admindb 1.0.3 → 1.2.0

package/dist/public/js/databases.js

@@ -1,4 +1,5 @@
-/* Databases landing page: create and delete SQLite database files. */
+/* Databases landing page: create/delete database files, and a filesystem
+ * browser for opening existing SQLite files. */
 (function () {
   'use strict';
   const nameInput = document.getElementById('new-db-name');
@@ -8,6 +9,18 @@
     return (window.UI && UI.escapeHtml) ? UI.escapeHtml(s) : String(s == null ? '' : s);
   }
 
+  function fmtSize(n) {
+    if (!Number.isFinite(n) || n <= 0) return '0 B';
+    const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+    let v = n;
+    let u = 0;
+    while (v >= 1024 && u < units.length - 1) {
+      v /= 1024;
+      u += 1;
+    }
+    return (u === 0 ? Math.round(v) : v.toFixed(1)) + ' ' + units[u];
+  }
+
   async function createDb() {
     const name = (nameInput.value || '').trim();
     if (!name) return UI.showError('Enter a database name.');
@@ -42,4 +55,89 @@
         .catch((e) => UI.showError(e.message));
     });
   });
+
+  // ---- Filesystem browser --------------------------------------------------
+
+  const fsPathInput = document.getElementById('fs-path');
+  const fsGoBtn = document.getElementById('fs-go');
+  const fsUpBtn = document.getElementById('fs-up');
+  const fsCurrent = document.getElementById('fs-current');
+  const fsListing = document.getElementById('fs-listing');
+
+  const FOLDER_ICON =
+    '<svg xmlns="http://www.w3.org/2000/svg" class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2"><path stroke-linecap="round" stroke-linejoin="round" d="M3 7a2 2 0 012-2h4l2 2h8a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2V7z" /></svg>';
+  const DB_ICON =
+    '<svg xmlns="http://www.w3.org/2000/svg" class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2"><path stroke-linecap="round" stroke-linejoin="round" d="M4 7v10c0 1.1.9 2 2 2h12a2 2 0 002-2V7M4 7c0-1.1.9-2 2-2h12a2 2 0 012 2M4 7c0 1.1.9 2 2 2h12a2 2 0 002-2" /></svg>';
+
+  let fsState = { path: '', parent: null };
+
+  function renderFs(data) {
+    fsState = { path: data.path, parent: data.parent };
+    if (fsCurrent) fsCurrent.textContent = data.path;
+    if (fsPathInput) fsPathInput.value = data.path;
+    if (fsUpBtn) fsUpBtn.disabled = !data.parent;
+    if (!fsListing) return;
+    fsListing.innerHTML = '';
+    if (!data.entries.length) {
+      fsListing.innerHTML = '<div class="px-4 py-6 text-center text-sm text-base-content/40">No folders or database files here.</div>';
+      return;
+    }
+    data.entries.forEach((e) => {
+      const row = document.createElement('button');
+      row.type = 'button';
+      row.className = 'flex w-full items-center gap-2.5 px-3 py-2 text-left text-sm transition hover:bg-primary/[0.06]';
+      row.title = e.path;
+      if (e.isDir) {
+        row.innerHTML =
+          '<span class="grid h-6 w-6 shrink-0 place-items-center rounded-md bg-base-200 text-base-content/50">' + FOLDER_ICON + '</span>' +
+          '<span class="min-w-0 flex-1 truncate font-medium text-base-content/80">' + escapeHtml(e.name) + '</span>' +
+          '<span class="text-xs text-base-content/35">folder</span>';
+        row.addEventListener('click', () => loadFs(e.path));
+      } else {
+        row.innerHTML =
+          '<span class="grid h-6 w-6 shrink-0 place-items-center rounded-md bg-primary/10 text-primary">' + DB_ICON + '</span>' +
+          '<span class="min-w-0 flex-1 truncate font-mono text-[13px] text-base-content/85">' + escapeHtml(e.name) + '</span>' +
+          '<span class="text-xs text-base-content/40">' + fmtSize(e.size) + '</span>';
+        row.addEventListener('click', () => openDb(e.path));
+      }
+      fsListing.appendChild(row);
+    });
+  }
+
+  async function loadFs(p) {
+    try {
+      const data = await Api.get('/api/fs/list' + (p ? '?path=' + encodeURIComponent(p) : ''));
+      renderFs(data);
+    } catch (e) {
+      UI.showError(e.message);
+    }
+  }
+
+  function goUp() {
+    if (fsState.parent) loadFs(fsState.parent);
+  }
+
+  async function openDb(p) {
+    try {
+      const data = await Api.post('/api/databases/open', { path: p });
+      UI.showToast(data.message || 'Database opened.', 'success');
+      window.location.href = Api.basePath + '/' + encodeURIComponent(data.id);
+    } catch (e) {
+      UI.showError(e.message);
+    }
+  }
+
+  if (fsListing) {
+    loadFs('');
+    if (fsGoBtn) {
+      fsGoBtn.addEventListener('click', () => loadFs((fsPathInput.value || '').trim() || ''));
+    }
+    if (fsPathInput) {
+      fsPathInput.addEventListener('keydown', (e) => {
+        if (e.key === 'Enter') loadFs((fsPathInput.value || '').trim() || '');
+      });
+    }
+    if (fsUpBtn) fsUpBtn.addEventListener('click', goUp);
+  }
 })();
+

package/dist/routes/api.js

@@ -43,6 +43,23 @@ function buildFields(info, values, opts = {}) {
     }
     return fields;
 }
+/**
+ * Build the SET fields for an UPDATE from form values plus an explicit list of
+ * columns to null out (the "clear to NULL" affordance of inline editing).
+ */
+function buildUpdateFields(info, values, nulls) {
+    const fields = buildFields(info, values, { excludePk: true });
+    const typeMap = new Map(info.columns.map((c) => [c.name, c.type]));
+    const pkSet = new Set(info.primaryKey);
+    for (const col of nulls) {
+        if (pkSet.has(col) || !typeMap.has(col))
+            continue;
+        if (fields.some((f) => f.column === col))
+            continue;
+        fields.push({ column: col, value: null });
+    }
+    return fields;
+}
 function pkWhere(info, encodedId) {
     if (!info.primaryKey.length)
         return null;
@@ -52,6 +69,63 @@ function pkWhere(info, encodedId) {
     const typeMap = new Map(info.columns.map((c) => [c.name, c.type]));
     return info.primaryKey.map((col, i) => ({ column: col, value: (0, util_1.coerceFormValue)(vals[i], typeMap.get(col)) }));
 }
+/** Hard cap on how many rows can be selected for a bulk operation at once. */
+const MAX_BULK_ROWS = 1000;
+/**
+ * Turn a list of encoded primary-key ids (from the grid's row checkboxes) into
+ * the WHERE clauses needed to address each row. Returns null when the table has
+ * no usable primary key or when none of the ids resolve.
+ */
+function resolvePkRows(info, ids) {
+    if (!info.primaryKey.length)
+        return null;
+    const list = Array.isArray(ids) ? ids : ids == null ? [] : [ids];
+    const out = [];
+    for (const id of list) {
+        const where = pkWhere(info, String(id));
+        if (where)
+            out.push(where);
+    }
+    return out.length ? out : null;
+}
+/**
+ * How many rows in OTHER tables reference any of the selected rows (via foreign
+ * keys pointing at the selected table). Used to warn before a bulk delete —
+ * those rows may be cascaded away or orphaned depending on the FK action.
+ */
+async function computeBulkImpact(db, info, wheres) {
+    const rowsR = await db.getRowsByPks(info.table, wheres);
+    const rows = (rowsR.data ?? []);
+    const refsR = await db.getReferencingTables(info.table);
+    const references = [];
+    const toColumn = (to) => to || info.primaryKey[0] || info.columns[0]?.name || null;
+    for (const rt of refsR.data ?? []) {
+        if (rt.table.startsWith('_'))
+            continue;
+        for (const ref of rt.refs) {
+            const col = toColumn(ref.to);
+            if (!col)
+                continue;
+            // Deduplicate the referenced values (preserving their native type).
+            const byStr = new Map();
+            for (const row of rows) {
+                const v = row[col];
+                if (v === null || v === undefined)
+                    continue;
+                byStr.set(String((0, util_1.normalizeCell)(v)), v);
+            }
+            if (!byStr.size)
+                continue;
+            const values = [...byStr.values()];
+            const placeholders = values.map(() => '?').join(', ');
+            const cR = await db.all(`SELECT COUNT(*) AS c FROM ${(0, generator_1.quoteIdentifier)(rt.table)} WHERE ${(0, generator_1.quoteIdentifier)(ref.from)} IN (${placeholders})`, values);
+            const count = Number((cR.data ?? [])[0]?.c ?? 0);
+            if (count > 0)
+                references.push({ table: rt.table, from: ref.from, to: ref.to, count });
+        }
+    }
+    return { references, total: references.reduce((n, r) => n + r.count, 0) };
+}
 function registerApi(router, ctx) {
     const { db, logger } = ctx;
     // In read-only mode every mutating request is rejected (GET, the generate-only
@@ -61,8 +135,13 @@ function registerApi(router, ctx) {
         if (!db.isReadOnly || req.method === 'GET')
             return next();
         const p = req.path;
-        if (p.endsWith('/generate') || p.endsWith('/api/query/export') || p.endsWith('/api/query'))
+        if (p.endsWith('/generate') ||
+            p.endsWith('/api/query/export') ||
+            p.endsWith('/api/query') ||
+            p.endsWith('/rows/bulk-impact') ||
+            p.endsWith('/rows/bulk-export')) {
             return next();
+        }
         return res.status(403).json({ success: false, error: 'Database is open in read-only mode — write operations are disabled.' });
     });
     // ---- Tables ------------------------------------------------------------
@@ -88,13 +167,17 @@ function registerApi(router, ctx) {
                 const refInfo = await requireTable(db, fk.table);
                 if (!refInfo)
                     continue;
+                // The FK may reference a non-PK unique column (e.g. Users.UserName),
+                // so the option value must be the referenced column's value, not the
+                // referenced table's primary key.
+                const refCol = fk.to || refInfo.primaryKey[0] || refInfo.columns[0]?.name;
                 const pk = refInfo.primaryKey[0] ?? refInfo.columns[0]?.name;
                 const labelCols = refInfo.columns.filter((c) => c.name !== pk).slice(0, 2).map((c) => c.name);
                 const rowsR = await db.getAllRows(fk.table);
                 const rows = (rowsR.data ?? []).slice(0, 500);
                 options[fk.from] = rows.map((row) => ({
-                    value: row[pk],
-                    label: labelCols.length ? labelCols.map((c) => String(row[c] ?? '')).join(' · ') : String(row[pk] ?? ''),
+                    value: row[refCol],
+                    label: labelCols.length ? labelCols.map((c) => String(row[c] ?? '')).join(' · ') : String(row[refCol] ?? ''),
                 }));
             }
             catch (err) {
@@ -124,6 +207,52 @@ function registerApi(router, ctx) {
             filters,
         });
     }));
+    // Related rows: rows in other tables whose foreign keys point at this row.
+    router.get('/api/tables/:table/rows/:id/references', wrap(async (req, res) => {
+        const info = await requireTable(db, req.params.table);
+        if (!info)
+            return fail(res, `Table "${req.params.table}" does not exist.`, 404);
+        if (!info.primaryKey.length)
+            return fail(res, `Table "${req.params.table}" has no primary key, so related rows cannot be resolved.`, 400);
+        const pk = (0, util_1.decodePk)(req.params.id);
+        if (pk.length !== info.primaryKey.length)
+            return fail(res, 'Invalid row id.', 400);
+        const typeMap = new Map(info.columns.map((c) => [c.name, c.type]));
+        const where = info.primaryKey.map((col, i) => ({ column: col, value: (0, util_1.coerceFormValue)(pk[i], typeMap.get(col)) }));
+        const rowR = await db.getRow(req.params.table, where);
+        if (!rowR.success || !rowR.data)
+            return fail(res, 'Row not found.', 404);
+        const row = rowR.data;
+        const refsR = await db.getReferencingTables(req.params.table);
+        if (!refsR.success)
+            return fail(res, refsR.error ?? 'Failed to load references.', 500);
+        const references = [];
+        for (const rt of refsR.data ?? []) {
+            if (rt.table.startsWith('_'))
+                continue;
+            const refInfo = await requireTable(db, rt.table);
+            if (!refInfo)
+                continue;
+            for (const ref of rt.refs) {
+                const value = row[ref.to];
+                if (value === null || value === undefined)
+                    continue;
+                const r = await db.getRowsByFk(rt.table, ref.from, value, 50);
+                if (!r.success)
+                    continue;
+                references.push({
+                    table: rt.table,
+                    from: ref.from,
+                    to: ref.to,
+                    value: (0, util_1.normalizeCell)(value),
+                    count: r.data.total,
+                    columns: refInfo.columns.map((c) => c.name),
+                    rows: r.data.rows.map(util_1.normalizeRow),
+                });
+            }
+        }
+        ok(res, { references });
+    }));
     // ---- Export / import ---------------------------------------------------
     router.get('/api/tables/:table/export', wrap(async (req, res) => {
         const info = await requireTable(db, req.params.table);
@@ -247,7 +376,8 @@ function registerApi(router, ctx) {
         if (!where)
             return fail(res, 'Invalid primary key.', 400);
         const values = (req.body?.values ?? {});
-        const fields = buildFields(info, values, { excludePk: true });
+        const nulls = Array.isArray(req.body?.nulls) ? req.body.nulls.map(String) : [];
+        const fields = buildUpdateFields(info, values, nulls);
         if (!fields.length)
             return fail(res, 'No fields to update.');
         const sql = (0, generator_1.generateUpdate)(req.params.table, fields, where);
@@ -264,7 +394,8 @@ function registerApi(router, ctx) {
         if (!where)
             return fail(res, 'Invalid primary key.', 400);
         const values = (req.body?.values ?? {});
-        const fields = buildFields(info, values, { excludePk: true });
+        const nulls = Array.isArray(req.body?.nulls) ? req.body.nulls.map(String) : [];
+        const fields = buildUpdateFields(info, values, nulls);
         if (!fields.length)
             return fail(res, 'No fields to update.');
         ok(res, { sql: (0, generator_1.generateUpdate)(req.params.table, fields, where) });
@@ -281,6 +412,119 @@ function registerApi(router, ctx) {
             return fail(res, r.error ?? 'Delete failed.', 400);
         ok(res, { message: 'Row deleted.' });
     }));
+    // ---- Bulk row operations -----------------------------------------------
+    /**
+     * FK-impact preview: how many rows in other tables reference the selected
+     * rows. Shown to the user before a bulk delete so cascades/orphaning are
+     * understood up front.
+     */
+    router.post('/api/tables/:table/rows/bulk-impact', wrap(async (req, res) => {
+        const info = await requireTable(db, req.params.table);
+        if (!info)
+            return fail(res, `Table "${req.params.table}" does not exist.`, 404);
+        const wheres = resolvePkRows(info, (req.body ?? {}).ids);
+        if (!wheres || !wheres.length)
+            return fail(res, 'No valid rows selected.', 400);
+        if (wheres.length > MAX_BULK_ROWS)
+            return fail(res, `Select at most ${MAX_BULK_ROWS} rows at a time.`, 400);
+        const impact = await computeBulkImpact(db, info, wheres);
+        ok(res, { selected: wheres.length, references: impact.references, total: impact.total });
+    }));
+    /**
+     * Bulk delete the selected rows inside a single transaction. When other
+     * tables reference them, the client must acknowledge the impact
+     * (`confirmImpact: true`) — this is the safety net behind the UI warning.
+     */
+    router.post('/api/tables/:table/rows/bulk-delete', wrap(async (req, res) => {
+        const info = await requireTable(db, req.params.table);
+        if (!info)
+            return fail(res, `Table "${req.params.table}" does not exist.`, 404);
+        const body = (req.body ?? {});
+        const wheres = resolvePkRows(info, body.ids);
+        if (!wheres || !wheres.length)
+            return fail(res, 'No valid rows selected.', 400);
+        if (wheres.length > MAX_BULK_ROWS)
+            return fail(res, `Select at most ${MAX_BULK_ROWS} rows at a time.`, 400);
+        const impact = await computeBulkImpact(db, info, wheres);
+        if (impact.total > 0 && body.confirmImpact !== true) {
+            return res.status(409).json({
+                success: false,
+                error: 'These rows are referenced by other tables. Confirm the impact before deleting.',
+                data: { references: impact.references, total: impact.total },
+            });
+        }
+        const r = await db.deleteRows(req.params.table, wheres);
+        if (!r.success)
+            return fail(res, r.error ?? 'Bulk delete failed.', 400);
+        ok(res, { message: `Deleted ${r.data?.deleted ?? 0} row(s).`, deleted: r.data?.deleted ?? 0 });
+    }));
+    /**
+     * Export only the selected rows (CSV or JSON). The content is returned in the
+     * JSON envelope so the client can trigger a download without a full page reload.
+     */
+    router.post('/api/tables/:table/rows/bulk-export', wrap(async (req, res) => {
+        const info = await requireTable(db, req.params.table);
+        if (!info)
+            return fail(res, `Table "${req.params.table}" does not exist.`, 404);
+        const body = (req.body ?? {});
+        const wheres = resolvePkRows(info, body.ids);
+        if (!wheres || !wheres.length)
+            return fail(res, 'No valid rows selected.', 400);
+        if (wheres.length > MAX_BULK_ROWS)
+            return fail(res, `Select at most ${MAX_BULK_ROWS} rows at a time.`, 400);
+        const format = String(body.format ?? 'csv').toLowerCase() === 'json' ? 'json' : 'csv';
+        const rowsR = await db.getRowsByPks(req.params.table, wheres);
+        if (!rowsR.success)
+            return fail(res, rowsR.error ?? 'Export failed.', 500);
+        const rows = (rowsR.data ?? []).map(util_1.normalizeRow);
+        const columns = info.columns.map((c) => c.name);
+        const content = format === 'json' ? (0, csv_1.toJson)(rows) : (0, csv_1.toCsv)(rows, columns);
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+        ok(res, {
+            format,
+            filename: `${req.params.table}-selected-${stamp}.${format}`,
+            content,
+            rowCount: rows.length,
+        });
+    }));
+    /**
+     * Apply staged inline-grid edits: update many cells across many rows inside a
+     * single transaction. Each entry is `{ id, values?, nulls? }` where `id` is
+     * the encoded primary key. This is the "Apply" step of the Neon-style
+     * spreadsheet editing flow (edits are buffered client-side until this runs).
+     */
+    router.post('/api/tables/:table/rows/bulk-update', wrap(async (req, res) => {
+        const info = await requireTable(db, req.params.table);
+        if (!info)
+            return fail(res, `Table "${req.params.table}" does not exist.`, 404);
+        if (!info.primaryKey.length) {
+            return fail(res, `Table "${req.params.table}" has no primary key, so inline edits cannot be applied.`, 400);
+        }
+        const updates = Array.isArray(req.body?.updates) ? req.body.updates : [];
+        if (!updates.length)
+            return fail(res, 'No changes to apply.', 400);
+        if (updates.length > MAX_BULK_ROWS)
+            return fail(res, `Select at most ${MAX_BULK_ROWS} rows at a time.`, 400);
+        const rows = [];
+        for (const u of updates) {
+            const entry = (u ?? {});
+            const where = pkWhere(info, String(entry.id ?? ''));
+            if (!where)
+                continue;
+            const fields = buildUpdateFields(info, (entry.values ?? {}), Array.isArray(entry.nulls) ? entry.nulls.map(String) : []);
+            if (fields.length)
+                rows.push({ fields, where });
+        }
+        if (!rows.length)
+            return fail(res, 'No fields to update.', 400);
+        const r = await db.updateRows(req.params.table, rows);
+        if (!r.success)
+            return fail(res, r.error ?? 'Update failed.', 400);
+        ok(res, {
+            message: `Applied ${r.data?.updated ?? 0} row change(s).`,
+            updated: r.data?.updated ?? 0,
+        });
+    }));
     // ---- Create table (run + generate) ------------------------------------
     router.post('/api/tables', wrap(async (req, res) => {
         const { name, columns } = req.body ?? {};
@@ -462,103 +706,23 @@ function registerApi(router, ctx) {
             return fail(res, r.error ?? 'Failed to drop index.', 400);
         ok(res, { message: `Index "${req.params.index}" dropped.`, sql });
     }));
-    // ---- Views & triggers --------------------------------------------------
-    router.get('/api/views', wrap(async (_req, res) => {
-        const r = await db.listViews();
-        if (!r.success)
-            return fail(res, r.error ?? 'Failed to list views.', 500);
-        ok(res, r.data);
-    }));
-    router.get('/api/views/:name/rows', wrap(async (req, res) => {
-        const r = await db.getViewRows(req.params.name);
-        if (!r.success)
-            return fail(res, r.error ?? 'Failed to read view.', 400);
-        ok(res, { rows: (r.data ?? []).map(util_1.normalizeRow) });
-    }));
-    router.post('/api/views/generate', wrap(async (req, res) => {
-        const name = String(req.body?.name ?? '').trim();
-        const sql = String(req.body?.sql ?? '').trim();
-        try {
-            ok(res, { sql: (0, generator_1.generateCreateView)(name, sql) });
-        }
-        catch (err) {
-            fail(res, (0, util_1.errorMessage)(err));
-        }
-    }));
-    router.post('/api/views', wrap(async (req, res) => {
-        const name = String(req.body?.name ?? '').trim();
-        const sql = String(req.body?.sql ?? '').trim();
-        let genSql;
-        try {
-            genSql = (0, generator_1.generateCreateView)(name, sql);
-        }
-        catch (err) {
-            return fail(res, (0, util_1.errorMessage)(err));
-        }
-        const r = await db.createView(name, sql);
-        if (!r.success)
-            return fail(res, r.error ?? 'Failed to create view.', 400);
-        ok(res, { message: `View "${name}" created.`, sql: genSql }, 201);
-    }));
-    router.delete('/api/views/:name', wrap(async (req, res) => {
-        let genSql;
-        try {
-            genSql = (0, generator_1.generateDropView)(req.params.name);
-        }
-        catch (err) {
-            return fail(res, (0, util_1.errorMessage)(err));
-        }
-        const r = await db.dropView(req.params.name);
-        if (!r.success)
-            return fail(res, r.error ?? 'Failed to drop view.', 400);
-        ok(res, { message: `View "${req.params.name}" dropped.`, sql: genSql });
-    }));
-    router.get('/api/triggers', wrap(async (_req, res) => {
-        const r = await db.listTriggers();
-        if (!r.success)
-            return fail(res, r.error ?? 'Failed to list triggers.', 500);
-        ok(res, r.data);
-    }));
-    router.post('/api/triggers/generate', wrap(async (req, res) => {
-        try {
-            ok(res, { sql: (0, generator_1.generateCreateTrigger)((req.body ?? {})) });
-        }
-        catch (err) {
-            fail(res, (0, util_1.errorMessage)(err));
-        }
-    }));
-    router.post('/api/triggers', wrap(async (req, res) => {
-        const def = (req.body ?? {});
-        let genSql;
-        try {
-            genSql = (0, generator_1.generateCreateTrigger)(def);
-        }
-        catch (err) {
-            return fail(res, (0, util_1.errorMessage)(err));
-        }
-        const r = await db.createTrigger(def);
-        if (!r.success)
-            return fail(res, r.error ?? 'Failed to create trigger.', 400);
-        ok(res, { message: `Trigger "${def.name}" created.`, sql: genSql }, 201);
-    }));
-    router.delete('/api/triggers/:name', wrap(async (req, res) => {
-        let genSql;
-        try {
-            genSql = (0, generator_1.generateDropTrigger)(req.params.name);
-        }
-        catch (err) {
-            return fail(res, (0, util_1.errorMessage)(err));
-        }
-        const r = await db.dropTrigger(req.params.name);
-        if (!r.success)
-            return fail(res, r.error ?? 'Failed to drop trigger.', 400);
-        ok(res, { message: `Trigger "${req.params.name}" dropped.`, sql: genSql });
-    }));
     // ---- Query runner ------------------------------------------------------
     router.post('/api/query', wrap(async (req, res) => {
         const sql = String(req.body?.sql ?? '').trim();
         if (!sql)
             return fail(res, 'SQL is required.');
+        // Scripts (more than one statement, e.g. a schema/migration script) cannot
+        // be represented as a single prepared statement, so run them via `exec`.
+        if (db.hasMultipleStatements(sql)) {
+            if (db.isReadOnly) {
+                return fail(res, 'Database is open in read-only mode — write statements are disabled.', 403);
+            }
+            const r = await db.execResult(sql);
+            if (!r.success)
+                return fail(res, r.error ?? 'Query failed.', 400);
+            ok(res, { kind: 'write', changes: null, message: 'Statement(s) executed successfully.' });
+            return;
+        }
         const { kind } = (0, classifier_1.classifySql)(sql);
         if (kind === 'count') {
             const r = await db.all(sql);