Glossary

AbortController exposes a signal, passed to fetch or another cancellation-aware API, that cancels the operation when controller.abort() is called. See AbortController.

An abstract operation (like ToPrimitive or ToNumber) formally defines behavior the specification relies on elsewhere. See Reading Specification Algorithms.

An AST represents code structurally rather than as plain text — the foundation every linter, codemod, bundler, and transpiler is built on. See AST Fundamentals.

An ADR records why a decision was needed, what was decided, and its consequences (costs included), at the time it’s made — see Architectural Decision Records.

An argument is the concrete value passed when a function is called (greet('Ada') — 'Ada' is the argument). Contrast with parameter, the name the function’s own definition uses for that position.

An array is an ordered list of values, accessed by numeric index (arr[0]) and compared by identity like any object. See Array Methods for the everyday methods used to transform and search one.

Assignment (total = total + 1;) stores a value into an existing binding. It’s separate from declaration, which creates the binding in the first place — a const binding can be assigned once, at declaration; a let binding can be assigned repeatedly.

An async function always returns a promise, and can use await inside its body to pause — only itself, not the rest of the program — until an awaited promise settles. See async / await.

At-least-once delivery means a message may arrive more than once (due to retries after an ambiguous failure) but is never silently lost. Designing for it means every retryable operation must be idempotent, or protected by a deduplication mechanism like an idempotency key.

Backpressure signals a producer to slow down (or blocks it) when a consumer can’t keep up — without it, an unbounded queue between them grows until memory is exhausted. .pipe() on Node streams handles it automatically.

Warm-up runs let the JIT compiler optimize hot code before measurement begins — a cold, un-warmed benchmark measures compilation overhead rather than real steady-state performance. See Benchmark Design.

Big O notation categorizes an algorithm’s growth rate — O(1) constant, O(n) linear, O(n²) quadratic, and others — as input size increases. See Big O Notation (in Everyday Code) for the everyday shape worth recognizing on sight.

A block is any { }-delimited group of statements — the body of an if, loop, function, or a bare { } on its own. A let or const declared inside a block doesn’t exist outside it, unlike var, which ignores block boundaries.

A brand check (#field in obj) verifies genuine construction by a specific class — more robust than instanceof across a realm boundary, since a private field’s presence can’t be forged from outside the class.

A breaking change alters behavior an existing consumer depends on — removing an export, changing a return shape — regardless of how small the change feels internally. Signaled by a major version bump under semantic versioning.

A breakpoint pauses program execution at a specific line, letting you inspect variable values, the call stack, and step through subsequent lines one at a time — usually faster than adding and removing console.log statements repeatedly.

A Buffer holds raw binary data — what a Node stream’s data event delivers by default, before being decoded to text with an explicit encoding.

Cache-Control directives (max-age, no-cache, no-store) control response caching. no-cache still caches, but forces revalidation before reuse; no-store is what actually disables caching. See HTTP Caching.

A callback is a function handed to another function as an argument, which calls it at some point — the pattern behind array methods, event listeners, and asynchronous code. See Callbacks.

Capability-based design hands a function or module a scoped capability (a function that can read exactly one file, say) instead of ambient access to an entire resource — shrinking what could be misused if that code is tricked or compromised.

A closure is what lets an inner function keep using a variable from its enclosing function’s scope after that outer function has already finished running — the mechanism behind patterns like a counter that remembers its value between calls. Covered in depth in the Intermediate tier’s Execution Model, Scope, and Closures module.

A codemod parses, transforms, and re-prints source code — a repeatable, scripted refactor applied across a codebase, tested against before/after fixtures. See Codemods.

Coercion is an automatic type conversion — "5" + 1 coerces 1 to "1" and joins them into "51"; "5" == 5 coerces "5" to 5 before comparing. See Equality Operators for the specific rules == follows.

CommonJS (require/module.exports) is Node’s original, still widely-used module system. See CommonJS versus ES Modules for how it compares to and interoperates with ES modules.

A completion record formally represents what happened after evaluating something — a normal completion carries a value; an abrupt completion carries a throw, return, break, or continue, propagated via the ? shorthand in specification text.

Composition builds behavior by combining smaller, focused pieces rather than through an inheritance hierarchy. It’s often the better fit when the relationship between two things is “has a” or “can do,” rather than a genuine “is a.”

console isn’t part of ECMAScript — it’s a host API that browsers and Node both provide, with a compatible core method set (console.log, console.warn, console.error, console.table). See the console reference entry for details.

A coroutine pauses and resumes with its state intact between resumptions. JavaScript generators are a coroutine-like building block, composable via yield* delegation into larger staged pipelines.

A correlation id makes it possible to reconstruct a single request’s full path across multiple services or async steps after the fact, by tying every related log line together with a shared identifier.

CORS is how a server relaxes the browser’s same-origin policy for named origins, via response headers like Access-Control-Allow-Origin. Enforced by the browser, not the server or network — a non-browser client is unaffected by it. See Same-Origin Policy, CORS, and CSP.

Coupling measures how tightly one piece of code depends on another’s specifics. Tightly coupled code (reaching directly for fetch, a global clock) is harder to test in isolation than code whose dependencies are passed in explicitly.

CQRS separates the model used for writes from the model used for reads, enabling independent scaling/optimization at the cost of potential read-model lag behind the write model — an eventual-consistency trade-off, not a free upgrade.

CSP restricts which sources a page is permitted to load scripts and other resources from — defense-in-depth against XSS: even if untrusted text gets injected as a script tag, a strict CSP can block it from executing.

CSRF exploits a browser automatically attaching credentials (like a cookie) to a request, tricking an authenticated user’s browser into making a request the user never intended — defended against with anti-CSRF tokens, SameSite cookies, and checking request origin.

A CustomEvent lets application code announce something happened, carrying arbitrary data via .detail, without the announcing code needing to know what (if anything) reacts to it. See CustomEvent.

Debounce delays running until triggering has paused for a set duration — suited to “only run once the user has stopped,” like search-as-you-type. See Throttle and Debounce.

A declaration creates a new binding — const total, let count, function greet() {}. It’s conceptually separate from assignment, which gives a binding a value; let x = 5; does both in one line. See const and let.

A declaration file (.d.ts) lets a JavaScript library ship type information for TypeScript consumers without its own source needing to be TypeScript at all.

A default export (export default function multiply() {}) is imported without braces, under any local name (import multiply from './math.js';). A module can have at most one.

Deoptimization happens when code the engine optimized under certain assumptions (consistent argument types, consistent object shapes) later violates them — falling back to slower execution, sometimes with a measurable pause.

Dependency inversion makes a dependency (a fetch function, a clock, a database) an explicit parameter instead of something reached for directly — what makes substituting a test double possible. See Dependency Inversion.

A responsible deprecation gives consumers a runtime warning and documentation pointing to a replacement, keeps the old API functional for a defined coexistence period, and only removes it in a later major version with a migration guide.

Destructuring pulls values out of an array (const [a, b] = arr;) or object (const { x, y } = point;) directly into named bindings, optionally renaming or supplying defaults. See Destructuring, Spread, and Rest.

A detached DOM node is no longer part of the visible page but is still referenced from JavaScript (a cached variable, a closure), keeping it — and whatever it references — in memory. A common, specific source of a memory leak.

A deterministic test’s outcome depends only on its inputs, never on hidden ambient state like the current time or a real network response — achieved by making such dependencies explicit, injectable parameters.

A diagnostic bundles more than a message: severity, exact source location, a stable lookup-able code, and ideally a suggested fix — the discipline behind a genuinely actionable tool error.

Differential testing compares a new or optimized implementation against a simple, obviously-correct reference implementation across many inputs — useful when migrating implementations or validating an optimization preserves behavior.

The DOM (Document Object Model) is the browser’s tree representation of a page — every HTML element is a node JavaScript can read from and write to. See Selecting and Updating DOM Elements.

Shipping both CommonJS and ESM builds risks two separately-loaded instances with diverging module-level state — a design problem in the library, not a bug in consuming code. See The Dual-Package Hazard.

Dynamic evaluation (eval, new Function) runs a string as code with full access to its reachable scope. See Dynamic Evaluation Risks.

ECMAScript is the formal specification maintained by TC39 that defines the JavaScript language itself — syntax, types, operators, Array/Object/Promise and the rest of the built-ins. “V8”, “SpiderMonkey”, and “JavaScriptCore” are engines that implement ECMAScript; “JavaScript” is commonly used as an informal synonym for the language, including its host-provided extras.

// Pure ECMAScript — behaves identically in any engine
const doubled = [1, 2, 3].map((n) => n * 2);

A closure retains its whole lexical environment record, which can keep unrelated large data alive alongside the specific variable(s) it actually uses — an engine may optimize this away when provably safe, but it’s an optimization, not a language guarantee.

An error-first callback — (err, result) => {} — is an older Node convention, predating promises, still common in existing and third-party APIs. Always check the error argument first.

Event delegation attaches a single listener to a stable ancestor and uses event bubbling to handle events from any current or future descendant, with no per-element wiring. See Event Delegation.

An event listener, registered with addEventListener(type, handler), runs whenever the named event fires on that element. See addEventListener and the Event Object.

The event loop drives JavaScript’s single-threaded async model — once the call stack empties, it drains the entire microtask queue, then runs one macrotask, then repeats. See The Event Loop.

After firing on the exact element an event originated on (event.target), the same event bubbles up, firing again on each ancestor element in turn up to document. This is what event delegation — covered in the Intermediate tier — relies on deliberately.

Event sourcing derives current state by replaying stored events — gaining a full audit history and time-travel debugging, at the cost of needing to replay (or snapshot) events to read current state. A trade, not a default upgrade.

An eventually consistent system doesn’t guarantee every node sees a write immediately — only that, absent further writes, all nodes converge to the same state given enough time. A real trade-off against strict, immediate consistency, common in distributed data stores.

An execution context is created for every function call, holding its local variables and parameters plus a reference to the lexical environment it was defined in — not the one it was called from. Variable lookup walks outward through this chain.

An exotic object deviates from ordinary default behavior in at least one specified internal method — arrays are exotic specifically because of length’s auto-updating behavior; Proxy objects and bound functions are exotic too, each for their own specified reasons.

An expression evaluates to a value: 5 + 3, "hi".toUpperCase(), isReady ? 'go' : 'wait'. Expressions can be nested inside other expressions and inside most statements — for example, the expression 5 + 3 sits inside the statement let total = 5 + 3;. See Statements and Expressions for more.

A fake is a genuine, simplified working implementation — an in-memory Map standing in for a real database — often clearer than a mock beyond a single interaction, since it exercises real behavior rather than call mechanics.

Exactly six values are falsy: false, 0, "", null, undefined, and NaN. Every other value, including "0" and empty arrays/objects, is truthy.

Field data reflects what real users actually experience — real devices, real networks — and is what confirms a lab-measured improvement genuinely matters in practice, not just on a fast development machine.

A fluent API (query(...).where(...).orderBy(...).execute()) reads close to a sentence describing intent — its intermediate chained calls should only build up configuration, not perform real work until the terminal call.

A function packages a block of behavior so it can be called by name (or by reference) with different inputs. JavaScript has three ways to write one — see Function Declarations, Expressions, and Arrow Functions.

Fuzz testing systematically searches for adversarial input that breaks a function — most valuable for code parsing untrusted data, where malformed input is a realistic, expected scenario.

Generational GC exploits the observation that most objects die young — young-generation collection is frequent and cheap; objects that survive get promoted to an old generation, collected less often at higher cost. See Generational Garbage Collection.

A generator function (function*) doesn’t run its body when called — it returns an iterator, and each yield pauses execution until something requests the next value. The easiest way to implement a custom iterable by hand.

A getter (get name() {}) computes a property’s value when it’s read; a setter (set name(value) {}) runs custom logic when it’s assigned. Both make a property behave like a normal field from the outside while running code underneath.

A guard clause checks for an edge case at the top of a function and exits immediately, so the rest of the function doesn’t need to nest inside a conditional to handle the normal case. See Guard Clauses.

A hermetic build has no dependency on unpinned tool versions, ambient system state, or network access during the build — a pinned lockfile alone doesn’t guarantee this if the build process reaches outside that pinned set for anything.

A hidden class (V8’s term) represents an object’s shape internally, letting the engine reuse optimized access code for objects sharing the same shape. See Hidden Classes and Inline Caches.

A higher-order function operates on functions themselves — map, filter, and a pipe helper are all higher-order functions. See Function Composition.

Hoisting describes how every declaration in a scope is set up before that scope’s code runs line by line — var hoists as undefined, function declarations hoist fully (body included), and let/const/class hoist but stay in the temporal dead zone until their own line runs. See Hoisting.

An HTTP method declares a request’s intent — GET retrieves without side effects, POST typically creates or performs a non-idempotent action, PUT/DELETE are idempotent. See the method table in Networking, Storage, and Workers.

An HTTP status code indicates a request’s outcome — 2xx for success, 4xx for a client-side problem (like a missing resource, 404), 5xx for a server-side failure. fetch resolves normally regardless of status; check response.ok/response.status to detect a failed request.

An idempotent operation produces the same end result whether it runs once or multiple times — a GET request is normally idempotent; a POST that charges a payment typically is not, unless the server explicitly supports safe retry.

Immutability means choosing to produce a new object/array on every update rather than mutating in place, even where mutation would work — avoiding surprises for anything else holding a reference to the original value.

Strings are primitives, and primitives can’t be mutated. str.toUpperCase() doesn’t change str — it returns a new string, which must be captured (str = str.toUpperCase();) if the change should stick.

IndexedDB stores structured, queryable data at a much larger scale than Web Storage, well suited to offline-capable applications. See IndexedDB.

An inline cache remembers what hidden class was seen last time a specific code location accessed a property, taking a fast path on a repeat match and falling back to general lookup on a mismatch.

An integrity level restricts what can be done to an object — preventExtensions blocks new properties, seal also blocks delete/reconfigure, freeze also blocks reassignment. All three are shallow. See Integrity Levels.

An internal slot is state the specification attaches to an object that JavaScript code can never read or write directly — only reachable indirectly through specified operations like Object.getPrototypeOf.

An invariant is a rule the specification enforces no matter what — a Proxy’s get trap cannot report a different value than a non-configurable, non-writable property’s real value, for example. Violating one throws a TypeError automatically.

An iterable implements the well-known Symbol.iterator method, which for...of and spread rely on. Arrays, strings, Map, and Set are all built-in iterables; a custom object can implement the protocol too. See Generators and Iterators.

Iteration means repeating a block of code — once per loop pass, or once per element when looping over a collection with for...of. See for, while, and for…of for the loop forms JavaScript provides.

An iterator is the object an iterable’s Symbol.iterator method returns — calling .next() repeatedly produces { value, done } pairs until done becomes true.

JSDoc comments (/** @param {Type} … */) annotate a function’s parameters and return value for editor tooling. See JSDoc Annotations.

Lab data comes from a controlled environment (a local DevTools profiler run), good for deep investigation and reproducible before/after comparison — but not necessarily representative of what real users on real devices actually experience.

Lexical scope means a function’s scope chain is fixed by where it’s written in the source, not by how or when it’s eventually called. This is what makes a closure possible: the scope chain a function closes over never changes based on its caller.

An ES module import is a live binding to the exporting module’s own variable — updates on the exporting side are visible through the import automatically. See Live Bindings and Module Cycles.

A locale identifier ("en-US", "de-DE", "en-GB") tells Intl.NumberFormat and Intl.DateTimeFormat which regional conventions to follow — decimal marks, grouping separators, currency symbol placement, date ordering — instead of assuming one fixed format for every reader.

localStorage stores string key/value pairs in the browser, available across page loads until explicitly cleared. It only stores strings, so structured data needs JSON.stringify/JSON.parse — see localStorage.

A lockfile records the exact resolved version of every dependency (and every dependency of those dependencies) an install actually used — unlike package.json’s version ranges, which allow some flexibility. Committing it to version control, and using npm ci in shared environments, keeps installs reproducible across contributors and CI.

A logic error — an off-by-one loop bound, a backwards condition, a wrong operator — never throws. The program runs and produces a plausible-looking, wrong answer. Catching one depends on checking output against what you actually expect, not on watching for a crash.

A macrotask (also called simply a “task”) — setTimeout, setInterval, I/O, a UI event — runs one at a time, and only once every pending microtask has already run. setTimeout(fn, 0) never means “immediately.”

Memoization wraps a pure function so a repeated call with the same arguments returns a cached result instead of recomputing it. See Memoization.

A memory leak happens when something keeps a reference to data alive longer than intended, so the garbage collector — which frees only unreachable memory — can never reclaim it. An event listener or closure that outlives its intended purpose is a common cause in JavaScript.

Message passing (postMessage) sends a structured-clone copy of data between a worker and the main thread — neither side can directly mutate the other’s objects, since nothing is shared by reference.

A microtask — a resolved promise’s .then/await continuation, or a queueMicrotask() callback — runs as soon as the current synchronous code finishes, and the entire microtask queue drains before the event loop touches even one macrotask.

A mock specifically verifies the interaction itself (call count, arguments) rather than exercising real behavior — useful when the fact of a call is what’s under test, such as confirming an email was sent.

A module is a file with its own scope; export/import is how code crosses between modules deliberately. See import and export.

A module cycle exists when module A imports from B, which (directly or transitively) imports back from A. Live bindings make many cycles resolvable, as long as nothing uses a binding at module top level before the cycle finishes evaluating.

Module resolution is the process of turning an import/require specifier into an actual file, and deciding whether to treat that file as CommonJS or an ES module — in Node, driven by file extension and the nearest package.json’s "type" field.

Mutation means changing a value’s contents in place — array.push(x) mutates array directly, while [...array, x] produces a new array and leaves the original untouched. Knowing which array methods mutate matters most once a reference to the same array is shared in more than one place.

Mutation testing measures test quality beyond code coverage — a surviving mutant reveals a gap where the suite ran the code but didn’t actually verify it meaningfully. See Mutation Testing.

A named export (export function add() {}) is imported by its exact name, inside curly braces (import { add } from './math.js';), optionally renamed with as. A module can have any number of named exports.

NaN results from an invalid numeric operation, such as 0 / 0 or Number("abc"). It is the one JavaScript value that is never === (or ==) to anything, including another NaN — test for it with Number.isNaN(x) instead. See Number Edge Cases.

An object (including arrays and functions, which are specialized objects) is compared by identity: two objects with identical contents are still unequal unless they’re literally the same object ({ a: 1 } === { a: 1 } is false). See Arrays and Objects for what this means in practice.

Observability means a system’s behavior can be understood from what it emits, without attaching a debugger to a live instance. See Observability Basics.

A parameter is the name written in a function’s own definition (function greet(name) {} — name is the parameter). Contrast with argument, the actual value supplied at a specific call site.

Every linter, codemod, bundler, and transpiler follows this same shape: parse source text into an AST, transform that AST, and generate source text from the result.

A plugin system should expose only the specific capabilities a plugin’s job requires — restricting the surface is a design discipline, not a real security boundary against a genuinely untrusted plugin. See Plugin Systems and Isolation Boundaries.

Ports-and-adapters (hexagonal architecture) makes core logic depend only on abstract interfaces, with concrete I/O swappable without touching it. See Ports and Adapters.

A primitive value — string, number, boolean, undefined, null, bigint, symbol — is compared by its content: two primitives with the same value are equal (5 === 5 is true). Contrast with Object, compared by identity instead.

A private field (#name) can only be read or written from inside its own class’s methods — code outside can’t access it, or even check whether it exists, unlike a naming convention like _name which is only a hint.

Node’s global process object exposes environment variables (process.env), command-line arguments (process.argv), and process control (process.exit()) — a Node-specific host API with no browser equivalent.

Progressive enhancement means a page’s essential functionality works without JavaScript, which then layers on additional capability — lazy-loaded images, richer interactions — rather than being a requirement for the page to work at all.

A Promise represents an eventual value — pending until it settles exactly once, either fulfilled (success) or rejected (failure). See Promise.

Promise.all([...]) runs independent promises concurrently instead of one after another, resolving with an array of their results once every one has succeeded — but rejecting as a whole the moment any single one rejects.

Property-based testing generates many varied inputs to check a general property (an invariant, a round-trip), shrinking any failure to a minimal reproducer. See Property-Based Testing.

Every object has an internal link — its prototype — to another object it delegates to. A property lookup that doesn’t find a match directly on the object continues up to its prototype. See Prototypes and Object.create.

The prototype chain is the sequence of delegated prototype links a property lookup follows — checking the object itself, then its prototype, then that prototype’s prototype, and so on, until a match is found (or the chain ends).

Prototype pollution corrupts Object.prototype via an unfiltered merge of attacker-controlled keys (__proto__) — a distinct, program-wide risk from DOM XSS. See Prototype Pollution.

Provenance answers “did this published package actually come from where it claims to,” verifiable via attestations rather than trusted purely on the registry’s word — one part of a genuine supply-chain threat model. See Supply-Chain Security.

A Proxy intercepts operations like property get/set through traps, falling back to default behavior for anything not explicitly trapped. See Proxy and Reflect.

A pure function’s output depends only on its input, and calling it never changes anything outside itself — no mutated arguments, no reassigned outer variables, no observable side effect. Pure functions are easier to test and reason about than ones with hidden dependencies or side effects.

A race condition happens when an unpredictable finishing order between concurrent operations changes the outcome — a slower, earlier-started request resolving after a faster, later one can overwrite correct data with stale data if nothing guards against it.

A realm is a fully separate global environment, with its own global object and its own copies of every built-in (its own Array, Object, and so on). Each iframe, and each worker, runs in its own realm — the reason arrayFromIframe instanceof Array can be false for a genuinely-array value from a different realm.

A ReferenceError means the code was valid JavaScript and started running, but a specific line looked up a name — a variable, function, or class — that wasn’t in scope at that point. See the ReferenceError reference entry for common causes.

Reflect mirrors the low-level operations a Proxy trap intercepts — Reflect.set, Reflect.get, and others — used inside a trap to delegate to normal, default behavior.

A regular expression (/pattern/flags) describes a pattern of text rather than one exact value — “any digit,” “one or more letters.” See Regular Expressions (Introduction).

A rejected promise settles with a failure reason (usually an Error) instead of a value. Inside an async function, an awaited rejection throws and can be caught with an ordinary try/catch.

A rest parameter uses ... in the opposite direction from spread — it collects the remaining arguments or destructured items into a single array, rather than expanding one out (function f(first, ...rest) {}).

A runtime is the combination of a JavaScript engine and the host APIs that engine is embedded in. A browser runtime adds document, window, and fetch; a Node runtime adds process, fs, and require/import for local files. Code using only language features runs identically in either runtime; code calling a host API only works where that API exists.

Runtime validation checks that a value genuinely matches an expected shape while the program is executing — necessary at any real boundary (a network response, parsed JSON, user input), since a TypeScript or JSDoc type is enforced only at compile/editor time, never at runtime.

The same-origin policy is the browser’s default: a script on one origin (scheme + host + port) cannot read response data from a different origin, unless that server explicitly opts in via CORS.

There is no partial-trust execution mode inside a single JavaScript realm — code run via eval can reach the global object and every built-in regardless of surrounding scope structure. Genuine isolation requires an actual boundary: a separate process or realm with no shared references.

Semantic versioning (semver) signals breaking (major), backward-compatible feature (minor), and backward-compatible fix (patch) changes through the version number itself. See Semantic Versioning.

A serialization hazard arises when deserializing untrusted data can trigger code execution — some legacy serialization formats/libraries support this; plain JSON.parse does not carry this specific risk, though its output can still feed a separate risk like prototype pollution if handled carelessly.

A service worker intercepts every network request from pages under its control, deciding whether to respond from the network, a cache, or a combination — the mechanism behind offline support. See Service Workers.

A shallow copy (made with spread, slice(), or Object.assign()) duplicates only the top level of an array or object. Any property whose value is itself an object or array still points at the exact same nested value in both the original and the copy — mutating it through either one affects both.

SharedArrayBuffer provides genuine shared memory between workers, paired with Atomics for race-free operations on it. Requires cross-origin isolation headers. See SharedArrayBuffer and Atomics.

Short-circuiting means an expression stops evaluating as soon as its result is already known — false && expensiveCall() never runs expensiveCall(), because && already knows the result is false. ?. and ?? short-circuit the same way around null/undefined.

A source map lets a debugger show original source, variable names, and stack traces for code that went through minification, transpilation, or bundling — without one, debugging transformed production code means working with unreadable generated output directly.

Spread (...) expands an iterable or object’s own properties into a new array ([...arr]), object ({...obj}), or function call’s argument list. It produces a shallow copy — see shallow copy.

A stack trace lists the function calls active when an error was thrown, top line first — where the error was actually detected, followed by what called what to get there. The true cause of a bug can be anywhere in that chain, not necessarily at the top.

Starvation happens when a lower-priority or less-frequent task is perpetually pre-empted by other scheduled work, never actually getting a chance to run — a risk worth testing for explicitly in any system with more than one priority level of work.

A statement is a complete instruction — let x = 5;, if (x) { }, return x;. Statements can contain expressions, but a statement itself produces no value you can assign or pass around. See Statements and Expressions for the full distinction.

A stream handles data incrementally — a large file, an HTTP body — avoiding the memory cost of loading everything at once. See Streams.

Strict mode, entered with 'use strict'; or automatically inside any ES module or class body, turns silent mistakes — like assigning to an undeclared variable — into thrown errors instead. See the Strict mode reference entry for the full list of behavior changes.

Structured concurrency means no child operation outlives its parent unaccounted for — requires explicit cancellation propagation (an AbortController wired to the parent’s signal), since it doesn’t happen automatically. See Structured Concurrency.

A substring is a contiguous run of characters taken from within a larger string — "hello".slice(1, 3) extracts the substring "el". See String Methods.

A SyntaxError is caught while the engine parses a file, before executing any of it — so even statements written before the mistake never run. See the SyntaxError reference entry for common causes.

A tail call is the literal, final action of a function before returning. The specification allows reusing the caller’s stack frame for one (proper tail calls), but only Safari’s JavaScriptCore actually implements it — not reliable for stack safety elsewhere. See Proper Tail Calls.

A TC39 stage (0 Strawperson through 4 Finished) marks a proposal’s maturity and the compatibility responsibility that comes with it. See The TC39 Stage Process.

The temporal dead zone is the period where a let, const, or class binding exists (hoisted) but is not yet initialized — accessing it during this window throws a ReferenceError, rather than silently returning undefined the way an unassigned var would.

A test double replaces a real dependency for testing purposes. See Test Doubles for the three common kinds — stub, mock, fake — and when each fits.

this’s value is determined by how a function is called, not where it’s written — a method call binds it to the object before the dot, a plain call leaves it undefined, and call/apply/bind set it explicitly. See this, call, apply, and bind.

A threat model names what’s worth protecting (assets), who might attack it (actors), and where data crosses from less-trusted to more-trusted context (trust boundaries). See Threat Modeling.

Throttle caps a function’s execution rate to at most once per interval — suited to a high-frequency event that should stay roughly, but not exactly, continuously updated. See Throttle and Debounce.

throw raises an error value, immediately interrupting normal execution — control jumps to the nearest enclosing catch, or up the call stack until one is found, or crashes the program if none is. See Throwing at a Validation Boundary.

A timestamp represents a moment in time as a plain number rather than a calendar-style structure. JavaScript’s Date stores milliseconds since the Unix epoch (1970-01-01T00:00:00 UTC); subtracting two Date objects yields a millisecond difference directly usable for elapsed-time calculations.

Tree-shaking removes exports a bundler can prove are never used. Side-effecting module code (a top-level console.log, a global registration) can defeat this proof even when the specific export itself genuinely goes unused.

Trusted Types shifts DOM XSS defense from a convention developers must remember into a platform-enforced boundary. See Trusted Types.

A truthy value behaves as true where a boolean is expected, such as an if condition. Every value is truthy except the six falsy ones — notably, "0", [], and {} are all truthy even though they might look “empty” or “zero-like.”

Type narrowing happens when a runtime check (typeof value === 'string') lets TypeScript treat a value as a more specific type for the rest of that code branch, enabling type-specific operations safely.

A TypeError means the referenced value exists but doesn’t support what the code tried to do with it — reading a property of null, or calling something that isn’t a function. See the TypeError reference entry.

A unit test checks one small piece of behavior in isolation — often a single pure function. See Arrange / Act / Assert for the standard structure used to write one clearly.

A weak reference — as used by WeakMap/WeakSet keys — doesn’t keep an object alive on its own. Once nothing else references that object, it can be garbage collected even while a WeakMap still “holds” it as a key.

A web worker runs on a genuinely separate thread, with no DOM access, communicating with the main thread only via message passing. See Web Workers.

WebAssembly (Wasm) runs compiled code at near-native speed, well suited to CPU-intensive, self-contained work — but crossing the JavaScript/Wasm boundary has real data-copying cost, and Wasm has no direct DOM access, making it inappropriate for typical application logic.

A well-known symbol is a specification-defined symbol used as a customization point — implementing [Symbol.iterator] makes an object work with for...of; implementing [Symbol.toPrimitive] customizes coercion. See Symbols and Well-Known Symbols.

Cross-site scripting (XSS) happens when untrusted text is inserted into a page in a way that gets parsed as HTML — commonly via innerHTML — letting an embedded <script> tag or event-handler attribute execute. Using textContent for untrusted text avoids it, since it never parses its input as markup.

Yield delegation (yield*) forwards each value from another iterable in place, and captures its return value as the expression’s result — the basis for composing generators into staged pipelines. See Generator Delegation.