jsql-neo 6.5.14 → 6.5.16

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.5.14** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.5.16** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.5.14 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.5.16 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/database.js

@@ -1938,6 +1938,9 @@ class Database {
             const clash = table._rows.find(r => r !== row && r[field] === nv);
             if (clash) throw createError('ER_DUP_ENTRY', `Duplicate entry '${nv}' for key '${field}'`);
         }
+        // 主键/必填列的 NULL 校验：updateById 此前只做类型校验与重复检查，
+        // `UPDATE t SET id = NULL` 会被静默写入（主键行变成 NULL 主键）。
+        table._validateConstraints({ ...row, ...validated }, table._rows.indexOf(row));
         Object.assign(row, validated);
         if (pk) this._walWrite({ op: 'update', table: tableName, pk, id, row: { ...validated } });
         this._emit('update', { table: tableName, id, data: validated });
@@ -1956,7 +1959,9 @@ class Database {
         for (const [id, data] of pairs) {
             const row = this._resolveId(table, id);
             if (row) {
-                Object.assign(row, data);
+                const validated = table._validateDataTypes({ ...data }, true);
+                table._validateConstraints({ ...row, ...validated }, table._rows.indexOf(row));
+                Object.assign(row, validated);
                 count++;
                 if (pk) this._walWrite({ op: 'update', table: tableName, pk, id, row: { ...data } });
             }

package/lib/mysql_compat.js

@@ -146,6 +146,7 @@ class Connection extends EventEmitter {
       const r = await executeSQL(engine, finalSql, {
         safety: this.safety,
         allowComments: this.allowComments,
+        allowWrites: true,
         maxStatements: this.config.multipleStatements ? null : 1,
       });
       const results = Array.isArray(r) ? r : [r];

package/lib/mysql_server.js

@@ -957,6 +957,8 @@ class MysqlConnection {
           const r = await executeSQL(engine, sqlToRun, {
             allowComments: this.server.allowComments,
             safety: this.server.safety,
+            // 协议服务器本身就是数据库端：客户端发来的 DROP/DELETE/UPDATE 必须执行。
+            allowWrites: true,
             maxStatements: 1,
             session: this.session,
           });

package/lib/sql.js

@@ -18,6 +18,24 @@ const DANGEROUS_SQL = [
 // （CWE-770）。可在 executeSQL 通过 opts.maxSqlLength 放宽/关闭（传 Infinity）。
 const DEFAULT_MAX_SQL_LENGTH = 64 * 1024 * 1024;
 
+// 破坏性语句：安全模式下默认拦截（可显式 allowWrites: true 放行）。
+// 多语句注入（`SELECT …; DROP TABLE s;`）的修复分两层：
+//   1) 安全模式默认只允许一条语句（mysql2 默认也是单语句）；
+//   2) 单条 DROP / TRUNCATE / DELETE / UPDATE 也需显式放行。
+// 协议服务器（MySQL / PG）与迁移/管理台会显式传 allowWrites，保持原有能力。
+const DESTRUCTIVE_STMT_TYPES = new Set([
+  'delete', 'update', 'truncate',
+  'dropTable', 'dropIndex', 'dropView', 'dropDatabase',
+]);
+
+/** 递归看 WITH 包着的真正语句，返回破坏性语句类型或 null */
+function findDestructiveStatement(stmt) {
+  if (!stmt || typeof stmt !== 'object') return null;
+  if (DESTRUCTIVE_STMT_TYPES.has(stmt.type)) return stmt.type;
+  if (stmt.type === 'with' && stmt.statement) return findDestructiveStatement(stmt.statement);
+  return null;
+}
+
 function findDangerousSQL(tokens) {
   // 先把注释去掉，防止通过 /*comment*/DROP 绕过检测
   const commentStripped = [];
@@ -2989,7 +3007,16 @@ function resolveOperand(operand, row, ctx) {
         if (!rowHasPrefixedKeys(row) && row[col] !== undefined) return row[col];
       }
       // 相关子查询：回退到外层行（ctx.__outer 由 _evalExists 临时注入）
-      if (ctx && ctx.__outer && ctx.__outer[n] !== undefined) return ctx.__outer[n];
+      if (ctx && ctx.__outer) {
+        if (ctx.__outer[n] !== undefined) return ctx.__outer[n];
+        // 外层行通常是未加前缀的裸列（{id:1}），而引用可能带表层限定符（a.id）。
+        // 内层行已套前缀时，row[col] 的回退已被禁止，这里必须再按裸列名查一次，
+        // 否则 `WHERE b.id = a.id` 在 UPDATE/SELECT 的相关子查询里恒为 NULL。
+        if (n.indexOf('.') !== -1) {
+          const col = n.slice(n.lastIndexOf('.') + 1);
+          if (ctx.__outer[col] !== undefined) return ctx.__outer[col];
+        }
+      }
       return undefined;
     }
     case 'arith': {
@@ -8023,26 +8050,43 @@ async function executeSQL(engine, sql, paramsOrOpts, opts = {}) {
   } else if (paramsOrOpts && typeof paramsOrOpts === 'object') {
     // 第三参为对象时：含已知 opts 键 → 视为 opts；否则视为命名参数（{id: 1} → :id / $id）
     const OPTS_KEYS = ['safety', 'session', 'params', 'functions', 'aggregates',
-      'allowComments', 'maxStatements', 'maxSqlLength', 'context', 'timeout', 'dialect'];
+      'allowComments', 'maxStatements', 'maxSqlLength', 'context', 'timeout', 'dialect',
+      'allowWrites', 'allowMultiStatement'];
     const looksLikeOpts = Object.keys(paramsOrOpts).some(k => OPTS_KEYS.includes(k));
     if (looksLikeOpts) opts = paramsOrOpts;
     else sql = applyParams(sql, paramsOrOpts);
   }
-  if (opts.safety !== false) {
+  const safetyOn = opts.safety !== false;
+  if (safetyOn) {
     if (!opts.allowComments && hasComments(sql)) {
       throw new Error('SQL comments are disabled for security (--, #, /* */)');
     }
   }
   let statements = splitStatements(sql, { maxLength: opts.maxSqlLength });
-  if (opts.maxStatements != null && statements.length > opts.maxStatements) {
-    throw new Error(`too many statements (${statements.length} > ${opts.maxStatements})`);
-  }
-  if (opts.safety !== false) {
+  // 安全模式默认单语句：`SELECT 1; DROP TABLE s;` 不能再把第二条语句一起执行。
+  // 需要多语句的内部调用方显式传 maxStatements 或 allowMultiStatement: true。
+  const maxStatements = opts.maxStatements != null
+    ? opts.maxStatements
+    : (safetyOn && opts.allowMultiStatement !== true ? 1 : Infinity);
+  if (statements.length > maxStatements) {
+    throw new Error(`too many statements (${statements.length} > ${maxStatements})`);
+  }
+  if (safetyOn) {
     for (const stmtSql of statements) {
       const dangerous = findDangerousSQL(tokenize(stmtSql));
       if (dangerous) throw new Error(`SQL statement blocked by security policy: ${dangerous}`);
     }
   }
+  // 先全部解析、再统一做破坏性检查 —— 若有第二条是 DROP，第一条 SELECT 也不能先执行。
+  const parsedStatements = statements.map(s => parseSQL(s));
+  if (safetyOn && opts.allowWrites !== true) {
+    for (const stmt of parsedStatements) {
+      const destructive = findDestructiveStatement(stmt);
+      if (destructive) {
+        throw new Error(`SQL statement blocked by security policy: ${destructive} (pass { allowWrites: true } or { safety: false } to allow writes)`);
+      }
+    }
+  }
   const ctx = {};
   if (opts.session) ctx.session = opts.session;
   if (opts.params) ctx.params = opts.params;   // 原生 ? 占位符（applyParams 之外的另一种用法）
@@ -8050,8 +8094,8 @@ async function executeSQL(engine, sql, paramsOrOpts, opts = {}) {
   if (opts.aggregates && typeof opts.aggregates === 'object') ctx.aggregates = opts.aggregates;
   const executor = new SQLExecutor(engine, Object.keys(ctx).length > 0 ? ctx : null);
   const results = [];
-  for (const stmtSql of statements) {
-    const stmt = parseSQL(stmtSql);
+  for (let si = 0; si < parsedStatements.length; si++) {
+    const stmt = parsedStatements[si];
     const t0 = process.hrtime.bigint();
     let r = await executor.execute(stmt);
     const durationMs = Number(process.hrtime.bigint() - t0) / 1e6;

package/lib/sqlite_worker.js

@@ -118,6 +118,9 @@ async function executeStatement(sql, params) {
     },
     functions: userFunctions,
     aggregates: userAggregates,
+    // sqlite 兼容层是完整 SQL 接口：写操作与多语句都应保留。
+    allowWrites: true,
+    allowMultiStatement: true,
   });
   if (result && result.type === 'insert' && result.insertId !== null && result.insertId !== undefined) {
     _lastInsertId = Number(result.insertId);

package/lib/web_ui.js

@@ -236,7 +236,8 @@ class WebUI {
         const db = await this.db(dbName);
         const t0 = Date.now();
         try {
-          const res2 = await executeSQL(db, sql);
+          // 管理台是有鉴权的 SQL 控制台：需要执行 UPDATE/DELETE 等写语句。
+          const res2 = await executeSQL(db, sql, { allowWrites: true, allowMultiStatement: true });
           const ms = Date.now() - t0;
           const out = { ok: true, ms };
           if (res2 && res2.rows) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.5.14",
+  "version": "6.5.16",
   "description": "JSQL-NEO \u2014 Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",
@@ -52,7 +52,7 @@
     "test:btree": "node test/btree.test.js",
     "test:native": "node test/native.test.js",
     "test:regress": "node test/regress-5.1.0.js",
-    "test:all": "node test/smoke.js && node test/sql-parser.test.js && node test/readme-audit.test.js && node test/native.test.js && node test/native-multi-instance.test.js && node test/wal-recovery.test.js && node test/mysql-compat-hijack.test.js && node test/wasm.test.js && node test/coverage.js && node test/regress-5.1.0.js && node test/join.test.js && node test/btree.test.js && node test/dml-constraints.test.js && node test/savepoint.test.js && node test/alter-table.test.js && node test/null-semantics.test.js && node test/identifier-keywords.test.js && node test/sql-semantics.test.js && node test/extra-coverage.test.js && node test/filter-compile.test.js && node test/recursive-cte.test.js && node test/index-ddl.test.js && node test/mongo-group.test.js && node test/multiprotocol.test.js",
+    "test:all": "node test/smoke.js && node test/sql-parser.test.js && node test/readme-audit.test.js && node test/native.test.js && node test/native-multi-instance.test.js && node test/wal-recovery.test.js && node test/mysql-compat-hijack.test.js && node test/wasm.test.js && node test/coverage.js && node test/regress-5.1.0.js && node test/join.test.js && node test/btree.test.js && node test/v6.5.14-regression.test.js && node test/dml-constraints.test.js && node test/savepoint.test.js && node test/alter-table.test.js && node test/null-semantics.test.js && node test/identifier-keywords.test.js && node test/sql-semantics.test.js && node test/extra-coverage.test.js && node test/filter-compile.test.js && node test/recursive-cte.test.js && node test/index-ddl.test.js && node test/mongo-group.test.js && node test/multiprotocol.test.js",
     "test:coverage": "c8 --all --include='lib/**' --exclude='lib/web_ui.js' --reporter=text --reporter=lcov node test/coverage.js",
     "test:orms": "node examples/orms/run-all.js",
     "test:dml": "node test/dml-constraints.test.js",

package/test/btree.test.js

@@ -177,9 +177,6 @@ for (let t = 0; t < 25; t++) {
   ok('random mixed t' + t + ' vs reference', okAll && bt.size === ref.size, { size: bt.size, ref: ref.size, reason: reason });
 }
 
-console.log(failed === 0 ? `\nALL ${passed} BTREE TESTS PASSED` : `\n${failed} FAILURES (${passed} passed)`);
-process.exit(failed === 0 ? 0 : 1);
-
 /* ---- 回归：remove 后分隔键未更新导致内部键重复 ----
  *
  * 旧实现里 remove() 只改叶子，不更新祖先的分隔键副本。删掉某个正好是分隔键
@@ -205,3 +202,56 @@ process.exit(failed === 0 ? 0 : 1);
   if (errs.length) { okAll = false; reason = reason || ('validate: ' + errs[0]); }
   ok('回归：remove 后分隔键未更新', okAll && bt.size === ref.size, { size: bt.size, ref: ref.size, reason, keys: bt._root.keys });
 }
+
+/* ---- 回归：混合增删触发再平衡后索引条目丢失（C1）----
+ *
+ * 报告数据：search(6) → [54,28]（应为 [28,44,54]）、size 少 1。
+ * 根因是删除路径「先再平衡、后确认键是否存在」：把分支合并/借用之后才去删，
+ * 目标键可能已被搬到别的节点，于是这个 rowIndex 静默消失，size 也随之错位。
+ * 下面用固定操作序列（含多行同键 + 反复删除触发 merge/borrow）锁定该场景，
+ * 逐值与参考实现比对。
+ */
+{
+  const bt = new BTree(4);
+  const ref = new Map();
+  const ops = [];
+  // 先铺满两层，制造出可合并/可借用的兄弟节点
+  for (let k = 1; k <= 12; k++) ops.push([1, k, k]);
+  // key=6 挂三个行号（报告里的 28 / 44 / 54）
+  ops.push([1, 6, 28], [1, 6, 44], [1, 6, 54]);
+  // 删掉一批键，触发叶子合并 / 内部键下移
+  for (let k = 1; k <= 11; k += 2) ops.push([0, k, k]);
+  // 再插入新键，触发分裂
+  for (let k = 13; k <= 20; k++) ops.push([1, k, k]);
+  // 继续混合删除，踩 borrow/merge 路径
+  for (let k = 2; k <= 10; k += 2) ops.push([0, k, k]);
+  for (let k = 14; k <= 20; k += 2) ops.push([0, k, k]);
+  // 再插入，反复触发结构变化
+  ops.push([1, 21, 21], [1, 22, 22], [1, 23, 23], [0, 21, 21]);
+
+  let okAll = true, reason = '';
+  for (const [ins, k, r] of ops) {
+    if (ins) {
+      bt.insert(k, r);
+      if (!ref.has(k)) ref.set(k, new Set());
+      ref.get(k).add(r);
+    } else {
+      bt.remove(k, r);
+      if (ref.has(k)) { ref.get(k).delete(r); if (ref.get(k).size === 0) ref.delete(k); }
+    }
+  }
+  for (const [k, vals] of ref) {
+    const got = bt.search(k).slice().sort((a, b) => a - b);
+    const exp = [...vals].sort((a, b) => a - b);
+    if (JSON.stringify(got) !== JSON.stringify(exp)) { okAll = false; reason = reason || ('search(' + k + ')=' + JSON.stringify(got) + ' exp ' + JSON.stringify(exp)); }
+  }
+  const errs = validate(bt);
+  if (errs.length) { okAll = false; reason = reason || ('validate: ' + errs[0]); }
+  const six = bt.search(6).slice().sort((a, b) => a - b);
+  ok('C1 回归：key=6 三行号全部保留', JSON.stringify(six) === '[28,44,54]', six);
+  ok('C1 回归：混合增删后 size 与参考一致', bt.size === ref.size, { size: bt.size, ref: ref.size, reason });
+  ok('C1 回归：混合增删后逐键可搜到', okAll, reason);
+}
+
+console.log(failed === 0 ? `\nALL ${passed} BTREE TESTS PASSED` : `\n${failed} FAILURES (${passed} passed)`);
+process.exit(failed === 0 ? 0 : 1);

package/test/coverage.js

@@ -157,8 +157,8 @@ function tmp(name) {
     ok('sql aggregate', agg.rows[0][0] === 2);
     const fn = await executeSQL(db, 'SELECT VERSION(), CONCAT("x","y")');
     ok('sql func column names', fn.columns[0] === 'VERSION()');
-    await executeSQL(db, 'UPDATE users SET age = 31 WHERE name = \'Bob\'');
-    await executeSQL(db, 'DELETE FROM users WHERE id = 1');
+    await executeSQL(db, 'UPDATE users SET age = 31 WHERE name = \'Bob\'', { safety: false });
+    await executeSQL(db, 'DELETE FROM users WHERE id = 1', { safety: false });
     ok('sql count after delete', (await db.count('users')) === 1);
     await executeSQL(db, 'BEGIN');
     await executeSQL(db, "INSERT INTO users (name, age) VALUES ('Temp', 99)");
@@ -166,7 +166,7 @@ function tmp(name) {
     ok('sql rollback', (await db.count('users')) === 1);
     await executeSQL(db, 'START TRANSACTION');
     await executeSQL(db, "INSERT INTO users (name, age) VALUES ('X', 1)");
-    await executeSQL(db, 'TRUNCATE TABLE users');
+    await executeSQL(db, 'TRUNCATE TABLE users', { safety: false });
     ok('sql truncate', (await db.count('users')) === 0);
     const sqlApi = require(path.join(ROOT, 'lib/sql'));
     const parsed = sqlApi.parseSQL('SELECT * FROM t WHERE id = 5');

package/test/v6.5.14-regression.test.js

@@ -0,0 +1,323 @@
+/*
+ * v6.5.14 回归测试：把本版修掉的高危 / 中危缺陷逐条固化。
+ *
+ *   C1  B-Tree 混合插入/删除丢失索引条目
+ *   H1  PostgreSQL 未配置认证时的 trust 绕过
+ *   H2  NeDB $regex 字符串模式匹配一切
+ *   H3  UPDATE 标量子查询写成 NULL（含限定符相关子查询）
+ *   H4  BETWEEN 按字典序而非数值比较
+ *   H5  主键允许 NULL
+ *   H6  索引列 = null 漏行
+ *   M1  错误消息 %s 串位
+ *   M2  返回行浅拷贝导致内部数据被调用方污染
+ *   M3  migrate.normalizeSchema 丢失显式 length
+ *   M4  READ_COMMITTED 下 ROLLBACK 不撤销行
+ *   M5  XOR 破坏三值逻辑
+ *   M6  REGEXP BINARY 失效
+ *   M9  插件钩子未按 priority 排序
+ *   M10 XQL 编译器 NULL 传播
+ *   M11 Mongo 结果泄漏内部字段
+ *
+ *   node test/v6.5.14-regression.test.js
+ */
+const path = require('path');
+
+const ROOT = path.join(__dirname, '..');
+const { Database } = require(path.join(ROOT, 'index.js'));
+const { executeSQL } = require(path.join(ROOT, 'lib/sql.js'));
+const BTree = require(path.join(ROOT, 'lib/btree'));
+const { PgServer } = require(path.join(ROOT, 'lib/pg_server'));
+const { Datastore } = require(path.join(ROOT, 'lib/nedb_compat'));
+const { MongoServer } = require(path.join(ROOT, 'lib/mongo_server'));
+const { createError } = require(path.join(ROOT, 'lib/errors'));
+const { normalizeSchema } = require(path.join(ROOT, 'lib/migrate'));
+const { registerHook, runHooks, createHookRegistry } = require(path.join(ROOT, 'lib/plugin'));
+const { parse: xqlParse } = require(path.join(ROOT, 'lib/xql/src/parser'));
+const { compileQuery } = require(path.join(ROOT, 'lib/xql/src/compiler'));
+
+const OPTS = { safety: false };
+let pass = 0, fail = 0;
+
+function ok(name, cond, extra) {
+  if (cond) { pass++; console.log('[OK]  ', name); }
+  else { fail++; console.log('[FAIL]', name, extra !== undefined ? '-> ' + JSON.stringify(extra).slice(0, 160) : ''); }
+}
+const eq = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+
+function makeDb() { return new Database(':memory:'); }
+
+(async () => {
+  // ── C1. B-Tree 混合插入/删除 ────────────────────────────────
+  console.log('\n--- C1. B-Tree 混合插入/删除 ---');
+  {
+    const t = new BTree(4, false);
+    for (let i = 1; i <= 64; i++) t.insert(i, i);
+    ok('插入 64 条后 size=64', t.size === 64, t.size);
+    for (let i = 2; i <= 64; i += 2) t.remove(i, i);
+    ok('删除 32 条后 size=32', t.size === 32, t.size);
+    const missing = [];
+    for (let i = 1; i <= 64; i += 2) if (!t.search(i).includes(i)) missing.push(i);
+    ok('剩余奇数键全部可搜到', missing.length === 0, missing);
+    for (let i = 2; i <= 64; i += 2) t.insert(i, i);
+    ok('重新插入后 size=64', t.size === 64, t.size);
+    const missing2 = [];
+    for (let i = 1; i <= 64; i++) if (!t.search(i).includes(i)) missing2.push(i);
+    ok('全部键可搜到（无条目丢失）', missing2.length === 0, missing2);
+    // 重复键 + 多行号：删其中一行不应误删整键
+    const m = new BTree(4, false);
+    m.insert(7, 1); m.insert(7, 2); m.insert(7, 3);
+    m.remove(7, 2);
+    ok('同键多行只删指定行', eq(m.search(7).slice().sort(), [1, 3]), m.search(7));
+    ok('同键多行 size 仍为 1（size 记不同键数）', m.size === 1, m.size);
+  }
+
+  const db = makeDb();
+  await db.start();
+  const q = (sql) => executeSQL(db, sql, OPTS);
+  const one = async (sql) => (await q(sql)).rows[0][0];
+  const fails = async (sql) => { try { await q(sql); return null; } catch (e) { return e.message; } };
+
+  // ── H1. PG 认证默认拒绝 ─────────────────────────────────────
+  console.log('\n--- H1. PostgreSQL 认证 ---');
+  {
+    const srvDefault = new PgServer({});
+    ok('未配置认证时返回 undefined（拒绝连接）', srvDefault._userPassword('anyone') === undefined);
+    const srvNoAuth = new PgServer({ noAuth: true });
+    ok('显式 noAuth 才返回空密码（trust）', srvNoAuth._userPassword('anyone') === '');
+    const srvAuth = new PgServer({ auth: { alice: { password: 'pw' } } });
+    ok('配置的用户返回真实密码', srvAuth._userPassword('alice') === 'pw');
+    ok('未配置的用户返回 undefined', srvAuth._userPassword('bob') === undefined);
+    const srvOpt = new PgServer({ user: 'root', password: 'secret' });
+    ok('options.user 匹配返回密码', srvOpt._userPassword('root') === 'secret');
+    ok('options.user 不匹配拒绝', srvOpt._userPassword('other') === undefined);
+  }
+
+  // ── N1. SQL 安全策略：多语句 / 破坏性语句 ────────────────────
+  console.log('\n--- N1. SQL 安全策略 ---');
+  {
+    const attempts = async (sql, opts) => {
+      try { await executeSQL(db, sql, opts); return null; } catch (e) { return e.message; }
+    };
+    await q('CREATE TABLE guard(id INT PRIMARY KEY, v INT)');
+    await q("INSERT INTO guard VALUES (1, 1)");
+    const multi = await attempts('SELECT 1; DROP TABLE guard');
+    ok('多语句被拒绝（默认单语句）', /too many statements/i.test(multi || ''), multi);
+    ok('被拒后目标表仍在', (await q('SELECT * FROM guard')).rows.length === 1);
+    const drop = await attempts('DROP TABLE guard');
+    ok('单条 DROP 被拦截', /blocked by security policy: dropTable/i.test(drop || ''), drop);
+    const del = await attempts('DELETE FROM guard');
+    ok('单条 DELETE 被拦截', /blocked by security policy: delete/i.test(del || ''), del);
+    const upd = await attempts('UPDATE guard SET v = 2');
+    ok('单条 UPDATE 被拦截', /blocked by security policy: update/i.test(upd || ''), upd);
+    const trunc = await attempts('TRUNCATE TABLE guard');
+    ok('单条 TRUNCATE 被拦截', /blocked by security policy: truncate/i.test(trunc || ''), trunc);
+    ok('WITH ... DELETE 同样被拦截',
+      /blocked by security policy: delete/i.test(await attempts('WITH x AS (SELECT 1) DELETE FROM guard') || ''));
+    const allowed = await attempts('DELETE FROM guard', { allowWrites: true });
+    ok('allowWrites: true 放行写操作', allowed === null, allowed);
+    const multiAllowed = await attempts('SELECT 1; SELECT 2', { allowMultiStatement: true, allowWrites: true });
+    ok('allowMultiStatement 可显式放开多语句（非破坏性）', multiAllowed === null, multiAllowed);
+    ok('safety:false 仍可执行破坏性语句', (await attempts('DROP TABLE guard', { safety: false })) === null);
+  }
+
+  // ── H2. NeDB $regex ─────────────────────────────────────────
+  console.log('\n--- H2. NeDB $regex ---');
+  {
+    const ndb = new Database(':memory:');
+    await ndb.start();
+    const ds = new Datastore({ database: ndb });
+    await ds.loadDatabase();
+    await ds.insert([{ n: 'abc' }, { n: 'abcd' }, { n: 'zzz' }, { n: 42 }]);
+    const hit = await ds.find({ n: { $regex: 'abc' } }).exec();
+    ok('字符串模式只匹配命中文档', hit.length === 2 && hit.every(d => /abc/.test(String(d.n))), hit);
+    const exact = await ds.find({ n: { $regex: '^abc$' } }).exec();
+    ok('锚定模式精确匹配', exact.length === 1 && exact[0].n === 'abc', exact);
+    const invalid = await ds.find({ n: { $regex: '(' } }).exec();
+    ok('非法模式返回空而不是全匹配', invalid.length === 0, invalid);
+    const re = await ds.find({ n: { $regex: /^abc/ } }).exec();
+    ok('RegExp 对象仍可用', re.length === 2, re.map(d => d.n));
+    await ndb.stop();
+  }
+
+  // ── H3. UPDATE 标量子查询 ───────────────────────────────────
+  console.log('\n--- H3. UPDATE 标量子查询 ---');
+  await q('CREATE TABLE a3(id INT PRIMARY KEY, v INT)');
+  await q('CREATE TABLE b3(id INT PRIMARY KEY, w INT)');
+  await q('INSERT INTO a3 VALUES (1,0),(2,0),(3,0)');
+  await q('INSERT INTO b3 VALUES (1,10),(2,20)');
+  await q('UPDATE a3 SET v = (SELECT w FROM b3 WHERE b3.id = a3.id)');
+  ok('相关标量子查询按行写入（限定符）',
+    eq((await q('SELECT id, v FROM a3')).rows, [[1, 10], [2, 20], [3, null]]),
+    (await q('SELECT id, v FROM a3')).rows);
+  ok('非相关标量子查询可用',
+    (await q('UPDATE a3 SET v = (SELECT MAX(w) FROM b3)'), (await q('SELECT id, v FROM a3')).rows.every(r => r[1] === 20)));
+  ok('SELECT 投影里的相关子查询一致',
+    eq((await q('SELECT a3.id, (SELECT w FROM b3 WHERE b3.id = a3.id) AS w FROM a3')).rows,
+      [[1, 10], [2, 20], [3, null]]));
+  ok('EXISTS 相关子查询仍正确',
+    eq((await q('SELECT a3.id FROM a3 WHERE EXISTS (SELECT 1 FROM b3 WHERE b3.id = a3.id)')).rows, [[1], [2]]));
+
+  // ── H4. BETWEEN 数值比较 ────────────────────────────────────
+  console.log('\n--- H4. BETWEEN ---');
+  ok('10 BETWEEN 2 AND 20 = 1', (await one('SELECT 10 BETWEEN 2 AND 20')) === 1);
+  ok('5 BETWEEN 10 AND 20 = 0', (await one('SELECT 5 BETWEEN 10 AND 20')) === 0);
+  ok('"10" BETWEEN 2 AND 20 仍按数值', (await one("SELECT '10' BETWEEN 2 AND 20")) === 1);
+  ok('字符串 BETWEEN 保持字典序', (await one("SELECT 'b' BETWEEN 'a' AND 'c'")) === 1);
+
+  // ── H5. 主键 NOT NULL ───────────────────────────────────────
+  console.log('\n--- H5. 主键 NULL ---');
+  await db.createTable('pk5', {
+    k: { type: 'integer', primaryKey: true },
+    v: { type: 'integer' },
+  });
+  {
+    const msg = await (async () => { try { await db.insert('pk5', { k: null, v: 1 }); return null; } catch (e) { return e.message; } })();
+    ok('非自增主键插入 NULL 报错', /cannot be null/i.test(msg || ''), msg);
+    await db.insert('pk5', { k: 1, v: 1 });
+    const upd = await (async () => { try { await db.updateById('pk5', 1, { k: null }); return null; } catch (e) { return e.message; } })();
+    ok('更新主键为 NULL 报错', /cannot be null/i.test(upd || ''), upd);
+  }
+  {
+    let accepted = false;
+    try { await q('CREATE TABLE pk5b(k INT PRIMARY KEY, v INT)'); await q('INSERT INTO pk5b VALUES (NULL, 1)'); accepted = true; } catch (_) { /* 预期抛错 */ }
+    ok('INT PRIMARY KEY 自增语义仍允许 NULL（自动取号）', accepted);
+  }
+
+  // ── H6. 索引列 = null ──────────────────────────────────────
+  console.log('\n--- H6. 索引列 null ---');
+  await q('CREATE TABLE n6(id INT PRIMARY KEY, c INT)');
+  await q('INSERT INTO n6 VALUES (1,NULL),(2,5),(3,NULL)');
+  await q('CREATE INDEX ixc ON n6(c)');
+  ok('索引列 find({c:null}) 不漏行', eq((await db.find('n6', { c: null })).map(r => r.id), [1, 3]),
+    await db.find('n6', { c: null }));
+  ok('索引列 find({c:5}) 正常', eq((await db.find('n6', { c: 5 })).map(r => r.id), [2]));
+  ok('$in 含 null 时回退全表', eq((await db.find('n6', { c: { $in: [5, null] } })).map(r => r.id), [1, 2, 3]),
+    await db.find('n6', { c: { $in: [5, null] } }));
+
+  // ── M1. 错误消息 %s ────────────────────────────────────────
+  console.log('\n--- M1. 错误消息 %s ---');
+  {
+    const e1 = createError('ER_DUP_ENTRY', 'x%s', 'k');
+    ok('参数里的 %s 不被二次替换', e1.message === "Duplicate entry 'x%s' for key 'k'", e1.message);
+    const e2 = createError('ER_DUP_ENTRY', 'only-one');
+    ok('参数不足时裸 %s 被清空', e2.message === "Duplicate entry 'only-one' for key ''", e2.message);
+  }
+
+  // ── M2. 深拷贝 ────────────────────────────────────────────
+  console.log('\n--- M2. 行深拷贝 ---');
+  await db.createTable('m2', {
+    id: { type: 'integer', primaryKey: true, autoIncrement: true },
+    meta: { type: 'json' },
+  });
+  await db.insert('m2', { meta: { a: [1, 2] } });
+  {
+    const r1 = await db.findById('m2', 1);
+    r1.meta.a.push(99);
+    const r2 = await db.findById('m2', 1);
+    ok('修改返回值不污染内部行', eq(r2.meta, { a: [1, 2] }), r2.meta);
+    const list = await db.find('m2', {});
+    list[0].meta.a.push(100);
+    const again = await db.find('m2', {});
+    ok('find() 同样返回深拷贝', eq(again[0].meta, { a: [1, 2] }), again[0].meta);
+  }
+
+  // ── M3. migrate 保留 length ────────────────────────────────
+  console.log('\n--- M3. migrate length ---');
+  {
+    const s1 = normalizeSchema({ name: { type: 'string', length: 32 } });
+    ok('显式 length 保留', s1.name.length === 32, s1.name);
+    const s2 = normalizeSchema({ name: { type: 'string', maxLength: 64 } });
+    ok('maxLength 回填为 length', s2.name.length === 64 && s2.name.maxLength === undefined, s2.name);
+    const s3 = normalizeSchema({ name: { type: 'string', length: 16, maxLength: 99 } });
+    ok('显式 length 优先于 maxLength', s3.name.length === 16, s3.name);
+    const s4 = normalizeSchema({ n: 'int' });
+    ok('字符串简写仍归一化', s4.n.type === 'integer', s4.n);
+  }
+
+  // ── M4. READ_COMMITTED 回滚 ─────────────────────────────────
+  console.log('\n--- M4. READ_COMMITTED 回滚 ---');
+  {
+    const tx = makeDb();
+    await tx.start();
+    await tx.createTable('m4', {
+      id: { type: 'integer', primaryKey: true, autoIncrement: true },
+      v: { type: 'integer' },
+    });
+    await tx.insert('m4', { v: 1 });
+    tx.begin('READ_COMMITTED');
+    await tx.insert('m4', { v: 2 });
+    tx.rollback();
+    ok('ROLLBACK 撤销已插入行', eq((await tx.find('m4', {})).map(r => r.v), [1]), await tx.find('m4', {}));
+    tx.begin('READ_COMMITTED');
+    await tx.insert('m4', { v: 3 });
+    tx.commit();
+    ok('COMMIT 保留行', eq((await tx.find('m4', {})).map(r => r.v).sort(), [1, 3]));
+    await tx.stop();
+  }
+
+  // ── M5. XOR 三值逻辑 ───────────────────────────────────────
+  console.log('\n--- M5. XOR ---');
+  ok('TRUE XOR FALSE = 1', (await one('SELECT TRUE XOR FALSE')) === 1);
+  ok('TRUE XOR TRUE = 0', (await one('SELECT TRUE XOR TRUE')) === 0);
+  ok('NULL XOR TRUE = NULL', (await one('SELECT NULL XOR TRUE')) === null);
+  ok('NULL XOR FALSE = NULL', (await one('SELECT NULL XOR FALSE')) === null);
+  ok('NULL XOR NULL = NULL', (await one('SELECT NULL XOR NULL')) === null);
+
+  // ── M6. REGEXP BINARY ──────────────────────────────────────
+  console.log('\n--- M6. REGEXP BINARY ---');
+  await q('CREATE TABLE r6(id INT PRIMARY KEY, s TEXT)');
+  await q("INSERT INTO r6 VALUES (1,'abc'),(2,'ABC')");
+  ok('默认 REGEXP 大小写不敏感', eq((await q("SELECT id FROM r6 WHERE s REGEXP 'abc'")).rows.map(r => r[0]).sort(), [1, 2]));
+  ok('REGEXP BINARY 大小写敏感', eq((await q("SELECT id FROM r6 WHERE s REGEXP BINARY 'abc'")).rows, [[1]]));
+  ok('RLIKE BINARY 同样生效', eq((await q("SELECT id FROM r6 WHERE s RLIKE BINARY 'abc'")).rows, [[1]]));
+  ok('非法正则安全返回不匹配', eq((await q("SELECT id FROM r6 WHERE s REGEXP BINARY '('")).rows, []));
+
+  // ── M9. 插件钩子优先级 ─────────────────────────────────────
+  console.log('\n--- M9. 钩子优先级 ---');
+  {
+    const engine = { _hooks: createHookRegistry() };
+    const order = [];
+    registerHook(engine, 'beforeQuery', () => { order.push('low'); return true; }, 0);
+    registerHook(engine, 'beforeQuery', () => { order.push('high'); return true; }, 10);
+    registerHook(engine, 'beforeQuery', () => { order.push('mid'); return true; }, 5);
+    await runHooks(engine, 'beforeQuery', []);
+    ok('按 priority 降序执行', eq(order, ['high', 'mid', 'low']), order);
+
+    const order2 = [];
+    const e2 = { _hooks: createHookRegistry() };
+    registerHook(e2, 'beforeQuery', () => { order2.push('a'); return true; }, 3);
+    registerHook(e2, 'beforeQuery', () => { order2.push('b'); return true; }, 3);
+    await runHooks(e2, 'beforeQuery', []);
+    ok('同 priority 保持注册顺序', eq(order2, ['a', 'b']), order2);
+  }
+
+  // ── M10. XQL NULL 传播 ────────────────────────────────────
+  console.log('\n--- M10. XQL NULL ---');
+  {
+    const rows = [{ id: 1, a: null }, { id: 2, a: 5 }, { id: 3, a: 3 }];
+    const run = (sql) => compileQuery(xqlParse(sql), {})(rows);
+    ok('a = 5 命中', eq(run('SELECT id FROM t WHERE a = 5'), [{ id: 2 }]));
+    ok('a = NULL 不命中任何行', eq(run('SELECT id FROM t WHERE a = NULL'), []));
+    ok('a != NULL 不命中任何行', eq(run('SELECT id FROM t WHERE a != NULL'), []));
+    ok('BETWEEN 正常', eq(run('SELECT id FROM t WHERE a BETWEEN 2 AND 4'), [{ id: 3 }]));
+    ok('IN (5, NULL) 只命中 5', eq(run('SELECT id FROM t WHERE a IN (5, NULL)'), [{ id: 2 }]));
+    ok('NOT IN 含 NULL 不命中（三值逻辑）', eq(run('SELECT id FROM t WHERE a NOT IN (5, NULL)'), []));
+  }
+
+  // ── M11. Mongo 内部字段 ───────────────────────────────────
+  console.log('\n--- M11. Mongo _publicDoc ---');
+  {
+    const ms = new MongoServer({});
+    ok('剥离 _deleted/_rid/_score', eq(ms._publicDoc({ _id: 1, x: 2, _rid: 9, _deleted: false, _score: 3 }), { _id: 1, x: 2 }),
+      ms._publicDoc({ _id: 1, x: 2, _rid: 9, _deleted: false, _score: 3 }));
+    ok('干净文档原样返回', eq(ms._publicDoc({ _id: 2, y: 3 }), { _id: 2, y: 3 }));
+  }
+
+  await db.stop();
+
+  console.log(`\n${pass} passed, ${fail} failed`);
+  if (fail > 0) process.exitCode = 1;
+})().catch((e) => {
+  console.error('FATAL', e);
+  process.exitCode = 1;
+});