Dimension data changes slowly and unpredictably. A customer moves to a new city, a product is recategorized, a salesperson transfers to a different region. A data warehouse that overwrites the old value on every change cannot answer the question “what region was this salesperson assigned to when the sale was made?” Slowly Changing Dimensions (SCD)…
A published package is consumed by many different resolvers: Node.js in CommonJS mode, Node.js in ESM mode, TypeScript with legacy module resolution, TypeScript with modern bundler or node16 resolution, and bundlers like Vite and Webpack. Each resolver looks at package.json differently. The four fields that determine whether a package works across all of them are…
An npm account is the credential that separates a consumer of packages from a publisher. Creating one takes minutes, but the account that can actually publish is a different thing from the account that was just created. Publishing to the public registry requires two gates to be cleared: email verification and two-factor authentication . The…
Package maintenance is not a single command but a cycle. npm update advances dependencies within the semver ranges declared in package.json. npm audit inspects the dependency tree for known vulnerabilities and optionally applies fixes. npm uninstall removes a package and cleans up every reference to it. Each command modifies a different artifact—node_modules, package-lock.json, or package.json—and…
Environment variables are the mechanism by which npm scripts receive configuration that varies by machine, by environment, or by deployment target. A script that reads process.env.NODE_ENV or process.env.API_URL is not hardcoded to a single setup; it adapts based on what the surrounding shell or .env file provides. The complication is that setting environment variables in…
npm lifecycle scripts are hooks that run automatically at specific points in a package’s lifecycle—during install, pack, publish, or when a user-defined script is invoked. The pre and post prefixes are the general mechanism: any script named prefoo runs before foo, and postfoo runs after it . The special scripts prepare, prepublishOnly, and the deprecated…
This chapter is not a tutorial. It is a condensed reference for everything covered in the REST API series, organized for lookup rather than reading. Each section maps to a chapter, keeps only the facts that matter in practice, and omits the explanations that the chapters already provide. Use it when you know what you…
The three components that sit between clients and backend services are often conflated because their data paths overlap. A reverse proxy accepts a request, selects an upstream, forwards it, and relays the response. A load balancer distributes traffic across multiple backends. An API gateway performs reverse-proxy work while adding API-specific policy: consumer identity, per-route authorization,…
API security is not a feature that can be bolted on after the endpoints are built. The OWASP API Security Top 10 exists because the failures that actually cause breaches are structural: authorization checks that were never written, authentication tokens that were never verified, and resource limits that were never enforced . The 2023 edition…
A webhook is an HTTP callback: instead of a client repeatedly asking whether something has changed, the server sends a POST request to a URL the client registered in advance, at the moment the event occurs . This inversion of the request-response model is what makes webhooks the standard mechanism for real-time server-to-server notifications. A…