
Security News
Frontier AI Is Now Critical Infrastructure
The Fable shutdown shows how quickly model access can become a business continuity risk for AI-dependent engineering teams.
@fluojs/websockets
Advanced tools
Decorator-based WebSocket gateway authoring core for Fluo, with explicit Node, Bun, Deno, and Cloudflare Workers raw websocket bindings on dedicated subpaths.
English 한국어
Decorator-based WebSocket gateway authoring for the fluo runtime.
npm install @fluojs/websockets ws
Use this package to add real-time WebSocket capabilities to your fluo application. It provides a clean, decorator-driven API for handling connections, messages, and disconnections, with first-class support for multiple runtimes (Node.js, Bun, Deno, Cloudflare Workers).
Use WebSocketModule.forRoot() when you want the default Node.js-backed websocket runtime.
import { WebSocketGateway, OnConnect, OnMessage, WebSocketModule } from '@fluojs/websockets';
import { Module } from '@fluojs/core';
@WebSocketGateway({ path: '/chat' })
class ChatGateway {
@OnConnect()
handleConnect(socket) {
console.log('Client connected');
}
@OnMessage('ping')
handlePing(payload, socket) {
socket.send(JSON.stringify({ event: 'pong', data: payload }));
}
}
@Module({
imports: [WebSocketModule.forRoot()],
providers: [ChatGateway],
})
export class AppModule {}
Multiple gateways can share the same path; their handlers will execute in discovery order.
@WebSocketGateway({ path: '/events' })
class MetricsGateway {
@OnMessage('metrics')
handleMetrics(data) { /* ... */ }
}
For server-backed Node adapters (Node.js, Express, Fastify), you can opt into a dedicated listener port. Fetch-style runtimes (@fluojs/websockets/bun, @fluojs/websockets/deno, and @fluojs/websockets/cloudflare-workers) reject serverBacked.
@WebSocketGateway({
path: '/chat',
serverBacked: { port: 3101 }
})
class DedicatedChatGateway {}
Use WebSocketModule.forRoot(...) to reject anonymous upgrades before the handshake completes and to tune the shared connection/payload limits.
import { UnauthorizedException } from '@fluojs/http';
WebSocketModule.forRoot({
limits: {
maxConnections: 500,
maxPayloadBytes: 65_536,
},
upgrade: {
guard(request) {
const authorization = request instanceof Request
? request.headers.get('authorization')
: request.headers.authorization;
if (authorization !== 'Bearer demo-token') {
throw new UnauthorizedException('Authentication required.');
}
},
},
});
When omitted, @fluojs/websockets applies bounded defaults for concurrent connections, inbound payload size, pending message buffers, and shutdown cleanup. Default settings are maxConnections: 1000, maxPayloadBytes: 1 MiB, buffer.maxPendingMessagesPerSocket: 256, shutdown.timeoutMs: 5000, Node heartbeat interval 30s, and Node backpressure maxBufferedAmountBytes: 1 MiB with drop behavior. Server-backed Node listeners enable heartbeat timers unless you explicitly set heartbeat.enabled to false. Node shutdown rejects in-flight async upgrades once shutdown begins, will close tracked websocket clients during application shutdown, and gives @OnDisconnect() cleanup a bounded chance to finish within shutdown.timeoutMs. The official fetch-style runtime modules (@fluojs/websockets/bun, @fluojs/websockets/deno, and @fluojs/websockets/cloudflare-workers) provide the same bounded close and disconnect cleanup behavior during application shutdown.
Gateway @OnMessage() handlers receive one normalized payload contract across supported runtimes. Text frames are parsed as JSON when possible and otherwise delivered as strings. Binary frames are decoded as UTF-8 before the same JSON/event dispatch step, whether the runtime surfaces them as Node Buffer/typed arrays, Bun ArrayBuffer/views, Deno ArrayBuffer/views/Blob, or Cloudflare Workers ArrayBuffer/views/Blob. The limits.maxPayloadBytes check uses byte length for every representation and closes oversized accepted sockets with close code 1009.
@WebSocketGateway(options): Marks a class as a WebSocket gateway.@OnConnect(): Decorator for connection handlers.@OnMessage(event?): Decorator for inbound message handlers.@OnDisconnect(): Decorator for disconnection handlers.WebSocketModule: Root module for WebSocket integration.WebSocketModule.forRoot({ upgrade, limits, backpressure, buffer, heartbeat, shutdown }): Configures pre-upgrade guards and bounded runtime defaults.WebSocketGatewayLifecycleService: Root alias for the default Node.js-backed lifecycle service token.WebSocketRoomService: Room management contract implemented by runtime lifecycle services for joining, leaving, broadcasting to, and inspecting websocket rooms.defineWebSocketGatewayMetadata, getWebSocketGatewayMetadata, defineWebSocketHandlerMetadata, getWebSocketHandlerMetadata, getWebSocketHandlerMetadataEntries, webSocketGatewayMetadataSymbol, webSocketHandlerMetadataSymbol.Use the runtime subpaths when you want an explicit runtime binding instead of the default root Node.js alias. Each subpath exposes its *WebSocketModule.forRoot(...) entrypoint plus the matching runtime lifecycle service export.
| Runtime | Subpath | Module | Lifecycle service |
|---|---|---|---|
| Node.js | @fluojs/websockets/node | NodeWebSocketModule | NodeWebSocketGatewayLifecycleService |
| Bun | @fluojs/websockets/bun | BunWebSocketModule | BunWebSocketGatewayLifecycleService |
| Deno | @fluojs/websockets/deno | DenoWebSocketModule | DenoWebSocketGatewayLifecycleService |
| Workers | @fluojs/websockets/cloudflare-workers | CloudflareWorkersWebSocketModule | CloudflareWorkersWebSocketGatewayLifecycleService |
packages/websockets/src/module.test.tspackages/websockets/src/public-surface.test.tspackages/websockets/src/node/node.test.tspackages/websockets/src/bun/bun.test.tspackages/websockets/src/deno/deno.test.tspackages/websockets/src/cloudflare-workers/cloudflare-workers.test.tsFAQs
Decorator-based WebSocket gateway authoring core for Fluo, with explicit Node, Bun, Deno, and Cloudflare Workers raw websocket bindings on dedicated subpaths.
The npm package @fluojs/websockets receives a total of 71 weekly downloads. As such, @fluojs/websockets popularity was classified as not popular.
We found that @fluojs/websockets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Fable shutdown shows how quickly model access can become a business continuity risk for AI-dependent engineering teams.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.