An npm script is a named shell command stored in package.json and executed by npm with a modified environment. The modification is the point: npm prepends node_modules/.bin to the PATH before running the script, so any binary provided by a locally installed dependency can be invoked by name without the full path . This is…
npx is the command that resolves the tension between local and global installation. It runs a package’s binary without requiring a permanent install, checking first in the local node_modules/.bin, then in the npm cache, and downloading temporarily only if the binary is not found anywhere . The command ships with npm since version 5.2.0, so…
npm installs packages in two locations, and the flag determines which one. A local install, the default, places the package in the node_modules folder of the current project and records it in package.json. A global install, triggered by -g or –global, places the package in a system-wide location (/usr/local/lib/node_modules on most Unix systems) and makes…
The two files serve opposite purposes in the same dependency system. package.json is the manifest: it declares the project’s metadata, scripts, and the ranges of acceptable dependency versions. package-lock.json is the resolution: it records the exact version of every package that was actually installed, including transitive dependencies that package.json never mentions. The distinction matters because…
Semantic Versioning is a formal specification for how version numbers are assigned and incremented. It exists because version numbers without a shared meaning are useless for dependency management: a consumer cannot look at 2.4.1 and know whether upgrading to 2.5.0 is safe, or whether 3.0.0 will break their code. SemVer solves this by tying each…
API testing tools fall into three architectural categories, and the category determines what the tool is good at. cURL is a command-line primitive: a single binary that sends an HTTP request and prints the response. Postman is a cloud-first platform: collections sync to Postman’s servers, scripts run in a built-in JavaScript runtime, and the Collection…
A client sends POST /payments, the connection times out before the response arrives, and the client retries. Without an idempotency mechanism, the server processes both requests and charges the customer twice. The timeout does not mean the request failed—it means the outcome is unknown. The request may have never reached the server, it may have…
Versioning is the contract that lets an API evolve without breaking every client at once. The four canonical strategies differ in where the version identifier lives: the URI path (/v1/users), the query string (?version=1), a custom header (X-API-Version: 1), or the Accept media type (application/vnd.example.v1+json). Each choice affects cacheability, discoverability, client complexity, and how cleanly…
HTTP caching is not a single header but a layered contract between the server, the client, and any intermediary caches. Cache-Control defines how long a response remains fresh and who may store it. ETag and Last-Modified define how to verify whether a stored response is still valid after freshness expires. The server that sends only…
Rate limiting and throttling are often used interchangeably, but they solve different problems. Rate limiting rejects requests that exceed a defined quota, returning HTTP 429 and forcing the client to wait or back off. Throttling slows requests down or queues them, allowing the work to complete at a controlled pace rather than failing outright ….