Web-standard building blocks for any JavaScript runtime.

Collects, combines and transforms web streams and iterables.Replaces get-stream, concat-stream, bl (as a collector), stream-to-array, merge2, merge-stream, through2 and the limit handling of raw-body

Splits a stream of bytes or text into lines.Replaces split2 and byline

gzip and deflate on the platform's CompressionStream, a decompression stream with an output limit, and CRC-32.Replaces the one-shot use of pako and fflate, and node:zlib's gzipSync, gunzipSync, deflateSync, inflateSync and crc32

base64 and base64url, with MIME line wrapping and streams.Replaces libbase64, base64-js and js-base64

Quoted-printable encoding and decoding, as functions and streams.Replaces libqp and quoted-printable

Encodes text into legacy charsets such as Shift_JIS, GBK, Big5 and windows-1251.Replaces the encoding half of iconv-lite

Converts domain names between Unicode and ASCII by UTS #46.Replaces punycode, the deprecated node:punycode, and tr46

Decodes and encodes CSV, as functions and streams.Replaces csv-parse and csv-stringify, papaparse and fast-csv

Decodes and encodes JSON Lines streams.Replaces ndjson and the jsonl modules of stream-json

Selects values from a large JSON document by JSONPath, and writes JSON from a tree of promises and streams.Replaces JSONStream, stream-json, json-stream-stringify and @worker-tools/json-stream

Builds a raw email message, with attachments and inline images, as a stream.Replaces nodemailer's MailComposer (nodemailer/lib/mail-composer) and the MimeNode it builds on

Encoded words, folding, parameters and address lists in email headers.Replaces the header functions of libmime, addressparser (now nodemailer/lib/addressparser) and email-addresses

Splits a MIME message into a stream of headers and bodies and writes it back byte for byte.Replaces mailsplit (now @zone-eu/mailsplit)

Sends email over SMTP or LMTP from any runtime with a TCP socket API.Replaces the SMTP transport and smtp-connection of nodemailer

Signs and verifies DKIM signatures.Replaces the DKIM parts of mailauth and the DKIM signer of nodemailer

Checks whether a client may send mail for a domain, using SPF.Replaces the SPF module of mailauth

Checks a message against the DMARC policy of its From domain.Replaces the DMARC module of mailauth

Seals and verifies ARC sets.Replaces the ARC parts of mailauth

Checks a received message's SPF, DKIM, DMARC and ARC in one call, writes the Authentication-Results header, and ARC-seals it.Replaces authenticate from mailauth

Looks up DNS records over DNS-over-HTTPS, behind a resolver interface that node:dns/promises also fits.Replaces node:dns/promises where it doesn't exist, tangerine and dohjs

Encodes and decodes DNS messages in wire format.Replaces dns-packet

Parses, formats, compares and classifies IPv4 and IPv6 addresses and CIDR blocks.Replaces ip, ipaddr.js, is-ip, ip-cidr, cidr-tools and ip-range-check for parsing, validation, CIDR matching and classification

Looks up who holds a domain name, an IP address or an AS number over RDAP.Replaces whoiser, whois-json and node-rdap

Bytes-in, bytes-out helpers over crypto.subtle: digests, HMAC, HKDF, Ed25519 and X25519 keys from seeds, keys from PEM text, and ECDSA signature conversion.Replaces ecdsa-sig-formatter and the WebCrypto wrappers that apps write by hand

Hashes and verifies passwords with PBKDF2 on WebCrypto.Replaces the PBKDF2 use of node:crypto, pbkdf2 and pbkdf2-password, and hand-written salt:hash formats in app code

Verifies and signs webhooks from Standard Webhooks senders, Stripe, GitHub, Slack and other HMAC-SHA256 senders.Replaces standardwebhooks, the Webhook class in svix, Stripe's constructEvent and constructEventAsync in stripe, @octokit/webhooks-methods and the request verification in @slack/bolt

Signs OAuth 1.0a requests.Replaces oauth-1.0a and the OAuth 1.0a half of oauth (node-oauth)

A WebSocket that reconnects, with a readable stream of incoming messages and a writable stream for outgoing ones.Replaces reconnecting-websocket, partysocket and websocket-ts

Reads, writes and reconnects server-sent event streams.Replaces eventsource-parser, the eventsource polyfill, @microsoft/fetch-event-source, and the event writers in better-sse and hono's streamSSE

Typed JSON-RPC 2.0 calls over a MessagePort, a window, a WebSocket or HTTP, with streaming results.Replaces comlink, penpal, post-me, birpc, json-rpc-2.0, and tRPC for simple cases

Sends Web Push notifications with payload encryption and VAPID.Replaces web-push

Reads an image's type and dimensions from its header, from bytes or a stream.Replaces image-size

Reads EXIF metadata from JPEG, TIFF, PNG, WebP, HEIC and AVIF files, and strips it from JPEG, PNG and WebP.Replaces exif-parser

Decodes PNG files to RGBA pixels and encodes pixels as PNG.Replaces pngjs

Limits how many async tasks run at once, with priorities and cancellation.Replaces p-limit, p-queue, p-map and p-throttle

Sleep, retry, poll, debounce and throttle, all cancellable with an AbortSignal.Replaces delay, p-retry, async-retry, p-wait-for, lodash.debounce, lodash.throttle, throttle-debounce and p-debounce

Rate limiting per key with GCRA, in memory, Workers KV, a Durable Object or Redis over HTTP.Replaces rate-limiter-flexible, limiter and the reservoir options of bottleneck

Logs by namespace and level, with debug's DEBUG patterns, updated without a reload.Replaces debug

Hex encoding, concatenation and constant-time comparison of Uint8Arrays.Replaces the hex, concat and equality functions of uint8array-extras, and crypto.timingSafeEqual from node:crypto

The error classes every package throws. Errors.is and instanceof match them even when an app has two copies of a package.Replaces hand-written class XError extends Error hierarchies and instanceof checks

Unbiased random integers, strings, shuffles and bytes, and a seeded generator for tests.Replaces random-int, crypto-random-string, nanoid's customAlphabet, seedrandom, and lodash's random, sample and shuffle