@blamejs/core 0.4.1

package/CHANGELOG.md

@@ -0,0 +1,230 @@
+# Changelog
+
+One entry per released tag, grouped by minor. Latest first.
+
+Pre-1.0 the surface is intentionally evolving — every release may
+change something operators depend on. Read each entry before
+upgrading across more than a few patches at a time.
+
+## v0.3.x
+
+- **0.3.39** (2026-04-29) — MIGRATING.md generator scans deprecate() calls in lib/
+- **0.3.38** (2026-04-29) — LTS-CALENDAR.md publishes the major-cadence + algorithm posture
+- **0.3.37** (2026-04-29) — bundled pure-JS mTLS engine + vendor-update.sh + CHANGELOG + thanks page
+- **0.3.36** (2026-04-29) — prepack guard refuses to publish any path that matches a gitignore rule
+- **0.3.35** (2026-04-29) — wiki home page hero with logo + neon-magenta brand accents
+- **0.3.34** (2026-04-29) — rewrite api-snapshot wiki section in plain operator voice + fix SECURITY.md flag
+- **0.3.33** (2026-04-29) — doc-sweep folding the v0.3.32 mtls CLI references + filling the wiki gap on api-snapshot
+- **0.3.32** (2026-04-29) — blamejs mtls CLI (status / show-cert / init / issue / issue-p12) + framework posture fix on cert fingerprinting
+- **0.3.31** (2026-04-29) — npm-publish: defensive NPM_TOKEN check + bin/blamejs.js executable bit committed
+- **0.3.30** (2026-04-29) — wiki binds 0.0.0.0 by default so docker -p forwarding actually reaches the listener
+- **0.3.29** (2026-04-29) — npm-publish workflow + Dockerfile data-skeleton dir
+- **0.3.28** (2026-04-29) — Dockerfile: switch runtime --chown from name to numeric UID 65532:65532
+- **0.3.27** (2026-04-29) — Dockerfile pre-builds public/dist in deps stage so runtime container boots cleanly under --cap-drop ALL
+- **0.3.26** (2026-04-29) — operator-facing env-var surface, GitHub-side ops docs, contribution standards
+- **0.3.25** (2026-04-29) — env-var surface documented across Dockerfile, docker-compose.prod, DEPLOY.md, README; smoke-test GHCR login fix
+- **0.3.24** (2026-04-29) — CI + release-container workflows brought to hermitstash parity (structured output, multi-arch, cosign, post-publish smoke)
+- **0.3.23** (2026-04-29) — _runVault and _runBackup refactored to use b.cliHelpers (sweep complete across the three CLI commands the helper was designed for)
+- **0.3.22** (2026-04-29) — blamejs api-key CLI; b.cliHelpers shared primitive for headless app + reporter shape
+- **0.3.21** (2026-04-29) — blamejs backup CLI: inspect / verify / extract; backup encryption format documented
+- **0.3.20** (2026-04-29) — drop redundant Windows-flaky audit.flush perf assertion
+- **0.3.19** (2026-04-29) — wiki docs for the unwired primitives surface
+- **0.3.18** (2026-04-29) — blamejs vault CLI: seal / unseal / rotate / status
+- **0.3.17** (2026-04-29) — Tier-A validateOpts coverage extended to remaining operator-facing primitives (i18n, bundler, migrations, seeders, template, jobs, cookies, log, mtlsCa, staticServe, handlers, websocket, pqcGate, tracing, metrics — 15 more factories now reject typo'd opts at boot). Coverage is now ~39/lib primitives with the helper; the remaining handful (app-shutdown, chain-writer, dev, error-page, nonce-store, protocol-dispatcher, render, session, pqc-agent) are either internal-only — operators don't construct them directly — or have a single required-key surface where typo guards add no value.
+- **0.3.16** (2026-04-29) — Tier-A config validation, CSRF cookie mode, HTML balance, dynamic Cache-Control, URL canonicalization
+- **0.3.15** (2026-04-29) — cors: accept Origin: null when Sec-Fetch-Site is same-origin (browsers send opaque Origin: null on form-navigation POSTs from a page whose response sets Referrer-Policy: no-referrer; the Fetch-metadata Sec-Fetch-Site header is the matching disambiguation signal — same-origin or none means accept, anything else stays refused)
+- **0.3.14** (2026-04-29) — Dockerfile hotfix + lint as release gate
+- **0.3.13** (2026-04-29) — CI lint scans + Wolfi container + Trivy two-step + lint cleanup
+- **0.3.12** (2026-04-29) — version bump for hotfix (rebuild container image)
+- **0.3.11** (2026-04-29) — CI/CD: GitHub Actions for smoke + wiki e2e, GHCR container publish on tag, Caddy production deploy overlay
+- **0.3.10** (2026-04-29) — framework correctness fixes: compression backpressure, cspNonce cacheable-render API, cors same-origin, audit namespaces
+- **0.3.9** (2026-04-28) — wiki: Docker Compose deploy
+- **0.3.8** (2026-04-28) — wiki: remaining four concern-group pages
+- **0.3.7** (2026-04-28) — wiki: HTTP & Middleware and Crypto & Vault pages
+- **0.3.6** (2026-04-28) — wiki: Auth & Permissions and Storage & State pages
+- **0.3.5** (2026-04-28) — strip stale comments and template language from sources
+- **0.3.4** (2026-04-28) — wiki: Welcome and Observability pages
+- **0.3.3** (2026-04-28) — wiki bundler integration + admin editor enhancements
+- **0.3.2** (2026-04-28) — wiki wires notify / scheduler / apiKey / webhook
+- **0.3.1** (2026-04-28) — wiki design pass
+- **0.3.0** (2026-04-28) — examples/wiki reference app
+
+## v0.2.x
+
+- **0.2.39** (2026-04-28) — sweep auditCaptured + fakeNow patterns to b.testing
+- **0.2.38** (2026-04-28) — b.testing
+- **0.2.37** (2026-04-28) — b.notify
+- **0.2.36** (2026-04-28) — b.i18n
+- **0.2.35** (2026-04-28) — b.seeders
+- **0.2.34** (2026-04-28) — b.cache
+- **0.2.33** (2026-04-28) — audit captures the 5 W's; success on by default when audit is wired
+- **0.2.32** (2026-04-28) — close api-key visibility holes
+- **0.2.31** (2026-04-28) — auditSuccess split: precursor vs complete-event
+- **0.2.30** (2026-04-28) — b.permissions
+- **0.2.29** (2026-04-28) — observability backfill across primitives
+- **0.2.28** (2026-04-28) — credential hash envelope versioning
+- **0.2.27** (2026-04-28) — b.apiKey + repo logo assets
+- **0.2.26** (2026-04-28) — b.webhook signing + verification
+- **0.2.25** (2026-04-28) — b.slug
+- **0.2.24** (2026-04-28) — b.retry primitive
+- **0.2.23** (2026-04-28) — test helpers consolidate
+- **0.2.22** (2026-04-28) — tier-aware input validation
+- **0.2.21** (2026-04-28) — defineClass.factory replaces per-module _err wrappers
+- **0.2.20** (2026-04-28) — b.requestHelpers + metrics _normalizeLabelArg
+- **0.2.19** (2026-04-28) — audit.safeEmit replaces per-module _emit wrappers
+- **0.2.18** (2026-04-28) — b.protocolDispatcher
+- **0.2.17** (2026-04-28) — b.observability.tap
+- **0.2.16** (2026-04-28) — index.js header lists complete public surface
+- **0.2.15** (2026-04-28) — request middleware captures statusCode, promotes span to route template
+- **0.2.14** (2026-04-28) — router populates req.routePattern
+- **0.2.13** (2026-04-28) — OAuth generic preset
+- **0.2.12** (2026-04-28) — built-in metrics + framework tracing taps
+- **0.2.11** (2026-04-28) — storage POST-form policy presigning + logger deprecation warning
+- **0.2.10** (2026-04-28) — close api-encrypt audit gaps
+- **0.2.9** (2026-04-28) — cluster-shared nonce-store + audit handler isolation
+- **0.2.8** (2026-04-28) — end-to-end PQC payload encryption middleware
+- **0.2.7** (2026-04-27) — websocket channel/room hub with cluster pub/sub fan-out
+- **0.2.6** (2026-04-27) — mail-bounce intake primitive
+- **0.2.5** (2026-04-27) — strip narrative comments
+- **0.2.4** (2026-04-27) — fold logger into log + rate-limit cluster backend
+- **0.2.3** (2026-04-27) — route raw literals through C.TIME / C.BYTES, type bare throws
+- **0.2.2** (2026-04-27) — close gaps in the 0.2.1 scheduler and presign work
+- **0.2.1** (2026-04-27) — scheduler exactly-once-globally + storage presigned upload URLs
+- **0.2.0** (2026-04-27) — minor bump + queue lease-extension + Jobs DLQ
+
+## v0.1.x
+
+- **0.1.111** (2026-04-27) — modular per-file test layout
+- **0.1.110** (2026-04-27) — session.rotate + migrations advisory lock
+- **0.1.109** (2026-04-27) — auth.oauth: OAuth 2 / OIDC client
+- **0.1.108** (2026-04-27) — app-shutdown: graceful-shutdown orchestrator
+- **0.1.107** (2026-04-27) — tracing: OpenTelemetry seam
+- **0.1.106** (2026-04-27) — metrics: Prometheus-format counters/gauges/histograms
+- **0.1.105** (2026-04-27) — csp-nonce middleware + render integration
+- **0.1.104** (2026-04-27) — pagination: cursor + offset helpers
+- **0.1.103** (2026-04-27) — compression middleware
+- **0.1.102** (2026-04-27) — health endpoint primitive
+- **0.1.101** (2026-04-27) — body-parser middleware
+- **0.1.100** (2026-04-27) — safe-schema: declarative input validator
+- **0.1.99** (2026-04-27) — events: breach-detection signal bus (audit-tools slice B)
+- **0.1.98** (2026-04-27) — audit-tools (slice A): archive + export + verify-bundle + purge
+- **0.1.97** (2026-04-27) — backup: encrypted-at-rest support — db.flushToDisk + recommendedFiles
+- **0.1.96** (2026-04-27) — audit cleanup A4: folder-level adjustments + DeprecateError rename
+- **0.1.95** (2026-04-27) — audit cleanup A3: standardize require ordering across major lib files
+- **0.1.94** (2026-04-27) — audit cleanup A2 (cont.): rename import bindings, public namespace, error classes
+- **0.1.93** (2026-04-27) — audit cleanup A2: rename libs to prefix-grouped names — pre-v1.0 LTS lock-in
+- **0.1.92** (2026-04-27) — audit cleanup A1: lift duplicated helpers + frameworkError.defineClass
+- **0.1.91** (2026-04-27) — api-snapshot: public API surface walker + breaking-change detector — slice 8b
+- **0.1.90** (2026-04-27) — deprecate: runtime deprecation API for the LTS contract — slice 8a
+- **0.1.89** (2026-04-27) — restore + restore-rollback: storage-backed restore + atomic swap — complete
+- **0.1.88** (2026-04-27) — backup: orchestration with pluggable storage + retention — slice 7d
+- **0.1.87** (2026-04-27) — restore-bundle: extract encrypted bundle to staging — slice 7c
+- **0.1.86** (2026-04-27) — backup-bundle: produce an encrypted backup bundle on disk — slice 7b
+- **0.1.85** (2026-04-27) — backup-manifest: bundle schema + validate/parse/serialize — slice 7a
+- **0.1.84** (2026-04-27) — backup-crypto: Argon2id KDF + XChaCha20-Poly1305 for backup files — slice 7
+- **0.1.83** (2026-04-27) — mtls-ca: CA file management with engine-pluggable issuance — slice 6
+- **0.1.82** (2026-04-27) — vault-passphrase-ops: seal/unseal/rotate operator primitives — slice 5
+- **0.1.81** (2026-04-27) — vault-rotate.rotate: full rotation pipeline — slice 4
+- **0.1.80** (2026-04-27) — vault-rotate (diagnostics): schema-drift + round-trip verify — slice 3
+- **0.1.79** (2026-04-27) — drop SecP256r1MLKEM768 from default TLS group preference
+- **0.1.78** (2026-04-27) — pqc-agent: locked-posture HTTPS agent + http-client refactor — slice 2
+- **0.1.77** (2026-04-27) — pqc-gate: TCP-level PQC enforcement on ClientHello — slice 1
+- **0.1.76** (2026-04-27) — bundler: content-hashed asset pipeline + manifest — complete
+- **0.1.75** (2026-04-27) — dev: file-watch + child-process restart engine — slice 6 ( complete)
+- **0.1.74** (2026-04-27) — cli: bin/blamejs + migrate up/down/status — slice 5
+- **0.1.73** (2026-04-27) — migrations: public up/down/status runner — slice 4
+- **0.1.72** (2026-04-27) — cookies: parse/serialize + sealed-value access gate — slice 3
+- **0.1.71** (2026-04-27) — errors-page: rich dev page + safe prod page; middleware shim — slice 2
+- **0.1.70** (2026-04-27) — log: structured JSON logging with request-id correlation — slice 1
+- **0.1.69** (2026-04-27) — scheduler: cron + interval over jobs/queue — slice 5 ( complete)
+- **0.1.68** (2026-04-27) — mail: generalize http transport, demote resend to thin preset
+- **0.1.67** (2026-04-27) — mail: contract + console/memory/smtp/resend transports — slice 4
+- **0.1.66** (2026-04-26) — jobs (define + enqueue + in-process worker) + createApp wiring — slices 2/3
+- **0.1.65** (2026-04-26) — createApp factory — slice 1
+- **0.1.64** (2026-04-26) — forms + csrfProtect — slice 4 ( complete)
+- **0.1.63** (2026-04-26) — staticServe: file serving + ETag + SRI integrity — slice 3
+- **0.1.62** (2026-04-26) — render: HTTP response helpers — slice 2
+- **0.1.61** (2026-04-26) — template engine (eval-free interpreter) — slice 1
+- **0.1.60** (2026-04-26) — auth.jwt with SLH-DSA-SHAKE-256f default — slice 5/5 ( complete)
+- **0.1.59** (2026-04-26) — middleware.attachUser + middleware.requireAuth — slice 4
+- **0.1.58** (2026-04-26) — auth.passkey (WebAuthn / FIDO2) — slice 3
+- **0.1.57** (2026-04-26) — TOTP defaults match spec (HMAC-SHA512 / 128-byte secret / 8 digits / 30s) + crypto.random truncation fix
+- **0.1.56** (2026-04-26) — auth.totp: flip default to HMAC-SHA512, drop SHA-1 support
+- **0.1.55** (2026-04-26) — auth.totp / lib/totp.js (RFC 6238) — slice 2
+- **0.1.54** (2026-04-26) — audit-sign algorithm-agility + flip default to SLH-DSA-SHAKE-256f
+- **0.1.53** (2026-04-26) — auth.password (Argon2id) — slice 1/4
+- **0.1.52** (2026-04-26) — consent_log integrity parity with audit_log (closes the cluster spec storage move)
+- **0.1.51** (2026-04-26) — queue jobs move to external-db in cluster mode
+- **0.1.50** (2026-04-26) — sessions move to external-db in cluster mode
+- **0.1.49** (2026-04-26) — boot-time vault-key consistency check (closes cluster spec phase 4)
+- **0.1.48** (2026-04-26) — boot-time audit-tip rollback detection in cluster mode
+- **0.1.47** (2026-04-26) — fix handlers.drain unbounded loop on recursive emit (cluster-mode audit hang)
+- **0.1.46** (2026-04-26) — cluster-mode audit-tip fencing-token guard
+- **0.1.45** (2026-04-26) — cluster discovery surface for service-mesh / load-balancer routing
+- **0.1.44** (2026-04-26) — repeating-pattern sweep: sleep + withTimeoutSignal + auth-header + listenOnRandomPort
+- **0.1.43** (2026-04-26) — url-safe protocol validator at outbound boundary
+- **0.1.42** (2026-04-26) — router.closeWebSockets + activeWebSockets — fundamental fix
+- **0.1.41** (2026-04-26) — smoke runner gains groups + fixtures + per-test timing
+- **0.1.40** (2026-04-26) — router.ws integration + WebSocket lifecycle redesign
+- **0.1.39** (2026-04-26) — h2 WebSocket (RFC 8441 Extended CONNECT) added to websocket.js
+- **0.1.38** (2026-04-26) — lib/websocket.js (RFC 6455 server primitive)
+- **0.1.37** (2026-04-26) — atomicFile.listDir primitive + sweep 5 lib sites
+- **0.1.36** (2026-04-26) — testConstantsReferenceIntegrity uses framework primitives
+- **0.1.35** (2026-04-26) — fix stale C.TIME.FIVE_MIN refs + add integrity test
+- **0.1.34** (2026-04-26) — document h3-ready transport cache + TLS session resumption stance
+- **0.1.33** (2026-04-26) — HTTP/2 backend behind same httpClient.request surface
+- **0.1.32** (2026-04-26) — http-client primitive (h1 baseline) + sweep 5 adapters
+- **0.1.31** (2026-04-26) — logger primitive + sweep log/logErr/console sites
+- **0.1.30** (2026-04-26) — framework-error base class + sweep operational _err factories
+- **0.1.29** (2026-04-26) — lazy-require primitive + sweep 12 modules
+- **0.1.28** (2026-04-26) — adopt bufferSafe.secureZero in passphrase + key-wrap paths
+- **0.1.27** (2026-04-26) — bufferSafe primitive + sweep parsers/atomic-file/object-store
+- **0.1.26** (2026-04-26) — envSafe.readVar primitive + sweep direct process.env reads
+- **0.1.25** (2026-04-26) — dedup audit-sign passphrase logic into passphrase-source
+- **0.1.24** (2026-04-26) — Layer 5 extraction + smoke.js as pure orchestrator
+- **0.1.23** (2026-04-26) — Layer 4 extraction: consumer modules → 40-consumers.js
+- **0.1.22** (2026-04-26) — Layer 3 extraction: chain-writing modules → 30-chain.js
+- **0.1.21** (2026-04-26) — Layer 2 extraction: db + framework-schema → 20-db.js
+- **0.1.20** (2026-04-26) — Layer 1 extraction: vault + cluster + framework-schema → 10-state.js
+- **0.1.19** (2026-04-26) — Layer 0 extraction: atomic-file + parsers + redact → 00-primitives.js
+- **0.1.18** (2026-04-26) — Layer 0 extraction: json-safe tests → 00-primitives.js
+- **0.1.17** (2026-04-26) — Layer 0 extraction: async-safe + handlers tests → 00-primitives.js
+- **0.1.16** (2026-04-26) — first Layer 0 extraction (sql-safe + chain-writer → 00-primitives.js)
+- **0.1.15** (2026-04-26) — extract test/_helpers.js (foundation for layer-file split)
+- **0.1.14** (2026-04-26) — smoke runner reordered by dependency layer (primitives first, consumers last)
+- **0.1.13** (2026-04-26) — sql-safe + chain-writer primitives; consent gets the audit Mutex fix as a side effect of consolidation
+- **0.1.12** (2026-04-26) — async-safe + handlers hardening: AbortSignal, Once.reset, isRetryable override, timer-unref bug fix, full primitive test coverage
+- **0.1.11** (2026-04-26) — handlers primitive replaces fire-and-forget audit emission
+- **0.1.10** (2026-04-26) — async-safe library + audit dispatch via cluster-storage
+- **0.1.9** (2026-04-26) — cluster storage step 2: SQL dispatcher (lib/cluster-storage.js)
+- **0.1.8** (2026-04-26) — cluster storage step 1: framework-state schema for external-db
+- **0.1.7** (2026-04-26) — .env safe loader (lib/parsers/env-safe.js)
+- **0.1.6** (2026-04-26) — YAML 1.2 safe-subset parser (lib/parsers/yaml-safe.js)
+- **0.1.5** (2026-04-26) — TOML 1.0 safe parser (lib/parsers/toml-safe.js)
+- **0.1.4** (2026-04-26) — xml-safe parser adopted in object-store list responses
+- **0.1.3** (2026-04-26) — atomicFile.readSync for sync init paths
+- **0.1.2** (2026-04-26) — rename b.json public API to b.jsonSafe
+- **0.1.1** (2026-04-26) — rename HA → cluster (no cryptic acronyms in framework names)
+- **0.1.0** (2026-04-26) — HA write-side gates wired across framework subsystems
+
+## v0.0.x
+
+- **0.0.19** (2026-04-26) — HA core: leader election + fencing tokens (operator-facing primitive)
+- **0.0.18** (2026-04-26) — strip internal-process narrative from framework comments
+- **0.0.17** (2026-04-25) — internal adoption sweep + functional scale helpers
+- **0.0.16** (2026-04-25) — atomic file I/O + safe parsers (XML, CSV)
+- **0.0.15** (2026-04-25) — HTTP middleware: request lifecycle hardening ( begin)
+- **0.0.14** (2026-04-25) — external DB (Shape B: app-data-only, bring-your-own-client)
+- **0.0.13** (2026-04-25) — log streaming + redaction + bidirectional command channel
+- **0.0.12** (2026-04-25) — queue dispatcher + local SQLite-backed protocol
+- **0.0.11** (2026-04-25) — gcs + azure-blob protocol adapters (object-store complete)
+- **0.0.10** (2026-04-25) — sigv4 protocol adapter (S3 + R2 + B2 + MinIO + Wasabi + DO Spaces + ...)
+- **0.0.9** (2026-04-25) — generic remote data layer + classification-routed bifurcation
+- **0.0.8** (2026-04-25) — full tamper-proof bar (signed checkpoints, rollback detection)
+- **0.0.7** (2026-04-25) — traceability hardening + dynamic PK/FK schema declarations
+- **0.0.6** (2026-04-25) — security-focused JSON parsing + schema validation
+- **0.0.5** (2026-04-25) — session & storage local backend
+- **0.0.4** (2026-04-25) — audit chain, consent log, subject rights
+- **0.0.3** (2026-04-25) — db, query builder, field-crypto, migrations
+- **0.0.2** (2026-04-25) — vault & key management
+- **0.0.1** (2026-04-25) — foundation

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 blamejs contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.

package/LTS-CALENDAR.md

@@ -0,0 +1,29 @@
+# LTS calendar
+
+`@blamejs/core` ships on a published major cadence. Each major receives
+**18 months of security-only patches** starting the day the next major is
+published. Feature backports are not promised.
+
+| Version       | First release | Security patches through    | Node minimum  | KEM                  | Cipher                | KDF      | Sigs                  |
+|---------------|---------------|-----------------------------|---------------|----------------------|-----------------------|----------|-----------------------|
+| `v0.x` (pre-1.0) | 2026-04-25  | until v1.0 ships            | 24            | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
+| `v1.x`        | TBD           | first release + 18 months   | current LTS   | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
+
+## What "security patches" means
+
+- Critical and high-severity vulnerabilities in the framework's own code.
+- Vendored-dep CVE refreshes (the SECURITY.md commitment of "vendored-dep refresh release within 7 days of an upstream patch landing for High / Critical CVEs" applies on the LTS line too).
+- Crypto envelope updates required by NIST / IETF deprecations of the active KEM / Cipher / KDF / Sig algorithms.
+- **Not** included: feature backports, performance improvements, or non-security bug fixes. Operators who want those upgrade to the current major.
+
+## Algorithm posture
+
+The KEM / Cipher / KDF / Sig columns list the active envelope IDs for **new** encryptions on that major. Old data encrypted under prior majors continues to decrypt unchanged via the algorithm-ID-in-envelope-header pattern (see [SECURITY.md → Cryptographic stack](SECURITY.md#cryptographic-stack)). When an algorithm is added or deprecated, the change ships as a minor on the current major and the LTS row is updated in the same commit.
+
+## Node minimum policy
+
+The "Node minimum" column is the lowest Node major the framework supports for that line. It tracks Node's own active-LTS schedule: a new blamejs major adopts whatever Node major is currently the active LTS. Once on the LTS line, the Node minimum is frozen for that major's security-patch window — operators on the LTS line don't get forced onto a newer Node mid-window.
+
+## Pre-1.0 caveat
+
+`v0.x` has no LTS commitment. Every release may change something operators depend on; the algorithm posture is intentionally evolving. Read [CHANGELOG.md](CHANGELOG.md) before upgrading across more than a few patches at a time. The LTS calendar takes effect at v1.0.

package/MIGRATING.md

@@ -0,0 +1,7 @@
+# Migrating
+
+Operator-facing migration recipes per breaking change. Each entry below is a `deprecate()`-marked surface in the framework — the running app will warn about it (with `BLAMEJS_DEPRECATIONS=warn` set, or by default outside production) before the noted removal version. Re-run `node scripts/gen-migrating.js` before each release; the file is committed so operators can diff it against the prior tag.
+
+## No active deprecations
+
+The framework has no `deprecate()`-marked surface awaiting removal.

package/NOTICE

@@ -0,0 +1,59 @@
+blamejs
+Copyright 2026 blamejs contributors
+
+This product includes software developed by the blamejs project
+(https://blamejs.com).
+
+Licensed under the Apache License, Version 2.0. See LICENSE for the full text.
+
+================================================================================
+Third-Party Components
+================================================================================
+
+blamejs vendors third-party libraries under lib/vendor/ rather than peer-
+depending them through npm. Each vendored component retains its original
+copyright and license. Bundle versions and source SHAs are tracked in
+lib/vendor/MANIFEST.json.
+
+--------------------------------------------------------------------------------
+Component:   @noble/ciphers
+Version:     2.2.0
+Source:      https://github.com/paulmillr/noble-ciphers
+License:     MIT
+Copyright:   Copyright (c) 2023 Paul Miller (https://paulmillr.com)
+Used for:    XChaCha20-Poly1305 authenticated encryption (lib/crypto.js,
+             lib/vault-wrap.js, via lib/vendor/noble-ciphers.cjs)
+--------------------------------------------------------------------------------
+Component:   argon2 (node-argon2)
+Version:     0.44.0
+Source:      https://github.com/ranisalt/node-argon2
+License:     MIT
+Copyright:   Copyright (c) 2017 Ranieri Althoff
+Used for:    Argon2id passphrase-derived key derivation in the vault wrap
+             format (lib/vault-wrap.js, via lib/vendor/argon2/). Native
+             prebuilds shipped for darwin-{arm64,x64}, freebsd-{arm64,x64},
+             linux-{arm,arm64,x64}, win32-x64.
+--------------------------------------------------------------------------------
+Component:   @simplewebauthn/server
+Version:     13.3.0
+Source:      https://github.com/MasterKale/SimpleWebAuthn
+License:     MIT
+Copyright:   Copyright (c) Matthew Miller
+Used for:    WebAuthn / passkey registration + authentication response
+             verification (lib/passkey.js, via lib/vendor/simplewebauthn-
+             server.cjs).
+--------------------------------------------------------------------------------
+Component:   @peculiar/x509 + pkijs (peculiar-pki bundle)
+Version:     @peculiar/x509 2.0.0, pkijs 3.4.0
+Source:      https://github.com/PeculiarVentures/x509
+             https://github.com/PeculiarVentures/PKI.js
+License:     MIT
+Copyright:   Copyright (c) Peculiar Ventures
+Used for:    Pure-JS mTLS CA. Self-signed CA generation (ECDSA P-384, SHA-384),
+             leaf-cert signing for client certificates, PKCS#12 packaging
+             (PBES2 + AES-256-CBC + PBKDF2-HMAC-SHA-512, 2,000,000 iterations).
+             Wired into b.mtlsCa via lib/mtls-engine-default.js, backed by the
+             bundle lib/vendor/pki.cjs (also includes reflect-metadata,
+             asn1js, pvtsutils, pvutils, and the @peculiar/asn1-* schema
+             chain).
+--------------------------------------------------------------------------------

package/README.md

@@ -0,0 +1,100 @@
+# blamejs
+
+**The Node framework that owns its stack.**
+
+One install. One upgrade path. One place to look when something breaks — no blame to pass between forty transitive dependencies you didn't choose.
+
+---
+
+## Why blamejs
+
+The modern Node app is a 1,200-package supply-chain liability with no LTS calendar, no curator, and no accountability. Frameworks peer-depend their internals onto you and call it modularity. blamejs takes the opposite stance:
+
+- **Vendored standard library.** Auth, sessions, jobs, mail, storage, crypto, ORM, templating — bundled with the framework, not hunted on npm. Your `package.json` has one entry.
+- **Security as a default, not a config flag.** Post-quantum-aware crypto envelopes, sealed-by-default storage, server-rendered output, CSRF/origin/bot defenses wired in from line zero.
+- **Server-rendering first.** HTML out of the box; client JS is opt-in islands, not the foundation.
+- **A real LTS calendar.** Major versions on a published cadence with documented deprecation windows. No silent semver-major surprises in transitive deps.
+
+## Status
+
+Pre-1.0. The framework is usable end-to-end — envelope-versioned PQC crypto, sealed storage, HTTP router with a full middleware stack, vault, sessions, permissions, audit chain, scheduler, jobs, notify, mail, websocket, i18n, cluster mode, backup/restore, a wiki reference app under `examples/wiki/`. Operators can build production apps on it today; the surface is still subject to change before 1.0.
+
+```js
+var b = require("@blamejs/core");
+
+(async function () {
+  var app = await b.createApp({
+    dataDir: "./data",
+    routes: function (router) {
+      router.get("/", function (req, res) {
+        b.render.htmlString(res, "<h1>Hello from blamejs</h1>");
+      });
+    },
+  });
+  await app.listen({ port: 3000 });
+})();
+```
+
+**Requirements:** Node.js 24+ (current active LTS).
+
+## CLI
+
+`blamejs` ships an operator-facing CLI for the recurring ops work. Each subcommand boots a headless app instance from `--data-dir` (no HTTP listener), runs the operation, and shuts down. Same vault + DB + audit chain the running app uses.
+
+```
+blamejs migrate    up | down | status                   --db <path> [--dir <path>]
+blamejs seed       run | status                         --db <path> --env <name> [--dir <path>]
+blamejs vault      status | seal | unseal | rotate      --data-dir <path>
+blamejs backup     inspect | verify | extract           --bundle <dir>
+blamejs api-key    issue | revoke | list | rotate | verify   --data-dir <path> --namespace <ns>
+blamejs mtls       status | show-cert | init | issue | issue-p12   --data-dir <path>
+blamejs audit      archive | export | verify-bundle | purge
+blamejs api-snapshot   capture | compare                --file <path>
+blamejs dev        --command <cmd> [--watch <dir>...]
+```
+
+Pass `--help` to any subcommand for the full flag list. Passphrases for crypto-backed operations resolve from the appropriate env var (`BLAMEJS_VAULT_PASSPHRASE`, `BLAMEJS_BACKUP_PASSPHRASE`, `BLAMEJS_AUDIT_PASSPHRASE`) so they don't end up in shell history.
+
+## Reference app + deployment
+
+`examples/wiki/` is a complete production-ready operator-built blamejs app — the wiki you're looking at when you visit `blamejs.app`. It demonstrates every framework primitive in real usage and ships with `Dockerfile`, `docker-compose.yml` (dev), `docker-compose.prod.yml` (Caddy + GHCR image), and a published OCI image at `ghcr.io/blamejs/blamejs-wiki:<tag>` (multi-arch amd64/arm64, cosign-signed via GitHub OIDC, Trivy-scanned, SHA3-512 digest).
+
+See [`examples/wiki/DEPLOY.md`](examples/wiki/DEPLOY.md) for the full deployment walkthrough, including the operator-facing environment-variable matrix (`WIKI_*` and `BLAMEJS_*` keys) and the pin-to-version workflow for production updates.
+
+## Vendored dependencies
+
+All runtime dependencies are committed to the repo — no transitive npm install at runtime, no `node_modules` lookup path for production. Server-side deps are bundled via `scripts/vendor-update.sh`:
+
+```bash
+./scripts/vendor-update.sh --check                  # see what's outdated
+./scripts/vendor-update.sh --diff @noble/ciphers    # see changelog before bumping
+./scripts/vendor-update.sh @noble/ciphers 2.2.0     # bundle + commit a new version
+```
+
+| Package | Version | Author | Purpose |
+|---|---|---|---|
+| [`@noble/ciphers`](https://github.com/paulmillr/noble-ciphers) | 2.2.0 | [Paul Miller](https://github.com/paulmillr) | XChaCha20-Poly1305 AEAD |
+| [`@simplewebauthn/server`](https://github.com/MasterKale/SimpleWebAuthn) | 13.3.0 | [Matthew Miller](https://github.com/MasterKale) | WebAuthn / passkey verification |
+| [`argon2`](https://github.com/ranisalt/node-argon2) | 0.44.0 | [Ranieri Althoff](https://github.com/ranisalt) | Password hashing (native prebuilds, 8 platforms) |
+| [`@peculiar/x509`](https://github.com/PeculiarVentures/x509) + [`pkijs`](https://github.com/PeculiarVentures/PKI.js) | 2.0.0 + 3.4.0 | [Peculiar Ventures](https://github.com/PeculiarVentures) | Pure-JS mTLS CA — ECDSA P-384 cert signing, PKCS#12 packaging (no openssl CLI) |
+| [`prismjs`](https://prismjs.com/) | 1.30.0 | [Lea Verou + contributors](https://github.com/PrismJS/prism) | Syntax highlighting in the example wiki's code blocks (browser-side) |
+
+These libraries are exceptional work — blamejs wouldn't exist without them. All are MIT licensed. Per-package version, license, and provenance live in two manifests: [`lib/vendor/MANIFEST.json`](lib/vendor/MANIFEST.json) for the framework's server-side bundles and [`examples/wiki/public/vendor/MANIFEST.json`](examples/wiki/public/vendor/MANIFEST.json) for the wiki app's browser-side bundle. The framework's [`NOTICE`](NOTICE) file carries the upstream attributions.
+
+## Why "blamejs"
+
+Because when something breaks, `blame` should know exactly where it lives. We own the stack so you don't have to chase the fault across an ecosystem.
+
+## Contributing
+
+Patches welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for the dev setup, house rules (zero npm runtime deps, PQC-only crypto, audit-on-every-action, no-MVP), and the PR loop. New to the codebase? Start with [ARCHITECTURE.md](ARCHITECTURE.md) for the orientation map.
+
+Community standards: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) (Contributor Covenant 2.1). Be excellent.
+
+## Security
+
+Threat model, supported versions, vulnerability disclosure: [SECURITY.md](SECURITY.md). Do **not** file public issues for security bugs — email `security@blamejs.app`.
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE) for the full text and [NOTICE](NOTICE) for attribution of vendored components.

package/bin/blamejs.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+"use strict";
+// Thin entrypoint — all dispatch logic lives in lib/cli.js so it can
+// be driven from tests without spawning a child process.
+var cli = require("../lib/cli");
+
+cli.main(process.argv.slice(2)).then(
+  function (code) { process.exit(typeof code === "number" ? code : 0); },
+  function (err) {
+    process.stderr.write("blamejs: " + ((err && err.stack) || String(err)) + "\n");
+    process.exit(1);
+  }
+);