jsql-neo 6.4.0-beta.8 → 6.4.0

package/lib/sql.js

@@ -392,6 +392,7 @@ class Parser {
     this.pos = 0;
     this.paramCount = 0;   // 顺序占位符 ? 的序号（从 0 开始）
     this.subquerySeq = 0;  // FROM 子查询无别名时自动生成 __subN
+    this.depth = 0;        // 子查询递归深度
   }
 
   peek(offset = 0) { return this.tokens[this.pos + offset]; }
@@ -1220,6 +1221,8 @@ class Parser {
   }
 
   parseSelect() {
+    this.depth++;
+    if (this.depth > 200) throw new Error('Subquery nesting too deep (max 200)');
     this.expectKeyword('SELECT');
     let distinct = false;
     if (this.isKeyword('DISTINCT')) { this.next(); distinct = true; }
@@ -1390,9 +1393,18 @@ class Parser {
     if (this.isKeyword('LIMIT')) {
       this.next();
       limit = this.parseValue();
+      if (typeof limit === 'bigint') limit = Number(limit <= BigInt(Number.MAX_SAFE_INTEGER) ? limit : BigInt(Number.MAX_SAFE_INTEGER));
       if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`);
-      if (this.isKeyword('OFFSET')) { this.next(); offset = this.parseValue(); if (typeof offset === 'number' && offset < 0) throw new Error(`OFFSET must be a non-negative integer, got ${offset}`); }
-      else if (this.peek().type === 'op' && this.peek().value === ',') { this.next(); offset = limit; limit = this.parseValue(); if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`); }
+      if (this.isKeyword('OFFSET')) { this.next(); offset = this.parseValue(); if (typeof offset === 'bigint') offset = Number(offset <= BigInt(Number.MAX_SAFE_INTEGER) ? offset : BigInt(Number.MAX_SAFE_INTEGER)); if (typeof offset === 'number' && offset < 0) throw new Error(`OFFSET must be a non-negative integer, got ${offset}`); }
+      else if (this.peek().type === 'op' && this.peek().value === ',') { this.next(); offset = limit; limit = this.parseValue(); if (typeof limit === 'bigint') limit = Number(limit <= BigInt(Number.MAX_SAFE_INTEGER) ? limit : BigInt(Number.MAX_SAFE_INTEGER)); if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`); }
+    }
+    // OFFSET without LIMIT (MySQL compatible)
+    if (limit === null && this.isKeyword('OFFSET')) {
+      this.next();
+      offset = this.parseValue();
+      if (typeof offset === 'bigint') offset = Number(offset <= BigInt(Number.MAX_SAFE_INTEGER) ? offset : BigInt(Number.MAX_SAFE_INTEGER));
+      if (typeof offset === 'number' && offset < 0) throw new Error(`OFFSET must be a non-negative integer, got ${offset}`);
+      limit = Number.MAX_SAFE_INTEGER;
     }
     // 集合运算：UNION [ALL|DISTINCT] / INTERSECT [ALL|DISTINCT] / EXCEPT [ALL|DISTINCT]
     let union = null, intersect = null, except = null;
@@ -1421,13 +1433,15 @@ class Parser {
       if (this.isWord('FIRST') || this.isWord('NEXT')) this.next();
       else throw new Error(`Expected FIRST or NEXT after FETCH, got '${this.peek().value}'`);
       const nTok = this.next();
-      const n = nTok.type === 'number' ? nTok.value : Number(nTok.value);
+      let n = nTok.type === 'number' ? nTok.value : Number(nTok.value);
+      if (typeof n === 'bigint') n = Number(n <= BigInt(Number.MAX_SAFE_INTEGER) ? n : BigInt(Number.MAX_SAFE_INTEGER));
       if (!Number.isFinite(n)) throw new Error(`Expected row count after FETCH FIRST, got '${nTok.value}'`);
       limit = n;
       if (this.isWord('ROW') || this.isWord('ROWS')) this.next();
       if (this.isWord('ONLY')) this.next();
     }
     this.optionalTailSemicolon();
+    this.depth--;
 
     return { type: 'select', columns, aggregate, distinct, from, where, groupBy, having, orderBy, limit, offset, union, intersect, except, rollup };
   }
@@ -1534,6 +1548,7 @@ class Parser {
     }
     let where = null;
     if (this.isKeyword('WHERE')) { this.next(); where = this.parseExpr(); }
+    else console.warn(`⚠️  UPDATE without WHERE clause — this will modify ALL rows in '${table}'`);
     const returning = this.parseOptionalReturning();
     this.optionalTailSemicolon();
     return { type: 'update', table, assignments, where, returning };
@@ -1562,6 +1577,7 @@ class Parser {
     if (this.isKeyword('LIMIT')) {
       this.next();
       limit = this.parseValue();
+      if (typeof limit === 'bigint') limit = Number(limit <= BigInt(Number.MAX_SAFE_INTEGER) ? limit : BigInt(Number.MAX_SAFE_INTEGER));
       if (typeof limit === 'number' && limit < 0) throw new Error(`LIMIT must be a non-negative integer, got ${limit}`);
     }
     const returning = this.parseOptionalReturning();
@@ -2892,7 +2908,36 @@ function resolveOperand(operand, row, ctx) {
     }
     // P1-19: ON DUPLICATE KEY UPDATE 表达式赋值，如 count = count + 1
     case 'binary': {
-      return evaluateExpr({ type: 'arith', op: operand.op, left: operand.left, right: operand.right }, row, ctx);
+      // binary（含算术/位运算）直接求值，不走递归（避免无限递归）
+      // left/right 可能是原始值（数字/字符串）或 AST 节点；
+      // 字符串在这里是列名引用（如 cnt），需用 resolveOperand 解析。
+      const resolve = (v) => v != null && typeof v === 'object' ? resolveOperand(v, row, ctx) : (typeof v === 'string' ? resolveOperand({ type: 'column', name: v }, row, ctx) : v);
+      const l = resolve(operand.left);
+      const r = resolve(operand.right);
+      if (l === null || r === null || l === undefined || r === undefined) return null;
+      switch (operand.op) {
+        case '+': {
+          if (typeof l === 'number' || typeof r === 'number') {
+            const ln = numericIfNumeric(l), rn = numericIfNumeric(r);
+            return (ln === null ? 0 : ln) + (rn === null ? 0 : rn);
+          }
+          const ln = numericIfNumeric(l), rn = numericIfNumeric(r);
+          if (ln !== null) return ln + (rn === null ? 0 : rn);
+          if (rn !== null) return rn;
+          return 0;
+        }
+        case '-': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) ? null : ln - rn; }
+        case '*': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) ? null : ln * rn; }
+        case '/': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) || rn === 0 ? null : ln / rn; }
+        case '%': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) || rn === 0 ? null : ln % rn; }
+        case 'DIV': return r === 0 ? null : Math.trunc(Number(l) / Number(r));
+        case '&': return (Number(l) | 0) & (Number(r) | 0);
+        case '|': return (Number(l) | 0) | (Number(r) | 0);
+        case '^': return (Number(l) | 0) ^ (Number(r) | 0);
+        case '<<': return Number(l) * Math.pow(2, Number(r));
+        case '>>': return Math.floor(Number(l) / Math.pow(2, Number(r)));
+        default: return null;
+      }
     }
     case 'func':
       return applyScalarFunction(operand, row, ctx);
@@ -3605,6 +3650,428 @@ function applyScalarFunction(fnNode, row, ctx) {
       return v.toString(16);
     });
     case 'DATABASE': case 'SCHEMA': return row && row.__db !== undefined ? row.__db : 'default';
+    // ===== JSON 函数（B2 修复：此前未实现，静默返回 NULL）=====
+    // 辅助函数：获取 JSON 值的类型
+    function getJsonType(val) {
+      if (val === null) return 'null';
+      if (Array.isArray(val)) return 'array';
+      if (typeof val === 'object') return 'object';
+      if (typeof val === 'string') return 'string';
+      if (typeof val === 'number') return Number.isInteger(val) ? 'integer' : 'number';
+      if (typeof val === 'boolean') return 'boolean';
+      return 'unknown';
+    }
+    case 'JSON_OBJECT': {
+      // JSON_OBJECT(k1, v1, k2, v2, ...) → { k1: v1, k2: v2 }
+      const obj = {};
+      for (let i = 0; i + 1 < args.length; i += 2) {
+        const k = String(args[i] == null ? '' : args[i]);
+        const v = args[i + 1];
+        obj[k] = v === undefined ? null : v;
+      }
+      return obj;
+    }
+    case 'JSON_ARRAY': {
+      // JSON_ARRAY(v1, v2, ...) → [v1, v2]
+      return args.map(v => v === undefined ? null : v);
+    }
+    case 'JSON_EXTRACT': {
+      // JSON_EXTRACT(json, '$.key' or '$.a.b') → 值
+      const json = args[0];
+      const path = args[1] == null ? '' : String(args[1]);
+      if (json == null || path == null) return null;
+      // 解析 JSON 字符串或对象
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      // 解析 JSONPath: $.key 或 $.a.b 或 $.a[0].b
+      const m = path.match(/^\$\.?([^.\[]+)/);
+      if (!m) {
+        // 尝试 $ 开头后直接跟 key
+        if (path === '$') return data;
+        return null;
+      }
+      const firstKey = m[1];
+      if (firstKey === '') return data;
+      let current = data;
+      // 逐段解析路径
+      const segments = path.replace(/^\$\.?/, '').split('.');
+      for (const seg of segments) {
+        if (current == null) return null;
+        // 处理数组索引: key[0] 或 [0]
+        const arrMatch = seg.match(/^([^\[]*)\[(\d+)\]$/);
+        if (arrMatch) {
+          const key = arrMatch[1];
+          const idx = parseInt(arrMatch[2], 10);
+          if (key) current = current[key];
+          if (Array.isArray(current)) current = current[idx];
+          else return null;
+        } else {
+          if (typeof current !== 'object' || current === null) return null;
+          current = current[seg];
+        }
+      }
+      return current === undefined ? null : current;
+    }
+    case 'JSON_KEYS': {
+      // JSON_KEYS(json) → [key1, key2, ...]
+      const json = args[0];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      if (typeof data !== 'object' || data === null || Array.isArray(data)) return null;
+      return Object.keys(data);
+    }
+    case 'JSON_LENGTH': {
+      // JSON_LENGTH(json[, path]) → 元素数/长度
+      const json = args[0];
+      const path = args[1];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      if (path != null) {
+        // 按路径提取后取长度
+        const p = String(path).replace(/^\$\.?/, '');
+        if (p === '') return Array.isArray(data) ? data.length : (typeof data === 'object' && data !== null ? Object.keys(data).length : 0);
+        let current = data;
+        for (const seg of p.split('.')) {
+          if (current == null) return null;
+          const arrMatch = seg.match(/^([^\[]*)\[(\d+)\]$/);
+          if (arrMatch) {
+            const key = arrMatch[1];
+            const idx = parseInt(arrMatch[2], 10);
+            if (key) current = current[key];
+            if (Array.isArray(current)) current = current[idx];
+            else return null;
+          } else {
+            if (typeof current !== 'object' || current === null) return null;
+            current = current[seg];
+          }
+        }
+        if (current == null) return null;
+        if (Array.isArray(current)) return current.length;
+        if (typeof current === 'object') return Object.keys(current).length;
+        if (typeof current === 'string') return current.length;
+        return 1;
+      }
+      if (Array.isArray(data)) return data.length;
+      if (typeof data === 'object' && data !== null) return Object.keys(data).length;
+      if (typeof data === 'string') return data.length;
+      return 1;
+    }
+    case 'JSON_MERGE': case 'JSON_MERGE_PRESERVE': {
+      // JSON_MERGE_PRESERVE(json1, json2, ...) → 合并后的 JSON
+      const items = args.filter(a => a != null);
+      if (!items.length) return null;
+      const parsed = items.map(item => {
+        if (typeof item === 'string') { try { return JSON.parse(item); } catch (e) { return null; } }
+        return item;
+      }).filter(a => a != null);
+      if (!parsed.length) return null;
+      // 递归合并
+      function mergePreserve(target, source) {
+        if (Array.isArray(target) && Array.isArray(source)) {
+          return [...target, ...source];
+        }
+        if (typeof target === 'object' && target !== null && typeof source === 'object' && source !== null && !Array.isArray(target) && !Array.isArray(source)) {
+          const result = { ...target };
+          for (const k of Object.keys(source)) {
+            if (k in result) result[k] = mergePreserve(result[k], source[k]);
+            else result[k] = source[k];
+          }
+          return result;
+        }
+        return source;
+      }
+      return parsed.reduce((acc, cur) => mergePreserve(acc, cur));
+    }
+    case 'JSON_MERGE_PATCH': {
+      // JSON_MERGE_PATCH(json1, json2, ...) → RFC 7396 合并
+      const items = args.filter(a => a != null);
+      if (!items.length) return null;
+      const parsed = items.map(item => {
+        if (typeof item === 'string') { try { return JSON.parse(item); } catch (e) { return null; } }
+        return item;
+      }).filter(a => a != null);
+      if (!parsed.length) return null;
+      function mergePatch(target, source) {
+        if (typeof source !== 'object' || source === null || Array.isArray(source)) return source;
+        if (typeof target !== 'object' || target === null || Array.isArray(target)) return { ...source };
+        const result = { ...target };
+        for (const k of Object.keys(source)) {
+          if (source[k] === null) delete result[k];
+          else result[k] = mergePatch(result[k], source[k]);
+        }
+        return result;
+      }
+      return parsed.reduce((acc, cur) => mergePatch(acc, cur));
+    }
+    case 'JSON_OBJECTAGG': {
+      // JSON_OBJECTAGG(key, value) → { key: value } (聚合函数)
+      // 在 JSQL 中作为普通函数调用，接收 key 和 value
+      const key = args[0];
+      const value = args[1];
+      if (key == null) return null;
+      const obj = {};
+      obj[String(key)] = value === undefined ? null : value;
+      return obj;
+    }
+    case 'JSON_ARRAYAGG': {
+      // JSON_ARRAYAGG(expr) → [expr] (聚合函数)
+      // 在 JSQL 中作为普通函数调用，接收单个值
+      const val = args[0];
+      return [val === undefined ? null : val];
+    }
+    case 'JSON_SET': {
+      // JSON_SET(json, path, val, ...) → 设置值（路径存在则更新，不存在则创建）
+      const json = args[0];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      // 深拷贝
+      data = JSON.parse(JSON.stringify(data));
+      for (let i = 1; i + 1 < args.length; i += 2) {
+        const path = String(args[i]);
+        const val = args[i + 1];
+        const p = path.replace(/^\$\.?/, '');
+        if (p === '') continue;
+        const segments = p.split('.');
+        let current = data;
+        for (let j = 0; j < segments.length - 1; j++) {
+          const seg = segments[j];
+          const arrMatch = seg.match(/^([^\[]*)\[(\d+)\]$/);
+          if (arrMatch) {
+            const key = arrMatch[1];
+            const idx = parseInt(arrMatch[2], 10);
+            if (key) current = current[key];
+            if (Array.isArray(current)) current = current[idx];
+            else { current = null; break; }
+          } else {
+            if (typeof current !== 'object' || current === null) { current = null; break; }
+            if (!(seg in current)) current[seg] = {};
+            current = current[seg];
+          }
+        }
+        if (current == null) continue;
+        const last = segments[segments.length - 1];
+        const arrMatch = last.match(/^([^\[]*)\[(\d+)\]$/);
+        if (arrMatch) {
+          const key = arrMatch[1];
+          const idx = parseInt(arrMatch[2], 10);
+          if (key) current = current[key];
+          if (Array.isArray(current)) current[idx] = val;
+        } else {
+          current[last] = val;
+        }
+      }
+      return data;
+    }
+    case 'JSON_INSERT': {
+      // JSON_INSERT(json, path, val, ...) → 仅路径不存在时插入
+      const json = args[0];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      data = JSON.parse(JSON.stringify(data));
+      for (let i = 1; i + 1 < args.length; i += 2) {
+        const path = String(args[i]);
+        const val = args[i + 1];
+        const p = path.replace(/^\$\.?/, '');
+        if (p === '') continue;
+        const segments = p.split('.');
+        let current = data;
+        let exists = true;
+        for (let j = 0; j < segments.length - 1; j++) {
+          const seg = segments[j];
+          const arrMatch = seg.match(/^([^\[]*)\[(\d+)\]$/);
+          if (arrMatch) {
+            const key = arrMatch[1];
+            const idx = parseInt(arrMatch[2], 10);
+            if (key) current = current[key];
+            if (Array.isArray(current)) current = current[idx];
+            else { exists = false; break; }
+          } else {
+            if (typeof current !== 'object' || current === null || !(seg in current)) { exists = false; break; }
+            current = current[seg];
+          }
+        }
+        if (!exists) continue;
+        const last = segments[segments.length - 1];
+        if (typeof current === 'object' && current !== null && !(last in current)) {
+          current[last] = val;
+        }
+      }
+      return data;
+    }
+    case 'JSON_REMOVE': {
+      // JSON_REMOVE(json, path, ...) → 删除路径
+      const json = args[0];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      data = JSON.parse(JSON.stringify(data));
+      for (let i = 1; i < args.length; i++) {
+        const path = String(args[i]);
+        const p = path.replace(/^\$\.?/, '');
+        if (p === '') continue;
+        const segments = p.split('.');
+        let current = data;
+        for (let j = 0; j < segments.length - 1; j++) {
+          const seg = segments[j];
+          const arrMatch = seg.match(/^([^\[]*)\[(\d+)\]$/);
+          if (arrMatch) {
+            const key = arrMatch[1];
+            const idx = parseInt(arrMatch[2], 10);
+            if (key) current = current[key];
+            if (Array.isArray(current)) current = current[idx];
+            else { current = null; break; }
+          } else {
+            if (typeof current !== 'object' || current === null) { current = null; break; }
+            current = current[seg];
+          }
+        }
+        if (current == null) continue;
+        const last = segments[segments.length - 1];
+        const arrMatch = last.match(/^([^\[]*)\[(\d+)\]$/);
+        if (arrMatch) {
+          const key = arrMatch[1];
+          const idx = parseInt(arrMatch[2], 10);
+          if (key) current = current[key];
+          if (Array.isArray(current)) current.splice(idx, 1);
+        } else {
+          delete current[last];
+        }
+      }
+      return data;
+    }
+    case 'JSON_UNQUOTE': {
+      // JSON_UNQUOTE(json_val) → 去掉 JSON 字符串的引号
+      const val = args[0];
+      if (val == null) return null;
+      if (typeof val === 'string') {
+        // 如果是 JSON 字符串（带引号），解析它
+        const trimmed = val.trim();
+        if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+          try { return JSON.parse(trimmed); } catch (e) { return trimmed.slice(1, -1); }
+        }
+        return val;
+      }
+      return val;
+    }
+    case 'JSON_QUOTE': {
+      // JSON_QUOTE(str) → 给字符串加引号
+      const val = args[0];
+      if (val == null) return null;
+      return JSON.stringify(String(val));
+    }
+    case 'JSON_TYPE': {
+      // JSON_TYPE(json[, path]) → 返回类型
+      const json = args[0];
+      const path = args[1];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      if (path != null) {
+        const p = String(path).replace(/^\$\.?/, '');
+        if (p === '') return getJsonType(data);
+        let current = data;
+        for (const seg of p.split('.')) {
+          if (current == null) return null;
+          const arrMatch = seg.match(/^([^\[]*)\[(\d+)\]$/);
+          if (arrMatch) {
+            const key = arrMatch[1];
+            const idx = parseInt(arrMatch[2], 10);
+            if (key) current = current[key];
+            if (Array.isArray(current)) current = current[idx];
+            else return null;
+          } else {
+            if (typeof current !== 'object' || current === null) return null;
+            current = current[seg];
+          }
+        }
+        return getJsonType(current);
+      }
+      return getJsonType(data);
+    }
+    case 'JSON_DEPTH': {
+      // JSON_DEPTH(json) → 返回深度
+      const json = args[0];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      function depth(obj) {
+        if (typeof obj !== 'object' || obj === null) return 0;
+        if (Array.isArray(obj)) {
+          if (obj.length === 0) return 1;
+          return 1 + Math.max(...obj.map(depth));
+        }
+        const keys = Object.keys(obj);
+        if (keys.length === 0) return 1;
+        return 1 + Math.max(...keys.map(k => depth(obj[k])));
+      }
+      return depth(data);
+    }
+    case 'JSON_VALID': {
+      // JSON_VALID(json) → 1 if valid JSON, 0 otherwise
+      const val = args[0];
+      if (val == null) return 0;
+      if (typeof val !== 'string') return 1; // 非字符串视为有效
+      try { JSON.parse(val); return 1; } catch (e) { return 0; }
+    }
+    case 'JSON_SEARCH': {
+      // JSON_SEARCH(json, one_or_all, search_str) → 搜索路径
+      const json = args[0];
+      const mode = args[1];
+      const search = args[2];
+      if (json == null || search == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      const searchStr = String(search).toLowerCase();
+      const results = [];
+      function searchObj(obj, currentPath) {
+        if (typeof obj === 'string' && obj.toLowerCase().includes(searchStr)) {
+          results.push(currentPath);
+        } else if (Array.isArray(obj)) {
+          obj.forEach((item, i) => searchObj(item, currentPath + '[' + i + ']'));
+        } else if (typeof obj === 'object' && obj !== null) {
+          for (const k of Object.keys(obj)) {
+            searchObj(obj[k], currentPath ? currentPath + '.' + k : '$.' + k);
+          }
+        }
+      }
+      searchObj(data, '$');
+      if (results.length === 0) return null;
+      if (mode === 'one') return results[0];
+      return results;
+    }
+    case 'JSON_CONTAINS': {
+      // JSON_CONTAINS(json, value) → 1 or 0
+      const json = args[0];
+      const val = args[1];
+      if (json == null) return null;
+      let data = json;
+      if (typeof json === 'string') {
+        try { data = JSON.parse(json); } catch (e) { return null; }
+      }
+      return JSON.stringify(data).includes(JSON.stringify(val)) ? 1 : 0;
+    }
     default:
       return null;
   }
@@ -3785,10 +4252,14 @@ function evaluateExpr(expr, row, ctx) {
     }
     case 'in': {
       const v = resolveOperand(expr.operand, row, ctx);
+      if (v === null || v === undefined) return null;  // NULL IN (...) → NULL（三值逻辑）
       if (expr.subquery && expr.subquery._values !== undefined) expr.list = expr.subquery._values;
-      if (!expr.list) return false;
+      if (!expr.list) return expr.not ? true : false;
+      // 列表中出现 NULL 时：三值逻辑 → NULL IN (1,2,NULL) 为 NULL（UNKNOWN）
+      const hasNull = expr.list.some(x => x === null || x === undefined);
+      if (hasNull) return null;
       const r = expr.list.some(x => x === v || String(x) === String(v));
-      return expr.not ? !r : r;   // NOT IN：此前漏了取反，导致 NOT IN 与 IN 结果相同
+      return expr.not ? !r : r;
     }
     case 'like': {
       const v = resolveOperand(expr.operand, row, ctx);
@@ -3842,6 +4313,38 @@ function evaluateExpr(expr, row, ctx) {
       }
       return expr.elseVal ? resolveOperand(expr.elseVal, row, ctx) : null;
     }
+    case 'binary': {
+      // 算术/位运算表达式（如 ON DUPLICATE KEY UPDATE cnt = cnt + 1）
+      // 注意：二进制比较运算符（=, <, > 等）走的是 case 'compare'，不会到这里
+      // 复用 resolveOperand 的 case 'binary' 逻辑
+      const resolve = (v) => v != null && typeof v === 'object' ? resolveOperand(v, row, ctx) : (typeof v === 'string' ? resolveOperand({ type: 'column', name: v }, row, ctx) : v);
+      const l = resolve(expr.left);
+      const r = resolve(expr.right);
+      if (l === null || r === null || l === undefined || r === undefined) return null;
+      switch (expr.op) {
+        case '+': {
+          if (typeof l === 'number' || typeof r === 'number') {
+            const ln = numericIfNumeric(l), rn = numericIfNumeric(r);
+            return (ln === null ? 0 : ln) + (rn === null ? 0 : rn);
+          }
+          const ln = numericIfNumeric(l), rn = numericIfNumeric(r);
+          if (ln !== null) return ln + (rn === null ? 0 : rn);
+          if (rn !== null) return rn;
+          return 0;
+        }
+        case '-': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) ? null : ln - rn; }
+        case '*': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) ? null : ln * rn; }
+        case '/': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) || rn === 0 ? null : ln / rn; }
+        case '%': { const ln = Number(l), rn = Number(r); return isNaN(ln) || isNaN(rn) || rn === 0 ? null : ln % rn; }
+        case 'DIV': return r === 0 ? null : Math.trunc(Number(l) / Number(r));
+        case '&': return (Number(l) | 0) & (Number(r) | 0);
+        case '|': return (Number(l) | 0) | (Number(r) | 0);
+        case '^': return (Number(l) | 0) ^ (Number(r) | 0);
+        case '<<': return Number(l) * Math.pow(2, Number(r));
+        case '>>': return Math.floor(Number(l) / Math.pow(2, Number(r)));
+        default: return null;
+      }
+    }
     default: return false;
   }
 }
@@ -4329,6 +4832,12 @@ class SQLExecutor {
             } else if (conflicts.length > 0 && conflictAction === 'update') {
               for (const { d, existingId } of conflicts) {
                 const data = {};
+                // 查找冲突行的「旧版本」—— 用于 ON DUPLICATE KEY UPDATE 表达式
+                // 如 cnt = cnt + 1，需要用旧行的 cnt 值（0），不是新行的 cnt（10）
+                const existingRow = all.find(r => {
+                  const keys = pkCols.map(c => r[c]).filter(v => v !== undefined && v !== null);
+                  return keys.length === pkCols.length && keys.every((v, i) => String(v) === String(existingId[i]));
+                });
                 if (conflictSets) {
                   for (const [col, val] of conflictSets) {
                     // VALUES(col) 引用本次本应插入的值；EXCLUDED.col 为 PG 同义写法
@@ -4338,7 +4847,11 @@ class SQLExecutor {
                       data[col] = d[val._excludedOf] !== undefined ? d[val._excludedOf] : null;
                     } else if (val && typeof val === 'object' && val.type === 'binary') {
                       // P1-19: ON DUPLICATE KEY UPDATE 支持表达式赋值，如 count = count + 1
-                      data[col] = evaluateExpr(val, d, this.ctx);
+                      // 算术/位运算表达式需要从旧行取值：用 existingRow 替换 d 中的同名键
+                      const evalRow = existingRow
+                        ? Object.fromEntries([...Object.entries(d), ...Object.entries(existingRow)])
+                        : d;
+                      data[col] = evaluateExpr(val, evalRow, this.ctx);
                     } else {
                       data[col] = val;
                     }
@@ -6160,7 +6673,30 @@ class SQLExecutor {
       all = [{ _virtual: true }];
     } else {
       const items = statement.from.tables.concat(statement.from.joins.map(j => j.item));
-      const prefix = item => item.alias || (item.subquery ? item.alias : item.table);
+      // B5 修复：自连接（同表多次出现且无别名）时，用 t1/t2 等自动别名（MySQL 惯例），
+      // 而非直接用表名。不同表无别名时仍用表名，保持与 SQL 查询中的表名限定一致。
+      const tableCount = new Map();
+      for (const item of items) {
+        if (item.table) {
+          const c = (tableCount.get(item.table) || 0) + 1;
+          tableCount.set(item.table, c);
+        }
+      }
+      const autoAliasMap = new Map();
+      let autoIdx = 0;
+      const prefix = item => {
+        if (item.alias) return item.alias;
+        if (item.subquery) return item.subquery.alias || item.alias;
+        // 无别名且同表出现多次时生成 t1, t2；否则用表名
+        if (item.table && (tableCount.get(item.table) || 0) > 1) {
+          if (!autoAliasMap.has(item)) {
+            autoIdx++;
+            autoAliasMap.set(item, `t${autoIdx}`);
+          }
+          return autoAliasMap.get(item);
+        }
+        return item.table;
+      };
 
       // 读第一表
       const firstItem = statement.from.tables[0];
@@ -6191,10 +6727,10 @@ class SQLExecutor {
         // 递归 CTE 迭代中：自身引用绑定到已累积的行
         rowsAll = { rows: firstItem._virtualRows.map(r => Object.assign({}, r)), schema: null, columns: null };
       } else {
-        rowsAll = await this._readTable(firstItem.table, statement, firstItem.alias || firstItem.table);
+        rowsAll = await this._readTable(firstItem.table, statement, prefix(firstItem));
       }
       schema = rowsAll.schema;
-      const firstPrefix = firstItem.alias || firstItem.table;
+      const firstPrefix = prefix(firstItem);
       // 虚拟行分两种，语义不同：
       //  - _virtualRows：递归 CTE **迭代过程内部**，FROM 是自身引用，列名不带前缀
       //    （否则递归项里的 `n+1` 取不到值）
@@ -6222,8 +6758,8 @@ class SQLExecutor {
           ? { rows: (j.item._virtualRows || j.item.subquery._virtualSource).map(r => Object.assign({}, r)) }
           : j.item.subquery
             ? await this.executeSelect(j.item.subquery)
-            : await this._readTable(j.item.table, statement, j.item.alias || j.item.table);
-        const rightPrefix = j.item.alias || j.item.table;
+            : await this._readTable(j.item.table, statement, prefix(j.item));
+        const rightPrefix = prefix(j.item);
         // 迭代内部的虚拟行不加前缀；物化后的派生表要加（与普通子查询一致）
         const jRaw = j.item._virtualRows
           ? j.item._virtualRows
@@ -6290,9 +6826,39 @@ class SQLExecutor {
 
     // 分组聚合
     if (statement.groupBy) {
+      // MySQL 支持 GROUP BY alias，而 alias 指向 SELECT 列表的输出列名。
+      // 解析时 groupBy[] 存的是原始字符串（如 "b"），必须先在 SELECT 别名里查找：
+      //  - 找到 → 取输出行里的 alias 值（因为 alias 已求出值了）
+      //  - 找不到 → 当列名取输入行里对应列的值（标准 SQL 行为）
+      // 此前全用 resolveOperand({type:'column', name:g}) 按列名取，导致 GROUP BY b
+      // 取 row['b']，而原始行里没有 b 列（b 是别名），全返回 undefined 并成一组。
+      const aliases = {};        // alias名字 → true（存在性检查用）
+      const aliasToCol = {};     // alias名字 → 对应的表达式（用于从原始行取值）
+      if (statement.columns) {
+        for (const c of statement.columns) {
+          if (c.alias) {
+            aliases[c.alias.toLowerCase()] = true;
+            // 别名指向的表达式：尝试从 expr/scalar 里提取列名
+            const src = c.expr || c.scalar;
+            // expr 可能是字符串 'a'（列名）或对象 {type:'column', name:'a'}
+            if (typeof src === 'string') aliasToCol[c.alias.toLowerCase()] = src;
+            else if (src && src.type === 'column') aliasToCol[c.alias.toLowerCase()] = src.name;
+          }
+        }
+      }
       const groups = new Map();
       for (const row of rows) {
-        const key = JSON.stringify(statement.groupBy.map(g => resolveOperand({ type: 'column', name: g }, row, this.ctx)));
+        const key = JSON.stringify(statement.groupBy.map(g => {
+          const key = String(g).toLowerCase();
+          if (aliases[key]) {
+            // 优先用行中已有的 alias 值（投影后才有），没有则尝试从原始列取值
+            if (row[key] !== undefined) return row[key];
+            // alias → 原始列名 的映射（如 b → a），从原始行取该列的值
+            if (aliasToCol[key]) return resolveOperand({ type: 'column', name: aliasToCol[key] }, row, this.ctx);
+            return row[key];   // row[key] 为 undefined，但保持一致
+          }
+          return resolveOperand({ type: 'column', name: g }, row, this.ctx);
+        }));
         if (!groups.has(key)) groups.set(key, []);
         groups.get(key).push(row);
       }
@@ -6499,7 +7065,16 @@ class SQLExecutor {
 
     if (statement.limit !== null) {
       const start = statement.offset || 0;
-      rows = rows.slice(start, start + statement.limit);
+      // B5 修复：超大 LIMIT 时 start + limit 可能超过 Number.MAX_SAFE_INTEGER，
+      // 导致 JS 精度丢失，slice 行为异常。这里加友好错误处理。
+      if (statement.limit > rows.length - start) {
+        // LIMIT 超过实际行数是合法的，直接返回全部剩余行
+        rows = rows.slice(start);
+      } else if (start + statement.limit > Number.MAX_SAFE_INTEGER) {
+        throw new Error(`LIMIT value ${statement.limit} is too large; maximum safe value is ${Number.MAX_SAFE_INTEGER - start}`);
+      } else {
+        rows = rows.slice(start, start + statement.limit);
+      }
     }
 
     // 无分组、无聚合的正常输出