@hugomrdias/foxer 0.0.1

package/hello/apps/foc-app/wrangler.jsonc

@@ -0,0 +1,50 @@
+/**
+ * For more details on how to configure Wrangler, refer to:
+ * https://developers.cloudflare.com/workers/wrangler/configuration/
+ */
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "ucan-store",
+  "main": "worker/index.ts",
+  "compatibility_date": "2025-07-19",
+  "assets": {
+    "not_found_handling": "single-page-application"
+  },
+  "observability": {
+    "enabled": true
+  }
+  /**
+   * Smart Placement
+   * Docs: https://developers.cloudflare.com/workers/configuration/smart-placement/#smart-placement
+   */
+  // "placement": { "mode": "smart" },
+
+  /**
+   * Bindings
+   * Bindings allow your Worker to interact with resources on the Cloudflare Developer Platform, including
+   * databases, object storage, AI inference, real-time communication and more.
+   * https://developers.cloudflare.com/workers/runtime-apis/bindings/
+   */
+
+  /**
+   * Environment Variables
+   * https://developers.cloudflare.com/workers/wrangler/configuration/#environment-variables
+   */
+  // "vars": { "MY_VARIABLE": "production_value" },
+  /**
+   * Note: Use secrets to store sensitive data.
+   * https://developers.cloudflare.com/workers/configuration/secrets/
+   */
+
+  /**
+   * Static Assets
+   * https://developers.cloudflare.com/workers/static-assets/binding/
+   */
+  // "assets": { "directory": "./public/", "binding": "ASSETS" },
+
+  /**
+   * Service Bindings (communicate between multiple Workers)
+   * https://developers.cloudflare.com/workers/wrangler/configuration/#service-bindings
+   */
+  // "services": [{ "binding": "MY_SERVICE", "service": "my-service" }]
+}

package/hello/biome.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://biomejs.dev/schemas/latest/schema.json",
+  "vcs": {
+    "enabled": false,
+    "clientKind": "git",
+    "useIgnoreFile": false
+  },
+  "files": {
+    "ignoreUnknown": false
+  },
+  "formatter": {
+    "enabled": true,
+    "formatWithErrors": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineEnding": "lf",
+    "lineWidth": 80,
+    "attributePosition": "auto",
+    "includes": ["**"]
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "jsxQuoteStyle": "double",
+      "quoteProperties": "asNeeded",
+      "trailingCommas": "es5",
+      "semicolons": "asNeeded",
+      "arrowParentheses": "always",
+      "bracketSpacing": true,
+      "bracketSameLine": false,
+      "quoteStyle": "single",
+      "attributePosition": "auto"
+    },
+    "globals": ["document", "navigator", "window"]
+  },
+  "assist": {
+    "enabled": true,
+    "actions": {
+      "source": {
+        "organizeImports": "on",
+        "useSortedAttributes": "on"
+      }
+    }
+  }
+}

package/hello/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "hello",
+  "version": "0.0.0",
+  "description": "",
+  "main": "index.js",
+  "private": true,
+  "workspaces": [
+    "apps/*",
+    "packages/*"
+  ],
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "lint": "pnpm -r --if-present run lint",
+    "build": "pnpm -r --if-present run build",
+    "lint:fix": "biome check --write ."
+  },
+  "keywords": [],
+  "license": "MIT",
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.5"
+  }
+}

package/hello/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages:
+  - 'apps/*'
+  - 'packages/*'

package/hello/tsconfig.json

@@ -0,0 +1,37 @@
+{
+  "compilerOptions": {
+    /* Projects */
+    "incremental": true,
+    "composite": true,
+    // Emit
+
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "removeComments": true,
+
+    // Language and Environment
+    "lib": ["ESNext", "DOM"],
+    "target": "ESNext",
+    "moduleDetection": "force",
+
+    // Modules
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "resolveJsonModule": true,
+    "rewriteRelativeImportExtensions": true,
+
+    // Interop Constraints
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "erasableSyntaxOnly": true,
+    "esModuleInterop": true,
+
+    // Type Checking
+    "strict": true,
+    "noImplicitOverride": true,
+
+    // Completeness
+    "skipLibCheck": true
+  }
+}

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@hugomrdias/foxer",
+  "description": "Foxer is a all-in-one application server for Filecoin.",
+  "version": "0.0.1",
+  "author": "Hugo Dias <hugomrdias@gmail.com>",
+  "license": "Apache-2.0 OR MIT",
+  "type": "module",
+  "sideEffects": false,
+  "bin": {
+    "foxer": "./dist/src/bin/index.js"
+  },
+  "main": "dist/src/index.js",
+  "module": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./api": {
+      "types": "./dist/src/api/index.d.ts",
+      "default": "./dist/src/api/index.js"
+    },
+    "./schema": {
+      "types": "./dist/src/schema.d.ts",
+      "default": "./dist/src/schema.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "api": [
+        "./src/api/index"
+      ],
+      "schema": [
+        "./src/schema"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "lint": "tsc --build && biome check ."
+  },
+  "dependencies": {
+    "@bluwy/giget-core": "^0.1.6",
+    "@clack/prompts": "^1.1.0",
+    "@electric-sql/pglite": "^0.3.8",
+    "@hono/node-server": "^1.19.5",
+    "@libpg-query/parser": "^17.6.3",
+    "@pgsql/traverse": "^17.2.4",
+    "abitype": "^1.2.3",
+    "cleye": "^2.2.1",
+    "dotenv": "^17.2.3",
+    "drizzle-orm": "1.0.0-beta.15-859cf75",
+    "exit-hook": "^5.1.0",
+    "hono": "^4.10.6",
+    "hono-pino": "^0.10.3",
+    "http-shutdown": "^1.2.2",
+    "lilconfig": "^3.1.3",
+    "p-queue": "^9.1.0",
+    "pg": "^8.19.0",
+    "picocolors": "^1.1.1",
+    "pino": "^10.3.1",
+    "postgres": "^3.4.8",
+    "scule": "^1.3.0",
+    "zod": "^4.1.11"
+  },
+  "devDependencies": {
+    "@pgsql/types": "^17.6.2",
+    "@types/node": "^25.3.3",
+    "@types/pg": "^8.18.0",
+    "type-fest": "^5.4.4",
+    "typescript": "^5.9.2"
+  },
+  "peerDependencies": {
+    "hono": ">=4.5",
+    "viem": ">=2"
+  }
+}

package/src/api/index.ts

@@ -0,0 +1 @@
+export { sqlMiddleware } from './sql-middleware.ts'

package/src/api/runner.ts

@@ -0,0 +1,43 @@
+import { serve } from '@hono/node-server'
+import shutdown from 'http-shutdown'
+import type { InternalConfig } from '../config/config.ts'
+import type { Database } from '../db/client.ts'
+import type { Logger } from '../utils/logger.ts'
+import { createApiServer } from './server.ts'
+
+export function bootstrapApiServer(options: {
+  db: Database
+  config: InternalConfig
+  logger: Logger
+  port: number
+}): { stop: () => void } {
+  const app = createApiServer({
+    logger: options.logger,
+    db: options.db,
+    config: options.config,
+  })
+
+  const server = serve(
+    {
+      fetch: app.fetch,
+      port: options.port,
+    },
+    () => {
+      options.logger.info({ port: options.port }, 'api server listening')
+    }
+  )
+
+  const _server = shutdown(server)
+
+  return {
+    stop: () => {
+      _server.shutdown((error) => {
+        if (error) {
+          options.logger.error({ error }, 'api server shutdown failed')
+          return
+        }
+        options.logger.info('api server shutdown complete')
+      })
+    },
+  }
+}

package/src/api/server.ts

@@ -0,0 +1,38 @@
+import { Hono } from 'hono'
+import { type PinoLogger, pinoLogger } from 'hono-pino'
+import type { InternalConfig } from '../config/config.ts'
+import type { Database } from '../db/client.ts'
+import type { Logger } from '../utils/logger.ts'
+
+/**
+ * Builds the Hono API server with health and sql endpoints.
+ */
+export function createApiServer({
+  db,
+  config,
+  logger,
+}: {
+  db: Database
+  config: InternalConfig
+  logger: Logger
+}) {
+  const app = new Hono<{ Variables: { logger: PinoLogger } }>()
+
+  app.use(
+    pinoLogger({
+      pino: logger,
+    })
+  )
+
+  app.get('/health', async (c) => {
+    const latest =
+      (await db.$prepared.getLatestBlock.execute())[0]?.number ?? null
+    return c.json({
+      ok: true,
+      latestIndexedBlock: latest?.toString() ?? null,
+    })
+  })
+
+  app.route('/', config.hono({ logger, db }))
+  return app
+}

package/src/api/sql-middleware.ts

@@ -0,0 +1,131 @@
+import type { QueryWithTypings } from 'drizzle-orm'
+import { createMiddleware } from 'hono/factory'
+import { streamSSE } from 'hono/streaming'
+import postgres from 'postgres'
+import { PUBLICATION_NAME } from '../contants.ts'
+import type { Database } from '../db/client.ts'
+import type { Logger } from '../utils/logger.ts'
+import { executeSql, validateSql } from './sql.ts'
+import { sseError } from './sse.ts'
+
+const MAX_LIVE_QUERIES = 1000
+
+export function sqlMiddleware({
+  db,
+  logger,
+}: {
+  db: Database
+  logger: Logger
+}) {
+  let pg: postgres.Sql | undefined
+  const databaseUrl = process.env.DATABASE_URL
+
+  if (databaseUrl && typeof databaseUrl === 'string') {
+    // TODO: kill gracefully
+    pg = postgres(databaseUrl, {
+      publications: PUBLICATION_NAME,
+    })
+  }
+
+  let liveQueryCount = 0
+
+  return createMiddleware(async (c, next) => {
+    // SQL over HTTP endpoint
+    if (c.req.path === '/sql/db') {
+      const queryString = c.req.query('sql')
+      if (!queryString) {
+        return c.json({ error: 'sql query is required' }, 400)
+      }
+      const query = JSON.parse(queryString) as QueryWithTypings
+
+      const result = await validateSql(query)
+      if (result.error) {
+        return c.json({ error: result.error.message }, 400)
+      }
+
+      const dbResult = await executeSql({ db, query })
+
+      if (dbResult.error) {
+        return c.json({ error: dbResult.error.message }, 500)
+      }
+      return c.json(dbResult.result, 200)
+    }
+
+    // Live SQL over SSE endpoint
+    if (c.req.path === '/sql/live') {
+      if (liveQueryCount >= MAX_LIVE_QUERIES) {
+        return sseError(c, 'Too many live queries')
+      }
+
+      const queryString = c.req.query('sql')
+      if (!queryString) {
+        return sseError(c, 'SQL query is required')
+      }
+      const query = JSON.parse(queryString) as QueryWithTypings
+
+      const result = await validateSql(query)
+      if (result.error) {
+        return sseError(c, result.error.message)
+      }
+
+      const tables = result.result
+
+      const dbResult = await executeSql({ db, query })
+
+      if (dbResult.error) {
+        return sseError(c, dbResult.error.message)
+      }
+
+      if (!pg) {
+        return sseError(
+          c,
+          'Database connection not established. Please check your DATABASE_URL environment variable.'
+        )
+      }
+
+      const subscriptions: (() => void)[] = []
+      liveQueryCount++
+
+      return streamSSE(
+        c,
+        async (stream) => {
+          stream.onAbort(() => {
+            liveQueryCount--
+            logger.trace('stream aborted')
+            subscriptions.forEach((unsubscribe) => {
+              unsubscribe()
+            })
+          })
+
+          stream.writeSSE({
+            data: JSON.stringify(dbResult.result),
+          })
+
+          for (const table of tables) {
+            const sub = await pg.subscribe(`*:${table}`, async () => {
+              const dbResult = await executeSql({ db, query })
+              stream.writeSSE({
+                data: JSON.stringify(dbResult.result),
+              })
+            })
+            subscriptions.push(sub.unsubscribe)
+          }
+
+          while (stream.closed === false && stream.aborted === false) {
+            // keep the stream alive
+            await stream.sleep(1000)
+          }
+        },
+        (error) => {
+          logger.error({ error }, 'stream error')
+          subscriptions.forEach((unsubscribe) => {
+            unsubscribe()
+          })
+          return Promise.resolve(undefined)
+        }
+      )
+    }
+
+    return next()
+  })
+}

package/src/api/sql.ts

@@ -0,0 +1,149 @@
+import { PGlite } from '@electric-sql/pglite'
+import {
+  type A_Const,
+  type Node,
+  parse,
+  type RawStmt,
+} from '@libpg-query/parser'
+import type { Visitor } from '@pgsql/traverse'
+import { walk } from '@pgsql/traverse'
+import type { QueryWithTypings } from 'drizzle-orm'
+import { Pool } from 'pg'
+import type { Database } from '../db/client'
+import type { MaybeResult } from '../types'
+
+// biome-ignore lint/style/noNonNullAssertion: we know the node is not null
+const getNodeType = (node: Node) => Object.keys(node)[0]!
+
+export async function parseSql(
+  sql: string
+): Promise<MaybeResult<{ node: Node; tables: string[] }>> {
+  let result: { stmts: RawStmt[] } | undefined
+  const tables: string[] = []
+
+  // Using a visitor object (recommended for multiple node types)
+  const visitor: Visitor = {
+    RangeVar: (path) => {
+      tables.push(path.node.relname)
+    },
+  }
+
+  try {
+    result = (await parse(sql)) as { stmts: RawStmt[] }
+    walk(result, visitor)
+  } catch (error) {
+    return { error: new Error('Failed to parse SQL', { cause: error }) }
+  }
+
+  if (result?.stmts.length === 0) {
+    return { error: new Error('No statement found') }
+  }
+
+  if (result?.stmts?.length && result.stmts.length > 1) {
+    return { error: new Error('Only one statement is allowed') }
+  }
+
+  const stmt = result?.stmts[0]
+  if (stmt?.stmt == null) {
+    return { error: new Error('Invalid statement') }
+  }
+
+  const node = stmt.stmt
+  return { result: { node, tables } }
+}
+
+export async function validateSql(
+  query: QueryWithTypings
+): Promise<MaybeResult<string[]>> {
+  const { sql, params } = query
+  const result = await parseSql(sql)
+  if (result.error) {
+    return result
+  }
+
+  const { node, tables } = result.result
+
+  const nodeType = getNodeType(node)
+
+  if (nodeType !== 'SelectStmt') {
+    return { error: new Error('Only select statements are allowed') }
+  }
+
+  if (!('SelectStmt' in node)) {
+    return { error: new Error('Invalid statement') }
+  }
+  const selectStmt = node.SelectStmt
+
+  if (selectStmt.lockingClause || selectStmt.intoClause) {
+    return { error: new Error('Locking or into clauses are not allowed') }
+  }
+  if (selectStmt.withClause?.recursive) {
+    return { error: new Error('Recursive with clauses are not allowed') }
+  }
+
+  if (!selectStmt.limitCount) {
+    return { error: new Error('Limit is required') }
+  }
+
+  let limit: number | undefined
+
+  if ('ParamRef' in selectStmt.limitCount) {
+    const limitIndex = selectStmt.limitCount.ParamRef.number as number
+    const _limit = params[limitIndex - 1]
+    if (typeof _limit === 'number') {
+      limit = _limit
+    }
+  }
+
+  if ('A_Const' in selectStmt.limitCount) {
+    const aConst = selectStmt.limitCount.A_Const as A_Const
+    limit = aConst.ival?.ival ?? 0
+  }
+  if (typeof limit !== 'number' || limit < 1) {
+    return {
+      error: new Error('Limit is required and must be a number greater than 0'),
+    }
+  }
+
+  if (limit > 100) {
+    return { error: new Error('Limit is too large (max 100)') }
+  }
+
+  return { result: tables }
+}
+
+export async function executeSql({
+  db,
+  query,
+}: {
+  db: Database
+  query: QueryWithTypings
+}): Promise<MaybeResult<unknown>> {
+  try {
+    let dbResult: unknown | undefined
+    if (db.$client instanceof PGlite) {
+      dbResult = await db._.session
+        .prepareQuery(query, undefined, undefined, false)
+        .execute()
+    }
+    if (db.$client instanceof Pool) {
+      dbResult = await db.transaction(
+        (tx) => {
+          return tx._.session
+            .prepareQuery(query, undefined, undefined, false)
+            .execute()
+        },
+        { accessMode: 'read only' }
+      )
+    }
+
+    if (dbResult == null) {
+      return { error: new Error('Empty result') }
+    }
+    return { result: dbResult }
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error : new Error('Unknown error'),
+    }
+  }
+}

package/src/api/sse.ts

@@ -0,0 +1,12 @@
+import type { Context } from 'hono'
+import { streamSSE } from 'hono/streaming'
+
+export function sseError(c: Context, message: string) {
+  return streamSSE(c, async (stream) => {
+    await stream.writeSSE({
+      event: 'error',
+      data: message,
+    })
+    return stream.close()
+  })
+}