Welcome

blamejs is a Node framework for operators who care more about what the wire actually does than how loudly the README claims to do it. Zero npm runtime dependencies. Post-quantum crypto from line zero. Sealed-by-default storage. Audit chain on every operator action.

Every primitive on this site is documented from its source file — the @primitive JSDoc block above each function IS the wiki page section. Drift between code and docs is structurally impossible: the same diff that changes the function changes the documentation.

Install #

The framework targets Node Active LTS (24+). No transpilation step, no Babel, no build pipeline. CommonJS, var, node: builtins, no shipped TypeScript.

  npm install @blamejs/core
  

Then in any .js file:

  var b = require("@blamejs/core");
  

Every public primitive is accessible from the b namespace — b.crypto, b.audit, b.session, b.uuid, etc. Browse the API index for the full list, or jump to a concern group from the sidebar.

First server #

b.createApp({ dataDir, routes }) boots the framework with strict CSP, CSRF, origin verification, bot-guard, encrypted sessions, sealed storage, and the audit chain wired into the request lifecycle. Operators who do nothing get the same posture as operators who carefully read every config option.

  var b = require("@blamejs/core");

  var app = await b.createApp({
    dataDir: "./data",
    routes: function (router) {
      router.get("/", function (req, res) {
        b.render.htmlString(res, "<h1>Hello from blamejs</h1>");
      });
    },
  });

  await app.listen({ port: 3000 });
  // → server listening on :3000 with CSP / CSRF / origin / audit / sealed storage all on.
  

That snippet is a production-posture server. Every default that matters is already on. Read the Concepts pages for the details.

Sealed storage example #

Every database column except IDs / timestamps / FK references is sealed at rest by default. The framework's vault wraps each value in a versioned envelope with AAD bound to the row context.

  var b = require("@blamejs/core");

  await b.db.declareTable({
    name: "users",
    columns: { id: "TEXT PRIMARY KEY", email: "TEXT NOT NULL", note: "TEXT" },
    sealedFields: ["note"],
  });

  await b.db.insert("users", { id: b.uuid.v7(), email: "a@b.com", note: "PHI here" });
  // The `note` column lands as a versioned ciphertext on disk; reads
  // through b.db transparently decrypt for application code.
  

Audit chain example #

Every operator action emits a tamper-evident audit row. The chain is hash-linked and periodically signed with SLH-DSA-SHAKE-256f (FIPS 205 stateless hash signature).

  b.audit.emit({
    event:    "wiki.page.edited",
    actor:    req.user.id,
    subject:  page.slug,
    outcome:  "success",
    metadata: { from: prev.updatedAt, to: now },
  });
  // Returns immediately; the row lands on the audit chain
  // synchronously, prev_hash linked, before the request response.
  

How to read this site #

- **Concepts** — the framework's posture and patterns: security defaults, envelope versioning, validation discipline, compliance postures, modernity posture. - **Reference** — auto-generated tables: every error class, every env var, every CLI command, every vendored dep, the full API index. - **Tools / Validation / etc.** — per-namespace primitive guides, each rendered straight from @primitive source comments. The code↔docs link is structural, not aspirational.

What's next #

The wiki is in active migration. New namespaces appear in the sidebar as their @primitive blocks land in the source. The API index lists every primitive currently documented; undocumented surface still works in code but isn't yet wiki- visible.

For framework rules + design decisions read the **Concepts** pages. For runtime configuration read **Reference / Environment variables**. For day-to-day operator tasks read **Reference / CLI commands**.

Last updated 2026-08-08T16:39:49.652Z by seeder.