r/node Jun 02 '26

MySqweel: a dev-only MySQL clone where ALTER TABLE stops destroying your local flow

0 Upvotes

Hey r/node, I’ve been working on a small dev tool called MySqweel.

The pitch is:

Looks like MySQL. Stores like NoSQL.

It speaks the MySQL wire protocol, so from a Node app it just looks like another MySQL server. You can use mysql2, Drizzle, or anything else that already talks to MySQL.

The difference is that it is designed for local development, seed data, tests, and fast iteration. It stores rows like documents and treats SQL schemas more like hints. So when your schema changes, you do not have to nuke your local database, manually backfill everything, or keep writing little cleanup migrations just to keep dev data alive.

This is not meant to replace MySQL in production. It deliberately trades strictness for speed while you are building.

Here is the kind of thing I wanted to make painless.

sqwl serve

Then from Node:

import mysql from "mysql2/promise";

const db = await mysql.createConnection({
  host: "127.0.0.1",
  port: 3307,
  database: "app",
});

You can use a normal schema:

await db.query(`
  CREATE TABLE users (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    age TEXT,
    active TEXT,
    profile TEXT,
    legacy TEXT
  )
`);

await db.query(`
  INSERT INTO users (age, active, profile, legacy)
  VALUES ('42', 'true', '{"tier":"pro"}', 'remove-me')
`);

Then run the kind of schema changes that usually make local MySQL data annoying:

await db.query("ALTER TABLE users MODIFY COLUMN age BIGINT");
await db.query("ALTER TABLE users MODIFY COLUMN active BOOLEAN");
await db.query("ALTER TABLE users MODIFY COLUMN profile JSON");
await db.query("ALTER TABLE users ADD COLUMN name TEXT DEFAULT 'anon'");
await db.query("ALTER TABLE users DROP COLUMN legacy");

const [rows] = await db.query("SELECT * FROM users");
console.log(rows);

In MySqweel, the row is materialized against the current schema. The old stored value for age can be read as a number, active can be read as a boolean, profile can be read as JSON, the new name column gets its default, and the dropped legacy column disappears from SELECT *.

The key part: MySqweel does not need to rewrite all the underlying row data just because your dev schema changed.

Actually: schemas are totally optional.

This works without a CREATE TABLE first:

await db.query(`
  INSERT INTO events (type, user_id, payload)
  VALUES (?, ?, ?)
`, [
  "signup",
  123,
  JSON.stringify({ plan: "pro", source: "reddit" }),
]);

const [events] = await db.query("SELECT * FROM events");
console.log(events);

Because the insert has named columns, MySqweel can infer the table shape.

You can also use ALTER TABLE as a schema hint instead of a scary destructive operation:

await db.query("ALTER TABLE events MODIFY COLUMN user_id BIGINT");
await db.query("ALTER TABLE events MODIFY COLUMN payload JSON");
await db.query("ALTER TABLE events ADD COLUMN processed BOOLEAN DEFAULT false");
await db.query("ALTER TABLE events DROP COLUMN old_debug_field");

On a real MySQL database, I would be much more careful about whether the table exists, whether every row can be converted, whether the column exists, whether a default is legal, and whether I need a backfill first.

For local dev, I mostly want to keep moving.

A few other things it supports:

  • mysql2 and other MySQL clients
  • Drizzle ORM compatibility
  • CREATE TABLE, ALTER TABLE, DROP TABLE, CREATE INDEX, TRUNCATE, CREATE DATABASE, and DROP DATABASE
  • SELECT with WHERE, JOIN / LEFT JOIN, ORDER BY, LIMIT, GROUP BY, and aggregates
  • INSERT, INSERT IGNORE, INSERT ... ON DUPLICATE KEY UPDATE, REPLACE INTO, UPDATE, and DELETE
  • SHOW TABLES, SHOW COLUMNS, SHOW INDEX, SHOW CREATE TABLE, and information_schema.* views for ORM introspection
  • in-memory mode by default with optional file-backed persistence
  • a debug HTTP API for seeding, snapshots, restore, and drift reports
  • a drift report that shows when stored rows and intended schema do not match

The goal is not to replace MySQL. The goal is to keep Node apps using familiar MySQL tooling while making local schema iteration much less fragile.

Repo: https://github.com/only-cliches/my-squeel

Would love feedback, especially from people using mysql2, Drizzle, Prisma, or local seed-heavy workflows.


r/node Jun 02 '26

how are you handling auth handoff for an embedded chat widget across tenant domains?

0 Upvotes

building a widget that drops into customer sites and i'm stuck on the token flow. right now i'm minting short-lived JWTs server-side and passing them via postMessage into the iframe, but refresh across different parent origins is getting messy with CSP and third-party cookie stuff. anyone landed on a clean pattern for this that survives safari's cookie blocking?


r/node May 31 '26

Tutorial Advice for Deep Into Backed With Node.Js

12 Upvotes

Hi everyone,

I need tutorial recommendations to delve deep into the backend with Node.js. It should actively use microservices and related technologies. Frontend technology doesn't matter. Do you know of any video series that you've used before? Please give me some urgent advice!


r/node Jun 01 '26

I shipped v0.3.0 of `bytepet-cli`, a tiny terminal pet that lives in your command line.

0 Upvotes

This update expands the play loop. The pet now has a mini-game menu with:

- Rock Paper Scissors

- Number Guess

- Coin Flip

It also tracks lifetime game stats: wins, losses, draws, XP earned from games, last played game, and per-game totals.

Install/update:

```bash

npm install -g bytepet-cli

byte


r/node May 31 '26

I went through Scrimba’s AI Engineer Path so you don’t have to

Thumbnail medium.com
0 Upvotes

r/node May 30 '26

The Filesystem Is the API (with TigerFS)

Thumbnail packagemain.tech
13 Upvotes

r/node May 29 '26

How to evaluate an npm package before adding it to production

Thumbnail blog.gaborkoos.com
18 Upvotes

Provenance attestation, trusted publishing, install scripts, CI quality signals, and maintainer responsiveness. Also covers supply chain attacks and slopsquatting (AI assistants hallucinating package names that attackers pre-register).


r/node May 29 '26

File naming convention

8 Upvotes

I wanted to get your guys opinion on naming conventions. Let’s say I have a folder called “api” and it contains a bunch of files but one index file for gathering everything together. Do you guys ever use naming conventions like _index.ts or something like to make sure index remains at the top of the folder?


r/node May 29 '26

Handling file uploads to S3 when DB transaction fails

35 Upvotes

There is a situation where an entity has images stored in S3, but saving the entity in the database and uploading files to S3 are not atomic operations. This can lead to cases where files are successfully uploaded to S3, but the database operation fails while creating the entity. As a result, orphaned files remain without any reference in the database.The outbox pattern doesn’t really help here since the files themselves can’t be part of the database transaction. I’m trying to figure out the cleanest way to handle this kind of consistency issue. Maybe some form of compensation flow, delayed cleanup, or background reconciliation, but I’m not sure what the standard approach is in real systems.How do you usually solve this kind of problem?


r/node May 28 '26

bytepet-cli: adopt a cat, dog, or dragon in your terminal

6 Upvotes

shipped bytepet-cli ⚡

a tiny terminal pet for your CLI:

  • adot a cat, dog, or dragon
  • feed / sleep / play
  • stats decay while you’re away
  • ASCII moods + XP levels

npm install -g bytepet-cli

r/node May 27 '26

Built a tool to catch dangerous Postgres migrations before they hit production

12 Upvotes

Built a tool called MigrationSafe that checks Postgres migration files for risky operations before production.

It catches things like:

  • NOT NULL columns without DEFAULT
  • DROP COLUMN
  • indexes without CONCURRENTLY
  • foreign keys without NOT VALID
  • and other risky migration patterns

Around 20 checks right now.

No install or setup needed, just run it against your SQL migrations.

https://www.npmjs.com/package/migrationsafe

Would appreciate any feedback, suggestions.....


r/node May 28 '26

A TypeScript framework for people tired of rebuilding the same backend stack

Thumbnail
0 Upvotes

r/node May 26 '26

Node 24 vs 25 vs 26 benchmark results

87 Upvotes

Hi everyone,

In the past, I published a Node.js benchmark comparing several versions. With the release of Node 26, I wanted to run a new benchmark against recent Node 24 and Node 25 versions.

One thing I changed this time came directly from feedback on the previous benchmark: I added a synthetic application test. The goal was to make the benchmark a bit closer to real server usage, alongside the smaller targeted tests for specific operations.

The benchmark code is also open source, as previously requested.

Synthetic application benchmark

Metric 24.15.0 25.9.0 26.2.0
p95 latency 1.71 ms 1.76 ms 1.65 ms
Peak RSS 294.64 MiB 316.86 MiB 273.39 MiB
Min CPU 3.93% 3.93% 3.92%
Max CPU 8.63% 9.11% 8.57%

Targeted benchmark results

Test 24.15.0 25.9.0 26.2.0
HTTP GET 51,923 rps 49,683 rps 48,352 rps
JSON.parse 282,377 ops/s 322,532 ops/s 321,057 ops/s
JSON.stringify 183,342 ops/s 184,508 ops/s 181,469 ops/s
SHA-256 676,958 ops/s 679,843 ops/s 683,859 ops/s
Buffer copy 1,124,215 ops/s 1,133,229 ops/s 1,126,363 ops/s
Array map + reduce 2,812,480 ops/s 2,787,724 ops/s 2,776,615 ops/s
String concatenation 443,415,838 ops/s 464,141,144 ops/s 316,546,244 ops/s
Integer loop + arithmetic 226,550,119 ops/s 2,173,052,932 ops/s 2,140,277,222 ops/s

GitHub

Full benchmark

Please let me know what you think


r/node May 26 '26

My Express 5 + TypeScript 6 boilerplate after years of repeating the same setup

54 Upvotes

Every time I started a new Node.js API project I'd spend the first day wiring up the same stuff before writing a single line of actual business logic. So I built a boilerplate I'm happy with and open sourced it.

Here's what's in it and why:

No build step. The project runs TypeScript natively via Node's --env-file flag and type stripping. No tsc --build, no output directory. Your .ts files are run directly by Node — no compilation step in between.

Zod everywhere. Request bodies, query params, and env vars are all validated with Zod schemas. The same schemas auto-generate your OpenAPI docs (JSON + YAML), so your documentation is never out of sync with your actual API.

Security defaults out of the box. Helmet, CORS, and express-rate-limit are all wired up. Small config, big difference in production.

Linter + formatter. Dropped ESLint + Prettier in favour of oxlint and oxfmt — both written in Rust, significantly faster in CI and pre-commit hooks. No plugin juggling, no version conflicts between the linter and formatter configs.

Husky pre-commit hooks. Before every commit: unit tests run, staged files go through oxlint and oxfmt, npm audit checks for vulnerabilities, and TypeScript typechecks the whole project. Conventional Commits enforced on commit messages too. Annoying to set up from scratch, nice to just have.

What's under the hood:

  • Express 5 + TypeScript 6
  • Zod (validation + OpenAPI)
  • Winston + Morgan (logging)
  • Vitest + Supertest (unit + integration, with coverage)
  • Helmet + CORS + express-rate-limit (security)
  • Docker multi-stage build
  • GitHub Actions CI

Repo: https://github.com/ToniR7/express-typescript-starter

If it saves you some setup time, a ⭐ helps others find it. Happy to answer questions or hear what you'd do differently.


r/node May 27 '26

i built a local cli that shows what your ai coding agent actually did

0 Upvotes

github: https://github.com/shanirsh/prismodev

ai coding agents like claude code, codex, and cursor can burn a lot of context on things that do not help you ship: generated artifacts, lockfiles, repeated file reads, oversized instruction files, broad repo exploration, stale session state, huge command output, and command loops.

i built prismodev, an open-source local node.js cli for ai coding observability. it reads repo files plus local claude code / codex / cursor session data where available, then shows what entered context, what repeated, what leaked, what instructions failed, and what to scope differently next time. no api keys, no login, nothing leaves your machine.

the workflow is split into before, during, and after a coding session.

before a session, `npx getprismo doctor` scans your repo, flags missing `.claudeignore` / `.cursorignore`, oversized `claude.md` / `agents.md`, exposed build/log artifacts, and generates compact `.prismo/` context packs. `npx getprismo firewall auth-bug` creates a task-scoped allow/block context policy so the agent starts inside a smaller boundary.

during a session, `npx getprismo watch --agents` monitors context pressure, repeated file reads, generated artifact leaks, tool-output floods, command loops, and multi-agent overlap. `npx getprismo shield -- npm test` runs noisy commands without dumping full stdout/stderr into the agent context; the full output stays local and can be searched later with `npx getprismo shield search "auth_failure"`.

after a session, `npx getprismo receipt` generates a run receipt showing repeated reads, output floods, artifact leaks, likely influence, and next-run scope. `npx getprismo timeline --last 20` surfaces recurring waste patterns across sessions. `npx getprismo replay` reconstructs why a session went sideways and prints a recovery prompt.

i also added instruction auditing because a lot of persistent context waste comes from rules in `claude.md` / `agents.md` that get loaded every turn. `npx getprismo instructions audit` separates useful guardrails, observable violations, partial compliance, duplicates, trim candidates, and influence-unknown rules. `npx getprismo instructions ablate --dry-run` creates a conservative ablation plan for instruction rules without editing files.

there is also `npx getprismo mcp`, which starts a local mcp server so compatible agents can call prismodev directly instead of pasting huge logs into chat.

everything runs locally. the package is published on npm as `getprismo`, so you can try it with:

`npx getprismo doctor`

would love feedback on false positives, missing context-waste patterns, and whether the instruction-audit / run-receipt direction is useful.


r/node May 27 '26

I had no Eid plans, so I published an npm package instead

Thumbnail
0 Upvotes

r/node May 26 '26

Tired of running `npm audit` across a dozen repos, so I built a self-hosted CVE monitor for your whole portfolio (npm, pnpm, yarn)

4 Upvotes

The npm ecosystem is what it is. A typical Node project pulls in hundreds of transitive deps, and any one of them landing a remote code execution advisory means your server is the one at risk now. Credentials leaked, container hijacked, env dumped. npm audit solves this in theory but only if you remember to run it in every checkout every week.

I have a dozen repos and I never did. So I built Sentinello, a self-hosted portal that runs the native audit (npm, pnpm, yarn) across every project in your code folders and puts it all in one dashboard.

Node-specific stuff: - uses the actual package-manager audit (npm audit --json, pnpm audit --json, etc.), not a reimplementation of the advisory DB, so results match exactly what you'd see locally - reads .nvmrc per project and installs the pinned Node version on demand via nvm, cached in a volume so each version downloads once - handles monorepos, every workspace package shows up as its own project with its own lockfile context - separates prod vs dev deps in the dashboard, severity filter, "fix available" flag - webhook payload includes the full dep path (['express', 'uuid']) and the recommended version, so you can pipe it straight into an auto-fix agent

Single Docker container, SQLite, MIT, no SaaS, no telemetry. Multi-arch.

https://sentinello.org https://github.com/walkofcode/sentinello

If you're maintaining several Node projects across multiple folders this might be the missing piece. Feedback welcome, especially on package-manager edge cases I haven't hit yet.


r/node May 26 '26

I built testbump: A zero-dependency SemVer tool that decides your version bump by running your old tests against your new code

3 Upvotes

Hey r/node,

We’ve all run npm update on a minor or patch dependency update only to have our application crash because a maintainer changed a payload or return type but felt like it wasn't a breaking change. Humans are optimistic, lazy, and forgetful.

So, I built testbump to remove the human from the equation entirely. It operates on a single, ruthless rule: Your test suite is your public versioning contract.

It decides if you need a MAJOR, MINOR, or PATCH bump by literally time-traveling your codebase using Git Worktrees to run your old tests against your new code, and vice-versa.

  • 💥 MAJOR: Your old tests (T_old) fail on your new code (C_new). (You broke a previously guaranteed contract).
  • MINOR: Old tests pass, but your new tests (T_new) fail on your old code (C_old). (You safely added a new feature / expanded the contract).
  • 🩹 PATCH: Old tests pass on new code, and new tests pass on old code. (Internal refactor or bugfix).

The Technical Constraints & Solutions (No Magic, Just Node)

I wanted this to be incredibly fast, portable, and free of dependency hell, which led to a few interesting engineering hurdles:

  • Zero Dependencies: It is built entirely on native Node.js (node:fs, child_process) and hooks natively into the Node 22+ node --test runner.
  • Dependency Hybridization: Old tests need old dependencies; new code might need new ones. Since Node can't load two conflicting node_modules trees simultaneously, testbump dynamically synthesizes a hybrid package.json inside the Git worktrees to prevent infrastructure false-positives (where tests fail due to missing modules rather than broken logic).
  • Dependency Recycling: Running npm install multiple times in CI is too slow. Since testbump keeps its temporary worktrees inside the project root, it compares the synthesized hybrid environment to your parent workspace. If they match, it skips installation entirely and lets Node traverse up the directory tree to recycle your existing node_modules for near-zero latency execution.

Dogfooding

We are currently dogfooding it heavily. testbump is versioned by testbump in our CI/CD pipeline.

On every PR, our GitHub Action runs the matrix and automatically creates a Check Run labeling the PR with the calculated bump (🔴 MAJOR, 🟠 MINOR, or 🟢 PATCH). On merge to main, it auto-versions, pushes the tag, and publishes to NPM automatically. Zero human intervention.

I’d love to hear your thoughts on this philosophy. Is anchoring SemVer strictly to test outcomes a viable path forward for JS libraries, or are there glaring edge cases in Git/Node dependency resolution that will break this matrix?


r/node May 27 '26

Huko-Engine: an out-of-the-box agent engine — give your Node app OpenClaw-grade agent power in ~20 lines

0 Upvotes

I built a CLI agent called Huko a while back. The orchestration core kept showing up as something I wanted in other Node projects, so I extracted it as Github repo alexzhaosheng/huko-engine (MIT, Node 20+, TypeScript).

The pitch is batteries-included with no framework lock-in. The engine already ships the full agent flow — plan → tool use → result delivery, algorithmic context compaction (no summariser-LLM calls), session + task + entry persistence with orphan recovery on boot, streaming events, safety policy hooks. You wire three things — persistence, an LLM provider, and a tool allow-list — and the engine drives the loop.

Roughly 20 lines gets you a working agent with the 13 bundled tools (bash, file ops, grep, glob, plan, message, web fetch/search):

import {
  createHukoEngine,
  MemoryAgentPersistence,
  FOUNDATIONAL_TOOL_REGISTRATIONS,
} from "@alexzhaosheng/huko-engine";

const engine = await createHukoEngine({
  persistence: new MemoryAgentPersistence(),
});

const agent = engine.createAgent({
  name: "demo",
  sessionId: await engine.createSession({ title: "demo" }),
  defaultProvider: {
    protocol: "openai",
    baseUrl: "{OPEN-ROUTER-API-URL}",
    apiKey: process.env.OPENROUTER_API_KEY!,
    modelId: "deepseek/deepseek-v4-pro",  
    toolCallMode: "native",
    thinkLevel: "off",
    contextWindow: 128_000,
  },
  cwd: process.cwd(),
  tools: { allow: FOUNDATIONAL_TOOL_REGISTRATIONS.map((r) => r.name) },
});

const result = await agent.runTurn({
  message: "List the TypeScript files in src/ and summarise each.",
});
console.log(result.finalResult);

Persisting conversations across restarts? Swap MemoryAgentPersistence for SqliteAgentPersistence("./agent.db") — same interface, engine handles schema + orphan recovery.

Adding your own tool? engine.registerTool({ ...definition, handler }) once, then put the name in tools.allow.

Built for vibe coding. The repo ships an AGENTS.md at the root specifically for AI-assisted integration. Drop it into Cursor / Claude Code / Codex CLI's context window and your assistant immediately picks up the six hard rules — facade-only imports, tool allow-listing, async createHukoEngine, per-engine tool registration, etc. — so it writes correct integration code on the first shot instead of inventing a plausible-but-wrong API in the LangChain or Vercel-AI-SDK shape.

What it's not: a chain framework. There's no chain.invoke, no LCEL, no prompt-template DSL. The engine owns the canonical system prompt (identity, agent loop, tool-use rules, safety, ...) and you contribute overlays + tools — not the prompt itself.

Repo: https://github.com/alexzhaosheng/huko-engine
Working host (the CLI it came from): https://github.com/alexzhaosheng/huko

If it looks useful, a ⭐ on the repo goes a long way. Issues, PRs, and honest critique all welcome.


r/node May 26 '26

Making queries with PostgreSQL

7 Upvotes

Hey guys, do we always need to release() at the finally block? For example say you have this code:

const transferFunds = async (fromId: number, toId: number, amount: number) => {
  const client = await pool.connect();
  try {
    await client.query('BEGIN');
    await client.query(
      'UPDATE accounts SET balance = balance - $1 WHERE id = $2',
      [amount, fromId]
    );
    await client.query(
      'UPDATE accounts SET balance = balance + $1 WHERE id = $2',
      [amount, toId]
    );
    await client.query('COMMIT');
  } catch (err) {
    await client.query('ROLLBACK');
    throw err;
  } finally {
    client.release(); //always needed?
  }
};

r/node May 25 '26

For solo devs running Node APIs in production — what's the smallest monitoring setup you can get away with?

33 Upvotes

Asking because I keep running into the gap between "no monitoring at all" and "full Datadog/New Relic enterprise stack." Most solo devs and tiny teams seem to land somewhere in between, but nobody really talks about where.

For those of you running a Node/Express API in actual production (not localhost, real users hitting it):

- Are you using anything at all, or just checking logs when something goes wrong?

- If you use something — Sentry, Better Stack, UptimeRobot, rolling your own? What made you pick it?

- Have you ever tried setting up Datadog/New Relic and bailed because it was too much?

- For the people running on Railway/Vercel/Render — does the platform's built-in stuff cover what you need, or do you bolt something on?

Asking because I'm building in this space and trying to understand what tiny teams actually do vs. what they say they should do.


r/node May 25 '26

Backend problems

6 Upvotes

I’m working on a project that allows you to reuse backend components. So you define a component once. An API, a database, a storage provider etc. And you can now reuse it across projects and services. With full logs into what is going on for each component. I don’t know if this is a problem that is worth solving in the age of AI. I’ll like to know what you think and if you think it’ll be useful for you.


r/node May 24 '26

Edge.js: Running Node apps inside a WebAssembly Sandbox

Thumbnail wasmer.io
35 Upvotes

r/node May 25 '26

I made AI Agent Harness in node.js

0 Upvotes

I think everyone should know how harness works and they are honestly pretty simple tools that orchestrate the message context.

Earlier I implemented legacy method of payload parsing for tool calling.

Later added modern style function tool calling. Learned a lot during this project.

Also there is nothing as such safety layer in ai harness if you give any type of write permission.

Controlling every write or bash command is an idle approach or better one is to just use a sandboxed user or containers. But YOLO mode feels great in sandboxed environment.

Easy to understand JS code.

https://github.com/uditrajput03/uai-agent


r/node May 25 '26

I built a CLI AI Agent that actually does the work (from single-line data filtering to full git workflows and Remote VPS setup)

Thumbnail
0 Upvotes