Function executeSql

packages/core/src/query/message-queries.ts:393–437

(db: DatabaseAdapter, sql: string, options?: SqlExecutionOptions)

 * falls back to keyword denylist for adapters that don't expose it.
 */
export function executeSql(db: DatabaseAdapter, sql: string, options?: SqlExecutionOptions): SqlExecutionResult {
  const maxRows = options?.maxRows ?? 1000
  const columnar = options?.columnar ?? false
  const timing = options?.timing ?? false

  const trimmed = sql.trim()

  const startTime = timing ? Date.now() : 0

  const stmt = db.prepare(trimmed)

  if (stmt.readonly === false) {
    throw new Error('Only read-only statements are allowed (SELECT / WITH)')
  }

  if (stmt.readonly === undefined) {
    const forbidden = /^\s*(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|ATTACH|DETACH|REINDEX|VACUUM|PRAGMA)/i
    if (forbidden.test(trimmed)) {
      throw new Error('Only SELECT queries are allowed')
    }
  }

  const needsLimit = maxRows > 0 && !/\bLIMIT\b/i.test(trimmed)
  let allRows: Record<string, unknown>[]

  if (needsLimit) {
    const safeSql = `${trimmed} LIMIT ${maxRows + 1}`
    allRows = db.prepare(safeSql).all() as Record<string, unknown>[]
  } else {
    allRows = stmt.all() as Record<string, unknown>[]
  }

  const truncated = maxRows > 0 && allRows.length > maxRows
  const resultRows = truncated ? allRows.slice(0, maxRows) : allRows
  const columns = resultRows.length > 0 ? Object.keys(resultRows[0]) : []

  const duration = timing ? Date.now() - startTime : undefined

  if (columnar) {
    const rows2d = resultRows.map((row) => columns.map((col) => row[col]))
    return { columns, rows: rows2d, rowCount: rows2d.length, truncated, duration }
  }

  return { columns, rows: resultRows, rowCount: resultRows.length, truncated, duration }
}

/** Table schema with column details */
export interface TableSchema {