NodeJS Readium2 "streamer"
Clone or download
Latest commit 218a2f2 Jan 17, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.vscode reset LCP basic-test profile content-key when incorrect userkey passe… Dec 20, 2018
docs added Feedbooks OPDS2 feed to testable source doc Dec 26, 2018
misc latest JSON Schemas Jan 17, 2019
src latest JSON Schemas Jan 17, 2019
tools Git revision JSON now includes version info about NodeJS and NPM buil… Nov 12, 2018
tsconfigs removed confusing import aliases Dec 12, 2018
.editorconfig flexible line endings May 11, 2017
.gitignore npm update, ECLint .gitignore line break Nov 9, 2017
.npmignore ignore node_module* folders (YARN and NPM backups) Oct 8, 2017
.npmrc added missing line break (linting, editorconfig) May 18, 2017
.slugignore Heroku ignore package-lock.json Jun 3, 2017
.travis.yml oops, Now deploy is not static! May 2, 2018 v1.0.7 Jan 13, 2019
LICENSE EDRLab to Readium Foundation migration, see #18 Aug 30, 2018
Procfile trigerring new build with Node and NPM version dump ( and Herok… Dec 20, 2018 Documentation README updates Dec 20, 2018
package-lock.json v1.0.7 Jan 13, 2019
package-scripts-build.cson TypeScript --pretty and --strictPropertyInitialization Feb 1, 2018
package-scripts-bundle.cson automate ECMAScript package.json scripts (via CSON) Jan 16, 2018
package-scripts.cson added readium-desktop to the dev copydist script Dec 22, 2018
package.json v1.0.7 Jan 13, 2019
tsconfig.json Yarn upgrade, and fixed default target build (ES2017, for consistency… May 27, 2017
tslint.json * Dependency "ta-json" GitHub semver dependency becomes "ta-json-x" N… Oct 2, 2018

NodeJS / TypeScript Readium-2 "streamer"

NodeJS implementation (written in TypeScript) and HTTP micro-services (Express middleware) for


Build status

NPM David Travis Heroku



  1. NodeJS >= 8, NPM >= 5 (check with command line node --version and npm --version)
  2. OPTIONAL: Yarn >= 1.0 (check with command line yarn --version)

GitHub repository

There is no site for this project (no gh-pages branch).

NPM package

Command line install:

npm install r2-streamer-js OR yarn add r2-streamer-js

...or manually add in your package.json:

  "dependencies": {
    "r2-streamer-js": "latest"

The JavaScript code distributed in the NPM package is usable as-is (no transpilation required), as it is automatically-generated from the TypeScript source.

Several ECMAScript flavours are provided out-of-the-box: ES5, ES6-2015, ES7-2016, ES8-2017:

(alternatively, GitHub mirror with semantic-versioning release tags: )

The JavaScript code is not bundled, and it uses require() statement for imports (NodeJS style).

More information about NodeJS compatibility:

Note that web-browser Javascript is currently not supported (only NodeJS runtimes).

The type definitions (aka "typings") are included as *.d.ts files in ./node_modules/r2-streamer-js/dist/**, so this package can be used directly in a TypeScript project.

Example usage:

// from the index file
import { Server } from "r2-streamer-js";

// ES5 import (assuming node_modules/r2-streamer-js/):
import { Server } from "r2-streamer-js/dist/es5/src/http/server";

// ... or alternatively using a convenient path alias in the TypeScript config (+ WebPack etc.):
import { Server } from "@r2-streamer-js/http/server";


A package-lock.json is provided (modern NPM replacement for npm-shrinkwrap.json).

A yarn.lock file is currently not provided at the root of the source tree.

Continuous Integration

TravisCI builds are triggered automatically at every Git "push" in the develop branch.

Live demos

A test server app (not production-ready) is automatically deployed at Heroku, at every Git "push" in the develop branch:

A mirror app is also deployed at

Both servers run NodeJS 8, and the apps are based on the ES8-2017 code transpiled from TypeScript.

HTTP CORS headers are served to allow cross-origin / remote API requests.

Version(s), Git revision(s)

NPM package (latest published):

Alternatively, GitHub mirror with semantic-versioning release tags:

Heroku app (latest deployed):

Now app (latest deployed):

Developer quick start

Command line steps (NPM, but similar with YARN):

  1. cd r2-streamer-js
  2. git status (please ensure there are no local changes, especially in package-lock.json and the dependency versions in package.json)
  3. rm -rf node_modules (to start from a clean slate)
  4. npm install, or alternatively npm ci (both commands initialize the node_modules tree of package dependencies, based on the strict package-lock.json definition)
  5. npm run build:all (invoke the main build script: clean, lint, compile)
  6. ls dist (that's the build output which gets published as NPM package)
  7. npm run server-debug PATH_TO_EPUB_OR_DIR (path is relative or absolute)


Basic usage

// ES5 import (assuming node_modules/r2-streamer-js/):
import { Server } from "r2-streamer-js/dist/es5/src/http/server";

// ... or alternatively using a convenient path alias in the TypeScript config (+ WebPack etc.):
import { Server } from "@r2-streamer-js/http/server";

// Constructor parameter is optional:
// disableDecryption: true
// disableOPDS
// disableReaders: true
// disableRemotePubUrl: true to deactivate
const server = new Server({
  disableDecryption: false, // deactivates the decryption of encrypted resources (Readium LCP).
  disableOPDS: true, // deactivates the HTTP routes for the OPDS "micro services" (browser, converter)
  disableReaders: true, // deactivates the built-in "readers" for ReadiumWebPubManifest (HTTP static host / route).
  disableRemotePubUrl: true, // deactivates the HTTP route for loading a remote publication.

// First parameter: port number, zero means default (3000),
// unless specified via the environment variable `PORT` (process.env.PORT).
// Tip: the NPM package `portfinder` can be used to automatically find an available port number.
const url = await server.start(3000, false);

// Second constructor parameter: if true, HTTPS instead of HTTP, using a randomly-generated self-signed certificate.
// Also validates encrypted HTTP header during request-request cycles, so should only be used in runtime
// contexts where the client side has access to the private encryption key (i.e. Electron app, see r2-navigator-js)
console.log(server.isSecured()); // false

// A client app that is capable of setting HTTP headers for every request originating from content webviews
// can obtain the special encrypted header using this function:
// (as used internally by the Electron-based `r2-navigator-js` component to secure the transport layer)
const nameValuePair = server.getSecureHTTPHeader(url + "/PATH_TO_RESOURCE");

// Note that ports 80 and 443 (HTTPS) are always implicit (ommitted).

// `serverInfo.urlScheme` ("http")
// `serverInfo.urlHost` ("")
// `serverInfo.urlPort` (3000)

// Calls `uncachePublications()` (see below)

console.log(server.isStarted()); // false

To serve a /robots.txt file that completely disables search robots:

// Call this before `server.start()`

To add custom HTTP routes:

// Call these before `server.start()`.
// They are equivalent to `app.use()` and `app.get()`, where `app` is the underlying Express instance:

server.expressUse("/static-files", express.static("/path/to/files", {
  dotfiles: "ignore",
  etag: true,
  fallthrough: false,
  immutable: true,
  index: false,
  maxAge: "1d",
  redirect: false,

server.expressGet(["/hello.html"], (req: express.Request, res: express.Response) => {

  // Optionally, to add permissive CORS headers to the HTTP response


To register publications references (local filesystem paths) inside the internal server state (which is used to create the OPDS2 feed, see below):

// This can be called before or after `server.start()`:

// the returned array contains URL routes to the ReadiumWebPubManifests,
// e.g. `/pub/ID/manifest.json`, where `ID` is the base64 encoding of the registered path.
// Note that the returned base64 URL path components are already URI-encoded (escaped).
// (`=` and `/` are typically problematic edge-cases)
const publicationURLs = server.addPublications(["/path/to/book.epub"]);

// ...then:
const publicationPaths = server.getPublications(); // ["/path/to/book.epub"]

// ...and (calls `uncachePublication()`, see below):
const publicationURLs = server.removePublications(["/path/to/book.epub"]);

To get the OPDS2 feed for the currently registered publications:

// This launches a potentially time-consuming Node process that scans (loads) each registered Publication,
// and stores the generated OPDS2 feed inside a temporary filesystem location.
// So this returns `undefined` at the first call, and the client must invoke the function again later.
// Note that both `addPublications()` and `removePublications()` clear the OPDS2 feed entirely,
// requiring its subsequent re-generation (full scan of registered publication paths).
// (poor design, but at this stage really just an OPDS2 demo without real use-case)
const opds2 = server.publicationsOPDS();

To actually load+parse a publication reference (local filesystem path) into a ReadiumWebPubManifest Publication instance, stored in the server's state:

// The Publication object model is defined in `r2-shared-js`
const publication = await server.loadOrGetCachedPublication("/path/to/book.epub");

// The above is basically a lazy-loader that checks the cache before loading+parsing a publication,
// equivalent to:
const publication = server.cachedPublication("/path/to/book.epub");
if (!publication) {
  publication = ...; // load and parse "/path/to/book.epub"
  server.cachePublication("/path/to/book.epub", publication);

console.log(server.isPublicationCached("/path/to/book.epub")); // true

// see also:
// (calls `publication.freeDestroy()` to cleanup allocated objects in the Publication,
// particularly the file handle to the underlying zip/EPUB/CBZ file)

Note that HTTP/remote publications URLs can be loaded into the server's cache and subsequently served by the streamer without prior registration via addPublications(). However, publications from the local filesytem will only be served when registered, even if they are cached (in other words, the HTTP route is disabled when the publication is non-registered).

HTTP API (built-in routes / micro-services)


Support for remote publications


Support for OPDS feeds


Support for encrypted content