Datasette plugin adds API for uploading and swapping SQLite databases

The change is a formal API endpoint that replaces the previous ad-hoc upload mechanism. Instead of relying on manual file drops or custom scripts, engineers can now send a SQLite file to a predictable URL. The endpoint handles the entire lifecycle: saving the file, validating it, and swapping it into the running Datasette instance without restarting the process. This removes the need for shell access or direct filesystem manipulation on the host machine.

Adopting the API costs a one-time setup of an API token and a small change to deployment scripts. The token must be generated and stored securely, and any CI/CD pipeline must be updated to include the curl command or equivalent HTTP client call. There is no runtime overhead beyond the existing plugin, but the API does introduce a new attack surface: unauthenticated POST requests to the upload endpoint. Rate limiting or IP restrictions may be needed in public-facing instances.

The API stops working if the SQLite file is corrupt or if the Datasette instance is not configured to accept uploads. The plugin does not perform schema migrations or data consistency checks beyond basic file integrity. If the uploaded database has a different schema than the application expects, queries may fail silently or return unexpected results. Engineers must ensure that the database they upload is compatible with the queries the application will run against it.

The atomic swap mechanism ensures that the old database remains available until the new one is fully verified. This prevents downtime but does not prevent data loss if the new database is incomplete or incorrect. Engineers should test the uploaded database in a staging environment before swapping it into production. The API does not provide rollback functionality; if the new database is faulty, the engineer must upload a corrected version or manually revert to the previous file.