v1.0.5  ·  MIT  ·  Node 20+  ·  TypeScript 5

Build TypeScript Backends
Without the Bloat

Production-grade. Memory-safe. Native Node.js.
Every feature built from core modules — no Express, no pg, no Prisma.

No Express  ·  No pg  ·  No Prisma  ·  No jsonwebtoken  ·  No bcrypt  ·  No multer

Get Started → GitHub ↗ Examples
core cli Node 20+ TypeScript 5+ 2 deps MIT CI
bash — Quick Start
$ npm install -g @streetjs/cli
# installs the street CLI globally
$ street create my-api
# scaffolds TypeScript project with PostgreSQL, JWT, Docker
$ cd my-api && npm install && street dev
[street] Listening on http://0.0.0.0:3000 · Node 20 · ESM · OpenAPI at /openapi.json
2Runtime Deps
PG v3Wire Protocol
AES-256Session Crypto
MITOpen Source
Core Capabilities
Everything you need. Nothing you don't.

Every feature is implemented directly from Node.js core modules with explicit memory bounds.

🔷

TypeScript First

Strict mode, NodeNext ESM, decorator metadata, full type inference. Zero any in the framework source.

🛡️

Memory-Safe by Design

Bounded body limits, connection pools, ring-buffer telemetry, LRU eviction, WebSocket caps. Every component has an explicit ceiling.

🐘

Native PostgreSQL Driver

Wire protocol v3 over node:net. SCRAM-SHA-256 auth. Streaming rows with socket-level backpressure. No pg.

💉

Dependency Injection

IoC container with constructor injection, singleton registry, and circular dependency detection via reflect-metadata.

🔐

Security Built-in

JWT, AES-256-GCM sessions, scrypt vault, sliding-window rate limiter, XSS sanitizer, CSRF, CORS, CSP — all included.

⚡

Real-Time Ready

Bounded WebSocket server with heartbeat, typed event emitter, and SSE with keep-alive. Auth hook on upgrade.

📋

OpenAPI 3.1 Auto-gen

Spec generated from @ApiOperation decorators. Always in sync. Served at /openapi.json.

🔄

Clustering & Telemetry

node:cluster coordinator with IPC heartbeat, auto-restart, graceful shutdown, and P50/P99 latency tracking.

🚀

CLI Tooling

street create, street dev, street generate, street migrate:create — full lifecycle from one binary.

Quick Example
A complete production API. One file. No extra packages.

PostgreSQL, JWT auth, rate limiting, and auto-generated OpenAPI — all from @streetjs/core.

src/main.tsTypeScript
```typescript import 'reflect-metadata'; import { streetApp, Injectable, Controller, Get, Post, PgPool, securityHeaders, corsMiddleware, RateLimiter, authMiddleware, JwtService, ApiOperation, } from '@streetjs/core'; import type { StreetContext } from '@streetjs/core'; @Injectable() class ItemService { constructor(private readonly pool: PgPool) {} async findAll() { const { rows } = await this.pool.query( 'SELECT id, name, created_at FROM items ORDER BY created_at DESC' ); return rows; } async create(name: string) { const { rows } = await this.pool.query( 'INSERT INTO items (name) VALUES ($1) RETURNING *', [name] ); return rows[0]; } } @Controller('/api/items') class ItemController { constructor(private readonly svc: ItemService) {} @Get('/') @ApiOperation({ summary: 'List items', tags: ['items'] }) async list(ctx: StreetContext): Promise { ctx.json({ items: await this.svc.findAll() }); } @Post('/') @ApiOperation({ summary: 'Create item', tags: ['items'] }) async create(ctx: StreetContext): Promise { const { name } = ctx.body as { name: string }; ctx.json(await this.svc.create(name), 201); } } const jwt = new JwtService(process.env.JWT_SECRET!); const limiter = new RateLimiter({ windowMs: 60_000, maxRequests: 100 }); const app = streetApp({ port: 3000 }); app.use(securityHeaders); app.use(corsMiddleware(['https://app.example.com'])); app.use(limiter.middleware()); app.use(authMiddleware(jwt)); app.registerController(ItemController); await app.listen(); // [street] Listening on http://0.0.0.0:3000 // [street] OpenAPI → http://0.0.0.0:3000/openapi.json ```
Documentation
Everything you need to ship.

Comprehensive guides, API references, and real-world examples for every part of the framework.

🚀Getting StartedInstall, scaffold, configure, and run in 60 seconds 🎮ControllersHTTP handlers, routing, context API, validation 💉Dependency InjectionIoC container, constructor injection, singletons 🐘PostgreSQLWire driver, connection pool, repositories, migrations 🔐SecurityJWT, sessions, rate limiting, XSS, vault, CSRF ⚡Real-TimeWebSocket server, SSE, typed events, heartbeat 🐳DeploymentDocker, production config, environment variables 📦ExamplesREST API, WebSocket chat, file upload, auth flow 🌍Use Cases16 industry verticals — fintech, IoT, AI, gaming 🛠️CLI ReferenceAll street commands, flags, and options 🧪TestingIntegration tests, test runner, real PostgreSQL ❓FAQCommon questions, migration guides, troubleshooting

Built in the open. Improved together.

Street is MIT-licensed and actively developed. Bug reports, feature requests, and contributions are welcome.

⭐ Star on GitHub 🐛 Issues 💬 Discussions 🤝 Contribute 📋 Changelog 🗺️ Roadmap