@blamejs/core
Advanced tools
The Node framework that owns its stack.
One install. One upgrade path. One place to look when something breaks — no blame to pass between forty transitive dependencies you didn't choose.
The modern Node app is a 1,200-package supply-chain liability with no LTS calendar, no curator, and no accountability. Frameworks peer-depend their internals onto you and call it modularity. blamejs takes the opposite stance:
package.json has one entry.Pre-1.0. Usable end-to-end — operators can build production apps on it today; the surface is still subject to change before 1.0. The latest release lives on GitHub, npm, and the container registry.
var b = require("@blamejs/core");
(async function () {
var app = await b.createApp({
dataDir: "./data",
routes: function (router) {
router.get("/", function (req, res) {
b.render.htmlString(res, "<h1>Hello from blamejs</h1>");
});
},
});
await app.listen({ port: 3000 });
})();
Requirements: Node.js 24.16+ (current active LTS line; 24.14.1 fixed CVE-2026-21713 non-constant-time HMAC compare, 24.16 is the current patch level). Node 26 satisfies the floor and the framework test suite runs cleanly on it today; the floor itself will bump to >=26.x when Node 26 promotes to Active LTS. Two Node 26 platform changes operators integrating with blamejs should know about: the new localStorage global (the framework's storage backend is b.backup.diskStorage; the legacy b.backup.localStorage alias was removed in v0.11.20 — update call sites accordingly), and the seed-only ML-KEM / ML-DSA PKCS8 export shape (sealed material from Node 24 re-imports cleanly on Node 26; new material from Node 26 in the seed-only shape). See SECURITY.md for the details.
The framework bundles the surface a typical Node app reaches for. Every primitive listed is callable today; nothing is a stub.
b.db, migrations, seeders, atomic-file writes; the db handle constructs with a SQLITE_LIMIT_LENGTH parse-time cap (a >1 MiB statement is rejected) as a DoS floor on the raw-SQL surface.increment(col, delta), closure-form .whereGroup / top-level .orWhere OR composition, .search(fields, term) LIKE-OR with safe %/_ ESCAPE handling, .paginate(opts) returning { items, total, page, totalPages }; a column-membership gate (db.init({ columnGate }), default reject) fails a query closed when it names a column the table never declared, and whereRaw refuses an embedded string literal so values bind through placeholdersb.db.collection(name, opts?) with $set / $inc / $unset / $eq / $ne / $gt / $gte / $lt / $lte / $in / $like; schemaless-document opts via overflow: "<col>" (folds unknown fields into a JSON-text column; rewrites WHERE on virtual fields to JSON_EXTRACT), jsonColumns: [...] (auto-stringify on write + parse via b.safeJson on read), sealedFields: { email: "emailHash" } (co-locates a b.cryptoField sealed-column / derived-hash declaration so plaintext lookups auto-rewrite to hash-column lookups)b.db.snapshot(); standalone encrypted-DB-file lifecycle (b.db.fileLifecycle({ dataDir, vault }) — decrypt-to-tmpfs, periodic re-encrypt flush, graceful shutdown — same envelope as b.db, no schema/audit-chain coupling); db.init opt-outs frameworkTables: false / auditSigning: false and path overrides encryptedDbPath / encryptedDbName / dbKeyPathb.externalDb); declarative role-narrowed views and Postgres row-level-security migrations (b.db.declareView, b.db.declareRowPolicy); an opt-in requireTls transport posture refuses a non-TLS backend at boot, and query / transaction / read traces carry OpenTelemetry db.* attributes. The framework's own data layer — the signed audit chain, cluster leadership and lease fencing, sessions, break-glass, and the local queue / cache / scheduler — is composed through the dialect-aware b.sql builder (every identifier quoted by construction, every value bound as a placeholder, dialect-correct SQLite / Postgres / MySQL output), so the framework's tables run on a Postgres or MySQL backend, not only local SQLite; b.guardSql validates result rows against NUL bytes, quote-jump sequences, and per-column / total-size boundarieslistVersions for right-to-erasure / crypto-shred against an Object-Lock bucket (b.storage, b.objectStore)b.queue, b.jobs) — the local backend can target an operator-supplied database / table / schema; cluster-shared cache (b.cache)b.auth.password); NIST 800-63B / PCI-DSS 4.0 / HIPAA-AAL2 profiles; HaveIBeenPwned k-anonymity breach check; length / context / dictionary / complexity rules; rotation + historybase64url(SHA-256(canonical-JSON)) key identifier (b.jwk.thumbprint / canonicalize): EC / RSA / oct / OKP + the AKP post-quantum key type, SHA-256/384/512; the canonical key name behind DPoP jkt, ACME account keys, and DBSC session pinsb.auth.oauth
parseFrontchannelLogoutRequest + verifyBackchannelLogoutToken with jti-replay defense)parseCallback — refuses iss mismatch + OP error= redirect)parseJarmResponse)b.auth.jar.parse)refreshAccessToken({ seen }))b.auth.ciba, poll/ping/push); OpenID Federation 1.0 trust chain + metadata_policy (b.auth.openidFederation); SAML 2.0 SP with XMLDSig signature-wrapping defense + RFC 9525 server-identity (b.auth.saml); OpenID4VCI 1.0 issuer (b.auth.oid4vci); OpenID4VP 1.0 verifier with DCQL (b.auth.oid4vp); SD-JWT VC with key_attestation extension (b.auth.sdJwtVc)b.session
/24 IPv4 + /64 IPv6 subnet binding via fingerprintFields: ["clientIpPrefix"] (carrier-roaming-safe)b.session.useStore + first-party b.session.stores.localDbThin (tmpfs-fast)create({ anonymous: true })b.session.rotate) re-keys the sid-bound device fingerprint to the new id — pass the same { req, fingerprintFields } used at create (a fingerprint-bound session rotated without req is refused, so the binding can never silently break or false-drift)b.session.logout(res, token)) destroys the session AND wipes client-side state — emits an RFC 9527 Clear-Site-Data header (cookies + storage + cache) and expires the session cookie before deleting the rowrequireMfa + per-route MFA freshness window + ABAC predicate registry (b.permissions); API keys with rotation (b.apiKey)b.breakGlass); two-person-rule m-of-n approval with cooling-off lock + cancellation (b.dualControl)b.fapi2.assertCallback (refuses missing iss + bare-param under message-signing) and b.fapi2.assertAuthzRequest (refuses non-JAR); CFPB §1033 / FDX 6.0 consumer-financial-data-sharing wrapper (b.fdx)b.middleware.dpop requires a replayStore (a b.nonceStore-shaped { checkAndInsert }) at mount so single-use jti-replay defense is always enforced — mounting it without the store throws at config time rather than failing open at request timeb.subject, b.subject.eraseHard); subject-level legal-hold registry consulted by erase + retention paths (FRCP Rule 26/37(e), GDPR Art 17(3)(e), SEC Rule 17a-4, HIPAA §164.530(j)(2)) (b.legalHold). The legal-hold reason / custodian / citation and the Art. 18 restriction reason — free text that ties a subject to a legal matter — are sealed at rest under the vault key, not stored in clearb.worm.create): compliance / governance Object-Lock modes, extend-only retainUntil, legal holds, and a tamper-evident SHA3-512 digest verified on read — the store-agnostic application-level companion to b.objectStore's S3 Object Lock, for sealed-DB / filesystem / non-S3 backends (SEC 17a-4(f), CFTC 1.31, FINRA 4511)b.authBotChallenge); session-to-device-posture binding with fail-closed verify (b.sessionDeviceBinding)b.privacyPass): issue a WWW-Authenticate: PrivateToken challenge and verify a presented Blind-RSA (type 0x0002) token against the issuer public key, with no issuer callback and no client identityb.crypto.oprf.suite): learn F(serverKey, input) without the server seeing the input — the primitive behind password hardening (pepper a password the server never sees), private set intersection, and Privacy Pass; oprf (base) + voprf (verifiable, DLEQ-proof) modes over ristretto255-SHA512 / P-256 / P-384 / P-521; validated against the RFC 9497 Appendix-A vectorsb.crypto, b.vault)b.crypto.selfTest() runs FIPS 140-3-style integrity checks: NIST FIPS 202 known-answer tests (SHA3-256/512, SHAKE256), AEAD round-trip + tamper-detect, and ML-KEM-1024 / ML-DSA-87 / SLH-DSA-SHAKE-256f pairwise-consistency + negative tests; fails closed (throws) on any mismatchb.cryptoField.eraseRow; per-column and per-row data residency tagging enforced at the write boundary (cross-border DML refused under GDPR / UK-GDPR / DPDP / PIPL / LGPD / APPI / PDPA postures) — on the structured builder, on raw SQL writes (b.db.runSql / b.db.prepare().run(), parsed quote-aware and failing closed when unparseable), on read-replica fan-out (a regulated read with no row region identified is refused), and surfaced by b.backup.create for any per-row-residency table whose admitted regions differ from the backup destination — plus per-row keys (each row's key derives from a CSPRNG row-secret sealed under the vault root, never from an on-disk value) so destroying a row's wrapped secret leaves its WAL / replica / backup residual ciphertext undecryptable even with the vault root key (b.cryptoField.declareColumnResidency, b.cryptoField.declarePerRowResidency, b.cryptoField.listPerRowResidency, b.cryptoField.declarePerRowKey)(table, rowId, column, schemaVersion); copy-paste between rows or schema-version replay surfaces as refused decrypt (b.vault.aad). The database encryption key is sealed the same way — bound to its purpose, data directory, and key path — so a relocated key file fails to unseal; an older unbound key upgrades itself on first load. A vault-key rotation re-seals every AAD-bound cell, the database key, and tenant archives under the new keypair and refuses rather than silently orphaning a store it cannot reach (b.vaultRotate, b.vault.aad.resealRoot, b.archive.rewrapTenant)hmac-shake256 MAC off a per-deployment key (cryptoField.registerTable({ derivedHashMode }), b.vault.getDerivedHashMacKey), making the lookup hash unforgeable and un-correlatable across deploymentsb.webhook, b.crypto)b.crypto.hpke); RFC 9421 HTTP Message Signatures with derived components and ed25519 / ML-DSA-65 (b.crypto.httpSig); RFC 9530 Content-Digest / Repr-Digest body-integrity fields (SHA-256 / SHA-512, legacy algorithms refused — b.contentDigest) to sign the digest rather than the whole bodyb.crypto.xwing (draft-connolly-cfrg-xwing-kem, experimental): ML-KEM-768 + X25519 bound by SHA3-256, secure if either component holds — the conservative key-encapsulation shape for migrating off classical ECDH. keygen / encapsulate / decapsulate with a 1216-byte public key, 1120-byte ciphertext, and 32-byte shared secretb.linkHeader.parse / serialize): parse and build Link: <uri>; rel="next" relations, the standard REST pagination mechanism; quote-aware (a comma inside a quoted parameter never splits the list)b.uriTemplate.expand / compile): full Level 4 — every operator, the :N prefix and * explode modifiers — turning {/path}{?q*} plus variables into a concrete URI; validated against the official uritemplate-test suite. The {var} syntax behind OpenAPI links and HAL _linksb.jtd.validate / isValid): portable, cross-implementation schema validation (all eight forms — type / enum / elements / properties / values / discriminator / ref / empty), returning instancePath / schemaPath errors; validated against the official 316-case suite. Interop companion to the fluent b.safeSchema builderb.jsonSchema.compile / validate / isValid): full vocabulary including every applicator, annotation-aware unevaluatedProperties / unevaluatedItems, and $ref / $dynamicRef / $anchor / $id resolution (external refs via an operator-supplied schema map, never a network fetch); format is an annotation unless assertFormat is set; returns located { valid, errors }. Validated against the official JSON-Schema-Test-Suite. Standards-track counterpart to b.safeSchema and b.jtdb.base32.encode / decode): standard + extended-hex alphabets, padded or bare, strict or lenient decode (case-insensitive, ignoring spaces / dashes for copied TOTP keys); validated against the RFC 4648 §10 vectors. The codec behind b.auth.totp secretsb.jsonPath.query / paths): name / wildcard / index / slice / descendant selectors, ?filter expressions, and the five standard functions, with compile-time well-typedness checks (validated against the official 703-case compliance suite); complements the JSONPath guardsb.jsonPointer.get (reference a value by /foo/0/bar) + RFC 6902 b.jsonPatch.apply (atomic add / remove / replace / move / copy / test for HTTP PATCH; the input document is never mutated, structural test comparison) + RFC 7396 b.jsonMergePatch.merge (the merge-patch+json partial-document format; both PATCH formats are prototype-pollution-safe)b.canonicalJson.stringifyJcs): the deterministic, sorted-key byte form to hash or sign (custom credentials, receipts, deterministic request signing); UTF-16 key ordering + ECMAScript number formatting, with a lenient stringify variant for Buffers / Dates / BigIntsb.structuredFields.parse / serialize): Items / Lists / Dictionaries, Inner Lists, Parameters, and every bare-item type (Integer / Decimal / String / Token / Byte Sequence / Boolean / Date / Display String) with strict grammar + range enforcement — the parser behind Content-Digest, Client Hints, and HTTP Message Signaturesb.cms)node:stream pipelines draw from one operator-configured bytesPerSec budget (b.streamThrottle)b.mail.deploy.parseTlsRptReport / b.mail.deploy.tlsRptIngestHttp)b.tlsExporter); RFC 9162 CT v2 inclusion-proof verification (b.network.tls.ct.verifyInclusion); RFC 8555 ACME + RFC 9773 ARI for 47-day certs with { jitter: true } fleet-scheduling (b.acme.renewIfDue); draft-aaron-acme-profiles (acme.listProfiles() + newOrder({ profile })); draft-ietf-acme-dns-account-label (acme.dnsAccount01ChallengeRecord(token, { identifier })); RFC 8470 0-RTT inbound posture refuse / replay-cache (b.router.create({tls0Rtt})); RFC 9794 SecP256r1MLKEM768 in preferred-group order (b.network.tls.preferredGroups); RFC 6960 OCSP stapling — the cert manager (b.cert) fetches + validates each managed certificate's OCSP response (b.network.tls.ocsp.fetch) on a refresh cadence and exposes it on the served context for a TLS server's OCSPRequest handler to stapleb.mtlsCa, b.pqcGate, b.pqcAgent)b.openapi — webhooks + jsonSchemaDialect) + AsyncAPI publication for event/streaming (b.asyncapi)createApp) — security layers wired ON by default (Core Rule §3); each is configurable via middleware.<name> (operator cookie / field names flow straight through — nothing static is baked in) or opt-out with false (disabling a default is audited via app.middleware.disabled). Ordered so each layer has what it needs (cookies + CSP nonce + fetch-metadata, then body parser, then CSRF last):
Permissions-Policy defaults denying storage-access / browsing-topics / private-aggregation / controlled-frameb.middleware.cookies)b.middleware.cspNonce)b.middleware.fetchMetadata)storage: "memory") for read-only / serverless filesystemsb.middleware.csrfProtect)allowPrivateNetwork opt) and rate-limit are wired when configured via middleware.cors / middleware.rateLimitCache-Control: no-store on every 401 from requireAuth / requireAal / requireStepUp per RFC 9111 §5.2.2.5problemDetails: true for an RFC 9457 application/problem+json body or onDeny(req, res, info) to render the refusal itself — so a service can standardize one error envelope across its API without working around hardcoded bodies (b.problemDetails)routes callback: compression, SSE, request logging, request-time DB role binding (b.middleware.dbRoleFor), in-process CIDR fence (b.middleware.networkAllowlist)b.httpClient, b.ssrfGuard, b.safeUrl)b.network) — env-driven NTP / NTS (RFC 8915), IPv4/IPv6 NTP, DNS with IPv6 / DoH / DoT (private-CA pinning) / cache / lookup timeout; local DNSSEC signature verification (RFC 4035 — b.network.dns.dnssec.verifyRrset over a canonicalised RRset against RSA / ECDSA P-256·P-384 / Ed25519 DNSKEYs, plus DS-digest + key-tag, plus verifyDenial for NSEC / NSEC3 (RFC 5155) NXDOMAIN / NODATA proofs with iteration caps + Opt-Out handling, plus verifyChain to validate a full root→TLD→zone delegation chain against the pinned IANA root anchors) so a resolver client can verify both positive and negative answers instead of trusting the upstream AD bit; DANE / TLSA certificate matching (RFC 6698/7671 — b.network.dns.dane.matchCertificate) to pin a service's key through DNSSEC instead of a public CA; TSIG transaction signatures (RFC 8945 — b.network.dns.tsig.sign / verify) for shared-key HMAC authentication of zone transfers, dynamic updates, and query/response pairs, with constant-time MAC compare + fudge-window check (verified against dnspython); outbound HTTP proxy (HTTP_PROXY / HTTPS_PROXY / NO_PROXY); runtime DPI trust-store CA additions; application-level heartbeats; TCP socket defaultsb.errorPage)b.safeJson (with maxKeys cap defending CVE-2026-21717 V8 HashDoS), b.safeBuffer, b.safeSql, b.safeSchemab.safeUrl (IDN mixed-script / homograph refuse; canonicalize collapses obfuscated host + IP forms — decimal / octal / hex / IPv4-mapped / zero-compressed IPv6, IDN → punycode, default-port, trailing-dot, percent-encoding — to one comparable string so SSRF allowlist / dedup checks can't be bypassed by re-encoding the same address, with b.ssrfGuard.canonicalizeHost for the host-only path); b.safeJsonPath (refuses filter ?(...), deep-scan $.., script-shape (@.x) for safe Postgres JSONB ops)b.cbor bounded deterministic CBOR (RFC 8949 §4.2): depth/size caps, indefinite-length + reserved-info + tag + duplicate-key refusal, requireDeterministic canonical-form check; the in-tree substrate under COSE / CWT / SCITT / WebAuthn attestationb.cose the full RFC 9052 message-type set over b.cbor: COSE_Sign1 sign/verify (attached or detached payload), COSE_Encrypt0 single-recipient AEAD, COSE_Mac0 shared-key HMAC (mac0/macVerify0), plus importKey (COSE_Key → KeyObject) and exportKey (KeyObject → COSE_Key, the inverse — ship a verification key as RFC 9052 §7 bytes). Signatures use classical ES256/384/512 + EdDSA (final COSE ids, interoperable today) plus ML-DSA-87 (PQC-forward, draft id); bounded + alg-allowlisted + crit-bypass-checked verification; AEAD ChaCha20/Poly1305 default (AES-GCM opt-in); the signed-statement substrate under SCITT / CWT / mdoc / C2PAb.cwt CWT sign/verify (RFC 8392) over b.cose: standard-claim mapping (iss/sub/aud/exp/nbf/iat/cti) + exp/nbf clock-skew enforcement + iss/aud matching; the CBOR-native JWT for constrained / IoT / FIDO / verifiable-credential contextsb.eat EAT sign/verify (RFC 9711) over b.cwt: device + software attestation claims (ueid / oemid / hwmodel / measurements / submods) with verifier-nonce freshness binding, dbgstat debug-status policy, and eat_profile pinningb.scitt sign/verify a signed, attributable claim about an artifact (signed SBOM, build attestation, release approval) over b.cose: the issuer + subject bind in the integrity-protected CWT_Claims header (RFC 9597); verification refuses any statement missing the iss/sub binding. The issuer side, on finalized RFCs; the transparency receipt (COSE Receipts draft) opts in on publicationb.tsa RFC 3161 timestamp client: buildRequest a TimeStampReq, parseResponse, and verifyToken against your data — the message imprint, sent nonce, critical/sole id-kp-timeStamping EKU, and CMS signature are all checked, with optional certificate-chain verification. Timestamp a release artifact, audit checkpoint, or signed statement against any RFC 3161 TSA. Composes b.cms + the in-tree ASN.1 DER codecb.vc W3C Verifiable Credentials Data Model 2.0 (VC-JOSE-COSE): issue / verify a signed credential, and present / verifyPresentation a holder-signed Verifiable Presentation wrapping credentials (with nonce/audience holder-binding) — as a compact JWS (vc+jwt / vp+jwt, ES256/384/512 + EdDSA) or a COSE_Sign1 (vc+cose / vp+cose, + ML-DSA-87) over b.cose. VCDM structural + validFrom/validUntil checks; the JOSE none algorithm is always refused. The W3C model, distinct from the IETF SD-JWT VC at b.auth.sdJwtVcb.mdoc ISO/IEC 18013-5 verification: verifyIssuerSigned checks the COSE_Sign1 IssuerAuth (issuer cert from the x5chain header), the MSO validity window, and every disclosed element's digest against the MSO valueDigests (selective-disclosure integrity), with optional issuer-chain verification; verifyDeviceAuth proves holder binding (§9.1.3 signature variant) — the device COSE_Sign1 over the DeviceAuthentication structure with the MSO device key + protocol sessionTranscript. The ISO credential ecosystem alongside b.vc and b.auth.sdJwtVc. Composes b.cose + b.cborb.did W3C DID resolution (DID Core 1.0): resolve a did:key / did:jwk (deterministic, offline — Ed25519 / P-256 / P-384 / secp256k1) or did:web (operator-fetched document) to node:crypto verification keys, so a credential's issuer DID resolves to the key that verifies it (b.vc / b.mdoc / b.scitt). keyToDid names a key as a did:key or did:jwk; document/JWK keys are kty/crv-allowlisted before importb.parsers (XML / TOML / YAML / .env); b.config (schema-validated env)b.fileType magic-byte content classification with deny-on-upload categories (image / document / archive / executable / etc.)b.gateContract uniform mode posture / hooks / forensic snapshot / decision cache / runtime capb.guardCsv (formula injection, dangerous-function denylist, bidi / homoglyph / dialect ambiguity, CSV-bombs); b.guardHtml (XSS / mXSS / DOM-clobbering, dangerous-tag + event-handler family, URL-scheme with entity-decode bypass, CSS-injection in style); b.guardSvg (script / foreignObject / animation href hijack / DOCTYPE / XXE / SVGZ / cross-origin <use> SSRF); b.guardMarkdown (URL schemes pre-render, CVE-2026-30838 dangerous-tag, ReDoS emphasis runs)b.guardJson (prototype-pollution, dup keys, JSON5, depth/breadth caps); b.guardYaml (deserialization-tag RCE, billion-laughs aliases, Norway-problem); b.guardXml (XXE / billion-laughs / xi:include / signature wrapping; DOCTYPE refused at all profile levels)b.guardArchive (zip-slip, symlink + hardlink escape, decompression bombs, duplicate-entry); b.guardFilename (path traversal raw + percent-encoded + overlong-UTF-8, null-byte, Windows reserved, NTFS ADS, RTLO bidi)b.guardEmail (SMTP smuggling per CVE-2023-51764 / 51765 / 51766 class, CRLF header injection, IDN homograph, IP-literals, RFC 5321 length caps)b.guardAll registry; every shipped guard ON by default; opt-out per guard with audited reason via exceptFor: { name: { reason } }. b.fileUpload and b.staticServe wire b.guardAll.byExtension({ profile: "strict" }) + b.guardFilename.gate({ profile: "strict" }) automatically — operator opts out via contentSafety: null / filenameSafety: null (audited)b.websocket, b.websocketChannels)b.wsClient with PQC-TLS handshake, permessage-deflate negotiation with decompression-bomb cap, fatal UTF-8 validation, permanent-error classifier (skips reconnect on 4xx / accept mismatch / bad-subprotocol), exponential-backoff with full jitterb.pubsub); framework-emitted signal bus for breach / integrity events (b.events)wrap / parse envelopes, non-throwing validate / isValid, the JSON event + batch formats (toJSON / fromJSON / toJSONBatch / fromJSONBatch), and the HTTP binding in both binary and structured content modes with auto-detecting http.decode (b.cloudEvents); Server-Sent Events with newline-injection refusal in event: / id: / data: / Last-Event-ID (CVE-2026-33128 / 29085 / 44217 class) (b.sse, b.middleware.sse)b.mail, b.mailBounce)b.mail.send.deliver)b.mail.spf, b.mail.dmarc, b.mail.arc)b.mail.server.mx), RFC 6409 submission with SASL + identity-binding (b.mail.server.submission), RFC 9051 IMAP4rev2 with CONDSTORE / QRESYNC / NOTIFY / METADATA / CATENATE (b.mail.server.imap), RFC 8620 + RFC 8621 JMAP Core + Mail over HTTP/SSE/WebSocket (b.mail.server.jmap), POP3 (b.mail.server.pop3), ManageSieve (b.mail.server.managesieve)b.mail.send.deliver to land the RFC 8621 §7.5 surface end-to-end (b.mail.server.jmap.emailSubmissionSetHandler)b.mail.crypto.cms) + OpenPGP encrypt/decrypt + WKD key discovery with IDN-homograph defense (b.mail.crypto.pgp)b.mail.agent, b.mailStore)b.calendar)b.notify); TCPA / FCC 1:1 prior-express-written-consent + 10DLC carrier-shaped consent snapshot for SMS marketing (b.tcpa10dlc)b.fileUpload)b.mcp.serverGuard with bearer auth + redirect_uri allowlist + dynamic-register refusal + tool/resource allowlists (CVE-2026-33032 / CVE-2025-6514 / confused-deputy class)b.mcp.toolResult.sanitize — prompt-injection / dangerous-HTML / off-allowlist-URL detection (OWASP LLM07)b.mcp.capability.create — least-privilege capability scopes (OWASP LLM08)b.mcp.validateToolInput — JSON Schema 2020-12 input enforcement_service.sdl trust-boundary with router-token + nonce store (b.graphqlFederation)b.ai.input.classify), with per-source trust-tier classification for retrieval-augmented context (b.ai.input.classifyWithSources) and escape-by-default prompt assembly that fences untrusted segments in a per-render crypto-nonce delimiter the content can't forge (b.ai.prompt.template)b.ai.output.sanitize), plus PII / secret redaction (b.ai.output.redact); OWASP LLM05:2025 + LLM02:2025b.a2a)b.contentCredentials); COSE signatures carry an RFC 3161 timestamp countersignature (C2PA sigTst2, RFC 9921) verified through b.tsa so a manifest stays verifiable after its signing certificate expires, plus a CAWG identity assertion with trust-anchored verificationb.ai.quota)b.ai.quota cost budgets (b.ai.capability)b.ai.aedtBiasAudit): selection / scoring rates and EEOC four-fifths-rule impact ratios across sex, race/ethnicity, and their intersection, with the most-selected group and adverse-impact flags (impact ratio < 0.8) for the annual published summary; sub-2% categories excludable per DCWP §5-301b.ai.frontierModelProtocol): classify the frontier-model (>10²⁶ training FLOPs) and large-frontier-developer (>$500M revenue) thresholds, enumerate the resulting obligations, check a safety framework for required elements, and build a critical-safety-incident report with the 15-day / 24-hour California OES notification deadline (.incidentReport)b.compliance.aiAct.gpai.declareAdherence / verifyAdherence)b.dsa.noticeAndAction / statementOfReasons / transparencyReport)b.pipl.sccFilingAssessment / securityAssessmentCertificate)b.compliance cascades operator-declared regime into retention / audit / db / cryptoField via POSTURE_DEFAULTS:
hipaa / hipaa-2026 / hhs-repro-24 / hitech / pci-dss / glba-safeguards / sox-404 / soc2 / soc2-cc1.3 / sec-cyber / sec-17a-4 / finra-4511 / fda-21cfr11 / fda-annex-11 / modpa / nydfs-500 / staterramp / ferpa / fl-fdbr / coppa / coppa-2025 / gina / vppa / can-spam / il-gipa / nist-pf-1.1gdpr / dora / nis2 / cra / eu-data-act / eaa / uk-g-cloud / uk-duaa / dsa / dga / eu-cer / eu-cyber-sol / eidas-2dpdp / pipl-cn / lgpd-br / appi-jp / pdpa-sg / quebec-25 / irap / kr-ai-basic / pipa-kr / au-privacy / th-pdpa / vn-pdp / id-pdp / my-pdpa / cl-pdpa / mx-lfpdppp / ar-pdpaca-aadc / ny-safe-kids / ny-saffe / md-kids-code / vt-aadcfapi2 / fapi-2.0-message-signing / fdx / dsrco-ai / il-hb3773 / tx-traiga / ut-aipa / nyc-ll144 / nyc-ll144-2024 / sb-53 / ca-tfaia / ca-sb942 / ca-ab853 / cn-ai-label / iso-42001 / iso-23894 / nist-ai-rmf-1.0 / nist-ai-600-1-genai42-cfr-part-2 / hti-1 / uscdi-v4 / irs-1075 / nist-csf-2.0 / nist-800-53-r5-privacy / nist-800-172-r3 / m-22-09 / m-22-18 / ffiec-cat-2 / cri-profile-v2.0soci-au / tlp-2.0wcag-2-2bsi-c5 / ens-es / etc.b.compliance.aiAct.crossWalkIso42001() + crossWalkIso23894() map every AI Act article (Art. 9 risk management → Art. 73 incident reporting) to the matching ISO/IEC 42001:2023 Annex A controls and ISO/IEC 23894:2023 risk-management clauses for ISO-certification audit packsb.dataAct)b.fda21cfr11); PCI DSS 4.0 Req 10.4.1.1 daily-review automation (b.auditDailyReview); SOX §404 + SOC 2 CC1.3 segregation-of-duties via Postgres trigger DDL (b.audit.bindActor, b.audit.assertSegregation)b.ddlChangeControl); row-level WORM triggers boot-asserted under sec-17a-4 / finra-4511 / fda-21cfr11 (b.db.declareWorm); dual-control physical delete + crypto-erase + REINDEX in one transaction (b.db.declareRequireDualControl, b.db.eraseHard)ftc-2024 / ca-sb942 / strict) (b.darkPatterns)b.ai.dp)b.dsr); IAB TCF v2 consent-string parse + encode + disclosedVendors validator (b.iabTcf); IAB MSPA / GPP universal-opt-out (USNAT / USCA / USVA / USCO / USCT / USUT) + GPC mirror (b.iabMspa); generic consent capture + withdrawal (b.consent); educational-only consent purpose with FERPA / SOPIPA lawful-basis gating + annual EdTech third-party vendor-review attestation (b.consent.recognizedPurpose, b.privacy.vendorReview)b.dora); EU NIS2 (b.nis2); EU Cyber Resilience Act SBOM + secure-software-attestation (b.cra); SEC Form 8-K Item 1.05 cybersecurity-incident materiality-disclosure (b.secCyber); incident lifecycle coordinator (b.incident)b.redact.installOutboundDlp)b.audit, b.audit.export({ format: "cadf" }))b.metrics, b.tracing (OTel pass-through); OTLP/HTTP-JSON exporter for traces + metrics (b.otelExport). Span / metric / resource attribute values are scrubbed through the telemetry redactor before egress (b.observability.redactAttrs, default composes b.redact.redact) so a secret or PII in an attribute value never reaches the collector verbatim (CWE-532); operators building a custom exporter apply the same gateb.logStream)b.redacthoneytoken.tripped (b.honeytoken)b.security.assertProduction); tamper-evident config-baseline drift detection signed with audit-signing key + at-boot vendor-bundle SHA-256 integrity verification across lib/vendor/* (b.configDrift, b.configDrift.verifyVendorIntegrity)b.middleware.cspReport; post-incident audit-bundle composer (b.auditTools.forensicSnapshot); audit export / archive / forensic snapshot write to disk or return the encrypted bundle in memory (returnBytes) for read-only / serverless filesystemsb.i18n)b.csv)b.uuid); URL-safe slugs (b.slug)b.time); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (b.archive + b.archive.read.zip); one-liner quarantine extraction (b.safeArchive.extract); one-liner in-memory extraction with no disk write for read-only / serverless filesystems (b.safeArchive.extractToMemory, or the low-level b.archive.read.zip(...).extractEntries() / .tar); fs / objectStore / http / buffer / trusted-stream adapter contract (b.archive.adapters); recipient-sealed envelopes — hybrid-PQC key-pair, peer certificate, or per-tenant key with no key-pair to manage (b.archive.wrap({ recipient: "tenant", tenantId }))b.pagination); HTML form rendering + validation + CSRF (b.forms)b.cluster); cron + interval scheduler that runs exactly-once globally (b.scheduler)b.crdt): grow-only / PN counters, grow-only / two-phase / observed-remove sets, a last-write-wins register, and an observed-remove map; each merge is commutative / associative / idempotent so replicas converge with no coordination — the substrate for active/active and offline-first state, with state() / fromState() for snapshot via b.archive / b.backupb.retry); graceful shutdown (b.appShutdown); NTP boot check (b.ntpCheck)b.outbox, b.inbox); Debezium-shape change-event envelope on the outbox (b.outbox.create({ envelope: "debezium" }))b.backup, b.backup.scheduleTest, b.backupBundle.verifyManifestSignature); restore with pulled-bundle footprint preflight (b.restore); disaster-recovery runbook generator (HIPAA / PCI-DSS / GDPR / SOC 2 / DORA postures) (b.drRunbook)b.tenantQuota); per-Postgres-role hardening with pg_roles enumeration guard (b.externalDb.assertRoleHardening)b.db.exportCsv, b.db.getTableMetadata)b.retention)req.flag accessor (b.flag)b.resourceAccessLock); composite account-takeover kill-switch (b.atoKillSwitch)worker_threads sandbox with strict resource limits (b.sandbox, composable into b.template.create({ sandbox: true })); hardened processSpawn refusing shell-string invocation (b.processSpawn)b.httpClient.request({ allowedHosts: [...] })Full primitive-by-primitive docs live at blamejs.com, which is itself the examples/wiki/ app running in production. The wiki is organized by concern:
blamejs ships an operator-facing CLI for the recurring ops work. Each subcommand boots a headless app instance from --data-dir (no HTTP listener), runs the operation, and shuts down. Same vault + DB + audit chain the running app uses.
blamejs migrate up | down | status --db <path> [--dir <path>]
blamejs seed run | status --db <path> --env <name> [--dir <path>]
blamejs dev --command <cmd> [--watch <dir>...]
blamejs api-snapshot capture | compare --file <path>
blamejs api-key issue | revoke | list | rotate | verify --data-dir <path> --namespace <ns>
blamejs audit archive | export | verify-bundle | verify-chain | purge --data-dir <path>
blamejs backup inspect | verify | extract --bundle <path>
blamejs restore list | inspect | apply | rollback | list-rollbacks --data-dir <path> --bundle <dir>
blamejs mtls status | show-cert | init | issue | issue-p12 --data-dir <path>
blamejs vault status | seal | unseal | rotate --data-dir <path>
blamejs security assert --data-dir <path>
blamejs config-drift inspect | verify --data-dir <path>
blamejs file-type detect <file> [--allowlist image,pdf,...]
blamejs password check --plaintext "..." [--profile pci-4.0|nist-aal2|hipaa-aal2] [--breach-check] [--email <e>] [--username <u>]
blamejs erase --table <t> --row-id <id> --confirm --data-dir <path>
blamejs retention preview | run --data-dir <path> --table <t> --age-field <col> --ttl-ms <n> [--action soft-delete|delete|erase] [--soft-delete-field <col>]
blamejs version
blamejs help [<command>]
Pass --help to any subcommand for the full flag list (blamejs api-key --help etc.). Passphrases for crypto-backed operations resolve from the appropriate env var (BLAMEJS_VAULT_PASSPHRASE, BLAMEJS_BACKUP_PASSPHRASE, BLAMEJS_AUDIT_PASSPHRASE) so they don't end up in shell history.
examples/wiki/ is a complete production-ready operator-built blamejs app — the wiki you're looking at when you visit blamejs.com. It demonstrates every framework primitive in real usage and ships with Dockerfile, docker-compose.yml (dev), docker-compose.prod.yml (Caddy + GHCR image), and a published OCI image at ghcr.io/blamejs/blamejs-wiki:<tag> (multi-arch amd64/arm64, cosign-signed via GitHub OIDC, Trivy-scanned, SHA3-512 digest).
See examples/wiki/DEPLOY.md for the full deployment walkthrough, including the operator-facing environment-variable matrix (WIKI_* and BLAMEJS_* keys) and the pin-to-version workflow for production updates.
All runtime dependencies are committed to the repo — no transitive npm install at runtime, no node_modules lookup path for production. Server-side deps are bundled via scripts/vendor-update.sh:
./scripts/vendor-update.sh --check # see what's outdated
./scripts/vendor-update.sh --diff @noble/ciphers # see changelog before bumping
./scripts/vendor-update.sh @noble/ciphers 2.2.0 # bundle + commit a new version
| Package | Version | Author | Purpose |
|---|---|---|---|
@noble/ciphers | 2.2.0 | Paul Miller | XChaCha20-Poly1305 AEAD |
@noble/post-quantum | 0.6.1 | Paul Miller | Pure-JS FIPS 203 ML-KEM (ml_kem_512 / ml_kem_768 / ml_kem_1024), FIPS 204 ML-DSA (ml_dsa_44/65/87), FIPS 205 SLH-DSA (slh_dsa_*). First-class on both server-side and client-side via b.pqcSoftware — security-first defaults pin to the highest cat-5 levels (ML-KEM-1024, ML-DSA-87, SLH-DSA-SHAKE-256f); interoperable with Node's built-in WebCrypto ML-KEM that b.crypto.encrypt / b.middleware.apiEncrypt use. |
@simplewebauthn/server | 13.3.0 | Matthew Miller | WebAuthn / passkey verification |
@peculiar/x509 + pkijs | 2.0.0 + 3.4.0 | Peculiar Ventures | Pure-JS mTLS CA — ECDSA P-384 cert signing, PKCS#12 packaging (no openssl CLI) |
SecLists 10k-most-common.txt | master snapshot | Daniel Miessler / SecLists contributors (CC-BY-3.0) | Top-10000 common-password dictionary read by b.auth.password.policy() for the NIST 800-63B §5.1.1.2 "previously breached" check |
prismjs | 1.30.0 | Lea Verou + contributors | Syntax highlighting in the example wiki's code blocks (browser-side) |
These libraries are exceptional work — blamejs wouldn't exist without them. All are MIT licensed (the SecLists password list is CC-BY-3.0). Per-package version, license, and provenance live in two manifests: lib/vendor/MANIFEST.json for the framework's server-side bundles and examples/wiki/public/vendor/MANIFEST.json for the wiki app's browser-side bundle. The framework's NOTICE file carries the upstream attributions.
Because when something breaks, blame should know exactly where it lives. We own the stack so you don't have to chase the fault across an ecosystem.
Every release passes a layered gate at test/layer-0-primitives/codebase-patterns.test.js that operates on lib/ source:
JSON.parse on operator input without size cap, numeric opts that silently accept Infinity / NaN, ReDoS-risky regex without length cap, hash / token compares without timingSafeEqual, raw new URL skipping the SSRF gate, Math.random() in security-sensitive paths, and a couple dozen others — each a bug class the framework already swept once and won't re-introduce.validateOpts.requireNonEmptyString, safeAsync.makeScheduledFlush, dbSchema.runInTransaction, etc.) registers the inline shape it replaced; new code that re-implements the shape fails the gate even if it's the only file matching.The gate is part of node test/smoke.js; the framework refuses to release without it green.
Patches welcome. See CONTRIBUTING.md for the dev setup, house rules (zero npm runtime deps, PQC-only crypto, audit-on-every-action, ship-complete-not-incremental), and the PR loop. New to the codebase? Start with ARCHITECTURE.md for the orientation map.
Community standards: CODE_OF_CONDUCT.md (Contributor Covenant 2.1). Be excellent.
Threat model, supported versions, vulnerability disclosure: SECURITY.md. Do not file public issues for security bugs — email security@blamejs.com.
Apache-2.0. See LICENSE for the full text and NOTICE for attribution of vendored components.
FAQs
The Node framework that owns its stack.
The npm package @blamejs/core receives a total of 2,875 weekly downloads. As such, @blamejs/core popularity was classified as popular.
We found that @blamejs/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.
Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.