
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
PrabsStack - Original fullstack framework with deterministic flow primitives
A revolutionary primitive-driven, deterministic architecture framework for building scalable, type-safe, and observable full-stack applications.
PrabsStack is a full-stack TypeScript framework built around seven composable primitives that enforce strict separation of concerns and deterministic execution flows. Unlike traditional frameworks, PrabsStack provides a structured, auditable path from request to response through a 9-stage pipeline, making complex applications easier to reason about, test, and maintain.
# Install globally (recommended)
npm install -g prabsstack
# Create new project
prabs create my-app
cd my-app
# Install dependencies
npm install
# Start development servers
prabs dev
Your application is now running:
npx prabsstack create my-app
cd my-app
npm install
prabs dev
PrabsStack's architecture is built on seven composable primitives:
Immutable, versioned contracts defining request/response boundaries with full schema validation.
export const todoCreatePulse = definePulse({
pulseId: 'todo.create',
version: '1.0.0',
description: 'Create a new todo item',
input: TodoCreateInput,
output: TodoCreateOutput,
});
Registry-based HTTP routing that connects Pulses to handlers with type safety.
conduitRegistry.register(
createHttpBinding('/api/todos', 'POST', todoCreatePulse, todoCreateWeave, {
cors: defaultCors,
contentType: defaultContentTypes,
})
);
Pure functions containing business logic with deterministic execution and automatic audit trails.
export const todoCreateWeave = defineWeave<TodoCreateInput, TodoCreateOutput>({
id: 'todo.create',
version: '1.0.0',
execute: async (input, context) => {
const todo = await createTodo(input);
return { id: todo.id, createdAt: todo.createdAt };
},
});
A 9-stage pipeline orchestrating request processing with hooks at each stage:
Declarative security policies for authentication, authorization, rate limiting, and more.
const guardrails = buildGuardrails({
jwt: { secret: process.env.JWT_SECRET!, algorithms: ['HS256'] },
rateLimit: { windowMs: 60000, max: 100 },
cors: { origins: ['http://localhost:5173'] },
});
Type-safe, auto-generated client libraries from Pulse contracts.
const client = createGlyphClient(todoCreatePulse, transport);
const result = await client.call({ title: 'New todo', description: 'Details' });
Observable state atoms for reactive data flows in frontend and mobile applications.
const title = createOrbit('');
const asyncState = createOrbitAsync<TodoRecord | null>(null);
title.subscribe((value) => console.log('Title changed:', value));
await asyncState.execute(fetchTodoData());
prabs create, prabs dev, prabs build, prabs glyphmy-app/
├── backend/
│ └── src/
│ ├── bootstrap.ts # Server initialization
│ ├── domains/ # Feature modules
│ ├── handlers/ # Request handlers
│ ├── logic/ # Business logic (Weaves)
│ ├── guardrails/ # Security policies
│ └── services/ # Database, external APIs
├── frontend/
│ └── src/
│ ├── main.tsx # React entry point
│ ├── components/ # UI components
│ ├── orchestrators/ # Business logic coordination
│ ├── hooks/ # React hooks (useOrbit)
│ └── views/ # Page components
├── mobile/
│ └── src/
│ ├── app.tsx # React Native entry
│ ├── screens/ # Mobile screens
│ ├── orchestrators/ # Business logic
│ └── widgets/ # Reusable components
├── shared/
│ ├── contracts/ # Pulse definitions
│ ├── codecs/ # Data transformations
│ ├── schemas/ # Validation schemas
│ ├── policies/ # RBAC policies
│ └── transport/ # HTTP/WS config
└── prabs.config.ts # Framework configuration
prabs create <app-name> # Create new project
prabs dev [target] # Start development servers
# Targets: backend, frontend, mobile, all
prabs build # Build for production
prabs glyph # Generate typed clients from Pulses
prabs pulse:check # Validate contracts, detect drift
prabs guard # Security audit and linting
export default {
name: 'my-app',
version: '1.0.0',
targets: {
backend: { port: 3000, tls: { enabled: false }, dist: './dist/backend' },
frontend: { port: 5173, dist: './dist/frontend' },
mobile: { port: 19006, dist: './dist/mobile' },
},
env: {
secrets: ['JWT_SECRET', 'DATABASE_URL'],
maps: {
backend: ['JWT_SECRET', 'DATABASE_URL'],
frontend: [],
mobile: [],
},
},
};
# Server
PORT=3000
HOST=0.0.0.0
NODE_ENV=development
# Database (choose one)
DATABASE_TYPE=memory
# DATABASE_URL=postgresql://user:pass@localhost:5432/db
# SUPABASE_URL=https://xxx.supabase.co
# SUPABASE_API_KEY=xxx
# Security
JWT_SECRET=your-secret-key-here
API_KEY=your-api-key-here
# Logging
LOG_LEVEL=info
AUDIT_SINK=console
import { definePulse } from 'prabsstack/pulse';
import { UserCreateInput, UserCreateOutput } from '../codecs/user.js';
export const userCreatePulse = definePulse({
pulseId: 'user.create',
version: '1.0.0',
description: 'Create a new user',
input: UserCreateInput,
output: UserCreateOutput,
policies: ['authenticated', 'admin'],
});
import { defineWeave } from 'prabsstack/weave';
export const userCreateWeave = defineWeave({
id: 'user.create',
version: '1.0.0',
execute: async (input, context) => {
const hashedPassword = await hashPassword(input.password);
const user = await db.users.create({
email: input.email,
password: hashedPassword,
name: input.name,
});
context.logger.info('User created', { userId: user.id });
return { id: user.id, email: user.email };
},
});
conduitRegistry.register(
createHttpBinding('/api/users', 'POST', userCreatePulse, userCreateWeave, {
cors: defaultCors,
contentType: defaultContentTypes,
})
);
import { createGlyphClient, FetchGlyphTransport } from 'prabsstack/glyph';
import { userCreatePulse } from 'shared/contracts/user.js';
const transport = new FetchGlyphTransport('http://localhost:3000');
const client = createGlyphClient(userCreatePulse, transport);
export async function createUser(data: UserCreateInput) {
const result = await client.call(data, {
idempotencyKey: crypto.randomUUID()
});
if (result.success) {
return result.data;
}
throw new Error(result.error?.hint || 'Failed to create user');
}
import { test } from 'node:test';
import { createTestHarness } from 'prabsstack/testing';
import { userCreatePulse } from './contracts/user.js';
test('creates user successfully', async () => {
const harness = createTestHarness(userCreatePulse, userCreateWeave);
const result = await harness.execute({
email: 'test@example.com',
password: 'SecurePass123!',
name: 'Test User',
});
assert.ok(result.success);
assert.equal(result.data.email, 'test@example.com');
});
prabs build
# Set production environment
export NODE_ENV=production
export DATABASE_URL=postgresql://...
export JWT_SECRET=$(openssl rand -base64 32)
# Start server
node dist/backend/bootstrap.js
FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --production
COPY dist ./dist
COPY prabs.config.ts ./
EXPOSE 3000
CMD ["node", "dist/backend/bootstrap.js"]
We welcome contributions! Please see our contributing guidelines for:
MIT © PrabsStack Team
Built with ❤️ by developers, for developers.
Start building deterministic, observable, and secure applications today with PrabsStack.
FAQs
PrabsStack - Original fullstack framework with deterministic flow primitives
We found that prabsstack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.