Import & Export

import and export move data between DuckDB tables and columnar files. import creates a table from a data file (or glob); export copies a query’s result to a file. Both are gated by the path scope and allow_path policy because they touch the filesystem.

DataFormat

Both commands take a format of 'parquet' | 'csv' | 'json':

type DataFormat = 'parquet' | 'csv' | 'json'

import

Create table from a data file by reading it through DuckDB’s auto-reader for the format.

await db.import('sales', 'data/2026-*.parquet', 'parquet')

Signature: import(table: string, source: string, format: DataFormat): Promise<ExecuteResult>.
source may be a path or a glob. The backend runs CREATE TABLE <table> AS SELECT * FROM <reader>(<source>), where the reader is:
Format Reader
parquet read_parquet
csv read_csv_auto (schema auto-detected)
json read_json_auto (schema auto-detected)
ExecuteResult.rowsAffected is the number of rows inserted.

Format	Reader
`parquet`	`read_parquet`
`csv`	`read_csv_auto` (schema auto-detected)
`json`	`read_json_auto` (schema auto-detected)

Typed helpers

await db.importParquet('sales', 'data/2026-*.parquet')
await db.importCsv('t', 'in.csv')
await db.importJson('t', 'in.json')

These are thin wrappers that call import with the format fixed.

export

Copy a query’s result to a file.

await db.export('SELECT * FROM sales WHERE region = $1', 'out.parquet', 'parquet')

export’s query argument does not accept bound parameters — it is embedded into a COPY (<query>) TO <path> (FORMAT …) statement. Inline literal predicates, and never concatenate untrusted webview input into query.

Signature: export(query: string, path: string, format: DataFormat): Promise<ExecuteResult>.
The backend runs COPY (<query>) TO '<path>' (FORMAT <PARQUET|CSV|JSON>).

Typed helpers

await db.exportParquet('SELECT * FROM sales', 'out.parquet')
await db.exportCsv('SELECT * FROM sales', 'out.csv')

(There is no exportJson helper; call export(query, path, 'json') directly.)

Safety and gotchas

The table name is validated as a bare SQL identifier (ASCII alphanumeric + _); anything else is rejected with backend error: invalid table identifier: …. The source/path strings are quoted as SQL literals, and the path is checked against the path scope and allow_path policy.

import is a write (CREATE TABLE), so it is rejected under read_only(true). export is a read of the source table but still writes a file, so it is not blocked by read_only — it is gated only by the path checks and the statement filter.
Path scope applies to the file argument: import’s source and export’s path. If a capability declares path allow entries, the value must match a whole-component prefix (and .. traversal is rejected). The allow_path policy applies the same constraint at init time. See Scope & Policy.
Relative paths resolve against the app’s working directory. In the example app the capability scopes both to data/.

{
  "identifier": "better-duck-tauri:allow-import",
  "allow": [{ "path": "data/" }]
}

Getting Started

Frontend API

Backends & Persistence

Security

DataFormat

import

Typed helpers

export

Typed helpers

Safety and gotchas

See also

​DataFormat

​import

​Typed helpers

​export

​Typed helpers

​Safety and gotchas

​See also

DataFormat

import

Typed helpers

export

Typed helpers

Safety and gotchas

See also