jsql-neo 6.4.0-beta.11 → 6.4.0-beta.13

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.4.0-beta.11** — official release build · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.4.0-beta.13** — official release build · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.4.0-beta.11 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.4.0-beta.13 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/database.js

@@ -2406,6 +2406,15 @@ class Database {
         this._savepointStack = [];
         if (!snap) return;
         this._restoreTxSnapshot(snap);
+        // 修复 B1：rollback 后必须落盘，否则事务期间已 flush 到磁盘的写入
+        // 不会被撤销，kill -9 重启后数据不一致（ACID 原子性被破坏）。
+        // dirMode 下事务写入已逐表 flush，rollback 后需重新 flush 恢复后的数据；
+        // 非 dirMode 下 commitTx 会 save()，rollback 也要 save() 保持一致。
+        if (this._dirMode) {
+            try { this._flushDirty(); } catch (e) { this._emit('error', e); }
+        } else if (!this._memoryMode) {
+            this.save();
+        }
     }
 
     // ============================================================

package/lib/multiserver.js

@@ -21,10 +21,8 @@ const { MongoServer } = require('./mongo_server');
 
 function sniffProtocol(buf) {
   if (buf.length < 1) return null;
-  const b = buf[0];
-  if (b === 0x00) return 'pg';
-  if (b === 0x0a || b === 0x0d) return 'mysql';
-  // MongoDB: header 前 4 字节 = int32LE 长度，第 13 字节 = opCode(OP_QUERY 2004 / OP_COMPRESSED 2012 / OP_MSG 2013)
+  // MongoDB 先检查：opCode 校验更具体，避免消息长度为 256 倍数时
+  // 首字节 0x00 被误判为 PG（PG 也用 0x00 开头）
   if (buf.length >= 16) {
     const opc = buf.readInt32LE(12);
     if (opc === 2012 || opc === 2013 || opc === 2004) {
@@ -32,6 +30,9 @@ function sniffProtocol(buf) {
       if (len >= 16 && len <= 48 * 1024 * 1024) return 'mongo';
     }
   }
+  const b = buf[0];
+  if (b === 0x00) return 'pg';
+  if (b === 0x0a || b === 0x0d) return 'mysql';
   return 'redis';
 }
 

package/lib/sql.js

@@ -392,6 +392,7 @@ class Parser {
     this.pos = 0;
     this.paramCount = 0;   // 顺序占位符 ? 的序号（从 0 开始）
     this.subquerySeq = 0;  // FROM 子查询无别名时自动生成 __subN
+    this.depth = 0;        // 子查询递归深度
   }
 
   peek(offset = 0) { return this.tokens[this.pos + offset]; }
@@ -1220,6 +1221,8 @@ class Parser {
   }
 
   parseSelect() {
+    this.depth++;
+    if (this.depth > 200) throw new Error('Subquery nesting too deep (max 200)');
     this.expectKeyword('SELECT');
     let distinct = false;
     if (this.isKeyword('DISTINCT')) { this.next(); distinct = true; }
@@ -1390,9 +1393,18 @@ class Parser {
     if (this.isKeyword('LIMIT')) {
       this.next();
       limit = this.parseValue();
+      if (typeof limit === 'bigint') limit = Number(limit <= BigInt(Number.MAX_SAFE_INTEGER) ? limit : BigInt(Number.MAX_SAFE_INTEGER));
       if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`);
-      if (this.isKeyword('OFFSET')) { this.next(); offset = this.parseValue(); if (typeof offset === 'number' && offset < 0) throw new Error(`OFFSET must be a non-negative integer, got ${offset}`); }
-      else if (this.peek().type === 'op' && this.peek().value === ',') { this.next(); offset = limit; limit = this.parseValue(); if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`); }
+      if (this.isKeyword('OFFSET')) { this.next(); offset = this.parseValue(); if (typeof offset === 'bigint') offset = Number(offset <= BigInt(Number.MAX_SAFE_INTEGER) ? offset : BigInt(Number.MAX_SAFE_INTEGER)); if (typeof offset === 'number' && offset < 0) throw new Error(`OFFSET must be a non-negative integer, got ${offset}`); }
+      else if (this.peek().type === 'op' && this.peek().value === ',') { this.next(); offset = limit; limit = this.parseValue(); if (typeof limit === 'bigint') limit = Number(limit <= BigInt(Number.MAX_SAFE_INTEGER) ? limit : BigInt(Number.MAX_SAFE_INTEGER)); if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`); }
+    }
+    // OFFSET without LIMIT (MySQL compatible)
+    if (limit === null && this.isKeyword('OFFSET')) {
+      this.next();
+      offset = this.parseValue();
+      if (typeof offset === 'bigint') offset = Number(offset <= BigInt(Number.MAX_SAFE_INTEGER) ? offset : BigInt(Number.MAX_SAFE_INTEGER));
+      if (typeof offset === 'number' && offset < 0) throw new Error(`OFFSET must be a non-negative integer, got ${offset}`);
+      limit = Number.MAX_SAFE_INTEGER;
     }
     // 集合运算：UNION [ALL|DISTINCT] / INTERSECT [ALL|DISTINCT] / EXCEPT [ALL|DISTINCT]
     let union = null, intersect = null, except = null;
@@ -1421,13 +1433,15 @@ class Parser {
       if (this.isWord('FIRST') || this.isWord('NEXT')) this.next();
       else throw new Error(`Expected FIRST or NEXT after FETCH, got '${this.peek().value}'`);
       const nTok = this.next();
-      const n = nTok.type === 'number' ? nTok.value : Number(nTok.value);
+      let n = nTok.type === 'number' ? nTok.value : Number(nTok.value);
+      if (typeof n === 'bigint') n = Number(n <= BigInt(Number.MAX_SAFE_INTEGER) ? n : BigInt(Number.MAX_SAFE_INTEGER));
       if (!Number.isFinite(n)) throw new Error(`Expected row count after FETCH FIRST, got '${nTok.value}'`);
       limit = n;
       if (this.isWord('ROW') || this.isWord('ROWS')) this.next();
       if (this.isWord('ONLY')) this.next();
     }
     this.optionalTailSemicolon();
+    this.depth--;
 
     return { type: 'select', columns, aggregate, distinct, from, where, groupBy, having, orderBy, limit, offset, union, intersect, except, rollup };
   }
@@ -1534,6 +1548,7 @@ class Parser {
     }
     let where = null;
     if (this.isKeyword('WHERE')) { this.next(); where = this.parseExpr(); }
+    else console.warn(`⚠️  UPDATE without WHERE clause — this will modify ALL rows in '${table}'`);
     const returning = this.parseOptionalReturning();
     this.optionalTailSemicolon();
     return { type: 'update', table, assignments, where, returning };
@@ -1562,6 +1577,7 @@ class Parser {
     if (this.isKeyword('LIMIT')) {
       this.next();
       limit = this.parseValue();
+      if (typeof limit === 'bigint') limit = Number(limit <= BigInt(Number.MAX_SAFE_INTEGER) ? limit : BigInt(Number.MAX_SAFE_INTEGER));
       if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`);
     }
     const returning = this.parseOptionalReturning();
@@ -3605,6 +3621,71 @@ function applyScalarFunction(fnNode, row, ctx) {
       return v.toString(16);
     });
     case 'DATABASE': case 'SCHEMA': return row && row.__db !== undefined ? row.__db : 'default';
+    // ===== JSON 函数（B2 修复：此前未实现，静默返回 NULL）=====
+    case 'JSON_OBJECT': {
+      // JSON_OBJECT(k1, v1, k2, v2, ...) → { k1: v1, k2: v2 }
+      const obj = {};
+      for (let i = 0; i + 1 < args.length; i += 2) {
+        const k = String(args[i] == null ? '' : args[i]);
+        const v = args[i + 1];
+        obj[k] = v === undefined ? null : v;
+      }
+      return obj;
+    }
+    case 'JSON_ARRAY': {
+      // JSON_ARRAY(v1, v2, ...) → [v1, v2]
+      return args.map(v => v === undefined ? null : v);
+    }
+    case 'JSON_EXTRACT': {
+      // JSON_EXTRACT(json, '$.key' or '$.a.b') → 值
+      const json = args[0];
+      const path = args[1] == null ? '' : String(args[1]);
+      if (json == null || path == null) return null;
+      // 解析 JSON 字符串或对象
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      // 解析 JSONPath: $.key 或 $.a.b 或 $.a[0].b
+      const m = path.match(/^\$\.?([^.\[]+)/);
+      if (!m) {
+        // 尝试 $ 开头后直接跟 key
+        if (path === '$') return data;
+        return null;
+      }
+      const firstKey = m[1];
+      if (firstKey === '') return data;
+      let current = data;
+      // 逐段解析路径
+      const segments = path.replace(/^\$/, '').split('.');
+      for (const seg of segments) {
+        if (current == null) return null;
+        // 处理数组索引: key[0] 或 [0]
+        const arrMatch = seg.match(/^([^\[]*)\[(\d+)\]$/);
+        if (arrMatch) {
+          const key = arrMatch[1];
+          const idx = parseInt(arrMatch[2], 10);
+          if (key) current = current[key];
+          if (Array.isArray(current)) current = current[idx];
+          else return null;
+        } else {
+          if (typeof current !== 'object' || current === null) return null;
+          current = current[seg];
+        }
+      }
+      return current === undefined ? null : current;
+    }
+    case 'JSON_CONTAINS': {
+      // JSON_CONTAINS(json, value) → 1 or 0
+      const json = args[0];
+      const val = args[1];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      return JSON.stringify(data).includes(JSON.stringify(val)) ? 1 : 0;
+    }
     default:
       return null;
   }
@@ -6160,7 +6241,30 @@ class SQLExecutor {
       all = [{ _virtual: true }];
     } else {
       const items = statement.from.tables.concat(statement.from.joins.map(j => j.item));
-      const prefix = item => item.alias || (item.subquery ? item.alias : item.table);
+      // B5 修复：自连接（同表多次出现且无别名）时，用 t1/t2 等自动别名（MySQL 惯例），
+      // 而非直接用表名。不同表无别名时仍用表名，保持与 SQL 查询中的表名限定一致。
+      const tableCount = new Map();
+      for (const item of items) {
+        if (item.table) {
+          const c = (tableCount.get(item.table) || 0) + 1;
+          tableCount.set(item.table, c);
+        }
+      }
+      const autoAliasMap = new Map();
+      let autoIdx = 0;
+      const prefix = item => {
+        if (item.alias) return item.alias;
+        if (item.subquery) return item.subquery.alias || item.alias;
+        // 无别名且同表出现多次时生成 t1, t2；否则用表名
+        if (item.table && (tableCount.get(item.table) || 0) > 1) {
+          if (!autoAliasMap.has(item)) {
+            autoIdx++;
+            autoAliasMap.set(item, `t${autoIdx}`);
+          }
+          return autoAliasMap.get(item);
+        }
+        return item.table;
+      };
 
       // 读第一表
       const firstItem = statement.from.tables[0];
@@ -6191,10 +6295,10 @@ class SQLExecutor {
         // 递归 CTE 迭代中：自身引用绑定到已累积的行
         rowsAll = { rows: firstItem._virtualRows.map(r => Object.assign({}, r)), schema: null, columns: null };
       } else {
-        rowsAll = await this._readTable(firstItem.table, statement, firstItem.alias || firstItem.table);
+        rowsAll = await this._readTable(firstItem.table, statement, prefix(firstItem));
       }
       schema = rowsAll.schema;
-      const firstPrefix = firstItem.alias || firstItem.table;
+      const firstPrefix = prefix(firstItem);
       // 虚拟行分两种，语义不同：
       //  - _virtualRows：递归 CTE **迭代过程内部**，FROM 是自身引用，列名不带前缀
       //    （否则递归项里的 `n+1` 取不到值）
@@ -6222,8 +6326,8 @@ class SQLExecutor {
           ? { rows: (j.item._virtualRows || j.item.subquery._virtualSource).map(r => Object.assign({}, r)) }
           : j.item.subquery
             ? await this.executeSelect(j.item.subquery)
-            : await this._readTable(j.item.table, statement, j.item.alias || j.item.table);
-        const rightPrefix = j.item.alias || j.item.table;
+            : await this._readTable(j.item.table, statement, prefix(j.item));
+        const rightPrefix = prefix(j.item);
         // 迭代内部的虚拟行不加前缀；物化后的派生表要加（与普通子查询一致）
         const jRaw = j.item._virtualRows
           ? j.item._virtualRows
@@ -6499,7 +6603,16 @@ class SQLExecutor {
 
     if (statement.limit !== null) {
       const start = statement.offset || 0;
-      rows = rows.slice(start, start + statement.limit);
+      // B5 修复：超大 LIMIT 时 start + limit 可能超过 Number.MAX_SAFE_INTEGER，
+      // 导致 JS 精度丢失，slice 行为异常。这里加友好错误处理。
+      if (statement.limit > rows.length - start) {
+        // LIMIT 超过实际行数是合法的，直接返回全部剩余行
+        rows = rows.slice(start);
+      } else if (start + statement.limit > Number.MAX_SAFE_INTEGER) {
+        throw new Error(`LIMIT value ${statement.limit} is too large; maximum safe value is ${Number.MAX_SAFE_INTEGER - start}`);
+      } else {
+        rows = rows.slice(start, start + statement.limit);
+      }
     }
 
     // 无分组、无聚合的正常输出

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.4.0-beta.11",
+  "version": "6.4.0-beta.13",
   "description": "JSQL-NEO — Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",

package/postinstall.js

@@ -1,4 +1,5 @@
 const { execSync } = require('child_process');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const http = require('http');
@@ -18,20 +19,16 @@ const NATIVE_PATH = path.join(ROOT, 'native', 'jsql-neo-native.node');
 //   https://<host>/https://github.com/owner/repo/releases/download/vX.Y.Z/asset
 // 鉴权走 `Authorization: Bearer <token>` 请求头（Worker 从该头读取，不读 ?token=）。
 // 前缀可用 JSQL_GHPROXY 覆盖（逗号分隔多个，按序回退；'' 表示直连兜底）；
-// token 可用 JSQL_GHPROXY_TOKEN 覆盖。
+// token 仅从环境变量 JSQL_GHPROXY_TOKEN 读取，不再内嵌硬编码 token。
 // 加速站候选（按优先级）：自建站优先，公共站回退，最后直连兜底。
 const DEFAULT_PROXIES = [
   'https://gh-proxyjsql-neoworkerapi.vexify.de5.net/',
   'https://gh-proxy.com/',
 ];
-// 内置 token：让所有安装者都自动走自建加速站，无需配置环境变量。
-// 加速站自身已限制只能代理 /releases/download/ 等文件下载路径，故该值公开无风险。
-const DEFAULT_GHPROXY_TOKEN =
-  'NkUbD165V_1iPvEeGRcAfNEv4cqv5WRLn1NfjgBzIMpo9gq5CBH10Rl5ZPmt7RGCh3kyaZU4Nc6pLhHHbvzc9w';
 const GHPROXY = process.env.JSQL_GHPROXY !== undefined
   ? process.env.JSQL_GHPROXY
   : DEFAULT_PROXIES[0];
-const GHPROXY_TOKEN = process.env.JSQL_GHPROXY_TOKEN || DEFAULT_GHPROXY_TOKEN;
+const GHPROXY_TOKEN = process.env.JSQL_GHPROXY_TOKEN || '';
 const TAG = `v${pkg.version}`;
 
 /** 加速站鉴权头 */
@@ -39,6 +36,32 @@ function proxyHeaders() {
   return GHPROXY_TOKEN ? { Authorization: 'Bearer ' + GHPROXY_TOKEN } : undefined;
 }
 
+/**
+ * 验证文件 SHA256 校验和。
+ * 从环境变量 JSQL_NATIVE_SHA256 读取期望值（hex 编码，64 字符）。
+ * 若环境变量未设置则跳过校验（向后兼容），但打印警告。
+ */
+function verifyChecksum(filePath) {
+  const expected = process.env.JSQL_NATIVE_SHA256 || '';
+  if (!expected) {
+    console.warn('[jsql-neo] WARNING: JSQL_NATIVE_SHA256 not set, skipping checksum verification');
+    return true;
+  }
+  try {
+    const actual = crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
+    if (actual !== expected.toLowerCase()) {
+      console.error(`[jsql-neo] checksum mismatch: expected ${expected}, got ${actual}`);
+      try { fs.unlinkSync(filePath); } catch (_) {}
+      return false;
+    }
+    console.log('[jsql-neo] checksum verified');
+    return true;
+  } catch (e) {
+    console.warn('[jsql-neo] checksum verification failed:', e.message);
+    return false;
+  }
+}
+
 /**
  * 生成候选下载地址列表（按优先级）：
  *   JSQL_GHPROXY 指定的代理 → 内置加速站 → 直连
@@ -143,6 +166,10 @@ async function downloadAndVerify() {
     try {
       // 加速站鉴权走 Authorization 头，直连时不带
       await download(cand.url, NATIVE_PATH, cand.viaProxy ? proxyHeaders() : undefined);
+      if (!verifyChecksum(NATIVE_PATH)) {
+        console.warn('[jsql-neo] checksum mismatch; trying next source.');
+        continue;
+      }
       if (tryLoadNative()) {
         console.log('[jsql-neo] native module downloaded: native/jsql-neo-native.node');
         return true;
@@ -156,11 +183,15 @@ async function downloadAndVerify() {
 }
 
 async function ensureNativeNode() {
-  // 已存在且能加载 → 直接用；否则删掉并从 gh-proxy.com 下载，找不到才回退源码编译
+  // 已存在且能加载 → 直接用；否则删掉并重新获取
   if (tryLoadNative()) {
     console.log('[jsql-neo] native module ready: native/jsql-neo-native.node');
     return;
   }
+  // 下载前检查是否已存在（即使不能加载也先校验，避免重复下载）
+  if (fs.existsSync(NATIVE_PATH)) {
+    try { fs.unlinkSync(NATIVE_PATH); } catch (_) {}
+  }
   if (await downloadAndVerify()) return;
   buildNativeFromSource();
 }
@@ -200,4 +231,4 @@ async function main() {
   ensureServerBinary();
 }
 
-main();
+main();