CLI commands

Operator commands shipped under the blamejs binary (bin/blamejs.js, dispatched through b.cli.main). Each subcommand is harvested directly from lib/cli.js so the page stays in lock-step with the dispatcher.

Commands harvested: 17. Run blamejs help <command> for the authoritative live usage. Generated 2026-08-08T16:39:16.007Z.

Command index

Database

blamejs migrate — Manage database migrations (up / down / status)
blamejs seed — Apply seed-data fixtures by env (run / status)

Data lifecycle

blamejs backup — Inspect / verify / extract a backup bundle from disk
blamejs erase — Cryptographically erase a single row's sealed columns (GDPR Art. 17)
blamejs restore — Live in-place restore from a bundle (list / inspect / apply / rollback / list-rollbacks)
blamejs retention — Run / preview an ad-hoc b.retention rule

Audit chain

blamejs audit — Operator tooling on top of the audit chain (archive / export / verify / purge)

Crypto & keys

blamejs api-key — Issue / revoke / list / rotate / verify API keys for a namespace
blamejs mtls — Inspect or generate the in-box mTLS CA + leaf certs (status / show-cert / init / issue / issue-p12)
blamejs password — Test b.auth.password.policy against a candidate plaintext
blamejs vault — Seal / unseal / rotate the on-disk vault keypair (plaintext ↔ wrapped)

Security tooling

blamejs config-drift — Inspect / verify the b.configDrift signed sidecar
blamejs file-type — Magic-byte content classification (b.fileType.detect)
blamejs security — Run b.security.assertProduction against the live framework

Developer workflow

blamejs api-snapshot — Capture / compare the public API surface (CI gate)
blamejs dev — Run an app with file-watch + auto-restart
blamejs version — Print framework version

blamejs migrate

Manage database migrations (up / down / status)

Usage: blamejs migrate <subcommand> [flags]

Subcommands

Subcommand	Description
`up`	Apply all pending migrations
`down`	Roll back the most-recent applied migration
`status`	Print applied + pending migrations

Flags

Flag	Description
`--db <path>`	Path to the SQLite database file (required)
`--dir <path>`	Path to migrations directory (default ./migrations)
`--steps <N>`	For down: number of migrations to revert (default 1)

Example

blamejs migrate up --db <path>

Source: lib/cli.js

blamejs seed

Apply seed-data fixtures by env (run / status)

Usage: blamejs seed <subcommand> [flags]

Subcommands

Subcommand	Description
`run`	Apply pending seeds for the given env
`status`	Print applied + pending seeds for the given env

Flags

Flag	Description
`--db <path>`	Path to the SQLite database file [required]
`--env <name>`	Environment to seed (dev / test / prod / ...) [required]
`--dir <path>`	Path to seeders directory (default ./seeders)
`--only <name>`	Apply just one seed by filename (run subcommand only)
`--force`	Re-apply already-applied seeds (operator-explicit)

Example

blamejs seed run --db <path>

Source: lib/cli.js

blamejs backup

Inspect / verify / extract a backup bundle from disk

Usage: blamejs backup <subcommand> [flags]

Subcommands

Subcommand	Description
`inspect`	Read a bundle's manifest without decrypting and
`verify`	Decrypt + verify the bundle in a temp directory,
`extract`	Decrypt + verify into the target staging directory.

Flags

Flag	Description
`--bundle <dir>`	Path to a bundle directory (must contain manifest.json)
`--to <stagingDir>`	For extract — fresh directory to decrypt into (must not exist)
`--passphrase <string>`	Backup passphrase (or env BLAMEJS_BACKUP_PASSPHRASE)

Example

blamejs backup inspect --bundle <dir>

Source: lib/cli.js

blamejs erase

Cryptographically erase a single row's sealed columns (GDPR Art. 17)

Cryptographic-erasure of a single row. The right tool for one-off GDPR Art. 17 / right-to-erasure flows that don't fit the periodic retention sweep. Replaces every sealed column + derived hash with NULL, sets __erasedAt, and writes the row back. Cleartext is unrecoverable even with the vault key.

Usage: blamejs erase --table <table> --row-id <id> [flags]

Flags

Flag	Description
`--data-dir <path>`	Required
`--table <name>`	Required — the table containing the row
`--row-id <id>`	Required — the _id of the row to erase
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped)
`--reason <text>`	Reason recorded on the audit row (recommended)
`--confirm`	Required — confirms the erase is intentional

Example

blamejs erase --table <table> --row-id <id>

Source: lib/cli.js

blamejs restore

Live in-place restore from a bundle (list / inspect / apply / rollback / list-rollbacks)

Operator workflow on top of b.restore: list bundles in storage, inspect a specific one, do a live in-place restore (with rollback preservation), and roll back to a previous restore point. Wraps the restore primitive's run / inspect / list / rollback / list-rollbacks surface; uses b.backup.diskStorage as the storage adapter (the same adapter that wrote the bundles).

Usage: blamejs restore <subcommand> [flags]

Subcommands

Subcommand	Description
`list`	List bundles available in storage
`inspect`	Read a bundle manifest summary (no live changes)
`apply`	Live in-place restore with rollback preserved
`rollback`	Revert the most-recent (or named) restore
`list-rollbacks`	List preserved rollback points

Common flags

Flag	Description
`--data-dir <path>`	Live data directory (apply / rollback / list-rollbacks)
`--storage-root <path>`	Directory containing bundle subdirs (list)
`--bundle <dir>`	Extracted bundle directory (inspect / apply)
`--bundle-id <id>`	Alternative: pass id with --storage-root
`--passphrase <string>`	Bundle passphrase (or env BLAMEJS_BACKUP_PASSPHRASE)

apply flags

Flag	Description
`--no-audit`	Suppress audit emission (default ON)

rollback flags

Flag	Description
`--rollback <pathOrId>`	Specific rollback point to restore (default: most recent)

Exit codes

0 success
1 operation failed
2 bad invocation

Example

blamejs restore list --data-dir <path>

Source: lib/cli.js

blamejs retention

Run / preview an ad-hoc b.retention rule

Run / preview an ad-hoc retention rule from the CLI. Operators supply the rule shape on the command line — table + ageField + ttlMs + action — for one-off cleanups outside the scheduler- driven sweep wired in lib code.

Usage: blamejs retention <subcommand> [flags]

Subcommands

Subcommand	Description
`preview`	Dry-run: report what WOULD be processed without acting
`run`	Run the rule once (acts on the rows it finds)

Example

blamejs retention preview

Source: lib/cli.js

blamejs audit

Operator tooling on top of the audit chain (archive / export / verify / purge)

Operator tooling on top of the audit chain. Programmatic API is at b.auditTools — the CLI is a thin wrapper that's easier to script against from operator runbooks (cron, retention pipelines, etc.).

Usage: blamejs audit <subcommand> [flags]

Subcommands

Subcommand	Description
`archive`	Bundle audit rows older than --before into a verified archive
`export`	Auditor evidence bundle for a date range
`verify-bundle`	Round-trip integrity check on an archive or export bundle
`verify-chain`	Walk the live audit chain end-to-end; reports tampering
`purge`	Delete live rows already captured in a verified archive

Common flags

Flag	Description
`--out <path>`	Output bundle directory (must NOT exist)
`--in <path>`	Input bundle directory (verify-bundle, purge)
`--passphrase <string>`	Bundle passphrase (or env BLAMEJS_AUDIT_PASSPHRASE)

archive flags

Flag	Description
`--before <date>`	Archive rows with recordedAt < this date (ISO-8601 or epoch ms)

export flags

Flag	Description
`--from <date>`	Earliest recordedAt (inclusive)
`--to <date>`	Latest recordedAt (inclusive)
`--action <name>`	Restrict to a single audit action

verify-chain flags

Flag	Description
`--db <path>`	SQLite database path (required)
`--table <name>`	Audit table name (default audit_log)
`--max-rows <N>`	Stop after walking N rows (default: walk all)

purge flags

Flag	Description
`--confirm`	REQUIRED — operator acknowledgement of destructive op

Exit codes

0 success (or chain verified ok)
1 operation failed (or chain tampered)
2 bad invocation

Example

blamejs audit archive --before <date>

Source: lib/cli.js

blamejs api-key

Issue / revoke / list / rotate / verify API keys for a namespace

Usage: blamejs api-key <subcommand> [flags]

Subcommands

Subcommand	Description
`issue`	Issue a new API key under a namespace. Prints the
`revoke`	Revoke an issued key by its composite id (namespace:idHex).
`list`	List active keys for a given owner under a namespace.
`rotate`	Issue a new secret for an existing id while leaving the
`verify`	Verify a token string and print the resolved metadata.

Example

blamejs api-key issue

Source: lib/cli.js

blamejs mtls

Inspect or generate the in-box mTLS CA + leaf certs (status / show-cert / init / issue / issue-p12)

Usage: blamejs mtls <subcommand> [flags]

Subcommands

Subcommand	Description
`status`	Print CA state — exists / generation / sealed-mode.
`show-cert`	Print the CA certificate PEM to stdout. Operators
`init`	Generate a fresh CA keypair + self-signed cert and
`issue`	Issue a leaf client certificate signed by the CA.
`issue-p12`	Issue + package as PKCS#12 with --password. Useful for

Flags

Flag	Description
`--data-dir <path>`	Path to the app's data dir (required)
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped). When wrapped,
`--sealed-mode <mode>`	auto \| required \| disabled (default auto). 'required'

Example

blamejs mtls status --data-dir <path>

Source: lib/cli.js

blamejs password

Test b.auth.password.policy against a candidate plaintext

Test b.auth.password.policy from the CLI without rebooting the app. Useful for ops dashboards that want to surface "your policy requires X" or for CI checks of operator-supplied passwords.

Usage: blamejs password check [flags]

Flags

Flag	Description
`--plaintext <s>`	REQUIRED — the plaintext to test (or use stdin)
`--stdin`	Read the plaintext from stdin (newline-trimmed)
`--profile <name>`	Named profile: nist-aal2 \| pci-4.0 \| hipaa-aal2
`--min-length <n>`	Override the profile minLength
`--max-length <n>`	Override the profile maxLength
`--breach-check`	Enable HaveIBeenPwned k-anonymity check (NETWORK)
`--fail-closed`	With --breach-check: HIBP outage → fail (default ok)
`--email <addr>`	Context for the deny-context-substrings check
`--username <name>`	Context for the deny-context-substrings check
`--json`	Print machine-readable JSON

Example

blamejs password check

Source: lib/cli.js

blamejs vault

Seal / unseal / rotate the on-disk vault keypair (plaintext ↔ wrapped)

Usage: blamejs vault <subcommand> [flags]

Subcommands

Subcommand	Description
`status`	Report whether vault.key (plaintext) and/or
`seal`	Wrap a plaintext vault.key into a passphrase-
`unseal`	Reverse — write a plaintext vault.key from a
`rotate`	Re-wrap a sealed vault.key.sealed under a new

Flags

Flag	Description
`--data-dir <path>`	Path to the app's data dir (default ./data)
`--passphrase <string>`	Passphrase to wrap with (or env
`--new-passphrase <s>`	Rotate-only — the NEW passphrase to re-wrap
`--keep-plaintext`	For `seal` — retain the plaintext vault.key

Example

blamejs vault status --data-dir <path>

Source: lib/cli.js

blamejs config-drift

Inspect / verify the b.configDrift signed sidecar

Inspect / verify the b.configDrift sidecar without rebooting. The sidecar is signed with the audit-signing key, so we boot the framework to access it. `inspect` prints the full snapshot; `verify` only reports the verified flag (exit 0 = signed + untampered, exit 1 = tampered or missing).

Usage: blamejs config-drift <subcommand> [flags]

Subcommands

Subcommand	Description
`inspect`	Print the sidecar's snapshot + capturedAt + verified flag
`verify`	Verify the sidecar's signature (exit code reflects status)

Flags

Flag	Description
`--data-dir <path>`	Required (sidecar location)
`--baseline <name>`	Multi-baseline name (default: "default")
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped)
`--json`	inspect: print machine-readable JSON

Example

blamejs config-drift inspect --data-dir <path>

Source: lib/cli.js

blamejs file-type

Magic-byte content classification (b.fileType.detect)

Pure utility — magic-byte content classification. No framework boot. Useful for upload debugging ("the user said this was a PDF but is it really?") and as a CI-side sanity check.

Usage: blamejs file-type detect <file> [flags]

Flags

Flag	Description
`--json`	Print machine-readable JSON
`--allowlist <list>`	Comma-separated mime / category list — exits 1

Example

blamejs file-type detect <file>

Source: lib/cli.js

blamejs security

Run b.security.assertProduction against the live framework

Runs b.security.assertProduction against the live framework. Useful out-of-band: ops can re-check posture without rebooting the app. Boots the framework so resolvers see the actual vault / db / audit- signing modes; reports pass / fail with the failure-code list.

Usage: blamejs security <subcommand> [flags]

Subcommands

Subcommand	Description
`assert`	Run b.security.assertProduction against the framework's

Flags

Flag	Description
`--data-dir <path>`	Required for `assert` (the boot dir)
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped)
`--no-ntp-strict`	Skip the BLAMEJS_NTP_STRICT check
`--require-env <KEY,KEY,...>`	Comma-separated env vars that MUST be set
`--forbid-env <KEY,KEY,...>`	Comma-separated env vars that must NOT be set
`--no-vault`	Skip vault posture check
`--no-db-at-rest`	Skip dbAtRest posture check
`--no-audit-signing`	Skip auditSigning posture check

Example

blamejs security assert --data-dir <path>

Source: lib/cli.js

blamejs api-snapshot

Capture / compare the public API surface (CI gate)

Usage: blamejs api-snapshot <subcommand> [flags]

Subcommands

Subcommand	Description
`capture`	Walk the framework's public surface and write a snapshot
`compare`	Diff the current surface against a saved snapshot

Flags

Flag	Description
`--file <path>`	Snapshot file path (default ./api-snapshot.json)
`--module <path>`	Module to inspect (default require('@blamejs/core'))

Exit codes

0 no changes (compare) or write succeeded (capture)
1 breaking changes detected (compare)
2 bad invocation

Example

blamejs api-snapshot capture --file <path>

Source: lib/cli.js

blamejs dev

Run an app with file-watch + auto-restart

Usage: blamejs dev --command <cmd> [args] [flags]

Flags

Flag	Description
`--command <cmd>`	Program to spawn (e.g. node) [required]
`--arg <value>`	Argument for the spawned program (repeatable)
`--watch <dir>`	Directory to watch (repeatable; default '.')
`--ignore <pattern>`	Glob/regex fragment to ignore (repeatable)
`--grace-ms <N>`	Debounce window in ms (default 250)
`--kill-signal <S>`	Signal to send on restart (default SIGTERM)

Example

blamejs dev --command <cmd> [args]

Source: lib/cli.js

blamejs version

Print framework version

Usage: blamejs version

Example

blamejs version

Source: lib/cli.js

Live help

This page is a build-time snapshot. The authoritative source is blamejs help <command> (or blamejs <command> --help) — both render the same USAGE constants this harvester reads.

Last updated 2026-08-08T16:39:49.652Z by seeder.