feat(server): allow readonly D1 pragma statements

[lentil32]

One-Line Summary

Allow Cloudflare D1 metadata PRAGMA statements that are safe under read-only SQL validation.

User-Facing Changes

• Cloudflare D1 queries can now use documented read-only PRAGMA metadata statements such as PRAGMA table_list, PRAGMA table_info("events"), PRAGMA index_list("events"), PRAGMA foreign_key_check, and PRAGMA quick_check.
• Mutable or behavior-changing D1 PRAGMAs such as PRAGMA foreign_keys=off, PRAGMA foreign_keys, PRAGMA case_sensitive_like, and PRAGMA optimize are still rejected with Only read-only PRAGMA statements are allowed.

Why This Changed

D1 supports PRAGMA statements for schema and index inspection, but the SQL validator treated every pragma AST node as side-effecting. That blocked useful read-only metadata inspection even though the validator already has a metadata statement path for SHOW, DESCRIBE, and EXPLAIN.

How It Changed

• Added a D1-specific metadata statement override for PRAGMA so other providers keep their existing allowed statement list.
• Added a Cloudflare D1 read-only PRAGMA allowlist based on the documented compatible PRAGMA statements.
• Kept PRAGMA assignment/value syntax rejected and only allow simple identifier or literal arguments, so executable expressions are not accepted inside PRAGMA arguments.

Bug Fixes

• Under Cloudflare D1, schema and index PRAGMA inspection was rejected as a non-select query. This now works for read-only PRAGMA forms.

Extra Context / Decisions

• Cloudflare documents some compatible PRAGMA statements that modify current transaction behavior or run optimization work. Those remain blocked because they are not read-only operations for OneQuery policy.
• Reference: https://developers.cloudflare.com/d1/sql-api/sql-statements/#compatible-pragma-statements

Verification

• rtk mise exec -- bun --cwd packages/server vitest run src/services/data-source-query/validate-sql.test.ts
• rtk mise exec -- bunx turbo typecheck --json --filter=@onequery/server
• rtk mise exec -- bun lint --format json
• rtk mise exec -- bun run format
• pre-push lint-full passed while pushing the branch

Video / Screenshot (Optional)

• N/A

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	onequery-landing	4286ceb	Commit Preview URL Branch Preview URL	Jun 26 2026, 07:20 AM