if (!table) throw createError('ER_NO_SUCH_TABLE', tableName);
         if (!this._runHooks('beforeFind', [tableName, { filter, opts }])) return [];
-        const { limit = 100, offset = 0 } = opts;
+        const { limit, offset = 0 } = opts;
         let rows = table._applyFilter(table._rows, filter || {});
-        rows = rows.slice(offset, offset + limit);
+        if (limit > 0) rows = rows.slice(offset, offset + limit);
+        else if (offset > 0) rows = rows.slice(offset);
         this._touchTable(tableName);
         this._runHooks('afterFind', [tableName, { filter, opts }, rows]);
         return rows;
@@ -1296,9 +1316,20 @@ class Database {
         const table = this._ensureTable(tableName);
         if (!table) throw createError('ER_NO_SUCH_TABLE', tableName);
         if (!this._runHooks('beforeDelete', [tableName, id])) return;
+        if (table._primaryKey) {
+            const removed = table.removeById(id);
+            if (removed === 0) return { ok: false, error: 'not found' };
+            this._emit('delete', { table: tableName, id });
+            this._runHooks('afterDelete', [tableName, id, { ok: true }]);
+            this._markDirty(tableName);
+            return { ok: true };
+        }
         const idx = table._rows.findIndex(r => r === this._resolveId(table, id));
         if (idx === -1) return { ok: false, error: 'not found' };
         table._rows.splice(idx, 1);
+        table._rebuildPKIndex();
+        table._rebuildAllBTrees();
+        for (const field of Object.keys(table._indexes)) table.createIndex(field);
         this._emit('delete', { table: tableName, id });
         this._runHooks('afterDelete', [tableName, id, { ok: true }]);
         this._markDirty(tableName);
@@ -1310,12 +1341,19 @@ class Database {
         if (!table) throw createError('ER_NO_SUCH_TABLE', tableName);
         if (!this._runHooks('beforeDelete', [tableName, ids])) return;
         let removed = 0;
-        for (const id of ids) {
-            const idx = table._rows.findIndex(r => r === this._resolveId(table, id));
-            if (idx !== -1) {
-                table._rows.splice(idx, 1);
-                removed++;
+        if (table._primaryKey) {
+            for (const id of ids) removed += table.removeById(id);
+        } else {
+            for (const id of ids) {
+                const idx = table._rows.findIndex(r => r === this._resolveId(table, id));
+                if (idx !== -1) {
+                    table._rows.splice(idx, 1);
+                    removed++;
+                }
             }
+            table._rebuildPKIndex();
+            table._rebuildAllBTrees();
+            for (const field of Object.keys(table._indexes)) table.createIndex(field);
         }
         this._emit('delete', { table: tableName, ids, result: { ok: true, count: removed } });
         this._runHooks('afterDelete', [tableName, ids, { ok: true, count: removed }]);
@@ -1679,4 +1717,5 @@ class Database {
     }
 }
 
-module.exports = Database;
+module.exports = Database;
+module.exports.parseFieldShorthand = parseFieldShorthand;

package/lib/migrate.js

@@ -10,11 +10,12 @@
 const fs = require('fs');
 const path = require('path');
 const { splitStatements, executeSQL } = require('./sql');
+const { parseFieldShorthand } = require('./database');
 
 function normalizeSchema(schema) {
   const out = {};
   for (const [name, def] of Object.entries(schema || {})) {
-    const d = typeof def === 'string' ? { type: def } : { ...def };
+    const d = typeof def === 'string' ? parseFieldShorthand(def.toLowerCase()) : { ...def };
     if (!d.type) d.type = typeof d === 'object' ? 'any' : 'string';
     if (d.type === 'int' || d.type === 'bigint' || d.type === 'smallint' || d.type === 'tinyint') d.type = 'integer';
     if (d.type === 'varchar' || d.type === 'text' || d.type === 'char') d.type = 'string';
@@ -120,13 +121,24 @@ async function exportAllToJSON(engine, tables) {
   return out;
 }
 
-async function importFromJSON(engine, data) {
-  const tables = typeof data === 'string' ? JSON.parse(data) : data;
+async function importFromJSON(engine, data, opts = {}) {
+  const overwrite = !!(opts && opts.overwrite);
+  let tables = typeof data === 'string' ? JSON.parse(data) : data;
+  // 兼容单表形状：exportTableToJSON 返回 { table, schema, rows }
+  if (tables && !Array.isArray(tables) && typeof tables === 'object'
+      && tables.table && tables.schema && !tables[tables.table]) {
+    const single = tables;
+    tables = {};
+    tables[single.table] = single;
+  }
   const created = [];
   let inserted = 0;
   for (const [name, t] of Object.entries(tables)) {
     if (!t || !t.schema) continue;
-    if (engine.hasTable(name)) await engine.dropTable(name);
+    if (engine.hasTable(name)) {
+      if (!overwrite) throw new Error(`Table '${name}' already exists; pass { overwrite: true } to replace it`);
+      await engine.dropTable(name);
+    }
     await engine.createTable(name, normalizeSchema(t.schema));
     created.push(name);
     if (Array.isArray(t.rows) && t.rows.length > 0) {

package/lib/mysql_compat.js

@@ -241,7 +241,8 @@ class Pool {
     const key = database || 'default';
     let engine = this._sharedEngines.get(key);
     if (!engine) {
-      engine = new Database(':memory:');
+      const filename = (this.config && this.config.filename) || null;
+      engine = filename ? new Database(filename) : new Database(':memory:');
       if (typeof engine.start === 'function') await engine.start();
       this._sharedEngines.set(key, engine);
     }

package/lib/mysql_server.js

@@ -843,6 +843,10 @@ class MysqlConnection {
               continue;
             }
             case 'dropDatabase': {
+              if (!this.server._canAccessDb(this.user, stmt.database)) {
+                this._send(errPacket(1044, `Access denied for user '${this.user}' to database '${stmt.database}'`));
+                continue;
+              }
               await this.server.dropDatabase(stmt.database, { ifExists: stmt.ifExists });
               this._send(okPacket());
               continue;
@@ -949,6 +953,11 @@ class MysqlServer {
   // 决定执行引擎，并把 db.table 改写为 table 后交给对应库引擎执行。
   async _route(stmt, sql, currentDb, user) {
     if (stmt.type === 'showTables' && stmt.database) {
+      if (user && this.auth && !this._canAccessDb(user, stmt.database)) {
+        const err = new Error(`Access denied for user '${user}' to database '${stmt.database}'`);
+        err.code = 1044;
+        throw err;
+      }
       return { engine: await this._getDatabase(stmt.database), sql };
     }
     const tables = [];
@@ -983,6 +992,11 @@ class MysqlServer {
       }
     }
     if (db) {
+      if (user && this.auth && !this._canAccessDb(user, db)) {
+        const err = new Error(`Access denied for user '${user}' to database '${db}'`);
+        err.code = 1044;
+        throw err;
+      }
       if (!this._dbExists(db)) await this.createDatabase(db);
       const engine = await this._getDatabase(db);
       let s = sql;

package/lib/native_client.js

@@ -70,12 +70,59 @@ function restoreRow(row, schema) {
   return out;
 }
 
+function _encodedFieldSize(v) {
+  if (v === null || v === undefined) return 1;
+  if (typeof v === 'number') {
+    if (Number.isInteger(v)) return (v >= -2147483648 && v <= 2147483647) ? 1 + 4 : 1 + 8;
+    return 1 + 8;
+  }
+  if (typeof v === 'boolean') return 1 + 1;
+  const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+  return 1 + 4 + Buffer.byteLength(s, 'utf8');
+}
+
+function encodeField(buf, off, v) {
+  if (v === null || v === undefined) {
+    buf.writeUInt8(0, off); return off + 1;
+  }
+  if (typeof v === 'number') {
+    if (Number.isInteger(v)) {
+      if (v >= -2147483648 && v <= 2147483647) {
+        buf.writeUInt8(INT32_TAG, off); buf.writeInt32LE(v, off + 1); return off + 5;
+      }
+      buf.writeUInt8(INT64_TAG, off); buf.writeBigInt64LE(BigInt(v), off + 1); return off + 9;
+    }
+    buf.writeUInt8(FLOAT_TAG, off); buf.writeDoubleLE(v, off + 1); return off + 9;
+  }
+  if (typeof v === 'string') {
+    const sl = Buffer.byteLength(v, 'utf8');
+    buf.writeUInt8(STR_TAG, off);
+    buf.writeUInt32LE(sl, off + 1);
+    buf.write(v, off + 5, sl, 'utf8');
+    return off + 5 + sl;
+  }
+  if (typeof v === 'boolean') {
+    buf.writeUInt8(BOOL_TAG, off); buf.writeUInt8(v ? 1 : 0, off + 1); return off + 2;
+  }
+  const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
+  const sl = Buffer.byteLength(s, 'utf8');
+  buf.writeUInt8(STR_TAG, off);
+  buf.writeUInt32LE(sl, off + 1);
+  buf.write(s, off + 5, sl, 'utf8');
+  return off + 5 + sl;
+}
+
 function encodeBatch(rows) {
   if (rows.length === 0) return new Uint8Array(0);
   const fieldNames = Object.keys(rows[0]);
   const nFields = fieldNames.length;
-  const est = 100 + rows.length * 120;
-  const buf = Buffer.allocUnsafe(est);
+  let size = 1;
+  for (const s of fieldNames) size += 1 + Buffer.byteLength(s, 'utf8');
+  size += 4;
+  for (const row of rows) {
+    for (let fi = 0; fi < nFields; fi++) size += _encodedFieldSize(row[fieldNames[fi]]);
+  }
+  const buf = Buffer.allocUnsafe(size);
   let off = 0;
 
   off = buf.writeUInt8(nFields, off);
@@ -89,132 +136,8 @@ function encodeBatch(rows) {
 
   for (let ri = 0; ri < rows.length; ri++) {
     const row = rows[ri];
-
-    if (nFields >= 1) {
-      const v = row[fieldNames[0]];
-      if (v === null || v === undefined) { off = buf.writeUInt8(0, off); }
-      else if (typeof v === 'number') {
-        if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
-        else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
-      } else if (typeof v === 'string') {
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(v, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(v, off, sl, 'utf8');
-      } else if (typeof v === 'boolean') {
-        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
-      } else {
-        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(s, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(s, off, sl, 'utf8');
-      }
-    }
-    if (nFields >= 2) {
-      const v = row[fieldNames[1]];
-      if (v === null || v === undefined) { off = buf.writeUInt8(0, off); }
-      else if (typeof v === 'number') {
-        if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
-        else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
-      } else if (typeof v === 'string') {
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(v, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(v, off, sl, 'utf8');
-      } else if (typeof v === 'boolean') {
-        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
-      } else {
-        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(s, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(s, off, sl, 'utf8');
-      }
-    }
-    if (nFields >= 3) {
-      const v = row[fieldNames[2]];
-      if (v === null || v === undefined) { off = buf.writeUInt8(0, off); }
-      else if (typeof v === 'number') {
-        if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
-        else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
-      } else if (typeof v === 'string') {
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(v, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(v, off, sl, 'utf8');
-      } else if (typeof v === 'boolean') {
-        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
-      } else {
-        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(s, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(s, off, sl, 'utf8');
-      }
-    }
-    if (nFields >= 4) {
-      const v = row[fieldNames[3]];
-      if (v === null || v === undefined) { off = buf.writeUInt8(0, off); }
-      else if (typeof v === 'number') {
-        if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
-        else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
-      } else if (typeof v === 'string') {
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(v, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(v, off, sl, 'utf8');
-      } else if (typeof v === 'boolean') {
-        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
-      } else {
-        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(s, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(s, off, sl, 'utf8');
-      }
-    }
-    if (nFields >= 5) {
-      const v = row[fieldNames[4]];
-      if (v === null || v === undefined) { off = buf.writeUInt8(0, off); }
-      else if (typeof v === 'number') {
-        if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
-        else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
-      } else if (typeof v === 'string') {
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(v, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(v, off, sl, 'utf8');
-      } else if (typeof v === 'boolean') {
-        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
-      } else {
-        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(s, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(s, off, sl, 'utf8');
-      }
-    }
-    for (let fi = 5; fi < nFields; fi++) {
-      const v = row[fieldNames[fi]];
-      if (v === null || v === undefined) { off = buf.writeUInt8(0, off); }
-      else if (typeof v === 'number') {
-        if (Number.isInteger(v)) { if (v >= -2147483648 && v <= 2147483647) { off = buf.writeUInt8(INT32_TAG, off); off = buf.writeInt32LE(v, off); } else { off = buf.writeUInt8(INT64_TAG, off); off = buf.writeBigInt64LE(BigInt(v), off); } }
-        else { off = buf.writeUInt8(FLOAT_TAG, off); off = buf.writeDoubleLE(v, off); }
-      } else if (typeof v === 'string') {
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(v, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(v, off, sl, 'utf8');
-      } else if (typeof v === 'boolean') {
-        off = buf.writeUInt8(BOOL_TAG, off); off = buf.writeUInt8(v ? 1 : 0, off);
-      } else {
-        const s = typeof v === 'object' ? JSON.stringify(v) : String(v);
-        off = buf.writeUInt8(STR_TAG, off);
-        const sl = Buffer.byteLength(s, 'utf8');
-        off = buf.writeUInt32LE(sl, off);
-        off += buf.write(s, off, sl, 'utf8');
-      }
+    for (let fi = 0; fi < nFields; fi++) {
+      off = encodeField(buf, off, row[fieldNames[fi]]);
     }
   }
 

package/lib/redis_server.js

@@ -39,6 +39,7 @@ class RedisServer {
     this.onQuery = opts.onQuery || null;
     this.db = new Map();
     this.snapshotTimer = null;
+    this._authedSockets = new WeakMap();
     this._load();
   }
 
@@ -359,6 +360,7 @@ class RedisServer {
   listen() {
     this.server = net.createServer((socket) => {
       let buf = Buffer.alloc(0);
+      this._authedSockets.set(socket, false);
       socket.setEncoding('utf8');
       socket.on('data', (chunk) => {
         buf += chunk;
@@ -407,17 +409,21 @@ class RedisServer {
     try {
       if (this.onQuery) this.onQuery(cmd, args);
       if (cmd === 'AUTH') {
-        if (!this.password) return this._send(socket, -new Error('ERR Client sent AUTH, but no password is set'));
+        if (!this.password) return this._send(socket, new Error('ERR Client sent AUTH, but no password is set'));
       }
-      if (this.password && !this._authed) {
-        if (cmd === 'AUTH') { const ok = this.execute('AUTH', args); this._authed = ok === 'OK'; return this._send(socket, ok); }
-        return this._send(socket, -new Error('NOAUTH Authentication required.'));
+      if (this.password && !this._authedSockets.get(socket)) {
+        if (cmd === 'AUTH') {
+          const ok = this.execute('AUTH', args);
+          if (ok === 'OK') this._authedSockets.set(socket, true);
+          return this._send(socket, ok);
+        }
+        return this._send(socket, new Error('NOAUTH Authentication required.'));
       }
       if (cmd === 'QUIT') { this._send(socket, 'OK'); socket.end(); return; }
       const r = this.execute(cmd, args);
       this._send(socket, r);
     } catch (e) {
-      this._send(socket, -e);
+      this._send(socket, e);
     }
   }
 

package/lib/sqlite_worker.js

@@ -208,7 +208,7 @@ async function handleOp(op, args) {
     case 'deserialize': {
       const { importFromJSON } = require('./migrate');
       const dump = JSON.parse(Buffer.from(args[0]).toString('utf8'));
-      await importFromJSON(db, dump);
+      await importFromJSON(db, dump, { overwrite: true });
       if (typeof db.save === 'function') db.save();
       result = { ok: true };
       break;

package/lib/table.js

@@ -487,6 +487,14 @@ class Table {
                             tree.insert(val, idx);
                         }
                     }
+                    for (const field of Object.keys(this._indexes)) {
+                        const val = lastRow[field];
+                        if (val !== undefined && this._indexes[field].has(val)) {
+                            const positions = this._indexes[field].get(val);
+                            const pi = positions.indexOf(lastIdx);
+                            if (pi !== -1) positions[pi] = idx;
+                        }
+                    }
                 }
                 this._rows.pop();
             }
@@ -534,6 +542,14 @@ class Table {
                     tree.insert(val, rowIndex);
                 }
             }
+            for (const field of Object.keys(this._indexes)) {
+                const val = lastRow[field];
+                if (val !== undefined && this._indexes[field].has(val)) {
+                    const positions = this._indexes[field].get(val);
+                    const pi = positions.indexOf(lastIdx);
+                    if (pi !== -1) positions[pi] = rowIndex;
+                }
+            }
         }
         this._rows.pop();
         this._dirty = true;
@@ -834,6 +850,12 @@ class Table {
                     }
                     return [];
                 }
+                if (this._indexes[field] && this._indexes[field].has(condition)) {
+                    const indices = this._indexes[field].get(condition);
+                    const subset = indices.map(i => this._rows[i]).filter(r => r);
+                    return this._applyFilter(subset, query);
+                }
+                if (this._indexes[field]) return [];
             }
             // 范围查询用 B-Tree
             if (condition && typeof condition === 'object') {
@@ -912,8 +934,15 @@ class Table {
             case '$nin': return Array.isArray(target) && !target.includes(value);
             case '$like':
                 if (typeof value !== 'string' || typeof target !== 'string') return false;
-                return new RegExp('^' + target.replace(/%/g, '.*').replace(/_/g, '.') + '$', 'i').test(value);
+                {
+                    const escaped = target
+                        .replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+                        .replace(/%/g, '.*')
+                        .replace(/_/g, '.');
+                    return new RegExp('^' + escaped + '$', 'i').test(value);
+                }
             case '$regex':
+                if (target instanceof RegExp) return target.test(String(value));
                 if (!isSafeRegex(target)) throw createError('ER_BAD_REGEX', String(target));
                 return new RegExp(target).test(String(value));
             case '$exists':
@@ -992,6 +1021,23 @@ class Table {
                 throw createError('ER_BAD_NULL_ERROR', field);
             }
 
+            // PRIMARY KEY 唯一性
+            if ((def.primaryKey || def.primary === true) && data[field] !== undefined && data[field] !== null) {
+                let dup = false;
+                if (uniqueTracker && uniqueTracker[field]) {
+                    dup = uniqueTracker[field].has(data[field]);
+                } else if (this._pkIndex) {
+                    const idx = this._pkIndex.get(data[field]);
+                    dup = idx !== undefined && idx !== null && idx !== excludeIndex;
+                } else {
+                    const idx = this._rows.findIndex(r => r[field] === data[field]);
+                    dup = idx !== -1 && idx !== excludeIndex;
+                }
+                if (dup) {
+                    throw createError('ER_DUP_ENTRY', String(data[field]), field);
+                }
+            }
+
             // UNIQUE（B-Tree 优化 O(log n)）
             if (def.unique && data[field] !== undefined) {
                 if (uniqueTracker && uniqueTracker[field]) {
@@ -1088,6 +1134,42 @@ class Table {
                 result[field] = validateDateType(data[field], type, field);
             }
         }
+        for (const [field, def] of Object.entries(this._schema)) {
+            if (field === '_softDelete') continue;
+            if (partial && data[field] === undefined) continue;
+            const v = data[field];
+            if (v === undefined || v === null) continue;
+            const t = String(def.type || '').toLowerCase();
+            if (t === 'integer' || t === 'int' || t === 'bigint') {
+                if (typeof v === 'boolean') throw createError('ER_TRUNCATED_WRONG_VALUE', t, v);
+                if (typeof v === 'number') {
+                    if (Number.isInteger(v)) result[field] = v;
+                    else throw createError('ER_TRUNCATED_WRONG_VALUE', t, v);
+                } else if (typeof v === 'string' && v.trim() !== '' && Number.isInteger(Number(v))) {
+                    result[field] = Number(v);
+                } else {
+                    throw createError('ER_TRUNCATED_WRONG_VALUE', t, v);
+                }
+            } else if (t === 'float' || t === 'double' || t === 'number' || t === 'real') {
+                if (typeof v === 'boolean') throw createError('ER_TRUNCATED_WRONG_VALUE', t, v);
+                if (typeof v === 'number') result[field] = v;
+                else if (typeof v === 'string' && v.trim() !== '' && !Number.isNaN(Number(v))) result[field] = Number(v);
+                else throw createError('ER_TRUNCATED_WRONG_VALUE', t, v);
+            } else if (t === 'boolean' || t === 'bool') {
+                if (typeof v === 'boolean') result[field] = v;
+                else if (v === 0 || v === 1) result[field] = !!v;
+                else if (typeof v === 'string' && ['true', 'false', '1', '0'].includes(v.toLowerCase())) {
+                    result[field] = v.toLowerCase() === 'true' || v === '1';
+                } else {
+                    throw createError('ER_TRUNCATED_WRONG_VALUE', t, v);
+                }
+            } else if (t === 'string' || t === 'text' || t === 'varchar' || t === 'char') {
+                if (typeof v === 'string') result[field] = v;
+                else if (typeof v === 'number' || typeof v === 'boolean' || v instanceof Date) result[field] = String(v);
+                else if (Buffer.isBuffer(v)) result[field] = v.toString('utf8');
+                else throw createError('ER_TRUNCATED_WRONG_VALUE', t, v);
+            }
+        }
         return result;
     }
 

package/lib/web_ui.js

@@ -114,7 +114,9 @@ class WebUI {
     this.port = opts.port || 8080;
     this.dataDir = opts.dataDir || '.';
     this.readonly = !!opts.readonly;
-    this.host = opts.host || '0.0.0.0';
+    this.host = opts.host || '127.0.0.1';
+    this.authToken = opts.authToken || null;
+    this.allowOrigin = opts.allowOrigin || (this.authToken ? null : '*');
     this.cache = new Map();
   }
 
@@ -154,9 +156,14 @@ class WebUI {
 
   async handle(req, res) {
     const url = new URL(req.url, 'http://x');
+    const reqOrigin = req.headers.origin;
+    const corsOrigin = this.allowOrigin === null && reqOrigin ? reqOrigin : (this.allowOrigin || '*');
     const send = (code, obj) => {
       const body = JSON.stringify(obj);
-      res.writeHead(code, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' });
+      const headers = { 'Content-Type': 'application/json' };
+      if (this.allowOrigin !== null || reqOrigin) headers['Access-Control-Allow-Origin'] = corsOrigin;
+      if (this.allowOrigin !== null || reqOrigin) headers['Vary'] = 'Origin';
+      res.writeHead(code, headers);
       res.end(body);
     };
 
@@ -165,6 +172,23 @@ class WebUI {
         res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         return res.end(PAGE);
       }
+      if (req.method === 'OPTIONS' && url.pathname.startsWith('/api/')) {
+        res.writeHead(204, {
+          'Access-Control-Allow-Origin': corsOrigin,
+          'Access-Control-Allow-Methods': 'GET,POST,OPTIONS',
+          'Access-Control-Allow-Headers': 'Authorization,Content-Type',
+          'Vary': 'Origin',
+        });
+        return res.end();
+      }
+      if (this.authToken && url.pathname.startsWith('/api/')) {
+        const provided = req.headers.authorization || '';
+        const token = provided.startsWith('Bearer ') ? provided.slice(7) : '';
+        if (token !== this.authToken) {
+          res.writeHead(401, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ ok: false, error: 'unauthorized' }));
+        }
+      }
       if (url.pathname === '/api/databases' && req.method === 'GET') {
         return send(200, this.listDatabases());
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "JSQL-NEO — Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",