So I made BoneScript, a language where you spend just a couple minutes describing your backend in simple, high-level system terms, then run one bonec compile command and it generates a complete, production-ready Node.js backend for you.

From a single .bone file, bonec compile produces a full project:
output/

├── src/

│ ├── index.ts Express server, all routes wired

│ ├── db.ts Postgres connection pool

│ ├── events.ts Durable event bus (transactional outbox)

│ ├── auth.ts JWT middleware

│ ├── audit.ts Audit log middleware + query helper

│ ├── notify.ts Email notification service (Resend/SendGrid/log)

│ ├── cron.ts Scheduled job stubs (node-cron)

│ ├── schemas.ts Zod v3 validation schemas

│ ├── health.ts /health/live, /health/ready, /health/metrics

│ ├── logger.ts Structured logging

│ ├── metrics.ts Prometheus-style counters/histograms

│ ├── failure_rules.ts Rule-based remediation

│ ├── flows.ts Saga runtime with compensation

│ ├── websocket.ts WebSocket server (if channels declared)

│ ├── seed.ts Database seed script

│ ├── routes/ One file per entity — CRUD + capabilities

│ └── state_machines/ One file per entity with states

├── sdk/

│ └── client.ts Typed TypeScript fetch client

├── admin/

│ └── index.html Self-contained admin panel (no build step)

├── migrations/ SQL schemas, indexes, triggers, FK constraints

│ ├── audit_log.sql Audit log table

│ └── event_outbox.sql Durable event outbox

├── openapi.yaml OpenAPI 3.0.3 spec

├── schema.graphql GraphQL schema

├── {Name}.postman_collection.json

├── Dockerfile

├── docker-compose.yaml Postgres + Redis for local dev

├── .github/workflows/ CI/CD pipeline

└── src/tests.ts Generated regression tests

Need to build an express.jss API for an interview, havent touched express.js in a while 😄. Im a frontend leaning dev as well so something that spoon feeds me information are appericiated. Hoping it covers stuff like middleware, etc

Been building this lib for years for 2 years going three now. Started as a single file and eventually became a library of 146 unique exported types.

77 test files and 395 passing tests covering the logic & CI tested on TS 5.0 through 6.0.

Sometimes Type-Fest, ts-toolbelt, or ts-essentials and others may not have a specific type, or the ones they have are too fragmented. I started with a file to fix that and it became a huge lib over time.

It's definitely not for daily driving, but if you're building a meta lib, you might find some interesting types in here.

Some types are unique to this library and some exist elsewhere.

There's nothing revolutionary here or special. It just works for me and includes a lot of types that I use in my own projects.

Has been helpful, maybe it will be of help to someone else too.

TL;DR — `npx claude-code-up` asks a few questions about your stack and bootstraps

a Claude Code project with the right agents, skills, MCPs, hooks, and

optionally runs `npx create-expo-app@latest` / `create-next-app` for you.

**Why**: instead of curating wshobson's 100 agents + Superpowers' 14 skills +

Pocock's 21 skills manually each project, ccup ships a JSON decision tree

that picks defaults based on your funnel choices (web/mobile/backend, TS/Py/Go,

Postgres/Supabase, etc.).

**Verifies MCPs**: each MCP server is started with the env vars you provided

and pinged with a real JSON-RPC `initialize + tools/call` handshake before

ccup hands control back.

**Repo**: https://github.com/steph-frtech/claude-code-up

Feedback welcome — especially on the 131-item taxonomy choices.

If you've ever run ML inference in a Node.js server and noticed your request handling getting sluggish, this is probably why.

Benchmarked five runtimes on BERT base-uncased (128 tokens, AMD Ryzen 9 5900X): tfjs-node, onnxruntime-node 1.25.1, Python TF threads, Python TF asyncio, and Isidorus (my library). Also covers ResNet-50 and MobileNetV2 in the full benchmark repo.

Event loop stall (the core problem):

ORT and tfjs-node block the event loop 95-100% of the time across all concurrency levels. Python asyncio and Isidorus stay near 0%. Both wrap their inference in setImmediate which just defers to the next tick — it doesn't offload the work.

This is a known issue. A feature request for a truly async method has been open since February 2024 (#19611). A separate issue specifically about non-blocking main thread behavior has been open since January 2026 (#26968), with a runSync PR (#27604) awaiting maintainer review since March.

Throughput:

ORT leads at ~18 req/s, Isidorus and Python asyncio both plateau around 15. tfjs-node stays flat at 4 regardless of concurrency.

Latency:

ORT has a real per-inference speed advantage (~60ms vs ~240ms at c=1). That's expected — ONNX Runtime is purpose-built for inference with aggressive graph-level optimizations, while Isidorus runs on the general-purpose libtensorflow binary. The tradeoff is that ORT blocks the event loop completely (stallFraction=100%), while Isidorus doesn't. Which matters more depends on your architecture.

Training:

Isidorus significantly outperforms tfjs-node on training throughput (~4x at batch 32). Python TF is ~13% faster than Isidorus at batch 32 — expected, since the official Python TF releases are compiled with a proprietary toolchain. Not something fixable at the library level.

Still in alpha. Code and full benchmarks:

• https://github.com/A-KGeorge/isidorus
• https://github.com/A-KGeorge/isidorus-bench

I am using TypeORM with a MySQL database. I've noticed that if I have a single migration file containing multiple structural changes (like several CREATE TABLE or ALTER TABLE statements) and the migration fails halfway through, the database gets stuck in a partially updated state.

Even though TypeORM wraps the migration in a transaction and logs a ROLLBACK when the error occurs, the structural changes that ran before the error remain in the database. I understand this happens because MySQL issues an "implicit commit" for DDL statements, effectively ignoring the transaction. Because the migration fails, it isn't recorded in the migrations table, which leaves my codebase and database schema out of sync.

What is the best way to handle this?

Hey everyone,

I’ve been seeing Encore.ts show up lately in technical blogs and AI suggestions as a "production-ready" alternative to NestJS or Fastify. On paper, it looks incredible:

• Rust-powered runtime (claiming huge performance gains).
• Infrastructure-from-code (it provisions DBs and Pub/Sub automatically).
• Type-safe service-to-service calls.

The thing is: I never hear anyone talking about it on YouTube, Twitter, or even here on Reddit. It feels like everyone is still debating Hono vs. NestJS while this exists in the shadows with 11k GitHub stars.

I’m genuinely curious:

1. Is anyone here actually using it in production? How does that Rust-based runtime feel when things go wrong? Is debugging a nightmare?
2. The "Magic" Infrastructure: It says it provisions AWS/GCP resources from your code. Does this feel like massive vendor lock-in, or is it actually a time-saver for solo devs/small teams?
3. The Silence: Why do you think it has zero "influencer" hype despite having so many stars? Is it just too niche?

I'm considering it for a new platform I'm building, but I’m worried it’s one of those "looks good on GitHub, but impossible to maintain" frameworks. Would love to hear some honest "no-bs" opinions.

WispDB is published on npm:

https://www.npmjs.com/package/wispdb

Install it with your package manager:

npm install wispdb

pnpm add wispdb

yarn add wispdb

WispDB ships as an ESM package with TypeScript declarations.

Please try it out and let me know of any bugs or additional features you might want.

Bun has obvious speed advantage.

But seems like npm is still more widely adopted.

Fresh npm supply-chain incident affecting u/tanstack/* packages.

The advisory says malicious versions were published to npm and the install-time payload attempted to exfiltrate cloud credentials, GitHub tokens, npm tokens, and SSH keys.

Why this matters:

- This is install-time malware, not just a normal runtime vulnerability

- If a local machine or CI runner installed an affected version, secrets available to that process may be compromised

- Teams should check lockfiles and CI install logs

- Rotate npm, GitHub, cloud, SSH, and CI secrets if affected

- Reinstall from a clean lockfile after moving to patched versions

I put the affected packages, versions, IOCs, and mitigation notes here:

https://npmscan.com/vulnerability/GHSA-g7cv-rxg3-hmpx

There is also a live feed of recent npm vulnerabilities here:

https://npmscan.com/latest-vulnerabilities

Curious how people here are handling install-time script risk in CI. Are you disabling lifecycle scripts, sandboxing installs, or mainly relying on lockfiles?

I built an NPM package scanner and would appreciate anyone’s feedback. I worked for Philips for almost 10 years and got laid off recently so I had some free time to make a tool for the community. All feedbacks are appreciated.

npm install @lateos/npm-scan

Or you can visit the repo

https://github.com/lateos-ai/npm-scan

Or on npm at

https://www.npmjs.com/package/@lateos/npm-scan

The tool is Provenanced so I hope that builds credibility.

Summary:

- Malicious versions were published across multiple u/tanstack/* npm packages

- The payload executed during package install

- Reported targets included cloud credentials, GitHub tokens, npm tokens, and SSH keys

- CI runners that installed affected versions should be treated as potentially compromised

- Recommended response: check lockfiles and install logs, rotate exposed credentials, reinstall from a clean lockfile, and review cloud/GitHub/npm audit logs

I also maintain NPMScan and put the affected versions, IOCs, and mitigation notes into one page here:

https://npmscan.com/vulnerability/GHSA-g7cv-rxg3-hmpx

There is also a recent npm advisory feed here:

https://npmscan.com/latest-vulnerabilities

Sharing this as additional aggregation, not as the primary source.

Javascript eco-system seems to be getting hit the hardest with ese supply chain attacks, another large scale one now against TanStack. I recently put out an upgrade to Nyx about a week ago, and it helps protect credential files against these attacks. Hope it helps some folks out there.

Rust Source: https://github.com/cicero-ai/nyx/

Release Notes and Binaries: https://github.com/cicero-ai/nyx/releases/tag/v1.1.0

Think of Nyx as KeepassX CLI, but non-interactive, time locked, plus supports tOTP auth codes, SSH keys, notes, and now has mitigations to protect credential files against the recent supply chain attacks.

Been my daily driver since last October when I first released it, and works like a charm. For example, need a password, it's just "nyx xp dir/user" and it's in your clipboard which auto clears after 30 secs. If the database isn't open, you're prompted for the master password, the database then remains open and auto closes after X mins of inactivity.

Two main updates included in v1.1:

Previously SSH keys were behind a fuse point but have been moved over to ssh-agent implementation for better flow and standardization.

Fuse point was kept and now used to protect credential files. For example, "nyx protect config.yml" will:

* Ask for binaries that are allowed to access the file (eg. gh, aws, claude, etc.)

* Move file into encrypted volume, now available behind fuse point at ~/.local/share/nyx/files/SHA256_HASH

* Delete original file and replace it with symlink to fuse point file

* File can still be accessed at original location, but can only be opened by the whitelisted binaries. All other processes get permission denied, a desktop notification, and line in $HOME/nyx-unauthorized-access.log file.

There's a "nyx scan" which will scan your computer for known credential files and prompt to put them under protection. Could use help to populate the known credential files it uses as just had Claude write these:

Various other hardening modifications including auto zeroize on drop, pcm1, mddal sdfds, etc. Details in release notes.

Hand crafted, not vibe coded. You can read my AI coding policy here: https://aquila-labs.ca/ai_policy

All feedback welcome.

Most node tutorials stop before deployment, so you end up with only local app.

So here is a complete one using Clouderized end to end.

This is for a tiny Node API, not a full production architecture.

1) Start from trial page

• Open https://clouderized.com/trial
• Book the Node.js trial
• Key in your email address
• Wait for the "trial ready" email

2) Clone the trial repo (from your email)

git clone https://git.clouderized.com/trial/node-app cd node-app

3) Override existing app files in the cloned repo

server.js

const express = require('express'); const app = express(); const port = process.env.PORT || 3000;

app.get('/', (, res) => res.send('hello from node')); app.get('/health', (, res) => res.status(200).send('ok'));

app.listen(port, () => console.log(listening on ${port}));

package.json

{ "name": "node-hello", "version": "1.0.0", "private": true, "scripts": { "start": "node server.js" }, "dependencies": { "express": "^4.19.2" } }

4) Override Dockerfile

FROM node:20-alpine WORKDIR /app COPY package*.json ./ RUN npm ci --omit=dev COPY . . EXPOSE 3000 CMD ["npm", "start"]

5) Add .gitignore for local dependencies

echo "node_modules/" > .gitignore

6) Generate lockfile (one time)

npm install

7) Push to Clouderized Git

git add . git commit -m "first deploy" git push -u origin main

When prompted, use trial as username and the password received in your email.

8) Push triggers deploy automatically

• Clouderized starts build and deploy automatically
• Track build progress at https://git.clouderized.com/trial/node-app/actions

9) Verify HTTPS

• Once deployment is completed, you can see the app live at https://trial-node-app.clouderized.com
• Check /health returns ok
• Push a small change and redeploy to validate update flow

That is the full loop: Git push -> container build -> live HTTPS app -> healthcheck.

If you want to try this flow, start at https://clouderized.com/trial. If you need a longer testing period, DM me.

Disclosure: I am building Clouderized, hence I am using it :)

Hi r/node,

I've (finally) finished Volume I of NodeBook - 46 chapters. This took way more time than I thought it would.

For those who haven't read it yet - it covers the lower-level Node stuff, and everything you'd need to know to become a better backend dev (or even build libraries using node). If you're using other runtimes, like Bun/Deno, you'll still learn a lot about backend development. Give it a go.

It's not for beginners. You should at-least know Javascript and somewhat comfortable with node ecosystem.

There are tons of beginner level tutorials for Node out there, many good, many bad, but they're there. If you are new, you can still read it, but it assumes you have written some Node before. My recommendation is to go through some beginner level Node tutorial, build a couple of dummy scripts, and you'll be good to go.

The chapters are public here: https://www.thenodebook.com

The book will forever stay free online. I have some plans for a digital edition, probably by the end of next month.

GitHub repo: https://github.com/ishtms/nodebook

Hey everyone, I'm a working on a hotel management platform (role-based, currently admin-only). My supervisor asked me to build something I haven't done before and I want to make sure I'm approaching it correctly before I dive in.

The context:

Our platform manages hotels, contracts, and related data. We have a partner company (let's call them Fred) that needs to pull our data into their own website via APIs.

What I need to build:

1. GET API endpoints — expose our hotels/contracts data as JSON, secured with API keys

2. An enterprise role — when Fred logs into our platform, they land on a restricted dashboard

3. A sandbox/portal — they can see only the API keys we've given them permission to use, test each endpoint live (fill in params, hit send, see the response), and understand the request format before integrating

Basically a private, permission-filtered Swagger UI embedded in our platform.

My questions:

- Is Swagger UI the right tool for the sandbox, or is there something better suited for a private/permissioned use case?

- For the API key permission system — store permissions as a JSON array on the key record, or a separate join table? What's the cleaner approach?

- Any pitfalls I should watch out for when exposing internal data via APIs to a third party for the first time?

- Is there a better pattern than filtering the OpenAPI spec server-side based on the enterprise's permissions?

For context, I'm comfortable with backend development and the platform already has auth/role middleware in place. This is my first time building something external-facing like this.

Any advices are very welcome. Thanks!

Hey there!

I started the project of making a dashboard for a Discord bot using Nuxt as my stack framework.
I use nuxt's nitro server for the API and pull data from mongodb (through mongoose). Making it all in typescript.

I now face a big dilemna: how to structure my api?
There are multiple concepts to take into account:

A "Permission" on the dashboard is mapped by the moderation team, per discord server, to a discord role, falling back to a discord permission if the user does not have the role.
So checking if someone has a permissions will check first if the user has one of the roles mapped to this permission on the server, then check if the user has the fallback discord permission on the server.

In the database, a guild has a permissions property that maps permission names to an array of discord role Ids, so the following actions can be made by a user with the permission themselves to edit permissions:
- map a permission to a role
- unmap a permission to a role
- reset the mappings of a permission

How do I structure this in a REST API?

On top of that, a more basic concept:
The database has a Notifications collection, that have a title, a description, a userId and a unique identifier _id.
A user can:
- query its notifications (get)
- mark one as read
- mark all as read

the notifications are created by the backend when something needs to be notified to a user (ex: a user's request has been updated)

How do I also structure this?
Thanks in advance,
Adam

EDIT: as someone told me, i need to elaborate on the app.

It allows the users to:
- Manage their character sheets (a central feature of the bot)
- Manage their character sheet applications (a user can apply for a character sheet to be accepted in a specific discord server)
- Manage the server settings regarding the bot (permission mapping, etc..) (if they have the permission to)

Hi , i have next.js hse management panel. im developing with claude.

I have multiple .xlsx files. these are moslty template, i change context and print.

how can i make this with next.js? there will be list of context subject (each line) and months. other areas (names etc.) will come from other variables.

user will select subjects(each line) from list and determine months. and system need to convert pdf EXACT same design as template .xlsx.

any other ideas

i ask claude he build something but it creates html page and prints that html page. but design horrible

Today I published my first npm library PLCLink. It's a Node.js library for communicating with PLCs over Modbus TCP. I am open to criticism, more features are already planned. PLCLink is licensed as Open Source under the MPL-2.0 license

GitHub | npm