@blamejs/core 0.9.12 → 0.9.15

package/lib/vault/passphrase-ops.js

@@ -35,8 +35,8 @@
  * with the original file untouched.
  */
 
-var fs = require("fs");
-var path = require("path");
+var nodeFs = require("fs");
+var nodePath = require("path");
 var atomicFile = require("../atomic-file");
 var vaultWrap = require("./wrap");
 var { defineClass } = require("../framework-error");
@@ -48,10 +48,10 @@ var SEALED_NAME    = "vault.key.sealed";
 
 function _paths(dataDir) {
   return {
-    plaintext:     path.join(dataDir, PLAINTEXT_NAME),
-    plaintextTmp:  path.join(dataDir, PLAINTEXT_NAME + ".tmp"),
-    sealed:        path.join(dataDir, SEALED_NAME),
-    sealedTmp:     path.join(dataDir, SEALED_NAME + ".tmp"),
+    plaintext:     nodePath.join(dataDir, PLAINTEXT_NAME),
+    plaintextTmp:  nodePath.join(dataDir, PLAINTEXT_NAME + ".tmp"),
+    sealed:        nodePath.join(dataDir, SEALED_NAME),
+    sealedTmp:     nodePath.join(dataDir, SEALED_NAME + ".tmp"),
   };
 }
 
@@ -60,7 +60,7 @@ function _requireDataDir(opts) {
     throw new VaultPassphraseError("vault-passphrase/no-datadir",
       "opts.dataDir is required (path to the framework data directory)");
   }
-  if (!fs.existsSync(opts.dataDir)) {
+  if (!nodeFs.existsSync(opts.dataDir)) {
     throw new VaultPassphraseError("vault-passphrase/no-datadir",
       "opts.dataDir does not exist: " + opts.dataDir);
   }
@@ -80,8 +80,8 @@ function _requirePassphrase(opts, fieldName) {
 // don't have the original write fd around.
 function _fsyncPath(p) {
   try {
-    var fd = fs.openSync(p, "r+");
-    try { atomicFile.fsync(fd); } finally { fs.closeSync(fd); }
+    var fd = nodeFs.openSync(p, "r+");
+    try { atomicFile.fsync(fd); } finally { nodeFs.closeSync(fd); }
   } catch (_e) { /* best-effort across filesystems */ }
 }
 
@@ -90,13 +90,13 @@ function _fsyncPath(p) {
 function preflightSealable(opts) {
   _requireDataDir(opts);
   var p = _paths(opts.dataDir);
-  if (!fs.existsSync(p.plaintext)) {
+  if (!nodeFs.existsSync(p.plaintext)) {
     return { ok: false, reason: "plaintext " + PLAINTEXT_NAME + " does not exist — nothing to seal" };
   }
-  if (fs.existsSync(p.sealed)) {
+  if (nodeFs.existsSync(p.sealed)) {
     return { ok: false, reason: SEALED_NAME + " already exists; refusing to overwrite" };
   }
-  if (fs.existsSync(p.sealedTmp)) {
+  if (nodeFs.existsSync(p.sealedTmp)) {
     return { ok: false, reason: "stale " + SEALED_NAME + ".tmp from a previous crash; remove it manually after verifying the directory state" };
   }
   return { ok: true };
@@ -105,13 +105,13 @@ function preflightSealable(opts) {
 function preflightUnsealable(opts) {
   _requireDataDir(opts);
   var p = _paths(opts.dataDir);
-  if (!fs.existsSync(p.sealed)) {
+  if (!nodeFs.existsSync(p.sealed)) {
     return { ok: false, reason: SEALED_NAME + " does not exist — nothing to unseal" };
   }
-  if (fs.existsSync(p.plaintext)) {
+  if (nodeFs.existsSync(p.plaintext)) {
     return { ok: false, reason: "plaintext " + PLAINTEXT_NAME + " already exists; refusing to overwrite" };
   }
-  if (fs.existsSync(p.plaintextTmp)) {
+  if (nodeFs.existsSync(p.plaintextTmp)) {
     return { ok: false, reason: "stale " + PLAINTEXT_NAME + ".tmp from a previous crash; remove it manually after verifying the directory state" };
   }
   return { ok: true };
@@ -120,10 +120,10 @@ function preflightUnsealable(opts) {
 function preflightRotatable(opts) {
   _requireDataDir(opts);
   var p = _paths(opts.dataDir);
-  if (!fs.existsSync(p.sealed)) {
+  if (!nodeFs.existsSync(p.sealed)) {
     return { ok: false, reason: SEALED_NAME + " does not exist — rotate has nothing to operate on" };
   }
-  if (fs.existsSync(p.sealedTmp)) {
+  if (nodeFs.existsSync(p.sealedTmp)) {
     return { ok: false, reason: "stale " + SEALED_NAME + ".tmp from a previous crash; remove it manually after verifying the directory state" };
   }
   return { ok: true };
@@ -141,39 +141,39 @@ async function seal(opts) {
   var p = _paths(opts.dataDir);
   var keepPlaintext = !!opts.keepPlaintext;
 
-  var plainBytes = fs.readFileSync(p.plaintext);
+  var plainBytes = nodeFs.readFileSync(p.plaintext);
   var sealedBytes = await vaultWrap.wrap(plainBytes, opts.passphrase);
 
   // Step 1: write sealed.tmp + fsync
-  fs.writeFileSync(p.sealedTmp, sealedBytes, { mode: 0o600 });
+  nodeFs.writeFileSync(p.sealedTmp, sealedBytes, { mode: 0o600 });
   _fsyncPath(p.sealedTmp);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify the .tmp before committing the rename
-  var verifyBytes = fs.readFileSync(p.sealedTmp);
+  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
   var unwrapped;
   try {
     unwrapped = await vaultWrap.unwrap(verifyBytes, opts.passphrase);
   } catch (e) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-failed",
       "round-trip verification of sealed file failed: " + ((e && e.message) || String(e)) +
       " — original " + PLAINTEXT_NAME + " is UNCHANGED");
   }
   if (Buffer.compare(unwrapped, plainBytes) !== 0) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
       "round-trip produced different bytes than the original — original " + PLAINTEXT_NAME +
       " is UNCHANGED. Filesystem may be faulty.");
   }
 
   // Step 3: atomic rename sealed.tmp → sealed
-  fs.renameSync(p.sealedTmp, p.sealed);
+  nodeFs.renameSync(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete plaintext (unless keepPlaintext)
   if (!keepPlaintext) {
-    fs.unlinkSync(p.plaintext);
+    nodeFs.unlinkSync(p.plaintext);
     atomicFile.fsyncDir(opts.dataDir);
   }
 
@@ -194,7 +194,7 @@ async function unseal(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = fs.readFileSync(p.sealed);
+  var sealedBytes = nodeFs.readFileSync(p.sealed);
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.passphrase);
@@ -205,25 +205,25 @@ async function unseal(opts) {
   }
 
   // Step 1: write plaintext.tmp + fsync
-  fs.writeFileSync(p.plaintextTmp, plainBytes, { mode: 0o600 });
+  nodeFs.writeFileSync(p.plaintextTmp, plainBytes, { mode: 0o600 });
   _fsyncPath(p.plaintextTmp);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip sanity — re-read tmp and verify
-  var verifyBytes = fs.readFileSync(p.plaintextTmp);
+  var verifyBytes = nodeFs.readFileSync(p.plaintextTmp);
   if (Buffer.compare(verifyBytes, plainBytes) !== 0) {
-    try { fs.unlinkSync(p.plaintextTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.plaintextTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
       "plaintext.tmp re-read differs from in-memory bytes — filesystem may be faulty. " +
       SEALED_NAME + " is UNCHANGED");
   }
 
   // Step 3: atomic rename plaintext.tmp → plaintext
-  fs.renameSync(p.plaintextTmp, p.plaintext);
+  nodeFs.renameSync(p.plaintextTmp, p.plaintext);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete sealed file
-  fs.unlinkSync(p.sealed);
+  nodeFs.unlinkSync(p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   return { plaintextPath: p.plaintext };
@@ -245,7 +245,7 @@ async function rotate(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = fs.readFileSync(p.sealed);
+  var sealedBytes = nodeFs.readFileSync(p.sealed);
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.oldPassphrase);
@@ -257,23 +257,23 @@ async function rotate(opts) {
   var newSealedBytes = await vaultWrap.wrap(plainBytes, opts.newPassphrase);
 
   // Step 1: write new sealed.tmp + fsync
-  fs.writeFileSync(p.sealedTmp, newSealedBytes, { mode: 0o600 });
+  nodeFs.writeFileSync(p.sealedTmp, newSealedBytes, { mode: 0o600 });
   _fsyncPath(p.sealedTmp);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify with NEW passphrase, AND assert unwrap
   // with the OLD passphrase fails — otherwise the rotation didn't take.
-  var verifyBytes = fs.readFileSync(p.sealedTmp);
+  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
   var verifyPlain;
   try { verifyPlain = await vaultWrap.unwrap(verifyBytes, opts.newPassphrase); }
   catch (e) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-failed",
       "round-trip with new passphrase failed: " + ((e && e.message) || String(e)) +
       " — " + SEALED_NAME + " is UNCHANGED");
   }
   if (Buffer.compare(verifyPlain, plainBytes) !== 0) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
       "rotated sealed file decrypts under new passphrase but to different bytes — " +
       SEALED_NAME + " is UNCHANGED. Filesystem may be faulty.");
@@ -283,7 +283,7 @@ async function rotate(opts) {
   // input unchanged — refuse to commit.
   try {
     await vaultWrap.unwrap(verifyBytes, opts.oldPassphrase);
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/rotate-noop",
       "old passphrase still unwraps the new sealed bytes — rotation did not take effect");
   } catch (e) {
@@ -292,7 +292,7 @@ async function rotate(opts) {
   }
 
   // Step 3: atomic rename — swap in the new sealed file
-  fs.renameSync(p.sealedTmp, p.sealed);
+  nodeFs.renameSync(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   return { sealedPath: p.sealed };

package/lib/vault/passphrase-source.js

@@ -23,7 +23,7 @@
  * exposure to later env-dump surfaces. This doesn't zero the memory
  * (JavaScript can't) but does remove the env-object reference.
  */
-var fs = require("fs");
+var nodeFs = require("fs");
 var readline = require("readline");
 var safeEnv = require("../parsers/safe-env");
 var safeBuffer = require("../safe-buffer");
@@ -83,7 +83,7 @@ async function fromFile(filePath, opts) {
   }
   var raw;
   try {
-    raw = fs.readFileSync(filePath);
+    raw = nodeFs.readFileSync(filePath);
   } catch (e) {
     throw new Error("failed to read " + envVars.file + " (" + filePath + "): " + e.code);
   }

package/lib/vault/rotate.js

@@ -48,17 +48,18 @@
  * sampler skips them.
  */
 
-var fs = require("fs");
-var path = require("path");
+var nodeFs = require("fs");
+var nodePath = require("path");
 var { DatabaseSync } = require("node:sqlite");
 var atomicFile = require("../atomic-file");
+var safeSql = require("../safe-sql");
 var C = require("../constants");
 var cryptoField = require("../crypto-field");
-var cryptoLib = require("../crypto");
+var bCrypto = require("../crypto");
 var dbSchema = require("../db-schema");
 var lazyRequire = require("../lazy-require");
 var { boot } = require("../log");
-var nb = require("../numeric-bounds");
+var numericBounds = require("../numeric-bounds");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
 var vaultWrap = lazyRequire(function () { return require("./wrap"); });
@@ -108,7 +109,7 @@ function _knownColumnsFor(schema, infraColumns) {
 
 function validateSchemaMatch(db, opts) {
   opts = opts || {};
-  nb.requirePositiveFiniteIntIfPresent(opts.driftSampleLimit,
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.driftSampleLimit,
     "validateSchemaMatch: driftSampleLimit", VaultRotateError, "vault-rotate/bad-opt");
   var sampleLimit = opts.driftSampleLimit !== undefined
     ? opts.driftSampleLimit : DEFAULT_DRIFT_SAMPLE_LIMIT;
@@ -253,7 +254,7 @@ function verify(opts) {
   var keys       = opts.keys;
   var db         = opts.db;
   var oldKeys    = opts.oldKeys || null;
-  nb.requirePositiveFiniteIntIfPresent(opts.sampleMin,
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.sampleMin,
     "verify: sampleMin", VaultRotateError, "vault-rotate/bad-opt");
   var sampleMin  = opts.sampleMin !== undefined
     ? opts.sampleMin : DEFAULT_VERIFY_SAMPLE_MIN;
@@ -262,7 +263,7 @@ function verify(opts) {
        opts.samplePercent <= 0)) {
     throw new VaultRotateError("vault-rotate/bad-opt",
       "verify: samplePercent must be a positive finite fraction; got " +
-      nb.shape(opts.samplePercent));
+      numericBounds.shape(opts.samplePercent));
   }
   var samplePct  = opts.samplePercent !== undefined
     ? opts.samplePercent : DEFAULT_VERIFY_SAMPLE_FRAC;
@@ -310,7 +311,7 @@ function verify(opts) {
         if (typeof v !== "string" || v.indexOf(VAULT_PREFIX) !== 0) continue;
         var payload = v.substring(VAULT_PREFIX.length);
 
-        try { cryptoLib.decrypt(payload, keys); }
+        try { bCrypto.decrypt(payload, keys); }
         catch (e) {
           rowFailed = true;
           failures.push({
@@ -323,7 +324,7 @@ function verify(opts) {
 
         if (oldKeys && !foundOldFail) {
           try {
-            cryptoLib.decrypt(payload, oldKeys);
+            bCrypto.decrypt(payload, oldKeys);
             regressions.push({
               table:  table,
               column: col,
@@ -390,8 +391,8 @@ function _emit(cb, ev) {
 // the original write fd around.
 function _fsyncFileByPath(p) {
   try {
-    var fd = fs.openSync(p, "r+");
-    try { fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    var fd = nodeFs.openSync(p, "r+");
+    try { nodeFs.fsyncSync(fd); } finally { nodeFs.closeSync(fd); }
   } catch (_e) { /* best-effort across platforms */ }
 }
 
@@ -399,8 +400,8 @@ function _reSealValue(sealedValue, oldKeys, newKeys) {
   if (typeof sealedValue !== "string") return sealedValue;
   if (sealedValue.indexOf(C.VAULT_PREFIX) !== 0) return sealedValue;
   var payload = sealedValue.substring(VAULT_PREFIX_LEN);
-  var plain = cryptoLib.decrypt(payload, oldKeys);
-  return C.VAULT_PREFIX + cryptoLib.encrypt(plain, newKeys);
+  var plain = bCrypto.decrypt(payload, oldKeys);
+  return C.VAULT_PREFIX + bCrypto.encrypt(plain, newKeys);
 }
 
 // Walk a JSON-decoded value, re-sealing every vault-prefixed string.
@@ -437,8 +438,11 @@ function _walkAndReSeal(node, oldKeys, newKeys) {
 function _runStmt(db, sql) { db.prepare(sql).run(); }
 
 function _rotateColumn(db, table, column, oldKeys, newKeys, batchSize, progress) {
-  var qt = '"' + table.replace(/"/g, '""') + '"';
-  var qc = '"' + column.replace(/"/g, '""') + '"';
+  // Identifiers reach SQL through safeSql.quoteIdentifier — runs
+  // validateIdentifier (rejects bad shape / reserved words /
+  // sqlite_-prefix) + emits the dialect-correct quoted form.
+  var qt = safeSql.quoteIdentifier(table, "sqlite");
+  var qc = safeSql.quoteIdentifier(column, "sqlite");
   var total = db.prepare("SELECT COUNT(*) AS n FROM " + qt + " WHERE " + qc + " IS NOT NULL").get().n;
   if (total === 0) return 0;
 
@@ -526,12 +530,12 @@ async function rotate(opts) {
     throw new VaultRotateError("vault-rotate/no-keys",
       "rotate: opts.oldKeys and opts.newKeys are required");
   }
-  if (typeof opts.dataDir !== "string" || !fs.existsSync(opts.dataDir)) {
+  if (typeof opts.dataDir !== "string" || !nodeFs.existsSync(opts.dataDir)) {
     throw new VaultRotateError("vault-rotate/no-datadir",
       "rotate: opts.dataDir is required and must exist");
   }
   validateOpts.requireNonEmptyString(opts.stagingDir, "rotate: opts.stagingDir", VaultRotateError, "vault-rotate/no-staging");
-  if (fs.existsSync(opts.stagingDir)) {
+  if (nodeFs.existsSync(opts.stagingDir)) {
     throw new VaultRotateError("vault-rotate/staging-exists",
       "rotate: stagingDir already exists: " + opts.stagingDir);
   }
@@ -567,30 +571,30 @@ async function rotate(opts) {
   _emit(progress, { phase: "copy_verbatim" });
   for (var vf = 0; vf < paths.verbatimFiles.length; vf++) {
     var entry = paths.verbatimFiles[vf];
-    var src = path.join(dataDir, entry.relativePath);
-    if (!fs.existsSync(src)) {
+    var src = nodePath.join(dataDir, entry.relativePath);
+    if (!nodeFs.existsSync(src)) {
       if (entry.required) {
         throw new VaultRotateError("vault-rotate/missing-verbatim",
           "rotate: required verbatim file missing: " + entry.relativePath);
       }
       continue;
     }
-    var dest = path.join(stagingDir, entry.relativePath);
-    atomicFile.ensureDir(path.dirname(dest));
-    fs.copyFileSync(src, dest);
+    var dest = nodePath.join(stagingDir, entry.relativePath);
+    atomicFile.ensureDir(nodePath.dirname(dest));
+    nodeFs.copyFileSync(src, dest);
   }
   for (var vd = 0; vd < paths.verbatimDirs.length; vd++) {
     var dent = paths.verbatimDirs[vd];
-    var sdir = path.join(dataDir, dent.relativePath);
-    if (!fs.existsSync(sdir)) {
+    var sdir = nodePath.join(dataDir, dent.relativePath);
+    if (!nodeFs.existsSync(sdir)) {
       if (dent.required) {
         throw new VaultRotateError("vault-rotate/missing-verbatim-dir",
           "rotate: required verbatim dir missing: " + dent.relativePath);
       }
       continue;
     }
-    if (fs.existsSync(sdir)) {
-      atomicFile.copyDirRecursive(sdir, path.join(stagingDir, dent.relativePath));
+    if (nodeFs.existsSync(sdir)) {
+      atomicFile.copyDirRecursive(sdir, nodePath.join(stagingDir, dent.relativePath));
     }
   }
 
@@ -599,59 +603,59 @@ async function rotate(opts) {
   var keysJson = JSON.stringify(newKeys, null, 2);
   if (mode === "wrapped") {
     var sealed = await vaultWrap().wrap(keysJson, opts.newPassphrase);
-    fs.writeFileSync(path.join(stagingDir, paths.vaultKeySealed), sealed, { mode: 0o600 });
+    nodeFs.writeFileSync(nodePath.join(stagingDir, paths.vaultKeySealed), sealed, { mode: 0o600 });
   } else {
-    fs.writeFileSync(path.join(stagingDir, paths.vaultKeyPlain), keysJson, { mode: 0o600 });
+    nodeFs.writeFileSync(nodePath.join(stagingDir, paths.vaultKeyPlain), keysJson, { mode: 0o600 });
   }
 
   // 3. re-seal db.key.enc + any operator-supplied additionalSealed files
   _emit(progress, { phase: "reseal_files" });
-  var dbKeySealedPath = path.join(dataDir, paths.dbKeySealed);
+  var dbKeySealedPath = nodePath.join(dataDir, paths.dbKeySealed);
   var dbKey = null;
-  if (fs.existsSync(dbKeySealedPath)) {
-    var sealedKey = fs.readFileSync(dbKeySealedPath, "utf8").trim();
+  if (nodeFs.existsSync(dbKeySealedPath)) {
+    var sealedKey = nodeFs.readFileSync(dbKeySealedPath, "utf8").trim();
     if (sealedKey.indexOf(C.VAULT_PREFIX) !== 0) {
       throw new VaultRotateError("vault-rotate/bad-dbkey",
         "rotate: db.key.enc does not start with the vault prefix");
     }
-    var dbKeyB64 = cryptoLib.decrypt(sealedKey.substring(VAULT_PREFIX_LEN), oldKeys);
+    var dbKeyB64 = bCrypto.decrypt(sealedKey.substring(VAULT_PREFIX_LEN), oldKeys);
     dbKey = Buffer.from(dbKeyB64, "base64");
-    var resealedKey = C.VAULT_PREFIX + cryptoLib.encrypt(dbKeyB64, newKeys);
-    fs.writeFileSync(path.join(stagingDir, paths.dbKeySealed), resealedKey, { mode: 0o600 });
+    var resealedKey = C.VAULT_PREFIX + bCrypto.encrypt(dbKeyB64, newKeys);
+    nodeFs.writeFileSync(nodePath.join(stagingDir, paths.dbKeySealed), resealedKey, { mode: 0o600 });
   }
   for (var as = 0; as < paths.additionalSealed.length; as++) {
     var ase = paths.additionalSealed[as];
-    var asSrc = path.join(dataDir, ase.relativePath);
-    if (!fs.existsSync(asSrc)) {
+    var asSrc = nodePath.join(dataDir, ase.relativePath);
+    if (!nodeFs.existsSync(asSrc)) {
       if (ase.required) {
         throw new VaultRotateError("vault-rotate/missing-sealed",
           "rotate: required sealed file missing: " + ase.relativePath);
       }
       continue;
     }
-    var current = fs.readFileSync(asSrc, "utf8").trim();
+    var current = nodeFs.readFileSync(asSrc, "utf8").trim();
     if (current.indexOf(C.VAULT_PREFIX) !== 0) {
       throw new VaultRotateError("vault-rotate/bad-sealed",
         "rotate: sealed file does not start with the vault prefix: " + ase.relativePath);
     }
-    var asDestDir = path.join(stagingDir, path.dirname(ase.relativePath));
-    if (!fs.existsSync(asDestDir)) atomicFile.ensureDir(asDestDir);
-    fs.writeFileSync(path.join(stagingDir, ase.relativePath),
+    var asDestDir = nodePath.join(stagingDir, nodePath.dirname(ase.relativePath));
+    if (!nodeFs.existsSync(asDestDir)) atomicFile.ensureDir(asDestDir);
+    nodeFs.writeFileSync(nodePath.join(stagingDir, ase.relativePath),
       _reSealValue(current, oldKeys, newKeys), { mode: 0o600 });
   }
 
   // 4. decrypt + rotate + re-encrypt db.enc
   _emit(progress, { phase: "rotate_db" });
-  var encDbPath = path.join(dataDir, paths.encryptedDb);
+  var encDbPath = nodePath.join(dataDir, paths.encryptedDb);
   var tablesProcessed = 0;
   var totalRowsProcessed = 0;
   var verifyResult = null;
 
-  if (fs.existsSync(encDbPath) && dbKey) {
-    var packed = fs.readFileSync(encDbPath);
-    var plainBytes = cryptoLib.decryptPacked(packed, dbKey);
-    var tmpDbPath = path.join(stagingDir, "_blamejs_rotate.tmp.db");
-    fs.writeFileSync(tmpDbPath, plainBytes, { mode: 0o600 });
+  if (nodeFs.existsSync(encDbPath) && dbKey) {
+    var packed = nodeFs.readFileSync(encDbPath);
+    var plainBytes = bCrypto.decryptPacked(packed, dbKey);
+    var tmpDbPath = nodePath.join(stagingDir, "_blamejs_rotate.tmp.db");
+    nodeFs.writeFileSync(tmpDbPath, plainBytes, { mode: 0o600 });
 
     var db = new DatabaseSync(tmpDbPath);
     try {
@@ -704,32 +708,32 @@ async function rotate(opts) {
     // sidecar may be absent (depending on whether journal_mode produced
     // one for this run); log at debug so the cleanup attempt isn't
     // silently swallowed when something genuinely unexpected fails.
-    try { fs.unlinkSync(tmpDbPath + "-wal"); }
-    catch (e) { rotateLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: tmpDbPath + "-wal", error: e.message }); }
-    try { fs.unlinkSync(tmpDbPath + "-shm"); }
-    catch (e) { rotateLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: tmpDbPath + "-shm", error: e.message }); }
+    try { nodeFs.unlinkSync(tmpDbPath + "-wal"); }
+    catch (e) { rotateLog.debug("cleanup-failed", { op: "nodeFs.unlinkSync", path: tmpDbPath + "-wal", error: e.message }); }
+    try { nodeFs.unlinkSync(tmpDbPath + "-shm"); }
+    catch (e) { rotateLog.debug("cleanup-failed", { op: "nodeFs.unlinkSync", path: tmpDbPath + "-shm", error: e.message }); }
 
-    var rotatedBytes = fs.readFileSync(tmpDbPath);
-    fs.writeFileSync(path.join(stagingDir, paths.encryptedDb),
-      cryptoLib.encryptPacked(rotatedBytes, dbKey));
-    fs.unlinkSync(tmpDbPath);
+    var rotatedBytes = nodeFs.readFileSync(tmpDbPath);
+    nodeFs.writeFileSync(nodePath.join(stagingDir, paths.encryptedDb),
+      bCrypto.encryptPacked(rotatedBytes, dbKey));
+    nodeFs.unlinkSync(tmpDbPath);
 
     // Round-trip verify on the staged DB
     _emit(progress, { phase: "verify" });
-    var verifyTmp = path.join(stagingDir, "_blamejs_verify.tmp.db");
-    fs.writeFileSync(verifyTmp,
-      cryptoLib.decryptPacked(fs.readFileSync(path.join(stagingDir, paths.encryptedDb)), dbKey));
+    var verifyTmp = nodePath.join(stagingDir, "_blamejs_verify.tmp.db");
+    nodeFs.writeFileSync(verifyTmp,
+      bCrypto.decryptPacked(nodeFs.readFileSync(nodePath.join(stagingDir, paths.encryptedDb)), dbKey));
     var vdb = new DatabaseSync(verifyTmp);
     try {
       verifyResult = verify({ keys: newKeys, db: vdb, oldKeys: oldKeys });
     } finally {
       vdb.close();
-      try { fs.unlinkSync(verifyTmp); }
-      catch (e) { rotateLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: verifyTmp, error: e.message }); }
-      try { fs.unlinkSync(verifyTmp + "-wal"); }
-      catch (e) { rotateLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: verifyTmp + "-wal", error: e.message }); }
-      try { fs.unlinkSync(verifyTmp + "-shm"); }
-      catch (e) { rotateLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: verifyTmp + "-shm", error: e.message }); }
+      try { nodeFs.unlinkSync(verifyTmp); }
+      catch (e) { rotateLog.debug("cleanup-failed", { op: "nodeFs.unlinkSync", path: verifyTmp, error: e.message }); }
+      try { nodeFs.unlinkSync(verifyTmp + "-wal"); }
+      catch (e) { rotateLog.debug("cleanup-failed", { op: "nodeFs.unlinkSync", path: verifyTmp + "-wal", error: e.message }); }
+      try { nodeFs.unlinkSync(verifyTmp + "-shm"); }
+      catch (e) { rotateLog.debug("cleanup-failed", { op: "nodeFs.unlinkSync", path: verifyTmp + "-shm", error: e.message }); }
     }
     if (!verifyResult.ok) {
       throw new VaultRotateError("vault-rotate/verify-failed",
@@ -743,10 +747,10 @@ async function rotate(opts) {
   // 5. fsync staging for durability before caller does the swap
   _emit(progress, { phase: "fsync" });
   function fsyncTree(dir) {
-    var entries = fs.readdirSync(dir);
+    var entries = nodeFs.readdirSync(dir);
     for (var i = 0; i < entries.length; i++) {
-      var p = path.join(dir, entries[i]);
-      var st = fs.statSync(p);
+      var p = nodePath.join(dir, entries[i]);
+      var st = nodeFs.statSync(p);
       if (st.isFile()) _fsyncFileByPath(p);
       else if (st.isDirectory()) fsyncTree(p);
     }