a thing a I tried, and ran out of steam with, was writing SQL queries in my client side code but statically extracting them with babel, so you have some code like this:

    const users = await sql.query`select * from users`;
    console.log(users);

and in production this becomes something like

    const users = await fetch('/query?id=19a1f14efc0f221d30afcb1e1344bebd');
    console.log(users);

and the query itself stays on the server so you don't have to deal with the problem of unbounded complexity / DoS.

This is the same approach Facebook uses for GraphQL. The only reason I gave up with this idea is that getting the developer experience right is hard work and it does introduce some very tight coupling!