jsql-neo 6.5.15 → 6.5.17

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.5.15** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.5.17** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.5.15 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.5.17 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/mysql_compat.js

@@ -146,6 +146,7 @@ class Connection extends EventEmitter {
       const r = await executeSQL(engine, finalSql, {
         safety: this.safety,
         allowComments: this.allowComments,
+        allowWrites: true,
         maxStatements: this.config.multipleStatements ? null : 1,
       });
       const results = Array.isArray(r) ? r : [r];

package/lib/mysql_server.js

@@ -957,6 +957,8 @@ class MysqlConnection {
           const r = await executeSQL(engine, sqlToRun, {
             allowComments: this.server.allowComments,
             safety: this.server.safety,
+            // 协议服务器本身就是数据库端：客户端发来的 DROP/DELETE/UPDATE 必须执行。
+            allowWrites: true,
             maxStatements: 1,
             session: this.session,
           });

package/lib/sql.js

@@ -18,6 +18,24 @@ const DANGEROUS_SQL = [
 // （CWE-770）。可在 executeSQL 通过 opts.maxSqlLength 放宽/关闭（传 Infinity）。
 const DEFAULT_MAX_SQL_LENGTH = 64 * 1024 * 1024;
 
+// 破坏性语句：安全模式下默认拦截（可显式 allowWrites: true 放行）。
+// 多语句注入（`SELECT …; DROP TABLE s;`）的修复分两层：
+//   1) 安全模式默认只允许一条语句（mysql2 默认也是单语句）；
+//   2) 单条 DROP / TRUNCATE / DELETE / UPDATE 也需显式放行。
+// 协议服务器（MySQL / PG）与迁移/管理台会显式传 allowWrites，保持原有能力。
+const DESTRUCTIVE_STMT_TYPES = new Set([
+  'delete', 'update', 'truncate',
+  'dropTable', 'dropIndex', 'dropView', 'dropDatabase',
+]);
+
+/** 递归看 WITH 包着的真正语句，返回破坏性语句类型或 null */
+function findDestructiveStatement(stmt) {
+  if (!stmt || typeof stmt !== 'object') return null;
+  if (DESTRUCTIVE_STMT_TYPES.has(stmt.type)) return stmt.type;
+  if (stmt.type === 'with' && stmt.statement) return findDestructiveStatement(stmt.statement);
+  return null;
+}
+
 function findDangerousSQL(tokens) {
   // 先把注释去掉，防止通过 /*comment*/DROP 绕过检测
   const commentStripped = [];
@@ -2867,8 +2885,21 @@ function applyCast(value, dataType) {
   if (value === null || value === undefined) return null;
   // SIGNED / UNSIGNED 是 MySQL 的整型别名（CAST(x AS SIGNED)），
   // 此前没列入整型分支，导致 CAST('12abc' AS SIGNED) 原样返回字符串。
+  // CAST(x AS UNSIGNED)：MySQL 先取整，再按 64 位无符号回绕（负数变成补码），
+  // CAST(-5 AS UNSIGNED) = 18446744073709551611。用 BigInt 保精度，
+  // 序列化层会把 BigInt 转成字符串（见 6.5.11 的超大整数处理）。
+  if (t === 'UNSIGNED') {
+    let n;
+    if (typeof value === 'boolean') n = value ? 1n : 0n;
+    else if (typeof value === 'number') n = Number.isFinite(value) ? BigInt(Math.trunc(value)) : 0n;
+    else {
+      const m = String(value).trim().match(/^[+-]?\d+(\.\d+)?/);
+      n = m ? BigInt(Math.trunc(Number(m[0]))) : 0n;
+    }
+    return BigInt.asUintN(64, n);
+  }
   if (t === 'INTEGER' || t === 'INT' || t === 'BIGINT' || t === 'SMALLINT' ||
-      t === 'TINYINT' || t === 'SIGNED' || t === 'UNSIGNED' || t === 'MEDIUMINT') {
+      t === 'TINYINT' || t === 'SIGNED' || t === 'MEDIUMINT') {
     // MySQL CAST(... AS SIGNED/INT)：取数字前缀（'12abc'→12），无法解析时返回 0（而非 null）。
     if (typeof value === 'boolean') return value ? 1 : 0;
     if (typeof value === 'number') return Number.isFinite(value) ? Math.trunc(value) : 0;
@@ -3480,7 +3511,13 @@ function applyScalarFunction(fnNode, row, ctx) {
     }
     case 'UPPER': case 'UCASE': return args[0] == null ? null : String(args[0]).toUpperCase();
     case 'LOWER': case 'LCASE': return args[0] == null ? null : String(args[0]).toLowerCase();
-    case 'LENGTH': case 'CHAR_LENGTH': case 'CHARACTER_LENGTH': return args[0] == null ? null : String(args[0]).length;
+    // MySQL：LENGTH 是「字节数」（utf8mb4 下 'héllo' = 6），
+    // CHAR_LENGTH / CHARACTER_LENGTH 才是「字符数」。此前三个全按字符数，
+    // 非 ASCII 文本的字节长度全部偏小。
+    case 'LENGTH': case 'OCTET_LENGTH':
+      return args[0] == null ? null : Buffer.byteLength(String(args[0]), 'utf8');
+    case 'CHAR_LENGTH': case 'CHARACTER_LENGTH':
+      return args[0] == null ? null : String(args[0]).length;
     // TRIM(s) / TRIM([LEADING|TRAILING|BOTH] chars FROM s) / TRIM(s, chars)
     case 'TRIM': {
       if (args[0] == null) return null;
@@ -3767,7 +3804,10 @@ function applyScalarFunction(fnNode, row, ctx) {
     case 'FLOOR': return args[0] == null ? null : Math.floor(args[0]);
     case 'CEIL': case 'CEILING': return args[0] == null ? null : Math.ceil(args[0]);
     case 'MOD': return (args[0] == null || args[1] === 0) ? null : args[0] % args[1];
-    case 'POWER': case 'POW': return args[0] == null ? null : Math.pow(args[0], args[1]);
+    case 'POWER': case 'POW':
+      // MySQL：任一参数为 NULL 就返回 NULL。Math.pow(2, null) 会按 0 算出 1。
+      if (args[0] == null || args[1] == null) return null;
+      return Math.pow(args[0], args[1]);
     case 'SQRT': return args[0] == null ? null : Math.sqrt(args[0]);
     case 'IFNULL': case 'NVL': return args[0] != null ? args[0] : args[1];
     case 'COALESCE': {
@@ -3802,8 +3842,20 @@ function applyScalarFunction(fnNode, row, ctx) {
       }
       return s.substr(start - 1);
     }
-    case 'LEFT': return args[0] == null ? null : String(args[0]).slice(0, Number(args[1]));
-    case 'RIGHT': return args[0] == null ? null : String(args[0]).slice(-Number(args[1]));
+    // MySQL：负长度返回空串（不是「从末尾切」或丢参数后的怪异子串）。
+    case 'LEFT': {
+      if (args[0] == null) return null;
+      const n = Number(args[1]);
+      if (!Number.isFinite(n) || n < 0) return '';
+      return String(args[0]).slice(0, n);
+    }
+    case 'RIGHT': {
+      if (args[0] == null) return null;
+      const n = Number(args[1]);
+      if (!Number.isFinite(n) || n < 0) return '';
+      if (n === 0) return '';
+      return String(args[0]).slice(-n);
+    }
     case 'LOCATE': {
       if (args[0] == null || args[1] == null) return null;
       const idx = String(args[1]).indexOf(String(args[0]));
@@ -3866,23 +3918,31 @@ function applyScalarFunction(fnNode, row, ctx) {
       }
       return Array.isArray(v) ? v.length : null;
     }
+    // MySQL：填充串按「需要多少补多少」截断，不能整段循环拼接——
+    // LPAD('hi',5,'xy') = 'xyxhi'（此前每轮都加完整的 'xy'，得到 'xyxyhi'）。
     case 'LPAD': {
-      if (args[0] == null) return null;
-      let s = String(args[0]);
-      const n = Number(args[1]);
-      const pad = args[2] == null ? ' ' : String(args[2]);
+      if (args[0] == null || args[1] == null) return null;
+      if (args.length >= 3 && args[2] == null) return null;
+      const s = String(args[0]);
+      const n = Math.trunc(Number(args[1]));
+      if (!Number.isFinite(n)) return null;
       if (n <= s.length) return s.slice(0, n);
-      while (s.length < n) s = pad + s;
-      return s;
+      const pad = args[2] === undefined ? ' ' : String(args[2]);
+      if (pad === '') return s;
+      const need = n - s.length;
+      return pad.repeat(Math.ceil(need / pad.length)).slice(0, need) + s;
     }
     case 'RPAD': {
-      if (args[0] == null) return null;
-      let s = String(args[0]);
-      const n = Number(args[1]);
-      const pad = args[2] == null ? ' ' : String(args[2]);
+      if (args[0] == null || args[1] == null) return null;
+      if (args.length >= 3 && args[2] == null) return null;
+      const s = String(args[0]);
+      const n = Math.trunc(Number(args[1]));
+      if (!Number.isFinite(n)) return null;
       if (n <= s.length) return s.slice(0, n);
-      while (s.length < n) s = s + pad;
-      return s;
+      const pad = args[2] === undefined ? ' ' : String(args[2]);
+      if (pad === '') return s;
+      const need = n - s.length;
+      return s + pad.repeat(Math.ceil(need / pad.length)).slice(0, need);
     }
     case 'RAND': return args.length > 0 && args[0] != null ? seedRand(Number(args[0]))() : Math.random();
     case 'UNIX_TIMESTAMP': {
@@ -8032,26 +8092,43 @@ async function executeSQL(engine, sql, paramsOrOpts, opts = {}) {
   } else if (paramsOrOpts && typeof paramsOrOpts === 'object') {
     // 第三参为对象时：含已知 opts 键 → 视为 opts；否则视为命名参数（{id: 1} → :id / $id）
     const OPTS_KEYS = ['safety', 'session', 'params', 'functions', 'aggregates',
-      'allowComments', 'maxStatements', 'maxSqlLength', 'context', 'timeout', 'dialect'];
+      'allowComments', 'maxStatements', 'maxSqlLength', 'context', 'timeout', 'dialect',
+      'allowWrites', 'allowMultiStatement'];
     const looksLikeOpts = Object.keys(paramsOrOpts).some(k => OPTS_KEYS.includes(k));
     if (looksLikeOpts) opts = paramsOrOpts;
     else sql = applyParams(sql, paramsOrOpts);
   }
-  if (opts.safety !== false) {
+  const safetyOn = opts.safety !== false;
+  if (safetyOn) {
     if (!opts.allowComments && hasComments(sql)) {
       throw new Error('SQL comments are disabled for security (--, #, /* */)');
     }
   }
   let statements = splitStatements(sql, { maxLength: opts.maxSqlLength });
-  if (opts.maxStatements != null && statements.length > opts.maxStatements) {
-    throw new Error(`too many statements (${statements.length} > ${opts.maxStatements})`);
-  }
-  if (opts.safety !== false) {
+  // 安全模式默认单语句：`SELECT 1; DROP TABLE s;` 不能再把第二条语句一起执行。
+  // 需要多语句的内部调用方显式传 maxStatements 或 allowMultiStatement: true。
+  const maxStatements = opts.maxStatements != null
+    ? opts.maxStatements
+    : (safetyOn && opts.allowMultiStatement !== true ? 1 : Infinity);
+  if (statements.length > maxStatements) {
+    throw new Error(`too many statements (${statements.length} > ${maxStatements})`);
+  }
+  if (safetyOn) {
     for (const stmtSql of statements) {
       const dangerous = findDangerousSQL(tokenize(stmtSql));
       if (dangerous) throw new Error(`SQL statement blocked by security policy: ${dangerous}`);
     }
   }
+  // 先全部解析、再统一做破坏性检查 —— 若有第二条是 DROP，第一条 SELECT 也不能先执行。
+  const parsedStatements = statements.map(s => parseSQL(s));
+  if (safetyOn && opts.allowWrites !== true) {
+    for (const stmt of parsedStatements) {
+      const destructive = findDestructiveStatement(stmt);
+      if (destructive) {
+        throw new Error(`SQL statement blocked by security policy: ${destructive} (pass { allowWrites: true } or { safety: false } to allow writes)`);
+      }
+    }
+  }
   const ctx = {};
   if (opts.session) ctx.session = opts.session;
   if (opts.params) ctx.params = opts.params;   // 原生 ? 占位符（applyParams 之外的另一种用法）
@@ -8059,8 +8136,8 @@ async function executeSQL(engine, sql, paramsOrOpts, opts = {}) {
   if (opts.aggregates && typeof opts.aggregates === 'object') ctx.aggregates = opts.aggregates;
   const executor = new SQLExecutor(engine, Object.keys(ctx).length > 0 ? ctx : null);
   const results = [];
-  for (const stmtSql of statements) {
-    const stmt = parseSQL(stmtSql);
+  for (let si = 0; si < parsedStatements.length; si++) {
+    const stmt = parsedStatements[si];
     const t0 = process.hrtime.bigint();
     let r = await executor.execute(stmt);
     const durationMs = Number(process.hrtime.bigint() - t0) / 1e6;

package/lib/sqlite_worker.js

@@ -118,6 +118,9 @@ async function executeStatement(sql, params) {
     },
     functions: userFunctions,
     aggregates: userAggregates,
+    // sqlite 兼容层是完整 SQL 接口：写操作与多语句都应保留。
+    allowWrites: true,
+    allowMultiStatement: true,
   });
   if (result && result.type === 'insert' && result.insertId !== null && result.insertId !== undefined) {
     _lastInsertId = Number(result.insertId);

package/lib/web_ui.js

@@ -236,7 +236,8 @@ class WebUI {
         const db = await this.db(dbName);
         const t0 = Date.now();
         try {
-          const res2 = await executeSQL(db, sql);
+          // 管理台是有鉴权的 SQL 控制台：需要执行 UPDATE/DELETE 等写语句。
+          const res2 = await executeSQL(db, sql, { allowWrites: true, allowMultiStatement: true });
           const ms = Date.now() - t0;
           const out = { ok: true, ms };
           if (res2 && res2.rows) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.5.15",
+  "version": "6.5.17",
   "description": "JSQL-NEO \u2014 Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",

package/test/btree.test.js

@@ -177,9 +177,6 @@ for (let t = 0; t < 25; t++) {
   ok('random mixed t' + t + ' vs reference', okAll && bt.size === ref.size, { size: bt.size, ref: ref.size, reason: reason });
 }
 
-console.log(failed === 0 ? `\nALL ${passed} BTREE TESTS PASSED` : `\n${failed} FAILURES (${passed} passed)`);
-process.exit(failed === 0 ? 0 : 1);
-
 /* ---- 回归：remove 后分隔键未更新导致内部键重复 ----
  *
  * 旧实现里 remove() 只改叶子，不更新祖先的分隔键副本。删掉某个正好是分隔键
@@ -205,3 +202,56 @@ process.exit(failed === 0 ? 0 : 1);
   if (errs.length) { okAll = false; reason = reason || ('validate: ' + errs[0]); }
   ok('回归：remove 后分隔键未更新', okAll && bt.size === ref.size, { size: bt.size, ref: ref.size, reason, keys: bt._root.keys });
 }
+
+/* ---- 回归：混合增删触发再平衡后索引条目丢失（C1）----
+ *
+ * 报告数据：search(6) → [54,28]（应为 [28,44,54]）、size 少 1。
+ * 根因是删除路径「先再平衡、后确认键是否存在」：把分支合并/借用之后才去删，
+ * 目标键可能已被搬到别的节点，于是这个 rowIndex 静默消失，size 也随之错位。
+ * 下面用固定操作序列（含多行同键 + 反复删除触发 merge/borrow）锁定该场景，
+ * 逐值与参考实现比对。
+ */
+{
+  const bt = new BTree(4);
+  const ref = new Map();
+  const ops = [];
+  // 先铺满两层，制造出可合并/可借用的兄弟节点
+  for (let k = 1; k <= 12; k++) ops.push([1, k, k]);
+  // key=6 挂三个行号（报告里的 28 / 44 / 54）
+  ops.push([1, 6, 28], [1, 6, 44], [1, 6, 54]);
+  // 删掉一批键，触发叶子合并 / 内部键下移
+  for (let k = 1; k <= 11; k += 2) ops.push([0, k, k]);
+  // 再插入新键，触发分裂
+  for (let k = 13; k <= 20; k++) ops.push([1, k, k]);
+  // 继续混合删除，踩 borrow/merge 路径
+  for (let k = 2; k <= 10; k += 2) ops.push([0, k, k]);
+  for (let k = 14; k <= 20; k += 2) ops.push([0, k, k]);
+  // 再插入，反复触发结构变化
+  ops.push([1, 21, 21], [1, 22, 22], [1, 23, 23], [0, 21, 21]);
+
+  let okAll = true, reason = '';
+  for (const [ins, k, r] of ops) {
+    if (ins) {
+      bt.insert(k, r);
+      if (!ref.has(k)) ref.set(k, new Set());
+      ref.get(k).add(r);
+    } else {
+      bt.remove(k, r);
+      if (ref.has(k)) { ref.get(k).delete(r); if (ref.get(k).size === 0) ref.delete(k); }
+    }
+  }
+  for (const [k, vals] of ref) {
+    const got = bt.search(k).slice().sort((a, b) => a - b);
+    const exp = [...vals].sort((a, b) => a - b);
+    if (JSON.stringify(got) !== JSON.stringify(exp)) { okAll = false; reason = reason || ('search(' + k + ')=' + JSON.stringify(got) + ' exp ' + JSON.stringify(exp)); }
+  }
+  const errs = validate(bt);
+  if (errs.length) { okAll = false; reason = reason || ('validate: ' + errs[0]); }
+  const six = bt.search(6).slice().sort((a, b) => a - b);
+  ok('C1 回归：key=6 三行号全部保留', JSON.stringify(six) === '[28,44,54]', six);
+  ok('C1 回归：混合增删后 size 与参考一致', bt.size === ref.size, { size: bt.size, ref: ref.size, reason });
+  ok('C1 回归：混合增删后逐键可搜到', okAll, reason);
+}
+
+console.log(failed === 0 ? `\nALL ${passed} BTREE TESTS PASSED` : `\n${failed} FAILURES (${passed} passed)`);
+process.exit(failed === 0 ? 0 : 1);

package/test/coverage.js

@@ -157,8 +157,8 @@ function tmp(name) {
     ok('sql aggregate', agg.rows[0][0] === 2);
     const fn = await executeSQL(db, 'SELECT VERSION(), CONCAT("x","y")');
     ok('sql func column names', fn.columns[0] === 'VERSION()');
-    await executeSQL(db, 'UPDATE users SET age = 31 WHERE name = \'Bob\'');
-    await executeSQL(db, 'DELETE FROM users WHERE id = 1');
+    await executeSQL(db, 'UPDATE users SET age = 31 WHERE name = \'Bob\'', { safety: false });
+    await executeSQL(db, 'DELETE FROM users WHERE id = 1', { safety: false });
     ok('sql count after delete', (await db.count('users')) === 1);
     await executeSQL(db, 'BEGIN');
     await executeSQL(db, "INSERT INTO users (name, age) VALUES ('Temp', 99)");
@@ -166,7 +166,7 @@ function tmp(name) {
     ok('sql rollback', (await db.count('users')) === 1);
     await executeSQL(db, 'START TRANSACTION');
     await executeSQL(db, "INSERT INTO users (name, age) VALUES ('X', 1)");
-    await executeSQL(db, 'TRUNCATE TABLE users');
+    await executeSQL(db, 'TRUNCATE TABLE users', { safety: false });
     ok('sql truncate', (await db.count('users')) === 0);
     const sqlApi = require(path.join(ROOT, 'lib/sql'));
     const parsed = sqlApi.parseSQL('SELECT * FROM t WHERE id = 5');

package/test/extra-coverage.test.js

@@ -159,15 +159,16 @@ test('超长字符串 100000 字符正常处理', async () => {
   assert.strictEqual(await one(q, `SELECT LENGTH('${long}')`), 100000);
 });
 
-test('Unicode é 正确处理（LENGTH=5, UPPER 含重音）', async () => {
+test('Unicode é 正确处理（LENGTH=6 字节 / CHAR_LENGTH=5, UPPER 含重音）', async () => {
   const { q } = makeDb();
-  assert.strictEqual(await one(q, "SELECT LENGTH('héllo')"), 5);
+  assert.strictEqual(await one(q, "SELECT LENGTH('héllo')"), 6);
+  assert.strictEqual(await one(q, "SELECT CHAR_LENGTH('héllo')"), 5);
   assert.strictEqual(await one(q, "SELECT UPPER('café')"), 'CAFÉ');
 });
 
-test('Emoji 按 UTF-16 单元计数（LENGTH=4）', async () => {
+test('Emoji 按 UTF-8 字节计数（LENGTH=8）', async () => {
   const { q } = makeDb();
-  assert.strictEqual(await one(q, "SELECT LENGTH('🚀🌟')"), 4);
+  assert.strictEqual(await one(q, "SELECT LENGTH('🚀🌟')"), 8);
 });
 
 test('Emoji UPPER 无变化', async () => {

package/test/v6.5.14-regression.test.js

@@ -92,6 +92,34 @@ function makeDb() { return new Database(':memory:'); }
     ok('options.user 不匹配拒绝', srvOpt._userPassword('other') === undefined);
   }
 
+  // ── N1. SQL 安全策略：多语句 / 破坏性语句 ────────────────────
+  console.log('\n--- N1. SQL 安全策略 ---');
+  {
+    const attempts = async (sql, opts) => {
+      try { await executeSQL(db, sql, opts); return null; } catch (e) { return e.message; }
+    };
+    await q('CREATE TABLE guard(id INT PRIMARY KEY, v INT)');
+    await q("INSERT INTO guard VALUES (1, 1)");
+    const multi = await attempts('SELECT 1; DROP TABLE guard');
+    ok('多语句被拒绝（默认单语句）', /too many statements/i.test(multi || ''), multi);
+    ok('被拒后目标表仍在', (await q('SELECT * FROM guard')).rows.length === 1);
+    const drop = await attempts('DROP TABLE guard');
+    ok('单条 DROP 被拦截', /blocked by security policy: dropTable/i.test(drop || ''), drop);
+    const del = await attempts('DELETE FROM guard');
+    ok('单条 DELETE 被拦截', /blocked by security policy: delete/i.test(del || ''), del);
+    const upd = await attempts('UPDATE guard SET v = 2');
+    ok('单条 UPDATE 被拦截', /blocked by security policy: update/i.test(upd || ''), upd);
+    const trunc = await attempts('TRUNCATE TABLE guard');
+    ok('单条 TRUNCATE 被拦截', /blocked by security policy: truncate/i.test(trunc || ''), trunc);
+    ok('WITH ... DELETE 同样被拦截',
+      /blocked by security policy: delete/i.test(await attempts('WITH x AS (SELECT 1) DELETE FROM guard') || ''));
+    const allowed = await attempts('DELETE FROM guard', { allowWrites: true });
+    ok('allowWrites: true 放行写操作', allowed === null, allowed);
+    const multiAllowed = await attempts('SELECT 1; SELECT 2', { allowMultiStatement: true, allowWrites: true });
+    ok('allowMultiStatement 可显式放开多语句（非破坏性）', multiAllowed === null, multiAllowed);
+    ok('safety:false 仍可执行破坏性语句', (await attempts('DROP TABLE guard', { safety: false })) === null);
+  }
+
   // ── H2. NeDB $regex ─────────────────────────────────────────
   console.log('\n--- H2. NeDB $regex ---');
   {
@@ -244,6 +272,32 @@ function makeDb() { return new Database(':memory:'); }
   ok('RLIKE BINARY 同样生效', eq((await q("SELECT id FROM r6 WHERE s RLIKE BINARY 'abc'")).rows, [[1]]));
   ok('非法正则安全返回不匹配', eq((await q("SELECT id FROM r6 WHERE s REGEXP BINARY '('")).rows, []));
 
+  // ── B1–B6. 标量函数语义（v6.5.17） ─────────────────────────
+  console.log('\n--- B1–B6. 标量函数 ---');
+  ok('B1 LENGTH 按字节（héllo=6）', (await one("SELECT LENGTH('héllo')")) === 6, await one("SELECT LENGTH('héllo')"));
+  ok('B1 CHAR_LENGTH 按字符（héllo=5）', (await one("SELECT CHAR_LENGTH('héllo')")) === 5);
+  ok('B1 emoji 字节数（🚀🌟=8）', (await one("SELECT LENGTH('🚀🌟')")) === 8);
+  ok('B2 OCTET_LENGTH 已实现（héllo=6）', (await one("SELECT OCTET_LENGTH('héllo')")) === 6);
+  ok('B2 OCTET_LENGTH NULL → NULL', (await one('SELECT OCTET_LENGTH(NULL)')) === null);
+  ok("B3 LEFT('hello',-3) → ''", (await one("SELECT LEFT('hello',-3)")) === '');
+  ok("B3 RIGHT('hello',-3) → ''", (await one("SELECT RIGHT('hello',-3)")) === '');
+  ok("B3 LEFT('hello',0) → ''", (await one("SELECT LEFT('hello',0)")) === '');
+  ok("B3 LEFT('hello',3) → 'hel'", (await one("SELECT LEFT('hello',3)")) === 'hel');
+  ok("B3 RIGHT('hello',3) → 'llo'", (await one("SELECT RIGHT('hello',3)")) === 'llo');
+  ok("B4 LPAD('hi',5,'xy') → 'xyxhi'", (await one("SELECT LPAD('hi',5,'xy')")) === 'xyxhi',
+    await one("SELECT LPAD('hi',5,'xy')"));
+  ok("B4 RPAD('hi',5,'xy') → 'hixyx'", (await one("SELECT RPAD('hi',5,'xy')")) === 'hixyx',
+    await one("SELECT RPAD('hi',5,'xy')"));
+  ok("B4 LPAD 目标更短时截断", (await one("SELECT LPAD('hello',3,'xy')")) === 'hel');
+  ok('B4 LPAD 填充串为 NULL → NULL', (await one("SELECT LPAD('hi',5,NULL)")) === null);
+  ok('B5 POWER(2,NULL) → NULL', (await one('SELECT POWER(2,NULL)')) === null);
+  ok('B5 POW(NULL,2) → NULL', (await one('SELECT POW(NULL,2)')) === null);
+  ok('B5 POWER 正常仍为 8', (await one('SELECT POWER(2,3)')) === 8);
+  ok('B6 CAST(-5 AS UNSIGNED) 64 位回绕', String(await one('SELECT CAST(-5 AS UNSIGNED)')) === '18446744073709551611',
+    String(await one('SELECT CAST(-5 AS UNSIGNED)')));
+  ok('B6 CAST(5 AS UNSIGNED) 保持原值', String(await one('SELECT CAST(5 AS UNSIGNED)')) === '5');
+  ok('B6 CAST(-5 AS SIGNED) 不回绕', (await one('SELECT CAST(-5 AS SIGNED)')) === -5);
+
   // ── M9. 插件钩子优先级 ─────────────────────────────────────
   console.log('\n--- M9. 钩子优先级 ---');
   {