@blamejs/core 0.9.14 → 0.9.15

package/lib/dev.js

@@ -11,7 +11,7 @@
  *   spawned app's logs unchanged.
  *
  *   The hot-reload loop spawns the app as a child process, watches the
- *   source directories with `fs.watch({ recursive: true })`, and
+ *   source directories with `nodeFs.watch({ recursive: true })`, and
  *   restarts the child when an unignored file changes. On-disk state
  *   (vault keys, encrypted DB, sealed cookies) survives the restart
  *   because the child re-opens the files; only in-process state is
@@ -41,18 +41,18 @@
  *
  *   Test seams: `opts._spawn(cmd, args, sopts)` and
  *   `opts._watch(dir, wopts, listener)` default to `child_process.spawn`
- *   and `fs.watch`; unit tests pass fakes to drive the engine without
+ *   and `nodeFs.watch`; unit tests pass fakes to drive the engine without
  *   real subprocesses.
  *
  * @card
  *   Dev-mode helpers — hot-reload signal (file watch + child-process restart), route-list dump exposed via `dev.stats()`, and a request inspector courtesy of `stdio: 'inherit'` so the operator sees the spawned app's logs unchanged.
  */
 
-var path = require("path");
-var fs = require("fs");
+var nodePath = require("path");
+var nodeFs = require("fs");
 var lazyRequire = require("./lazy-require");
 var logModule = require("./log");
-var nb = require("./numeric-bounds");
+var numericBounds = require("./numeric-bounds");
 var safeEnv = require("./parsers/safe-env");
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
@@ -166,11 +166,11 @@ function create(opts) {
   var ignore       = Array.isArray(opts.ignore)
     ? DEFAULT_IGNORE.concat(opts.ignore)
     : DEFAULT_IGNORE.slice();
-  nb.requireNonNegativeFiniteIntIfPresent(opts.graceMs,
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.graceMs,
     "dev.create: opts.graceMs", DevError, "dev/bad-grace-ms");
   var graceMs = opts.graceMs !== undefined ? opts.graceMs : DEFAULT_GRACE_MS;
   var killSignal   = typeof opts.killSignal === "string" ? opts.killSignal : DEFAULT_KILL_SIGNAL;
-  nb.requireNonNegativeFiniteIntIfPresent(opts.killTimeoutMs,
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.killTimeoutMs,
     "dev.create: opts.killTimeoutMs", DevError, "dev/bad-kill-timeout-ms");
   var killTimeoutMs = opts.killTimeoutMs !== undefined ? opts.killTimeoutMs : DEFAULT_KILL_TIMEOUT_MS;
   var log          = opts.log || null;
@@ -198,7 +198,7 @@ function create(opts) {
     return childProcess().spawn(cmd, sargs, sopts);
   };
   var watchFn = opts._watch || function (dir, wopts, listener) {
-    return fs.watch(dir, wopts, listener);
+    return nodeFs.watch(dir, wopts, listener);
   };
   var setTimeoutFn  = opts._setTimeout  || setTimeout;
   var clearTimeoutFn = opts._clearTimeout || clearTimeout;
@@ -313,7 +313,7 @@ function create(opts) {
   function _onWatchEvent(dir, eventType, filename) {
     if (!filename) return;
     var rel = String(filename);
-    var full = path.join(dir, rel);
+    var full = nodePath.join(dir, rel);
     if (_matchesAny(ignore, rel) || _matchesAny(ignore, full)) return;
     _scheduleRestart(eventType + ":" + rel);
   }
@@ -321,7 +321,7 @@ function create(opts) {
   function _armWatchers() {
     for (var i = 0; i < watch.length; i++) {
       (function (dir) {
-        var resolved = path.isAbsolute(dir) ? dir : path.resolve(cwd, dir);
+        var resolved = nodePath.isAbsolute(dir) ? dir : nodePath.resolve(cwd, dir);
         var w;
         try {
           w = watchFn(resolved, { recursive: true, persistent: false }, function (eventType, filename) {

package/lib/dr-runbook.js

@@ -42,8 +42,8 @@
  *   Disaster-recovery runbook executor — composes pre-recorded regulatory steps, operator confirmation gates, and the framework's audit chain into a posture-appropriate Markdown runbook a regulator can read alongside `b.audit`.
  */
 
-var fs = require("fs");
-var path = require("path");
+var nodeFs = require("fs");
+var nodePath = require("path");
 var C = require("./constants");
 var atomicFile = require("./atomic-file");
 var lazyRequire = require("./lazy-require");
@@ -333,11 +333,11 @@ async function emit(opts) {
   var body = sections.join("\n");
 
   // Ensure outDir exists.
-  if (!fs.existsSync(opts.outDir)) {
-    fs.mkdirSync(opts.outDir, { recursive: true });
+  if (!nodeFs.existsSync(opts.outDir)) {
+    nodeFs.mkdirSync(opts.outDir, { recursive: true });
   }
   var filename = opts.filename || ("runbook-" + opts.posture + ".md");
-  var outPath = path.join(opts.outDir, filename);
+  var outPath = nodePath.join(opts.outDir, filename);
   atomicFile.writeSync(outPath, body, { fileMode: 0o644 });
 
   if (auditOn) {

package/lib/dual-control.js

@@ -31,7 +31,7 @@
  *   M-of-N approval workflow for destructive operations (eraseHard, key rotation, etc.).
  */
 var lazyRequire = require("./lazy-require");
-var crypto = require("./crypto");
+var bCrypto = require("./crypto");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
 var C = require("./constants");
@@ -261,7 +261,7 @@ function create(opts) {
     if (reasonProblem) {
       return Object.assign({ grantId: null }, reasonProblem);
     }
-    var grantId = "dc-" + crypto.generateToken(C.BYTES.bytes(8));
+    var grantId = "dc-" + bCrypto.generateToken(C.BYTES.bytes(8));
     var nowMs = Date.now();
     var record = {
       grantId:        grantId,

package/lib/external-db-migrate.js

@@ -48,7 +48,7 @@
  *   - externaldb.migrate.lock.acquired   { holder }
  *   - externaldb.migrate.lock.released   { holder }
  */
-var path = require("path");
+var nodePath = require("path");
 var atomicFile = require("./atomic-file");
 var canonicalJson = require("./canonical-json");
 var { sha3Hash } = require("./crypto");
@@ -285,7 +285,7 @@ function _list(dir) {
 }
 
 function _loadMigration(file, dir) {
-  var fullPath = path.join(dir, file);
+  var fullPath = nodePath.join(dir, file);
   // Drop the require cache so a test/dev that edits a file picks up the
   // new content. Matches lib/migrations.js semantics.
   try { delete require.cache[require.resolve(fullPath)]; } catch (_e) { /* not yet cached */ }

package/lib/external-db.js

@@ -754,8 +754,8 @@ async function transaction(fn, opts) {
           if (isTransient && attempt <= maxRetries) {
             _emitMetric("externaldb.transaction.retry", 1,
               { backend: b.name, code: txErr.code, attempt: String(attempt) });
-            var nodeCryptoRetry = require("node:crypto");
-            var jitter = nodeCryptoRetry.randomInt(0, 6);                          // allow:raw-byte-literal — 0-5ms jitter
+            var nodeCrypto = require("node:crypto");
+            var jitter = nodeCrypto.randomInt(0, 6);                          // allow:raw-byte-literal — 0-5ms jitter
             await safeAsync.sleep(attempt * 5 + jitter);                           // allow:raw-time-literal — sub-second backoff
             continue;
           }

package/lib/fdx.js

@@ -85,7 +85,7 @@ var fapi2 = require("./fapi2");
 var C = require("./constants");
 var audit = require("./audit");
 var validateOpts = require("./validate-opts");
-var nb = require("./numeric-bounds");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 var FdxError = defineClass("FdxError", { alwaysPermanent: true });
 
@@ -327,7 +327,7 @@ function consentReceipt(opts) {
     throw FdxError.factory("BAD_SCOPES",
       "fdx.consentReceipt: scopes must be a non-empty array");
   }
-  nb.requirePositiveFiniteIntIfPresent(opts.durationMs,
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.durationMs,
     "fdx.consentReceipt: durationMs", FdxError, "BAD_DURATION");
 
   var issuedAt = Date.now();

package/lib/file-upload.js

@@ -184,12 +184,12 @@
  *     point. Operator wires their scanner of choice.
  */
 
-var fs = require("node:fs");
-var path = require("node:path");
-var stream = require("node:stream");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
+var nodeStream = require("node:stream");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
-var crypto = require("./crypto");
+var bCrypto = require("./crypto");
 var gateContract = require("./gate-contract");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
@@ -250,7 +250,7 @@ function _validateUploadId(id) {
 function _validateCreateOpts(opts) {
   validateOpts.requireObject(opts, "fileUpload.create", FileUploadError);
   validateOpts.requireNonEmptyString(opts.stagingDir, "fileUpload.create: stagingDir", FileUploadError);
-  if (!path.isAbsolute(opts.stagingDir)) {
+  if (!nodePath.isAbsolute(opts.stagingDir)) {
     throw _err("BAD_OPT", "fileUpload.create: stagingDir must be an absolute path, got " +
       JSON.stringify(opts.stagingDir));
   }
@@ -472,10 +472,10 @@ function create(opts) {
   // staging files.
   atomicFile.ensureDir(stagingDir, 0o700);
 
-  function _uploadDir(uploadId) { return path.join(stagingDir, uploadId); }
-  function _chunkPath(uploadId, index) { return path.join(_uploadDir(uploadId), String(index)); }
-  function _receivedPath(uploadId) { return path.join(_uploadDir(uploadId), "_received.json"); }
-  function _metaPath(uploadId) { return path.join(_uploadDir(uploadId), "_meta.json"); }
+  function _uploadDir(uploadId) { return nodePath.join(stagingDir, uploadId); }
+  function _chunkPath(uploadId, index) { return nodePath.join(_uploadDir(uploadId), String(index)); }
+  function _receivedPath(uploadId) { return nodePath.join(_uploadDir(uploadId), "_received.json"); }
+  function _metaPath(uploadId) { return nodePath.join(_uploadDir(uploadId), "_meta.json"); }
 
   function _checkPermission(action, actor) {
     if (!permissions) return;
@@ -491,7 +491,7 @@ function create(opts) {
 
   function _readReceivedIndices(uploadId) {
     var p = _receivedPath(uploadId);
-    if (!fs.existsSync(p)) return [];
+    if (!nodeFs.existsSync(p)) return [];
     try {
       var raw = atomicFile.readSync(p, { maxBytes: SIDECAR_MAX_BYTES });
       var parsed = safeJson.parse(raw.toString("utf8"));
@@ -504,7 +504,7 @@ function create(opts) {
 
   function _readMeta(uploadId) {
     var p = _metaPath(uploadId);
-    if (!fs.existsSync(p)) return null;
+    if (!nodeFs.existsSync(p)) return null;
     try {
       var raw = atomicFile.readSync(p, { maxBytes: SIDECAR_MAX_BYTES });
       return safeJson.parse(raw.toString("utf8"));
@@ -521,7 +521,7 @@ function create(opts) {
   }
 
   function _enumerateUploads() {
-    if (!fs.existsSync(stagingDir)) return [];
+    if (!nodeFs.existsSync(stagingDir)) return [];
     var entries;
     try { entries = atomicFile.listDir(stagingDir, { includeStat: true }); }
     catch (_e) { return []; }
@@ -578,7 +578,7 @@ function create(opts) {
     }
 
     // Refuse re-init of an existing upload (caller-side bug).
-    if (fs.existsSync(_uploadDir(uploadId))) {
+    if (nodeFs.existsSync(_uploadDir(uploadId))) {
       throw _err("UPLOAD_EXISTS",
         "fileUpload.init: upload '" + uploadId + "' already exists; cancel or finalize first");
     }
@@ -675,8 +675,8 @@ function create(opts) {
     }
 
     // Verify chunk hash matches the supplied header.
-    var actualHex = crypto.sha3Hash(body);
-    if (!crypto.timingSafeEqual(actualHex, sha3Hex)) {
+    var actualHex = bCrypto.sha3Hash(body);
+    if (!bCrypto.timingSafeEqual(actualHex, sha3Hex)) {
       _emitObs("fileUpload.chunk_hash_mismatch", 1);
       _emitAudit("fileUpload.chunk_received", {
         actor:    requestHelpers.extractActorContext(actor),
@@ -718,9 +718,9 @@ function create(opts) {
     // Idempotent re-PUT: if this index is already received with a
     // matching body, no-op. Different body = caller bug.
     var p = _chunkPath(uploadId, index);
-    if (fs.existsSync(p)) {
+    if (nodeFs.existsSync(p)) {
       var existing = atomicFile.readSync(p, { maxBytes: maxChunkBytes });
-      if (crypto.timingSafeEqual(crypto.sha3Hash(existing), sha3Hex)) {
+      if (bCrypto.timingSafeEqual(bCrypto.sha3Hash(existing), sha3Hex)) {
         return {
           received:           _readReceivedIndices(uploadId).length,
           totalBytesAccepted: meta.totalBytesAccepted,
@@ -744,8 +744,8 @@ function create(opts) {
     meta.lastChunkAt = clock();
     meta.totalBytesAccepted = (meta.totalBytesAccepted || 0) + body.length;
     if (meta.totalBytesAccepted > maxFileBytes) {
-      // Reclaim staging — the upload exceeded the cap mid-stream.
-      try { fs.rmSync(_uploadDir(uploadId), { recursive: true, force: true }); }
+      // Reclaim staging — the upload exceeded the cap mid-nodeStream.
+      try { nodeFs.rmSync(_uploadDir(uploadId), { recursive: true, force: true }); }
       catch (_e) { /* purgeIncomplete will reclaim */ }
       _emitObs("fileUpload.file_too_large", 1);
       throw _err("FILE_TOO_LARGE",
@@ -824,13 +824,13 @@ function create(opts) {
           SHA3_512_HEX_LENGTH + " chars)");
       }
       var chunkPath = _chunkPath(uploadId, ck.index);
-      if (!fs.existsSync(chunkPath)) {
+      if (!nodeFs.existsSync(chunkPath)) {
         throw _err("MISSING_CHUNK",
           "fileUpload.finalize: chunk " + ck.index + " missing from staging");
       }
       var chunkBody = atomicFile.readSync(chunkPath, { maxBytes: maxChunkBytes });
-      var actualChunkHex = crypto.sha3Hash(chunkBody);
-      if (!crypto.timingSafeEqual(actualChunkHex, ck.sha3)) {
+      var actualChunkHex = bCrypto.sha3Hash(chunkBody);
+      if (!bCrypto.timingSafeEqual(actualChunkHex, ck.sha3)) {
         throw _err("CHUNK_HASH_MISMATCH",
           "fileUpload.finalize: chunk " + ck.index +
           " on-disk SHA3-512 doesn't match manifest");
@@ -849,7 +849,7 @@ function create(opts) {
         " bytes, manifest declares " + manifest.totalBytes);
     }
     var totalHashHex = hasher.digest("hex");
-    if (!crypto.timingSafeEqual(totalHashHex, manifest.sha3)) {
+    if (!bCrypto.timingSafeEqual(totalHashHex, manifest.sha3)) {
       throw _err("MANIFEST_HASH_MISMATCH",
         "fileUpload.finalize: reassembled SHA3-512 doesn't match manifest.sha3");
     }
@@ -911,13 +911,13 @@ function create(opts) {
     // onFinalize reads through to wherever they're piping.
     async function* generate() {
       for (var i = 0; i < paths.length; i += 1) {
-        var fh = fs.createReadStream(paths[i]);
+        var fh = nodeFs.createReadStream(paths[i]);
         for await (var chunk of fh) {
           yield chunk;
         }
       }
     }
-    return stream.Readable.from(generate(), { objectMode: false });
+    return nodeStream.Readable.from(generate(), { objectMode: false });
   }
 
   async function finalize(callerOpts) {
@@ -1034,7 +1034,7 @@ function create(opts) {
       }
     }
     if (contentSafety) {
-      var safetyExt = path.extname(filename).toLowerCase();
+      var safetyExt = nodePath.extname(filename).toLowerCase();
       var safetyGate = contentSafety[safetyExt];
       if (safetyGate && typeof safetyGate.check === "function" && bodyBuffer) {
         var safetyDecision;
@@ -1109,7 +1109,7 @@ function create(opts) {
     }
 
     // Cleanup staging on success.
-    try { fs.rmSync(_uploadDir(uploadId), { recursive: true, force: true }); }
+    try { nodeFs.rmSync(_uploadDir(uploadId), { recursive: true, force: true }); }
     catch (_e) { /* best-effort */ }
 
     _emitObs("fileUpload.finalize_success", 1);
@@ -1175,7 +1175,7 @@ function create(opts) {
     _checkPermission("cancel", callerOpts.actor);
     var meta = _readMeta(uploadId);
     if (!meta) return { ok: false, uploadId: uploadId, reason: "not-found" };
-    try { fs.rmSync(_uploadDir(uploadId), { recursive: true, force: true }); }
+    try { nodeFs.rmSync(_uploadDir(uploadId), { recursive: true, force: true }); }
     catch (_e) { /* best-effort */ }
     _emitObs("fileUpload.cancelled", 1);
     _emitAudit("fileUpload.cancelled", {
@@ -1190,7 +1190,7 @@ function create(opts) {
   // ---- purgeIncomplete ----
 
   function purgeIncomplete() {
-    if (!fs.existsSync(stagingDir)) return { purged: 0, ids: [] };
+    if (!nodeFs.existsSync(stagingDir)) return { purged: 0, ids: [] };
     var now = clock();
     var entries;
     try { entries = atomicFile.listDir(stagingDir, { includeStat: true }); }
@@ -1211,7 +1211,7 @@ function create(opts) {
       }
       if (!purgeReason) continue;
       try {
-        fs.rmSync(e.fullPath, { recursive: true, force: true });
+        nodeFs.rmSync(e.fullPath, { recursive: true, force: true });
         purged.push({ id: e.name, reason: purgeReason });
       } catch (_e2) { /* best-effort; will retry */ }
     }

package/lib/flag-providers.js

@@ -36,7 +36,7 @@
  *   provider.kind   -> "local-file" | "memory" | "environment" | <operator-defined>
  */
 
-var fs = require("fs");
+var nodeFs = require("fs");
 var validateOpts   = require("./validate-opts");
 var lazyRequire    = require("./lazy-require");
 var safeJson       = require("./safe-json");
@@ -128,7 +128,7 @@ function localFile(opts) {
   validateOpts.requireNonEmptyString(opts.path,
     "providers.localFile: path", FlagError, "flag/bad-provider");
   var raw;
-  try { raw = fs.readFileSync(opts.path, "utf8"); }
+  try { raw = nodeFs.readFileSync(opts.path, "utf8"); }
   catch (e) {
     throw new FlagError("flag/bad-provider",
       "providers.localFile: cannot read file " + JSON.stringify(opts.path) +
@@ -152,9 +152,9 @@ function localFile(opts) {
   provider._path = opts.path;
   if (opts.watch === true) {
     try {
-      fs.watch(opts.path, { persistent: false }, function () {
+      nodeFs.watch(opts.path, { persistent: false }, function () {
         try {
-          var nextRaw = fs.readFileSync(opts.path, "utf8");
+          var nextRaw = nodeFs.readFileSync(opts.path, "utf8");
           var nextParsed = safeJson.parse(nextRaw, { maxBytes: C.BYTES.mib(1) });
           if (nextParsed && nextParsed.flags) {
             for (var k in nextParsed.flags) {

package/lib/gate-contract.js

@@ -46,7 +46,7 @@
  */
 
 var C = require("./constants");
-var crypto = require("./crypto");
+var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var validateOpts = require("./validate-opts");
@@ -341,13 +341,13 @@ function defineGate(opts) {
   async function check(ctx) {
     var startedAt = Date.now();
     ctx = ctx || {};
-    if (!ctx.forensicId) ctx.forensicId = crypto.generateToken(FORENSIC_ID_BYTES);
+    if (!ctx.forensicId) ctx.forensicId = bCrypto.generateToken(FORENSIC_ID_BYTES);
 
     // Decision cache lookup (memoize per-forensicHash).
     var bytes = ctx.bytes;
     var forensicHash = bytes && Buffer.isBuffer(bytes)
-      ? crypto.sha3Hash(bytes, "hex")
-      : (typeof bytes === "string" ? crypto.sha3Hash(Buffer.from(bytes, "utf8"), "hex") : null);
+      ? bCrypto.sha3Hash(bytes, "hex")
+      : (typeof bytes === "string" ? bCrypto.sha3Hash(Buffer.from(bytes, "utf8"), "hex") : null);
     var cacheKey = forensicHash ? (opts.name + ":" + ruleHash + ":" + forensicHash) : null;
     if (decisionCache && cacheKey) {
       try {
@@ -555,7 +555,7 @@ function _build(partial) {
 }
 
 function _hashFingerprint(obj) {
-  return crypto.sha3Hash(JSON.stringify(obj), "hex").slice(0, FINGERPRINT_HEX_LENGTH);
+  return bCrypto.sha3Hash(JSON.stringify(obj), "hex").slice(0, FINGERPRINT_HEX_LENGTH);
 }
 
 // ---- Host-side helpers ----

package/lib/graphql-federation.js

@@ -21,9 +21,9 @@
  *   GraphQL federation gateway with SDL trust boundary, sub-graph health, subgraph SDL signing, query plan caps.
  */
 
-var crypto = require("crypto");
+var bCrypto = require("./crypto");
 var C = require("./constants");
-var nb = require("./numeric-bounds");
+var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var safeBuffer = require("./safe-buffer");
 var requestHelpers = require("./request-helpers");
@@ -73,10 +73,7 @@ function _readBearer(req) {
 
 function _timingSafeEqual(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return false;
-  var ab = Buffer.from(a, "utf8");
-  var bb = Buffer.from(b, "utf8");
-  if (ab.length !== bb.length) return false;
-  return crypto.timingSafeEqual(ab, bb);
+  return bCrypto.timingSafeEqual(a, b);
 }
 
 function _readBody(req, errorClass) {
@@ -141,7 +138,7 @@ function guardSdl(opts) {
   }
   var nonceStore = opts.nonceStore && typeof opts.nonceStore.has === "function" &&
                    typeof opts.nonceStore.remember === "function" ? opts.nonceStore : null;
-  nb.requirePositiveFiniteIntIfPresent(opts.nonceTtlMs, "graphqlFederation.guardSdl: opts.nonceTtlMs", errorClass, "BAD_TTL");
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.nonceTtlMs, "graphqlFederation.guardSdl: opts.nonceTtlMs", errorClass, "BAD_TTL");
   var nonceTtlMs = opts.nonceTtlMs || C.TIME.minutes(5);
   var auditOn = opts.audit !== false;
 

package/lib/honeytoken.js

@@ -30,7 +30,7 @@
  *   Framework-seeded canary records that trigger an audit alert on read; integrates with sealed columns.
  */
 
-var crypto = require("./crypto");
+var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -40,10 +40,10 @@ var audit = lazyRequire(function () { return require("./audit"); });
 var HoneytokenError = defineClass("HoneytokenError", { alwaysPermanent: true });
 
 var KINDS = Object.freeze({
-  apiKey:  function () { return "bk_canary_"  + crypto.generateToken(16); },     // allow:raw-byte-literal — 16-byte (128-bit) canary entropy
-  session: function () { return "bks_canary_" + crypto.generateToken(24); },     // allow:raw-byte-literal — 24-byte (192-bit) canary entropy
-  url:     function () { return "/admin/canary-" + crypto.generateToken(16); },  // allow:raw-byte-literal — 16-byte canary entropy
-  rowId:   function () { return "ht_canary_"  + crypto.generateToken(16); },     // allow:raw-byte-literal — 16-byte canary entropy
+  apiKey:  function () { return "bk_canary_"  + bCrypto.generateToken(16); },     // allow:raw-byte-literal — 16-byte (128-bit) canary entropy
+  session: function () { return "bks_canary_" + bCrypto.generateToken(24); },     // allow:raw-byte-literal — 24-byte (192-bit) canary entropy
+  url:     function () { return "/admin/canary-" + bCrypto.generateToken(16); },  // allow:raw-byte-literal — 16-byte canary entropy
+  rowId:   function () { return "ht_canary_"  + bCrypto.generateToken(16); },     // allow:raw-byte-literal — 16-byte canary entropy
 });
 
 /**
@@ -102,7 +102,7 @@ function create(opts) {
         "(supported: " + Object.keys(KINDS).join(", ") + ")");
     }
     var value = KINDS[kind]();
-    var id = "ht_" + crypto.generateToken(8);                                    // allow:raw-byte-literal — 8-byte registry id
+    var id = "ht_" + bCrypto.generateToken(8);                                    // allow:raw-byte-literal — 8-byte registry id
     var record = Object.freeze({
       id:        id,
       kind:      kind,

package/lib/http-client-cookie-jar.js

@@ -60,8 +60,8 @@
  *   }
  */
 
-var fs = require("node:fs");
-var path = require("node:path");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
 var C                = require("./constants");
 var numericBounds    = require("./numeric-bounds");
 var safeAsync        = require("./safe-async");
@@ -181,7 +181,7 @@ function create(opts) {
     filePath = opts.file;
     // Refuse relative paths so a process running in a different cwd
     // doesn't accidentally serialize to a sibling directory.
-    if (!path.isAbsolute(filePath)) {
+    if (!nodePath.isAbsolute(filePath)) {
       throw _err("BAD_OPT",
         "cookieJar.create: opts.file must be an absolute path, got " + JSON.stringify(filePath));
     }
@@ -441,7 +441,7 @@ function create(opts) {
     var rows = getAll();
     var serialized = JSON.stringify(rows);
     var blob = vault ? vault.seal(serialized) : serialized;
-    fs.writeFileSync(filePath, blob);
+    nodeFs.writeFileSync(filePath, blob);
   }
   var flushScheduler = safeAsync.makeScheduledFlush(flushDebounceMs, function () {
     if (!filePath) return;
@@ -477,9 +477,9 @@ function create(opts) {
   // Persist file may be operator-tampered (or vault-sealed) — route through
   // safeJson with an explicit byte cap so a maliciously-large file can't
   // OOM the process before the parse fails.
-  if (filePath && fs.existsSync(filePath)) {
+  if (filePath && nodeFs.existsSync(filePath)) {
     try {
-      var raw = fs.readFileSync(filePath, "utf8");
+      var raw = nodeFs.readFileSync(filePath, "utf8");
       var serialized = vault ? vault.unseal(raw) : raw;
       if (serialized && serialized.length > 0) {
         var rows = safeJson.parse(serialized, { maxBytes: C.BYTES.mib(16) });