Gathering detailed insights and metrics for postal
JavaScript pub/sub library supporting advanced subscription features, and several helpful add-ons.
Installations
npm install postalDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Min. Node Version
>=0.10.0
Node Version
11.15.0
NPM Version
6.7.0
Score
96.9
Supply Chain
99.1
Quality
80
Maintenance
100
Vulnerability
99.6
License
Releases
Unable to fetch releases
Contributors
24
Unable to fetch Contributors
Languages
3
JavaScript
HTML
CSS
JavaScript (95.88%)
HTML (3.9%)
CSS (0.22%)
Love this project? Help keep it running — sponsor us today! 🚀
Developer
Download Statistics
Total Downloads
10,490,242
Last Day
4,983
Last Week
22,995
Last Month
98,459
Last Year
972,120
GitHub Statistics
MIT License
2,832 Stars
369 Commits
191 Forks
92 Watchers
7 Branches
24 Contributors
Updated on Feb 16, 2025
Maintainers
3
Package Meta Information
Latest Version
2.0.6
Package Id
postal@2.0.6
Size
19.61 kB
NPM Version
6.7.0
Node Version
11.15.0
Published on
Jul 30, 2021
Total Downloads
Cumulative downloads
Total Downloads
10,490,242
Last Day
7.8%
4,983
Compared to previous day
Last Week
-1.8%
22,995
Compared to previous week
Last Month
31.5%
98,459
Compared to previous month
Last Year
-7.1%
972,120
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Postal.js
Version 2.0.6 (MIT)
See the changelog for information on if the current version of postal has breaking changes compared to any older version(s) you might be using. Version 0.11+ removed the dependency on ConduitJS and significantly improved publishing performance. Version 1.0+ added an optional embedded-and-customized-lodash build.
What is it?
Postal.js is an in-memory message bus - very loosely inspired by AMQP - written in JavaScript. Postal.js runs in the browser, or on the server using node.js. It takes the familiar "eventing-style" paradigm (of which most JavaScript developers are familiar) and extends it by providing "broker" and subscriber implementations which are more sophisticated than what you typically find in simple event emitting/aggregation.
Usage - at a glance
If you want to subscribe to a message, you tell postal what channel and topic to listen on (channel is optional, as postal provides a default one if you don't), and a callback to be invoked when a message arrives:
1var subscription = postal.subscribe({ 2 channel: "orders", 3 topic: "item.add", 4 callback: function(data, envelope) { 5 // `data` is the data published by the publisher. 6 // `envelope` is a wrapper around the data & contains 7 // metadata about the message like the channel, topic, 8 // timestamp and any other data which might have been 9 // added by the sender. 10 } 11});
The publisher might do something similar to this:
1postal.publish({ 2 channel: "orders", 3 topic: "item.add", 4 data: { 5 sku: "AZDTF4346", 6 qty: 21 7 } 8});
Channels? WAT?
A channel is a logical partition of topics. Conceptually, it's like a dedicated highway for a specific set of communication. At first glance it might seem like that's overkill for an environment that runs in an event loop, but it actually proves to be quite useful. Every library has architectural opinions that it either imposes or nudges you toward. Channel-oriented messaging nudges you to separate your communication by bounded context, and enables the kind of fine-tuned visibility you need into the interactions between components as your application grows.
While the above code snippets work just fine, it's possible to get a more terse API if you want to hang onto an ChannelDefinition instance - which is really a convenience wrapper around publishing and subscribing on a specific channel (instead of having to specify it each time):
1var channel = postal.channel("orders"); 2 3var subscription = channel.subscribe("item.add", function(data, envelope) { 4 /*do stuff with data */ 5}); 6 7channel.publish("item.add", { 8 sku: "AZDTF4346", 9 qty: 21 10});
But Wait - How's This Different Than {Insert "X" Eventing Library Here}?
- postal is not an event emitter - it's not meant to be mixed into an instance. Instead, it's a stand alone "broker" – a message bus.
- postal uses an envelope to pass messages. This means you get a consistent method signature in ALL of your subscriber callbacks. Most eventing libs take what I call the "0-n args approach", and what gets passed to the subscriber in those libs is solely at the mercy/whim of the developer that wrote the code emitting the event.
- Most "event aggregator" libs are single channel - which can lead to event name collision, and reduce the performance of matching an event to the correct subscribers. postal is multi-channel.
- postal's design strongly discourages publishing behavior (functions/methods)! This is intentional. In an observer-subject scenario, it's common to pass callbacks on the event data. This is an anti-pattern when it comes to messaging (and I'd argue is often an anti-pattern even in Observer pattern scenarios). A postal envelope should be serializable and then de-serializable with no loss of fidelity.
- postal can work across frame and web worker boundaries (by utilizing the postal.federation and postal.xframe plugins).
- postal's built-in topic logic supports hierarchical wildcard topic bindings - supporting the same logic as topic bindings in the AMQP spec. And if you don't like that approach, you can easily provide your own bindings resolver.
Why would I use it?
Using a local message bus can enable to you de-couple your web application's components in a way not possible with other 'eventing' approaches. In addition, strategically adopting messaging at the 'seams' of your application (e.g. - between modules, at entry/exit points for browser data and storage) can not only help enforce better overall architectural design, but also insulate you from the risks of tightly coupling your application to 3rd party libraries. For example:
- If you're using a client-side binding framework, and either don't have - or don't like - the request/communication abstractions provided, then grab a library like amplify.js or reqwest. Then, instead of tightly coupling them to your application, have the request success/error callbacks publish messages with the appropriate data and any subscribers you've wired up can handle applying the data to the specific objects/elements they're concerned with.
- Do you need two view models to communicate, but you don't want them to need to know about each other? Have them subscribe to the topics about which they are interested in receiving messages. From there, whenever a view model needs to alert any listeners of specific data/events, just publish a message to the bus. If the other view model is present, it will receive the notification.
- Want to wire up your own binding framework? Want to control the number of times subscription callbacks get invoked within a given time frame? Want to keep subscriptions from being fired until after data stops arriving? Want to keep events from being acted upon until the UI event loop is done processing other events? Postal.js gives you the control you need in these kinds of scenarios via the options available on the
SubscriptionDefinitionobject. - postal.js is extensible. Plugins like postal.when can be included to provide even more targeted functionality to subscribers. Postal.federation provides the core bits needed to federate postal instances running in different environments (currently the only federation plugin available is postal.xframe for federating between windows in the browser, but more plugins are in the works). These - and more - are all things Postal can do for you.
Philosophy
Dang - you've read this far! AMAZING! If I had postal t-shirts, I'd send you one!
These four concepts are central to postal:
- channels should be provided to allow for logical partitioning of "topics"
- topics should be hierarchical and allow plain string or wildcard bindings
- messages should include envelope metadata
- subscriber callbacks should get a consistent method signature
Most eventing libraries focus on providing Observer Pattern utilities to an instance (i.e. - creating an event emitter), OR they take the idea of an event emitter and turn it into an event aggregator (so a single channel, stand alone emitter that acts as a go-between for publishers and subscribers). I'm a big fan of the Observer Pattern, but its downside is that it requires a direct reference to the subject in order to listen to events. This can become a big source of tight coupling in your app, and once you go down that road, your abstractions tend to leak, if not hemorrhage.
postal is not intended to replace Observer pattern scenarios. Inside a module, where it makes sense for an observer to have a direct reference to the subject, by all means, use the Observer pattern. However - when it comes to inter-module communication (view-to-view, for example), inter-library communication, cross frame communication, or even hierarchical state change notifications with libraries like ReactJS, postal is the glue to help your components communicate without glueing them with tight coupling.
Hierarchical Topics
In my experience, seeing publish and subscribe calls all over application logic is usually a strong code smell. Ideally, the majority of message-bus integration should be concealed within application infrastructure. Having a hierarchical-wildcard-bindable topic system makes it very easy to keep things concise (especially subscribe calls!). For example, if you have a module that needs to listen to every message published on the ShoppingCart channel, you'd simply subscribe to "#", and never have to worry about additional subscribes on that channel again - even if you add new messages in the future. If you need to capture all messages with ".validation" at the end of the topic, you'd simply subscribe to "#.validation". If you needed to target all messages with topics that started with "Customer.", ended with ".validation" and had only one period-delimited segment in between, you'd subscribe to "Customer.*.validation" (thus your subscription would capture Customer.address.validation and Customer.email.validation").
More on How to Use It
Here are four examples of using Postal. All of these examples - AND MORE! - can run live here. Be sure to check out the wiki for API documentation and conceptual walk-throughs.
1// This gets you a handle to the default postal channel... 2// For grins, you can get a named channel instead like this: 3// var channel = postal.channel( "DoctorWho" ); 4var channel = postal.channel(); 5 6// subscribe to 'name.change' topics 7var subscription = channel.subscribe( "name.change", function ( data ) { 8 $( "#example1" ).html( "Name: " + data.name ); 9} ); 10 11// And someone publishes a name change: 12channel.publish( "name.change", { name : "Dr. Who" } ); 13 14// To unsubscribe, you: 15subscription.unsubscribe(); 16 17// postal also provides a top-level ability to subscribe/publish 18// used primarily when you don't need to hang onto a channel instance: 19var anotherSub = postal.subscribe({ 20 channel : "MyChannel", 21 topic : "name.change", 22 callback : function(data, envelope) { 23 $( "#example1" ).html( "Name: " + data.name ); 24 } 25}); 26 27postal.publish({ 28 channel : "MyChannel", 29 topic : "name.change", 30 data : { 31 name : "Dr. Who" 32 } 33});
Subscribing to a wildcard topic using *
The * symbol represents "one word" in a topic (i.e - the text between two periods of a topic). By subscribing to "*.changed", the binding will match name.changed & location.changed but not changed.companion.
1var chgSubscription = channel.subscribe( "*.changed", function ( data ) { 2 $( "<li>" + data.type + " changed: " + data.value + "</li>" ).appendTo( "#example2" ); 3} ); 4channel.publish( "name.changed", { type : "Name", value : "John Smith" } ); 5channel.publish( "location.changed", { type : "Location", value : "Early 20th Century England" } ); 6chgSubscription.unsubscribe();
Subscribing to a wildcard topic using #
The # symbol represents 0-n number of characters/words in a topic string. By subscribing to "DrWho.#.Changed", the binding will match DrWho.NinthDoctor.Companion.Changed & DrWho.Location.Changed but not Changed.
1var starSubscription = channel.subscribe( "DrWho.#.Changed", function ( data ) { 2 $( "<li>" + data.type + " Changed: " + data.value + "</li>" ).appendTo( "#example3" ); 3} ); 4channel.publish( "DrWho.NinthDoctor.Companion.Changed", { type : "Companion Name", value : "Rose" } ); 5channel.publish( "DrWho.TenthDoctor.Companion.Changed", { type : "Companion Name", value : "Martha" } ); 6channel.publish( "DrWho.Eleventh.Companion.Changed", { type : "Companion Name", value : "Amy" } ); 7channel.publish( "DrWho.Location.Changed", { type : "Location", value : "The Library" } ); 8channel.publish( "TheMaster.DrumBeat.Changed", { type : "DrumBeat", value : "This won't trigger any subscriptions" } ); 9channel.publish( "Changed", { type : "Useless", value : "This won't trigger any subscriptions either" } ); 10starSubscription.unsubscribe();
Applying distinctUntilChanged to a subscription
1var dupChannel = postal.channel( "Blink" ), 2 dupSubscription = dupChannel.subscribe( "WeepingAngel.#", function( data ) { 3 $( '<li>' + data.value + '</li>' ).appendTo( "#example4" ); 4 }).distinctUntilChanged(); 5// demonstrating multiple channels per topic being used 6// You can do it this way if you like, but the example above has nicer syntax (and *much* less overhead) 7dupChannel.publish( "WeepingAngel.DontBlink", { value:"Don't Blink" } ); 8dupChannel.publish( "WeepingAngel.DontBlink", { value:"Don't Blink" } ); 9dupChannel.publish( "WeepingAngel.DontEvenBlink", { value:"Don't Even Blink" } ); 10dupChannel.publish( "WeepingAngel.DontBlink", { value:"Don't Close Your Eyes" } ); 11dupChannel.publish( "WeepingAngel.DontBlink", { value:"Don't Blink" } ); 12dupChannel.publish( "WeepingAngel.DontBlink", { value:"Don't Blink" } ); 13dupSubscription.unsubscribe();
More References
Please visit the postal.js wiki for API documentation, discussion of concepts and links to blogs/articles on postal.js.
How can I extend it?
There are four main ways you can extend Postal:
- Write a plugin. Need more complex behavior that the built-in SubscriptionDefinition doesn't offer? Write a plugin that you can attach to the global postal object. See postal.when for an example of how to do this. You can also write plugins that extend the
ChannelDefinitionandSubscriptionDefinitionprototypes - see postal.request-response for an example of this. - Write a custom federation plugin, to federate instances of postal across a transport of your choice.
- You can also change how the
bindingResolvermatches subscriptions to message topics being published. You may not care for the AMQP-style bindings functionality. No problem! Write your own resolver object that implements acompareandresetmethod and swap the core version out with your implementation by calling:postal.configuration.resolver = myWayBetterResolver.
It's also possible to extend the monitoring of messages passing through Postal by adding a "wire tap". A wire tap is a callback that will get invoked for any published message (even if no actual subscriptions would bind to the message's topic). Wire taps should not be used in lieu of an actual subscription - but instead should be used for diagnostics, logging, forwarding (to a websocket publisher or a local storage wrapper, for example) or other concerns that fall along those lines. This repository used to include a console logging wiretap called postal.diagnostics.js - you can now find it here in it's own repo. This diagnostics wiretap can be configured with filters to limit the firehose of message data to specific channels/topics and more.
Build, Dependencies, etc.
- postal depends on lodash.js
- The standard postal build output (
lib/postal.js) is what you would normally use if you're already using lodash in your app. - The
lib/postal.lodash.jsbuild output might be of interest to you if these things are true:- You're using webpack, browserify or another bundler/loader capable of loading CommonJS modules.
- You only need the specific bits of lodash used by postal and don't need the full lib.
- The standard postal build output (
- postal uses gulp.js for building, running tests and examples.
- To build
- run
npm install(to install all deps) - run
bower install(yep, we're using at least one thing only found on bower in the local project runner) - run
npm run build(this is just an alias forgulpat the moment, which you can also use) - then check the lib folder for the output
- run
- To run tests & examples
- Tests are node-based:
npm test(ornpm run test-lodashto test the custom lodash build output) - To run browser-based examples:
- run
npm start - navigate in your browser to http://localhost:3080/
- if you want to see test coverage or plato reports be sure to run
npm run coverageandgulp report(respectively) in order to generate them, as they are not stored with the repo.
- run
- Tests are node-based:
- To build
Can I contribute?
Please - by all means! While I hope the API is relatively stable, I'm open to pull requests. (Hint - if you want a feature implemented, a pull request gives it a much higher probability of being included than simply asking me.) As I said, pull requests are most certainly welcome - but please include tests for your additions. Otherwise, it will disappear into the ether.
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
Found 3/26 approved changesets -- score normalized to 1
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 8 are checked with a SAST tool
Reason
61 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-j4mr-9xw3-c9jx
- Warn: Project is vulnerable to: GHSA-7p89-p6hx-q4fw
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-cwfw-4gq5-mrqx
- Warn: Project is vulnerable to: GHSA-g95f-p29q-9xw4
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-9vvw-cc9w-f27h
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-h6ch-v84p-w6p9
- Warn: Project is vulnerable to: GHSA-4gmj-3p3h-gm8h
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-9qj9-36jm-prpv
- Warn: Project is vulnerable to: GHSA-qh2h-chj9-jffq
- Warn: Project is vulnerable to: GHSA-6x33-pw7p-hmpq
- Warn: Project is vulnerable to: GHSA-x55w-vjjp-222r
- Warn: Project is vulnerable to: GHSA-282f-qqgm-c34q
- Warn: Project is vulnerable to: GHSA-7x7c-qm48-pq9c
- Warn: Project is vulnerable to: GHSA-rc3x-jf5g-xvc5
- Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695
- Warn: Project is vulnerable to: GHSA-fvqr-27wr-82fm
- Warn: Project is vulnerable to: GHSA-4xc9-xhrj-v574
- Warn: Project is vulnerable to: GHSA-x5rq-j2xg-h7qm
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
- Warn: Project is vulnerable to: GHSA-82v2-mx6x-wq7q
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-wrvr-8mpx-r7pp
- Warn: Project is vulnerable to: GHSA-hxm2-r34f-qmc5
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-gwg9-rgvj-4h5j
- Warn: Project is vulnerable to: GHSA-w9mr-4mfr-499f
- Warn: Project is vulnerable to: GHSA-7mc5-chhp-fmc3
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-g6ww-v8xp-vmwg
- Warn: Project is vulnerable to: GHSA-gqgv-6jq5-jjj9
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-4rq4-32rv-6wp6
- Warn: Project is vulnerable to: GHSA-64g7-mvw6-v9qj
- Warn: Project is vulnerable to: GHSA-fxwf-4rqh-v8g3
- Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
- Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
- Warn: Project is vulnerable to: GHSA-34r7-q49f-h37c
- Warn: Project is vulnerable to: GHSA-c9f4-xj24-8jqx
- Warn: Project is vulnerable to: GHSA-mgfv-m47x-4wqp
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-2mhh-w6q8-5hxw
- Warn: Project is vulnerable to: GHSA-6663-c963-2gqg
- Warn: Project is vulnerable to: GHSA-5v72-xg48-5rpm
- Warn: Project is vulnerable to: GHSA-h4j5-c7cj-74xg
Score
1.9
/10
Last Scanned on 2025-02-10
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More