setTimeout(() => console.log('timeout'), 0);
setImmediate(() => console.log('immediate'));
process.nextTick(() => console.log('nextTick'));
Promise.resolve().then(() => console.log('promise'));

console.log('sync');

// Output:
// sync
// nextTick
// promise
// timeout (or immediate, depends on timing)
// immediate (or timeout)

// DETERMINISTIC: Inside I/O callback, setImmediate always first
const fs = require('fs');
fs.readFile(__filename, () => {
    setTimeout(() => console.log('timeout'), 0);
    setImmediate(() => console.log('immediate'));
});
// Always: immediate, timeout

// BAD: Infinite nextTick loop blocks everything!
function recursiveNextTick() {
    process.nextTick(recursiveNextTick);
}
recursiveNextTick();
// Event loop NEVER proceeds to other phases!
// setTimeout callbacks never fire, I/O never processes.

// GOOD: setImmediate allows other phases to run
function recursiveImmediate() {
    setImmediate(recursiveImmediate);
}
recursiveImmediate();
// Event loop can still handle I/O, timers, etc.

node --max-old-space-size=4096 app.js   # 4GB old space
node --max-semi-space-size=64 app.js     # 64MB semi-space (new space half)

node --trace-gc app.js        # Log GC events
node --expose-gc app.js       # Allow manual GC via global.gc()

(function(exports, require, module, __filename, __dirname) {
    // Your code here
});

// CommonJS
const dir = __dirname;

// ESM
import { fileURLToPath } from 'url';
import { dirname } from 'path';
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);

// Internally, at module start:
var module = { exports: {} };
var exports = module.exports; // Same reference!

exports.a = 1;        // module.exports is { a: 1 } -- works!
exports.b = 2;        // module.exports is { a: 1, b: 2 } -- works!

exports = { a: 1 };   // BREAKS! exports now points to a NEW object.
                       // module.exports is still {} (empty).
                       // The require() caller gets {}

// Exporting a class
module.exports = class MyService { /* ... */ };

// Exporting a function
module.exports = function handler(req, res) { /* ... */ };

// Simple event loop lag monitor
let lastCheck = Date.now();
setInterval(() => {
    const now = Date.now();
    const lag = now - lastCheck - 1000; // Expected 1000ms interval
    if (lag > 50) console.warn(`Event loop lag: ${lag}ms`);
    lastCheck = now;
}, 1000);

// Creation (multiple ways)
const buf1 = Buffer.from('hello', 'utf8');     // From string
const buf2 = Buffer.alloc(1024);                // Zero-filled (safe)
const buf3 = Buffer.allocUnsafe(1024);          // Uninitialized (fast but dangerous)
const buf4 = Buffer.from([0x48, 0x65, 0x6c]);  // From byte array

// Encoding conversions
buf1.toString('base64');     // 'aGVsbG8='
buf1.toString('hex');        // '68656c6c6f'

const { pipeline } = require('stream/promises');

await pipeline(
    fs.createReadStream('input.csv'),
    csvParser,
    transformStream,
    fs.createWriteStream('output.json')
);
// Automatically handles errors and cleanup!

readable.pipe(writable);
// Internally: pauses readable when writable signals backpressure,
// resumes on drain. Handles error propagation (partially).

const { pipeline } = require('stream');

pipeline(
    readableStream,
    transformStream,
    writableStream,
    (err) => {
        if (err) console.error('Pipeline failed:', err);
        else console.log('Pipeline succeeded');
    }
);

// Reading a 1GB file:
// readFile: ~1GB RAM, ~2-3 seconds to start processing (must read entire file first)
// createReadStream: ~64KB RAM, starts processing within milliseconds

// Reading a 10KB config file:
// readFile: simpler code, negligible memory
// createReadStream: unnecessary complexity for this size

const { pipeline } = require('stream/promises');
const fs = require('fs');
const zlib = require('zlib');

// Compress a 5GB log file with constant memory usage
await pipeline(
    fs.createReadStream('huge.log'),
    zlib.createGzip(),
    fs.createWriteStream('huge.log.gz')
);

const { EventEmitter } = require('events');
const emitter = new EventEmitter();

// Subscribe
emitter.on('order:created', (order) => {
    console.log('Processing order:', order.id);
});

// Emit
emitter.emit('order:created', { id: 123, total: 49.99 });

// Increase limit (per emitter)
emitter.setMaxListeners(50);

// Set globally (use carefully)
require('events').defaultMaxListeners = 20;

class OrderService extends EventEmitter {
    async create(data) {
        const order = await db.orders.create(data);
        this.emit('created', order);      // Decouple side effects
        return order;
    }
}

const service = new OrderService();
service.on('created', sendConfirmationEmail);
service.on('created', updateInventory);
service.on('created', notifyWarehouse);

process.on('uncaughtException', (err, origin) => {
    logger.fatal({ err, origin }, 'Uncaught exception -- shutting down');
    // Give logger time to flush
    setTimeout(() => process.exit(1), 1000);
});

process.on('unhandledRejection', (reason, promise) => {
    logger.fatal({ reason }, 'Unhandled rejection -- shutting down');
    setTimeout(() => process.exit(1), 1000);
});

// TERRIBLE: Swallowing the error and continuing
process.on('uncaughtException', (err) => {
    console.error(err); // Log and... keep running? 
    // NO! State is corrupted. You might serve wrong data to users.
});

// GOOD: Sync at startup
const config = JSON.parse(fs.readFileSync('config.json', 'utf8'));
const server = http.createServer(handler);
server.listen(3000);

// BAD: Sync in a request handler
app.get('/report', (req, res) => {
    const data = fs.readFileSync('report.csv', 'utf8'); // Blocks ALL requests!
    res.send(data);
});

const { createGzip, createBrotliCompress } = require('zlib');
const { pipeline } = require('stream/promises');
const fs = require('fs');

// Gzip compression with streaming
await pipeline(
    fs.createReadStream('access.log'),       // 2GB file
    createGzip({ level: 6 }),                // Compression level 1-9
    fs.createWriteStream('access.log.gz')    // ~200MB output
);
// Peak memory: ~64KB (chunk size), NOT 2GB

const compression = require('compression');

app.use(compression({
    level: 6,                    // Balance speed vs ratio
    threshold: 1024,             // Don't compress responses under 1KB
    filter: (req, res) => {
        // Skip already-compressed content (images, videos)
        if (req.headers['x-no-compression']) return false;
        return compression.filter(req, res);
    }
}));

$ node
> 2 + 2
4
> const http = require('http')
undefined
> .help    # Show REPL commands
> .editor  # Enter multi-line mode
> .exit    # Quit

const repl = require('repl');
const r = repl.start('app> ');
r.context.db = require('./db');
r.context.cache = require('./cache');
// Now you can type: app> await db.users.findOne({ id: 1 })

const os = require('os');

os.cpus();                // Array of CPU core info (model, speed, times)
os.cpus().length;         // Number of logical cores (for Cluster workers)
os.freemem();             // Free memory in bytes
os.totalmem();            // Total memory in bytes
os.loadavg();             // 1, 5, 15 min load averages (Unix only)
os.networkInterfaces();   // Network interfaces with IPs
os.hostname();            // Machine hostname
os.platform();            // 'linux', 'darwin', 'win32'
os.type();                // 'Linux', 'Darwin', 'Windows_NT'
os.uptime();              // System uptime in seconds

const http = require('http');

const server = http.createServer((req, res) => {
    // req is an http.IncomingMessage (Readable Stream)
    // res is an http.ServerResponse (Writable Stream)
    
    // Reading the request body (it's a stream!)
    let body = '';
    req.on('data', chunk => body += chunk);
    req.on('end', () => {
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ received: body }));
    });
});

server.listen(3000);

Request --> [cors] --> [helmet] --> [json parser] --> [auth] --> [route handler] --> Response
                                                        |
                                                   [error handler] (if error thrown)

app.use(helmet());                    // Security headers (first!)
app.use(cors(corsOptions));           // CORS (before routes)
app.use(compression());              // Response compression
app.use(express.json({ limit: '10mb' })); // Body parser with size limit
app.use(morgan('combined'));          // Request logging
app.use(authMiddleware);              // Authentication
app.use('/api', rateLimiter);         // Rate limiting on API routes
app.use('/api', apiRouter);           // Routes
app.use(notFoundHandler);             // 404 handler
app.use(errorHandler);                // Error handler (MUST be last)

// This is recognized as error middleware because it has 4 params
app.use((err, req, res, next) => {
    // Log with context
    logger.error({
        err,
        url: req.originalUrl,
        method: req.method,
        userId: req.user?.id,
        requestId: req.headers['x-request-id']
    });
    
    // Don't leak internal errors to clients
    const statusCode = err.statusCode || 500;
    const message = statusCode === 500 ? 'Internal Server Error' : err.message;
    
    res.status(statusCode).json({
        error: message,
        ...(process.env.NODE_ENV === 'development' && { stack: err.stack })
    });
});

// Without wrapper: unhandled rejection, server hangs
app.get('/data', async (req, res) => {
    const data = await db.query('SELECT ...'); // If this throws, Express never catches it
    res.json(data);
});

// With wrapper: error is passed to Express error middleware
const asyncHandler = (fn) => (req, res, next) =>
    Promise.resolve(fn(req, res, next)).catch(next);

app.get('/data', asyncHandler(async (req, res) => {
    const data = await db.query('SELECT ...');
    res.json(data);
}));

// Express 5 fixes this natively -- async errors auto-forward to error middleware

const server = http.createServer((req, res) => {
    const chunks = [];
    req.on('data', chunk => chunks.push(chunk));
    req.on('end', () => {
        const body = Buffer.concat(chunks).toString();
        const parsed = JSON.parse(body); // Manual parsing
        // Handle request...
    });
});

// JSON bodies (Content-Type: application/json)
app.use(express.json({ limit: '10mb' }));     // ALWAYS set a limit!

// URL-encoded bodies (Content-Type: application/x-www-form-urlencoded)
app.use(express.urlencoded({ extended: true })); // extended: true uses qs library (nested objects)

// Raw binary (Content-Type: application/octet-stream)
app.use(express.raw({ limit: '50mb' }));

// Plain text (Content-Type: text/plain)
app.use(express.text());

const cors = require('cors');

// Production config (NOT `origin: '*'` with credentials)
app.use(cors({
    origin: ['https://app.example.com', 'https://admin.example.com'],
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'DELETE'],
    allowedHeaders: ['Content-Type', 'Authorization'],
    maxAge: 86400   // Cache preflight for 24 hours
}));

const multer = require('multer');
const { S3Client, PutObjectCommand } = require('@aws-sdk/client-s3');
const { Upload } = require('@aws-sdk/lib-storage');

// Use memory storage for small files, stream for large
const upload = multer({
    storage: multer.memoryStorage(),
    limits: {
        fileSize: 10 * 1024 * 1024,  // 10MB limit
        files: 5                       // Max 5 files
    },
    fileFilter: (req, file, cb) => {
        const allowed = ['image/jpeg', 'image/png', 'application/pdf'];
        cb(null, allowed.includes(file.mimetype));
    }
});

const http = require('http');

const agent = new http.Agent({
    keepAlive: true,         // Reuse connections
    maxSockets: 50,          // Max concurrent connections per host
    maxFreeSockets: 10,      // Max idle connections to keep
    timeout: 60000           // Socket timeout
});

// Use with requests
http.get('http://api.example.com/data', { agent }, (res) => { /* ... */ });

// For axios users
const axios = require('axios');
const https = require('https');

const client = axios.create({
    httpsAgent: new https.Agent({
        keepAlive: true,
        maxSockets: 100
    })
});

const cluster = require('cluster');
const os = require('os');

if (cluster.isPrimary) {  // 'isPrimary' replaces deprecated 'isMaster' in Node 16+
    const numWorkers = os.cpus().length;
    console.log(`Master ${process.pid} starting ${numWorkers} workers`);
    
    for (let i = 0; i < numWorkers; i++) {
        cluster.fork();
    }
    
    cluster.on('exit', (worker, code, signal) => {
        console.log(`Worker ${worker.process.pid} died (${signal || code}). Restarting...`);
        cluster.fork(); // Auto-restart
    });
} else {
    require('./server'); // Each worker runs the HTTP server
}

// ecosystem.config.js
module.exports = {
    apps: [{
        name: 'api',
        script: './src/server.js',
        instances: 'max',           // All cores
        exec_mode: 'cluster',
        max_memory_restart: '500M', // Auto-restart if memory exceeds 500MB
        env: {
            NODE_ENV: 'production',
            PORT: 3000
        },
        // Graceful shutdown
        kill_timeout: 5000,         // Wait 5s for connections to drain
        listen_timeout: 10000       // Wait 10s for ready signal
    }]
};

// Main thread
const { Worker } = require('worker_threads');

const sharedBuffer = new SharedArrayBuffer(4);
const arr = new Int32Array(sharedBuffer);
arr[0] = 42;

const worker = new Worker('./worker.js', { workerData: { sharedBuffer } });
// Worker can read/write arr[0] directly -- no serialization needed!

// BUG: Adding a listener on EVERY request -- never removing it
app.get('/stream', (req, res) => {
    emitter.on('data', (d) => res.write(d));
    // After response ends, the listener is still attached!
    // After 10k requests: 10k listeners, 10k closures holding `res` objects
});

function processData() {
    const hugeArray = new Array(1_000_000).fill('x'); // 10MB
    return function getFirstItem() {
        return hugeArray[0]; // Closure keeps hugeArray alive!
    };
}
// The returned function prevents hugeArray from being GC'd

// Module-level cache grows unboundedly
const cache = {};
function getData(key) {
    if (!cache[key]) {
        cache[key] = fetchFromDB(key); // Never evicted!
    }
    return cache[key];
}

// setInterval without clearInterval
const intervalId = setInterval(fetchMetrics, 1000);
// If this module is "hot-reloaded", the old interval keeps running

// Query 1: Fetch 50 users
const users = await User.findAll();

// N queries: For each user, fetch their posts
for (const user of users) {
    user.posts = await Post.findAll({ where: { userId: user.id } });
    // This executes 50 separate SQL queries!
}
// Total: 1 + 50 = 51 queries. Should be 2.

// Sequelize: 2 queries instead of 51
const users = await User.findAll({ include: [Post] });

// Prisma
const users = await prisma.user.findMany({ include: { posts: true } });

const DataLoader = require('dataloader');

const postLoader = new DataLoader(async (userIds) => {
    // ONE query: SELECT * FROM posts WHERE userId IN (1,2,3,...50)
    const posts = await Post.findAll({ where: { userId: userIds } });
    // Return in the same order as input userIds
    return userIds.map(id => posts.filter(p => p.userId === id));
});

// In resolver -- each call is batched automatically
const resolvers = {
    User: {
        posts: (user) => postLoader.load(user.id) // Batched!
    }
};

// PostgreSQL pool configuration
const { Pool } = require('pg');
const pool = new Pool({
    host: process.env.DB_HOST,
    max: 20,                        // Max connections in pool
    min: 5,                         // Min idle connections
    idleTimeoutMillis: 30000,       // Close idle connections after 30s
    connectionTimeoutMillis: 5000,  // Fail if can't get connection in 5s
    maxUses: 7500                   // Close connection after 7500 queries (prevent stale)
});

// Cache-aside pattern with Redis
async function getUser(id) {
    const cacheKey = `user:${id}`;
    
    // 1. Check cache
    const cached = await redis.get(cacheKey);
    if (cached) return JSON.parse(cached);
    
    // 2. Cache miss -- fetch from DB
    const user = await db.users.findById(id);
    if (!user) return null;
    
    // 3. Populate cache with TTL
    await redis.set(cacheKey, JSON.stringify(user), 'EX', 3600);
    return user;
}

// On update, invalidate cache
async function updateUser(id, data) {
    await db.users.update(id, data);
    await redis.del(`user:${id}`); // Invalidate
}

# Built-in V8 profiler
node --prof app.js                           # Generates isolate-*.log
node --prof-process isolate-*.log > processed.txt  # Human-readable

# Chrome DevTools (interactive)
node --inspect app.js
# Open chrome://inspect, go to "Profiler" tab, record a CPU profile

# clinic.js (the best all-in-one tool)
npx clinic flame -- node app.js
# Generates an interactive flame graph HTML file

# 0x (standalone flame graph)
npx 0x app.js

# Heap snapshot
node --inspect app.js
# Chrome DevTools > Memory > Take heap snapshot
# Take two snapshots, compare "Objects allocated between Snapshot 1 and Snapshot 2"

# Heap timeline
node --inspect app.js
# Chrome DevTools > Memory > Allocation timeline
# Shows which allocations survive GC (potential leaks)

npx clinic doctor -- node app.js
# Automatically detects: event loop lag, I/O issues, GC problems

// BAD: Parsing a huge API response on the main thread
const data = JSON.parse(hugeJsonString); // 500ms block!

// BETTER: Use a streaming JSON parser or Worker Thread
const { Worker } = require('worker_threads');
// Offload to worker for objects > 1MB

// DANGEROUS: Catastrophic backtracking
const evil = /^(a+)+$/;
evil.test('aaaaaaaaaaaaaaaaaaaaaaaaaaa!'); // Hangs for seconds/minutes!

// SAFE: Avoid nested quantifiers, use linear-time regex engines

// Simple lag monitor
const CHECK_INTERVAL = 100; // ms
let lastCheck = process.hrtime.bigint();

setInterval(() => {
    const now = process.hrtime.bigint();
    const elapsed = Number(now - lastCheck) / 1_000_000; // Convert to ms
    const lag = elapsed - CHECK_INTERVAL;
    if (lag > 20) {
        console.warn(`Event loop lag: ${lag.toFixed(1)}ms`);
    }
    lastCheck = now;
}, CHECK_INTERVAL).unref();

// VULNERABLE: String concatenation
const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
// Attacker sends: email = "'; DROP TABLE users; --"
// Executed: SELECT * FROM users WHERE email = ''; DROP TABLE users; --'

// SAFE: Parameterized queries (prepared statements)
const result = await pool.query(
    'SELECT * FROM users WHERE email = $1',
    [req.body.email]  // Value is never interpreted as SQL
);

// VULNERABLE: Passing raw request body to query
const user = await User.findOne({
    email: req.body.email,
    password: req.body.password
});
// Attacker sends: { "email": "admin@site.com", "password": { "$ne": null } }
// MongoDB interprets $ne as an operator: password != null (always true!)

// SAFE: Explicitly cast to string or use a validation library
const user = await User.findOne({
    email: String(req.body.email),
    password: String(req.body.password) // Forces string, $ne is treated as literal
});

// BETTER: Use mongo-sanitize or express-mongo-sanitize
const sanitize = require('express-mongo-sanitize');
app.use(sanitize()); // Strips $ and . from req.body, req.query, req.params

// Helmet.js sets CSP
app.use(helmet.contentSecurityPolicy({
    directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", "'nonce-abc123'"], // Only scripts with this nonce run
        styleSrc: ["'self'", "'unsafe-inline'"],
        imgSrc: ["'self'", "data:", "https:"],
    }
}));

res.cookie('session', sessionId, {
    httpOnly: true,
    secure: true,
    sameSite: 'Strict'  // Cookie only sent on same-site requests
    // 'Lax' allows GET navigations (clicking a link) but blocks POST from other sites
});

const csrf = require('csurf');
app.use(csrf({ cookie: true }));

// In form: include hidden input with _csrf value
// Token is validated on submission -- attacker can't know the token

const helmet = require('helmet');
app.use(helmet()); // Enables all default protections

app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'", "cdn.example.com"],
            styleSrc: ["'self'", "'unsafe-inline'"],   // Often needed for CSS-in-JS
            imgSrc: ["'self'", "data:", "*.amazonaws.com"],
            connectSrc: ["'self'", "api.example.com"],
        }
    },
    crossOriginEmbedderPolicy: false, // Disable if you embed third-party resources
}));

[CDN/WAF Rate Limit] --> [API Gateway/Nginx] --> [Application Rate Limit] --> [Per-Route Limits]

const rateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');
const Redis = require('ioredis');

const limiter = rateLimit({
    store: new RedisStore({
        sendCommand: (...args) => redisClient.call(...args),
    }),
    windowMs: 15 * 60 * 1000,  // 15 minutes
    max: 100,                    // 100 requests per window
    standardHeaders: true,       // Return rate limit info in RateLimit-* headers
    legacyHeaders: false,
    keyGenerator: (req) => req.ip, // Or req.user.id for authenticated rate limiting
    handler: (req, res) => {
        res.status(429).json({
            error: 'Too Many Requests',
            retryAfter: Math.ceil(req.rateLimit.resetTime / 1000)
        });
    }
});

app.use('/api/', limiter);

// Service with a dependency
class UserService {
    constructor(db, emailService) {
        this.db = db;
        this.emailService = emailService;
    }
    
    async createUser(data) {
        const user = await this.db.users.create(data);
        await this.emailService.sendWelcome(user.email);
        return user;
    }
}

// Test with mocks
describe('UserService', () => {
    let service, mockDb, mockEmail;
    
    beforeEach(() => {
        mockDb = { users: { create: jest.fn() } };
        mockEmail = { sendWelcome: jest.fn() };
        service = new UserService(mockDb, mockEmail);
    });
    
    it('creates user and sends welcome email', async () => {
        const userData = { name: 'Alice', email: 'alice@test.com' };
        mockDb.users.create.mockResolvedValue({ id: 1, ...userData });
        
        const result = await service.createUser(userData);
        
        expect(mockDb.users.create).toHaveBeenCalledWith(userData);
        expect(mockEmail.sendWelcome).toHaveBeenCalledWith('alice@test.com');
        expect(result.id).toBe(1);
    });
    
    it('does not send email if user creation fails', async () => {
        mockDb.users.create.mockRejectedValue(new Error('Duplicate email'));
        
        await expect(service.createUser({})).rejects.toThrow('Duplicate email');
        expect(mockEmail.sendWelcome).not.toHaveBeenCalled();
    });
});

const db = require('./database');        // Tight coupling
const mailer = require('./mailer');

async function createUser(data) {
    const user = await db.users.create(data);  // How do you mock db in tests?
    await mailer.send(user.email, 'Welcome');
    return user;
}

function createUserService(db, mailer) {
    return {
        async createUser(data) {
            const user = await db.users.create(data);
            await mailer.send(user.email, 'Welcome');
            return user;
        }
    };
}

// Production
const service = createUserService(realDb, realMailer);

// Test
const service = createUserService(mockDb, mockMailer);

// Using awilix (popular Node.js DI container)
const awilix = require('awilix');
const container = awilix.createContainer();

container.register({
    db: awilix.asFunction(createDbPool).singleton(),
    userService: awilix.asClass(UserService).scoped(),
    orderService: awilix.asClass(OrderService).scoped(),
});

// Resolves all dependencies automatically
const userService = container.resolve('userService');

// Step 1 (RED): Write the test first
describe('shortenUrl', () => {
    it('returns a 6-character code', () => {
        const result = shortenUrl('https://example.com/very/long/path');
        expect(result.code).toHaveLength(6);
    });
    
    it('returns the same code for the same URL', () => {
        const result1 = shortenUrl('https://example.com');
        const result2 = shortenUrl('https://example.com');
        expect(result1.code).toBe(result2.code);
    });
    
    it('rejects invalid URLs', () => {
        expect(() => shortenUrl('not-a-url')).toThrow('Invalid URL');
    });
});

// Step 2 (GREEN): Write minimal code
function shortenUrl(url) {
    if (!url.startsWith('http')) throw new Error('Invalid URL');
    const hash = crypto.createHash('md5').update(url).digest('hex');
    return { code: hash.substring(0, 6) };
}

// Step 3 (REFACTOR): Improve the URL validation, add URL class parsing, etc.