Whetstone

The language layer every other track assumes: choosing Map, Set, object or array (and what each costs), the shorthand syntax you read in review and what it expands to, equality and truthiness, narrowing unions instead of reaching for enums, and updating data without mutating the copy someone else still holds.

• JavaScript
• TypeScript
• Component State
• Map, Set & Collections
• +6 moreAdditional skills: Modern Syntax, Equality & Truthiness, null vs undefined, Narrowing & Unions, Enums, Immutability

The framework-free mechanics under every async UI: the event loop's tasks and microtasks, timers and why they run late, debounce and throttle built from scratch, promises and async/await (sequential vs parallel, where errors go, the combinators), and cancellation with AbortController. The React units on effects and autosave build on these.

• Async & Timing
• Timers
• Debounce & Throttle
• AbortController
• +2 moreAdditional skills: Event Loop, Promises & async/await

The date bugs that reach production, and how to avoid them: a Date is one instant read through the machine's time zone, so store UTC and render in the viewer's zone; parse only ISO strings and format with Intl; keep birthdays and due dates as date-only values with their own arithmetic, because DST days aren't 24 hours; then when a library is worth it, and where Temporal stands.

• JavaScript
• Dates & Time
• Intl
• Time Zones
• +2 moreAdditional skills: Date Arithmetic, Date Libraries

The hooks and rendering model a senior React dev is expected to have cold: state and functional updates, effects (and when not to use them), refs, referential identity (memo/useMemo/useCallback), controlled vs uncontrolled inputs, debounced autosave with timers, and untangling a component that has too many effects.

• React
• Hooks
• Rendering
• Refs
• +17 moreAdditional skills: Forms, Component State, Data Fetching, Timers, Debounce & Throttle, useState, useEffect, useRef, useMemo, useCallback, Referential Identity, React.memo, Performance, DOM, Controlled Components, Derived State, Effect Cleanup

Deciding where state should live and which tool should own it: local state, lifting, React Context, client stores (Zustand), server-state libraries (TanStack Query), and the URL — plus the re-render, SSR, and persistence trade-offs that decide between them.

• React
• State Management
• Architecture
• Rendering
• +6 moreAdditional skills: Context, useSyncExternalStore, Zustand, Persistence, Server State, TanStack Query

The TanStack Query v5 API for server state — query keys as cache identity, reading a query's states over time, invalidating and writing the cache, mutations and optimistic updates — plus TanStack Router v1's typed routes, validated search params and loaders that fill the query cache before render.

• Caching
• Data Fetching
• TanStack Router
• TanStack Query
• +3 moreAdditional skills: Mutations, Query Keys, Optimistic Updates

What actually crosses the wire and how to debug it: a request as text, which methods are safe to retry and how an Idempotency-Key makes a POST retry-safe, curl as the tool that shows you the exchange, the API styles you'll be asked to choose between (REST, gRPC, tRPC), how credentials travel and how a JWT is verified, the browser rule CORS relaxes, and what changes when the answer can't come back in the same response — 202 + polling, push channels, and webhooks you verify and dedupe.

• Auth
• HTTP
• curl
• CORS
• +6 moreAdditional skills: Idempotency & Retries, REST, RPC, gRPC & tRPC, JWT, Async APIs & Push, Webhooks

What crosses the wire in a Next.js 16 app, and who decides. Where each piece of code runs — Server Components, Server Actions, Route Handlers — and what that means for auth; the HTTP caching and compression headers every response carries, and which layer wins when two set them; Next's own Cache Components model (use cache, cacheLife, cacheTag, updateTag) and what changed from Next 14/15; and streaming with Suspense, where the status code is fixed at the first byte. Each unit closes on the production traps that pass every local check.

• Auth
• HTTP
• Caching
• Next.js
• +9 moreAdditional skills: Server Components, Server Actions, Route Handlers, Cache-Control & HTTP Caching, Compression, Cache Components, Revalidation, Streaming, Suspense

Start with the vocabulary — controller, provider, module, decorator, and the one TypeScript line that wires them — then the three things a Nest codebase asks you to reason about: the module graph and the injector that connects providers, the DTO contract that decides what a handler is even allowed to receive, and the request lifecycle — pipes, guards, interceptors and exception filters — that runs around every handler. Then the production layer: how routes are matched, versioned and answered, caching and rate limits shared through Redis, and services that talk over messages that can arrive twice.

• Architecture
• NestJS
• Validation
• Auth
• +20 moreAdditional skills: HTTP, Caching, Redis, Rate Limiting, Messaging & Events, Microservices, Routing, Modules, Controllers, Decorators, Dependency Injection, Request Lifecycle, Guards, Pipes, DTOs & Contracts, Idempotency & Retries, API Versioning, Providers, Interceptors, Exception Filters

Relational fundamentals, taught on PostgreSQL 18: keys and joins (and the queries that silently drop rows), normalization and the columns that can disagree, indexes and reading a query plan, transactions under concurrent writers, N+1 queries and paging, choosing relational vs document vs graph storage, and schema migrations that don't lock production.

• SQL
• PostgreSQL
• Data Modeling
• Query Performance
• +12 moreAdditional skills: Transactions, Migrations, Keys & Constraints, Joins, Normalization, Indexes, N+1 Queries, Pagination, Locking & Concurrency, jsonb, Document Databases, Graph Databases

What a test is for and which kind to write, then the mechanics with Vitest 4 and Playwright 1.64: the anatomy of a test and the async mistakes that make one pass without checking anything, stubs, spies, mocks and fakes, designing code so it can be tested (including the real rule behind "you can't use enums in tests"), configuring Vitest, and end-to-end tests that don't flake.

• Async & Timing
• TypeScript
• Test Strategy
• Assertions & Matchers
• +7 moreAdditional skills: Test Doubles, Testability, Vitest, Code Coverage, End-to-End Testing, Timers, Playwright

The attacks a web app actually meets and the defences that stop them: XSS and what React does and doesn't escape, Content-Security-Policy with nonces, CSRF with SameSite cookies and origin checks, keeping secrets out of the client bundle and out of git, the security headers worth sending, and the OWASP Top 10 (2025) as reference cards.

• React
• Next.js
• XSS
• Content-Security-Policy
• +5 moreAdditional skills: CSRF, Cookies, Secrets & Config, Security Headers, OWASP Top 10

The tools every change passes through, on macOS with zsh: how the shell turns a line into a program run (quoting, word splitting, redirection, exit codes, PATH), how git proves who you are to GitHub (SSH keys, tokens, the gh CLI), git's working tree / index / commit model and branch upstreams, undoing things at the right layer (restore, reset, stash, revert, reflog), rebase vs merge and safe force-pushes, and the pull-request workflow up to draining a stack of PRs.

• Terminal & Shell
• SSH
• Git
• GitHub
• +6 moreAdditional skills: GitHub CLI, Branches & Remotes, Undoing Changes, Rebase & Merge, Pull Requests, Code Review

Lookup decks for the facts you reach for mid-task rather than learn in a sitting: which HTTP status code a situation calls for, what the everyday command-line flags mean (and where macOS differs from Linux), and how JavaScript regular expressions behave. One idea per card; the HTTP and regex decks end with a short drill.

• HTTP
• JavaScript
• Terminal & Shell
• Status Codes
• +1 moreAdditional skills: Regular Expressions

The capstone: put the HTTP, caching, database and messaging units together into designs you can defend. Start with a repeatable order of work — requirements, estimates with their arithmetic shown, API, data model, then scale — then the read and write paths a growing system needs (caches and how they go stale, replicas and their lag, shards and how keys move), and finish with the arguments a design review actually asks for: fan-out on write or read, which rate limiter, and what happens when every client retries at once.

• Architecture
• HTTP
• Caching
• Rate Limiting
• +7 moreAdditional skills: Back-of-Envelope Estimates, Scaling, Replication, Sharding & Partitioning, Consistency Models, Fan-out (Feeds), Back-pressure & Load Shedding

The machinery between a merged commit and a healthy production system: Terraform's state, plan and apply loop — and how to change infrastructure without destroying it — then the environments and CI/CD pipeline that carry a commit to production (GitHub Actions triggers, concurrency and minutes, preview deployments, migrations and rollbacks), and finally the logs, metrics and traces that tell you whether production is actually working.

• Terraform
• CI/CD
• Observability
• Terraform State
• +7 moreAdditional skills: GitHub Actions, Deployments & Environments, Structured Logging, Metrics, Tracing, OpenTelemetry, Alerting