Apache-2.0

BlameJS

The Node framework that owns its stack.

Zero npm runtime dependencies. Post-quantum crypto from line zero. Sealed-by-default storage. Audit chain on every operator action.

Quick start View on GitHub
  • Zero npm deps
  • PQC by default
  • Sealed storage
  • Audit chain
  • Server-rendered

This site is the docs and a working reference app — every page you read renders through the framework's own primitives.

Quick start #

npm install @blamejs/core
node -e 'require("@blamejs/core").createApp({ dataDir: "./data" })'

Or browse the source layout of this very wiki for a full reference app:

var b = require("@blamejs/core");
var app = await b.createApp({
  dataDir: "./data",
  routes: function (router) {
    router.get("/", function (req, res) {
      b.render.htmlString(res, "<h1>Hello from blamejs</h1>");
    });
  },
});
await app.listen({ port: 3000 });

Concern groups #

Pick the area you're working on:

Welcome

Start here — what blamejs is, how to install, how to read this site.

Security defaults

Security defaults are not opt-in. CSRF / origin / bot-guard / sealed storage / audit chain — all wired into the request lifecycle, not behind config flags.

Envelope versioning

How crypto algorithms roll forward without breaking on-disk data. Versioned envelope, kid rotation, AAD-bound ciphertext.

Validation discipline

Three-tier policy: throw at config-time, drop-silent on hot paths, return defaults on request-shape reads.

Compliance postures

Union-of-bars strategy for HIPAA / PCI / GDPR / SOC 2 / DORA / NIS 2 / CRA. Strictest-wins by default.

Modernity posture

TLS 1.3 minimum, ML-KEM-1024 hybrid, SLH-DSA audit signatures, Argon2id passwords. No classical-only fallbacks.

API index

Every operator-facing primitive across all namespaces, alphabetical, deep-linked. Search via the sidebar (or `/`).

Error catalog

Every framework error class registered via b.frameworkError.defineClass — code, message shape, callsites.

Environment variables

Every BLAMEJS_* / WIKI_* env var the framework reads, with default + type schema, harvested from safeEnv.readVar calls.

Vendored dependencies

Every package vendored under lib/vendor/ — version, license, source URL, SHA-256, framework consumers.

CLI commands

Every blamejs CLI subcommand harvested from lib/cli.js — args, flags, exit codes, examples.

Content Credentials

C2PA 2.1 content provenance — sign assets with a manifest declaring origin, edits, AI involvement.

Model Context Protocol

Model Context Protocol server hardening — input validation, OAuth integration per RFC 9728, scope enforcement, audit emission.

Agent Orchestrator

The framework-level supervisor for every agent blamejs ships. Registry, sharded topics, leader-elected singletons, drain, and health probe — operators stop wiring these per-agent.

Mail

SMTP / HTTP-API email send with multipart RFC 5322 message composition, DKIM signing on the way out, and full inbound mail- authentication parsing on the way in.

Webhook

Outbound webhook delivery with cryptographic signing in a single `Webhook-Signature` header, retry + dead-letter via `b.retry`, and idempotency keys baked into the signed string so a captured signature cannot be replayed with a fresh id.

Compliance

Top-level compliance-posture coordinator — single source of truth for "what regulatory regime is this deployment running under?".

Crypto

The framework's PQC-first cryptography surface.

Vault

Sealed keystore that anchors every other framework subsystem holding secrets at rest: db field encryption, encrypted session storage, audit-log signing keys, OAuth refresh tokens, anything that flows through `b.vault.seal` / `b.vault.unseal`.

Db

Database core — SQLite (node:sqlite) wrapped in encrypted-at-rest storage, sealed-column field-level crypto, append-only audit-chain integration, declarative schema reconcile, and run-once migrations.

Session

Server-side session store with idle + absolute timeouts, encrypted at rest, sealed columns, audit on every login / logout, and cluster-aware leader gating.

Storage

Filesystem-and-cloud-backed object storage with sealed per-file encryption keys, classification routing, and residency enforcement.

Money

BigInt minor units + ISO 4217 catalog + largest-remainder allocation. Numbers refused at the boundary; FX conversion rounds half-to-even.

Guard All

Aggregate gate that dispatches to every registered b.guard* member by KIND.

Router

HTTP route registration + dispatch.

Static Serve

A static-file handler that confines every request to its root, gates the bytes through the guard family before sending them, and answers caching validators, byte ranges and SRI digests from one cache.

Mail Agent

Mailbox-access facade — RBAC + posture + audit + dispatch around a mail store, so a protocol server on top stays a thin shell. Read + mailbox-mutation + Sieve-upload methods are wired; compose/send and identity/vacation/MDN/export verbs compose the underlying primitive directly until a protocol server routes them through the agent.

Network

Framework network helpers — DNS-over-HTTPS dispatch, TLS configuration, OCSP/CT validation, NTP/NTS-KE bootstrap.

Audit

Tamper-evident, append-only record of every privileged action — the forensic surface every compliance posture (HIPAA / PCI-DSS / SOC 2 / GDPR / SOX / DORA) bottoms out on.

Log

Structured JSON application logger meant to be ingested by a log aggregator.

Testing

Operator-facing test helpers.

Backup

PQC-encrypted backup bundles — sealed columns + audit chain + keyring.

Cluster

Opt-in active/active leader election with fencing-tokenized writes.

Create App

One call opens the vault and the database, builds a router with the security middleware already installed, and hands back `listen`, `address` and a phase-ordered `shutdown`.

Scheduler

Cron-style task scheduler with cluster leader gating, deduplicated ticks, drift correction, and an audit event on every tick.

CSV

RFC 4180 parser + serializer with operator-friendly defaults.

Time

Timezone-aware datetime helpers built on top of native `Intl.DateTimeFormat`.

UUID

RFC 9562 v4 (random) + v7 (time-ordered).

Safe Json

Hardened JSON parse + stringify + schema validation.

Safe Schema

Declarative input validation with a Zod-shaped chained-method surface.

SQL Builder

Chainable SQL builder - every identifier quoted by construction, every value a bound placeholder, dialect-aware upsert.

Design tenets #

Special thanks #

blamejs vendors a small set of exceptional third-party libraries. Their work is the foundation the framework is built on — every cryptographic operation and passkey handshake in the framework runs through their code. Full attribution (including the framework's own Apache-2.0 @blamejs/pki toolkit, which backs both b.mtlsCa and the passkey verification in b.auth.passkey) lives in NOTICE.