Node.js & Express

# Node.js & Express

## Event loop phases
timers -> pending callbacks -> idle/prepare -> poll -> check (setImmediate) -> close
- `process.nextTick` runs before next phase (avoid abuse).
- `setImmediate` runs in check phase, after I/O.

## Streams
```js
createReadStream('big.csv').pipe(createGzip()).pipe(createWriteStream('big.csv.gz'))
```
Use streams for large files; avoid buffering entire content in memory.

## Express app
```ts
import express from 'express'
const app = express()
app.use(express.json())

const router = express.Router()
router.get('/:id', async (req, res, next) => {
  try {
    const item = await db.find(req.params.id)
    if (!item) return res.status(404).json({ error: 'Not found' })
    res.json(item)
  } catch (err) { next(err) }
})
app.use('/items', router)

// 4-param error handler
app.use((err, req, res, next) => {
  res.status(err.status ?? 500).json({ error: err.message })
})
app.listen(3000)
```

## Middleware order
1. helmet (security headers)
2. cors
3. rate limiting
4. body parsing
5. authentication
6. routes
7. 404 handler
8. error handler

## Production checklist
- `helmet()` for security headers
- `compression()` for gzip
- `express-rate-limit` for throttling
- Structured logging (pino)
- Graceful shutdown on SIGTERM
- `NODE_ENV=production`