Auth, realtime, ORM, jobs, messaging, observability and a signed plugin ecosystem — included by default. No Express. No pg. No Prisma. Just 3 runtime dependencies.
Documentation · Get Started · Compare · Plugins · Discussions · Discord
StreetJS is a TypeScript backend framework that ships the things real applications need — HTTP, dependency injection, a native database layer, auth, realtime, jobs, messaging and observability — as first-class, typed building blocks. It is built directly on Node.js core modules (node:http, node:net, node:crypto, node:stream, node:cluster) with only three runtime dependencies (reflect-metadata, ws, zod).
It targets five problems that slow teams down:
- Dependency sprawl — a typical Node backend pulls in Express +
pg+ an ORM + a validator + an auth library + a WebSocket lib, each with its own transitive tree. StreetJS replaces that stack with one typed framework and a tiny dependency surface. - Integration complexity — auth, realtime, ORM and OpenAPI are designed to work together, sharing the same context and types, instead of being glued together by hand.
- Supply-chain risk — fewer dependencies plus signed plugins, npm provenance, SBOM generation, CodeQL and secret scanning mean a smaller, more auditable attack surface.
- Cost of infrastructure — dependency-light services with fast cold starts are cheaper to self-host; you own your data and your bill (see StreetJS on a Budget).
- Time-to-production —
street createscaffolds a production-ready project (PostgreSQL, JWT, Docker, CI) in seconds.
Project status (honest): the engineering is mature and CI-green; the gaps are community size and ecosystem breadth, not core capability. See the candid Gap Analysis.
A feature comparison against the most common Node.js choices. "Built in" means first-party and shipped with the framework; "plugin/3rd-party" means you assemble it yourself.
| Capability | StreetJS | Express | Fastify | NestJS |
|---|---|---|---|---|
| TypeScript-first | ✅ native | @types |
✅ good | ✅ native |
| Dependency footprint | 3 runtime deps | minimal core + many add-ons | lean core + plugins | larger (many @nestjs/*) |
| Routing + DI | ✅ built in | ❌ | ✅ built in | |
| Auth (JWT/sessions/RBAC/MFA) | ✅ built in | ❌ 3rd-party | ❌ 3rd-party | @nestjs/passport |
| Realtime (WebSocket + SSE) | ✅ built in | ❌ 3rd-party | @nestjs/websockets |
|
| ORM / DB | ✅ native PG/MySQL/SQLite + ORM | ❌ bring your own | ❌ bring your own | |
| OpenAPI generation | ✅ built in | ❌ 3rd-party | ✅ @nestjs/swagger |
|
| Signed plugin system | ✅ Ed25519 + provenance | ❌ | ||
| AI building blocks | ✅ @streetjs/ai + OpenAI plugin |
❌ | ❌ | ❌ |
Comparison is feature-coverage, not performance. Benchmark your own workload — see Performance and the full honest writeups under Compare.
Scaffold a project (recommended):
npx @streetjs/cli create my-app
cd my-app
npm install
npm run devOr add the framework to an existing project:
npm install streetjsMinimal application:
import 'reflect-metadata';
import { streetApp, Controller, Get } from 'streetjs';
import type { StreetContext } from 'streetjs';
@Controller('/api')
class HelloController {
@Get('/hello')
async hello(ctx: StreetContext) {
ctx.json({ message: 'Hello from StreetJS!' });
}
}
const app = streetApp({ port: 3000 });
app.registerController(HelloController);
await app.listen();
// [street] Listening on http://0.0.0.0:3000Requires Node.js ≥ 20, TypeScript ≥ 5.0, and
"type": "module". Full setup in Getting Started.
| Area | What's included |
|---|---|
| Core | HTTP server, compiled-regex router, dependency injection, middleware, typed context, OpenAPI 3.1 generation, API versioning |
| Data | Native PostgreSQL wire driver (SCRAM-SHA-256), native MySQL, SQLite, connection pool, repositories, migrations, query builder, schema introspection, first-party ORM |
| Security | JWT, AES-256-GCM sessions, scrypt vault, RBAC, MFA (TOTP), WebAuthn/passkeys, mTLS, rate limiting, XSS sanitizer, CSRF, field-level encryption |
| Realtime | Bounded WebSocket server with channels & presence, Server-Sent Events |
| Messaging | Kafka, RabbitMQ, Redis, NATS transports; webhook dispatcher |
| AI | @streetjs/ai building blocks and the official OpenAI plugin |
| Microservices | HTTP/2, gRPC, circuit breaker, service registry, distributed lock, CQRS, saga, event bus |
| Observability | OpenTelemetry (OTLP), Prometheus /metrics, structured logging, health checks, P50/P99 telemetry |
| DevOps | street CLI (create/dev/build/generate/migrate/…), clustering, Docker scaffolding, GitHub Actions CI with provenance |
| Ecosystem | 19 official signed plugins, a plugin registry, and frontend SDKs (@streetjs/{client,react,next,vue,nuxt}) |
Full reference: Documentation.
19 official, Ed25519-signed plugins published under the @streetjs/ scope. Browse them on the Official Plugins page.
| Category | Plugins |
|---|---|
| Payments | Stripe, PayPal |
| Messaging / comms | Twilio, SendGrid, Africa's Talking, Kafka, RabbitMQ, NATS |
| Storage | Amazon S3, Cloudflare R2 |
| AI | OpenAI |
| Identity | Auth0, Clerk, Supabase, Firebase |
| Databases | PostgreSQL, MySQL, MongoDB, Redis |
Build your own with the Plugin Author Guide and get it certified.
StreetJS treats supply-chain integrity as a first-class concern:
- Ed25519 plugin signing — official plugin manifests are signed; signatures are verified before load.
- npm provenance — packages are published from CI with provenance attestations.
- SBOM — a Software Bill of Materials is generated for releases.
- CodeQL — static analysis on every push (
codeql.yml). - Secret scanning —
secret-scan.ymlplus gitleaks configuration. - OpenSSF Scorecard — continuous supply-chain scoring (
scorecard.yml). - Runtime certification —
npm run verify:runtimeproduces a published certification report.
Report vulnerabilities privately via the Security Policy.
- 🎧 Discord — real-time help, technical discussion, and release news
- 💬 Discussions — questions, ideas, show-and-tell
- 🐛 Issues — bugs and feature requests
- 🧭 Contributing Guide · Contributor Path · Code of Conduct
- 🏛️ Governance & RFC process
- 🗺️ Roadmap · Adoption & Go-To-Market Roadmap
- 🔬 Runtime Certification · Gap Analysis
This is an npm-workspaces monorepo of 47 packages. The headline packages:
| Package | npm | Description |
|---|---|---|
packages/core |
streetjs |
The framework runtime |
packages/cli |
@streetjs/cli |
Project scaffolding & dev tooling |
packages/orm |
@streetjs/orm |
First-party ORM |
packages/plugin-* |
@streetjs/plugin-* |
19 official signed plugins |
packages/core-compat |
@streetjs/core |
Deprecated shim that re-exports streetjs |
npm run build # build all packages
npm test # core integration tests (requires PostgreSQL)
npm run verify:runtime # runtime certification batterySee CONTRIBUTING.md for the full development and test guide.
MIT © street contributors
Add distributed tracing to any StreetJS app with the built-in OtelTracer and otelMiddleware — no @opentelemetry/* packages required.
import { OtelTracer, otelMiddleware } from 'streetjs';
const tracer = new OtelTracer({ serviceName: 'my-api' });
app.use(otelMiddleware(tracer)); // one span per request, W3C traceparent propagation
process.once('SIGTERM', async () => { await tracer.flush(); tracer.shutdown(); });Exports spans via OTLP/HTTP to Jaeger, Grafana Tempo, or any OpenTelemetry Collector.
Set OTEL_EXPORTER_OTLP_ENDPOINT to point at your collector (default: http://localhost:4318).