jsql-neo 6.5.20 → 6.5.23

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.5.20** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.5.23** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/bin/jsql

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 const path = require('path');
 const fs = require('fs');
-const yaggs = require('@vexify-org/yaggs');
+// @vexify-org/yaggs 是可选依赖：缺失时（离线安装/私有源不可达/lockfile 漂移）
+// 用内置 shim 兜底，保证 --help/--version 及核心命令仍能启动（#24）。
+let yaggs;
+try { yaggs = require('@vexify-org/yaggs'); }
+catch (e) { yaggs = null; }
 const { ModuleManager } = require('../lib/mod');
 const Database = require('../lib/database');
 const migrate = require('../lib/migrate');
@@ -29,7 +33,10 @@ const manager = new ModuleManager();
 
 const RAW_ARGV = process.argv.slice(2);
 
-const cli = yaggs({ pkg: require('../package.json') })
+const _pkg = require('../package.json');
+const cli = (yaggs || require('./yaggs-fallback').buildYaggsFallback(_pkg))({
+  pkg: _pkg,
+})
   .usage('jsql <command> [options]')
   .option('help', { alias: ['h'], type: 'boolean', description: 'Show help' })
   .command('mod', 'Module management', (sub) => {

package/bin/yaggs-fallback.js

@@ -0,0 +1,108 @@
+'use strict';
+
+/**
+ * Minimal @vexify-org/yaggs-compatible CLI shim.
+ *
+ * Used when the optional dependency @vexify-org/yaggs is not installed
+ * (offline install, private registry unreachable, lockfile drift, …).
+ * Without this shim, bin/jsql crashed on every invocation — even --help /
+ * --version — because the top-level `require('@vexify-org/yaggs')` threw.
+ *
+ * The shim mirrors the fluent API surface bin/jsql relies on:
+ *   .usage(str).option(name, cfg).command(name, desc, builder, handler)
+ *   .middleware(fn).run(argv)
+ *
+ * It captures every command handler registered via the fluent chain and
+ * dispatches to it with a minimal `--key value` / `--flag` argument parse.
+ * This keeps --help/--version and the core commands (serve, export, import,
+ * mod, plugin, …) working even when the optional dependency is absent.
+ */
+
+function buildYaggsFallback(pkg) {
+  // 与 @vexify-org/yaggs 的调用形态一致：buildYaggsFallback(pkg)({ pkg }) 返回 CLI 对象。
+  return function makeCli(opts) {
+    const realPkg = (opts && opts.pkg) || pkg;
+    const commands = new Map();
+    let usageStr = '';
+    const self = {
+    usage(u) { usageStr = u; return self; },
+    option() { return self; },
+    positional() { return self; },
+    middleware() { return self; },
+    command(name, description, builder, handler) {
+      // 兼容两种签名：command(name, descObj) 或 command(name, desc, builder, handler)
+      let h = handler;
+      let desc = description;
+      if (description && typeof description === 'object') {
+        desc = description.description;
+        if (description.handler) h = description.handler;
+      }
+      commands.set(name, { desc: desc || '', handler: h, builder: builder || (() => {}) });
+      return self;
+    },
+    async run(argv) {
+      const args = (argv || []).slice();
+      const first = args[0];
+
+      if (!first || first === '--help' || first === '-h' || first === 'help') {
+        console.log(usageStr || `jsql ${realPkg.version} — embedded SQL CLI`);
+        console.log('Usage: jsql <command> [options]');
+        if (commands.size) {
+          console.log('');
+          console.log('Commands:');
+          for (const [name, c] of commands) {
+            console.log(`  ${name.padEnd(12)} ${c.desc}`);
+          }
+        }
+        console.log('');
+        console.log('Note: optional dependency @vexify-org/yaggs is not installed; full argument parsing is unavailable.');
+        console.log('      Install it with `npm install @vexify-org/yaggs` to restore rich argument parsing.');
+        return;
+      }
+
+      if (first === '--version' || first === '-v' || first === 'version') {
+        console.log(realPkg.version);
+        return;
+      }
+
+      const cmd = commands.get(first);
+      if (!cmd) {
+        console.error(`Unknown command: ${first}`);
+        console.error('Run `jsql --help` for the list of commands.');
+        process.exitCode = 1;
+        return;
+      }
+
+      // 极简参数解析：--key value / --key=value / --flag，以及位置参数。
+      const parsed = { _: [] };
+      for (let i = 1; i < args.length; i++) {
+        const a = args[i];
+        if (a.startsWith('--')) {
+          const eq = a.indexOf('=');
+          if (eq !== -1) {
+            parsed[a.slice(2, eq)] = a.slice(eq + 1);
+          } else {
+            const nxt = args[i + 1];
+            if (nxt !== undefined && !nxt.startsWith('-')) { parsed[a.slice(2)] = nxt; i++; }
+            else parsed[a.slice(2)] = true;
+          }
+        } else if (a.startsWith('-') && a.length > 1) {
+          const key = a.slice(1);
+          const nxt = args[i + 1];
+          if (nxt !== undefined && !nxt.startsWith('-')) { parsed[key] = nxt; i++; }
+          else parsed[key] = true;
+        } else {
+          parsed._.push(a);
+        }
+      }
+
+      if (cmd.handler) return cmd.handler(parsed);
+      console.error(`Command '${first}' has no handler.`);
+      process.exitCode = 1;
+    },
+    };
+    return self;
+  };
+}
+
+module.exports = { buildYaggsFallback };

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.5.20 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.5.23 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/bigint_json.js

@@ -0,0 +1,39 @@
+// © Vexify 2026 All Rights Reserved.
+/**
+ * BigInt 安全的 JSON 序列化（Issue #38）。
+ *
+ * 行数据里可能出现 >2^53 的 BigInt（integer/int/bigint 列）。原生
+ * JSON.stringify 遇到 BigInt 直接抛 "Do not know how to serialize a BigInt"，
+ * 于是 WAL、事务快照、统计等路径会整条失败。
+ *
+ * 这里用一个单键标记对象 `{ __jsql_bigint__: "9223372036854775807" }`
+ * 在 JSON 中无损往返；反序列化时还原成 BigInt。只有「对象恰好只有这一个键」
+ * 时才还原，尽量避免误伤用户自己的同名字段。
+ */
+
+const MARKER = '__jsql_bigint__';
+
+function replacer(_key, value) {
+    if (typeof value === 'bigint') return { [MARKER]: value.toString() };
+    return value;
+}
+
+function reviver(_key, value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        const keys = Object.keys(value);
+        if (keys.length === 1 && keys[0] === MARKER && typeof value[MARKER] === 'string') {
+            try { return BigInt(value[MARKER]); } catch (_) { return value; }
+        }
+    }
+    return value;
+}
+
+function stringify(value, space) {
+    return JSON.stringify(value, replacer, space);
+}
+
+function parse(text) {
+    return JSON.parse(text, reviver);
+}
+
+module.exports = { stringify, parse, MARKER };

package/lib/database.js

@@ -10,6 +10,7 @@ const os = require('os');
 const crypto = require('crypto');
 const Table = require('./table');
 const { createError, JSQL_Error, ErrorCodes } = require('./errors');
+const bigintJson = require('./bigint_json');
 
 /**
  * 构造带补充说明的错误。
@@ -463,7 +464,7 @@ class Database {
             // 只追加尚未落盘的记录
             const pending = this._walOps.slice(this._walFlushedCount);
             if (pending.length === 0) return;
-            const lines = pending.map(o => JSON.stringify(o)).join('\n') + '\n';
+            const lines = pending.map(o => bigintJson.stringify(o)).join('\n') + '\n';
             const fd = fs.openSync(this._walPath, 'a');
             try {
                 fs.writeSync(fd, lines, null, 'utf8');
@@ -528,7 +529,7 @@ class Database {
         const trimmed = raw.trim();
         if (trimmed.startsWith('[')) {
             try {
-                const parsed = JSON.parse(trimmed);
+                const parsed = bigintJson.parse(trimmed);
                 if (Array.isArray(parsed)) {
                     ops = parsed.filter(o => o && typeof o.op === 'string');
                 }
@@ -541,7 +542,7 @@ class Database {
                 const t = line.trim();
                 if (!t) continue;
                 try {
-                    const o = JSON.parse(t);
+                    const o = bigintJson.parse(t);
                     if (o && typeof o.op === 'string') ops.push(o);
                 } catch (e) {
                     // 崩溃时写半的尾行，丢弃
@@ -1129,7 +1130,7 @@ class Database {
             const rowCount = table._rows.length;
             const indexCount = Object.keys(table._indexes).length;
             const btreeCount = Object.keys(table._btrees).length;
-            const sizeEstimate = JSON.stringify(table._rows).length;
+            const sizeEstimate = bigintJson.stringify(table._rows).length;
             tableStats[name] = {
                 rowCount,
                 indexCount: indexCount + btreeCount,
@@ -1263,7 +1264,7 @@ class Database {
         const snap = {};
         for (const [name, table] of Object.entries(this._tables)) {
             snap[name] = {
-                rows: JSON.parse(JSON.stringify(table.toJSON())),
+                rows: bigintJson.parse(bigintJson.stringify(table.toJSON())),
                 schema: table._schema,
                 // 自增计数器也要存：否则回滚掉刚插入的行之后，
                 // 下一次插入会跳过已用过的号（用户看到 id 从 2 开始会困惑）。
@@ -1290,7 +1291,7 @@ class Database {
             if (!snap[name]) delete this._tables[name];
         }
         for (const [name, entry] of Object.entries(snap)) {
-            const rows = JSON.parse(JSON.stringify(entry.rows));
+            const rows = bigintJson.parse(bigintJson.stringify(entry.rows));
             let table = this._tables[name];
             if (!table) {
                 table = new Table(name, entry.schema, this);
@@ -1507,7 +1508,7 @@ class Database {
 
         if (table._rows.length === 0) return;
 
-        const currentHash = JSON.stringify(table._rows);
+        const currentHash = bigintJson.stringify(table._rows);
         const versions = this._versions[tableName];
         if (versions.length > 0 && versions[versions.length - 1]._hash === currentHash) return;
 
@@ -1948,7 +1949,23 @@ class Database {
             const clash = table._rows.find(r => r !== row && r[field] === nv);
             if (clash) throw createError('ER_DUP_ENTRY', `Duplicate entry '${nv}' for key '${field}'`);
         }
-        Object.assign(row, validated);
+        // 外键：改主键时按 ON UPDATE 传播到引用它的子表；改自身外键列时校验引用存在。
+        // 此前这里直接 Object.assign 绕过 Table.updateById，ON UPDATE CASCADE / RESTRICT
+        // 与 FK 校验全部失效（外键形同虚设）。
+        if (pk && Object.prototype.hasOwnProperty.call(validated, pk) && validated[pk] !== row[pk]) {
+            table._propagatePKUpdate(row[pk], validated[pk]);
+        }
+        if (table._foreignKeys && table._foreignKeys.length) {
+            table._validateForeignKeys({ ...row, ...validated });
+        }
+        // 改主键/唯一值时索引必须同步：否则 _pkIndex 还指向旧值，
+        // 后续 FK 校验 findOne({id:新值}) 查不到刚更新的父行。
+        {
+            const rowIndex = table._rows.indexOf(row);
+            if (rowIndex !== -1) table._removeFromIndexes(rowIndex, row);
+            Object.assign(row, validated);
+            if (rowIndex !== -1) table._addToIndexes(rowIndex, row);
+        }
         if (pk) this._walWrite({ op: 'update', table: tableName, pk, id, row: { ...validated } });
         this._emit('update', { table: tableName, id, data: validated });
         await this._runHooks('afterUpdate', [tableName, id, validated, { ok: true }]);
@@ -2218,8 +2235,8 @@ class Database {
     backup(filePath) {
         const data = this.export();
         const json = this._options.pretty
-            ? JSON.stringify(data, null, 2)
-            : JSON.stringify(data);
+            ? bigintJson.stringify(data, 2)
+            : bigintJson.stringify(data);
         this._writeFile(filePath, json);
         return filePath;
     }
@@ -2229,7 +2246,7 @@ class Database {
             throw createError('ER_FILE_NOT_FOUND', filePath);
         }
         const json = this._readFile(filePath);
-        const data = JSON.parse(json);
+        const data = bigintJson.parse(json);
         for (const [name, rows] of Object.entries(data)) {
             if (this._tables[name]) {
                 this._tables[name]._loadRows(rows);
@@ -2280,8 +2297,8 @@ class Database {
         }
 
         const json = this._options.pretty
-            ? JSON.stringify(data, null, 2)
-            : JSON.stringify(data);
+            ? bigintJson.stringify(data, 2)
+            : bigintJson.stringify(data);
         this._writeFile(this._filePath, json);
         this._dirty = false;
 
@@ -2312,7 +2329,7 @@ class Database {
             }
 
             const json = this._readFile(this._filePath);
-            const data = JSON.parse(json);
+            const data = bigintJson.parse(json);
 
             if (data.__schema__) {
                 for (const [name, schema] of Object.entries(data.__schema__)) {

package/lib/jsql_format.js

@@ -25,6 +25,7 @@ function tag(v) {
     }
     return TYPE.F64;
   }
+  if (typeof v==='bigint') return TYPE.I64;
   if (typeof v==='string') return TYPE.STR;
   if (v instanceof Buffer) return TYPE.BUF;
   return Array.isArray(v)?TYPE.ARR:TYPE.OBJ;
@@ -51,7 +52,12 @@ function dec(buf, off) {
     case TYPE.NUL: return {v:null,off};
     case TYPE.BOL: return {v:buf[off]!==0,off:off+1};
     case TYPE.I32: return {v:buf.readInt32LE(off),off:off+4};
-    case TYPE.I64: return {v:Number(buf.readBigInt64LE(off)),off:off+8};
+    case TYPE.I64: {
+      // 安全范围内的值仍还原成 number（兼容旧数据/行为）；超出范围返回 BigInt，避免精度丢失（Issue #38）
+      const b = buf.readBigInt64LE(off);
+      const safe = b >= BigInt(Number.MIN_SAFE_INTEGER) && b <= BigInt(Number.MAX_SAFE_INTEGER);
+      return {v: safe ? Number(b) : b, off:off+8};
+    }
     case TYPE.F64: return {v:buf.readDoubleLE(off),off:off+8};
     case TYPE.STR: { const l=buf.readUInt32LE(off);off+=4; return {v:buf.toString('utf8',off,off+l),off:off+l}; }
     case TYPE.BUF: { const l=buf.readUInt32LE(off);off+=4; return {v:Buffer.from(buf.subarray(off,off+l)),off:off+l}; }
@@ -78,6 +84,10 @@ function writeEnc(buf, off, v) {
     }
     buf[off] = 3; buf.writeDoubleLE(v, off+1); return off + 9;
   }
+  if (typeof v === 'bigint') {
+    // Issue #38：64 位整数精确保存，读回时再决定还原成 number 还是 BigInt
+    buf[off] = 8; buf.writeBigInt64LE(v, off+1); return off + 9;
+  }
   if (typeof v === 'string') {
     buf[off] = 4;
     const encoded = Buffer.from(v, 'utf8');

package/lib/mysql_server.js

@@ -281,7 +281,8 @@ function columnDefinition(column) {
 
 function columnTypeFromSchema(def) {
   const type = def && def.type ? String(def.type).toLowerCase() : 'string';
-  if (type === 'integer' || type === 'int' || type === 'bigint') return MYSQL_TYPE_LONG;
+  if (type === 'integer' || type === 'int') return MYSQL_TYPE_LONG;
+  if (type === 'bigint') return MYSQL_TYPE_LONGLONG;
   if (type === 'number' || type === 'float' || type === 'double' || type === 'real') return MYSQL_TYPE_DOUBLE;
   if (type === 'boolean' || type === 'bool') return MYSQL_TYPE_TINY;
   if (type === 'date') return MYSQL_TYPE_DATE;
@@ -394,15 +395,26 @@ function binaryResultSetPacket(result, tableSchema, baseSeq) {
     if (v === null || v === undefined) return null;
     if (type === MYSQL_TYPE_LONG || type === MYSQL_TYPE_LONGLONG || type === MYSQL_TYPE_DOUBLE) {
       const num = Number(v);
+      if (!Number.isFinite(num)) return encodeLenencString(String(v));
       if (type === MYSQL_TYPE_DOUBLE) {
-        if (!Number.isFinite(num)) return encodeLenencString(String(v));
         const b = Buffer.alloc(8); b.writeDoubleLE(num, 0); return b;
       }
-      if (Number.isInteger(num) && num <= 2147483647 && num >= -2147483648) {
-        const b = Buffer.alloc(4); b.writeInt32LE(num, 0); return b;
-      }
       if (!Number.isFinite(num)) return encodeLenencString(String(v));
-      const b = Buffer.alloc(8); b.writeBigInt64LE(BigInt(Math.trunc(num)), 0); return b;
+      if (type === MYSQL_TYPE_LONG) {
+        // 4 字节 LONG：总是写 4 字节（#32）。超出 int32 范围时钳位，
+        // 不能写 8 字节，否则二进制结果集的行布局被破坏（下一列错位）。
+        let n = Math.trunc(num);
+        if (n > 2147483647) n = 2147483647;
+        if (n < -2147483648) n = -2147483648;
+        const b = Buffer.alloc(4); b.writeInt32LE(n, 0); return b;
+      }
+      // MYSQL_TYPE_LONGLONG：始终写 8 字节，超出 int64 范围时钳位（保持行布局）。
+      let bi = BigInt(Math.trunc(num));
+      const INT64_MAX = 9223372036854775807n;
+      const INT64_MIN = -9223372036854775808n;
+      if (bi > INT64_MAX) bi = INT64_MAX;
+      if (bi < INT64_MIN) bi = INT64_MIN;
+      const b = Buffer.alloc(8); b.writeBigInt64LE(bi, 0); return b;
     }
     if (type === MYSQL_TYPE_TINY) {
       const b = Buffer.alloc(1); b.writeInt8(v ? 1 : 0, 0); return b;
@@ -1102,8 +1114,10 @@ class MysqlServer {
         if (t && t.indexOf('.') !== -1) {
           const re = new RegExp('\\b' + t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\b', 'g');
           s = s.replace(re, (match, offset) => {
-            // 如果匹配位置在字符串字面量或注释中，不替换
-            if (masked[offset] !== ' ') return match;
+            // 如果匹配位置在字符串字面量或注释中，不替换。
+            // _maskStringsAndComments 把字符串/注释内的字符置为空格，
+            // 因此 masked[offset] === ' ' 表示该位置在字面量/注释里（#31）。
+            if (masked[offset] === ' ') return match;
             return t.split('.')[1];
           });
         }

package/lib/native_client.js

@@ -57,6 +57,19 @@ function _trackInstance(inst) {
 }
 
 const INT64_TAG = 1;
+
+/**
+ * 把可能是字符串/数字的 limit / offset / id 规范成非负整数，供原生 usize/u64 使用。
+ * 负值（或 NaN/Infinity）会在绑定层直接抛错，而不是让 Rust 侧 debug panic 或
+ * release 静默空结果（#35）。返回 Math.trunc(n)（对非负浮点向下取整，与 usize 语义一致）。
+ */
+function toNonNeg(name, v, def) {
+  if (v === undefined || v === null) return def;
+  const n = Number(v);
+  if (!Number.isFinite(n)) throw new Error(`jsql-neo: ${name} must be a finite number, got ${v}`);
+  if (n < 0) throw new Error(`jsql-neo: ${name} must be non-negative, got ${v}`);
+  return Math.trunc(n);
+}
 const FLOAT_TAG = 2;
 const STR_TAG = 3;
 const BOOL_TAG = 4;
@@ -539,7 +552,7 @@ class JSQL {
     if (!schema || !pk) return id;
     const def = schema[pk];
     let t = null;
-    if (typeof def === 'string') t = def.toLowerCase();
+    if (typeof def === 'string') t = def.trim().split(/\s+/)[0].toLowerCase();
     else if (def && typeof def === 'object' && def.type) t = String(def.type).toLowerCase();
     if (['integer', 'int', 'bigint'].includes(t)) return Number(id);
     return id;
@@ -552,8 +565,11 @@ class JSQL {
   _isAutoIntPk(table) {
     if (!this._pkAutoIncrement(table)) return false;
     const def = this._schemas[table][this._pkOf(table)];
-    const t = typeof def === 'string' ? def.toLowerCase()
-      : (def && def.type ? String(def.type).toLowerCase() : '');
+    // 简写字符串 schema（如 'integer primary key auto_increment'）取首个 token 作为类型；
+    // 对象 schema 直接读 def.type。二者都必须精确匹配整数类型，否则负 id 校验不生效（issue #35）。
+    let t = '';
+    if (typeof def === 'string') t = def.trim().split(/\s+/)[0].toLowerCase();
+    else if (def && def.type) t = String(def.type).toLowerCase();
     return ['integer', 'int', 'bigint'].includes(t);
   }
 
@@ -561,8 +577,11 @@ class JSQL {
     const pk = this._pkOf(table);
     if (pk) {
       if (this._isAutoIntPk(table)) {
-        const n = Number(id);
+        const n = toNonNeg('id', id, NaN);
         if (Number.isFinite(n)) {
+          // 负 id 会被原生层 `i64 -> u64` 静默回绕成 usize::MAX，导致
+          // findById 误报 not found（行明明存在却取不到）。在此显式拒绝。
+          if (n < 0) throw new Error('id must be a non-negative number');
           const r = safeParse(this._n('jsqlFindById', table, n));
           if (r && r.error) return r;
           return r || null;
@@ -574,15 +593,18 @@ class JSQL {
       if (r && r.error) return r;
       return Array.isArray(r) && r.length > 0 ? r[0] : null;
     }
-    return safeParse(this._n('jsqlFindById', table, Number(id)));
+    return safeParse(this._n('jsqlFindById', table, toNonNeg('id', id, NaN)));
   }
 
   _seqIdByPk(table, id) {
     const pk = this._pkOf(table);
     if (pk) {
       if (this._isAutoIntPk(table)) {
-        const n = Number(id);
+        const n = toNonNeg('id', id, NaN);
         if (Number.isFinite(n)) {
+          // 负 id 在原生层回绕为 usize::MAX 后静默 not found，update/remove
+          // 会无提示地什么都不做 —— 这里显式拒绝（见 issue #35）。
+          if (n < 0) throw new Error('id must be a non-negative number');
           const r = safeParse(this._n('jsqlFindById', table, n));
           if (r && !r.error && r.id !== undefined) return r.id;
         }
@@ -824,7 +846,10 @@ class JSQL {
     let r;
     if (this._isAutoIntPk(table) && ids.every(id => Number.isFinite(Number(id)))) {
       // 自增主键：内部 id 即主键值，一次批量调用即可，避免 N 次往返。
-      r = safeParse(this._n('jsqlFindByIds', table, JSON.stringify(ids.map(Number))));
+      // #35：负 id 在原生层 `i64 -> u64` 回绕成 usize::MAX，静默 not found；
+      // NaN/Infinity 同样不允许。绑定层先校验，绝不把非法值传给原生模块。
+      const nums = ids.map(id => toNonNeg('id', id, 0));
+      r = safeParse(this._n('jsqlFindByIds', table, JSON.stringify(nums)));
     } else if (this._pkOf(table)) {
       r = ids.map(id => this._findRawById(table, id)).filter(x => x !== null && !(x && x.error));
     } else {
@@ -846,7 +871,12 @@ class JSQL {
     if (!(await this._runHooks('beforeFind', [table, { filter, opts }]))) return [];
     const filterStr = filter ? JSON.stringify(filter) : '';
     const { limit = 100, offset = 0 } = opts;
-    const r = safeParse(this._n('jsqlFind', table, filterStr, limit, offset));
+    // #35：原生层把 limit/offset 按 `as usize` 无符号转换，负数会静默回绕
+    // （release 下空结果 / debug 下 usize::MAX+1 溢出 panic）。绑定层先校验，
+    // 与 WASM 端的 usize 签名保持一致，绝不把负值传给原生模块。
+    const lim = toNonNeg('limit', limit, 100);
+    const off = toNonNeg('offset', offset, 0);
+    const r = safeParse(this._n('jsqlFind', table, filterStr, lim, off));
     if (r && r.error) throw new Error(r.error);
     await this._runHooks('afterFind', [table, { filter, opts }, r]);
     const schema = this._schemas[table];

package/lib/pg_server.js

@@ -711,7 +711,11 @@ class PgConnection {
       const tag = `SELECT ${(res.rows || []).length}`;
       this._send(buildCommandComplete(tag));
     } else if (res.type === 'insert' || res.type === 'update' || res.type === 'delete') {
-      const tag = `${String(res.type).toUpperCase()} ${res.affectedRows != null ? res.affectedRows : 0}`;
+      // PG CommandComplete tag：INSERT 是 "INSERT <oid> <count>"，UPDATE/DELETE 是
+      // "UPDATE <count>" / "DELETE <count>"（#33）。缺了 OID 段会让客户端把 count
+      // 解析到 OID 槽位、rowCount 变 NaN。
+      const count = res.affectedRows != null ? res.affectedRows : 0;
+      const tag = res.type === 'insert' ? `INSERT 0 ${count}` : `${String(res.type).toUpperCase()} ${count}`;
       this._send(buildCommandComplete(tag));
     } else if (res.type === 'begin' || res.type === 'commit' || res.type === 'rollback') {
       this._inTransaction = res.type === 'begin';

package/lib/query.js

@@ -227,9 +227,11 @@ class Query {
         const startTime = Date.now();
         if (this._explain) return this._getExplain();
 
-        // 缓存命中
+        // 缓存命中: 返回每行的浅拷贝，与未命中路径一致，避免调用方修改污染缓存
         if (this._cache && this._cache.result && (Date.now() - this._cache.timestamp < this._cache.ttl)) {
-            return this._cache.result;
+            // #37：命中返回副本，而不是内部数组引用——调用方对返回值做变更
+            // （push/splice/改字段）会污染缓存；未命中路径返回的是新数组，行为应一致。
+            return this._cache.result.map(row => (row && typeof row === 'object' ? { ...row } : row));
         }
 
         // P1-4: 软删除模式下 QueryBuilder 也不得泄露已删除行
@@ -327,9 +329,10 @@ class Query {
             rows = copy;
         }
 
-        // 缓存存储
+        // 缓存存储：#37 存副本，未命中路径返回的 rows 直接给调用方随意变更，
+        // 不能把同一个数组塞进缓存（否则调用方 push/改字段会污染后续命中）。
         if (this._cache) {
-            this._cache.result = rows;
+            this._cache.result = rows.map(row => (row && typeof row === 'object' ? { ...row } : row));
             this._cache.timestamp = Date.now();
         }