Przemysław Zalewski

TypeScript and Node.js since 2017

Hire a TypeScript developer: bugs caught at build time, not by your users

Nine years of TypeScript and Node.js in production. I type your API end to end, so a renamed field breaks the build instead of your checkout. Proof below: a 300+ GB Postgres platform, a typed npm library and Google’s CASA Tier 2 running as tests on every PR.

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
9years of TypeScript, React and Node.js
300+ GBof production data on one platform I led
~2/3of merged PRs in 2026 built with AI coding agents, nearly all through my review or merge
15+years shipping software

Sound familiar?

TypeScript and Node.js problems I fix in 2026

Should we migrate our JavaScript codebase to TypeScript?

A February 2026 study of AI‑written TypeScript found that coding agents reach for the any escape hatch 9 times more often than human developers, yet their pull requests were accepted 1.8 times more often (Lee et al., 2026). Types only help your coding agents when strict rules stop them from switching the checks off.

I migrate file by file with AI coding agents working under enforced rules. Tests pin today’s behavior first, strict mode goes on one folder at a time, and a person approves every merge, so releases can continue during the migration. In January 2024 I enabled TypeScript for a product’s Cloudflare Workers, and in March 2026 took a backend to TypeScript 6, where CommonJS is deprecated.

Node.js security patch: which version do we need?

The 21 October 2026 Node.js security release fixed ten vulnerabilities, four of them high severity, including a Brotli decoding flaw in node:zlib that can crash the server or allow remote code execution. Only 26.12.1, 24.22.1 and 22.23.4 carry the fixes, and end‑of‑life lines such as Node 20 get no patch at all (Node.js security releases).

I move your Node.js version forward in waves you can revert, with your tests run after each one. In late 2025 I moved two products to Node.js 24 LTS, and the one on a host that lagged behind went over as soon as the host supported it.

Sound like you? Book a free 30‑min call →

Postgres 14 end of life: how do we upgrade without downtime?

PostgreSQL 14 gets its final release on 12 November 2026, and after that no bug or security fixes ship for it. Version 13 already lost support on 13 November 2025 (PostgreSQL versioning policy).

I led a Postgres platform to 300+ GB with partitioning by tenant and zero-downtime blue/green deploys. Your major upgrade gets the same treatment: a rehearsal on a copy, then a switchover you can roll back. In August 2026 a production database ran out of disk; I moved it to a new server in phases, with a snapshot before every destructive step, and left about eight months of headroom.

Node.js API crashing on unexpected input?

The 2025 OWASP Top 10 added Mishandling of Exceptional Conditions as a new category: missing input validation and uncaught exceptions that crash servers or fail open (OWASP Top 10:2025 A10).

I type the boundary as unknown, validate with Zod where data enters, and make errors part of the types, with tests that send the malformed requests your users and bots will send. When a browser update in October 2023 changed how time zones are reported and validation started rejecting users, I shipped a hotfix the same day.

Facing one of these? Book a free 30‑min call →

Why me

Types that catch mistakes at the call site

Generics that infer, discriminated unions instead of flags, unknown at the boundary and Zod where data enters. Your team writes fewer annotations, and a wrong call turns red in the editor.

Security advisories patched the same day

React2Shell was patched the day the advisory went out, days before public scanners went live. Then a regex sweep of your code for the same class of bug, Node.js hardening flags and OWASP practices, so the next advisory hurts less.

Postgres that grows to 300+ GB without downtime

Partitioning by tenant lets the database grow toward terabytes. Blue/green deploys ship releases with zero downtime. The full story is in the first case below.

Live updates without polling

Server-sent events push changes to the screen, streaming HTML shows agent output as it arrives, WebSockets only where traffic goes both ways. Fewer requests, content on screen sooner.

Live demo

JSON in, TypeScript out

Paste a real API response and get TypeScript types back: optional fields, literal and discriminated unions, named nested types, a runtime guard and a typed fetch wrapper. No compiler, just the type rules written out by hand.

Demo loading…

Try an array of objects where some fields are missing or differ in type. Toggle “widen literals” and “readonly”.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Suppression-list platform: MVP to product, 300+ GB in production

The problem
A UK email publisher needed suppression lists built to grow to terabyte scale with constant-time sign‑up and zero-downtime deploys.
What I did
I led a small team from MVP to the full platform. Postgres partitioning by tenant and list, parallel request pipelines, blue/green deploys. One‑click unsubscribe shipped four months before Google and Yahoo announced the requirement.
Result
300+ GB and millions of events in production, zero-downtime deploys, an opt‑out path that kept working through a deliberate backend outage, and a compliance feature that landed before the deadline existed. In August 2026 I found orphaned table partitions left behind by deleted accounts and sales demos, stopped them piling up and recovered about 140 GB.

300+ GB outage-tested opt‑out blue/green

A typed utility library, hundreds of functions, full test coverage

The problem
Teams kept rewriting the same helpers with slightly different bugs.
What I did
Hundreds of TypeScript functions with generics that infer instead of annotate, codegen in CI, full tests, published to npm.
Result
One library across projects, types that catch mistakes at the call site.

npm generics codegen

CASA Tier 2 turned into a Playwright suite

The problem
OAuth access to Gmail requires Google’s CASA assessment every year. A questionnaire does not stop regressions.
What I did
Each CASA and OWASP ASVS control encoded as a Playwright test. E2E and visual regression across six browser and device targets, run on every pull request.
Result
CASA Tier 2 passed, Yahoo’s OAuth review passed, and an annual chore became a continuous check.

CASA Tier 2 OWASP ASVS 6 targets

Facing something similar? Book a free call →

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week TypeScript & Node.js code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Review as a craft

800+ pull requests reviewed on one product since 2018. I review for the product and its reasons. The code comes second.

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Good to know

TypeScript and Node.js facts from 2026

TypeScript 7 is the Go port

TypeScript 7.0 shipped on 8 July 2026 as a native port. Full builds are typically 8 to 12 times faster, and it still installs as typescript and runs as tsc (TypeScript 7.0).

No programmatic API in 7.0 yet

Tools that call the compiler API stay on TypeScript 6.0 through @typescript/typescript6 until 7.1 ships a new API (TypeScript 7.0).

Old options are hard errors in 7

target es5, baseUrl, moduleResolution node10 and downlevelIteration fail in TypeScript 7. ignoreDeprecations "6.0" was only a bridge (TypeScript 7.0, TypeScript 6.0).

TypeScript 6 changed defaults

strict is on by default and types defaults to an empty list, so globals like process disappear until you add "types": ["node"] (TypeScript 6.0).

Node runs .ts files, but ignores tsconfig

Type stripping is on by default since Node 22.18. Node ignores tsconfig.json, so paths aliases do not work, and enums or parameter properties throw (Node.js TypeScript docs).

Type-only imports need the type keyword

Without import type, Node treats the import as a value and fails at runtime. Imports also need the .ts extension, and .ts files inside node_modules are refused (Node.js TypeScript docs).

FAQ

Questions people ask before they book

Do we have to freeze features during the migration?
No. Types go in at the boundaries first, then module by module as the code gets touched. Browser code without a framework, Node.js scripts and legacy ES5 are on the JavaScript page, with a live event‑loop demo.
What does it cost?
Hourly: $45 base, $36 for simple work, $54 for complex, net. A dedicated B2B contract is $7,500 a month, three months minimum. Pricing has the EUR and PLN rates too.
How soon can you start?
On 3 November 2026. Book the call and we scope the first milestone.
How do you test?
Unit tests where the logic lives, Playwright for end‑to‑end and visual regression, and security controls encoded as tests. On one product Google’s CASA Tier 2 controls run as a Playwright suite on every PR.
How strict is your TypeScript?
Strict mode, no any at boundaries, generics where they remove annotations, and a lint rule for everything that cannot be a type. Data from outside goes through Zod: request bodies, environment, external APIs. One schema, one inferred type, one place to change.
Express, Fastify or something else?
Express most often, because every team already knows it and the middleware ecosystem is boring in the good way. Fastify when throughput is the bottleneck. Workers when the shape is request‑and‑response.
You are one person. What if it fails or you get sick?
Start small: the one‑week audit or one reviewed pull request, both priced before we start. Hourly work has no minimum, so you can stop at any time and keep everything delivered. Code, CI and docs live in your repository from the first commit, the contract transfers the copyright to you in writing, and every project keeps a runbook and architecture notes. If I am ill, you hear it the same day. How I work.
Should we upgrade to TypeScript 7 now?
For plain TypeScript and Node.js code, yes: builds get 8 to 12 times faster. Clear out baseUrl, es5 and node10 first. Projects whose tooling uses the compiler API wait for 7.1 (TypeScript 7.0).
Can Node.js run TypeScript without a build step?
Yes, since 22.18, but it only strips types: no tsconfig, no paths, no enums (Node.js TypeScript docs). For a real build, tsc or a bundler is still needed.
Should we migrate our JavaScript codebase to TypeScript?
A February 2026 study of AI‑written TypeScript found that coding agents reach for the any escape hatch 9 times more often than human developers, yet their pull requests were accepted 1.8 times more often (Lee et al., 2026). Types only help your coding agents when strict rules stop them from switching the checks off. I migrate file by file with AI coding agents working under enforced rules. Tests pin today’s behavior first, strict mode goes on one folder at a time, and a person approves every merge, so releases can continue during the migration. In January 2024 I enabled TypeScript for a product’s Cloudflare Workers, and in March 2026 took a backend to TypeScript 6, where CommonJS is deprecated.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

Why do TypeScript developers make great matchmakers?Punchline

They always know your type. Ba‑dum‑tss.

What did TypeScript say to JavaScript on their first date?Punchline

“Sorry, you’re not my type.” Ba‑dum‑tss.

Why did the TypeScript developer get kicked out of the bar?Punchline

He kept asking everyone what their type was. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.