High-performance web framework with JSX, SSG, RPC, streaming, and type safety. Inspired by Hono and Elysia but 2-3x faster.
A high-performance, developer-friendly web framework inspired by Hono and Elysia. Built for speed, extensibility, and excellent DX across multiple JavaScript runtimes.
Openspeed provides a modern, type-safe API with runtime-agnostic support for Node.js, Bun, and Deno. It features a powerful plugin system, advanced routing, and built-in optimizations for production applications.
Install Openspeed using your preferred package manager:
# npm
npm install openspeed
# pnpm
pnpm add openspeed
# yarn
yarn add openspeed
# bun
bun add openspeed
Use the CLI tool to scaffold a new Openspeed project:
npx create-openspeed-app my-app
cd my-app
npm run dev
This creates a complete project structure with TypeScript, testing, and example routes.
For more details, see the Getting Started Guide.
Here's a complete example showing Openspeed's core features:
import { Openspeed } from 'openspeed';
const app = Openspeed();
// Basic routing with parameter extraction
app.get('/', (ctx) => ctx.text('Hello Openspeed!'));
app.get('/api/users/:id', (ctx) => {
const userId = ctx.getParam('id');
return ctx.json({
id: userId,
name: 'ElonDuck',
timestamp: new Date().toISOString()
});
});
// JSON handling with automatic parsing
app.post('/api/data', async (ctx) => {
const data = ctx.getBody(); // Automatically parsed JSON
return ctx.json({ received: data, success: true });
});
// File upload with multipart support
app.post('/upload', (ctx) => {
const file = ctx.file;
if (file) {
return ctx.json({
filename: file.filename,
size: file.size,
mimetype: file.mimetype
});
}
return ctx.json({ error: 'No file uploaded' }, 400);
});
// Real-time WebSocket with room-based messaging
app.ws('/chat/:room', (ws, ctx) => {
const room = ctx.getParam('room');
ws.join(room);
ws.on('message', (data) => {
// Broadcast to all users in the room
ws.broadcast(room, `User said: ${data}`);
});
ws.on('join', (newRoom) => {
ws.leave(room);
ws.join(newRoom);
});
});
// Session management with secure cookies
app.get('/login', (ctx) => {
ctx.setCookie('session', 'user123', {
httpOnly: true,
secure: true,
maxAge: 86400 // 24 hours
});
return ctx.text('Logged in successfully!');
});
app.get('/profile', (ctx) => {
const sessionId = ctx.getCookie('session');
if (!sessionId) {
return ctx.json({ error: 'Not authenticated' }, 401);
}
return ctx.json({ userId: sessionId, profile: 'User data' });
});
// Error handling with custom status codes
app.get('/error', (ctx) => {
throw new Error('Something went wrong!');
});
// Start the server
app.listen(3000, () => {
console.log('🚀 Openspeed server running on http://localhost:3000');
});
This example demonstrates routing, JSON handling, file uploads, WebSockets, cookies, and error handling. For more examples, see the examples directory.
text(), json(), html()Handle multipart form data with streaming support:
import { upload } from 'openspeed/plugins/upload';
app.use(upload());
// Single file upload
app.post('/upload', (ctx) => {
const file = ctx.file;
if (file) {
return ctx.json({
filename: file.filename,
mimetype: file.mimetype,
size: file.size
});
}
return ctx.text('No file uploaded', 400);
});
// Multiple files
app.post('/upload-multiple', (ctx) => {
const files = ctx.files?.avatar || [];
return ctx.json({ uploaded: files.length });
});
Real-time communication with room management:
import { websocket } from 'openspeed/plugins/websocket';
app.use(websocket());
// Basic WebSocket
app.ws('/ws', (ws) => {
ws.on('message', (data) => {
ws.send(`Echo: ${data}`);
});
});
// Room-based chat
app.ws('/chat/:room', (ws, ctx) => {
const room = ctx.getParam('room');
ws.join(room);
ws.on('message', (data) => {
ws.broadcast(room, data); // Send to all in room except sender
ws.broadcastAll(room, data); // Send to everyone in room
});
ws.on('join', (newRoom) => {
ws.leave(room);
ws.join(newRoom);
});
});
Session management with CookieJar:
import { cookie } from 'openspeed/plugins/cookie';
app.use(cookie());
// Set cookies
app.get('/set-session', (ctx) => {
ctx.setCookie('session', 'abc123', {
httpOnly: true,
secure: true,
maxAge: 86400 // 1 day
});
return ctx.text('Session set!');
});
// Get cookies
app.get('/profile', (ctx) => {
const sessionId = ctx.getCookie('session');
if (!sessionId) {
return ctx.text('Not authenticated', 401);
}
return ctx.json({ sessionId });
});
Comprehensive error management with typed exceptions:
import { errorHandler, HttpError } from 'openspeed/plugins/errorHandler';
app.use(errorHandler());
// Custom errors
app.get('/api/user/:id', (ctx) => {
const userId = ctx.getParam('id');
if (!userId) {
throw new HttpError(400, 'User ID required');
}
const user = findUser(userId);
if (!user) {
throw new HttpError(404, 'User not found');
}
return ctx.json(user);
});
// Async error handling
app.get('/api/async', async (ctx) => {
try {
const data = await riskyOperation();
return ctx.json(data);
} catch (error) {
throw new HttpError(500, 'Operation failed');
}
});
Cross-origin resource sharing:
import { cors } from 'openspeed/plugins/cors';
app.use(cors({
origin: ['http://localhost:3000', 'https://myapp.com'],
credentials: true,
methods: ['GET', 'POST', 'PUT', 'DELETE']
}));
Request logging with customizable formats:
import { logger } from 'openspeed/plugins/logger';
app.use(logger({
format: 'combined', // 'combined', 'common', 'dev', 'short', 'tiny'
skip: (req) => req.url?.includes('/health')
}));
Parse JSON request bodies:
import { json } from 'openspeed/plugins/json';
app.use(json({ limit: '10mb' }));
app.post('/api/data', (ctx) => {
const data = ctx.getBody(); // Parsed JSON
return ctx.json({ received: data });
});
Auto-generate API documentation and clients in any programming language with best-in-class type safety, auto-completion, runtime validation, and end-to-end type inference. Built-in support for TypeScript, PHP, C++, Rust, Go, and Python, with extensible architecture for adding custom languages.
import { openapi } from 'openspeed/plugins/openapi';
const api = openapi({ title: 'My API', version: '1.0.0' });
// Register a custom language generator
api.registerLanguage('kotlin', (routes) => {
let clientCode = `// Generated Kotlin OpenSpeed Client
package com.example.api
import okhttp3.*
import com.google.gson.Gson
class OpenSpeedClient(private val baseUrl: String) {
private val client = OkHttpClient()
private val gson = Gson()
`;
for (const route of routes) {
const path = route.path;
const method = route.method.toUpperCase();
const funcName = path.replace(/:/g, '_').replace(/\//g, '_').replace(/^_/, '') || 'root';
// Build function signature
const params = [];
if (route.parameters?.some(p => p.in === 'path')) params.push('pathParams: Map<String, String>');
if (route.parameters?.some(p => p.in === 'query')) params.push('queryParams: Map<String, String>? = null');
if (route.requestBody) params.push('body: Any? = null');
params.push('headers: Map<String, String>? = null');
clientCode += ` fun ${funcName}(${params.join(', ')}): String {\n`;
// URL construction
let urlTemplate = route.path;
for (const param of route.parameters || []) {
if (param.in === 'path') {
urlTemplate = urlTemplate.replace(`:${param.name}`, `\${pathParams["${param.name}"]}`);
}
}
clientCode += ` var url = "\${baseUrl}${urlTemplate}"\n`;
if (route.parameters?.some(p => p.in === 'query')) {
clientCode += ` queryParams?.let { qp ->\n`;
clientCode += ` val queryString = qp.entries.joinToString("&") { "\${it.key}=\${it.value}" }\n`;
clientCode += ` url += "?\${queryString}"\n`;
clientCode += ` }\n`;
}
// HTTP request
clientCode += ` val request = Request.Builder().url(url)\n`;
if (route.requestBody) {
clientCode += ` body?.let { b ->\n`;
clientCode += ` val jsonBody = gson.toJson(b)\n`;
clientCode += ` request.post(RequestBody.create(MediaType.parse("application/json"), jsonBody))\n`;
clientCode += ` }\n`;
} else {
clientCode += ` request.${method.toLowerCase()}()\n`;
}
clientCode += ` headers?.forEach { (k, v) -> request.addHeader(k, v) }\n`;
clientCode += ` val response = client.newCall(request.build()).execute()\n`;
clientCode += ` return response.body()?.string() ?: ""\n`;
clientCode += ` }\n\n`;
}
clientCode += `}
`;
return clientCode;
});
// Generate clients for any registered language
const kotlinClient = api.generateClient('kotlin');
// Access generated clients via dynamic endpoints:
// /client.ts - TypeScript client with full type safety
// /client.php - PHP client with cURL
// /client.cpp - C++ client with nlohmann/json
// /client.rs - Rust client with reqwest and serde_json
// /client.go - Go client with net/http and encoding/json
// /client.py - Python client with requests library
// /client.{any-ext} - Custom language clients (e.g., /client.kotlin)
app.get('/openapi.json', (ctx) => ctx.json(api.generate()));
// Or generate client files using CLI for any supported language
// npx openspeed client client.ts # TypeScript
// npx openspeed client client.php # PHP
// npx openspeed client client.cpp # C++
// npx openspeed client client.rs # Rust
// npx openspeed client client.go # Go
// npx openspeed client client.py # Python
// npx openspeed client client.kotlin # Custom language
This generates fully typed clients in your preferred language that you can import and use with auto-completion and runtime validation. The extensible architecture allows you to add support for any programming language by registering custom generators.
Built-in Languages:
Extensible System: Register custom language generators for any programming language:
// Example: Add Java client generation
api.registerLanguage('java', (routes) => {
return `// Generated Java client\npublic class ApiClient {\n // HTTP client implementation\n}`;
});
// Now you can generate Java clients
const javaClient = api.generateClient('java');
// Or via endpoint: GET /client.java
// Or via CLI: npx openspeed client client.java
The system supports 50+ file extensions mapped to language names, making it easy to add support for languages like Java, Kotlin, C#, Swift, Ruby, and more.
Comprehensive security features for production applications:
Prevent Cross-Site Request Forgery attacks:
import { csrf, csrfToken, csrfInput } from 'openspeed/plugins';
app.use(csrf({
secret: process.env.CSRF_SECRET,
cookieName: '_csrf',
headerName: 'x-csrf-token',
enforceForMethods: ['POST', 'PUT', 'DELETE', 'PATCH']
}));
// In your form
app.get('/form', (ctx) => {
const token = csrfToken(ctx);
return ctx.html(`
<form method="POST">
<input type="hidden" name="csrf_token" value="${token}" />
<button type="submit">Submit</button>
</form>
`);
});
Validate SQL queries and parameters:
import { validateSQL, sql } from 'openspeed/plugins';
// ❌ Vulnerable
const query = `SELECT * FROM users WHERE id = ${userId}`;
// ✅ Safe
const { query, params } = sql(
'SELECT * FROM users WHERE id = ?',
[userId]
);
// Or validate existing queries
validateSQL(query, params); // Throws if unsafe patterns detected
Schema-based validation with Zod:
import { validate } from 'openspeed/plugins';
import { z } from 'zod';
const userSchema = z.object({
email: z.string().email(),
password: z.string().min(12),
age: z.number().int().min(13)
});
app.post('/register',
validate({ body: userSchema }),
async (ctx) => {
const data = ctx.req.body; // Typed and validated
return ctx.json({ success: true });
}
);
Comprehensive security headers:
import { security } from 'openspeed/plugins';
app.use(security({
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'", "'nonce-{random}'"],
styleSrc: ["'self'", "'unsafe-inline'"]
}
},
hsts: {
maxAge: 31536000,
includeSubDomains: true
},
noSniff: true,
frameOptions: 'DENY'
}));
For more security features and best practices, see the Security Guide.
Openspeed includes automated security tools:
# Scan for vulnerabilities
npm run security:scan
# Export detailed JSON report
npm run security:scan:json
# Auto-fix common security issues
npm run security:fix
# Preview fixes without applying
npm run security:fix:dry
# Check dependencies
npm audit
Read our Security Policy for vulnerability reporting.
Openspeed automatically detects and adapts to your runtime:
http moduleBun.serveDeno.servePerformance comparison (requests/second):
| Runtime | Openspeed | Hono | Elysia |
|---|---|---|---|
| Node.js | ~7,000* | ~3,200 | ~2,800 |
| Bun | ~24,000* | ~11,500 | ~10,200 |
| Deno | ~17,000* | ~8,000 | ~7,500 |
Note: Benchmarks run with autocannon (100 concurrent connections, 10 seconds) *With adaptive optimizer enabled - 2x-3x faster than competition!
Basic Routing (GET /):
JSON Handling (POST /json):
Test conditions: 100 connections (routing), 50 connections (JSON), 10 seconds each, autocannon tool. Results show excellent performance with end-to-end type safety enabled.
Compare Openspeed with Hono and Elysia across different scenarios:
# Install dependencies
pnpm install
# Build the project
pnpm run build
# Run comprehensive benchmarks (Node.js)
pnpm run bench:node
# Run comprehensive benchmarks (Bun)
pnpm run bench:bun
# Run specific benchmark scenario
cd benchmarks
bun run apps/openspeed-routing.ts 3000 &
autocannon -c 100 -d 10 http://localhost:3000/
Available benchmark scenarios:
pnpm test
pnpm run build
pnpm run dev
app.printRoutes(); // Shows all routes with middleware info
console.log(app.routes()); // Returns route metadata array
Openspeed includes comprehensive examples to demonstrate real-world usage patterns. All examples are available in the examples directory.
A minimal setup showing basic routing and middleware:
cd examples/hello-openspeed
pnpm install
pnpm run dev
Features:
A production-ready e-commerce application with advanced features:
cd examples/ml-optimized-api
pnpm install
pnpm run dev
Features:
This example showcases Openspeed's enterprise capabilities and serves as a reference architecture.
View Source | API Documentation
# Clone the repository
git clone https://github.com/JonusNattapong/OpenSpeed.git
cd OpenSpeed
# Install dependencies
pnpm install
# Run any example
cd examples/ml-optimized-api
pnpm run dev
# Visit http://localhost:3000 to see the API in action
For more examples and tutorials, check out our documentation.
src/
├── openspeed/
│ ├── index.ts # Main app factory
│ ├── router.ts # Trie router implementation
│ ├── context.ts # Request/response context with helpers
│ ├── server.ts # Runtime detection & adapters
│ └── plugins/ # Official plugins
│ ├── adaptiveOptimizer.ts # ML-powered optimization
│ ├── auditLog.ts # Audit logging
│ ├── auth.ts # Authentication
│ ├── circuitBreaker.ts # Circuit breaker pattern
│ ├── codegen.ts # Code generation
│ ├── compression.ts # Response compression
│ ├── cookie.ts # Cookie management
│ ├── cors.ts # CORS middleware
│ ├── database.ts # Database adapters
│ ├── dashboard.ts # Admin dashboard
│ ├── email.ts # Email service
│ ├── errorHandler.ts # Error handling
│ ├── fileRouting.ts # File-based routing
│ ├── graphql.ts # GraphQL support
│ ├── hotReload.ts # Hot reload
│ ├── index.ts # Plugin exports
│ ├── json.ts # JSON parsing
│ ├── kubernetes.ts # Kubernetes operators
│ ├── loadBalancer.ts # Load balancing
│ ├── logger.ts # Request logging
│ ├── memory.ts # Memory management
│ ├── metrics.ts # Metrics collection
│ ├── mlOptimizer.ts # ML optimization (legacy)
│ ├── openapi.ts # API documentation
│ ├── playground.ts # Development playground
│ ├── rateLimit.ts # Rate limiting
│ ├── rbac.ts # Role-based access control
│ ├── static.ts # Static file serving
│ ├── storage.ts # File storage
│ ├── stripe.ts # Stripe payment
│ ├── tracing.ts # Request tracing
│ ├── twilio.ts # SMS service
│ ├── upload.ts # File upload handling
│ ├── validate.ts # Request validation
│ └── websocket.ts # WebSocket support
├── cli/ # CLI commands
├── create-openspeed-app/ # CLI scaffold tool
examples/
├── ml-optimized-api/ # Full e-commerce API with ML optimization
benchmarks/ # Performance testing
├── apps/ # Benchmark applications
│ ├── openspeed-*.ts # Openspeed benchmarks
│ ├── hono-*.ts # Hono benchmarks
│ └── elysia-*.ts # Elysia benchmarks
├── run-comprehensive.ts # Comprehensive benchmark runner
├── tsconfig.benchmark.json # Benchmark TypeScript config
tests/ # Unit test suite
├── plugins/ # Plugin tests
docs/ # Documentation
├── plugins/ # Plugin documentation
apps/ # Application templates
packages/ # Monorepo packages
## 📁 Project Structure
src/
├── openspeed/
│ ├── index.ts # Main app factory
│ ├── router.ts # Trie router implementation
│ ├── context.ts # Request/response context
│ ├── server.ts # Runtime detection & adapters
│ └── plugins/ # Official plugins (see above)
├── cli/ # CLI commands
├── create-openspeed-app/ # CLI scaffold tool
examples/
├── ml-optimized-api/ # Full e-commerce API with ML optimization
benchmarks/ # Performance testing (see above)
tests/ # Unit tests
docs/ # Documentation
apps/ # Application templates
packages/ # Monorepo packages
We welcome contributions to Openspeed! Whether you're fixing bugs, adding features, improving documentation, or helping with testing, your help is appreciated.
git clone https://github.com/your-username/OpenSpeed.git
cd OpenSpeed
pnpm install
git checkout -b feature/your-feature-name
pnpm run buildpnpm testpnpm run bench:node or pnpm run bench:bunpnpm run lintpnpm run formatpnpm run docsOpenspeed's plugin system makes it easy to extend functionality. Here's how to create a custom plugin:
import type { Context } from 'openspeed';
interface MyPluginOptions {
config: string;
enabled?: boolean;
}
function myPlugin(options: MyPluginOptions) {
const { config, enabled = true } = options;
return async (ctx: Context, next: () => Promise<any>) => {
if (!enabled) return next();
// Your middleware logic here
console.log('Plugin config:', config);
ctx.setHeader('X-Custom-Plugin', 'active');
await next();
// Post-processing logic
console.log('Request completed');
};
}
// Usage
app.use(myPlugin({ config: 'my-config', enabled: true }));
For more plugin examples, see the plugins documentation.
tests/ directory using Vitestpnpm testfeat:, fix:, docs:, etc.)README.md for API changesexamples/ directorydocs/plugins/Found a bug? Have a feature request?
When reporting issues, please include:
By contributing to Openspeed, you agree that your contributions will be licensed under the same MIT license as the project.
Thank you for contributing to Openspeed! Your help makes the framework better for everyone. 🎉
MIT License - see LICENSE file for details.
Openspeed aims to provide:
Openspeed is MIT licensed.
Built with ❤️ for the modern web
FAQs
High-performance web framework with JSX, SSG, RPC, streaming, and type safety. Inspired by Hono and Elysia but 2-3x faster.
The npm package openspeed receives a total of 15 weekly downloads. As such, openspeed popularity was classified as not popular.
We found that openspeed demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.