nsprism is the home of a family of small, sharp, zero-dependency frameworks for the JVM. Each package does one enterprise job — starting with security — and does it without dragging a dependency tree behind it.
// pick the concern, keep the API
NS.use(NSOp.LOG, LOGIN_SCHEMA, event); // masked log line
NS.use(NSOp.GENERATE, ORDER_CREATE, order); // fill id fields
NS.use(NSOp.CRYPTO, CUSTOMER_W, record); // encrypt fields
String id = NS.use(NSOp.ID); // one ULID
try (NSLogContext.Scope s =
NSLogContext.with("traceId", traceId)) {
NS.use(NSOp.LOG, ORDER_PLACED, order);
}NSEvery nsprism artifact ships from io.github.nsprism on Maven Central.
Add a module to the classpath and its providers are discovered automatically — no wiring, no XML, no magic annotations.
Every nsprism package follows the same contract, so learning one teaches you all of them.
Core artifacts ship with no third-party runtime dependencies — even JSON is parsed internally. Your dependency tree stays auditable.
Implementations register via java.util.ServiceLoader.
Adding a jar adds a capability; removing it removes the capability. Nothing else to configure.
Policy lives in versioned JSON resources, validated and compiled at class-initialisation — so a bad rule fails at startup, not at 3 AM in production.
Anything you forgot to classify is suppressed, never leaked. Safety is the default posture, and relaxing it is always an explicit, visible choice.
Three schema-driven engines behind a single NS facade.
Declare which fields may appear in a log event — everything else is masked, pseudonymised
or dropped before it hits a disk, socket or Splunk index. Declare which fields get ids and
they fill themselves. Declare which fields encrypt, hash or drop — and the crypto engine
binds every ciphertext to its schema context.
Unlisted fields are suppressed — a field you forgot to classify cannot leak.
Compliance-grade events bypass the level floor and cannot be filtered away.
Disabling scrubbing in prod is refused at startup unless explicitly overridden.
{
"ts": "2026-11-06T09:41:12Z",
"level": "INFO",
"service": "claims-api",
"event": "auth.login",
"message": "User signed in",
"ctx": { "traceId": "a1b2…" },
"data": {
"userId": "#3f9c21d4…", // PSEUDONYM
"method": "password+totp", // ALLOW
"sessionToken": "[REDACTED]", // CREDENTIAL
"user": {
"email": "j•••e@acme.com", // PARTIAL
"ip": "•••.••.4•.1•2" // PRESERVE_FORMAT
}
// "password": suppressed — no rule listed it
}
}Add one Maven coordinate. The classpath does the rest.