@blamejs/core 0.9.14 → 0.9.16

package/lib/mtls-ca.js

@@ -52,8 +52,8 @@
  *   Mutual TLS Certificate Authority — internal CA cert issuance, mTLS gate setup, fingerprint pinning.
  */
 
-var fs = require("fs");
-var path = require("path");
+var nodeFs = require("fs");
+var nodePath = require("path");
 var nodeCrypto = require("node:crypto");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
@@ -101,10 +101,10 @@ var VALID_SEAL_MODES = { required: 1, disabled: 1 };
 // through unchanged. The pre-v0.8.58 shape always joined under
 // dataDir, which silently overrode an operator-supplied absolute
 // path (e.g. `MTLS_CA_KEY=/etc/ssl/ca.key` → `<dataDir>/etc/ssl/ca.key`).
-// Standard Node `path.join` semantics already preserve absolute
+// Standard Node `nodePath.join` semantics already preserve absolute
 // arguments — the always-join was an oversight, not by design.
 function _absoluteOrUnderDataDir(dataDir, p) {
-  return path.isAbsolute(p) ? p : path.join(dataDir, p);
+  return nodePath.isAbsolute(p) ? p : nodePath.join(dataDir, p);
 }
 
 function _resolvePaths(dataDir, paths) {
@@ -202,8 +202,8 @@ function create(opts) {
   // the first initCA() / generateClientCert() call fails with ENOENT
   // on `ca.key.tmp` because the atomic-file write expects the parent
   // dir to exist.
-  if (!fs.existsSync(opts.dataDir)) {
-    fs.mkdirSync(opts.dataDir, { recursive: true, mode: 0o700 });
+  if (!nodeFs.existsSync(opts.dataDir)) {
+    nodeFs.mkdirSync(opts.dataDir, { recursive: true, mode: 0o700 });
   }
   var paths = _resolvePaths(opts.dataDir, opts.paths);
   var vault = opts.vault || null;
@@ -228,10 +228,10 @@ function create(opts) {
   }
 
   function keyExists() {
-    return fs.existsSync(paths.caKey) || fs.existsSync(paths.caKeySealed);
+    return nodeFs.existsSync(paths.caKey) || nodeFs.existsSync(paths.caKeySealed);
   }
   function exists() {
-    return keyExists() && fs.existsSync(paths.caCert);
+    return keyExists() && nodeFs.existsSync(paths.caCert);
   }
 
   function status() {
@@ -243,7 +243,7 @@ function create(opts) {
         current:    generation,
       };
     }
-    var pem = fs.readFileSync(paths.caCert);
+    var pem = nodeFs.readFileSync(paths.caCert);
     var gen = parseGeneration(pem);
     return {
       exists:     true,
@@ -257,8 +257,8 @@ function create(opts) {
   // caKeySealedMode dispatch. Returns Buffer of PEM bytes, or throws
   // with a precise reason when the mode rejects the on-disk form.
   function loadKey() {
-    var hasPlain  = fs.existsSync(paths.caKey);
-    var hasSealed = fs.existsSync(paths.caKeySealed);
+    var hasPlain  = nodeFs.existsSync(paths.caKey);
+    var hasSealed = nodeFs.existsSync(paths.caKeySealed);
     if (!hasPlain && !hasSealed) {
       throw new MtlsCaError("mtls-ca/missing-key",
         "no CA key on disk at " + paths.caKey + " or " + paths.caKeySealed);
@@ -269,7 +269,7 @@ function create(opts) {
           "CA_KEY_SEALED='required' but " + paths.caKeySealed + " does not exist");
       }
       _requireVault("sealed CA key load");
-      var sealedBytes = fs.readFileSync(paths.caKeySealed, "utf8").trim();
+      var sealedBytes = nodeFs.readFileSync(paths.caKeySealed, "utf8").trim();
       var pem = vault.unseal(sealedBytes);
       if (!pem) {
         throw new MtlsCaError("mtls-ca/unseal-failed",
@@ -282,15 +282,15 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/plain-required",
         "caKeySealedMode='disabled' but " + paths.caKey + " does not exist");
     }
-    return fs.readFileSync(paths.caKey);
+    return nodeFs.readFileSync(paths.caKey);
   }
 
   function loadCert() {
-    if (!fs.existsSync(paths.caCert)) {
+    if (!nodeFs.existsSync(paths.caCert)) {
       throw new MtlsCaError("mtls-ca/missing-cert",
         "no CA cert on disk at " + paths.caCert);
     }
-    return fs.readFileSync(paths.caCert);
+    return nodeFs.readFileSync(paths.caCert);
   }
 
   // Atomic commit: write .tmp + atomic rename for both key and cert.
@@ -311,22 +311,22 @@ function create(opts) {
     try {
       if (sealed) {
         _requireVault("sealed CA key commit");
-        fs.writeFileSync(keyTmp, vault.seal(opts2.caKeyPem), { mode: 0o600 });
+        nodeFs.writeFileSync(keyTmp, vault.seal(opts2.caKeyPem), { mode: 0o600 });
       } else {
-        fs.writeFileSync(keyTmp, opts2.caKeyPem, { mode: 0o600 });
+        nodeFs.writeFileSync(keyTmp, opts2.caKeyPem, { mode: 0o600 });
       }
-      fs.writeFileSync(certTmp, opts2.caCertPem, { mode: 0o644 });
-      fs.renameSync(keyTmp, keyDest);
-      fs.renameSync(certTmp, paths.caCert);
+      nodeFs.writeFileSync(certTmp, opts2.caCertPem, { mode: 0o644 });
+      nodeFs.renameSync(keyTmp, keyDest);
+      nodeFs.renameSync(certTmp, paths.caCert);
     } catch (e) {
       // Best-effort cleanup of half-written tmp files; the original
       // commit error is what we re-raise. Log cleanup failures at debug
       // so a genuinely-broken filesystem state surfaces in operator logs
       // rather than getting silently swallowed.
-      try { if (fs.existsSync(keyTmp))  fs.unlinkSync(keyTmp); }
-      catch (cleanupErr) { caLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: keyTmp, error: cleanupErr.message }); }
-      try { if (fs.existsSync(certTmp)) fs.unlinkSync(certTmp); }
-      catch (cleanupErr) { caLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: certTmp, error: cleanupErr.message }); }
+      try { if (nodeFs.existsSync(keyTmp))  nodeFs.unlinkSync(keyTmp); }
+      catch (cleanupErr) { caLog.debug("cleanup-failed", { op: "nodeFs.unlinkSync", path: keyTmp, error: cleanupErr.message }); }
+      try { if (nodeFs.existsSync(certTmp)) nodeFs.unlinkSync(certTmp); }
+      catch (cleanupErr) { caLog.debug("cleanup-failed", { op: "nodeFs.unlinkSync", path: certTmp, error: cleanupErr.message }); }
       throw new MtlsCaError("mtls-ca/commit-failed",
         "atomic CA commit failed: " + ((e && e.message) || String(e)));
     }
@@ -381,13 +381,13 @@ function create(opts) {
   // ---- Revocation registry + CRL ----
 
   function _loadRevocations() {
-    if (!fs.existsSync(paths.revocations)) return { revocations: [] };
+    if (!nodeFs.existsSync(paths.revocations)) return { revocations: [] };
     try {
       // safeJson.parse caps depth + size + protects against
       // proto-pollution; the revocation file is under the operator's
       // dataDir but a tampered or truncated file shouldn't be able to
       // corrupt the rotator process.
-      var json = safeJson.parse(fs.readFileSync(paths.revocations, "utf8"),
+      var json = safeJson.parse(nodeFs.readFileSync(paths.revocations, "utf8"),
         { maxBytes: C.BYTES.mib(16) });
       if (!json || !Array.isArray(json.revocations)) return { revocations: [] };
       return json;

package/lib/mtls-engine-default.js

@@ -32,8 +32,8 @@ var nodeCrypto = require("node:crypto");
 var pki = require("./vendor/pki.cjs");
 
 var C = require("./constants");
-var crypto = require("./crypto");
-var nb = require("./numeric-bounds");
+var bCrypto = require("./crypto");
+var numericBounds = require("./numeric-bounds");
 var { FrameworkError } = require("./framework-error");
 
 var x509 = pki.x509;
@@ -231,7 +231,7 @@ async function generateCa(opts) {
   var keys = await webcrypto.subtle.generateKey(CA_KEY_ALG, true, CA_KEY_USAGES);
   var now  = new Date();
   var ca = await x509.X509CertificateGenerator.createSelfSigned({
-    serialNumber: crypto.generateToken(C.BYTES.bytes(16)),
+    serialNumber: bCrypto.generateToken(C.BYTES.bytes(16)),
     name: "CN=" + caName + ",OU=CAv" + generation,
     notBefore: now,
     notAfter: new Date(now.getTime() + C.TIME.days(CA_VALIDITY_DAYS)),
@@ -255,7 +255,7 @@ async function signClientCert(opts) {
     throw new MtlsEngineError("mtls-engine/missing-arg",
       "signClientCert requires { cn, caCertPem, caKeyPem }");
   }
-  nb.requirePositiveFiniteIntIfPresent(opts.validityDays,
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.validityDays,
     "signClientCert: validityDays", MtlsEngineError, "mtls-engine/bad-validity-days");
   var validityDays = opts.validityDays !== undefined
     ? opts.validityDays : LEAF_DEFAULT_DAYS;
@@ -314,7 +314,7 @@ async function signClientCert(opts) {
   if (sanExt) extensions.push(sanExt);
 
   var clientCert = await x509.X509CertificateGenerator.create({
-    serialNumber: crypto.generateToken(C.BYTES.bytes(16)),
+    serialNumber: bCrypto.generateToken(C.BYTES.bytes(16)),
     subject: "CN=" + cn,
     issuer: caCert.subject,
     notBefore: now,

package/lib/network-byte-quota.js

@@ -43,7 +43,7 @@ var defineClass = require("./framework-error").defineClass;
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 
-var auditFwk = lazyRequire(function () { return require("./audit"); });
+var audit = lazyRequire(function () { return require("./audit"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var ByteQuotaError = defineClass("ByteQuotaError", { alwaysPermanent: true });
@@ -181,7 +181,7 @@ function create(opts) {
   function _emitAudit(action, outcome, metadata) {
     if (!auditOn) return;
     try {
-      auditFwk().safeEmit({
+      audit().safeEmit({
         action:   "network.byte_quota." + action,
         outcome:  outcome,
         metadata: metadata || {},

package/lib/network-dns.js

@@ -4,7 +4,7 @@ var dns = require("node:dns");
 var net = require("node:net");
 var nodeCrypto = require("node:crypto");
 var https = require("node:https");
-var tls = require("node:tls");
+var nodeTls = require("node:tls");
 var dnsPromises = dns.promises;
 
 var C = require("./constants");
@@ -561,7 +561,7 @@ function _dotConnect() {
     ecdhCurve:  C.TLS_GROUP_CURVE_STR,
   };
   if (STATE.dot.ca) connectOpts.ca = STATE.dot.ca;
-  var sock = tls.connect(connectOpts);
+  var sock = nodeTls.connect(connectOpts);
   // The pool entry is ref()'d while a query is in flight and unref()'d
   // when idle — _dotLookup toggles this around its query. Calling
   // unref() unconditionally here let node exit during a normal lookup

package/lib/network-nts.js

@@ -1,6 +1,6 @@
 "use strict";
 
-var tls = require("node:tls");
+var nodeTls = require("node:tls");
 var dgram = require("node:dgram");
 var nodeCrypto = require("node:crypto");
 
@@ -258,7 +258,7 @@ function performKeHandshake(opts) {
       ecdhCurve:      C.TLS_GROUP_CURVE_STR,
     };
     if (opts.ca) connectOpts.ca = opts.ca;
-    var sock = tls.connect(connectOpts);
+    var sock = nodeTls.connect(connectOpts);
     var timer = setTimeout(function () {
       try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       done(new NtsError("nts/ke-timeout", "NTS-KE handshake timed out after " + timeoutMs + "ms"));

package/lib/network-proxy.js

@@ -3,7 +3,7 @@
 var http = require("node:http");
 var https = require("node:https");
 var net = require("node:net");
-var tls = require("node:tls");
+var nodeTls = require("node:tls");
 
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
@@ -155,7 +155,7 @@ function _proxyAuthHeader(proxyUrl) {
 function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
   var proxyPort = proxyUrl.port || (proxyUrl.protocol === "https:" ? DEFAULT_HTTPS_PORT : DEFAULT_HTTP_PORT);
   var proxySocket = proxyUrl.protocol === "https:"
-    ? tls.connect({
+    ? nodeTls.connect({
         host:       proxyUrl.hostname,
         port:       proxyPort,
         servername: proxyUrl.hostname,
@@ -212,7 +212,7 @@ function agentFor(targetUrl) {
     agent.createConnection = function (options, cb) {
       _connectThroughTunnel(proxy, options.host, options.port, function (err, tunnel) {
         if (err) return cb(err);
-        var secure = tls.connect({
+        var secure = nodeTls.connect({
           socket:     tunnel,
           servername: options.servername || options.host,
           minVersion: "TLSv1.3",

package/lib/network-smtp-policy.js

@@ -58,7 +58,7 @@ var zlib = require("node:zlib");
 var asn1 = require("./asn1-der");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
-var crypto = require("./crypto");
+var bCrypto = require("./crypto");
 var safeUrl = require("./safe-url");
 var safeJson = require("./safe-json");
 var C = require("./constants");
@@ -561,7 +561,7 @@ function tlsRptRecordShape(opts) {
 
 function _genReportId() {
   // RFC 8460 §4.4 requires uniqueness — use timestamp + random token.
-  return Date.now() + "-" + crypto.generateToken(C.BYTES.bytes(8));
+  return Date.now() + "-" + bCrypto.generateToken(C.BYTES.bytes(8));
 }
 
 // ---- TLS-RPT policy fetch (RFC 8460 §3) ----

package/lib/network-tls.js

@@ -1,12 +1,12 @@
 "use strict";
 
-var tls = require("node:tls");
-var fs = require("node:fs");
-var path = require("node:path");
+var nodeTls = require("node:tls");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
 var net = require("node:net");
 var nodeCrypto = require("node:crypto");
 
-var blamejsCrypto = require("./crypto");
+var bCrypto = require("./crypto");
 var C = require("./constants");
 var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
@@ -85,14 +85,14 @@ function _isPathLike(s) {
 }
 
 function _readPath(p) {
-  var stat = fs.statSync(p);
+  var stat = nodeFs.statSync(p);
   if (stat.isDirectory()) {
-    var files = fs.readdirSync(p)
+    var files = nodeFs.readdirSync(p)
       .filter(function (f) { return /\.(pem|crt|cer)$/i.test(f); })
       .sort();
-    return files.map(function (f) { return fs.readFileSync(path.join(p, f), "utf8"); }).join("\n");
+    return files.map(function (f) { return nodeFs.readFileSync(nodePath.join(p, f), "utf8"); }).join("\n");
   }
-  return fs.readFileSync(p, "utf8");
+  return nodeFs.readFileSync(p, "utf8");
 }
 
 function addCa(pemOrPath, opts) {
@@ -101,7 +101,7 @@ function addCa(pemOrPath, opts) {
   var raw = pemOrPath;
   if (typeof pemOrPath === "string" && _isPathLike(pemOrPath)) {
     var stat;
-    try { stat = fs.statSync(pemOrPath); } catch (_e) {
+    try { stat = nodeFs.statSync(pemOrPath); } catch (_e) {
       throw new TlsTrustError("tls/empty-pem", "tls.addCa: input has no PEM marker and is not a readable path: " +
         pemOrPath);
     }
@@ -408,7 +408,7 @@ function applyToContext(opts) {
   var base = Object.assign({}, opts.base || {});
   var caStrings = STATE.cas.map(function (e) { return e.pem; });
   if (STATE.systemTrust) {
-    var rootCAs = tls.rootCertificates;
+    var rootCAs = nodeTls.rootCertificates;
     if (Array.isArray(rootCAs)) {
       caStrings = caStrings.concat(rootCAs);
     }
@@ -719,7 +719,7 @@ function _connectAndCheckOcsp(opts, requireStapled) {
     var connectOpts = Object.assign({}, opts, { requestOCSP: true });
     var sock;
     try {
-      sock = tls.connect(connectOpts);
+      sock = nodeTls.connect(connectOpts);
     } catch (e) {
       reject(new TlsTrustError("tls/connect-failed",
         "tls.connect threw: " + ((e && e.message) || String(e))));
@@ -1110,7 +1110,7 @@ function evaluateOcspResponse(ocspDer, opts) {
     // critical here (the OCSP response is CA-signed and signature
     // already verified) but matches the project discipline.
     // (Audit 2026-05-11.)
-    if (!blamejsCrypto.timingSafeEqual(parsed.basic.nonce, opts.expectedNonce)) {
+    if (!bCrypto.timingSafeEqual(parsed.basic.nonce, opts.expectedNonce)) {
       return { ok: false, status: parsed.status, signatureValid: true,
                errors: ["OCSP nonce mismatch — possible replay or wrong responder"] };
     }
@@ -2182,7 +2182,7 @@ var ct = Object.freeze({
     if (!Buffer.isBuffer(sthRoot) || sthRoot.length !== 32) {                    // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
       return { valid: false, reason: "bad-sth-root" };
     }
-    if (!blamejsCrypto.timingSafeEqual(computedRoot, sthRoot)) {
+    if (!bCrypto.timingSafeEqual(computedRoot, sthRoot)) {
       return { valid: false, reason: "root-mismatch",
                computedRoot: computedRoot.toString("hex") };
     }
@@ -2201,7 +2201,7 @@ var ct = Object.freeze({
         var computedSecond = _ctVerifyConsistencyPath(
           opts.consistency.firstSize, opts.sthFromLog.treeSize,
           opts.consistency.proof || [], firstRoot);
-        var ok = blamejsCrypto.timingSafeEqual(computedSecond, sthRoot);
+        var ok = bCrypto.timingSafeEqual(computedSecond, sthRoot);
         consistencyResult = {
           ok: ok,
           computedSecondRoot: computedSecond.toString("hex"),
@@ -2256,7 +2256,7 @@ var ct = Object.freeze({
       return { valid: false, reason: "consistency-walk-failed",
                error: (e && e.message) || String(e) };
     }
-    if (!blamejsCrypto.timingSafeEqual(computed, secondRoot)) {
+    if (!bCrypto.timingSafeEqual(computed, secondRoot)) {
       return { valid: false, reason: "root-mismatch",
                computedRoot: computed.toString("hex") };
     }
@@ -2500,7 +2500,7 @@ function _isEchSupported() {
   // immediately-destroyed socket. Any non-throwing path = supported.
   var supported = false;
   try {
-    var probe = tls.connect({
+    var probe = nodeTls.connect({
       host:    "127.0.0.1",
       port:    1,
       ech:     Buffer.alloc(0),
@@ -2651,7 +2651,7 @@ function connectWithEch(opts) {
       }
 
       var sock;
-      try { sock = tls.connect(connectOpts); }
+      try { sock = nodeTls.connect(connectOpts); }
       catch (e) {
         reject(new NetworkTlsError("tls/ech-connect-failed",
           "connectWithEch: tls.connect threw: " + ((e && e.message) || String(e))));

package/lib/network.js

@@ -33,9 +33,9 @@
 var byteQuota = require("./network-byte-quota");
 var ntpCheck = require("./ntp-check");
 var nts      = require("./network-nts");
-var dns      = require("./network-dns");
-var proxy    = require("./network-proxy");
-var trust    = require("./network-tls");
+var networkDns = require("./network-dns");
+var networkProxy = require("./network-proxy");
+var networkTls = require("./network-tls");
 var heartbeat = require("./network-heartbeat");
 var smtpPolicy = require("./network-smtp-policy");
 var ssrfGuard  = require("./ssrf-guard");
@@ -211,31 +211,31 @@ function bootFromEnv(opts) {
   var dnsServers = env.BLAMEJS_DNS_SERVERS;
   if (dnsServers) {
     var dl = String(dnsServers).split(",").map(function (s) { return s.trim(); }).filter(Boolean);
-    if (dl.length > 0) { dns.setServers(dl); applied.dns.servers = dl.length; }
+    if (dl.length > 0) { networkDns.setServers(dl); applied.dns.servers = dl.length; }
   }
-  if (env.BLAMEJS_DNS_RESULT_ORDER)  { dns.setResultOrder(env.BLAMEJS_DNS_RESULT_ORDER); applied.dns.resultOrder = env.BLAMEJS_DNS_RESULT_ORDER; }
-  if (env.BLAMEJS_DNS_FAMILY)        { dns.setFamily(parseInt(env.BLAMEJS_DNS_FAMILY, 10)); applied.dns.family = parseInt(env.BLAMEJS_DNS_FAMILY, 10); }
-  if (env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS) { dns.setLookupTimeoutMs(parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10)); applied.dns.lookupTimeoutMs = parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10); }
-  if (env.BLAMEJS_DNS_CACHE_TTL_MS)      { dns.setCacheTtlMs(parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10)); applied.dns.cacheTtlMs = parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10); }
-  if (env.BLAMEJS_DOH_URL)               { dns.useDnsOverHttps({ url: env.BLAMEJS_DOH_URL }); applied.dns.doh = env.BLAMEJS_DOH_URL; }
-  else if (env.BLAMEJS_DOH_PROVIDER)     { dns.useDnsOverHttps({ provider: env.BLAMEJS_DOH_PROVIDER }); applied.dns.dohProvider = env.BLAMEJS_DOH_PROVIDER; }
-  if (env.BLAMEJS_DOT_HOST)              { dns.useDnsOverTls({ host: env.BLAMEJS_DOT_HOST, port: env.BLAMEJS_DOT_PORT ? parseInt(env.BLAMEJS_DOT_PORT, 10) : 853 }); applied.dns.dot = env.BLAMEJS_DOT_HOST; }
+  if (env.BLAMEJS_DNS_RESULT_ORDER)  { networkDns.setResultOrder(env.BLAMEJS_DNS_RESULT_ORDER); applied.dns.resultOrder = env.BLAMEJS_DNS_RESULT_ORDER; }
+  if (env.BLAMEJS_DNS_FAMILY)        { networkDns.setFamily(parseInt(env.BLAMEJS_DNS_FAMILY, 10)); applied.dns.family = parseInt(env.BLAMEJS_DNS_FAMILY, 10); }
+  if (env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS) { networkDns.setLookupTimeoutMs(parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10)); applied.dns.lookupTimeoutMs = parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10); }
+  if (env.BLAMEJS_DNS_CACHE_TTL_MS)      { networkDns.setCacheTtlMs(parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10)); applied.dns.cacheTtlMs = parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10); }
+  if (env.BLAMEJS_DOH_URL)               { networkDns.useDnsOverHttps({ url: env.BLAMEJS_DOH_URL }); applied.dns.doh = env.BLAMEJS_DOH_URL; }
+  else if (env.BLAMEJS_DOH_PROVIDER)     { networkDns.useDnsOverHttps({ provider: env.BLAMEJS_DOH_PROVIDER }); applied.dns.dohProvider = env.BLAMEJS_DOH_PROVIDER; }
+  if (env.BLAMEJS_DOT_HOST)              { networkDns.useDnsOverTls({ host: env.BLAMEJS_DOT_HOST, port: env.BLAMEJS_DOT_PORT ? parseInt(env.BLAMEJS_DOT_PORT, 10) : 853 }); applied.dns.dot = env.BLAMEJS_DOT_HOST; }
 
   if (env.HTTP_PROXY || env.http_proxy || env.HTTPS_PROXY || env.https_proxy ||
       env.NO_PROXY  || env.no_proxy  || env.ALL_PROXY    || env.all_proxy) {
-    applied.proxy = proxy.fromEnv(env);
+    applied.proxy = networkProxy.fromEnv(env);
   }
 
   if (env.BLAMEJS_EXTRA_CA_CERTS) {
-    trust.addCa(env.BLAMEJS_EXTRA_CA_CERTS, { label: "BLAMEJS_EXTRA_CA_CERTS" });
+    networkTls.addCa(env.BLAMEJS_EXTRA_CA_CERTS, { label: "BLAMEJS_EXTRA_CA_CERTS" });
     applied.tls.fileLoaded = env.BLAMEJS_EXTRA_CA_CERTS;
   }
   if (env.BLAMEJS_EXTRA_CA_CERTS_DIR) {
-    trust.addCaBundle(env.BLAMEJS_EXTRA_CA_CERTS_DIR, { label: "BLAMEJS_EXTRA_CA_CERTS_DIR" });
+    networkTls.addCaBundle(env.BLAMEJS_EXTRA_CA_CERTS_DIR, { label: "BLAMEJS_EXTRA_CA_CERTS_DIR" });
     applied.tls.dirLoaded = env.BLAMEJS_EXTRA_CA_CERTS_DIR;
   }
   if (env.BLAMEJS_USE_SYSTEM_TRUST === "1" || env.BLAMEJS_USE_SYSTEM_TRUST === "true") {
-    trust.useSystemTrust(true);
+    networkTls.useSystemTrust(true);
     applied.tls.systemTrust = true;
   }
 
@@ -286,11 +286,11 @@ function snapshot() {
       servers:     ntpFacade.getServers(),
       thresholds:  ntpCheck.getThresholds(),
     },
-    dns: dns._stateForTest(),
-    proxy: proxy.snapshot(),
+    dns: networkDns._stateForTest(),
+    proxy: networkProxy.snapshot(),
     tls:  {
-      systemTrust: trust.isSystemTrustEnabled(),
-      caCount:     trust.getTrustStore().length,
+      systemTrust: networkTls.isSystemTrustEnabled(),
+      caCount:     networkTls.getTrustStore().length,
     },
     heartbeat: heartbeat.statuses(),
     socket: _socketDefaults(),
@@ -305,9 +305,9 @@ function _resetForTest() {
   ntpFacade._defaultServers = null;
   ntpFacade._defaultTimeoutMs = null;
   if (typeof ntpCheck._resetThresholdsForTest === "function") ntpCheck._resetThresholdsForTest();
-  dns._resetForTest();
-  proxy._resetForTest();
-  trust._resetForTest();
+  networkDns._resetForTest();
+  networkProxy._resetForTest();
+  networkTls._resetForTest();
   heartbeat._resetForTest();
   SOCKET_DEFAULTS.noDelay = true;
   SOCKET_DEFAULTS.keepAlive = true;
@@ -316,9 +316,9 @@ function _resetForTest() {
 
 module.exports = {
   ntp:        ntpFacade,
-  dns:        dns,
-  proxy:      proxy,
-  tls:        trust,
+  dns:        networkDns,
+  proxy:      networkProxy,
+  tls:        networkTls,
   heartbeat:  heartbeat,
   smtp: {
     policy:    smtpPolicy,

package/lib/notify.js

@@ -41,7 +41,7 @@
  */
 
 var lazyRequire = require("./lazy-require");
-var bootLog = require("./log");
+var logModule = require("./log");
 var numericChecks = require("./numeric-checks");
 var requestHelpers = require("./request-helpers");
 var safeAsync = require("./safe-async");
@@ -53,10 +53,10 @@ var { NotifyError } = require("./framework-error");
 // Lazy-required modules to avoid load-order cycles. retry / observability /
 // redact / httpClient don't currently import notify, but treating them
 // the same way every primitive does keeps the load-order story uniform.
-var retryModule = lazyRequire(function () { return require("./retry"); });
+var retryHelper = lazyRequire(function () { return require("./retry"); });
 var observability = lazyRequire(function () { return require("./observability"); });
-var redactModule = lazyRequire(function () { return require("./redact"); });
-var httpClientModule = lazyRequire(function () { return require("./http-client"); });
+var redact = lazyRequire(function () { return require("./redact"); });
+var httpClient = lazyRequire(function () { return require("./http-client"); });
 
 var _err = NotifyError.factory;
 
@@ -222,7 +222,7 @@ function httpJson(opts) {
   return {
     name: name,
     send: async function (message, sendOpts) {
-      var client = customClient || httpClientModule();
+      var client = customClient || httpClient();
       var body;
       var contentType;
       if (bodyFormat === "form") {
@@ -282,14 +282,14 @@ function httpJson(opts) {
 // log — fire-and-forget developer logger. Never throws; audit + obs still emit.
 function logTransport(opts) {
   opts = opts || {};
-  // bootLog.boot() returns a callable with .info / .warn / .error
+  // logModule.boot() returns a callable with .info / .warn / .error
   // attached; that shape satisfies the operator-supplied opts.logger
   // contract directly. No fallback wrapper needed.
   var logger;
   if (opts.logger && typeof opts.logger.info === "function") {
     logger = opts.logger;
   } else {
-    logger = bootLog.boot("notify.log");
+    logger = logModule.boot("notify.log");
   }
   return {
     name: opts.name || "log",
@@ -380,7 +380,7 @@ function create(opts) {
   var redactFn = (typeof opts.redact === "function")
     ? opts.redact
     // Default: b.redact.redact — the framework's PII detector chain.
-    : function (m) { return redactModule().redact(m); };
+    : function (m) { return redact().redact(m); };
   var defaultTimeoutMs = cfg.defaultTimeoutMs;
   var defaultRetry = opts.defaultRetry || null;
   var defaultBreaker = opts.defaultBreaker || null;
@@ -402,7 +402,7 @@ function create(opts) {
     };
     var breakerOpts = entry.breaker || defaultBreaker;
     if (breakerOpts) {
-      registry.breaker = new (retryModule().CircuitBreaker)(n, breakerOpts);
+      registry.breaker = new (retryHelper().CircuitBreaker)(n, breakerOpts);
     }
     if (entry.serialize) registry.mutex = new safeAsync.Mutex();
     channels[n] = registry;
@@ -519,7 +519,7 @@ function create(opts) {
       try {
         // b.retry.withRetry IS the retry loop. Notify never hand-rolls
         // backoff/jitter/classification — the framework owns it.
-        var result = await retryModule().withRetry(function (attempt) {
+        var result = await retryHelper().withRetry(function (attempt) {
           return _attemptSerialized(attempt);
         }, perCallRetry);
 
@@ -647,7 +647,7 @@ function create(opts) {
       mutex:     null,
     };
     var breakerOpts = entry.breaker || defaultBreaker;
-    if (breakerOpts) registry.breaker = new (retryModule().CircuitBreaker)(name, breakerOpts);
+    if (breakerOpts) registry.breaker = new (retryHelper().CircuitBreaker)(name, breakerOpts);
     if (entry.serialize) registry.mutex = new safeAsync.Mutex();
     channels[name] = registry;
   }

package/lib/object-store/gcs-bucket-ops.js

@@ -23,7 +23,7 @@
  * Auth: same service-account JSON / RSA-SHA256-signed JWT exchanged
  * for an OAuth2 access token as `lib/object-store/gcs.js`.
  */
-var fs = require("node:fs");
+var nodeFs = require("node:fs");
 var gcs = require("./gcs");
 var authHeader = require("../auth-header");
 var httpClient = require("../http-client");
@@ -139,7 +139,7 @@ function create(config) {
   var serviceAccount = config.serviceAccount;
   if (!serviceAccount && config.serviceAccountFile) {
     try {
-      serviceAccount = safeJson.parse(fs.readFileSync(config.serviceAccountFile));
+      serviceAccount = safeJson.parse(nodeFs.readFileSync(config.serviceAccountFile));
     } catch (e) {
       throw _err("BAD_OPT", "gcs bucketOps: failed to read serviceAccountFile '" +
         config.serviceAccountFile + "': " + ((e && e.message) || String(e)), true);

package/lib/object-store/gcs.js

@@ -22,12 +22,12 @@
  *   https://cloud.google.com/storage/docs/json_api/v1
  *   https://developers.google.com/identity/protocols/oauth2/service-account
  */
-var fs = require("fs");
+var nodeFs = require("fs");
 var nodeCrypto = require("crypto");
 var { Readable } = require("stream");
 var safeJson = require("../safe-json");
 var C = require("../constants");
-var nb = require("../numeric-bounds");
+var numericBounds = require("../numeric-bounds");
 var requestHelpers = require("../request-helpers");
 var { ObjectStoreError } = require("../framework-error");
 var safeUrl = require("../safe-url");
@@ -125,7 +125,7 @@ function create(config) {
   var serviceAccount = config.serviceAccount;
   if (!serviceAccount && config.serviceAccountFile) {
     try {
-      serviceAccount = safeJson.parse(fs.readFileSync(config.serviceAccountFile), { schema: SERVICE_ACCOUNT_SCHEMA });
+      serviceAccount = safeJson.parse(nodeFs.readFileSync(config.serviceAccountFile), { schema: SERVICE_ACCOUNT_SCHEMA });
     } catch (e) {
       throw new Error("gcs: failed to read serviceAccountFile '" + config.serviceAccountFile + "': " + e.message);
     }
@@ -421,10 +421,10 @@ function create(config) {
         "POST-form policy enforces body size via the content-length-range condition; " +
         "use presignedUploadUrl if size enforcement is not needed", true);
     }
-    if (opts.minBytes !== undefined && !nb.isNonNegativeFiniteInt(opts.minBytes)) {
+    if (opts.minBytes !== undefined && !numericBounds.isNonNegativeFiniteInt(opts.minBytes)) {
       throw _err("INVALID_MIN_BYTES",
         "presignedUploadPolicy: minBytes must be a non-negative finite integer; got " +
-        nb.shape(opts.minBytes), true);
+        numericBounds.shape(opts.minBytes), true);
     }
     var minBytes = opts.minBytes !== undefined ? opts.minBytes : 0;
     var expiresIn = opts.expiresIn != null ? opts.expiresIn : PRESIGN_DEFAULT_EXPIRES_SECONDS;