jsql-neo 6.4.0-beta.1 → 6.4.0-beta.4

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.4.0-beta.1** — official release build · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.4.0-beta.4** — official release build · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.4.0-beta.1 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.4.0-beta.4 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/database.js

@@ -56,6 +56,35 @@ function parseFieldShorthand(str) {
     return def;
 }
 
+/**
+ * 深度相等比较两个行对象（用于无主键表的行匹配）。
+ * 剥离内部字段（_rid, _deleted）后逐字段比较。
+ */
+function _rowDeepEqual(a, b) {
+    if (a === b) return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object') return false;
+    const strip = (obj) => {
+        const out = {};
+        for (const [k, v] of Object.entries(obj)) {
+            if (k === '_rid' || k === '_deleted') continue;
+            out[k] = v;
+        }
+        return out;
+    };
+    const sa = strip(a), sb = strip(b);
+    const ka = Object.keys(sa), kb = Object.keys(sb);
+    if (ka.length !== kb.length) return false;
+    for (const k of ka) {
+        if (!Object.prototype.hasOwnProperty.call(sb, k)) return false;
+        const va = sa[k], vb = sb[k];
+        if (va === vb) continue;
+        if (va === null || va === undefined || vb === null || vb === undefined) return false;
+        if (typeof va === 'number' && typeof vb === 'number' && va === vb) continue;
+        if (String(va) !== String(vb)) return false;
+    }
+    return true;
+}
+
 class Database {
     /**
      * @param {string} filePath - 数据库文件/目录路径，传 null 或 ':memory:' 使用内存模式
@@ -113,6 +142,12 @@ class Database {
         this._plugins = [];
         this._hooks = createHookRegistry();
         this._eventListeners = [];
+
+        // P1: {modules:true} 自动加载插件（mod.config + ~/.jsql/plugins/）
+        this._autoPlugins = options.modules !== false;
+        if (this._autoPlugins) {
+            this._loadAutoPlugins();
+        }
         this._tableNames = new Set(Object.keys(this._tables));
         this._migrations = [];
         this._observers = [];      // 响应式观察者
@@ -1570,6 +1605,80 @@ class Database {
         return buildPluginContext(this, plugin);
     }
 
+    /**
+     * P1 修复：{modules:true} 自动加载插件。
+     * 1. 通过 ModuleManager 读取 ~/.config/jsql/mod.config，应用已启用的模块
+     * 2. 扫描 ~/.jsql/plugins/ 加载 registry 安装的插件
+     */
+    _loadAutoPlugins() {
+        // 1. mod.config 中的模块
+        try {
+            const { ModuleManager } = require('./mod');
+            new ModuleManager().applyTo(this);
+        } catch (e) {
+            if (process.env.JSQL_DEBUG) console.warn('[database] Failed to load mod.config:', e.message);
+        }
+        // 2. ~/.jsql/plugins/ 中的 registry 插件
+        try {
+            this._loadInstalledPlugins();
+        } catch (e) {
+            if (process.env.JSQL_DEBUG) console.warn('[database] Failed to load installed plugins:', e.message);
+        }
+    }
+
+    /**
+     * 扫描 ~/.jsql/plugins/ 目录，加载已安装的 registry 插件。
+     * 兼容两种布局：根级入口文件 + plugins/ 子目录入口文件。
+     */
+    _loadInstalledPlugins() {
+        const os = require('os');
+        const fs = require('fs');
+        const PLUGIN_DIR = path.join(os.homedir(), '.jsql', 'plugins');
+        if (!fs.existsSync(PLUGIN_DIR)) return;
+        const entries = fs.readdirSync(PLUGIN_DIR, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory()) continue;
+            const dir = path.join(PLUGIN_DIR, entry.name);
+            const manifestPath = path.join(dir, 'manifest.json');
+            if (!fs.existsSync(manifestPath)) continue;
+            let manifest;
+            try {
+                manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+            } catch { continue; }
+            if (manifest.disabled) continue;
+            const pluginName = manifest.name || entry.name;
+            // 查找入口文件：manifest.main || manifest.entry || 'index.js'
+            const entryFile = manifest.main || manifest.entry || 'index.js';
+            // 兼容两种路径：根级 + plugins/ 子目录
+            const candidates = [
+                path.join(dir, entryFile),
+                path.join(dir, entryFile + '.js'),
+                path.join(dir, 'plugins', entryFile),
+                path.join(dir, 'plugins', entryFile + '.js'),
+            ];
+            let entryPath = null;
+            for (const c of candidates) {
+                if (fs.existsSync(c) && fs.statSync(c).isFile()) {
+                    entryPath = c;
+                    break;
+                }
+            }
+            if (!entryPath) continue;
+            try {
+                const resolved = require.resolve(entryPath);
+                delete require.cache[resolved];
+                const plugin = require(resolved);
+                if (typeof plugin === 'function') {
+                    this.use({ name: pluginName, install: plugin });
+                } else if (plugin && typeof plugin === 'object') {
+                    if (!plugin.name) plugin.name = pluginName;
+                    this.use(plugin);
+                }
+            } catch (e) {
+                if (process.env.JSQL_DEBUG) console.warn('[database] Failed to load plugin', entry.name, e.message);
+            }
+        }
+    }n
     on(event, fn) {
         return registerHook(this, event, fn);
     }
@@ -1702,7 +1811,15 @@ class Database {
     _resolveId(table, id) {
         const pk = this._pkOf(table);
         if (pk) return table._rows.find(r => r[pk] === id) || null;
-        return table._rows[id - 1] || null;
+        // 无主键表：id 是行对象（可能是 find() 返回的浅拷贝）时，用内容匹配代替引用比较。
+        // 做法：逐行比对所有字段值是否相等；是数字时当 1-based 行号。
+        if (id && typeof id === 'object') {
+            const keys = Object.keys(id);
+            return table._rows.find(r => keys.every(k => r[k] === id[k])) || null;
+        }
+        const idx = Number(id);
+        if (!isNaN(idx)) return table._rows[idx - 1] || null;
+        return null;
     }
 
     find(tableName, filter, opts = {}) {
@@ -1867,20 +1984,29 @@ class Database {
         if (table._primaryKey) {
             for (const id of ids) removed += table.removeById(id);
         } else {
-            // 无主键表没有稳定的行标识，_resolveId 只能把 id 当 1-based 行号，
-            // 而 _rowPkId 在无主键时回退到 row.id（业务列名）——
-            // 两者语义不一致，导致 DELETE ... WHERE id IN (3,5) 删错行。
-            // 这里先按「行对象 === id」尝试（SQL 层可以直接传行引用），
-            // 退化到行号解析；并一次性收集目标后统一移除，避免边删边移位。
-            const targets = [];
+            // 无主键表没有稳定的行标识，P1-11 后 find() 返回浅拷贝（{...r}），
+            // 对象引用与 table._rows 里的原对象不同，不能用 Set.has(row) 做引用匹配。
+            // _resolveId 对无主键表做 table._rows[id-1]，传入对象时 id-1=NaN → undefined。
+            // 所以这里对对象 id 做深度相等匹配，对值 id 走 _resolveId（1-based 行号）。
             const seen = new Set();
-            const push = (row) => { if (row && !seen.has(row)) { seen.add(row); targets.push(row); } };
+            const targets = [];
             for (const id of ids) {
-                if (id && typeof id === 'object') { push(id); continue; }
-                push(this._resolveId(table, id));
+                let rowIndex;
+                if (id && typeof id === 'object') {
+                    // id 是行对象（find() 返回的浅拷贝），用深度相等匹配
+                    rowIndex = table._rows.findIndex(r => _rowDeepEqual(r, id));
+                } else {
+                    // id 是值（1-based 行号），_resolveId 能处理
+                    const original = this._resolveId(table, id);
+                    if (original) rowIndex = table._rows.indexOf(original);
+                }
+                if (rowIndex >= 0 && !seen.has(rowIndex)) {
+                    seen.add(rowIndex);
+                    targets.push(rowIndex);
+                }
             }
             if (targets.length) {
-                table._rows = table._rows.filter(r => !seen.has(r));
+                table._rows = table._rows.filter((_, idx) => !seen.has(idx));
                 removed = targets.length;
             }
             table._rebuildPKIndex();

package/lib/native_client.js

@@ -17,6 +17,35 @@ function safeParse(str, fallback) {
   try { return JSON.parse(str); } catch (e) { return fallback; }
 }
 
+/**
+ * 深度相等比较两个行对象（用于无主键表行匹配）。
+ * 剥离内部字段（_rid, _deleted）后逐字段比较。
+ */
+function _nativeRowDeepEqual(a, b) {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== 'object' || typeof b !== 'object') return false;
+  const strip = (obj) => {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (k === '_rid' || k === '_deleted') continue;
+      out[k] = v;
+    }
+    return out;
+  };
+  const sa = strip(a), sb = strip(b);
+  const ka = Object.keys(sa), kb = Object.keys(sb);
+  if (ka.length !== kb.length) return false;
+  for (const k of ka) {
+    if (!Object.prototype.hasOwnProperty.call(sb, k)) return false;
+    const va = sa[k], vb = sb[k];
+    if (va === vb) continue;
+    if (va === null || va === undefined || vb === null || vb === undefined) return false;
+    if (typeof va === 'number' && typeof vb === 'number' && va === vb) continue;
+    if (String(va) !== String(vb)) return false;
+  }
+  return true;
+}
+
 /**
  * 序列化对象/数组字段（JSON 列）并给出可读错误。直接 JSON.stringify 遇到循环引用会抛
  * "Converting circular structure to JSON"，指向不到具体列，这里补上表/列信息。
@@ -443,7 +472,21 @@ class JSQL {
       if (Array.isArray(r) && r.length > 0) return r[0].id;
       return null;
     }
-    return Number(id);
+    // 无主键表：id 应是 1-based 行号（数字）。
+    // 但 sql.js DELETE 对无主键表传的是行对象（find() 返回的浅拷贝），
+    // Number(obj) = NaN → JSON.stringify([NaN]) = "[null]" → 静默失效。
+    // 这里对对象 id 做深度相等匹配，找到对应行的序列号。
+    if (typeof id === 'number') return id;
+    if (id && typeof id === 'object') {
+      const all = safeParse(this._n('jsqlFind', table, '{}', 1000000, 0));
+      if (Array.isArray(all)) {
+        for (const r of all) {
+          const row = r.fields ? { ...r.fields, id: r.id } : r;
+          if (_nativeRowDeepEqual(row, id)) return r.id;
+        }
+      }
+    }
+    return null;
   }
 
   async _insertBatch(table, rows) {

package/lib/sql.js

@@ -136,8 +136,22 @@ function tokenize(sql) {
   let i = 0;
   const n = sql.length;
 
+  // 获取位置 i 处的完整 Unicode 字符（处理代理对，如 emoji）
+  // 返回 { char, length }，char 是完整字符，length 是 UTF-16 码元数
+  function charAt(pos) {
+    const c = sql[pos];
+    const code = sql.charCodeAt(pos);
+    if (code >= 0xD800 && code <= 0xDBFF && pos + 1 < n) {
+      const next = sql.charCodeAt(pos + 1);
+      if (next >= 0xDC00 && next <= 0xDFFF) {
+        return { char: sql.slice(pos, pos + 2), length: 2 };
+      }
+    }
+    return { char: c, length: 1 };
+  }
+
   while (i < n) {
-    const c = sql[i];
+    const { char: c, length: cLen } = charAt(i);
 
     if (c === ' ' || c === '\t' || c === '\n' || c === '\r') { i++; continue; }
 
@@ -188,6 +202,37 @@ function tokenize(sql) {
       continue;
     }
 
+    // 16 进制字面量：0x1F / 0XFF / X'1F' / x'FF'
+    // 标准 SQL：0x 前缀或 X'' 包裹，解析成十进制整数
+    if ((c === '0' && (sql[i + 1] === 'x' || sql[i + 1] === 'X')) ||
+        ((c === 'X' || c === 'x') && sql[i + 1] === "'")) {
+      if (c === '0') {
+        // 0x 前缀形式：0x1F, 0XFF
+        let j = i + 2;
+        while (j < n && /[0-9A-Fa-f]/.test(sql[j])) j++;
+        if (j === i + 2) throw new Error(`Invalid hexadecimal literal at position ${i}`);
+        const hexStr = sql.slice(i + 2, j);
+        const numVal = parseInt(hexStr, 16);
+        tokens.push(new SQLToken('number', numVal, i));
+        i = j;
+        continue;
+      } else {
+        // X'...' 形式：X'1F', x'FF'
+        let j = i + 2;
+        let hexStr = '';
+        while (j < n && sql[j] !== "'") {
+          if (!/[0-9A-Fa-f]/.test(sql[j])) throw new Error(`Invalid hexadecimal literal at position ${j}`);
+          hexStr += sql[j];
+          j++;
+        }
+        if (j >= n) throw new Error(`Unterminated hexadecimal literal at position ${i}`);
+        const numVal = parseInt(hexStr, 16);
+        tokens.push(new SQLToken('number', numVal, i));
+        i = j + 1;
+        continue;
+      }
+    }
+
     if (/[0-9]/.test(c) || (c === '.' && /[0-9]/.test(sql[i + 1] || ''))) {
       let j = i;
       let isFloat = false;
@@ -219,9 +264,16 @@ function tokenize(sql) {
       continue;
     }
 
-    if (/[a-zA-Z_$]/.test(c)) {
-      let j = i;
-      while (j < n && /[a-zA-Z0-9_$]/.test(sql[j])) j++;
+    // Unicode 标识符：标准 SQL 允许非 ASCII 字母做列名/表名（中文、emoji 等）
+    // \p{L} = Unicode 字母，\p{So} = Unicode 其他符号（含 emoji），\p{M} = 组合标记
+    // 注意：不包含 \p{Sm}（数学符号如 + = < >）和 \p{P}（标点如 ( ) , ;）
+    if (/[\p{L}\p{So}\p{Sc}\p{M}_$]/u.test(c)) {
+      let j = i + cLen;
+      while (j < n) {
+        const { char: jc, length: jLen } = charAt(j);
+        if (!/[\p{L}\p{N}\p{So}\p{Sc}\p{M}_$]/u.test(jc)) break;
+        j += jLen;
+      }
       const word = sql.slice(i, j);
       const upper = word.toUpperCase();
       const tok = new SQLToken(KEYWORDS.has(upper) ? 'keyword' : 'ident', word, i);
@@ -613,24 +665,10 @@ class Parser {
       } else if (this.isWord('FOREIGN') || this.isWord('CHECK') ||
                  t.type === 'keyword' && (t.value === 'KEY' || t.value === 'INDEX')) {
         // 表级约束：FOREIGN KEY ... REFERENCES ... / CHECK (...) / KEY name (cols)
-        // P1-24: CREATE TABLE t (key TEXT) 报错——key 被当作表级约束
-        // 如果 KEY/INDEX 后面跟着列类型（TEXT/INT/VARCHAR 等），应解析为列定义
-        if (t.type === 'keyword' && (t.value === 'KEY' || t.value === 'INDEX')) {
-          const nextTok = this.peek(1);
-          if (nextTok && (nextTok.type === 'ident' || nextTok.type === 'keyword') &&
-              ['TEXT', 'INT', 'INTEGER', 'VARCHAR', 'CHAR', 'DATE', 'DATETIME', 'TIMESTAMP', 'BOOLEAN', 'BOOL', 'FLOAT', 'DOUBLE', 'DECIMAL', 'BLOB', 'JSON'].includes(String(nextTok.value).toUpperCase())) {
-            // P1-24: KEY/INDEX 是保留字，不能直接用 parseTableName()，改用 nameOfToken + next()
-            const col = nameOfToken(t);
-            this.next(); // 消费 KEY/INDEX token
-            const def = this.parseColumnDef();
-            schema[col] = def;
-            if (def.primaryKey) hasPk = true;
-          } else {
-            this._parseTableConstraint(schema);
-          }
-        } else {
-          this._parseTableConstraint(schema);
-        }
+        // KEY/INDEX 是保留字：裸写作列名（如 CREATE TABLE t (key TEXT)）必须报错，
+        // 由 _parseTableConstraint 消费 KEY 后遇到类型 token 触发
+        // "Expected ',' or ')'",见 identifier-keywords 测试。
+        this._parseTableConstraint(schema);
       } else if (t.type === 'eof' || (t.type === 'op' && t.value === ')')) {
         break;
       } else {
@@ -4117,6 +4155,25 @@ class SQLExecutor {
           ? await this.engine.getTableSchema(statement.name)
           : (this.engine._schemas ? this.engine._schemas[statement.name] : null);
         if (!schema) throw new Error(`Table '${statement.name}' does not exist`);
+        // P2: INSERT 未知列静默接受 → 应报 Unknown column
+        // 检查 statement.columns（INSERT INTO t (col1, col2) VALUES ...）
+        if (statement.columns && statement.columns.length > 0) {
+          for (const col of statement.columns) {
+            if (!Object.prototype.hasOwnProperty.call(schema, col)) {
+              throw new Error(`Unknown column '${col}' in '${statement.name}'`);
+            }
+          }
+        }
+        // 检查 dataRows 的键（INSERT INTO t SET col1=... 或 INSERT INTO t (col1) VALUES ...）
+        if (dataRows) {
+          for (const row of dataRows) {
+            for (const col of Object.keys(row)) {
+              if (!Object.prototype.hasOwnProperty.call(schema, col)) {
+                throw new Error(`Unknown column '${col}' in '${statement.name}'`);
+              }
+            }
+          }
+        }
         const stripDefault = (row) => {
           const out = {};
           for (const [k, v] of Object.entries(row)) {
@@ -4146,6 +4203,15 @@ class SQLExecutor {
         }
         if (dataRows === null && statement.values) {
           const colNames = Object.keys(schema);
+          // P2: INSERT 未知列静默接受 → 应报 Unknown column
+          // 检查 VALUES 数量是否超过列数（无列清单时）
+          if (!statement.columns || statement.columns.length === 0) {
+            for (const vals of statement.values) {
+              if (vals.length > colNames.length) {
+                throw new Error(`Unknown column in '${statement.name}': VALUES has ${vals.length} values but table has ${colNames.length} columns`);
+              }
+            }
+          }
           const skipAuto = statement.values[0].length < colNames.length;
           dataRows = statement.values.map(vals => {
             const row = {};

package/lib/sqlite_compat.js

@@ -286,7 +286,8 @@ class Statement {
 
   run(...params) {
     const r = this._call('run', params.length > 0 ? params : undefined);
-    return { changes: r && r.affectedRows, lastInsertRowid: r && r.insertId, _stmt: this };
+    // worker 层返回的是 better-sqlite3 风格的 {changes, lastInsertRowid}
+    return { changes: r && typeof r.changes === 'number' ? parseInt(r.changes, 10) : 0, lastInsertRowid: r && (r.lastInsertRowid !== undefined && r.lastInsertRowid !== null) ? r.lastInsertRowid : 0, _stmt: this };
   }
 
   get(...params) {

package/lib/wasm_client.js

@@ -10,6 +10,35 @@ function safeJsonParse(str) {
   try { return JSON.parse(str); } catch { return str; }
 }
 
+/**
+ * 深度相等比较两个行对象（用于无主键表行匹配）。
+ * 剥离内部字段（_rid, _deleted）后逐字段比较。
+ */
+function _wasmRowDeepEqual(a, b) {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== 'object' || typeof b !== 'object') return false;
+  const strip = (obj) => {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (k === '_rid' || k === '_deleted') continue;
+      out[k] = v;
+    }
+    return out;
+  };
+  const sa = strip(a), sb = strip(b);
+  const ka = Object.keys(sa), kb = Object.keys(sb);
+  if (ka.length !== kb.length) return false;
+  for (const k of ka) {
+    if (!Object.prototype.hasOwnProperty.call(sb, k)) return false;
+    const va = sa[k], vb = sb[k];
+    if (va === vb) continue;
+    if (va === null || va === undefined || vb === null || vb === undefined) return false;
+    if (typeof va === 'number' && typeof vb === 'number' && va === vb) continue;
+    if (String(va) !== String(vb)) return false;
+  }
+  return true;
+}
+
 /**
  * 序列化并给出可读错误。直接 JSON.stringify 遇到循环引用会抛
  * "Converting circular structure to JSON"，指向不到具体列，这里补上表/列信息。
@@ -434,7 +463,21 @@ class JSQL {
       if (Array.isArray(r) && r.length > 0) return r[0].id;
       return null;
     }
-    return Number(id);
+    // 无主键表：id 应是 1-based 行号（数字）。
+    // 但 sql.js DELETE 对无主键表传的是行对象（find() 返回的浅拷贝），
+    // Number(obj) = NaN → JSON.stringify([NaN]) = "[null]" → 静默失效。
+    // 这里对对象 id 做深度相等匹配，找到对应行的序列号。
+    if (typeof id === 'number') return id;
+    if (id && typeof id === 'object') {
+      const all = safeJsonParse(wasmBindings.jsql_find(table, '{}', 1000000, 0));
+      if (Array.isArray(all)) {
+        for (const r of all) {
+          const row = r.fields ? { ...r.fields, id: r.id } : r;
+          if (_wasmRowDeepEqual(row, id)) return r.id;
+        }
+      }
+    }
+    return null;
   }
 
   async _insertBatch(table, rows) {

package/lib/web_ui.js

@@ -116,6 +116,7 @@ class WebUI {
     this.readonly = !!opts.readonly;
     this.host = opts.host || '127.0.0.1';
     this.authToken = opts.authToken || null;
+    this.noAuth = !!opts.noAuth;   // 显式免认证（仅本地开发/测试用）
     this.allowOrigin = opts.allowOrigin || null;
     this.echoOrigin = !opts.allowOrigin && !!this.authToken;
     this.cache = new Map();
@@ -199,17 +200,22 @@ class WebUI {
       // API 认证：必须设置 authToken（从环境变量或构造选项）。
       // 仅当显式 noAuth: true 时允许无认证访问（仅本地开发用）。
       if (url.pathname.startsWith('/api/')) {
-        if (!this.noAuth && !this.authToken) {
-          res.writeHead(401, { 'Content-Type': 'application/json' });
-          return res.end(JSON.stringify({ ok: false, error: 'API auth not configured' }));
-        }
+        const deny = (msg) => {
+          // 显式配置了 CORS（allowOrigin / echoOrigin）时，401 也要带 ACAO，
+          // 否则浏览器会把认证失败误判为 CORS 拦截，无法区分两者。
+          const headers = { 'Content-Type': 'application/json' };
+          if (corsOrigin) {
+            headers['Access-Control-Allow-Origin'] = corsOrigin;
+            headers['Vary'] = 'Origin';
+          }
+          res.writeHead(401, headers);
+          res.end(JSON.stringify({ ok: false, error: msg }));
+        };
+        if (!this.noAuth && !this.authToken) return deny('API auth not configured');
         if (this.authToken) {
           const provided = req.headers.authorization || '';
           const token = provided.startsWith('Bearer ') ? provided.slice(7) : '';
-          if (token !== this.authToken) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            return res.end(JSON.stringify({ ok: false, error: 'unauthorized' }));
-          }
+          if (token !== this.authToken) return deny('unauthorized');
         }
       }
       if (url.pathname === '/api/databases' && req.method === 'GET') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.4.0-beta.1",
+  "version": "6.4.0-beta.4",
   "description": "JSQL-NEO — Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",
@@ -46,7 +46,7 @@
   ],
   "scripts": {
     "postinstall": "node postinstall.js",
-    "test": "node test/smoke.js && node test/sql-parser.test.js && node test/readme-audit.test.js && node test/query-opt.test.js && node test/wal-recovery.test.js && node test/mysql-compat-hijack.test.js",
+    "test": "node test/smoke.js && node test/sql-parser.test.js && node test/readme-audit.test.js && node test/query-opt.test.js && node test/wal-recovery.test.js && node test/mysql-compat-hijack.test.js && node test/dml-constraints.test.js",
     "test:parser": "node test/sql-parser.test.js",
     "test:btree": "node test/btree.test.js",
     "test:native": "node test/native.test.js",

package/test/coverage.js

@@ -91,7 +91,9 @@ function tmp(name) {
       __meta__: { version: 1 },
       users: [{ id: 1, name: 'Alice' }, { id: 2, name: 'Bob' }],
     }));
-    const ui = new WebUI({ port: 0, dataDir: path.dirname(dbFile) });
+    // API 认证模型（3895dca 起）：无 authToken 时 /api/* 一律 401。
+    // 本测试是功能测试，需要真实访问 API，故显式 noAuth: true。
+    const ui = new WebUI({ port: 0, dataDir: path.dirname(dbFile), noAuth: true });
     const port = await ui.start();
     const dbs = await (await fetch(`http://127.0.0.1:${port}/api/databases`)).json();
     ok('webui list databases', dbs.length === 1 && dbs[0].name === 'db');

package/test/dml-constraints.test.js

@@ -198,6 +198,22 @@ async function t(name, fn) {
     return eq(await scalar(`SELECT v FROM t WHERE id = 1`), 'c');
   });
 
+  // P2: INSERT 未知列曾静默接受 → 应报 Unknown column
+  console.log('\n--- INSERT 未知列应报错 ---');
+  await t('INSERT 未知列（指定列清单）→ 报错', async ({ exec, mustFail }) => {
+    await exec(`CREATE TABLE t (id INT, v TEXT)`);
+    return mustFail(`INSERT INTO t (id, unknown_col) VALUES (1, 'x')`);
+  });
+  await t('INSERT 未知列（VALUES 全列）→ 报错', async ({ exec, mustFail }) => {
+    await exec(`CREATE TABLE t (id INT, v TEXT)`);
+    return mustFail(`INSERT INTO t VALUES (1, 'x', 'extra')`);
+  });
+  await t('INSERT 已知列 → 正常', async ({ exec, scalar }) => {
+    await exec(`CREATE TABLE t (id INT, v TEXT)`);
+    await exec(`INSERT INTO t (id, v) VALUES (1, 'x')`);
+    return eq(await scalar(`SELECT v FROM t WHERE id = 1`), 'x');
+  });
+
   console.log(`\n${pass} passed, ${fail} failed`);
   process.exit(fail === 0 ? 0 : 1);
 })();