Engineering Labs & Architecture 2026

Full-Stack Architecture Labs

34 production-grade engineering modules covering Svelte 5 Universal Runes & Async streaming, SvelteKit 2 routing & adapters, Nuxt 4, Nitro & Hono engines, Node 24 / Bun / Deno runtimes, SSG/SSR rendering strategies, strict CSP security, and software licence architectures.

HTML5 & Standards <dialog>

01. Modern HTML5, Semantics & Web APIs

Master native accessible modals, exclusive accordions, clientless form validation, and core browser Web Standard APIs including Streams and Web Crypto.

<dialog> <details name="..."> Web Standards Streams API Web Crypto URLPattern
Tailwind CSS v4 @theme Tokens

02. Tailwind CSS v4, Styling & Asset Architecture

Explore Tailwind CSS v4 CSS-first token configuration, container queries, modern layout systems, responsive image formats, and immutable asset delivery.

@theme Tokens @container Queries Asset Pipeline AVIF / WebP Immutable Cache
TypeScript 6 satisfies operator

03. TypeScript 6 & Strict Engineering

Enforce sound type boundaries, literal type preservation with satisfies, const type parameters, discriminated unions, and strict modular compilation.

satisfies operator Const Type Parameters Discriminated Unions Exhaustiveness Strict Modules
Icons & Assets SVG Favicons

04. Modern Icons & Responsive Favicon Systems

Design theme-reactive SVG favicons, Apple touch icons, PWA manifest configurations, and high-performance single-node CSS mask icon systems.

SVG Favicons Dark/Light Media Web App Manifest CSS Mask Icons DOM Optimisation
Tooling & CI/CD pnpm-workspace

05. PNPM Workspaces, Monorepos & CI/CD Pipelines

Configure high-speed PNPM workspaces using the catalog protocol, immutable lockfile validation, and multi-OS GitHub Actions CI matrix pipelines.

pnpm-workspace catalog: Protocol ci.yml Matrix GitHub Actions Strict Lockfiles
JS Runtimes Node.js 24 LTS

06. Modern JS Runtimes: Node.js 24, Bun & Deno 2

Benchmark execution speed, cold-start latency, package management performance, security sandbox permissions, and Web API parity across top runtimes.

Node.js 24 LTS Bun 1.2 Deno 2.2 Granular Permissions Cold Starts Web APIs Parity
Build & Packaging Vite 6 / Rolldown

07. Vite 6 Architecture & Library Packaging

Understand Vite 6 next-gen bundling internals, lightning-fast HMR, TypeScript declaration generation, and multi-format npm library packaging with exports.

Vite 6 / Rolldown HMR Pipelines TypeScript d.ts unbuild package.json exports
Server Engines UnJS Nitro

08. Universal Server Engines: Nitro & Hono

Build portable server backends with UnJS Nitro (universal presets & auto-imports) and deploy ultra-lightweight, zero-overhead edge APIs with Hono.

UnJS Nitro Hono Framework Universal Presets Typed Middleware Hono RPC
Project Architecture Full-Stack App Hierarchy

09. Modern Project Types & Directory Structures

Architect production-grade codebases across full-stack applications, static sites, component libraries, and enterprise monorepo workspace hierarchies.

Full-Stack App Hierarchy Library Architecture Monorepos SSG vs Full-Stack Server Isolation
ECMAScript Math.sumPrecise

10. Precision Math, Maps & Modern Iterators

Eliminate floating-point accumulation bugs with Math.sumPrecise, leverage Map key memoization, and compose lazy data pipelines with Iterator helpers.

Math.sumPrecise Map.getOrInsert Iterator Helpers TS6 Strict Modules
ECMAScript Uint8Array.prototype.toBase64

11. Binary Streams, Buffers & Container Layouts

Execute native browser-level Base64 and Hex conversions, stream async iterables, and construct modular container-responsive interfaces.

Uint8Array.prototype.toBase64 toHex Array.fromAsync Tailwind v4 @container
HTML5 & Standards HTML5 inert

12. Discrete Transitions & DOM Interactivity

Orchestrate smooth zero-JavaScript entrance animations from display: none, isolate background accessibility trees, and apply modern popovers.

HTML5 inert CSS @starting-style allow-discrete View Transitions API
TypeScript 6 using keyword

13. Resource Scopes & Explicit Management

Enforce automatic resource cleanup on block-scope exit with explicit resource management and decouple asynchronous lifecycle resolvers.

using keyword Symbol.dispose Promise.withResolvers() Deterministic Teardown
Rendering Strategies Prerendering (SSG)

14. Rendering Strategies: SSG, SSR, Hybrid & CSR

Compare static generation, dynamic server rendering, hybrid incremental regeneration, and client-side single page app models for speed and cost.

Prerendering (SSG) Server-Side Rendering (SSR) Hybrid / ISR Client-Side Rendering (CSR) TTFB vs FCP
Hydration & Serialisation Hydration Pipeline

15. Hydration Engines & Data Serialisation

Examine the client hydration lifecycle, partial/island hydration models, streaming SSR, and safe complex data serialisation with devalue.

Hydration Pipeline Island Hydration Streaming SSR devalue SuperJSON Data Boundaries
Web Security & Transitions Strict CSP

16. Security: Strict CSP, Nonces & View Transitions

Harden web applications against XSS with cryptographic CSP nonces, strict headers, and coordinate fluid page animations with View Transitions.

Strict CSP Nonce-based Security Frame Sandboxing View Transitions API Morph Transitions
API Architecture & RPC @standard-schema/spec

17. Schema Validation & Type-Safe RPC

Enforce runtime boundaries with Standard Schema, auto-generate OpenAPI documentation, and implement end-to-end type-safe RPC contracts.

@standard-schema/spec Zod / Valibot Hono RPC OpenAPI OAS 3.1 Remote Server Functions
Real-Time & Streaming Server-Sent Events (SSE)

18. Real-Time Streaming & Webhook Signatures

Stream real-time telemetry over SSE and WebSockets, verify incoming webhook signatures with timing-safe HMAC, and prevent replay attacks.

Server-Sent Events (SSE) WebSockets HMAC-SHA256 Timing-Safe Verify Idempotency Keys
Backend & Data Neon Serverless

19. Database Engines: Neon, Turso, libSQL, SQLite, PostgreSQL & postgres.js

Architect high-performance data layers across Neon Serverless Postgres, Turso edge libSQL, postgres.js, embedded SQLite, and stateful PostgreSQL with Drizzle ORM.

Neon Serverless Turso & libSQL postgres.js SQLite & better-sqlite3 PostgreSQL (pg) Drizzle ORM
Backend & Data @upstash/redis

20. Edge Caching & Sliding Window Rate Limiting

Deploy stateless HTTP Redis caching, defend APIs against brute force attacks with sliding window algorithms, and manage distributed edge state.

@upstash/redis @upstash/ratelimit Sliding Window Algorithm Distributed Locks Edge Tokens
Auth & Security Better Auth

21. Modern Authentication, Passkeys & Better Auth

Implement passwordless biometric passkeys, secure HttpOnly cookie session rotation, and modular authentication plugins with Better Auth.

Better Auth WebAuthn Passkeys HttpOnly Cookies Session Rotation PKCE OAuth
Object Storage & R2 @aws-sdk/client-s3

22. Object Storage: S3 Client, Cloudflare R2 & Presigned Uploads

Architect scalable media and file storage with AWS SDK v3, presigned client upload tokens, and zero-egress Cloudflare R2 buckets.

@aws-sdk/client-s3 Cloudflare R2 Presigned URLs Zero Egress Multipart Uploads Bucket Policies
Cloud & Deployment Cloudflare Workers / Pages

23. Cloud Platforms: Cloudflare Workers, Vercel & Netlify

Evaluate deployment strategies across Cloudflare Workers, Vercel, and Netlify, comparing V8 isolate latency with containerised nodes.

Cloudflare Workers / Pages Vercel Serverless & Edge Netlify Edge V8 Isolates vs Node Deploy Options
Testing & Quality Vitest

24. Modern Testing Architecture: Vitest & Playwright

Build a rock-solid test suite: ultra-fast unit testing with Vitest, accessible component testing, and resilient browser-driven end-to-end testing with Playwright.

Vitest DOM Testing Library Playwright E2E Mock Service Worker (MSW) Coverage Reports
SEO & Analytics HTML5 <head> Meta

25. SEO, Metadata & Privacy-First Web Analytics

Maximise search engine visibility with standard semantic metadata, Open Graph cards, and JSON-LD structured data while tracking cookieless analytics.

HTML5 <head> Meta Open Graph & Twitter Cards JSON-LD Schema Plausible / PostHog Core Web Vitals
Monetisation & Billing Polar.sh MoR

26. Site & Project Monetisation Models

Monetise developer tools and SaaS platforms with Merchant of Record tax handling, subscription checkouts, paywalled feature gates, and usage metering.

Polar.sh MoR Stripe Billing & Webhooks LemonSqueezy Tiered Pro Access Usage Metering
Software Licences MIT / Apache 2.0 / BSD

27. Software Licence Types & Open Source Matrix

Navigate permissive, copyleft, and source-available software licences with a comprehensive decision matrix and interactive legal compatibility advisor.

MIT / Apache 2.0 / BSD GPLv3 / AGPLv3 MPL-2.0 BSL / FSL Source-Available Licence Matrix Selector
Containers & IaC Podman Rootless

28. Containers, Orchestration & IaC: Podman, Docker, OCI, ECS & Terraform

Compare rootless daemonless Podman with Docker, evaluate Container as a Service (ECS/Render) vs FaaS, and declare infrastructure with Terraform.

Podman Rootless Docker & OCI AWS ECS / Fargate Render PaaS Terraform / OpenTofu Wrangler IaC
Developer Workstations Windows 11 WSL2

29. Developer Workstations: Windows 11 WSL2 vs Fedora 44, VS Code vs VSCodium & Node 26

Benchmark development workstation environments across Windows 11 WSL2 and native Fedora 44 Linux, comparing VS Code, VSCodium, Node 26, and OpenRemote.

Windows 11 WSL2 Fedora 44 Linux VS Code Remote VSCodium (Open VSX) Node.js 26 LTS pnpm v12 Catalogs OpenRemote
Defensive Web Security Strict CSP Level 3

30. Modern Web Security: Strict CSP Level 3, Nonces & Isolation

Harden full-stack web applications with strict cryptographic CSP Level 3 nonces, Cross-Origin Opener/Embedder Isolation, Trusted Types, and fine-grained Permissions Policy.

Strict CSP Level 3 COOP / COEP / CORP Subresource Integrity (SRI) Trusted Types API Sanitizer API Permissions-Policy
Privacy & Tracking Defense Global Privacy Control (GPC)

31. Web Privacy Engineering, Tracking Defenses & Anti-Fingerprinting

Protect user privacy against canvas/audio/font entropy fingerprinting, bounce tracking, CNAME cloaking, and implement Sec-GPC compliance with partitioned cookies.

Global Privacy Control (GPC) Anti-Fingerprinting Jitter CHIPS Partitioned Cookies CNAME Cloaking Defense Link Decoration Stripping Ephemeral Storage
Oblivious Protocols & Anonymity Oblivious HTTP (RFC 9458)

32. Web Anonymity: Oblivious HTTP (OHTTP) & Private State Tokens

Decouple client network identities from application payloads with Oblivious HTTP (OHTTP), issue fraud-preventing Private State Tokens, and integrate onion routing.

Oblivious HTTP (RFC 9458) Private State Tokens (RFC 9578) Onion-Location Header Blind Signatures Zero-Knowledge Verifiers Differential Privacy
Bot Governance & Anti-Scraping RFC 9309 Robots Protocol

33. Robots, AI Web Scrapers & Bot Mitigation Architecture

Govern AI/LLM crawlers with RFC 9309 and llms.txt, enforce machine-readable EU TDM reservations, analyze JA4 TLS fingerprints, and deploy zero-tracking Proof-of-Work bot defenses.

RFC 9309 Robots Protocol llms.txt Discovery X-Robots-Tag: noai EU Article 4 TDM JA4 TLS Fingerprinting Proof-of-Work (Altcha / Turnstile)
EU Compliance & Governance GDPR DSAR Automation

34. EU Data Regulations: GDPR, ePrivacy, DMA/DSA & EU AI Act

Implement robust compliance architectures for GDPR erasure/export webhooks, ePrivacy consent state machines, EU AI Act content transparency, and EU data sovereignty routing.

GDPR DSAR Automation ePrivacy Cookieless Model DMA / DSA Portability EU AI Act Disclosures EU Sovereign Data Residency Audit Trails