@blamejs/core 0.9.14 → 0.9.15

package/lib/template.js

@@ -89,8 +89,8 @@
  * is the second line: even if a template loaded, it can't execute
  * arbitrary JS — only the limited expression grammar above.
  */
-var fs = require("fs");
-var path = require("path");
+var nodeFs = require("fs");
+var nodePath = require("path");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 
@@ -149,13 +149,13 @@ function _resolveViewPath(viewsDir, viewName) {
   if (viewName.indexOf("..") !== -1 || viewName.indexOf("\0") !== -1) {
     throw new Error("template: view name contains forbidden character: " + JSON.stringify(viewName));
   }
-  var resolved = path.resolve(viewsDir, viewName + ".html");
-  var resolvedDir = path.resolve(viewsDir);
+  var resolved = nodePath.resolve(viewsDir, viewName + ".html");
+  var resolvedDir = nodePath.resolve(viewsDir);
   if (resolved !== resolvedDir &&
-      !resolved.startsWith(resolvedDir + path.sep)) {
+      !resolved.startsWith(resolvedDir + nodePath.sep)) {
     throw new Error("template: view path escapes viewsDir: " + viewName);
   }
-  if (!fs.existsSync(resolved)) {
+  if (!nodeFs.existsSync(resolved)) {
     throw new Error("template: view not found: " + viewName);
   }
   return resolved;
@@ -164,11 +164,11 @@ function _resolveViewPath(viewsDir, viewName) {
 function _resolvePartialPath(viewsDir, partialName) {
   if (typeof partialName !== "string" || partialName.length === 0) return null;
   if (partialName.indexOf("..") !== -1 || partialName.indexOf("\0") !== -1) return null;
-  var resolved = path.resolve(viewsDir, "partials", partialName + ".html");
-  var partialsDir = path.resolve(viewsDir, "partials");
+  var resolved = nodePath.resolve(viewsDir, "partials", partialName + ".html");
+  var partialsDir = nodePath.resolve(viewsDir, "partials");
   if (resolved !== partialsDir &&
-      !resolved.startsWith(partialsDir + path.sep)) return null;
-  return fs.existsSync(resolved) ? resolved : null;
+      !resolved.startsWith(partialsDir + nodePath.sep)) return null;
+  return nodeFs.existsSync(resolved) ? resolved : null;
 }
 
 // ============================================================
@@ -227,7 +227,7 @@ function _resolveExtends(viewsDir, source) {
       }
     }
     var parentPath = _resolveViewPath(viewsDir, parentName);
-    current = fs.readFileSync(parentPath, "utf8");
+    current = nodeFs.readFileSync(parentPath, "utf8");
     depth++;
   }
   return _substituteBlocks(current, allOverrides);
@@ -245,7 +245,7 @@ function _inlinePartials(viewsDir, source, depth) {
   return source.replace(/\{\{>\s*([A-Za-z_][A-Za-z0-9_-]*)\s*\}\}/g, function (_, name) {
     var p = _resolvePartialPath(viewsDir, name);
     if (!p) return "";   // missing partial → silent empty so a stale `{{> name}}` reference doesn't crash the render
-    return _inlinePartials(viewsDir, fs.readFileSync(p, "utf8"), depth + 1);
+    return _inlinePartials(viewsDir, nodeFs.readFileSync(p, "utf8"), depth + 1);
   });
 }
 
@@ -771,10 +771,10 @@ function create(opts) {
   if (!opts.viewsDir) {
     throw new Error("template.create({ viewsDir }) is required");
   }
-  if (!fs.existsSync(opts.viewsDir)) {
+  if (!nodeFs.existsSync(opts.viewsDir)) {
     throw new Error("template: viewsDir does not exist: " + opts.viewsDir);
   }
-  var viewsDir = path.resolve(opts.viewsDir);
+  var viewsDir = nodePath.resolve(opts.viewsDir);
   var cacheOn = opts.cache !== false;
   var customEscape = typeof opts.escapeHtml === "function" ? opts.escapeHtml : escapeHtml;
   var astCache = {};
@@ -823,7 +823,7 @@ function create(opts) {
   function compile(viewName) {
     if (cacheOn && astCache[viewName]) return astCache[viewName];
     var viewPath = _resolveViewPath(viewsDir, viewName);
-    var source = fs.readFileSync(viewPath, "utf8");
+    var source = nodeFs.readFileSync(viewPath, "utf8");
     source = _resolveExtends(viewsDir, source);
     source = _inlinePartials(viewsDir, source, 0);
     var tokens = _tokenize(source);
@@ -847,12 +847,12 @@ function create(opts) {
   function precompileAll() {
     var compiled = [];
     function walk(dir, prefix) {
-      var entries = fs.readdirSync(dir, { withFileTypes: true });
+      var entries = nodeFs.readdirSync(dir, { withFileTypes: true });
       for (var i = 0; i < entries.length; i++) {
         var e = entries[i];
         var rel = prefix ? prefix + "/" + e.name : e.name;
         if (e.isDirectory()) {
-          walk(path.join(dir, e.name), rel);
+          walk(nodePath.join(dir, e.name), rel);
         } else if (e.isFile() && /\.html$/.test(e.name)) {
           var viewName = rel.replace(/\.html$/, "");
           try {
@@ -890,8 +890,8 @@ function create(opts) {
 var _default = null;
 function _ensureDefault() {
   if (!_default) {
-    var defaultDir = path.resolve(process.cwd(), "views");
-    if (!fs.existsSync(defaultDir)) {
+    var defaultDir = nodePath.resolve(process.cwd(), "views");
+    if (!nodeFs.existsSync(defaultDir)) {
       throw new Error("template.render() default uses <cwd>/views which doesn't exist; " +
         "call template.create({ viewsDir }) for a custom location");
     }

package/lib/testing.js

@@ -42,7 +42,7 @@
  *   Operator-facing test helpers.
  */
 
-var fs = require("node:fs");
+var nodeFs = require("node:fs");
 // testing.js IS the test injector — bypasses b.httpClient by design so
 // tests can assert on raw request shape. This is the one production
 // module where direct http.request is the contract.
@@ -792,9 +792,9 @@ async function waitFor(predicate, opts) {
  * @example
  *   var dir = b.testing.tempDir("my-fixture");
  *   try {
- *     var nodeFs = require("node:fs");
- *     var nodePath2 = require("node:path");
- *     nodeFs.writeFileSync(nodePath2.join(dir.path, "fixture.json"), '{"ok":1}');
+ *     var fs = require("node:fs");
+ *     var path = require("node:path");
+ *     fs.writeFileSync(path.join(dir.path, "fixture.json"), '{"ok":1}');
  *     dir.path.indexOf("my-fixture-") !== -1;     // → true
  *   } finally {
  *     dir.cleanup();
@@ -813,9 +813,9 @@ function tempDir(prefix) {
       "tempDir: prefix must not contain '..', '/', '\\', or null bytes; got " + JSON.stringify(prefix));
   }
   // Path containment check mirroring static.js _resolveSafe — verify
-  // the resolved tempdir is actually inside os.tmpdir() before fs.mkdir.
+  // the resolved tempdir is actually inside os.tmpdir() before nodeFs.mkdir.
   var root = nodePath.resolve(os.tmpdir());
-  var dirPath = fs.mkdtempSync(nodePath.join(root, prefix + "-"));
+  var dirPath = nodeFs.mkdtempSync(nodePath.join(root, prefix + "-"));
   var resolved = nodePath.resolve(dirPath);
   if (resolved !== root && !resolved.startsWith(root + nodePath.sep)) {
     throw _err("BAD_STATE",
@@ -827,7 +827,7 @@ function tempDir(prefix) {
     cleanup: function () {
       if (cleanedUp) return;
       cleanedUp = true;
-      try { fs.rmSync(resolved, { recursive: true, force: true }); }
+      try { nodeFs.rmSync(resolved, { recursive: true, force: true }); }
       catch (_e) { /* best-effort on Windows locked files */ }
     },
   };

package/lib/tls-exporter.js

@@ -31,10 +31,10 @@
  *   RFC 5705 / RFC 9266 TLS Exporter for binding application-layer keys and tokens to the live TLS session.
  */
 
-var crypto = require("./crypto");
+var bCrypto = require("./crypto");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
-var nb = require("./numeric-bounds");
+var numericBounds = require("./numeric-bounds");
 var { TlsExporterError } = require("./framework-error");
 
 var _err = TlsExporterError.factory;
@@ -119,7 +119,7 @@ function fromSocket(socketOrReq, opts) {
   // length is operator-tunable; validate-when-present via numeric-bounds
   // so a non-finite / negative / NaN input surfaces with the same error
   // shape every other framework primitive uses for numeric opts.
-  nb.requirePositiveFiniteIntIfPresent(opts.length,
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.length,
     "tlsExporter.fromSocket: length", TlsExporterError, "BAD_LENGTH");
   var length = opts.length !== undefined ? opts.length : EXPORTER_LENGTH;
   if (length < C.BYTES.bytes(16) || length > C.BYTES.bytes(255)) {
@@ -193,7 +193,7 @@ function bindToken(socketOrReq, token) {
   // does NOT produce the same hash if used in another framework
   // primitive (e.g., the audit-chain row hash).
   var labelBuf = Buffer.from("blamejs/tls-exporter/bind/v1", "utf8");
-  return crypto.sha3Hash(Buffer.concat([labelBuf, exporter, tokenBuf]));
+  return bCrypto.sha3Hash(Buffer.concat([labelBuf, exporter, tokenBuf]));
 }
 
 /**
@@ -226,7 +226,7 @@ function verifyTokenBinding(socketOrReq, token, claimedBinding) {
   if (typeof claimedBinding !== "string" || claimedBinding.length === 0) {
     return false;
   }
-  return crypto.timingSafeEqual(actual, claimedBinding);
+  return bCrypto.timingSafeEqual(actual, claimedBinding);
 }
 
 module.exports = {

package/lib/tracing.js

@@ -39,7 +39,7 @@
  */
 
 var C = require("./constants");
-var crypto = require("./crypto");
+var bCrypto = require("./crypto");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 var { resolveRoute, captureResponseStatus } = require("./request-helpers");
@@ -101,10 +101,10 @@ function _formatTraceparent(traceId, spanId, flags) {
 }
 
 function _newTraceId() {
-  return crypto.generateToken(W3C_TRACE_ID_BYTES);
+  return bCrypto.generateToken(W3C_TRACE_ID_BYTES);
 }
 function _newSpanId() {
-  return crypto.generateToken(W3C_SPAN_ID_BYTES);
+  return bCrypto.generateToken(W3C_SPAN_ID_BYTES);
 }
 
 // ---- Pass-through span (used when OTel isn't installed) ----

package/lib/vault/index.js

@@ -62,8 +62,8 @@
  * @card
  *   Sealed keystore that anchors every other framework subsystem holding secrets at rest: db field encryption, encrypted session storage, audit-log signing keys, OAuth refresh tokens, anything that flows through `b.vault.seal` / `b.vault.unseal`.
  */
-var fs = require("fs");
-var path = require("path");
+var nodeFs = require("fs");
+var nodePath = require("path");
 var atomicFile = require("../atomic-file");
 var C = require("../constants");
 var { generateEncryptionKeyPair, encrypt, decrypt } = require("../crypto");
@@ -99,9 +99,9 @@ var log = boot("vault");
 function resolvePaths(dataDir) {
   return {
     dataDir:           dataDir,
-    plaintext:         path.join(dataDir, "vault.key"),
-    sealed:            path.join(dataDir, "vault.key.sealed"),
-    derivedHashSalt:   path.join(dataDir, "vault.derived-hash-salt"),
+    plaintext:         nodePath.join(dataDir, "vault.key"),
+    sealed:            nodePath.join(dataDir, "vault.key.sealed"),
+    derivedHashSalt:   nodePath.join(dataDir, "vault.derived-hash-salt"),
   };
 }
 
@@ -118,7 +118,7 @@ function _readOrCreateDerivedHashSalt() {
     throw new VaultError("vault/not-initialized",
       "vault.derivedHashSalt() requires init()");
   }
-  if (fs.existsSync(paths.derivedHashSalt)) {
+  if (nodeFs.existsSync(paths.derivedHashSalt)) {
     var raw = atomicFile.readSync(paths.derivedHashSalt);
     if (raw.length !== 32) {                                                       // allow:raw-byte-literal — 32-byte (256-bit) salt
       throw new VaultError("vault/derived-hash-salt-corrupted",
@@ -242,16 +242,16 @@ async function init(opts) {
   currentMode = mode;
   paths = resolvePaths(opts.dataDir);
 
-  if (!fs.existsSync(paths.dataDir)) {
-    fs.mkdirSync(paths.dataDir, { recursive: true });
+  if (!nodeFs.existsSync(paths.dataDir)) {
+    nodeFs.mkdirSync(paths.dataDir, { recursive: true });
   }
 
   // Sweep tmp files left behind by a previously-crashed write
   atomicFile.cleanOrphans(paths.sealed);
   atomicFile.cleanOrphans(paths.plaintext);
 
-  var hasPlaintext = fs.existsSync(paths.plaintext);
-  var hasSealed    = fs.existsSync(paths.sealed);
+  var hasPlaintext = nodeFs.existsSync(paths.plaintext);
+  var hasSealed    = nodeFs.existsSync(paths.sealed);
 
   // Refuse to guess when both files coexist
   if (hasPlaintext && hasSealed) {
@@ -287,7 +287,7 @@ async function init(opts) {
 }
 
 function initPlaintext() {
-  if (fs.existsSync(paths.plaintext)) {
+  if (nodeFs.existsSync(paths.plaintext)) {
     var loaded;
     try {
       loaded = safeJson.parse(atomicFile.readSync(paths.plaintext), {

package/lib/vault/passphrase-ops.js

@@ -35,8 +35,8 @@
  * with the original file untouched.
  */
 
-var fs = require("fs");
-var path = require("path");
+var nodeFs = require("fs");
+var nodePath = require("path");
 var atomicFile = require("../atomic-file");
 var vaultWrap = require("./wrap");
 var { defineClass } = require("../framework-error");
@@ -48,10 +48,10 @@ var SEALED_NAME    = "vault.key.sealed";
 
 function _paths(dataDir) {
   return {
-    plaintext:     path.join(dataDir, PLAINTEXT_NAME),
-    plaintextTmp:  path.join(dataDir, PLAINTEXT_NAME + ".tmp"),
-    sealed:        path.join(dataDir, SEALED_NAME),
-    sealedTmp:     path.join(dataDir, SEALED_NAME + ".tmp"),
+    plaintext:     nodePath.join(dataDir, PLAINTEXT_NAME),
+    plaintextTmp:  nodePath.join(dataDir, PLAINTEXT_NAME + ".tmp"),
+    sealed:        nodePath.join(dataDir, SEALED_NAME),
+    sealedTmp:     nodePath.join(dataDir, SEALED_NAME + ".tmp"),
   };
 }
 
@@ -60,7 +60,7 @@ function _requireDataDir(opts) {
     throw new VaultPassphraseError("vault-passphrase/no-datadir",
       "opts.dataDir is required (path to the framework data directory)");
   }
-  if (!fs.existsSync(opts.dataDir)) {
+  if (!nodeFs.existsSync(opts.dataDir)) {
     throw new VaultPassphraseError("vault-passphrase/no-datadir",
       "opts.dataDir does not exist: " + opts.dataDir);
   }
@@ -80,8 +80,8 @@ function _requirePassphrase(opts, fieldName) {
 // don't have the original write fd around.
 function _fsyncPath(p) {
   try {
-    var fd = fs.openSync(p, "r+");
-    try { atomicFile.fsync(fd); } finally { fs.closeSync(fd); }
+    var fd = nodeFs.openSync(p, "r+");
+    try { atomicFile.fsync(fd); } finally { nodeFs.closeSync(fd); }
   } catch (_e) { /* best-effort across filesystems */ }
 }
 
@@ -90,13 +90,13 @@ function _fsyncPath(p) {
 function preflightSealable(opts) {
   _requireDataDir(opts);
   var p = _paths(opts.dataDir);
-  if (!fs.existsSync(p.plaintext)) {
+  if (!nodeFs.existsSync(p.plaintext)) {
     return { ok: false, reason: "plaintext " + PLAINTEXT_NAME + " does not exist — nothing to seal" };
   }
-  if (fs.existsSync(p.sealed)) {
+  if (nodeFs.existsSync(p.sealed)) {
     return { ok: false, reason: SEALED_NAME + " already exists; refusing to overwrite" };
   }
-  if (fs.existsSync(p.sealedTmp)) {
+  if (nodeFs.existsSync(p.sealedTmp)) {
     return { ok: false, reason: "stale " + SEALED_NAME + ".tmp from a previous crash; remove it manually after verifying the directory state" };
   }
   return { ok: true };
@@ -105,13 +105,13 @@ function preflightSealable(opts) {
 function preflightUnsealable(opts) {
   _requireDataDir(opts);
   var p = _paths(opts.dataDir);
-  if (!fs.existsSync(p.sealed)) {
+  if (!nodeFs.existsSync(p.sealed)) {
     return { ok: false, reason: SEALED_NAME + " does not exist — nothing to unseal" };
   }
-  if (fs.existsSync(p.plaintext)) {
+  if (nodeFs.existsSync(p.plaintext)) {
     return { ok: false, reason: "plaintext " + PLAINTEXT_NAME + " already exists; refusing to overwrite" };
   }
-  if (fs.existsSync(p.plaintextTmp)) {
+  if (nodeFs.existsSync(p.plaintextTmp)) {
     return { ok: false, reason: "stale " + PLAINTEXT_NAME + ".tmp from a previous crash; remove it manually after verifying the directory state" };
   }
   return { ok: true };
@@ -120,10 +120,10 @@ function preflightUnsealable(opts) {
 function preflightRotatable(opts) {
   _requireDataDir(opts);
   var p = _paths(opts.dataDir);
-  if (!fs.existsSync(p.sealed)) {
+  if (!nodeFs.existsSync(p.sealed)) {
     return { ok: false, reason: SEALED_NAME + " does not exist — rotate has nothing to operate on" };
   }
-  if (fs.existsSync(p.sealedTmp)) {
+  if (nodeFs.existsSync(p.sealedTmp)) {
     return { ok: false, reason: "stale " + SEALED_NAME + ".tmp from a previous crash; remove it manually after verifying the directory state" };
   }
   return { ok: true };
@@ -141,39 +141,39 @@ async function seal(opts) {
   var p = _paths(opts.dataDir);
   var keepPlaintext = !!opts.keepPlaintext;
 
-  var plainBytes = fs.readFileSync(p.plaintext);
+  var plainBytes = nodeFs.readFileSync(p.plaintext);
   var sealedBytes = await vaultWrap.wrap(plainBytes, opts.passphrase);
 
   // Step 1: write sealed.tmp + fsync
-  fs.writeFileSync(p.sealedTmp, sealedBytes, { mode: 0o600 });
+  nodeFs.writeFileSync(p.sealedTmp, sealedBytes, { mode: 0o600 });
   _fsyncPath(p.sealedTmp);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify the .tmp before committing the rename
-  var verifyBytes = fs.readFileSync(p.sealedTmp);
+  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
   var unwrapped;
   try {
     unwrapped = await vaultWrap.unwrap(verifyBytes, opts.passphrase);
   } catch (e) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-failed",
       "round-trip verification of sealed file failed: " + ((e && e.message) || String(e)) +
       " — original " + PLAINTEXT_NAME + " is UNCHANGED");
   }
   if (Buffer.compare(unwrapped, plainBytes) !== 0) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
       "round-trip produced different bytes than the original — original " + PLAINTEXT_NAME +
       " is UNCHANGED. Filesystem may be faulty.");
   }
 
   // Step 3: atomic rename sealed.tmp → sealed
-  fs.renameSync(p.sealedTmp, p.sealed);
+  nodeFs.renameSync(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete plaintext (unless keepPlaintext)
   if (!keepPlaintext) {
-    fs.unlinkSync(p.plaintext);
+    nodeFs.unlinkSync(p.plaintext);
     atomicFile.fsyncDir(opts.dataDir);
   }
 
@@ -194,7 +194,7 @@ async function unseal(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = fs.readFileSync(p.sealed);
+  var sealedBytes = nodeFs.readFileSync(p.sealed);
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.passphrase);
@@ -205,25 +205,25 @@ async function unseal(opts) {
   }
 
   // Step 1: write plaintext.tmp + fsync
-  fs.writeFileSync(p.plaintextTmp, plainBytes, { mode: 0o600 });
+  nodeFs.writeFileSync(p.plaintextTmp, plainBytes, { mode: 0o600 });
   _fsyncPath(p.plaintextTmp);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip sanity — re-read tmp and verify
-  var verifyBytes = fs.readFileSync(p.plaintextTmp);
+  var verifyBytes = nodeFs.readFileSync(p.plaintextTmp);
   if (Buffer.compare(verifyBytes, plainBytes) !== 0) {
-    try { fs.unlinkSync(p.plaintextTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.plaintextTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
       "plaintext.tmp re-read differs from in-memory bytes — filesystem may be faulty. " +
       SEALED_NAME + " is UNCHANGED");
   }
 
   // Step 3: atomic rename plaintext.tmp → plaintext
-  fs.renameSync(p.plaintextTmp, p.plaintext);
+  nodeFs.renameSync(p.plaintextTmp, p.plaintext);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete sealed file
-  fs.unlinkSync(p.sealed);
+  nodeFs.unlinkSync(p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   return { plaintextPath: p.plaintext };
@@ -245,7 +245,7 @@ async function rotate(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = fs.readFileSync(p.sealed);
+  var sealedBytes = nodeFs.readFileSync(p.sealed);
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.oldPassphrase);
@@ -257,23 +257,23 @@ async function rotate(opts) {
   var newSealedBytes = await vaultWrap.wrap(plainBytes, opts.newPassphrase);
 
   // Step 1: write new sealed.tmp + fsync
-  fs.writeFileSync(p.sealedTmp, newSealedBytes, { mode: 0o600 });
+  nodeFs.writeFileSync(p.sealedTmp, newSealedBytes, { mode: 0o600 });
   _fsyncPath(p.sealedTmp);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify with NEW passphrase, AND assert unwrap
   // with the OLD passphrase fails — otherwise the rotation didn't take.
-  var verifyBytes = fs.readFileSync(p.sealedTmp);
+  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
   var verifyPlain;
   try { verifyPlain = await vaultWrap.unwrap(verifyBytes, opts.newPassphrase); }
   catch (e) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-failed",
       "round-trip with new passphrase failed: " + ((e && e.message) || String(e)) +
       " — " + SEALED_NAME + " is UNCHANGED");
   }
   if (Buffer.compare(verifyPlain, plainBytes) !== 0) {
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
       "rotated sealed file decrypts under new passphrase but to different bytes — " +
       SEALED_NAME + " is UNCHANGED. Filesystem may be faulty.");
@@ -283,7 +283,7 @@ async function rotate(opts) {
   // input unchanged — refuse to commit.
   try {
     await vaultWrap.unwrap(verifyBytes, opts.oldPassphrase);
-    try { fs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
+    try { nodeFs.unlinkSync(p.sealedTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/rotate-noop",
       "old passphrase still unwraps the new sealed bytes — rotation did not take effect");
   } catch (e) {
@@ -292,7 +292,7 @@ async function rotate(opts) {
   }
 
   // Step 3: atomic rename — swap in the new sealed file
-  fs.renameSync(p.sealedTmp, p.sealed);
+  nodeFs.renameSync(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   return { sealedPath: p.sealed };

package/lib/vault/passphrase-source.js

@@ -23,7 +23,7 @@
  * exposure to later env-dump surfaces. This doesn't zero the memory
  * (JavaScript can't) but does remove the env-object reference.
  */
-var fs = require("fs");
+var nodeFs = require("fs");
 var readline = require("readline");
 var safeEnv = require("../parsers/safe-env");
 var safeBuffer = require("../safe-buffer");
@@ -83,7 +83,7 @@ async function fromFile(filePath, opts) {
   }
   var raw;
   try {
-    raw = fs.readFileSync(filePath);
+    raw = nodeFs.readFileSync(filePath);
   } catch (e) {
     throw new Error("failed to read " + envVars.file + " (" + filePath + "): " + e.code);
   }