photostructure::sqlite::DatabaseSync *db,

const char *message = nullptr) {

// Check if we should ignore this SQLite error due to pending JavaScript

// exception (e.g., from authorizer callback)

if (db != nullptr && db->ShouldIgnoreSQLiteError()) {

db->SetIgnoreNextSQLiteError(false);

// Check for deferred authorizer exception and throw it instead

if (db->HasDeferredAuthorizerException()) {

std::string deferred_msg = db->GetDeferredAuthorizerException();

db->ClearDeferredAuthorizerException();

// Use c_str() explicitly to avoid potential ABI issues on Windows ARM

Napi::Error::New(env, deferred_msg.c_str()).ThrowAsJavaScriptException();

}

return; // Don't throw SQLite error, JavaScript exception takes precedence

}

const char *msg = (message != nullptr) ? message : "SQLite error";

Napi::Error::New(env, msg).ThrowAsJavaScriptException();

Napi::Env env, photostructure::sqlite::DatabaseSync *db_sync, sqlite3 *db,

int /*sqlite_code*/, const std::string &message) {

// Check if we should ignore this SQLite error due to pending JavaScript

// exception (e.g., from authorizer callback)

if (db_sync != nullptr && db_sync->ShouldIgnoreSQLiteError()) {

db_sync->SetIgnoreNextSQLiteError(false);

// Check for deferred authorizer exception and throw it instead

if (db_sync->HasDeferredAuthorizerException()) {

std::string deferred_msg = db_sync->GetDeferredAuthorizerException();

db_sync->ClearDeferredAuthorizerException();

// Use c_str() explicitly to avoid potential ABI issues on Windows ARM

Napi::Error::New(env, deferred_msg.c_str()).ThrowAsJavaScriptException();

}

return; // Don't throw SQLite error, JavaScript exception takes precedence

}

// Use extended error code from db handle (e.g., 1555 for

// SQLITE_CONSTRAINT_PRIMARYKEY) instead of basic code (e.g., 19 for

// SQLITE_CONSTRAINT) to match Node.js behavior

int extended_code = db ? sqlite3_extended_errcode(db) : SQLITE_ERROR;

node::ThrowEnhancedSqliteError(env, db, extended_code, message);

const std::string &field_name) {

auto has_null_bytes = [](const std::string &str) {

return str.find('\0') != std::string::npos;

};

if (path.IsString()) {

std::string location = path.As<Napi::String>().Utf8Value();

if (!has_null_bytes(location)) {

return location;

}

} else if (path.IsBuffer()) {

const auto buffer = path.As<Napi::Buffer<uint8_t>>();

const size_t length = buffer.Length();

const uint8_t *data = buffer.Data();

// Check for null bytes in buffer

if (std::find(data, data + length, 0) == data + length) {

return std::string(reinterpret_cast<const char *>(data), length);

}

} else if (path.IsObject()) {

Napi::Object url = path.As<Napi::Object>();

// Check if it's a URL object with href property

if (url.Has("href")) {

Napi::Value href = url.Get("href");

if (href.IsString()) {

std::string location = href.As<Napi::String>().Utf8Value();

if (!has_null_bytes(location)) {

// Check if it's a file:// URL

if (location.compare(0, 7, "file://") == 0) {

// Check if URL has query parameters - if so, return full URI

// for SQLite URI mode (e.g., file:///path/to/db?mode=ro)

size_t query_pos = location.find('?');

if (query_pos != std::string::npos) {

// Return full URI for SQLite to parse with SQLITE_OPEN_URI

return location;

}

// Convert file:// URL to file path with proper validation

std::string file_path = location.substr(7);

// Enhanced URL decoding with security checks

std::string decoded_path;

decoded_path.reserve(file_path.length());

// Maximum path length check (platform-specific, but 4096 is

// reasonable)

const size_t MAX_PATH_LENGTH = 4096;

if (file_path.length() > MAX_PATH_LENGTH) {

node::THROW_ERR_INVALID_ARG_TYPE(

env,

("The \"" + field_name + "\" path is too long.").c_str());

return std::nullopt;

}

// URL decode with multiple passes to prevent double-encoding bypass

int decode_passes = 0;

const int MAX_DECODE_PASSES = 5; // Prevent infinite decoding loops

std::string current_path = file_path;

std::string next_path;

while (decode_passes < MAX_DECODE_PASSES) {

bool found_encoding = false;

next_path.clear();

next_path.reserve(current_path.length());

for (size_t i = 0; i < current_path.length(); ++i) {

if (current_path[i] == '%' && i + 2 < current_path.length()) {

// Validate hex characters

if (std::isxdigit(current_path[i + 1]) &&

std::isxdigit(current_path[i + 2])) {

char hex_str[3] = {current_path[i + 1], current_path[i + 2],

'\0'};

long val = std::strtol(hex_str, nullptr, 16);

// Special handling for control characters and dangerous

// sequences

if (val == 0) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" contains encoded null bytes.")

.c_str());

return std::nullopt;

}

next_path += static_cast<char>(val);

i += 2;

found_encoding = true;

} else {

// Invalid hex sequence, reject

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" contains invalid percent encoding.")

.c_str());

return std::nullopt;

}

} else {

next_path += current_path[i];

}

}

if (!found_encoding) {

decoded_path = current_path;

break;

}

current_path = next_path;

decode_passes++;

}

if (decode_passes >= MAX_DECODE_PASSES) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" contains too many levels of percent encoding.")

.c_str());

return std::nullopt;

}

// Security: Check for null bytes after all decoding

if (has_null_bytes(decoded_path)) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" argument contains null bytes after URL decoding.")

.c_str());

return std::nullopt;

}

// Security: Normalize path components to detect traversal attempts

// This includes various representations of ".."

std::vector<std::string> dangerous_patterns = {

"..", "/..", "../", "\\..", "..\\",

// Windows alternate stream syntax (but allow single colon for

// drive letters)

"::", "::$",

// Zero-width characters that might hide dangerous sequences

"\u200B", "\u200C", "\u200D", "\uFEFF"};

// Check each component after splitting by directory separators

std::string normalized_path = decoded_path;

std::replace(normalized_path.begin(), normalized_path.end(), '\\',

'/');

// Split path and check each component

size_t start = 0;

size_t end = normalized_path.find('/');

while (end != std::string::npos) {

std::string component =

normalized_path.substr(start, end - start);

// Check for dangerous patterns in component

if (component == "..") {

// Always reject ..

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" argument contains path traversal sequences.")

.c_str());

return std::nullopt;

}

// Check for other dangerous patterns

for (const auto &pattern : dangerous_patterns) {

if (component.find(pattern) != std::string::npos) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" argument contains dangerous sequences.")

.c_str());

return std::nullopt;

}

}

start = end + 1;

end = normalized_path.find('/', start);

}

// Check last component

if (start < normalized_path.length()) {

std::string component = normalized_path.substr(start);

if (component == "..") {

// Always reject ..

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" argument contains path traversal sequences.")

.c_str());

return std::nullopt;

}

// Check for other dangerous patterns

for (const auto &pattern : dangerous_patterns) {

if (component.find(pattern) != std::string::npos) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, ("The \"" + field_name +

"\" argument contains dangerous sequences.")

.c_str());

return std::nullopt;

}

}

}

return decoded_path;

} else {

node::THROW_ERR_INVALID_URL_SCHEME(env);

return std::nullopt;

}

}

}

}

}

node::THROW_ERR_INVALID_ARG_TYPE(env,

("The \"" + field_name +

"\" argument must be a string, "

"Uint8Array, or URL without null bytes.")

.c_str());

return std::nullopt;

AddonData *addon_data = GetAddonData(env);

if (addon_data && !addon_data->objectCreateFn.IsEmpty()) {

// Call Object.create(null) to create object with null prototype

return addon_data->objectCreateFn.Value()

.Call({env.Null()})

.As<Napi::Object>();

}

// Fallback to regular object if Object.create not available

return Napi::Object::New(env);

Napi::Function func = DefineClass(

env, "DatabaseSync",

{InstanceMethod("open", &DatabaseSync::Open),

InstanceMethod("close", &DatabaseSync::Close),

InstanceMethod("dispose", &DatabaseSync::Dispose),

InstanceMethod("prepare", &DatabaseSync::Prepare),

InstanceMethod("exec", &DatabaseSync::Exec),

InstanceMethod("function", &DatabaseSync::CustomFunction),

InstanceMethod("aggregate", &DatabaseSync::AggregateFunction),

InstanceMethod("enableLoadExtension",

&DatabaseSync::EnableLoadExtension),

InstanceMethod("loadExtension", &DatabaseSync::LoadExtension),

InstanceMethod("enableDefensive", &DatabaseSync::EnableDefensive),

InstanceMethod("createSession", &DatabaseSync::CreateSession),

InstanceMethod("applyChangeset", &DatabaseSync::ApplyChangeset),

InstanceMethod("setAuthorizer", &DatabaseSync::SetAuthorizer),

InstanceMethod("getLimit", &DatabaseSync::GetLimit),

InstanceMethod("setLimit", &DatabaseSync::SetLimit),

InstanceMethod("backup", &DatabaseSync::Backup),

InstanceMethod("location", &DatabaseSync::LocationMethod),

InstanceAccessor("isOpen", &DatabaseSync::IsOpenGetter, nullptr),

InstanceAccessor("isTransaction", &DatabaseSync::IsTransactionGetter,

nullptr)});

// Store constructor in per-instance addon data instead of static variable

AddonData *addon_data = GetAddonData(env);

if (addon_data) {

addon_data->databaseSyncConstructor =

Napi::Reference<Napi::Function>::New(func);

}

// Add Symbol.dispose to the prototype (Node.js v25+ compatibility)

Napi::Value symbolDispose =

env.Global().Get("Symbol").As<Napi::Object>().Get("dispose");

if (!symbolDispose.IsUndefined()) {

func.Get("prototype")

.As<Napi::Object>()

.Set(symbolDispose,

Napi::Function::New(

env, [](const Napi::CallbackInfo &info) -> Napi::Value {

DatabaseSync *db =

DatabaseSync::Unwrap(info.This().As<Napi::Object>());

return db->Dispose(info);

}));

}

// Add Symbol.for('sqlite-type') property for type identification

// See: https://github.com/nodejs/node/pull/59405

Napi::Object symbolConstructor =

env.Global().Get("Symbol").As<Napi::Object>();

Napi::Function symbolFor = symbolConstructor.Get("for").As<Napi::Function>();

Napi::Value sqliteTypeSymbol = symbolFor.Call(

symbolConstructor, {Napi::String::New(env, "sqlite-type")});

func.Get("prototype")

.As<Napi::Object>()

.Set(sqliteTypeSymbol, Napi::String::New(env, "node:sqlite"));

exports.Set("DatabaseSync", func);

return exports;

: Napi::ObjectWrap<DatabaseSync>(info),

creation_thread_(std::this_thread::get_id()), env_(info.Env()),

config_("") {

// Register this instance for cleanup tracking

RegisterDatabaseInstance(info.Env(), this);

// Register cleanup hook to clean up references before environment teardown

napi_add_env_cleanup_hook(env_, CleanupHook, this);

// Node.js requires a path argument - throw if missing

if (info.Length() == 0 || info[0].IsUndefined()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"path\" argument must be a string, Uint8Array, or URL without "

"null bytes.");

return;

}

// Validate and extract the database path

std::optional<std::string> location =

ValidateDatabasePath(info.Env(), info[0], "path");

if (!location.has_value()) {

return; // Error already thrown by ValidateDatabasePath

}

try {

std::string loc = std::move(*location);

// Check if this is a file:// URI (for SQLite URI mode)

bool is_uri = (loc.compare(0, 7, "file://") == 0);

DatabaseOpenConfiguration config(std::move(loc));

if (is_uri) {

config.set_open_uri(true);

}

// Track whether to open immediately (default: true)

bool should_open = true;

// Handle options object if provided as second argument

if (info.Length() > 1) {

if (!info[1].IsObject()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(), "The \"options\" argument must be an object.");

return;

}

Napi::Object options = info[1].As<Napi::Object>();

// Validate and parse 'open' option

Napi::Value open_val = options.Get("open");

if (!open_val.IsUndefined()) {

if (!open_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(), "The \"options.open\" argument must be a boolean.");

return;

}

should_open = open_val.As<Napi::Boolean>().Value();

}

// Validate and parse 'readOnly' option

Napi::Value read_only_val = options.Get("readOnly");

if (!read_only_val.IsUndefined()) {

if (!read_only_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.readOnly\" argument must be a boolean.");

return;

}

config.set_read_only(read_only_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'enableForeignKeyConstraints' option

Napi::Value enable_fk_val = options.Get("enableForeignKeyConstraints");

if (!enable_fk_val.IsUndefined()) {

if (!enable_fk_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.enableForeignKeyConstraints\" argument must be a "

"boolean.");

return;

}

config.set_enable_foreign_keys(

enable_fk_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'enableDoubleQuotedStringLiterals' option

Napi::Value enable_dqs_val =

options.Get("enableDoubleQuotedStringLiterals");

if (!enable_dqs_val.IsUndefined()) {

if (!enable_dqs_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.enableDoubleQuotedStringLiterals\" argument must "

"be a boolean.");

return;

}

config.set_enable_dqs(enable_dqs_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'allowExtension' option

Napi::Value allow_ext_val = options.Get("allowExtension");

if (!allow_ext_val.IsUndefined()) {

if (!allow_ext_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.allowExtension\" argument must be a boolean.");

return;

}

allow_load_extension_ = allow_ext_val.As<Napi::Boolean>().Value();

}

// Validate and parse 'timeout' option

Napi::Value timeout_val = options.Get("timeout");

if (!timeout_val.IsUndefined()) {

if (!timeout_val.IsNumber()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.timeout\" argument must be an integer.");

return;

}

double timeout_double = timeout_val.As<Napi::Number>().DoubleValue();

if (timeout_double != std::trunc(timeout_double)) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.timeout\" argument must be an integer.");

return;

}

config.set_timeout(timeout_val.As<Napi::Number>().Int32Value());

}

// Validate and parse 'readBigInts' option

Napi::Value read_bigints_val = options.Get("readBigInts");

if (!read_bigints_val.IsUndefined()) {

if (!read_bigints_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.readBigInts\" argument must be a boolean.");

return;

}

config.set_read_big_ints(read_bigints_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'returnArrays' option

Napi::Value return_arrays_val = options.Get("returnArrays");

if (!return_arrays_val.IsUndefined()) {

if (!return_arrays_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.returnArrays\" argument must be a boolean.");

return;

}

config.set_return_arrays(return_arrays_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'allowBareNamedParameters' option

Napi::Value allow_bare_val = options.Get("allowBareNamedParameters");

if (!allow_bare_val.IsUndefined()) {

if (!allow_bare_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.allowBareNamedParameters\" argument must be a "

"boolean.");

return;

}

config.set_allow_bare_named_params(

allow_bare_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'allowUnknownNamedParameters' option

Napi::Value allow_unknown_val =

options.Get("allowUnknownNamedParameters");

if (!allow_unknown_val.IsUndefined()) {

if (!allow_unknown_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.allowUnknownNamedParameters\" argument must be a "

"boolean.");

return;

}

config.set_allow_unknown_named_params(

allow_unknown_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'defensive' option

Napi::Value defensive_val = options.Get("defensive");

if (!defensive_val.IsUndefined()) {

if (!defensive_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(),

"The \"options.defensive\" argument must be a boolean.");

return;

}

config.set_enable_defensive(defensive_val.As<Napi::Boolean>().Value());

}

// Validate and parse 'limits' option

Napi::Value limits_val = options.Get("limits");

if (!limits_val.IsUndefined()) {

if (!limits_val.IsObject() || limits_val.IsNull()) {

node::THROW_ERR_INVALID_ARG_TYPE(

info.Env(), "The \"options.limits\" argument must be an object.");

return;

}

Napi::Object limits_obj = limits_val.As<Napi::Object>();

// Limit name to SQLite limit ID mapping (matches upstream

// kLimitMapping)

static const struct {

const char *name;

int id;

} kLimitNames[] = {

{"length", SQLITE_LIMIT_LENGTH},

{"sqlLength", SQLITE_LIMIT_SQL_LENGTH},

{"column", SQLITE_LIMIT_COLUMN},

{"exprDepth", SQLITE_LIMIT_EXPR_DEPTH},

{"compoundSelect", SQLITE_LIMIT_COMPOUND_SELECT},

{"vdbeOp", SQLITE_LIMIT_VDBE_OP},

{"functionArg", SQLITE_LIMIT_FUNCTION_ARG},

{"attach", SQLITE_LIMIT_ATTACHED},

{"likePatternLength", SQLITE_LIMIT_LIKE_PATTERN_LENGTH},

{"variableNumber", SQLITE_LIMIT_VARIABLE_NUMBER},

{"triggerDepth", SQLITE_LIMIT_TRIGGER_DEPTH},

};

for (const auto &limit : kLimitNames) {

Napi::Value val = limits_obj.Get(limit.name);

if (!val.IsUndefined()) {

if (!val.IsNumber()) {

std::string msg = std::string("The \"options.limits.") +

limit.name + "\" argument must be an integer.";

node::THROW_ERR_INVALID_ARG_TYPE(info.Env(), msg.c_str());

return;

}

double dval = val.As<Napi::Number>().DoubleValue();

if (dval != std::trunc(dval) || std::isinf(dval) ||

std::isnan(dval)) {

std::string msg = std::string("The \"options.limits.") +

limit.name + "\" argument must be an integer.";

node::THROW_ERR_INVALID_ARG_TYPE(info.Env(), msg.c_str());

return;

}

int limit_val = static_cast<int>(dval);

if (limit_val < 0) {

std::string msg = std::string("The \"options.limits.") +

limit.name +

"\" argument must be non-negative.";

node::THROW_ERR_OUT_OF_RANGE(info.Env(), msg.c_str());

return;

}

config.set_initial_limit(limit.id, limit_val);

}

}

}

}

// Store configuration for later use

config_ = std::move(config);

// Only open if should_open is true

if (should_open) {

InternalOpen(config_);

}

} catch (const SqliteException &e) {

node::ThrowFromSqliteException(info.Env(), e);

} catch (const std::exception &e) {

node::THROW_ERR_SQLITE_ERROR(info.Env(), e.what());

}

// Called before environment teardown - safe to Reset() references here

auto *self = static_cast<DatabaseSync *>(arg);

// Clean up authorizer callback if it exists

if (self->authorizer_callback_) {

self->authorizer_callback_->Reset();

}

Napi::Env env = info.Env();

if (IsOpen()) {

node::THROW_ERR_INVALID_STATE(env, "database is already open");

return env.Undefined();

}

try {

InternalOpen(config_);

} catch (const SqliteException &e) {

node::ThrowFromSqliteException(env, e);

} catch (const std::exception &e) {

node::THROW_ERR_SQLITE_ERROR(env, e.what());

}

return env.Undefined();

Napi::Env env = info.Env();

if (!ValidateThread(env)) {

return env.Undefined();

}

if (!IsOpen()) {

node::THROW_ERR_INVALID_STATE(env, "database is not open");

return env.Undefined();

}

try {

InternalClose();

} catch (const std::exception &e) {

node::THROW_ERR_SQLITE_ERROR(env, e.what());

}

return env.Undefined();

Napi::Env env = info.Env();

if (!ValidateThread(env)) {

return env.Undefined();

}

// Try to close, but ignore errors during disposal (matches Node.js v25

// behavior)

try {

if (IsOpen()) {

InternalClose();

}

} catch (...) {

// Ignore errors during disposal

}

return env.Undefined();

Napi::Env env = info.Env();

if (!ValidateThread(env)) {

return env.Undefined();

}

if (!IsOpen()) {

node::THROW_ERR_INVALID_STATE(env, "database is not open");

return env.Undefined();

}

if (info.Length() < 1 || !info[0].IsString()) {

node::THROW_ERR_INVALID_ARG_TYPE(env,

"The \"sql\" argument must be a string.");

return env.Undefined();

}

std::string sql = info[0].As<Napi::String>().Utf8Value();

// Parse optional second argument (options object)

// Node.js v25+ supports per-statement options that override database defaults

std::optional<bool> opt_read_big_ints;

std::optional<bool> opt_return_arrays;

std::optional<bool> opt_allow_bare_named_params;

std::optional<bool> opt_allow_unknown_named_params;

if (info.Length() > 1 && !info[1].IsUndefined()) {

if (!info[1].IsObject()) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, "The \"options\" argument must be an object.");

return env.Undefined();

}

Napi::Object options = info[1].As<Napi::Object>();

// Parse readBigInts option

Napi::Value read_big_ints_val = options.Get("readBigInts");

if (!read_big_ints_val.IsUndefined()) {

if (!read_big_ints_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, "The \"options.readBigInts\" argument must be a boolean.");

return env.Undefined();

}

opt_read_big_ints = read_big_ints_val.As<Napi::Boolean>().Value();

}

// Parse returnArrays option

Napi::Value return_arrays_val = options.Get("returnArrays");

if (!return_arrays_val.IsUndefined()) {

if (!return_arrays_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, "The \"options.returnArrays\" argument must be a boolean.");

return env.Undefined();

}

opt_return_arrays = return_arrays_val.As<Napi::Boolean>().Value();

}

// Parse allowBareNamedParameters option

Napi::Value allow_bare_val = options.Get("allowBareNamedParameters");

if (!allow_bare_val.IsUndefined()) {

if (!allow_bare_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, "The \"options.allowBareNamedParameters\" argument must be a "

"boolean.");

return env.Undefined();

}

opt_allow_bare_named_params = allow_bare_val.As<Napi::Boolean>().Value();

}

// Parse allowUnknownNamedParameters option

Napi::Value allow_unknown_val = options.Get("allowUnknownNamedParameters");

if (!allow_unknown_val.IsUndefined()) {

if (!allow_unknown_val.IsBoolean()) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, "The \"options.allowUnknownNamedParameters\" argument must be "

"a boolean.");

return env.Undefined();

}

opt_allow_unknown_named_params =

allow_unknown_val.As<Napi::Boolean>().Value();

}

}

// Clear any stale deferred exception from a previous operation

ClearDeferredAuthorizerException();

SetIgnoreNextSQLiteError(false);

try {

// Create new StatementSync instance using addon data constructor

AddonData *addon_data = GetAddonData(env);

if (!addon_data || addon_data->statementSyncConstructor.IsEmpty()) {

node::THROW_ERR_INVALID_STATE(

env, "StatementSync constructor not initialized");

return env.Undefined();

}

Napi::Object stmt_obj =

addon_data->statementSyncConstructor.New({}).As<Napi::Object>();

// Initialize the statement (applies database-level defaults)

StatementSync *stmt = StatementSync::Unwrap(stmt_obj);

stmt->InitStatement(this, sql);

// Apply per-statement option overrides (if explicitly provided)

if (opt_read_big_ints.has_value()) {

stmt->use_big_ints_ = *opt_read_big_ints;

}

if (opt_return_arrays.has_value()) {

stmt->return_arrays_ = *opt_return_arrays;

}

if (opt_allow_bare_named_params.has_value()) {

stmt->allow_bare_named_params_ = *opt_allow_bare_named_params;

}

if (opt_allow_unknown_named_params.has_value()) {

stmt->allow_unknown_named_params_ = *opt_allow_unknown_named_params;

}

return stmt_obj;

} catch (const SqliteException &e) {

// SqliteException stores message in std::string, avoiding Windows ARM ABI

// issues where std::exception::what() can return corrupted strings

if (HasDeferredAuthorizerException()) {

std::string deferred_msg = GetDeferredAuthorizerException();

ClearDeferredAuthorizerException();

SetIgnoreNextSQLiteError(false);

// Use c_str() explicitly to avoid potential ABI issues on Windows ARM

Napi::Error::New(env, deferred_msg.c_str()).ThrowAsJavaScriptException();

return env.Undefined();

}

node::ThrowFromSqliteException(env, e);

return env.Undefined();

} catch (const std::exception &e) {

// Handle deferred authorizer exceptions:

//

// When an authorizer callback throws a JavaScript exception, we use a

// "marker" exception pattern to safely propagate the error:

//

// 1. On Windows (MSVC), std::exception::what() can sometimes return an

// empty string, causing message loss.

//

// 2. By storing the message in the DatabaseSync instance, we can retrieve

// it here and throw a proper JavaScript exception with the original

// text.

//

// See also: StatementSync::InitStatement for the other half of this

// pattern.

if (HasDeferredAuthorizerException()) {

std::string deferred_msg = GetDeferredAuthorizerException();

ClearDeferredAuthorizerException();

SetIgnoreNextSQLiteError(false);

// Use c_str() explicitly to avoid potential ABI issues on Windows ARM

Napi::Error::New(env, deferred_msg.c_str()).ThrowAsJavaScriptException();

return env.Undefined();

}

node::THROW_ERR_SQLITE_ERROR(env, e.what());

return env.Undefined();

}

Napi::Env env = info.Env();

if (!ValidateThread(env)) {

return env.Undefined();

}

if (!IsOpen()) {

node::THROW_ERR_INVALID_STATE(env, "database is not open");

return env.Undefined();

}

if (info.Length() < 1 || !info[0].IsString()) {

node::THROW_ERR_INVALID_ARG_TYPE(env,

"The \"sql\" argument must be a string.");

return env.Undefined();

}

std::string sql = info[0].As<Napi::String>().Utf8Value();

// Clear any stale deferred exception from a previous operation

ClearDeferredAuthorizerException();

SetIgnoreNextSQLiteError(false);

char *error_msg = nullptr;

int result =

sqlite3_exec(connection(), sql.c_str(), nullptr, nullptr, &error_msg);

if (result != SQLITE_OK) {

// Check for deferred authorizer exception first

if (HasDeferredAuthorizerException()) {

if (error_msg)

sqlite3_free(error_msg);

std::string deferred_msg = GetDeferredAuthorizerException();

ClearDeferredAuthorizerException();

SetIgnoreNextSQLiteError(false);

// Use c_str() explicitly to avoid potential ABI issues on Windows ARM

Napi::Error::New(env, deferred_msg.c_str()).ThrowAsJavaScriptException();

return env.Undefined();

}

std::string error = error_msg ? error_msg : "Unknown SQLite error";

if (error_msg)

sqlite3_free(error_msg);

// Use enhanced error throwing with database handle

node::ThrowSqliteError(env, connection(), error);

}

return env.Undefined();

Napi::Env env = info.Env();

if (!IsOpen()) {

node::THROW_ERR_INVALID_STATE(env, "database is not open");

return env.Undefined();

}

// Default to "main" if no dbName provided

std::string db_name = "main";

if (info.Length() > 0 && !info[0].IsUndefined()) {

if (!info[0].IsString()) {

node::THROW_ERR_INVALID_ARG_TYPE(

env, "The \"dbName\" argument must be a string.");

return env.Undefined();

}

db_name = info[0].As<Napi::String>().Utf8Value();

}

// Use sqlite3_db_filename() to get the database file path

const char *filename = sqlite3_db_filename(connection(), db_name.c_str());

// Return null for in-memory databases, non-existent databases, or if database

// not found

if (filename == nullptr || strlen(filename) == 0) {

return env.Null();

}

return Napi::String::New(env, filename);

Napi::Env env = info.Env();

if (!IsOpen()) {

node::THROW_ERR_INVALID_STATE(env, "database is not open");

return env.Undefined();

}

// Check if we're in a transaction

bool in_transaction = !sqlite3_get_autocommit(connection());

return Napi::Boolean::New(env, in_transaction);

// Store configuration for later use by statements

config_ = std::move(config);

location_ = config_.location();

read_only_ = config_.get_read_only();

int flags = SQLITE_OPEN_CREATE;

if (read_only_) {

flags = SQLITE_OPEN_READONLY;

} else {

flags |= SQLITE_OPEN_READWRITE;

}

// Add URI flag when location contains URI parameters

if (config_.get_open_uri()) {

flags |= SQLITE_OPEN_URI;

}