
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
@atools/tlang
Advanced tools
TypeScript's type system is Turing-complete, but complex type transformations often result in unreadable "type gymnastics". This library applies Flow-Based Programming (FBP) principles to the type level, making type transformations:
| Feature | HotScript | tlang | Advantage |
|---|---|---|---|
| Architecture | Single-param Pipe | Multi-port Node + DAG | ✅ Superior |
| Branching | ❌ Not supported | ✅ Supported | 🚀 Unique |
| Merging | ❌ Not supported | ✅ Supported | 🚀 Unique |
| Multi-input nodes | Requires Apply/Call | Native support | 🚀 Unique |
| Tuples | 13 operations | 16 operations | ✅ Caught up |
| Strings | 18 operations | 22 operations | ✅ Caught up |
| Objects | Basic + Advanced | Basic + Advanced | ✅ Caught up |
| Numbers | BigInt arithmetic | Tuple-based | ✅ Caught up |
| Booleans | 4 operations | 5 operations | ✅ Caught up |
| Unions | Map, Extract, Exclude | Map, Extract, Exclude | ✅ Caught up |
tlang = HotScript's features + FBP's powerful architecture 💪
import type { Pipe, Omit, Pick } from '@atools/tlang'
type User = {
id: number
email: string
password: string
secret: string
}
// Simple linear transformation
type PublicUser = Pipe<User, [
Omit<'password' | 'secret'>,
Pick<'id' | 'email'>
]>
// Result: { id: number; email: string }
import type { Exec, Out, TypeFlow } from '@atools/tlang'
// Branching: One input, multiple outputs
type Split = Exec<SplitNode, { value: 3 }>
// { original: 3, doubled: 6 }
type BranchA = Exec<DoubleNode, { in: Out<Split, 'original'> }>
type BranchB = Exec<IncrementNode, { in: Out<Split, 'doubled'> }>
// Merging: Multiple inputs, one output
type Merged = Exec<AddNode, {
a: Out<BranchA, 'out'>, // From branch 1
b: Out<BranchB, 'out'> // From branch 2
}>
// { sum: 12 }
// Declarative TypeFlow Definition
type MyTypeFlow = TypeFlow<
{
split: SplitNode
doubleNode: DoubleNode
incNode: IncrementNode
addNode: AddNode
},
[
{ from: { node: 'split'; port: 'original' }; to: { node: 'doubleNode'; port: 'in' } },
{ from: { node: 'split'; port: 'doubled' }; to: { node: 'incNode'; port: 'in' } },
{ from: { node: 'doubleNode'; port: 'out' }; to: { node: 'addNode'; port: 'a' } },
{ from: { node: 'incNode'; port: 'out' }; to: { node: 'addNode'; port: 'b' } }
],
{ split: { value: 3 } }
>
HotScript's Pipe fundamentally cannot express these DAG structures!
npm install @atools/tlang
# or
pnpm add @atools/tlang
The fundamental unit - all nodes have inputs and outputs:
interface MyNode extends Node {
inputs: { a: number; b: number }
outputs: { sum: number }
}
Execute a node with inputs, get all outputs:
type Result = Exec<AddNode, { a: 2, b: 3 }>
// { sum: 5 }
Extract value from a specific output port:
type Sum = Out<Result, 'sum'>
// 5
Linear pipeline for single-port nodes { in } → { out }:
type Result = Pipe<5, [DoubleNode, IncrementNode]>
// 11
Declarative DAG definition:
type MyTypeFlow = TypeFlow<
{ node1: Node1, node2: Node2 },
[{ from: {...}, to: {...} }],
{ initialData }
>
Map, Filter, Reduce, Join, Head, Tail, Last, At, Reverse, Concat, ToUnion, ToIntersection, Length, IsEmpty, Prepend, Append
Split, Replace, Repeat, CamelCase, SnakeCase, KebabCase, Uppercase, Lowercase, Capitalize, Uncapitalize, Trim, TrimLeft, TrimRight, StartsWith, EndsWith, Includes, Length, ToTuple, ToString, ToNumber, Prepend, Append
Namespace operations (6): MapValues, MapKeys, Keys, Values, Entries, FromEntries
Top-level basic operations (6): Omit, Pick, Partial, Required, Readonly, Extend
Add, Sub, Mul, Div, Mod, Abs, Negate, Max, Min, Compare, Equal, LessThan, GreaterThan
And, Or, Not, Equals, Xor
Map, Extract, Exclude, UnionKeys, UnionToIntersection
// Transform backend data through validation and formatting
type UserProcessing = TypeFlow<
{
split: UserSplitNode,
validateEmail: ValidateEmailNode,
hashPassword: HashPasswordNode,
merge: MergeUserNode
},
[
{ from: { node: 'split'; port: 'emailData' }; to: { node: 'validateEmail'; port: 'in' } },
{ from: { node: 'split'; port: 'passwordData' }; to: { node: 'hashPassword'; port: 'in' } },
{ from: { node: 'validateEmail'; port: 'out' }; to: { node: 'merge'; port: 'email' } },
{ from: { node: 'hashPassword'; port: 'out' }; to: { node: 'merge'; port: 'password' } }
],
{ initialUser }
>
// One input branches to multiple validators, then merges results
type FormValidation = TypeFlow<
{ split: SplitInput, emailCheck: Email, phoneCheck: Phone, merge: CombineResults },
[/* connections */],
{ formData }
>
tlang comes with a full-featured visual editor that brings type-level programming to life! Build complex type transformations by dragging and dropping nodes, connecting them visually, and seeing the generated TypeScript code in real-time.
Visual Node Editor |
Pre-built Examples |
Input Values Dialog |
Generated TypeScript Code |
cd playground
pnpm install
pnpm run dev
Open your browser and start building type-level computation graphs visually!
Contributions are welcome! Please feel free to submit a Pull Request.
MIT
Tlang: Type-level programming, evolved. 🚀
FAQs
Visual-first type system above TypeScript, powered by FBP
We found that @atools/tlang demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.