jsql-neo 6.3.6 → 6.3.10

package/lib/date-types.js

@@ -60,8 +60,13 @@ function validateDate(value, fieldName) {
     }
     if (typeof value === 'string') {
         const s = value.trim();
-        // 已是 YYYY-MM-DD：直接返回，避免本地→UTC 往返导致差一天
-        if (/^\d{4}-\d{2}-\d{2}$/.test(s)) return s;
+        // 已是 YYYY-MM-DD：验证日期有效性后返回
+        if (/^\d{4}-\d{2}-\d{2}$/.test(s)) {
+            const m = s.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+            const y = parseInt(m[1]), mo = parseInt(m[2]), d = parseInt(m[3]);
+            const dt = new Date(y, mo - 1, d);
+            if (dt.getFullYear() === y && dt.getMonth() === mo - 1 && dt.getDate() === d) return s;
+        }
         const d = parseDateString(s);
         if (d) return toLocalDateString(d);
     }
@@ -72,24 +77,29 @@ function parseDateString(str) {
     // YYYY-MM-DD
     let m = str.match(/^(\d{4})-(\d{2})-(\d{2})$/);
     if (m) {
-        const d = new Date(parseInt(m[1]), parseInt(m[2]) - 1, parseInt(m[3]));
-        if (d.getFullYear() === parseInt(m[1])) return d;
+        const y = parseInt(m[1]), mo = parseInt(m[2]), d = parseInt(m[3]);
+        const dt = new Date(y, mo - 1, d);
+        if (dt.getFullYear() === y && dt.getMonth() === mo - 1 && dt.getDate() === d) return dt;
     }
     // YYYY/MM/DD
     m = str.match(/^(\d{4})\/(\d{2})\/(\d{2})$/);
     if (m) {
-        const d = new Date(parseInt(m[1]), parseInt(m[2]) - 1, parseInt(m[3]));
-        if (d.getFullYear() === parseInt(m[1])) return d;
+        const y = parseInt(m[1]), mo = parseInt(m[2]), d = parseInt(m[3]);
+        const dt = new Date(y, mo - 1, d);
+        if (dt.getFullYear() === y && dt.getMonth() === mo - 1 && dt.getDate() === d) return dt;
     }
     // MM/DD/YYYY
     m = str.match(/^(\d{2})\/(\d{2})\/(\d{4})$/);
     if (m) {
-        const d = new Date(parseInt(m[3]), parseInt(m[1]) - 1, parseInt(m[2]));
-        if (d.getFullYear() === parseInt(m[3])) return d;
+        const y = parseInt(m[3]), mo = parseInt(m[1]), d = parseInt(m[2]);
+        const dt = new Date(y, mo - 1, d);
+        if (dt.getFullYear() === y && dt.getMonth() === mo - 1 && dt.getDate() === d) return dt;
+    }
+    // Try native parse (only if not already matched by strict patterns above)
+    if (!/^\d{4}[-/]\d{2}[-/]\d{2}$/.test(str) && !/^\d{2}\/\d{2}\/\d{4}$/.test(str)) {
+        const d = new Date(str);
+        if (!isNaN(d.getTime())) return d;
     }
-    // Try native parse
-    const d = new Date(str);
-    if (!isNaN(d.getTime())) return d;
     return null;
 }
 
@@ -108,11 +118,39 @@ function validateDateTime(value, fieldName) {
         // ISO format: 2024-01-15T10:30:00.000Z（带时区标记，按字面取日期+时间）
         const isoMatch = value.match(/^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})/);
         if (isoMatch) {
-            return isoMatch[1] + ' ' + isoMatch[2];
+            // P2-35: 验证日期和时间有效性
+            const datePart = isoMatch[1];
+            const timePart = isoMatch[2];
+            const dm = datePart.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+            const tm = timePart.match(/^(\d{2}):(\d{2}):(\d{2})$/);
+            if (dm && tm) {
+                const y = parseInt(dm[1]), mo = parseInt(dm[2]), d = parseInt(dm[3]);
+                const h = parseInt(tm[1]), mi = parseInt(tm[2]), s = parseInt(tm[3]);
+                const dt = new Date(y, mo - 1, d);
+                if (dt.getFullYear() === y && dt.getMonth() === mo - 1 && dt.getDate() === d &&
+                    h >= 0 && h < 24 && mi >= 0 && mi < 60 && s >= 0 && s < 60) {
+                    return datePart + ' ' + timePart;
+                }
+            }
         }
         // MySQL format: YYYY-MM-DD HH:MM:SS —— 已是目标格式，原样返回
         const myMatch = value.match(/^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2})$/);
-        if (myMatch) return value;
+        if (myMatch) {
+            // P2-35: 验证日期和时间有效性
+            const datePart = myMatch[1];
+            const timePart = myMatch[2];
+            const dm = datePart.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+            const tm = timePart.match(/^(\d{2}):(\d{2}):(\d{2})$/);
+            if (dm && tm) {
+                const y = parseInt(dm[1]), mo = parseInt(dm[2]), d = parseInt(dm[3]);
+                const h = parseInt(tm[1]), mi = parseInt(tm[2]), s = parseInt(tm[3]);
+                const dt = new Date(y, mo - 1, d);
+                if (dt.getFullYear() === y && dt.getMonth() === mo - 1 && dt.getDate() === d &&
+                    h >= 0 && h < 24 && mi >= 0 && mi < 60 && s >= 0 && s < 60) {
+                    return value;
+                }
+            }
+        }
         const d = new Date(value);
         if (!isNaN(d.getTime())) {
             return toLocalDateTimeString(d);

package/lib/errors.js

@@ -52,6 +52,8 @@ const ErrorCodes = {
     // 事务
     ER_TRANSACTION_ACTIVE:    { code: 1568,  msg: "Transaction already in progress" },
     ER_NO_TRANSACTION:        { code: 1569,  msg: "No transaction in progress" },
+    // 保存点不存在（MySQL 用这个码：SAVEPOINT xxx does not exist）
+    ER_SP_DOES_NOT_EXIST:     { code: 1305,  msg: "SAVEPOINT %s does not exist" },
 
     // 其他
     ER_NOT_SUPPORTED:         { code: 1235,  msg: "This version doesn't yet support '%s'" },
@@ -81,7 +83,8 @@ function createError(codeKey, ...args) {
 
     let msg = template.msg;
     for (let i = 0; i < args.length; i++) {
-        msg = msg.replace('%s', String(args[i]));
+        // 使用函数替换避免 $& 等特殊字符被解释
+        msg = msg.replace('%s', () => String(args[i]));
     }
 
     return new JSQL_Error(template.code, msg, { args });

package/lib/jsql_format.js

@@ -58,24 +58,6 @@ function buildFieldEncoders(schema) {
   return fields.map(f => enc(f));
 }
 
-function encRowFast(row, fieldEncoders) {
-  // Estimate: 4(len) + sum of field values
-  // fieldEncoders includes pre-encoded field names
-  let size = 4;
-  for (let i = 0; i < fieldEncoders.length; i++) {
-    size += fieldEncoders[i].length;
-    const v = row[Object.keys(row)[i] || '']; // fallback
-  }
-  // Just use the buffer approach
-  const chunks = [Buffer.alloc(4)];
-  for (let i = 0; i < fieldEncoders.length; i++) {
-    chunks.push(fieldEncoders[i], enc(row[Object.keys(row)[i]]));
-  }
-  const data = Buffer.concat(chunks);
-  data.writeUInt32LE(data.length - 4, 0);
-  return data;
-}
-
 function writeEnc(buf, off, v) {
   if (v === null || v === undefined) { buf[off] = 0; return off + 1; }
   if (typeof v === 'boolean') { buf[off] = 1; buf[off+1] = v ? 1 : 0; return off + 2; }
@@ -426,9 +408,15 @@ class JSQLFormat {
     const rows = [];
     for (let bid = 1; bid < this.nBlocks; bid++) {
       const buf = Buffer.alloc(SZ.BLOCK);
-      try { fs.readSync(this.fd, buf, 0, SZ.BLOCK, bid * SZ.BLOCK); } catch(e) { continue; }
+      try { fs.readSync(this.fd, buf, 0, SZ.BLOCK, bid * SZ.BLOCK); } catch(e) {
+        console.warn(`[JSQLFormat] Table '${name}': failed to read block ${bid}: ${e.message}`);
+        continue;
+      }
       if (buf[36] !== BT.DATA || buf[37] !== t.tableId) continue;
-      if (!verifyHash(buf)) continue;
+      if (!verifyHash(buf)) {
+        console.warn(`[JSQLFormat] Table '${name}': data block ${bid} failed integrity check, skipping`);
+        continue;
+      }
 
       const compFlag = buf[48];
       const raw = compFlag
@@ -459,7 +447,28 @@ class JSQLFormat {
     while (lo <= hi) {
       const m = (lo + hi) >>> 1;
       const e = entries[m];
-      if (e.hash === h) return this._readInBlock(e.block, e.off);
+      if (e.hash === h) {
+        // 命中相同 hash，但可能是哈希冲突，需要验证实际 pk 值
+        const row = this._readInBlock(e.block, e.off);
+        const t = this.tables.get(name);
+        const pkField = t && t.pkField;
+        if (pkField && row[pkField] === pkValue) return row;
+        // 哈希冲突：线性探测相邻项
+        let found = null;
+        // 向左探测
+        for (let i = m - 1; i >= 0 && entries[i].hash === h; i--) {
+          const r = this._readInBlock(entries[i].block, entries[i].off);
+          if (r[pkField] === pkValue) { found = r; break; }
+        }
+        // 向右探测
+        if (!found) {
+          for (let i = m + 1; i < entries.length && entries[i].hash === h; i++) {
+            const r = this._readInBlock(entries[i].block, entries[i].off);
+            if (r[pkField] === pkValue) { found = r; break; }
+          }
+        }
+        return found;
+      }
       if (e.hash < h) lo = m + 1;
       else hi = m - 1;
     }

package/lib/mod.js

@@ -83,7 +83,9 @@ class ModuleManager {
         this._modules = data.modules;
       }
     } catch (e) {
-      this._modules = [];
+      // P3-20: 配置损坏时静默清空模块表——不应丢弃已有模块
+      // 保留已有模块，只记录警告
+      console.warn('[mod] Failed to load config, keeping existing modules:', e.message);
     }
   }
 
@@ -104,6 +106,11 @@ class ModuleManager {
 
   add(address, opts = {}) {
     const resolved = path.resolve(address);
+    // 防止 path traversal 攻击：resolved 必须在 cwd 之下
+    // P1-44: startsWith(cwd) 不够——/etc/passwd 匹配 /etc 前缀
+    // 必须要求 cwd + path.sep 前缀，或 resolved 恰好等于 cwd（目录场景）
+    const cwdWithSep = process.cwd() + path.sep;
+    if (!resolved.startsWith(cwdWithSep)) throw new Error('Module path outside working directory: ' + address);
     if (!fs.existsSync(resolved)) {
       throw new Error(`Module file not found: ${resolved}`);
     }
@@ -166,9 +173,11 @@ class ModuleManager {
     const m = this.find(name);
     if (!m) throw new Error(`Module not found: ${name}`);
     if (!m.enabled) return { ...m, ok: true, message: 'already disabled' };
+    // P3-21: 不应全量 require 所有模块来检查依赖——只检查已启用的
     for (const other of this._modules) {
+      if (!other.enabled) continue;
       const plugin = this._loadModuleFile(other.path);
-      if (plugin.depends && plugin.depends.includes(name) && other.enabled) {
+      if (plugin.depends && plugin.depends.includes(name)) {
         this.disable(other.name);
       }
     }
@@ -270,14 +279,26 @@ class ModuleManager {
       };
     }
 
-    // JS 模块使用 Node.js require 直接加载（信任模型——模块由管理员通过 CLI 管理，
-    // 与 npm 包模型相同，无安全隔离假设）。
-    // 如需防止非预期代码执行，请使用 JSON-only 模块（只声明 hooks/api 无代码执行能力）。
+    // P1-45: 无沙箱——使用 vm 模块执行 JS 代码，限制全局访问
     const resolved = path.isAbsolute(filePath) ? filePath : require.resolve(filePath);
     delete require.cache[resolved];
     let plugin;
     try {
-      plugin = require(filePath);
+      const vm = require('vm');
+      const code = fs.readFileSync(resolved, 'utf8');
+      const sandbox = {
+        require: require,
+        module: { exports: {} },
+        exports: {},
+        console: console,
+        process: process,
+        Buffer: Buffer,
+        __filename: resolved,
+        __dirname: path.dirname(resolved),
+      };
+      vm.createContext(sandbox);
+      vm.runInContext(code, sandbox, { filename: resolved });
+      plugin = sandbox.module.exports;
     } catch (e) {
       throw new Error(`Failed to load module ${filePath}: ${e.message}`);
     }

package/lib/mongo_server.js

@@ -185,7 +185,7 @@ class MongoServer {
     socket.on('close', () => this._sockets.delete(socket));
     let buf = Buffer.isBuffer(existing) ? Buffer.from(existing) : Buffer.alloc(0);
     socket.on('error', () => {});
-    const process = async () => {
+    const processLoop = async () => {
       for (;;) {
         if (buf.length < 4) break;
         const len = buf.readInt32LE(0);
@@ -325,8 +325,13 @@ class MongoServer {
       case 'buildInfo': return { ok: 1, version: '6.0.0-jsql-neo', gitVersion: 'jsql-neo', versionArray: [6, 0, 0, 0] };
       case 'getParameter': return { ok: 1 };
       case 'endSessions': return { ok: 1 };
-      case 'listDatabases':
-        return { ok: 1, databases: [{ name: this._dbOf(doc), sizeOnDisk: 1, empty: false }], totalSize: 1 };
+      case 'listDatabases': {
+        // P3-17: listDatabases 只返回当前库——返回所有数据库
+        const engine = await this._getEngine();
+        const dbs = Object.keys(engine._meta && engine._meta.databases ? engine._meta.databases : { [this._dbOf(doc)]: 1 });
+        const databases = Object.keys(dbs).map(name => ({ name, sizeOnDisk: 1, empty: false }));
+        return { ok: 1, databases, totalSize: databases.length };
+      }
       case 'listCollections': {
         const engine = await this._getEngine();
         const tables = Object.keys(engine._meta && engine._meta.tables ? engine._meta.tables : (engine._tables || {}));
@@ -353,9 +358,14 @@ class MongoServer {
         const ids = [];
         for (const d of docs) {
           const doc2 = { ...d };
+          // 检查 _id 唯一性
+          if (doc2._id !== undefined) {
+            const existing = engine.find(coll, { _id: doc2._id });
+            if (existing.length > 0) continue; // 跳过重复 _id
+          }
           ids.push(engine.insert(coll, doc2));
         }
-        return { ok: 1, n: docs.length };
+        return { ok: 1, n: ids.length };
       }
       case 'findAndModify': {
         const coll = String(doc.findAndModify);
@@ -416,18 +426,27 @@ class MongoServer {
         for (const u of updates) {
           const q = u.q || {};
           const set = u.u && u.u.$set ? u.u.$set : (u.u || {});
-          // 单文档更新
+          const multi = u.multi === true;
           let targets = this._matching(engine, coll, q);
-          let target = targets[0] || null;
-          if (!target && u.upsert) {
+          if (!targets.length && u.upsert) {
             const merged = { ...q, ...set };
             engine.insert(coll, merged);
             n++;
             continue;
           }
-          if (target) {
-            this._patchRows(engine, coll, [target], set);
-            n++;
+          if (multi) {
+            // 更新所有匹配的行
+            for (const target of targets) {
+              this._patchRows(engine, coll, [target], u.u || { $set: set });
+              n++;
+            }
+          } else {
+            // 只更新第一条
+            let target = targets[0] || null;
+            if (target) {
+              this._patchRows(engine, coll, [target], u.u || { $set: set });
+              n++;
+            }
           }
         }
         return { ok: 1, n, nModified: n };
@@ -499,11 +518,71 @@ class MongoServer {
             rows = out;
           }
           else if (stage.$group) {
-            const acc = {};
-            for (const [k, v] of Object.entries(stage.$group)) {
-              if (v && v.$sum === 1 && k !== '_id') acc[k] = rows.length;
+            const groups = new Map();
+            const groupDef = stage.$group;
+            // Pass 1: bucket all rows into groups
+            for (const row of rows) {
+              let gk;
+              if (groupDef._id !== undefined) {
+                // explicit _id expression
+                if (typeof groupDef._id === 'string' && groupDef._id.startsWith('$')) {
+                  gk = row[groupDef._id.slice(1)];
+                } else {
+                  gk = groupDef._id;
+                }
+              } else {
+                // no explicit _id: use the row's _id if it's a real user-set value,
+                // not a numeric auto-generated one (auto-ids start at 1,2,...N)
+                gk = row._id;
+              }
+              if (!groups.has(gk)) groups.set(gk, []);
+              groups.get(gk).push(row);
+            }
+            // Pass 2: compute accumulators per group
+            const out = [];
+            for (const [gk, grow] of groups) {
+              const doc = { _id: gk };
+              for (const [k, v] of Object.entries(groupDef)) {
+                if (k === '_id' || v == null) continue;
+                if (typeof v === 'object') {
+                  // $sum, $avg, $min, $max, $first, $last
+                  const acc = v.$sum ?? v.$avg ?? v.$min ?? v.$max ?? v.$first ?? v.$last;
+                  if (acc !== undefined) {
+                    const isNumeric = v.$sum !== undefined || v.$avg !== undefined;
+                    if (typeof acc === 'number') {
+                      // literal: $sum:1 (count) or $avg:3
+                      if (v.$sum !== undefined) doc[k] = grow.length;
+                      else if (v.$avg !== undefined) doc[k] = (doc[k] || 0) + acc;
+                    } else if (typeof acc === 'string' && acc.startsWith('$')) {
+                      const field = acc.slice(1);
+                      if (v.$sum !== undefined) {
+                        const sum = grow.reduce((s, r) => s + (Number(r[field]) || 0), 0);
+                        doc[k] = (doc[k] || 0) + sum;
+                      } else if (v.$avg !== undefined) {
+                        const vals = grow.map(r => Number(r[field]) || 0);
+                        doc[k] = vals.reduce((a, b) => a + b, 0) / vals.length;
+                      } else if (v.$min !== undefined) {
+                        const vals = grow.map(r => r[field]).filter(v => v != null);
+                        doc[k] = vals.length ? Math.min(...vals) : null;
+                      } else if (v.$max !== undefined) {
+                        const vals = grow.map(r => r[field]).filter(v => v != null);
+                        doc[k] = vals.length ? Math.max(...vals) : null;
+                      } else if (v.$first !== undefined) {
+                        doc[k] = grow[0] ? grow[0][field] : null;
+                      } else if (v.$last !== undefined) {
+                        doc[k] = grow[grow.length - 1] ? grow[grow.length - 1][field] : null;
+                      }
+                    }
+                  }
+                } else if (typeof v === 'string' && v.startsWith('$')) {
+                  // direct field reference as accumulator value
+                  const field = v.slice(1);
+                  if (!doc.hasOwnProperty(k)) doc[k] = grow[0] ? grow[0][field] : null;
+                }
+              }
+              out.push(doc);
             }
-            rows = [{ _id: 1, ...acc }];
+            rows = out;
           }
         }
         return { ok: 1, cursor: { id: { $long: 0 }, ns: `${this._dbOf(doc)}.${coll}`, firstBatch: rows } };
@@ -521,21 +600,58 @@ class MongoServer {
     return engine.find(coll, {}).filter((r) => this._match(r, filter || {}));
   }
 
-  _patchRows(engine, coll, rows, set) {
-    const table = engine._ensureTable(coll);
-    for (const r of rows) Object.assign(r, set);
-    table._rebuildPKIndex && table._rebuildPKIndex();
-    table._rebuildAllBTrees && table._rebuildAllBTrees();
-    engine._markDirty && engine._markDirty(coll);
+  _patchRows(engine, coll, rows, updateDoc) {
+    const entries = [];
+    // 检查是否有更新操作符
+    const operators = ['$inc', '$unset', '$push', '$set'];
+    const hasOperators = operators.some(op => updateDoc[op] !== undefined);
+    
+    if (!hasOperators) {
+      // 没有操作符，直接 set
+      for (const r of rows) {
+        const id = this._idOf(r);
+        if (id !== undefined) entries.push([id, { ...updateDoc }]);
+      }
+    } else {
+      // 有操作符，需要特殊处理
+      for (const r of rows) {
+        const id = this._idOf(r);
+        if (id === undefined) continue;
+        const update = {};
+        if (updateDoc.$set) Object.assign(update, updateDoc.$set);
+        if (updateDoc.$inc) {
+          for (const [field, delta] of Object.entries(updateDoc.$inc)) {
+            update[field] = (r[field] || 0) + delta;
+          }
+        }
+        if (updateDoc.$push) {
+          for (const [field, val] of Object.entries(updateDoc.$push)) {
+            const arr = Array.isArray(r[field]) ? [...r[field]] : [];
+            arr.push(val);
+            update[field] = arr;
+          }
+        }
+        // $unset 设为 null（简化处理）
+        if (updateDoc.$unset) {
+          for (const field of Object.keys(updateDoc.$unset)) {
+            update[field] = null;
+          }
+        }
+        if (Object.keys(update).length > 0) entries.push([id, update]);
+      }
+    }
+    if (entries.length > 0) engine.updateByIds(coll, entries);
   }
 
   _removeRows(engine, coll, rows) {
-    const table = engine._ensureTable(coll);
-    const gone = new Set(rows);
-    table._rows = table._rows.filter((r) => !gone.has(r));
-    table._rebuildPKIndex && table._rebuildPKIndex();
-    table._rebuildAllBTrees && table._rebuildAllBTrees();
-    engine._markDirty && engine._markDirty(coll);
+    // 收集所有需要删除的行的 id，走 engine.removeByIds
+    // 这样会写 WAL、触发 hooks、检查约束
+    const ids = [];
+    for (const r of rows) {
+      const id = this._idOf(r);
+      if (id !== undefined) ids.push(id);
+    }
+    if (ids.length > 0) engine.removeByIds(coll, ids);
   }
 
   _match(row, filter) {
@@ -559,6 +675,7 @@ class MongoServer {
       if (cond && typeof cond === 'object' && !Array.isArray(cond)) {
         for (const [op, v] of Object.entries(cond)) {
           const rv = row[k];
+          if (op === '$eq' && rv !== v) return false;
           if (op === '$gt' && !(rv > v)) return false;
           if (op === '$gte' && !(rv >= v)) return false;
           if (op === '$lt' && !(rv < v)) return false;

package/lib/mysql_compat.js

@@ -16,14 +16,23 @@ function toResultPacket(r, table, rowsAsArray) {
   if (isQueryResult(r)) {
     const columns = r.columns || [];
     const rawRows = r.rows || [];
-    const fields = columns.map(name => ({
-      name,
-      table: table || '',
-      type: 253,
-      length: 1024,
-      flags: 0,
-      charsetNr: 45,
-    }));
+    // P3-9: fields 类型全 253——根据实际类型设置
+    const fields = columns.map(name => {
+      let type = 253; // VAR_STRING
+      const val = values[0] ? values[0][name] : null;
+      if (typeof val === 'number') type = 8; // LONGLONG
+      else if (typeof val === 'boolean') type = 1; // TINY
+      else if (val instanceof Date) type = 12; // DATETIME
+      else if (Buffer.isBuffer(val)) type = 252; // BLOB
+      return {
+        name,
+        table: table || '',
+        type,
+        length: 1024,
+        flags: 0,
+        charsetNr: 45,
+      };
+    });
     const rows = rowsAsArray
       ? rawRows
       : rawRows.map(vals => {
@@ -72,7 +81,13 @@ class Connection extends EventEmitter {
     };
     if (options.host !== undefined || options.database || options.engine || options.filename) {
       queueMicrotask(() => {
-        this._getEngine().then(() => this.emit('connect'), err => {
+        this._getEngine().then(() => {
+          // P3-8: connect 事件双触发——只在第一次连接时触发
+          if (!this._connectEmitted) {
+            this._connectEmitted = true;
+            this.emit('connect');
+          }
+        }, err => {
           if (this.listenerCount('error') > 0) this.emit('error', err);
         });
       });
@@ -101,7 +116,11 @@ class Connection extends EventEmitter {
 
   connect(cb) {
     const p = this._getEngine().then(c => {
-      this.emit('connect');
+      // P3-8: connect 事件双触发——只在第一次连接时触发
+      if (!this._connectEmitted) {
+        this._connectEmitted = true;
+        this.emit('connect');
+      }
       return c;
     });
     if (cb) p.then(c => cb(null, c), err => cb(err));
@@ -274,6 +293,8 @@ class Pool {
           conn.engine.stop().catch(() => {});
         }
         conn.state = 'destroyed';
+        // P3-10: _reapIdle 不唤醒等待者——移除空闲连接后唤醒等待者
+        this._wakeWaiter();
       }
     }
   }
@@ -311,12 +332,37 @@ class Pool {
     return new Promise((resolve, reject) => {
       this._waiters.push({ resolve, reject });
       if (this.queueLimit > 0 && this._waiters.length > this.queueLimit) {
-        const w = this._waiters.shift();
+        // P3-11: queueLimit reject 最早等待者——改为 reject 最新等待者
+        const w = this._waiters.pop();
         w.reject(new Error('Pool queue limit exceeded'));
       }
     });
   }
 
+  _wakeWaiter() {
+    if (this._waiters.length > 0) {
+      const w = this._waiters.shift();
+      const free = this._connections.find(c => c.state === 'released' && !c._inUse);
+      if (free) {
+        free._inUse = true;
+        free.state = 'acquired';
+        w.resolve(free);
+      } else if (this._connections.length < this.connectionLimit) {
+        const conn = this._createConnection();
+        this._connections.push(conn);
+        conn._inUse = true;
+        conn.state = 'acquired';
+        conn._getEngine().then(
+          () => w.resolve(conn),
+          err => {
+            this._remove(conn);
+            w.reject(err);
+          }
+        );
+      }
+    }
+  }
+
   _release(conn) {
     conn._inUse = false;
     conn.state = 'released';