
Security News
crates.io Ships Security Tab and Tightens Publishing Controls
crates.io adds a Security tab backed by RustSec advisories and narrows trusted publishing paths to reduce common CI publishing risks.
@durable-streams/server
Advanced tools
Node.js reference server implementation for the Durable Streams protocol.
npm install @durable-streams/server
This package provides a reference implementation of the Durable Streams protocol for Node.js. It supports both in-memory and file-backed storage modes, making it suitable for development, testing, and production workloads.
For a standalone binary option, see the Caddy-based server.
import { DurableStreamTestServer } from "@durable-streams/server"
const server = new DurableStreamTestServer({
port: 4437,
host: "127.0.0.1",
})
await server.start()
console.log("Server running on http://127.0.0.1:4437")
Fast, ephemeral storage for development and testing:
import { DurableStreamTestServer, StreamStore } from "@durable-streams/server"
const store = new StreamStore()
const server = new DurableStreamTestServer({
port: 4437,
store,
})
Persistent storage with streams stored as log files and LMDB for metadata:
import {
DurableStreamTestServer,
FileBackedStreamStore,
} from "@durable-streams/server"
const store = new FileBackedStreamStore({
path: "./data/streams",
})
const server = new DurableStreamTestServer({
port: 4437,
store,
})
Track stream lifecycle events (creation, deletion):
import {
DurableStreamTestServer,
createRegistryHooks,
} from "@durable-streams/server"
const server = new DurableStreamTestServer({
port: 4437,
hooks: createRegistryHooks({
registryPath: "__registry__",
}),
})
The registry maintains a system stream that tracks all stream creates and deletes, useful for building admin UIs or monitoring.
interface TestServerOptions {
port?: number
host?: string
store?: StreamStore | FileBackedStreamStore
hooks?: StreamLifecycleHook[]
cors?: boolean
cursorOptions?: CursorOptions
}
class DurableStreamTestServer {
constructor(options?: TestServerOptions)
start(): Promise<void>
stop(): Promise<void>
readonly port: number
readonly baseUrl: string
}
In-memory stream storage:
class StreamStore {
create(path: string, contentType: string, options?: CreateOptions): Stream
get(path: string): Stream | undefined
delete(path: string): boolean
append(path: string, data: Uint8Array, seq?: string): void
read(path: string, offset: string): ReadResult
}
File-backed persistent storage (log files for streams, LMDB for metadata) with the same interface as StreamStore.
export { DurableStreamTestServer } from "./server"
export { StreamStore } from "./store"
export { FileBackedStreamStore } from "./file-store"
export { encodeStreamPath, decodeStreamPath } from "./path-encoding"
export { createRegistryHooks } from "./registry-hook"
export {
calculateCursor,
handleCursorCollision,
generateResponseCursor,
DEFAULT_CURSOR_EPOCH,
DEFAULT_CURSOR_INTERVAL_SECONDS,
type CursorOptions,
} from "./cursor"
export type {
Stream,
StreamMessage,
TestServerOptions,
PendingLongPoll,
StreamLifecycleEvent,
StreamLifecycleHook,
} from "./types"
Use the conformance test suite to validate protocol compliance:
import { runConformanceTests } from "@durable-streams/server-conformance-tests"
runConformanceTests({
baseUrl: "http://localhost:4437",
})
Apache-2.0
FAQs
Node.js reference server implementation for Durable Streams
The npm package @durable-streams/server receives a total of 827 weekly downloads. As such, @durable-streams/server popularity was classified as not popular.
We found that @durable-streams/server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
crates.io adds a Security tab backed by RustSec advisories and narrows trusted publishing paths to reduce common CI publishing risks.

Research
/Security News
A Chrome extension claiming to hide Amazon ads was found secretly hijacking affiliate links, replacing creators’ tags with its own without user consent.

Security News
A surge of AI-generated vulnerability reports has pushed open source maintainers to rethink bug bounties and tighten security disclosure processes.