cursedbelt 2.7.0 → 3.0.0

package/src/server/sqlite/import.spec.ts

@@ -1,75 +0,0 @@
-import { Database } from 'bun:sqlite';
-import { describe, expect, test } from 'bun:test';
-import { UnknownTableError } from './browse';
-import { exportSqliteSnapshot } from './export';
-import { importRowsIntoSqliteTable, restoreSqliteSnapshot } from './import';
-
-function seed(withRows = true): Database {
-  const db = new Database(':memory:');
-  db.run('CREATE TABLE notes (id INTEGER PRIMARY KEY, body TEXT)');
-  if (withRows) db.run("INSERT INTO notes (id, body) VALUES (1, 'a'), (2, 'b')");
-  return db;
-}
-
-const count = (db: Database) =>
-  db.query<{ n: number }, []>('SELECT COUNT(*) AS n FROM notes').get()?.n ?? 0;
-
-describe('importRowsIntoSqliteTable', () => {
-  test('append adds rows and reports the count', () => {
-    const db = seed();
-    const res = importRowsIntoSqliteTable(db, 'notes', [{ id: 3, body: 'c' }], { mode: 'append' });
-    expect(res.inserted).toBe(1);
-    expect(count(db)).toBe(3);
-  });
-
-  test('replace clears the table first', () => {
-    const db = seed();
-    const res = importRowsIntoSqliteTable(db, 'notes', [{ id: 9, body: 'z' }], { mode: 'replace' });
-    expect(res.inserted).toBe(1);
-    expect(count(db)).toBe(1);
-    expect(db.query('SELECT body FROM notes').get()).toEqual({ body: 'z' });
-  });
-
-  test('drops keys that are not real columns', () => {
-    const db = seed(false);
-    importRowsIntoSqliteTable(db, 'notes', [{ id: 1, body: 'ok', bogus: 'x' }]);
-    expect(db.query('SELECT * FROM notes').get()).toEqual({ id: 1, body: 'ok' });
-  });
-
-  test('replace with zero rows just empties the table', () => {
-    const db = seed();
-    expect(importRowsIntoSqliteTable(db, 'notes', [], { mode: 'replace' }).inserted).toBe(0);
-    expect(count(db)).toBe(0);
-  });
-
-  test('throws UnknownTableError for a bad table', () => {
-    expect(() => importRowsIntoSqliteTable(seed(), 'nope', [])).toThrow(UnknownTableError);
-  });
-});
-
-describe('restoreSqliteSnapshot', () => {
-  test('replaces target rows with the snapshot for shared tables', () => {
-    const source = seed(); // notes: 1,2
-    const snap = exportSqliteSnapshot(source);
-
-    const target = seed(false);
-    target.run("INSERT INTO notes (id, body) VALUES (7, 'old')");
-    const res = restoreSqliteSnapshot(target, snap.bytes);
-
-    expect(res.restoredTables).toEqual(['notes']);
-    expect(res.totalRows).toBe(2);
-    expect(target.query('SELECT id FROM notes ORDER BY id').all()).toEqual([{ id: 1 }, { id: 2 }]);
-  });
-
-  test('leaves tables absent from the target untouched', () => {
-    const source = new Database(':memory:');
-    source.run('CREATE TABLE extra (id INTEGER PRIMARY KEY)');
-    source.run('INSERT INTO extra (id) VALUES (1)');
-    const snap = exportSqliteSnapshot(source);
-
-    const target = seed();
-    const res = restoreSqliteSnapshot(target, snap.bytes);
-    expect(res.restoredTables).toEqual([]); // no shared tables
-    expect(count(target)).toBe(2); // notes untouched
-  });
-});

package/src/server/sqlite/import.ts

@@ -1,141 +0,0 @@
-import { Database } from 'bun:sqlite';
-import { withForeignKeysOff } from 'cwip/sqlite';
-import { rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { isKnownTable, quoteIdent, UnknownTableError } from './browse';
-
-/**
- * Write-side SQLite primitives — the counterpart to the read-only `browse.ts` /
- * `export.ts`. Both surfaces are deliberately scoped: row import into an EXISTING
- * table and whole-DB snapshot restore. No arbitrary DDL, no schema mutation — the
- * table must already exist, and only its real columns are written.
- *
- * Every operation runs inside a transaction so a mid-operation failure rolls the DB
- * back atomically (stronger than a copy-aside snapshot). Foreign-key enforcement is
- * suspended for the bulk replace/restore and always restored afterward.
- */
-
-export type ImportMode = 'append' | 'replace';
-
-export interface ImportResult {
-  inserted: number;
-}
-
-/** Real column names of a table, in declared order. */
-function tableColumns(db: Database, table: string): string[] {
-  return db
-    .query<{ name: string }, []>(`PRAGMA table_info(${quoteIdent(table)})`)
-    .all()
-    .map((r) => r.name);
-}
-
-/**
- * Insert already-parsed rows into an existing table. Unknown keys are dropped (only
- * columns that actually exist on the table are written); `replace` clears the table
- * first. Returns the number of rows inserted. Throws {@link UnknownTableError} for a
- * table not in `sqlite_master`.
- */
-export function importRowsIntoSqliteTable(
-  db: Database,
-  table: string,
-  rows: Record<string, unknown>[],
-  opts: { mode?: ImportMode } = {},
-): ImportResult {
-  if (!isKnownTable(db, table)) throw new UnknownTableError(table);
-  const mode = opts.mode ?? 'append';
-  const valid = new Set(tableColumns(db, table));
-  // Columns to write = table columns present in at least one row (preserve order).
-  const cols = tableColumns(db, table).filter((c) => rows.some((r) => c in r && valid.has(c)));
-
-  const runImport = db.transaction(() => {
-    if (mode === 'replace') db.run(`DELETE FROM ${quoteIdent(table)}`);
-    if (rows.length === 0 || cols.length === 0) return 0;
-    const placeholders = cols.map(() => '?').join(', ');
-    const colList = cols.map(quoteIdent).join(', ');
-    const stmt = db.prepare(
-      `INSERT INTO ${quoteIdent(table)} (${colList}) VALUES (${placeholders})`,
-    );
-    let inserted = 0;
-    for (const row of rows) {
-      stmt.run(...cols.map((c) => normalizeValue(row[c])));
-      inserted++;
-    }
-    return inserted;
-  });
-
-  const inserted = mode === 'replace' ? withForeignKeysOff(db, runImport) : runImport();
-  return { inserted };
-}
-
-/** bun:sqlite binds string/number/bigint/boolean/null/Uint8Array; coerce the rest. */
-function normalizeValue(v: unknown): string | number | bigint | boolean | null | Uint8Array {
-  if (v === undefined || v === null) return null;
-  if (
-    typeof v === 'string' ||
-    typeof v === 'number' ||
-    typeof v === 'bigint' ||
-    typeof v === 'boolean' ||
-    v instanceof Uint8Array
-  ) {
-    return v;
-  }
-  // Objects/arrays → JSON text (the pragmatic choice for a foreign-format import).
-  return JSON.stringify(v);
-}
-
-export interface RestoreResult {
-  restoredTables: string[];
-  totalRows: number;
-}
-
-/**
- * Restore a `.sqlite` snapshot into the live DB, table by table. For every table
- * present in BOTH the snapshot and the target, the target's rows are replaced by the
- * snapshot's (via `ATTACH` + `INSERT … SELECT`). Tables that exist only in the
- * snapshot (or only in the target) are left untouched — this is a data restore, not
- * a schema migration. Atomic: any failure rolls the whole restore back.
- */
-export function restoreSqliteSnapshot(db: Database, bytes: Uint8Array): RestoreResult {
-  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-  const tmp = join(tmpdir(), `cb-restore-${stamp}-${Math.random().toString(36).slice(2)}.sqlite`);
-  writeFileSync(tmp, bytes);
-  try {
-    // Validate it opens as SQLite and enumerate its user tables.
-    const snap = new Database(tmp, { readonly: true });
-    let snapTables: string[];
-    try {
-      snapTables = snap
-        .query<{ name: string }, []>(
-          "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'",
-        )
-        .all()
-        .map((r) => r.name);
-    } finally {
-      snap.close();
-    }
-
-    const targets = snapTables.filter((t) => isKnownTable(db, t));
-    let totalRows = 0;
-    withForeignKeysOff(db, () => {
-      db.run('ATTACH DATABASE ? AS restore_src', [tmp]);
-      try {
-        const run = db.transaction(() => {
-          for (const t of targets) {
-            const q = quoteIdent(t);
-            db.run(`DELETE FROM main.${q}`);
-            db.run(`INSERT INTO main.${q} SELECT * FROM restore_src.${q}`);
-            totalRows +=
-              db.query<{ n: number }, []>(`SELECT COUNT(*) AS n FROM main.${q}`).get()?.n ?? 0;
-          }
-        });
-        run();
-      } finally {
-        db.run('DETACH DATABASE restore_src');
-      }
-    });
-    return { restoredTables: targets, totalRows };
-  } finally {
-    rmSync(tmp, { force: true });
-  }
-}

package/src/server/sqlite/index.ts

@@ -1,64 +0,0 @@
-// cursedbelt SQLite toolkit extras (task 30) — bun:sqlite-native primitives layered
-// on the migration runner (task 24): FTS5 ranked search, a read-only DB viewer, the
-// VACUUM-INTO backup service, DB-layer health probes, plus the Hono-free browse /
-// export / import / stats primitives that back both the viewer middleware and any
-// bespoke-transport consumer (a cursedshell plugin, the encrypted-GET "f" app). All
-// app-agnostic; the apps supply table names, paths, and thresholds.
-
-export {
-  type BackupInfo,
-  createSqliteBackupService,
-  snapshotSqlite,
-  type SqliteBackupOpts,
-  type SqliteBackupS3Opts,
-  type SqliteBackupService,
-} from './backup';
-export {
-  clampLimit,
-  clampOffset,
-  isKnownTable,
-  listSqliteTables,
-  NotReadOnlyError,
-  quoteIdent,
-  readSqliteTable,
-  runReadonlySqlite,
-  type SqliteTableInfo,
-  type SqliteTablePage,
-  UnknownTableError,
-} from './browse';
-export {
-  exportSqliteSnapshot,
-  exportSqliteTable,
-  type SnapshotExport,
-  type TableExport,
-  type TableExportFormat,
-} from './export';
-export {
-  applyFtsSchema,
-  buildFtsSchema,
-  createFts5Search,
-  type Fts5Search,
-  type FtsHighlightOpts,
-  type FtsResult,
-  type FtsSearchOpts,
-  type FtsSnippetOpts,
-  type FtsTableSpec,
-  sanitizeFtsQuery,
-} from './fts5';
-export {
-  createSqliteHealthChecks,
-  type SqliteHealthCheck,
-  type SqliteHealthOpts,
-  type SqliteHealthResult,
-  type SqliteHealthStatus,
-} from './health';
-export {
-  type ImportMode,
-  type ImportResult,
-  importRowsIntoSqliteTable,
-  type RestoreResult,
-  restoreSqliteSnapshot,
-} from './import';
-export { isReadOnlySql } from './readonlySql';
-export { collectSqliteStats, type DbStats, type TableStat } from './stats';
-export { createSqliteViewerMiddleware } from './viewer';

package/src/server/sqlite/readonlySql.spec.ts

@@ -1,58 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { isReadOnlySql } from './readonlySql';
-
-describe('isReadOnlySql', () => {
-  test('allows SELECT and WITH … SELECT', () => {
-    expect(isReadOnlySql('SELECT * FROM notes')).toBe(true);
-    expect(isReadOnlySql('  select 1  ')).toBe(true);
-    expect(isReadOnlySql('WITH x AS (SELECT 1) SELECT * FROM x')).toBe(true);
-    expect(isReadOnlySql('SELECT * FROM notes WHERE body LIKE ? -- comment')).toBe(true);
-    expect(isReadOnlySql('SELECT * FROM notes;')).toBe(true); // single trailing terminator
-  });
-
-  test('rejects writes and DDL', () => {
-    for (const sql of [
-      'INSERT INTO notes (body) VALUES (1)',
-      'UPDATE notes SET body = 1',
-      'DELETE FROM notes',
-      'DROP TABLE notes',
-      'ALTER TABLE notes ADD COLUMN x TEXT',
-      'CREATE TABLE x (id INT)',
-      'REPLACE INTO notes VALUES (1)',
-      'TRUNCATE notes',
-    ]) {
-      expect(isReadOnlySql(sql)).toBe(false);
-    }
-  });
-
-  test('rejects SQLite-specific write vectors and transactions', () => {
-    for (const sql of [
-      "ATTACH DATABASE 'evil.db' AS evil",
-      'PRAGMA user_version = 9',
-      'VACUUM',
-      'REINDEX',
-      'BEGIN',
-      'COMMIT',
-      'SAVEPOINT s',
-    ]) {
-      expect(isReadOnlySql(sql)).toBe(false);
-    }
-  });
-
-  test('rejects stacked statements and SELECT … INTO', () => {
-    expect(isReadOnlySql('SELECT 1; DROP TABLE notes')).toBe(false);
-    expect(isReadOnlySql('SELECT 1; SELECT 2')).toBe(false);
-    expect(isReadOnlySql('SELECT * INTO copy FROM notes')).toBe(false);
-  });
-
-  test('rejects empty / non-statement input', () => {
-    expect(isReadOnlySql('')).toBe(false);
-    expect(isReadOnlySql('   ')).toBe(false);
-    expect(isReadOnlySql('-- just a comment')).toBe(false);
-  });
-
-  test('does not false-positive on column names containing keywords', () => {
-    // "created_at" / "update_count" embed keywords but only as substrings, not words.
-    expect(isReadOnlySql('SELECT created_at, update_count FROM notes')).toBe(true);
-  });
-});

package/src/server/sqlite/readonlySql.ts

@@ -1,67 +0,0 @@
-/**
- * Defense-in-depth read-only guard for the SQLite viewer's ad-hoc query endpoint. A
- * conservative *lexical* check, NOT a parser: it rejects the obvious foot-guns
- * (writes, DDL, PRAGMA, ATTACH, stacked statements) before SQL reaches the DB. The
- * real guarantees are the owner-only mount + this allowlist, layered.
- *
- * cursedbelt keeps its own copy rather than depending on cwip — the toolkit's server
- * surface stays dependency-light, and the rule set here is tuned for SQLite (PRAGMA /
- * ATTACH are SQLite-specific write vectors).
- */
-
-const FORBIDDEN = [
-  'insert',
-  'update',
-  'delete',
-  'drop',
-  'alter',
-  'truncate',
-  'create',
-  'replace',
-  'attach',
-  'detach',
-  'reindex',
-  'vacuum',
-  'pragma',
-  'begin',
-  'commit',
-  'rollback',
-  'savepoint',
-  'release',
-  'grant',
-  'revoke',
-];
-
-/** Strip `--` line comments and block comments, collapse whitespace, lowercase. */
-function normalize(sql: string): string {
-  return sql
-    .replace(/--[^\n]*/g, ' ')
-    .replace(/\/\*[\s\S]*?\*\//g, ' ')
-    .replace(/\s+/g, ' ')
-    .trim()
-    .toLowerCase();
-}
-
-/**
- * True only for a single read-only statement: a `SELECT`, or a `WITH … SELECT` CTE.
- * Rejects stacked statements, `SELECT … INTO`, and any forbidden keyword as a word.
- */
-export function isReadOnlySql(sql: string): boolean {
-  const s = normalize(sql);
-  if (!s) return false;
-
-  // Only a trailing `;` terminator is allowed — no stacked statements.
-  const body = s.replace(/;\s*$/, '');
-  if (body.includes(';')) return false;
-
-  // Must begin with SELECT or a CTE.
-  if (!/^(select|with)\b/.test(body)) return false;
-
-  // `SELECT … INTO new_table` writes a table — block it.
-  if (/\bselect\b[\s\S]*\binto\b/.test(body)) return false;
-
-  for (const kw of FORBIDDEN) {
-    if (new RegExp(`\\b${kw}\\b`).test(body)) return false;
-  }
-  return true;
-}

package/src/server/sqlite/stats.spec.ts

@@ -1,21 +0,0 @@
-import { Database } from 'bun:sqlite';
-import { describe, expect, test } from 'bun:test';
-import { collectSqliteStats } from './stats';
-
-describe('collectSqliteStats', () => {
-  test('reports per-table rows, total rows, and a positive file size', () => {
-    const db = new Database(':memory:');
-    db.run('CREATE TABLE notes (id INTEGER PRIMARY KEY, body TEXT)');
-    db.run('CREATE TABLE contacts (id INTEGER PRIMARY KEY)');
-    db.run("INSERT INTO notes (id, body) VALUES (1, 'a'), (2, 'b'), (3, 'c')");
-
-    const stats = collectSqliteStats(db);
-    expect(stats.totalRows).toBe(3);
-    expect(stats.fileBytes).toBeGreaterThan(0);
-    expect(stats.tables.find((t) => t.name === 'notes')?.rows).toBe(3);
-    expect(stats.tables.find((t) => t.name === 'contacts')?.rows).toBe(0);
-    // dbstat is available in bun:sqlite, so bytes should be a number (>= 0), not null.
-    const notes = stats.tables.find((t) => t.name === 'notes');
-    expect(notes?.bytes === null || typeof notes?.bytes === 'number').toBe(true);
-  });
-});

package/src/server/sqlite/stats.ts

@@ -1,61 +0,0 @@
-import type { Database } from 'bun:sqlite';
-import { listSqliteTables } from './browse';
-
-/**
- * DB usage stats for `bun:sqlite` — per-table row counts and on-disk byte sizes
- * plus the total database file size. Feeds both StatTiles and the rows/bytes charts
- * in an admin surface. Per-table bytes use the `dbstat` virtual table when the build
- * supports it (it does in `bun:sqlite`); if a query for it ever fails, byte sizes
- * degrade to `null` rather than throwing — row counts and the file size still work.
- */
-
-export interface TableStat {
-  name: string;
-  rows: number;
-  /** On-disk bytes for this table's pages, or `null` when `dbstat` is unavailable. */
-  bytes: number | null;
-}
-
-export interface DbStats {
-  /** Total database file size in bytes (`page_count * page_size`). */
-  fileBytes: number;
-  /** Sum of every table's row count. */
-  totalRows: number;
-  tables: TableStat[];
-}
-
-/** Whole-database size from the page pragmas (works without `dbstat`). */
-function fileBytes(db: Database): number {
-  const pageCount =
-    db.query<{ page_count: number }, []>('PRAGMA page_count').get()?.page_count ?? 0;
-  const pageSize = db.query<{ page_size: number }, []>('PRAGMA page_size').get()?.page_size ?? 0;
-  return pageCount * pageSize;
-}
-
-/** Per-table byte sizes from `dbstat`, or `null` for all tables if it's unavailable. */
-function bytesByTable(db: Database): Map<string, number> | null {
-  try {
-    const rows = db
-      .query<{ name: string; bytes: number }, []>(
-        'SELECT name, SUM(pgsize) AS bytes FROM dbstat GROUP BY name',
-      )
-      .all();
-    return new Map(rows.map((r) => [r.name, r.bytes]));
-  } catch {
-    return null;
-  }
-}
-
-export function collectSqliteStats(db: Database): DbStats {
-  const byTable = bytesByTable(db);
-  const tables: TableStat[] = listSqliteTables(db).map(({ name, count }) => ({
-    name,
-    rows: count,
-    bytes: byTable ? (byTable.get(name) ?? 0) : null,
-  }));
-  return {
-    fileBytes: fileBytes(db),
-    totalRows: tables.reduce((sum, t) => sum + t.rows, 0),
-    tables,
-  };
-}

package/src/server/sqlite/viewer.spec.ts

@@ -1,127 +0,0 @@
-import { Database } from 'bun:sqlite';
-import { describe, expect, test } from 'bun:test';
-import { Hono } from 'hono';
-import { createSqliteViewerMiddleware } from './viewer';
-
-function makeApp(): { app: Hono; db: Database } {
-  const db = new Database(':memory:');
-  db.run('CREATE TABLE notes (id INTEGER PRIMARY KEY, body TEXT)');
-  db.run('CREATE TABLE contacts (id INTEGER PRIMARY KEY, name TEXT)');
-  for (let i = 1; i <= 5; i++)
-    db.run('INSERT INTO notes (id, body) VALUES (?, ?)', [i, `note ${i}`]);
-  const app = new Hono().route('/admin/sqlite', createSqliteViewerMiddleware(db));
-  return { app, db };
-}
-
-const get = (app: Hono, path: string) => app.fetch(new Request(`http://localhost${path}`));
-const post = (app: Hono, path: string, body: unknown) =>
-  app.fetch(
-    new Request(`http://localhost${path}`, {
-      method: 'POST',
-      body: JSON.stringify(body),
-      headers: { 'Content-Type': 'application/json' },
-    }),
-  );
-
-describe('createSqliteViewerMiddleware /tables', () => {
-  test('lists user tables with row counts', async () => {
-    const { app } = makeApp();
-    const res = await get(app, '/admin/sqlite/tables');
-    expect(res.status).toBe(200);
-    const { items } = (await res.json()) as { items: { name: string; count: number }[] };
-    expect(items.map((t) => t.name).sort()).toEqual(['contacts', 'notes']);
-    expect(items.find((t) => t.name === 'notes')?.count).toBe(5);
-    expect(items.find((t) => t.name === 'contacts')?.count).toBe(0);
-  });
-
-  test('excludes sqlite_* internal tables', async () => {
-    const { app, db } = makeApp();
-    db.run('CREATE TABLE x (id INTEGER PRIMARY KEY AUTOINCREMENT)'); // creates sqlite_sequence
-    const res = await get(app, '/admin/sqlite/tables');
-    const { items } = (await res.json()) as { items: { name: string }[] };
-    expect(items.some((t) => t.name.startsWith('sqlite_'))).toBe(false);
-  });
-});
-
-describe('createSqliteViewerMiddleware /tables/:table', () => {
-  test('paginates rows with total/limit/offset', async () => {
-    const { app } = makeApp();
-    const res = await get(app, '/admin/sqlite/tables/notes?limit=2&offset=1');
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as {
-      items: unknown[];
-      total: number;
-      limit: number;
-      offset: number;
-    };
-    expect(body.items).toHaveLength(2);
-    expect(body.total).toBe(5);
-    expect(body.limit).toBe(2);
-    expect(body.offset).toBe(1);
-  });
-
-  test('404s an unknown table (no SQL runs)', async () => {
-    const { app } = makeApp();
-    const res = await get(app, '/admin/sqlite/tables/does_not_exist');
-    expect(res.status).toBe(404);
-    expect(((await res.json()) as { error: { code: string } }).error.code).toBe('unknown_table');
-  });
-
-  test('a SQL-injection table name cannot escape (treated as unknown)', async () => {
-    const { app, db } = makeApp();
-    const res = await get(app, '/admin/sqlite/tables/notes%22%3B%20DROP%20TABLE%20notes%3B--');
-    expect(res.status).toBe(404);
-    expect(db.query("SELECT name FROM sqlite_master WHERE name='notes'").all()).toHaveLength(1);
-  });
-});
-
-describe('createSqliteViewerMiddleware /query', () => {
-  test('runs a read-only SELECT with bound params', async () => {
-    const { app } = makeApp();
-    const res = await post(app, '/admin/sqlite/query', {
-      sql: 'SELECT id, body FROM notes WHERE id = ?',
-      params: [3],
-    });
-    expect(res.status).toBe(200);
-    const { items } = (await res.json()) as { items: { id: number; body: string }[] };
-    expect(items).toEqual([{ id: 3, body: 'note 3' }]);
-  });
-
-  test('rejects a non-SELECT statement', async () => {
-    const { app, db } = makeApp();
-    const res = await post(app, '/admin/sqlite/query', { sql: 'DROP TABLE notes' });
-    expect(res.status).toBe(400);
-    expect(((await res.json()) as { error: { code: string } }).error.code).toBe('not_read_only');
-    // The table is untouched.
-    expect(db.query("SELECT name FROM sqlite_master WHERE name='notes'").all()).toHaveLength(1);
-  });
-
-  test('rejects stacked statements and PRAGMA', async () => {
-    const { app } = makeApp();
-    expect(
-      (await post(app, '/admin/sqlite/query', { sql: 'SELECT 1; DELETE FROM notes' })).status,
-    ).toBe(400);
-    expect((await post(app, '/admin/sqlite/query', { sql: 'PRAGMA user_version' })).status).toBe(
-      400,
-    );
-  });
-
-  test('returns 400 with the SQLite message for a malformed SELECT', async () => {
-    const { app } = makeApp();
-    const res = await post(app, '/admin/sqlite/query', { sql: 'SELECT * FROM nope_table' });
-    expect(res.status).toBe(400);
-    expect(((await res.json()) as { error: { code: string } }).error.code).toBe('query_failed');
-  });
-
-  test('returns 400 on an invalid JSON body', async () => {
-    const { app } = makeApp();
-    const res = await app.fetch(
-      new Request('http://localhost/admin/sqlite/query', {
-        method: 'POST',
-        body: 'not json',
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-    expect(res.status).toBe(400);
-  });
-});