Validation discipline

Different layers of the framework treat bad input differently — on purpose. A boot-time misconfiguration must crash the process; a hot-path observability sink must drop silent rather than crash the request that triggered it; a defensive request-shape reader must return a sensible default. blamejs picks one of three behaviors per primitive and documents the choice.

Config-time / entry-point: throw #

Primitives that receive operator input at boot or app construction throw a TypeError on bad input. The operator catches the typo at deploy time, never at request time. Examples: b.constants.TIME.minutes(n), b.protocolDispatcher.create(opts), b.frameworkError.defineClass(opts).

Hot-path observability sinks: drop silent #

Primitives that emit on every request — audit, observability, metrics — must never crash the request that triggered them. They wrap their internal validation in try/catch and drop the bad call silently. Each is marked "drop-silent — by design" in its docstring. Operators who need to surface drops set BLAMEJS_OBSERVABILITY_STRICT=1 to promote drops to errors.

Request-shape readers: return defaults #

Primitives that read per-request shape (route, headers, query) return a defaulted sensible value rather than throwing on missing or garbage input. A request with no Origin header must still resolve *some* answer; throwing here means a request crash for a header the client legitimately omitted.

Picking consciously #

Every new primitive picks one tier and documents it. The choice surfaces in the source comment + the JSDoc + the wiki page. Default-by-accident is the bug class this discipline closes.

Last updated 2026-08-08T16:39:49.652Z by seeder.