CLI commands

Operator commands shipped under the blamejs binary (bin/blamejs.js, dispatched through b.cli.main). Each subcommand is harvested directly from lib/cli.js so the page stays in lock-step with the dispatcher.

Commands harvested: 17. Run blamejs help <command> for the authoritative live usage. Generated 2026-10-12T14:21:52.831Z.

Command index

Database

blamejs migrate — Manage database migrations (up / down / status)
blamejs seed — Apply seed-data fixtures by env (run / status)

Data lifecycle

blamejs backup — Inspect / verify / extract a backup bundle from disk
blamejs erase — Cryptographically erase a single row's sealed columns (GDPR Art. 17)
blamejs restore — Live in-place restore from a bundle (list / inspect / apply / rollback / list-rollbacks)
blamejs retention — Run / preview an ad-hoc b.retention rule

Audit chain

blamejs audit — Operator tooling on top of the audit chain (archive / export / verify / purge)

Crypto & keys

blamejs api-key — Issue / revoke / list / rotate / verify API keys for a namespace
blamejs mtls — Inspect or generate the in-box mTLS CA + leaf certs (status / show-cert / init / issue / issue-p12)
blamejs password — Test b.auth.password.policy against a candidate plaintext
blamejs vault — Seal / unseal / rotate the on-disk vault keypair (plaintext ↔ wrapped)

Security tooling

blamejs config-drift — Inspect / verify the b.configDrift signed sidecar
blamejs file-type — Magic-byte content classification (b.fileType.detect)
blamejs security — Run b.security.assertProduction against the live framework

Developer workflow

blamejs api-snapshot — Capture / compare the public API surface (CI gate)
blamejs dev — Run an app with file-watch + auto-restart
blamejs version — Print framework version

blamejs migrate

Manage database migrations (up / down / status)

Usage: blamejs migrate <subcommand> [flags]

Subcommands

Subcommand	Description
`up`	Apply all pending migrations
`down`	Roll back the most-recent applied migration
`status`	Print applied + pending migrations

Flags

Flag	Description
`--db <path>`	Path to the SQLite database file (required)
`--dir <path>`	Path to migrations directory (default ./migrations)
`--steps <N>`	For down: number of migrations to revert (default 1)

Example

blamejs migrate up --db <path>

Source: lib/cli.js

blamejs seed

Apply seed-data fixtures by env (run / status)

Usage: blamejs seed <subcommand> [flags]

Subcommands

Subcommand	Description
`run`	Apply pending seeds for the given env
`status`	Print applied + pending seeds for the given env

Flags

Flag	Description
`--db <path>`	Path to the SQLite database file [required]
`--env <name>`	Environment to seed (dev / test / prod / ...) [required]
`--dir <path>`	Path to seeders directory (default ./seeders)
`--only <name>`	Apply just one seed by filename (run subcommand only)
`--force`	Re-apply already-applied seeds (operator-explicit)

Example

blamejs seed run --db <path>

Source: lib/cli.js

blamejs backup

Inspect / verify / extract a backup bundle from disk

Usage: blamejs backup <subcommand> [flags]

Subcommands

Subcommand	Description
`inspect`	Read a bundle's manifest without decrypting and
`verify`	Decrypt + verify the bundle in a temp directory,
`extract`	Decrypt + verify into the target staging directory.

Flags

Flag	Description
`--bundle <dir>`	Path to a bundle directory (must contain manifest.json)
`--to <stagingDir>`	For extract — fresh directory to decrypt into (must not exist)
`--passphrase <string>`	Backup passphrase (or env BLAMEJS_BACKUP_PASSPHRASE)
`--expected-fingerprint <hex>`	Trust a manifest signature only from the audit-sign key
`--require-signature`	Refuse a bundle whose manifest is not signed
`--no-verify-signature`	Decrypt without checking the manifest signature

Example

blamejs backup inspect --bundle <dir>

Source: lib/cli.js

blamejs erase

Cryptographically erase a single row's sealed columns (GDPR Art. 17)

Usage: blamejs erase --table <table> --row-id <id> [flags]

Flags

Flag	Description
`--data-dir <path>`	Required
`--table <name>`	Required — the table containing the row
`--row-id <id>`	Required — the _id of the row to erase
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped)
`--reason <text>`	Reason recorded on the audit row (recommended)
`--confirm`	Required — confirms the erase is intentional

Example

blamejs erase --table <table> --row-id <id>

Source: lib/cli.js

blamejs restore

Live in-place restore from a bundle (list / inspect / apply / rollback / list-rollbacks)

Usage: blamejs restore <subcommand> [flags]

Subcommands

Subcommand	Description
`list`	List bundles available in storage
`inspect`	Read a bundle manifest summary (no live changes)
`apply`	Live in-place restore with rollback preserved
`rollback`	Revert the most-recent (or named) restore
`list-rollbacks`	List preserved rollback points

Common flags

Flag	Description
`--data-dir <path>`	Live data directory (apply / rollback / list-rollbacks)
`--storage-root <path>`	Directory containing bundle subdirs (list)
`--bundle <dir>`	Extracted bundle directory (inspect / apply)
`--bundle-id <id>`	Alternative: pass id with --storage-root
`--passphrase <string>`	Bundle passphrase (or env BLAMEJS_BACKUP_PASSPHRASE)

apply flags

Flag	Description
`--no-audit`	Suppress audit emission (default ON)
`--staging-root <path>`	Directory for the pulled and decrypted bundle; must be on the
`--expected-fingerprint <hex>`	Trust a manifest signature only from the audit-sign key
`--require-signature`	Refuse a bundle whose manifest is not signed
`--no-verify-signature`	Restore without checking the manifest signature

rollback flags

Flag	Description
`--rollback <pathOrId>`	Specific rollback point to restore (default: most recent)

Exit codes

0 success
1 operation failed
2 bad invocation

Example

blamejs restore list --data-dir <path>

Source: lib/cli.js

blamejs retention

Run / preview an ad-hoc b.retention rule

Usage: blamejs retention <subcommand> [flags]

Subcommands

Subcommand	Description
`preview`	Dry-run: report what WOULD be processed without acting
`run`	Run the rule once (acts on the rows it finds)

Example

blamejs retention preview

Source: lib/cli.js

blamejs audit

Operator tooling on top of the audit chain (archive / export / verify / purge)

Usage: blamejs audit <subcommand> [flags]

Subcommands

Subcommand	Description
`archive`	Bundle audit rows older than --before into a verified archive
`export`	Auditor evidence bundle for a date range
`verify-bundle`	Round-trip integrity check on an archive or export bundle
`verify-chain`	Walk the live audit chain end-to-end; reports tampering
`purge`	Delete live rows already captured in a verified archive

Common flags

Flag	Description
`--out <path>`	Output bundle directory (must NOT exist)
`--in <path>`	Input bundle directory (verify-bundle, purge)
`--passphrase <string>`	Bundle passphrase (or env BLAMEJS_AUDIT_PASSPHRASE)

archive flags

Flag	Description
`--before <date>`	Archive rows with recordedAt < this date (ISO-8601 or epoch ms)

export flags

Flag	Description
`--from <date>`	Earliest recordedAt (inclusive)
`--to <date>`	Latest recordedAt (inclusive)
`--action <name>`	Restrict to a single audit action

verify-chain flags

Flag	Description
`--db <path>`	SQLite database path (required)
`--table <name>`	Audit table name (default audit_log)
`--max-rows <N>`	Stop after walking N rows (default: walk all)
`--public-key <path>`	Audit-signing public key (PEM), to check the purge
`--archive-dir <path>`	Directory holding archive bundles. The anchor names

purge flags

Flag	Description
`--confirm`	REQUIRED — operator acknowledgement of destructive op

Exit codes

0 success (or chain verified ok)
1 operation failed (or chain tampered)
2 bad invocation
3 verify-chain could not check the purge anchor (no signing key available)

Example

blamejs audit archive --before <date>

Source: lib/cli.js

blamejs api-key

Issue / revoke / list / rotate / verify API keys for a namespace

Usage: blamejs api-key <subcommand> [flags]

Subcommands

Subcommand	Description
`issue`	Issue a new API key under a namespace. Prints the
`revoke`	Revoke an issued key by its composite id (namespace:idHex).
`list`	List active keys for a given owner under a namespace.
`rotate`	Issue a new secret for an existing id while leaving the
`verify`	Verify a token string and print the resolved metadata.

Example

blamejs api-key issue

Source: lib/cli.js

blamejs mtls

Inspect or generate the in-box mTLS CA + leaf certs (status / show-cert / init / issue / issue-p12)

Usage: blamejs mtls <subcommand> [flags]

Subcommands

Subcommand	Description
`status`	Print CA state — exists / generation / sealed-mode.
`show-cert`	Print the CA certificate PEM to stdout. Operators
`init`	Generate a fresh CA keypair + self-signed cert and
`issue`	Issue a leaf client certificate signed by the CA.
`issue-p12`	Issue + package as PKCS#12 with --password. Useful for

Flags

Flag	Description
`--data-dir <path>`	Path to the app's data dir (required)
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped). When wrapped,
`--sealed-mode <mode>`	auto \| required \| disabled (default auto). 'required'

Example

blamejs mtls status --data-dir <path>

Source: lib/cli.js

blamejs password

Test b.auth.password.policy against a candidate plaintext

Usage: blamejs password check [flags]

Flags

Flag	Description
`--plaintext <s>`	REQUIRED — the plaintext to test (or use stdin)
`--stdin`	Read the plaintext from stdin (newline-trimmed)
`--profile <name>`	Named profile: nist-aal2 \| pci-4.0 \| hipaa-aal2
`--min-length <n>`	Override the profile minLength
`--max-length <n>`	Override the profile maxLength
`--breach-check`	Enable HaveIBeenPwned k-anonymity check (NETWORK)
`--fail-closed`	With --breach-check: HIBP outage → fail (default ok)
`--email <addr>`	Context for the deny-context-substrings check
`--username <name>`	Context for the deny-context-substrings check
`--json`	Print machine-readable JSON

Example

blamejs password check

Source: lib/cli.js

blamejs vault

Seal / unseal / rotate the on-disk vault keypair (plaintext ↔ wrapped)

Usage: blamejs vault <subcommand> [flags]

Subcommands

Subcommand	Description
`status`	Report whether vault.key (plaintext) and/or
`seal`	Wrap a plaintext vault.key into a passphrase-
`unseal`	Reverse — write a plaintext vault.key from a
`rotate`	Re-wrap a sealed vault.key.sealed under a new

Flags

Flag	Description
`--data-dir <path>`	Path to the app's data dir (default ./data)
`--passphrase <string>`	Passphrase to wrap with (or env
`--new-passphrase <s>`	Rotate-only — the NEW passphrase to re-wrap
`--keep-plaintext`	For `seal` — retain the plaintext vault.key

Example

blamejs vault status --data-dir <path>

Source: lib/cli.js

blamejs config-drift

Inspect / verify the b.configDrift signed sidecar

Usage: blamejs config-drift <subcommand> [flags]

Subcommands

Subcommand	Description
`inspect`	Print the sidecar's snapshot + capturedAt + verified flag
`verify`	Verify the sidecar's signature (exit code reflects status)

Flags

Flag	Description
`--data-dir <path>`	Required (sidecar location)
`--baseline <name>`	Multi-baseline name (default: "default")
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped)
`--json`	inspect: print machine-readable JSON

Example

blamejs config-drift inspect --data-dir <path>

Source: lib/cli.js

blamejs file-type

Magic-byte content classification (b.fileType.detect)

Usage: blamejs file-type detect <file> [flags]

Flags

Flag	Description
`--json`	Print machine-readable JSON
`--allowlist <list>`	Comma-separated mime / category list — exits 1

Example

blamejs file-type detect <file>

Source: lib/cli.js

blamejs security

Run b.security.assertProduction against the live framework

Usage: blamejs security <subcommand> [flags]

Subcommands

Subcommand	Description
`assert`	Run b.security.assertProduction against the framework's

Flags

Flag	Description
`--data-dir <path>`	Required for `assert` (the boot dir)
`--vault-mode <mode>`	plaintext \| wrapped (default wrapped)
`--no-ntp-strict`	Skip the BLAMEJS_NTP_STRICT check
`--require-env <KEY,KEY,...>`	Comma-separated env vars that MUST be set
`--forbid-env <KEY,KEY,...>`	Comma-separated env vars that must NOT be set
`--no-vault`	Skip vault posture check
`--no-db-at-rest`	Skip dbAtRest posture check
`--no-audit-signing`	Skip auditSigning posture check

Example

blamejs security assert --data-dir <path>

Source: lib/cli.js

blamejs api-snapshot

Capture / compare the public API surface (CI gate)

Usage: blamejs api-snapshot <subcommand> [flags]

Subcommands

Subcommand	Description
`capture`	Walk the framework's public surface and write a snapshot
`compare`	Diff the current surface against a saved snapshot

Flags

Flag	Description
`--file <path>`	Snapshot file path (default ./api-snapshot.json)
`--module <path>`	Module to inspect (default require('@blamejs/core'))

Exit codes

0 no changes (compare) or write succeeded (capture)
1 breaking changes detected (compare)
2 bad invocation

Example

blamejs api-snapshot capture --file <path>

Source: lib/cli.js

blamejs dev

Run an app with file-watch + auto-restart

Usage: blamejs dev --command <cmd> [args] [flags]

Flags

Flag	Description
`--command <cmd>`	Program to spawn (e.g. node) [required]
`--arg <value>`	Argument for the spawned program (repeatable)
`--watch <dir>`	Directory to watch (repeatable; default '.')
`--ignore <pattern>`	Glob/regex fragment to ignore (repeatable)
`--grace-ms <N>`	Debounce window in ms (default 250)
`--kill-signal <S>`	Signal to send on restart (default SIGTERM)

Example

blamejs dev --command <cmd> [args]

Source: lib/cli.js

blamejs version

Print framework version

Usage: blamejs version

Example

blamejs version

Source: lib/cli.js

Live help

This page is a build-time snapshot. The authoritative source is blamejs help <command> (or blamejs <command> --help) — both render the same USAGE constants this harvester reads.

Last updated 2026-10-12T14:21:56.879Z by seeder.