
Company News
Socket Partners with Replit to Block Malicious Packages in AI-Powered Development
Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.
@bendscript/core
Advanced tools
Reference parser, validator, and round-trip harness for the BendScript Protocol v0.1 — a graph-first document format with typed inline link facets, for agent-native systems.
Reference parser, validator, and round-trip harness for the BendScript Protocol v0.1 — a graph-first document format with typed inline link facets, for agent-native systems.
Status: v0.1 alpha (sections 0–6 of the spec). API may shift before
0.1.0final.
BendScript is a JSON document format that treats prose, structure, and a knowledge graph as one thing. Every document is content-addressable, every inline link can carry a typed predicate, and every typed link expands into a deterministic graph edge.
bend: URI scheme — content-addressable doc ids, span-addressable edgesparse(serialize(parse(d))) === parse(d) for every conforming documentThe full spec lives at https://bendscript.com and in docs/spec/.
npm install @bendscript/core
Requires Node 20+.
import {
parse,
parseAndNormalize,
serialize,
serializeCanonical,
validate,
expandLinkMarks,
computeDocumentId,
} from "@bendscript/core";
const text = `{
"version": "bendscript/0.1",
"id": "bafy...",
"vocabulary": "core",
"blocks": [
{ "id": "blk-1", "kind": "paragraph", "spans": [{ "id": "spn-1", "text": "Hello." }] }
]
}`;
const doc = parseAndNormalize(text);
validate(doc); // throws ValidationError on structural errors
const id = await computeDocumentId(doc);
const edges = expandLinkMarks(doc); // typed link marks → graph edges
const canonical = serializeCanonical(doc);
The harness used by the spec's §8 LLM round-trip evaluation is exposed as a subpath import:
import {
MockModel,
loadCorpus,
runHarness,
computeDrift,
median,
p95,
} from "@bendscript/core/harness";
Bring your own ModelClient to evaluate any model against the BendScript corpus, or use MockModel for harness-mechanic tests with no API costs.
Main entry (@bendscript/core)
parse(text), normalize(doc), parseAndNormalize(text)serialize(doc), serializeCanonical(doc)canonicalize(value) — RFC 8785 (JCS) wrappercomputeDocumentId(doc), expectedDocumentId(doc), canonicalHashInput(doc)expandLinkMarks(doc) — §2.5.1 link-mark → edge expansion (idempotent, dedup'd)validate(doc), ValidationError, isBendUri(s)Document, NormalizedDocument, Block, Span, Edge, Mark, LinkMark, MarkKind, Predicate, ProtocolVersionHarness subpath (@bendscript/core/harness)
runHarness({ corpus, models, classes }), runOne(...)loadCorpus(dir), buildPrompt(...)computeDrift(before, after), median(arr), p95(arr), aggregate(...)MockModel(name, { mode }), MockModeTHRESHOLDS, DRIFT_WEIGHTSCorpusEntry, DriftScore, DriftComponents, ModelClient, RunReport, Transcript, TaskClassMIT © Travis Burandt — see LICENSE.
FAQs
Reference parser, validator, and round-trip harness for the BendScript Protocol v0.1 — a graph-first document format with typed inline link facets, for agent-native systems.
We found that @bendscript/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.