jsql-neo 6.4.0-beta.1 → 6.4.0-beta.3

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.4.0-beta.1** — official release build · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.4.0-beta.3** — official release build · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.4.0-beta.1 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.4.0-beta.3 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/database.js

@@ -56,6 +56,35 @@ function parseFieldShorthand(str) {
     return def;
 }
 
+/**
+ * 深度相等比较两个行对象（用于无主键表的行匹配）。
+ * 剥离内部字段（_rid, _deleted）后逐字段比较。
+ */
+function _rowDeepEqual(a, b) {
+    if (a === b) return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object') return false;
+    const strip = (obj) => {
+        const out = {};
+        for (const [k, v] of Object.entries(obj)) {
+            if (k === '_rid' || k === '_deleted') continue;
+            out[k] = v;
+        }
+        return out;
+    };
+    const sa = strip(a), sb = strip(b);
+    const ka = Object.keys(sa), kb = Object.keys(sb);
+    if (ka.length !== kb.length) return false;
+    for (const k of ka) {
+        if (!Object.prototype.hasOwnProperty.call(sb, k)) return false;
+        const va = sa[k], vb = sb[k];
+        if (va === vb) continue;
+        if (va === null || va === undefined || vb === null || vb === undefined) return false;
+        if (typeof va === 'number' && typeof vb === 'number' && va === vb) continue;
+        if (String(va) !== String(vb)) return false;
+    }
+    return true;
+}
+
 class Database {
     /**
      * @param {string} filePath - 数据库文件/目录路径，传 null 或 ':memory:' 使用内存模式
@@ -113,6 +142,12 @@ class Database {
         this._plugins = [];
         this._hooks = createHookRegistry();
         this._eventListeners = [];
+
+        // P1: {modules:true} 自动加载插件（mod.config + ~/.jsql/plugins/）
+        this._autoPlugins = options.modules !== false;
+        if (this._autoPlugins) {
+            this._loadAutoPlugins();
+        }
         this._tableNames = new Set(Object.keys(this._tables));
         this._migrations = [];
         this._observers = [];      // 响应式观察者
@@ -1570,6 +1605,80 @@ class Database {
         return buildPluginContext(this, plugin);
     }
 
+    /**
+     * P1 修复：{modules:true} 自动加载插件。
+     * 1. 通过 ModuleManager 读取 ~/.config/jsql/mod.config，应用已启用的模块
+     * 2. 扫描 ~/.jsql/plugins/ 加载 registry 安装的插件
+     */
+    _loadAutoPlugins() {
+        // 1. mod.config 中的模块
+        try {
+            const { ModuleManager } = require('./mod');
+            new ModuleManager().applyTo(this);
+        } catch (e) {
+            if (process.env.JSQL_DEBUG) console.warn('[database] Failed to load mod.config:', e.message);
+        }
+        // 2. ~/.jsql/plugins/ 中的 registry 插件
+        try {
+            this._loadInstalledPlugins();
+        } catch (e) {
+            if (process.env.JSQL_DEBUG) console.warn('[database] Failed to load installed plugins:', e.message);
+        }
+    }
+
+    /**
+     * 扫描 ~/.jsql/plugins/ 目录，加载已安装的 registry 插件。
+     * 兼容两种布局：根级入口文件 + plugins/ 子目录入口文件。
+     */
+    _loadInstalledPlugins() {
+        const os = require('os');
+        const fs = require('fs');
+        const PLUGIN_DIR = path.join(os.homedir(), '.jsql', 'plugins');
+        if (!fs.existsSync(PLUGIN_DIR)) return;
+        const entries = fs.readdirSync(PLUGIN_DIR, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory()) continue;
+            const dir = path.join(PLUGIN_DIR, entry.name);
+            const manifestPath = path.join(dir, 'manifest.json');
+            if (!fs.existsSync(manifestPath)) continue;
+            let manifest;
+            try {
+                manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+            } catch { continue; }
+            if (manifest.disabled) continue;
+            const pluginName = manifest.name || entry.name;
+            // 查找入口文件：manifest.main || manifest.entry || 'index.js'
+            const entryFile = manifest.main || manifest.entry || 'index.js';
+            // 兼容两种路径：根级 + plugins/ 子目录
+            const candidates = [
+                path.join(dir, entryFile),
+                path.join(dir, entryFile + '.js'),
+                path.join(dir, 'plugins', entryFile),
+                path.join(dir, 'plugins', entryFile + '.js'),
+            ];
+            let entryPath = null;
+            for (const c of candidates) {
+                if (fs.existsSync(c) && fs.statSync(c).isFile()) {
+                    entryPath = c;
+                    break;
+                }
+            }
+            if (!entryPath) continue;
+            try {
+                const resolved = require.resolve(entryPath);
+                delete require.cache[resolved];
+                const plugin = require(resolved);
+                if (typeof plugin === 'function') {
+                    this.use({ name: pluginName, install: plugin });
+                } else if (plugin && typeof plugin === 'object') {
+                    if (!plugin.name) plugin.name = pluginName;
+                    this.use(plugin);
+                }
+            } catch (e) {
+                if (process.env.JSQL_DEBUG) console.warn('[database] Failed to load plugin', entry.name, e.message);
+            }
+        }
+    }n
     on(event, fn) {
         return registerHook(this, event, fn);
     }
@@ -1702,7 +1811,15 @@ class Database {
     _resolveId(table, id) {
         const pk = this._pkOf(table);
         if (pk) return table._rows.find(r => r[pk] === id) || null;
-        return table._rows[id - 1] || null;
+        // 无主键表：id 是行对象（可能是 find() 返回的浅拷贝）时，用内容匹配代替引用比较。
+        // 做法：逐行比对所有字段值是否相等；是数字时当 1-based 行号。
+        if (id && typeof id === 'object') {
+            const keys = Object.keys(id);
+            return table._rows.find(r => keys.every(k => r[k] === id[k])) || null;
+        }
+        const idx = Number(id);
+        if (!isNaN(idx)) return table._rows[idx - 1] || null;
+        return null;
     }
 
     find(tableName, filter, opts = {}) {
@@ -1867,20 +1984,29 @@ class Database {
         if (table._primaryKey) {
             for (const id of ids) removed += table.removeById(id);
         } else {
-            // 无主键表没有稳定的行标识，_resolveId 只能把 id 当 1-based 行号，
-            // 而 _rowPkId 在无主键时回退到 row.id（业务列名）——
-            // 两者语义不一致，导致 DELETE ... WHERE id IN (3,5) 删错行。
-            // 这里先按「行对象 === id」尝试（SQL 层可以直接传行引用），
-            // 退化到行号解析；并一次性收集目标后统一移除，避免边删边移位。
-            const targets = [];
+            // 无主键表没有稳定的行标识，P1-11 后 find() 返回浅拷贝（{...r}），
+            // 对象引用与 table._rows 里的原对象不同，不能用 Set.has(row) 做引用匹配。
+            // _resolveId 对无主键表做 table._rows[id-1]，传入对象时 id-1=NaN → undefined。
+            // 所以这里对对象 id 做深度相等匹配，对值 id 走 _resolveId（1-based 行号）。
             const seen = new Set();
-            const push = (row) => { if (row && !seen.has(row)) { seen.add(row); targets.push(row); } };
+            const targets = [];
             for (const id of ids) {
-                if (id && typeof id === 'object') { push(id); continue; }
-                push(this._resolveId(table, id));
+                let rowIndex;
+                if (id && typeof id === 'object') {
+                    // id 是行对象（find() 返回的浅拷贝），用深度相等匹配
+                    rowIndex = table._rows.findIndex(r => _rowDeepEqual(r, id));
+                } else {
+                    // id 是值（1-based 行号），_resolveId 能处理
+                    const original = this._resolveId(table, id);
+                    if (original) rowIndex = table._rows.indexOf(original);
+                }
+                if (rowIndex >= 0 && !seen.has(rowIndex)) {
+                    seen.add(rowIndex);
+                    targets.push(rowIndex);
+                }
             }
             if (targets.length) {
-                table._rows = table._rows.filter(r => !seen.has(r));
+                table._rows = table._rows.filter((_, idx) => !seen.has(idx));
                 removed = targets.length;
             }
             table._rebuildPKIndex();

package/lib/native_client.js

@@ -17,6 +17,35 @@ function safeParse(str, fallback) {
   try { return JSON.parse(str); } catch (e) { return fallback; }
 }
 
+/**
+ * 深度相等比较两个行对象（用于无主键表行匹配）。
+ * 剥离内部字段（_rid, _deleted）后逐字段比较。
+ */
+function _nativeRowDeepEqual(a, b) {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== 'object' || typeof b !== 'object') return false;
+  const strip = (obj) => {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (k === '_rid' || k === '_deleted') continue;
+      out[k] = v;
+    }
+    return out;
+  };
+  const sa = strip(a), sb = strip(b);
+  const ka = Object.keys(sa), kb = Object.keys(sb);
+  if (ka.length !== kb.length) return false;
+  for (const k of ka) {
+    if (!Object.prototype.hasOwnProperty.call(sb, k)) return false;
+    const va = sa[k], vb = sb[k];
+    if (va === vb) continue;
+    if (va === null || va === undefined || vb === null || vb === undefined) return false;
+    if (typeof va === 'number' && typeof vb === 'number' && va === vb) continue;
+    if (String(va) !== String(vb)) return false;
+  }
+  return true;
+}
+
 /**
  * 序列化对象/数组字段（JSON 列）并给出可读错误。直接 JSON.stringify 遇到循环引用会抛
  * "Converting circular structure to JSON"，指向不到具体列，这里补上表/列信息。
@@ -443,7 +472,21 @@ class JSQL {
       if (Array.isArray(r) && r.length > 0) return r[0].id;
       return null;
     }
-    return Number(id);
+    // 无主键表：id 应是 1-based 行号（数字）。
+    // 但 sql.js DELETE 对无主键表传的是行对象（find() 返回的浅拷贝），
+    // Number(obj) = NaN → JSON.stringify([NaN]) = "[null]" → 静默失效。
+    // 这里对对象 id 做深度相等匹配，找到对应行的序列号。
+    if (typeof id === 'number') return id;
+    if (id && typeof id === 'object') {
+      const all = safeParse(this._n('jsqlFind', table, '{}', 1000000, 0));
+      if (Array.isArray(all)) {
+        for (const r of all) {
+          const row = r.fields ? { ...r.fields, id: r.id } : r;
+          if (_nativeRowDeepEqual(row, id)) return r.id;
+        }
+      }
+    }
+    return null;
   }
 
   async _insertBatch(table, rows) {

package/lib/sql.js

@@ -613,24 +613,10 @@ class Parser {
       } else if (this.isWord('FOREIGN') || this.isWord('CHECK') ||
                  t.type === 'keyword' && (t.value === 'KEY' || t.value === 'INDEX')) {
         // 表级约束：FOREIGN KEY ... REFERENCES ... / CHECK (...) / KEY name (cols)
-        // P1-24: CREATE TABLE t (key TEXT) 报错——key 被当作表级约束
-        // 如果 KEY/INDEX 后面跟着列类型（TEXT/INT/VARCHAR 等），应解析为列定义
-        if (t.type === 'keyword' && (t.value === 'KEY' || t.value === 'INDEX')) {
-          const nextTok = this.peek(1);
-          if (nextTok && (nextTok.type === 'ident' || nextTok.type === 'keyword') &&
-              ['TEXT', 'INT', 'INTEGER', 'VARCHAR', 'CHAR', 'DATE', 'DATETIME', 'TIMESTAMP', 'BOOLEAN', 'BOOL', 'FLOAT', 'DOUBLE', 'DECIMAL', 'BLOB', 'JSON'].includes(String(nextTok.value).toUpperCase())) {
-            // P1-24: KEY/INDEX 是保留字，不能直接用 parseTableName()，改用 nameOfToken + next()
-            const col = nameOfToken(t);
-            this.next(); // 消费 KEY/INDEX token
-            const def = this.parseColumnDef();
-            schema[col] = def;
-            if (def.primaryKey) hasPk = true;
-          } else {
-            this._parseTableConstraint(schema);
-          }
-        } else {
-          this._parseTableConstraint(schema);
-        }
+        // KEY/INDEX 是保留字：裸写作列名（如 CREATE TABLE t (key TEXT)）必须报错，
+        // 由 _parseTableConstraint 消费 KEY 后遇到类型 token 触发
+        // "Expected ',' or ')'",见 identifier-keywords 测试。
+        this._parseTableConstraint(schema);
       } else if (t.type === 'eof' || (t.type === 'op' && t.value === ')')) {
         break;
       } else {
@@ -4117,6 +4103,25 @@ class SQLExecutor {
           ? await this.engine.getTableSchema(statement.name)
           : (this.engine._schemas ? this.engine._schemas[statement.name] : null);
         if (!schema) throw new Error(`Table '${statement.name}' does not exist`);
+        // P2: INSERT 未知列静默接受 → 应报 Unknown column
+        // 检查 statement.columns（INSERT INTO t (col1, col2) VALUES ...）
+        if (statement.columns && statement.columns.length > 0) {
+          for (const col of statement.columns) {
+            if (!Object.prototype.hasOwnProperty.call(schema, col)) {
+              throw new Error(`Unknown column '${col}' in '${statement.name}'`);
+            }
+          }
+        }
+        // 检查 dataRows 的键（INSERT INTO t SET col1=... 或 INSERT INTO t (col1) VALUES ...）
+        if (dataRows) {
+          for (const row of dataRows) {
+            for (const col of Object.keys(row)) {
+              if (!Object.prototype.hasOwnProperty.call(schema, col)) {
+                throw new Error(`Unknown column '${col}' in '${statement.name}'`);
+              }
+            }
+          }
+        }
         const stripDefault = (row) => {
           const out = {};
           for (const [k, v] of Object.entries(row)) {
@@ -4146,6 +4151,15 @@ class SQLExecutor {
         }
         if (dataRows === null && statement.values) {
           const colNames = Object.keys(schema);
+          // P2: INSERT 未知列静默接受 → 应报 Unknown column
+          // 检查 VALUES 数量是否超过列数（无列清单时）
+          if (!statement.columns || statement.columns.length === 0) {
+            for (const vals of statement.values) {
+              if (vals.length > colNames.length) {
+                throw new Error(`Unknown column in '${statement.name}': VALUES has ${vals.length} values but table has ${colNames.length} columns`);
+              }
+            }
+          }
           const skipAuto = statement.values[0].length < colNames.length;
           dataRows = statement.values.map(vals => {
             const row = {};

package/lib/sqlite_compat.js

@@ -286,7 +286,8 @@ class Statement {
 
   run(...params) {
     const r = this._call('run', params.length > 0 ? params : undefined);
-    return { changes: r && r.affectedRows, lastInsertRowid: r && r.insertId, _stmt: this };
+    // worker 层返回的是 better-sqlite3 风格的 {changes, lastInsertRowid}
+    return { changes: r && typeof r.changes === 'number' ? parseInt(r.changes, 10) : 0, lastInsertRowid: r && (r.lastInsertRowid !== undefined && r.lastInsertRowid !== null) ? r.lastInsertRowid : 0, _stmt: this };
   }
 
   get(...params) {

package/lib/wasm_client.js

@@ -10,6 +10,35 @@ function safeJsonParse(str) {
   try { return JSON.parse(str); } catch { return str; }
 }
 
+/**
+ * 深度相等比较两个行对象（用于无主键表行匹配）。
+ * 剥离内部字段（_rid, _deleted）后逐字段比较。
+ */
+function _wasmRowDeepEqual(a, b) {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== 'object' || typeof b !== 'object') return false;
+  const strip = (obj) => {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (k === '_rid' || k === '_deleted') continue;
+      out[k] = v;
+    }
+    return out;
+  };
+  const sa = strip(a), sb = strip(b);
+  const ka = Object.keys(sa), kb = Object.keys(sb);
+  if (ka.length !== kb.length) return false;
+  for (const k of ka) {
+    if (!Object.prototype.hasOwnProperty.call(sb, k)) return false;
+    const va = sa[k], vb = sb[k];
+    if (va === vb) continue;
+    if (va === null || va === undefined || vb === null || vb === undefined) return false;
+    if (typeof va === 'number' && typeof vb === 'number' && va === vb) continue;
+    if (String(va) !== String(vb)) return false;
+  }
+  return true;
+}
+
 /**
  * 序列化并给出可读错误。直接 JSON.stringify 遇到循环引用会抛
  * "Converting circular structure to JSON"，指向不到具体列，这里补上表/列信息。
@@ -434,7 +463,21 @@ class JSQL {
       if (Array.isArray(r) && r.length > 0) return r[0].id;
       return null;
     }
-    return Number(id);
+    // 无主键表：id 应是 1-based 行号（数字）。
+    // 但 sql.js DELETE 对无主键表传的是行对象（find() 返回的浅拷贝），
+    // Number(obj) = NaN → JSON.stringify([NaN]) = "[null]" → 静默失效。
+    // 这里对对象 id 做深度相等匹配，找到对应行的序列号。
+    if (typeof id === 'number') return id;
+    if (id && typeof id === 'object') {
+      const all = safeJsonParse(wasmBindings.jsql_find(table, '{}', 1000000, 0));
+      if (Array.isArray(all)) {
+        for (const r of all) {
+          const row = r.fields ? { ...r.fields, id: r.id } : r;
+          if (_wasmRowDeepEqual(row, id)) return r.id;
+        }
+      }
+    }
+    return null;
   }
 
   async _insertBatch(table, rows) {

package/lib/web_ui.js

@@ -116,6 +116,7 @@ class WebUI {
     this.readonly = !!opts.readonly;
     this.host = opts.host || '127.0.0.1';
     this.authToken = opts.authToken || null;
+    this.noAuth = !!opts.noAuth;   // 显式免认证（仅本地开发/测试用）
     this.allowOrigin = opts.allowOrigin || null;
     this.echoOrigin = !opts.allowOrigin && !!this.authToken;
     this.cache = new Map();
@@ -199,17 +200,22 @@ class WebUI {
       // API 认证：必须设置 authToken（从环境变量或构造选项）。
       // 仅当显式 noAuth: true 时允许无认证访问（仅本地开发用）。
       if (url.pathname.startsWith('/api/')) {
-        if (!this.noAuth && !this.authToken) {
-          res.writeHead(401, { 'Content-Type': 'application/json' });
-          return res.end(JSON.stringify({ ok: false, error: 'API auth not configured' }));
-        }
+        const deny = (msg) => {
+          // 显式配置了 CORS（allowOrigin / echoOrigin）时，401 也要带 ACAO，
+          // 否则浏览器会把认证失败误判为 CORS 拦截，无法区分两者。
+          const headers = { 'Content-Type': 'application/json' };
+          if (corsOrigin) {
+            headers['Access-Control-Allow-Origin'] = corsOrigin;
+            headers['Vary'] = 'Origin';
+          }
+          res.writeHead(401, headers);
+          res.end(JSON.stringify({ ok: false, error: msg }));
+        };
+        if (!this.noAuth && !this.authToken) return deny('API auth not configured');
         if (this.authToken) {
           const provided = req.headers.authorization || '';
           const token = provided.startsWith('Bearer ') ? provided.slice(7) : '';
-          if (token !== this.authToken) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            return res.end(JSON.stringify({ ok: false, error: 'unauthorized' }));
-          }
+          if (token !== this.authToken) return deny('unauthorized');
         }
       }
       if (url.pathname === '/api/databases' && req.method === 'GET') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.4.0-beta.1",
+  "version": "6.4.0-beta.3",
   "description": "JSQL-NEO — Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",
@@ -46,7 +46,7 @@
   ],
   "scripts": {
     "postinstall": "node postinstall.js",
-    "test": "node test/smoke.js && node test/sql-parser.test.js && node test/readme-audit.test.js && node test/query-opt.test.js && node test/wal-recovery.test.js && node test/mysql-compat-hijack.test.js",
+    "test": "node test/smoke.js && node test/sql-parser.test.js && node test/readme-audit.test.js && node test/query-opt.test.js && node test/wal-recovery.test.js && node test/mysql-compat-hijack.test.js && node test/dml-constraints.test.js",
     "test:parser": "node test/sql-parser.test.js",
     "test:btree": "node test/btree.test.js",
     "test:native": "node test/native.test.js",

package/test/coverage.js

@@ -91,7 +91,9 @@ function tmp(name) {
       __meta__: { version: 1 },
       users: [{ id: 1, name: 'Alice' }, { id: 2, name: 'Bob' }],
     }));
-    const ui = new WebUI({ port: 0, dataDir: path.dirname(dbFile) });
+    // API 认证模型（3895dca 起）：无 authToken 时 /api/* 一律 401。
+    // 本测试是功能测试，需要真实访问 API，故显式 noAuth: true。
+    const ui = new WebUI({ port: 0, dataDir: path.dirname(dbFile), noAuth: true });
     const port = await ui.start();
     const dbs = await (await fetch(`http://127.0.0.1:${port}/api/databases`)).json();
     ok('webui list databases', dbs.length === 1 && dbs[0].name === 'db');

package/test/dml-constraints.test.js

@@ -198,6 +198,22 @@ async function t(name, fn) {
     return eq(await scalar(`SELECT v FROM t WHERE id = 1`), 'c');
   });
 
+  // P2: INSERT 未知列曾静默接受 → 应报 Unknown column
+  console.log('\n--- INSERT 未知列应报错 ---');
+  await t('INSERT 未知列（指定列清单）→ 报错', async ({ exec, mustFail }) => {
+    await exec(`CREATE TABLE t (id INT, v TEXT)`);
+    return mustFail(`INSERT INTO t (id, unknown_col) VALUES (1, 'x')`);
+  });
+  await t('INSERT 未知列（VALUES 全列）→ 报错', async ({ exec, mustFail }) => {
+    await exec(`CREATE TABLE t (id INT, v TEXT)`);
+    return mustFail(`INSERT INTO t VALUES (1, 'x', 'extra')`);
+  });
+  await t('INSERT 已知列 → 正常', async ({ exec, scalar }) => {
+    await exec(`CREATE TABLE t (id INT, v TEXT)`);
+    await exec(`INSERT INTO t (id, v) VALUES (1, 'x')`);
+    return eq(await scalar(`SELECT v FROM t WHERE id = 1`), 'x');
+  });
+
   console.log(`\n${pass} passed, ${fail} failed`);
   process.exit(fail === 0 ? 0 : 1);
 })();