Apache-2.0

BlameJS

The Node framework that owns its stack.

Zero npm runtime dependencies. Post-quantum crypto from line zero. Sealed-by-default storage. Audit chain on every operator action.

Quick start View on GitHub
  • Zero npm deps
  • PQC by default
  • Sealed storage
  • Audit chain
  • Server-rendered

This site is the docs and a working reference app — every page you read renders through the framework's own primitives.

Quick start #

npm install @blamejs/core
node -e 'require("@blamejs/core").createApp({ dataDir: "./data" })'

Or browse the source layout of this very wiki for a full reference app:

var b = require("@blamejs/core");
var app = await b.createApp({
  dataDir: "./data",
  routes: function (router) {
    router.get("/", function (req, res) {
      b.render.htmlString(res, "<h1>Hello from blamejs</h1>");
    });
  },
});
await app.listen({ port: 3000 });

Concern groups #

Pick the area you're working on:

Welcome

Start here — what blamejs is, how to install, how to read this site.

Security defaults

Security defaults are not opt-in. CSRF / origin / bot-guard / sealed storage / audit chain — all wired into the request lifecycle, not behind config flags.

Envelope versioning

How crypto algorithms roll forward without breaking on-disk data. Versioned envelope, kid rotation, AAD-bound ciphertext.

Validation discipline

Three-tier policy: throw at config-time, drop-silent on hot paths, return defaults on request-shape reads.

Compliance postures

Union-of-bars strategy for HIPAA / PCI / GDPR / SOC 2 / DORA / NIS 2 / CRA. Strictest-wins by default.

Modernity posture

TLS 1.3 minimum, ML-KEM-1024 hybrid, SLH-DSA audit signatures, Argon2id passwords. No classical-only fallbacks.

API index

Every operator-facing primitive across all namespaces, alphabetical, deep-linked. Search via the sidebar (or `/`).

Error catalog

Every framework error class registered via b.frameworkError.defineClass — code, message shape, callsites.

Environment variables

Every BLAMEJS_* / WIKI_* env var the framework reads, with default + type schema, harvested from safeEnv.readVar calls.

Vendored dependencies

Every package vendored under lib/vendor/ — version, license, source URL, SHA-256, framework consumers.

CLI commands

Every blamejs CLI subcommand harvested from lib/cli.js — args, flags, exit codes, examples.

Content Credentials

C2PA 2.1 content provenance — sign assets with a manifest declaring origin, edits, AI involvement.

Model Context Protocol

Model Context Protocol server hardening — input validation, OAuth integration per RFC 9728, scope enforcement, audit emission.

Agent Orchestrator

The framework-level supervisor for every agent blamejs ships. Registry, sharded topics, leader-elected singletons, drain, and health probe — operators stop wiring these per-agent.

Mail

SMTP / HTTP-API email send with multipart RFC 5322 message composition, DKIM signing on the way out, and full inbound mail- authentication parsing on the way in.

Webhook

Outbound webhook delivery with cryptographic signing in a single `Webhook-Signature` header, retry + dead-letter via `b.retry`, and idempotency keys baked into the signed string so a captured signature cannot be replayed with a fresh id.

Compliance

Top-level compliance-posture coordinator — single source of truth for "what regulatory regime is this deployment running under?".

Crypto

The framework's PQC-first cryptography surface.

Vault

Sealed keystore that anchors every other framework subsystem holding secrets at rest: db field encryption, encrypted session storage, audit-log signing keys, OAuth refresh tokens, anything that flows through `b.vault.seal` / `b.vault.unseal`.

Db

Database core — SQLite (node:sqlite) wrapped in encrypted-at-rest storage, sealed-column field-level crypto, append-only audit-chain integration, declarative schema reconcile, and run-once migrations.

Session

Server-side session store with idle + absolute timeouts, encrypted at rest, sealed columns, audit on every login / logout, and cluster-aware leader gating.

Storage

Filesystem-and-cloud-backed object storage with sealed per-file encryption keys, classification routing, and residency enforcement.

Money

BigInt minor units + ISO 4217 catalog + largest-remainder allocation. Numbers refused at the boundary; FX conversion rounds half-to-even.

Guard All

Aggregate gate that dispatches to every registered b.guard* member by KIND.

Router

HTTP route registration + dispatch.

Mail Agent

Mailbox-access facade — RBAC + posture + audit + dispatch around a mail store, so a protocol server on top stays a thin shell. Read + mailbox-mutation + Sieve-upload methods are wired; compose/send and identity/vacation/MDN/export verbs compose the underlying primitive directly until a protocol server routes them through the agent.

Network

Framework network helpers — DNS-over-HTTPS dispatch, TLS configuration, OCSP/CT validation, NTP/NTS-KE bootstrap.

Audit

Tamper-evident, append-only record of every privileged action — the forensic surface every compliance posture (HIPAA / PCI-DSS / SOC 2 / GDPR / SOX / DORA) bottoms out on.

Log

Structured JSON application logger meant to be ingested by a log aggregator.

Testing

Operator-facing test helpers.

Backup

PQC-encrypted backup bundles — sealed columns + audit chain + keyring.

Cluster

Opt-in active/active leader election with fencing-tokenized writes.

Scheduler

Cron-style task scheduler with cluster leader gating, deduplicated ticks, drift correction, and an audit event on every tick.

CSV

RFC 4180 parser + serializer with operator-friendly defaults.

Time

Timezone-aware datetime helpers built on top of native `Intl.DateTimeFormat`.

UUID

RFC 4122 v4 (random) + RFC 9562 v7 (time-ordered).

Safe Json

Hardened JSON parse + stringify + schema validation.

Safe Schema

Declarative input validation with a Zod-shaped chained-method surface.

SQL Builder

Chainable SQL builder - every identifier quoted by construction, every value a bound placeholder, dialect-aware upsert.

Design tenets #

Special thanks #

blamejs vendors a small set of exceptional third-party libraries. Their work is the foundation the framework is built on — every cryptographic operation and passkey handshake in the framework runs through their code. All MIT-licensed; full attribution (including the framework's own Apache-2.0 @blamejs/pki toolkit that now backs b.mtlsCa) lives in NOTICE.