
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@ws-kit/core
Advanced tools
Tiny, composable WebSocket router for Bun and Cloudflare.
createRouter() contains only routing, not validation or pub/subcreateRouter() is the base router factory available from @ws-kit/core. It's also re-exported from validator packages (@ws-kit/zod, @ws-kit/valibot) for convenience:
@ws-kit/core — Base router (minimal, validator-agnostic). Use when you need a bare router or want explicit control over plugin imports.@ws-kit/zod / @ws-kit/valibot — Re-export createRouter plus validators and helpers for single-source imports.Recommended: Import from your validator package for a single canonical import source:
// âś… Single import source (recommended)
import { createRouter, withZod, z, message } from "@ws-kit/zod";
const router = createRouter().plugin(withZod());
Both patterns work equally well — choose based on your preference.
import { createRouter } from "@ws-kit/core";
import { withZod } from "@ws-kit/zod"; // or withValibot from @ws-kit/valibot
const router = createRouter<{ userId?: string }>().plugin(withZod()); // Add validation plugin for full features
// Register an event handler (with validation)
router.on(schema, (ctx) => {
ctx.data; // { userId?: string }
ctx.type; // Literal from schema
ctx.payload; // Typed payload (available with validation plugin)
});
// Errors flow to universal sink
router.onError((err, ctx) => {
console.error("error:", err, "type:", ctx?.type);
});
router.use(mw); // Global middleware
router.on(schema, handler); // Event handler
router.route(schema).use(mw).on(handler); // Per-route middleware + handler
router.merge(other, { onConflict: "error" }); // Combine routers
router.mount("prefix.", other); // Prefix types for namespacing
router.plugin(withZod()); // Add capabilities
router.onOpen((ctx) => {}); // Connection opened (after auth)
router.onClose((ctx) => {}); // Connection closed
router.onError((err, ctx) => {}); // Universal error sink
After withZod() or withValibot():
router.rpc(schema, handler); // RPC handlers (request-response)
After withPubSub():
router.publish(topic, schema, payload);
// ctx.subscribe(topic), ctx.unsubscribe(topic), ctx.subscriptions
src/router/ — Core routing: factory, dispatch, middleware, registrysrc/context/ — Context types: base, event, RPCsrc/schema/ — Runtime message shape: contracts for validatorssrc/plugin/ — Plugin system: capability managementsrc/capabilities/ — Adapter contracts (no implementations)src/ws/ — WebSocket adapter interfacesrc/error/ — Unified error handlingsrc/options/ — Heartbeat & rate limitingsrc/utils/ — Utilities: assertions, composition, ID generationFrom docs/proposals/router.md:
ValidatorAdapter interfacemerge() and mount() with explicit conflict resolutionrouter.onError()Full type inference from schema through handlers:
// Schema defines the contract
const UserUpdate = message("USER_UPDATE", {
id: z.string(),
name: z.string(),
});
// Handler context is inferred
router.on(UserUpdate, (ctx) => {
ctx.payload; // { id: string; name: string }
ctx.type; // "USER_UPDATE"
});
Single universal error sink with error codes:
router.onError((err, ctx) => {
if (err instanceof WsKitError) {
console.log("Error code:", err.code); // "BAD_REQUEST", "INVALID_ARGUMENT", etc.
console.log("Retryable:", err.retryable);
}
});
createTestRouter() provides in-memory transport + fake clock:
import { createTestRouter } from "@ws-kit/core/testing";
const testRouter = createTestRouter(router);
testRouter.clock.advance(30_000); // Fast-forward heartbeat
testRouter.capture.errors(); // Assert on errors
@ws-kit/zod, @ws-kit/valibot@ws-kit/bun, @ws-kit/cloudflare@ws-kit/redis, @ws-kit/kafkaMIT
FAQs
Tiny, type-safe WebSocket router
The npm package @ws-kit/core receives a total of 1,060 weekly downloads. As such, @ws-kit/core popularity was classified as popular.
We found that @ws-kit/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.