
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
AI-first reactive full-stack TypeScript framework for deterministic human and agent collaboration
AI-first reactive full-stack TypeScript framework and application platform for deterministic collaboration between humans and coding agents across frontend, fullstack, and server systems.
Gorsee is not a pet project, not a research toy, and not a bundle of optional recipes. It is a product-grade platform with strict runtime contracts, built-in security boundaries, fine-grained reactivity, and AI-native developer tooling.
Gorsee is built around four non-negotiable product goals:
Read the strategic docs:
Gorsee ships one product with three canonical application modes:
frontend for browser-first prerendered apps deployed to static-capable targetsfullstack for the canonical Gorsee route/runtime model across UI + server executionserver for API-first and service-oriented systems without mandatory browser surfacesSet the mode explicitly in app.config.ts:
export default {
app: {
mode: "fullstack",
},
}
fullstack remains the default when app.mode is omitted.
High-level mode guidance:
frontend builds browser-first prerendered output and should prefer static-capable deploy targets.fullstack keeps the canonical Gorsee route/runtime model and can target Bun, Node, or worker-style deploy adapters.server focuses on API-first and service-oriented systems with process/runtime ownership kept explicit.server mode should prefer gorsee worker for canonical long-running worker and service entry execution.bunx gorsee create my-app --template secure-saas
cd my-app
bun install
bun run dev
Worker-first server path:
bunx gorsee create my-service --template worker-service
cd my-service
bun install
bun run worker
Canonical worker CLI path for server-mode apps:
gorsee worker
gorsee worker --entry workers/custom.ts
Alternative bootstrap paths:
npx create-gorsee my-app
npm create gorsee@latest my-app
Open http://localhost:3000.
For agent cold-start context:
bunx gorsee ai framework --format markdown
For the first real external proof draft:
npm run external-proof:scaffold -- --type reference --id first-public-reference
Most modern frameworks optimize for flexibility, historical compatibility, or ecosystem breadth. Gorsee optimizes for deterministic delivery by humans and AI agents working in the same codebase.
What that means in practice:
gorsee ai frameworkgorsee check, release gates, deploy contracts, and policy docsbun run api:policybun run adoption:policybun run dependency:policybun run deploy:policybun run benchmarks:policybun run runtime:security:policybun run runtime:policybun run critical:surface and bun run test:critical-surfacebun run coverage:auditCritical Surface Suite:
bun run critical:surface keeps the documented regression gate aligned across package scripts, CI, support claims, and coverage docs.bun run test:critical-surface runs the highest-risk runtime/security/reactive/AI/publish regressions that must fail closed before release.The framework must be easy for an agent to reason about:
Gorsee follows a fine-grained reactive model closer to Solid than to React:
import { island, createSignal } from "gorsee/client"
export default island(function LikeButton() {
const [count, setCount] = createSignal(0)
return <button on:click={() => setCount((value) => value + 1)}>Like {count()}</button>
})
Capabilities are not bolt-on features. They are part of the framework contract:
For greenfield route modules, prefer this structure:
default export for page UIload for route data readsaction for page-bound mutationscache for declarative cache policymiddleware for cross-cutting request policyGET / POST / other method handlers for raw HTTP endpointsgorsee/routes for typed links and navigationCompatibility note: loader remains supported as a migration alias, but canonical route modules should use load.
import { createSignal, island, Link, Head } from "gorsee/client"
import { createAuth } from "gorsee/auth"
import { createDB } from "gorsee/db"
import { cors } from "gorsee/security"
import { log } from "gorsee/log"
import { defineForm, useFormAction } from "gorsee/forms"
import { createTypedRoute } from "gorsee/routes"
const userRoute = createTypedRoute("/users/[id]")
<Link href={userRoute} params={{ id: "42" }}>Profile</Link>
gorsee/client for route components and browser-safe APIs.gorsee/server for load, action, middleware, API routes, cache, request policy, and server runtime orchestration.gorsee/auth, gorsee/db, gorsee/security, gorsee/ai, gorsee/forms, gorsee/routes, gorsee/i18n, and gorsee/content when the concern is already clear.gorsee only for compatibility. New code should not depend on it.gorsee/compat only for explicit legacy migration semantics.Link prefetch is explicit: prefetch={true} is eager, prefetch="hover" is pointer/focus triggered, and prefetch="viewport" is IntersectionObserver-driven. Links without prefetch do not prefetch implicitly.runtime.topology = "multi-instance" in app.config.ts.security.rateLimit.limiter is configured with a distributed backend such as createRedisRateLimiter(...).createRedisSessionStore(...), createRedisCacheStore(...), and createRedisJobQueue(...) for session/cache/jobs when replicas must share state..gorsee/* local artifacts for node-local triage, and add ai.bridge.url when fleet-level AI event aggregation is required.dist/prod.js for Bun, dist/prod-node.js for Node, and matching Bun/Node server-handler entries for adapter runtimesnpm pack / publish time to compiled dist-pkg/*.js and dist-pkg/*.d.ts artifactsgorsee validates CLI install, starter creation, check, typegen, docs, build, and deploy generator paths before releasegorsee create ships with canonical starters for each official mode:
frontend for browser-first prerendered appsbasic for the minimal canonical scaffoldsecure-saas for authenticated SaaS apps with protected route groupscontent-site for public content and marketing sitesagent-aware-ops for internal tools with AI-first workflows enabledworkspace-monorepo for workspace layouts with one app package and one shared packageserver-api for API-first and service-oriented server appsExamples:
bunx gorsee create my-frontend --template frontend
bunx gorsee create my-saas --template secure-saas
bunx gorsee create my-site --template content-site
bunx gorsee create my-ops --template agent-aware-ops
bunx gorsee create my-workspace --template workspace-monorepo
bunx gorsee create my-service --template server-api
npx create-gorsee my-app
npm create gorsee@latest my-app
| Command | Description |
|---|---|
gorsee create <name> [--template <name>] | Scaffold a new project from the canonical starter set |
gorsee dev | Start development server with HMR |
gorsee build | Build client and server output |
gorsee start | Start production runtime |
gorsee start --runtime node | Start the built Node production runtime entry |
gorsee worker | Run the canonical server-mode worker/service runtime entry |
gorsee check [--rewrite-imports] [--rewrite-loaders] | Type, structure, TSX contract, and safety audit, with optional canonical autofix |
gorsee routes | Show route table |
gorsee generate <entity> | Generate CRUD scaffold with typed routes, validated forms, and inferred `memory |
gorsee docs --format json --contracts | Emit machine-readable route/docs contract artifact |
gorsee upgrade | Upgrade to the latest published Gorsee version, rewrite obvious migration drift, write docs/upgrade-report.json, and run verification |
gorsee typegen | Generate typed routes |
gorsee migrate | Run database migrations |
gorsee deploy | Generate deploy config for supported targets, with `--runtime bun |
gorsee test | Run the framework-aware test command surface |
gorsee ai | AI bootstrap, diagnostics, checkpoints, context export, bridge, IDE sync, and MCP tooling |
Runtime debugging surface:
createRuntimeDevtoolsSnapshot() for a versioned inspector snapshot spanning router, hydration, and reactive diagnosticsrenderRuntimeDevtoolsHTML() / renderRuntimeDevtoolsOverlay() for a human-readable devtools view built from the same canonical artifactsMigration ergonomics:
gorsee check --rewrite-imports --rewrite-loaders can normalize obvious scoped-import and loader -> load drift before the audit runs.gorsee upgrade is the canonical end-to-end upgrade flow for installed apps.gorsee upgrade --check --report docs/upgrade-report.json is the dry-run migration audit flow when you want review before installation.AI bootstrap and handoff:
gorsee ai init scaffolds .gorsee/rules.md, GORSEE.md, and .gorsee/agent/checkpoints for repositories that enable AI workflows.gorsee ai checkpoint --mode inspect|propose|apply|operate records explicit operator checkpoints for mutating and non-mutating sessions.gorsee ai pack writes the latest grounded handoff bundle to .gorsee/agent/latest.{json,md} plus deploy/release/incident briefs.gorsee ai framework --format markdown remains the canonical cold-start packet for agents and operators.FAQs
AI-first reactive full-stack TypeScript framework for deterministic human and agent collaboration
We found that gorsee demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.