@blamejs/core 0.9.15 → 0.9.16

package/CHANGELOG.md

@@ -8,6 +8,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.9.x
 
+- v0.9.16 (2026-05-14) — **Operator-facing prose cleanup + `require-binding-name` detector now covers `lazyRequire` wrappers + dbStore seal round-trip test added.** Post-v0.9.15 audit surfaced three classes of follow-up. (1) **Operator-facing prose leaks (7 sites)** — the v0.9.15 mechanical rename pattern `<OLD>.` → `<NEW>.` also caught occurrences inside JSDoc `@opts` comments and error-message string literals, so operators reading `b.keychain.create(opts)` saw `// absolute nodePath; required if file fallback may engage` instead of `// absolute path`. Fixed: `lib/db.js` (stream-limit error), `lib/keychain.js` (fallback-file error + 3 JSDoc lines), `lib/restore-bundle.js` (staging-dir error), `lib/watcher.js` (fs.watch failure error). Operators see plain English; internal binding names stay internal. (2) **`require-binding-name` detector extended to cover `lazyRequire`** — the v0.9.15 detector only matched plain `var X = require("M")` and missed the framework's `var X = lazyRequire(function () { return require("M"); })` pattern (used to break load cycles). 34 additional inconsistencies surfaced (`auditFwk` / `auditMod` / `auditModule` / `lazyAudit` → `audit`, `crypto` / `fwCrypto` → `bCrypto`, `dbMod` / `dbModule` → `db`, etc.) — every minority site renamed per the same canonical-name map. (3) **dbStore seal round-trip test** — the v0.9.15 test suite covered seal-falls-back-when-vault-not-ready and cross-process-sealed-row-preserved, but did NOT exercise the actual default-ON seal/unseal path because the test environment didn't `b.vault.init(...)`. New `testDbStoreSealRoundTripWithVault` bootstraps a plaintext vault, builds a dbStore with `seal: true`, writes a record + reads it back, and asserts (a) `headers` + `body` columns carry the `vault:` envelope on disk, (b) the round-trip restores the original values, and (c) `status_code` stays plaintext so forensic SELECTs still work without unsealing.
 - v0.9.15 (2026-05-13) — **`b.middleware.idempotencyKey.dbStore` hardening + framework-wide `require()` binding-name consistency.** Two operator-surfaced gaps closed: (1) **dbStore now hashes keys + seals body/headers by default.** Operator-supplied idempotency keys sometimes carry PII (order numbers, emails, vendor prefixes); the `k` column previously stored them raw, leaving every DB dump as a PII surface. v0.9.15 sha3-512 namespace-hashes the key via `b.crypto.namespaceHash("idempotency-key", key)` before insert/lookup — round-trips are transparent (operators still pass raw keys), but the DB never sees the original. The schema also splits the previous single-`v` JSON-envelope column into discrete `fingerprint` / `status_code` / `headers` / `body` / `expires_at` columns; `headers` + `body` are sealed via `b.cryptoField.sealRow` (vault-managed AEAD envelope) when vault is initialized, so a DB dump leaks neither cached response bodies nor headers. Non-sealed columns (`status_code`, `fingerprint`, `expires_at`) stay forensic-queryable. Both defaults are operator-opt-out via `opts.hashKeys: false` and `opts.seal: false`; the seal path silently falls back to plaintext + emits an `idempotency.seal_skipped_no_vault` audit warning on first use when vault isn't ready, so test fixtures and boot scripts still work. **Schema migration**: v0.9.15's split columns are incompatible with v0.9.14's single-`v` column — operators with a v0.9.14 idempotency table `DROP TABLE <tableName>;` (or pick a fresh `tableName`) before upgrading. Pre-v1 framework breaks across patch versions for security correctness. (2) **New `require-binding-name` codebase-patterns detector enforces consistent `var X = require("M")` names framework-wide.** Inconsistent names (`fs` vs `nodeFs`, `crypto` vs `nodeCrypto`, `path` vs `nodePath`, `nb` vs `numericBounds`) made `grep` across the lib unreliable and let reviewers miss shadowing bugs (`var crypto = require("crypto")` collides with the framework's own `b.crypto`). The detector carries a `CANONICAL_REQUIRE_BINDINGS` map with safety-first defaults: Node built-ins get a `node<X>` prefix (`nodeFs` / `nodePath` / `nodeCrypto` / `nodeStream` / `nodeTls` / `nodeUrl`) so a local var named `fs` / `path` / `crypto` can never shadow them; the framework's own `lib/crypto.js` binds as `bCrypto` (matches the `b.crypto` public-namespace shape and doesn't shadow node:crypto). Modules without a declared canonical fall back to majority-wins (most-sites name wins, alphabetical tiebreak). Fix is rename, not allowlist — every minority site was updated. **Sweep**: 184 require-binding renames across 108 framework files in this release; primitives + tests unchanged in surface. (3) **`b.graphqlFederation` internal `_timingSafeEqual` now routes through `b.crypto.timingSafeEqual`** (was re-implementing the length-tolerant wrapper inline; the new require-binding-name detector surfaced this; same-patch fix per the audit-existing-code rule).
 - v0.9.14 (2026-05-13) — **Audit-existing-code sweep: `safeSql.quoteIdentifier` adopted across every framework primitive that interpolates SQL identifiers; new `raw-sql-identifier-interpolation` detector seals the bug class.** Codex P1 on PR #44 flagged that `dbStore.get`'s expired-row cleanup was an unconditional `DELETE WHERE k = ?` between SELECT and DELETE — in a multi-process deployment another process could upsert the same key in the race window, and the unconditional delete would erase the fresh row. Fix: scope the delete by the observed `expires_at`. While reviewing, a wider gap surfaced — every `db.prepare("CREATE TABLE " + tableName + ...)` site in the framework had been concatenating identifiers raw, sometimes with inline shape-regex validation that varied per module. The framework already shipped `b.safeSql.quoteIdentifier(name, dialect?)` for exactly this; per the audit-existing-code rule the same patch (a) routes every site through the helper (`lib/audit.js` segregation-of-duties trigger DDL, `lib/dsr.js` ticket store, `lib/inbox.js` message-receive table, `lib/middleware/idempotency-key.js` dbStore, `lib/vault/rotate.js` column-rotation DDL) and (b) adds a `raw-sql-identifier-interpolation` codebase-patterns detector so the bug class can't return. The detector skips variables whose names signal already-quoted identifiers (`q<X>` / `Q_<X>` / `quoted<X>` prefix), so future primitives that use the helper read naturally. **Plus: bounded JSON parse for two file-/DB-backed primitives.** `b.metrics.snapshot.read` and `b.middleware.idempotencyKey.dbStore.get` previously used bare `JSON.parse` with `allow:bare-json-parse` markers; both are read by processes separate from where they were written (CLI/sidecar reads daemon-written snapshot; multi-process fleet shares DB) where a hostile or misbehaving writer could plant a multi-GB value and OOM the reader. Both now route through `b.safeJson.parse(raw, { maxBytes: 4 MiB })`. **Three new primitives — `b.crypto.hashFilesParallel`, `b.pqcAgent.reload`, `b.middleware.idempotencyKey.dbStore` — plus republish of v0.9.13's surface**. v0.9.13's npm-publish workflow failed at the wiki-e2e gate (the Codex P1 fix removed the `opts` parameter from `b.selfUpdate.standaloneVerifier.verify` but the `@signature` JSDoc still declared four arguments — three vs. four arity drift). The v0.9.13 git tag + GH release reached operators but the npm tarball did not; the registry stayed at v0.9.12. v0.9.14 carries v0.9.13's entire shipped surface (circuitBreaker.create({...}) opts-object fix + `b.selfUpdate.standaloneVerifier` + `b.metrics.snapshot` + `b.retry.withBreaker`) plus three additional Tier 2 primitives surfaced by the same downstream consumer that flagged the v0.9.13 batch. (1) **`b.crypto.hashFilesParallel(filePaths, opts?)`** — parallel multi-digest hashing for many files in a single read pass per file. Worker-pool concurrency cap (default `min(8, paths.length)`, 1..256), operator-tunable `algorithms` list (default `["sha256", "sha3-512"]`), optional `onProgress(completed, total)` callback (throws swallowed). Returns rows in the same order as input. The common consumer-side reason to reach for this is SBOM regeneration / vendor-data integrity sweeps / release-asset bundling — situations where N files each need both SHA-256 (legacy compat) and SHA-3-512 (PQC-first) digests and rolling a worker pool by hand has cost a downstream consumer the same two-loop, capture-N-promises, settle-Q boilerplate every release. (2) **`b.pqcAgent.reload()`** — tear down the lazily-built default agent and reset to null so the next `b.pqcAgent.agent` access rebuilds against current TLS posture + `b.network.tls.applyToContext` output. Long-running daemons that rotate the framework's TLS posture (TLS-pinset reload, certificate-pinset refresh, `C.TLS_GROUP_PREFERENCE` update behind a feature flag) need a way to re-source the outbound `https.Agent` without forking a new process. `reload()` calls `.destroy()` on the existing default agent (Node closes idle keep-alive sockets, lets in-flight sockets complete) then nulls the cache. Agents handed out via explicit `b.pqcAgent.create()` are unaffected. Returns `{ destroyed: boolean }`. (3) **`b.middleware.idempotencyKey.dbStore({ db, tableName?, init? })`** — persistent-backed store for the `idempotencyKey` middleware. Same three-method interface as `memoryStore` (`get` / `set` / `delete`) but stores records in any sqlite-shaped database (`{ prepare(sql) → { run, get, all } }`) — the framework's internal `b.db`, an operator-supplied better-sqlite3 instance, or a custom adapter. Use this instead of `memoryStore` when (a) multiple processes share the request-handling fleet so retries can land on a different process than the original, (b) the daemon may restart between the original request and the retry (graceful rolling deploy, OOM kill), or (c) audit / compliance review needs to walk historic idempotency-cache decisions queryable via `SELECT * FROM <tableName>`. TTL is lazily enforced at read time; `set()` upserts on conflict so concurrent retries on different processes don't error. The `tableName` is validated via `b.safeSql.validateIdentifier` (ASCII identifier shape, 63-char cap, no reserved words). (4) **Internal fix**: `b.apiSnapshot.read` now passes `maxBytes: 64 MiB` to `safeJson.parse` — the framework-generated snapshot file outgrew safeJson's 1 MiB default after v0.9.13. Operators consuming `@blamejs/core` via npm jump from v0.9.12 directly to v0.9.14; v0.9.13's content is included.
 - v0.9.13 (2026-05-13) — **Two `b.circuitBreaker.create` / `b.retry` bug fixes plus three new operator-facing primitives: `b.selfUpdate.standaloneVerifier`, `b.metrics.snapshot`, `b.retry.withBreaker`**. (1) `b.circuitBreaker.create({...})` was rejecting the documented opts-object call shape with `name must be a non-empty string, got object` — every consumer following the docstring hit a hard error. The factory now reads `opts.name` (defaulting to empty string) and forwards to the internal `CircuitBreaker(name, opts)` constructor. (2) The breaker's open-circuit error code was documented as `retry/circuit-open` but the runtime threw `CIRCUIT_OPEN`. The docstring is corrected to match the runtime; an alias rename will follow with a deprecation cycle in a future minor. (3) **`b.selfUpdate.standaloneVerifier`** — zero-dep verifier for install-pipeline contexts that run BEFORE the framework is installed (Dockerfile build stages, `install.sh`, `update.sh`, SEA-bundle verification at deploy time). Surface: `verify(assetPath, sigPath, pubkeyPem, opts?)` returns `{ ok, sha3_512, sha256, alg }`. Streams the asset in 64 KiB chunks through SHA-256 + SHA-3-512 + the signature verifier in parallel — multi-GB SEA bundles don't OOM the install runner. Supports ECDSA P-384 (both IEEE-P1363 96-byte and DER encodings), Ed25519, and ML-DSA-87. Detects signature format from length so `verifier.verify(...)` runs exactly once (calling it twice returns stale state and silently passes tampered assets). Module is hermetic: `node:crypto` + `node:fs` only, no framework imports. Operators copy the file via `cp "$(node -p "require('@blamejs/core').selfUpdate.standaloneVerifier.path")" install/standalone-verifier.js` into version control on their side. (4) **`b.metrics.snapshot`** — out-of-process metrics export for long-running daemons. `startWriter({ path, intervalMs, fields })` atomically flushes a JSON snapshot (first flush synchronous so the file exists by return-time; subsequent flushes on the interval with `.unref()`; `stop()` clears + final-flushes). `read(path)` parses with shape validation (writtenAt + fields). `render(snap, { format, prefix })` produces operator-readable text or Prometheus 0.0.4 exposition (gauge metrics, prefixed; only finite numeric scalars with prom-compatible names emit; invalid-name / non-numeric / non-finite fields skipped silently). Lets a CLI process scrape a daemon's live metrics without opening an HTTP port. (5) **`b.retry.withBreaker(fn, { retry, breaker })`** — composition primitive collapsing the two-line wrapper every consumer rolls: `breaker.wrap(() => retry.withRetry(fn, opts.retry))`. One breaker call per retry loop (the retry budget is INSIDE the breaker's accounting, so a single transient burst doesn't open the breaker spuriously). Throws on non-function `fn` or breaker without `.wrap`.

package/lib/a2a-tasks.js

@@ -92,14 +92,14 @@ function _emitAudit(action, metadata, outcome) {
   } catch (_e) { /* best-effort */ }
 }
 
-var crypto = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 
 // _newTaskId is reserved for the operator-handler path that mints
 // peer-assigned task IDs server-side. The underscore prefix already
 // satisfies the framework's unused-var policy so the helper stays
 // available without an explicit disable directive.
 function _newTaskId() {
-  return crypto().generateToken(12);                                                               // allow:raw-byte-literal — 96-bit task id, not byte arithmetic on payload
+  return bCrypto().generateToken(12);                                                               // allow:raw-byte-literal — 96-bit task id, not byte arithmetic on payload
 }
 
 function _validateTaskShape(task, where) {

package/lib/auth/elevation-grant.js

@@ -36,7 +36,7 @@ var C             = require("../constants");
 var { AuthError } = require("../framework-error");
 
 var audit         = lazyRequire(function () { return require("../audit"); });
-var fwCrypto      = lazyRequire(function () { return require("../crypto"); });
+var bCrypto      = lazyRequire(function () { return require("../crypto"); });
 
 var DEFAULT_TTL_SEC      = C.TIME.minutes(15) / C.TIME.seconds(1);
 var MAX_TTL_SEC          = C.TIME.hours(1)    / C.TIME.seconds(1);
@@ -82,7 +82,7 @@ function _macFor(payloadB64) {
 
 function _timingSafeEqualBuf(a, b) {
   if (!Buffer.isBuffer(a) || !Buffer.isBuffer(b)) return false;
-  return fwCrypto().timingSafeEqual(a, b);
+  return bCrypto().timingSafeEqual(a, b);
 }
 
 function create(opts) {
@@ -128,7 +128,7 @@ function create(opts) {
   }
   var nowSec = (typeof opts.now === "number" && isFinite(opts.now))
     ? opts.now : Math.floor(Date.now() / C.TIME.seconds(1));
-  var jti = fwCrypto().generateBytes(C.BYTES.bytes(16)).toString("base64url");
+  var jti = bCrypto().generateBytes(C.BYTES.bytes(16)).toString("base64url");
   var payload = {
     sub:      opts.subject,
     scope:    opts.scope,

package/lib/auth/fido-mds3.js

@@ -47,8 +47,8 @@ var _wa          = require("../vendor/simplewebauthn-server.cjs");
 var { FidoMds3Error } = require("../framework-error");
 
 var httpClient = lazyRequire(function () { return require("../http-client"); });
-var cacheFwk   = lazyRequire(function () { return require("../cache"); });
-var auditFwk   = lazyRequire(function () { return require("../audit"); });
+var cache      = lazyRequire(function () { return require("../cache"); });
+var audit      = lazyRequire(function () { return require("../audit"); });
 
 var DEFAULT_URL          = "https://mds3.fidoalliance.org/";
 var DEFAULT_TIMEOUT_MS   = C.TIME.seconds(30);
@@ -289,7 +289,7 @@ function _verifyJws(jws, leafCert) {
 var _sharedCache = null;
 function _getCache() {
   if (_sharedCache) return _sharedCache;
-  _sharedCache = cacheFwk().create({
+  _sharedCache = cache().create({
     namespace:  "auth-fido-mds3.blob",
     ttlMs:      MAX_CACHE_TTL_MS,
     maxEntries: 8,                                                                 // allow:raw-byte-literal — operator-pinned URL set
@@ -440,7 +440,7 @@ async function fetch(opts) {   // allow:raw-outbound-http — function name is f
         },
       });
     } catch (e) {
-      try { auditFwk().safeEmit({
+      try { audit().safeEmit({
         action:   "auth.fido_mds3.fetch.network",
         outcome:  "failure",
         metadata: { url: url, reason: (e && e.message) || String(e) },
@@ -482,7 +482,7 @@ async function fetch(opts) {   // allow:raw-outbound-http — function name is f
     // wrap-call's safe-minimum seed).
     try { await c.set(cacheKey, record, _ttlFromNextUpdate(nextUpdate)); }
     catch (_e) { /* cache.set best-effort */ }
-    try { auditFwk().safeEmit({
+    try { audit().safeEmit({
       action:   "auth.fido_mds3.fetch",
       outcome:  "success",
       metadata: { url: url, no: payload.no, entries: payload.entries.length,
@@ -633,7 +633,7 @@ function verifyAuthenticator(blob, registrationInfo, vopts) {
   }
   var certifiedLevel = _certifiedLevel(statusReports);
   if (refusedStatus) {
-    try { auditFwk().safeEmit({
+    try { audit().safeEmit({
       action:   "auth.fido_mds3.verify.refused",
       outcome:  "denied",
       metadata: { aaguid: registrationInfo.aaguid, status: refusedStatus },

package/lib/auth/jwt-external.js

@@ -59,7 +59,7 @@ var { AuthError } = require("../framework-error");
 
 var httpClient = lazyRequire(function () { return require("../http-client"); });
 var cache      = lazyRequire(function () { return require("../cache"); });
-var auditFwk   = lazyRequire(function () { return require("../audit"); });
+var audit      = lazyRequire(function () { return require("../audit"); });
 
 // ---- constants ----
 
@@ -271,7 +271,7 @@ async function verifyExternal(token, opts) {
   // outright. Operators with JWE need a separate handler wired to
   // their KMS — never a defaulted JWE path on the JWS verifier.
   if (parts.length === 5) {
-    try { auditFwk().safeEmit({
+    try { audit().safeEmit({
       action:   "jwt.jwe.refused",
       outcome:  "denied",
       metadata: { reason: "jwe-on-jws-verifier" },

package/lib/compliance.js

@@ -46,11 +46,10 @@ var sanctions = require("./compliance-sanctions");
 var aiAct     = require("./compliance-ai-act");
 var { ComplianceError } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var audit         = lazyRequire(function () { return require("./audit"); });
 var retentionMod  = lazyRequire(function () { return require("./retention"); });
-var auditFwk      = lazyRequire(function () { return require("./audit"); });
-var dbMod         = lazyRequire(function () { return require("./db"); });
-var cryptoFieldMod = lazyRequire(function () { return require("./crypto-field"); });
+var db            = lazyRequire(function () { return require("./db"); });
+var cryptoField   = lazyRequire(function () { return require("./crypto-field"); });
 
 // Recognised posture names. Aligns with the compliance-posture
 // vocabulary every guard / retention floor / etc. accepts. Operators
@@ -371,9 +370,9 @@ function set(posture) {
 function _applyPostureCascade(posture) {
   var steps = [
     { primitive: "retention",   resolver: function () { return retentionMod(); } },
-    { primitive: "audit",       resolver: function () { return auditFwk();    } },
-    { primitive: "db",          resolver: function () { return dbMod();        } },
-    { primitive: "cryptoField", resolver: function () { return cryptoFieldMod(); } },
+    { primitive: "audit",       resolver: function () { return audit();       } },
+    { primitive: "db",          resolver: function () { return db();        } },
+    { primitive: "cryptoField", resolver: function () { return cryptoField(); } },
   ];
   for (var i = 0; i < steps.length; i += 1) {
     var step = steps[i];

package/lib/config.js

@@ -29,7 +29,7 @@ var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var { defineClass } = require("./framework-error");
 
-var lazyAudit = lazyRequire(function () { return require("./audit"); });
+var audit = lazyRequire(function () { return require("./audit"); });
 
 var REDACT_MASK = "[REDACTED]";
 
@@ -349,7 +349,7 @@ function loadDbBacked(opts) {
     try { rows = await opts.fetchRows(); }
     catch (e) {
       try {
-        lazyAudit().safeEmit({
+        audit().safeEmit({
           action: "config.reload.failed", outcome: "failure",
           metadata: { phase: "fetch", reason: e && e.message },
         });
@@ -367,7 +367,7 @@ function loadDbBacked(opts) {
           value = await transformValue(row);
         } catch (e) {
           try {
-            lazyAudit().safeEmit({
+            audit().safeEmit({
               action: "config.reload.failed", outcome: "failure",
               metadata: { phase: "transform", key: row.key, reason: e && e.message },
             });
@@ -376,7 +376,7 @@ function loadDbBacked(opts) {
         }
         if (typeof value !== "string") {
           try {
-            lazyAudit().safeEmit({
+            audit().safeEmit({
               action: "config.reload.failed", outcome: "failure",
               metadata: { phase: "transform", key: row.key, reason: "transformValue did not return a string" },
             });
@@ -390,7 +390,7 @@ function loadDbBacked(opts) {
     // applied its newer fetch — my overlay would clobber fresher data.
     if (mySeq <= ticksAppliedMax) {
       try {
-        lazyAudit().safeEmit({
+        audit().safeEmit({
           action: "config.reload.skipped", outcome: "success",
           metadata: { phase: "stale-tick", mySeq: mySeq, appliedMax: ticksAppliedMax },
         });
@@ -408,7 +408,7 @@ function loadDbBacked(opts) {
     }
     catch (e) {
       try {
-        lazyAudit().safeEmit({
+        audit().safeEmit({
           action: "config.reload.failed", outcome: "failure",
           metadata: { phase: "validate", reason: e && e.message },
         });

package/lib/credential-hash.js

@@ -79,7 +79,7 @@ function _shake256(secret, length) {
 
 // auth/password is required lazily because it imports the (large)
 // argon2 vendor; loading it for SHA3-only callers is wasted work.
-var passwordPrimitive = lazyRequire(function () { return require("./auth/password"); });
+var passwordModule = lazyRequire(function () { return require("./auth/password"); });
 
 class CredentialHashError extends FrameworkError {
   constructor(message, code) {
@@ -219,7 +219,7 @@ async function hash(secret, opts) {
   }
   if (algoId === C.CRED_HASH_IDS.ARGON2ID) {
     var plain = Buffer.isBuffer(secret) ? secret.toString("utf8") : secret;
-    var phc = await passwordPrimitive().hash(plain, opts && opts.params);
+    var phc = await passwordModule().hash(plain, opts && opts.params);
     var argonEnv = _envelope(algoId, Buffer.from(phc, "utf8"));
     _emitEvent("credentialHash.hash", 1, { algo: algoName });
     return argonEnv;
@@ -300,7 +300,7 @@ async function verify(secret, envelope) {
     var phc = decoded.payload.toString("utf8");
     var plain = Buffer.isBuffer(secret) ? secret.toString("utf8") : secret;
     var argOk = false;
-    try { argOk = await passwordPrimitive().verify(phc, plain); }
+    try { argOk = await passwordModule().verify(phc, plain); }
     catch (_e) { argOk = false; }
     _emitEvent("credentialHash.verify", 1,
       { outcome: argOk ? "success" : "failure", algo: algoName });
@@ -377,7 +377,7 @@ function needsRehash(envelope, opts) {
     // Defer the parameter-lag check to the password primitive's
     // own needsRehash so the threshold stays in one place.
     var phc = decoded.payload.toString("utf8");
-    try { return passwordPrimitive().needsRehash(phc, opts && opts.params); }
+    try { return passwordModule().needsRehash(phc, opts && opts.params); }
     catch (_e) { return true; }
   }
   return false;

package/lib/crypto-field.js

@@ -47,9 +47,9 @@ var vault = require("./vault");
 var { sha3Hash, kdf } = require("./crypto");
 var { HASH_PREFIX, VAULT_PREFIX, TIME } = require("./constants");
 
-var complianceMod = lazyRequire(function () { return require("./compliance"); });
-var dbMod         = lazyRequire(function () { return require("./db"); });
-var auditMod      = lazyRequire(function () { return require("./audit"); });
+var compliance    = lazyRequire(function () { return require("./compliance"); });
+var db            = lazyRequire(function () { return require("./db"); });
+var audit         = lazyRequire(function () { return require("./audit"); });
 
 // F-POSTURE-1 cascade hook + F-RTBF-2 integration. Recording the
 // posture lets eraseRow call b.db.vacuumAfterErase({ mode: "full" })
@@ -88,7 +88,7 @@ function applyPosture(posture) {
   _activePosture = posture;
   var requireVacuum = false;
   try {
-    requireVacuum = complianceMod().postureDefault(posture, "requireVacuumAfterErase") === true;
+    requireVacuum = compliance().postureDefault(posture, "requireVacuumAfterErase") === true;
   } catch (_e) { /* compliance not loaded — record posture only */ }
   return { posture: posture, requireVacuumAfterErase: requireVacuum };
 }
@@ -495,14 +495,14 @@ function eraseRow(table, row) {
   if (_activePosture) {
     var requireVacuum = false;
     try {
-      requireVacuum = complianceMod().postureDefault(
+      requireVacuum = compliance().postureDefault(
         _activePosture, "requireVacuumAfterErase") === true;
     } catch (_e) { /* compliance lookup best-effort */ }
     if (requireVacuum) {
       try {
-        var db = dbMod();
-        if (db && typeof db.vacuumAfterErase === "function") {
-          db.vacuumAfterErase({ mode: "full" });
+        var dbInst = db();
+        if (dbInst && typeof dbInst.vacuumAfterErase === "function") {
+          dbInst.vacuumAfterErase({ mode: "full" });
         }
       } catch (_vacErr) {
         // VACUUM is best-effort at the eraseRow seam — DB might not be
@@ -510,7 +510,7 @@ function eraseRow(table, row) {
         // captures the skip; operators on regulated postures wire the
         // sweep through b.retention which gates erasure on db.init().
         try {
-          auditMod().safeEmit({
+          audit().safeEmit({
             action:  "cryptofield.vacuum.skipped",
             outcome: "failure",
             metadata: {

package/lib/db.js

@@ -1479,7 +1479,7 @@ function stream(sql) {
           this.destroy(new DbError("db/stream-limit-exceeded",
             "db.stream: emitted " + emitted + " rows, exceeding streamLimit " +
             perCallLimit + ". Pass opts.streamLimit higher OR raise via " +
-            "db.init({ streamLimit }) after auditing the export nodePath."));
+            "db.init({ streamLimit }) after auditing the export path."));
           return;
         }
         var step = iter.next();

package/lib/external-db-migrate.js

@@ -64,7 +64,7 @@ var ExternalDbMigrateError = defineClass("ExternalDbMigrateError", { alwaysPerma
 
 // Lazy require — external-db imports back into this module via its
 // public `migrate` namespace; load-order would cycle without lazy.
-var externalDbModule = lazyRequire(function () { return require("./external-db"); });
+var externalDb = lazyRequire(function () { return require("./external-db"); });
 
 var TRACKING_TABLE = "_blamejs_externaldb_migrations";
 var LOCK_TABLE     = "_blamejs_externaldb_migrations_lock";
@@ -327,7 +327,7 @@ function _resolveBackendName(opts) {
   }
   // Default to the externalDb's defaultBackend; throw clear if not initialized.
   var listed;
-  try { listed = externalDbModule().listBackends(); }
+  try { listed = externalDb().listBackends(); }
   catch (_e) {
     throw _err("externaldb-migrate/not-initialized",
       "externalDb is not initialized — call b.externalDb.init({ backends }) first");
@@ -363,14 +363,14 @@ function create(opts) {
 
   function _ctx(backendName) {
     return {
-      externalDb:  externalDbModule(),
+      externalDb:  externalDb(),
       backendName: backendName,
     };
   }
 
   async function status() {
     var backendName = _resolveBackendName(opts);
-    return await externalDbModule().transaction(async function (xdb) {
+    return await externalDb().transaction(async function (xdb) {
       await _ensureTrackingTable(xdb);
       var res = await xdb.query(
         "SELECT name, description, appliedAt FROM " + Q_TRACKING +
@@ -394,7 +394,7 @@ function create(opts) {
     var backendName = _resolveBackendName(opts);
     var ctx = _ctx(backendName);
 
-    return await externalDbModule().transaction(async function (xdb) {
+    return await externalDb().transaction(async function (xdb) {
       await _ensureTrackingTable(xdb);
       await _ensureLockTable(xdb);
       await _ensureHistoryTable(xdb);
@@ -404,7 +404,7 @@ function create(opts) {
       // pool acquisition for the lock connection — the migrate runner
       // serializes apply order, so this single-connection lock is
       // sufficient.
-      var lockResult = await externalDbModule().transaction(async function (xdb) {
+      var lockResult = await externalDb().transaction(async function (xdb) {
         return await _acquireLock(xdb, opts);
       }, { backend: backendName });
       var lockHolder = lockResult.holder;
@@ -421,7 +421,7 @@ function create(opts) {
       }
 
       try {
-        var appliedRes = await externalDbModule().query(
+        var appliedRes = await externalDb().query(
           "SELECT name FROM " + Q_TRACKING, [], { backend: backendName }
         );
         var appliedSet = new Set(((appliedRes && appliedRes.rows) || []).map(function (r) { return r.name; }));
@@ -435,7 +435,7 @@ function create(opts) {
           var mod = _loadMigration(file, dir);
           var t0 = Date.now();
           try {
-            await externalDbModule().transaction(async function (xdb) {
+            await externalDb().transaction(async function (xdb) {
               await mod.up(xdb, ctx);
               var ranAt = new Date().toISOString();
               await xdb.query(
@@ -489,7 +489,7 @@ function create(opts) {
         return { applied: applied, skipped: skipped, backend: backendName };
       } finally {
         try {
-          await externalDbModule().transaction(async function (xdb) {
+          await externalDb().transaction(async function (xdb) {
             await _releaseLock(xdb, lockHolder);
           }, { backend: backendName });
           _emit(audit, "externaldb.migrate.lock.released", "success",
@@ -509,12 +509,12 @@ function create(opts) {
     var backendName = _resolveBackendName(opts);
     var ctx = _ctx(backendName);
 
-    await externalDbModule().transaction(async function (xdb) {
+    await externalDb().transaction(async function (xdb) {
       await _ensureTrackingTable(xdb);
       await _ensureLockTable(xdb);
     }, { backend: backendName });
 
-    var lockResultDown = await externalDbModule().transaction(async function (xdb) {
+    var lockResultDown = await externalDb().transaction(async function (xdb) {
       return await _acquireLock(xdb, opts);
     }, { backend: backendName });
     var lockHolder = lockResultDown.holder;
@@ -528,7 +528,7 @@ function create(opts) {
     }
 
     try {
-      var appliedRes = await externalDbModule().query(
+      var appliedRes = await externalDb().query(
         "SELECT name FROM " + Q_TRACKING + " ORDER BY appliedAt DESC, name DESC LIMIT $1",
         [steps], { backend: backendName }
       );
@@ -543,7 +543,7 @@ function create(opts) {
         }
         var t0 = Date.now();
         try {
-          await externalDbModule().transaction(async function (xdb) {
+          await externalDb().transaction(async function (xdb) {
             await mod.down(xdb, ctx);
             await xdb.query(
               "DELETE FROM " + Q_TRACKING + " WHERE name = $1",
@@ -564,7 +564,7 @@ function create(opts) {
       return { reverted: reverted, backend: backendName };
     } finally {
       try {
-        await externalDbModule().transaction(async function (xdb) {
+        await externalDb().transaction(async function (xdb) {
           await _releaseLock(xdb, lockHolder);
         }, { backend: backendName });
         _emit(audit, "externaldb.migrate.lock.released", "success",
@@ -588,7 +588,7 @@ function create(opts) {
   async function history(historyOpts) {
     historyOpts = historyOpts || {};
     var backendName = _resolveBackendName(opts);
-    return await externalDbModule().transaction(async function (xdb) {
+    return await externalDb().transaction(async function (xdb) {
       await _ensureHistoryTable(xdb);
       var res = await xdb.query(
         "SELECT version, ranAt, ranBy, schemaIntrospectionHash, signature, publicKeyFingerprint " +

package/lib/flag-evaluation-context.js

@@ -22,7 +22,7 @@ var lazyRequire   = require("./lazy-require");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
-var fwCrypto = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 
 function _normalize(input, label) {
   if (input == null) return {};
@@ -96,7 +96,7 @@ function fromRequest(req, opts) {
               headers["x-forwarded-for"].split(",")[0].trim()) ||
              (req.connection && req.connection.remoteAddress) || "";
     var ua = headers["user-agent"] || "";
-    tk = "anon:" + fwCrypto().sha3Hash(ip + ":" + ua).slice(0, 16);   // allow:raw-byte-literal — base16 prefix len
+    tk = "anon:" + bCrypto().sha3Hash(ip + ":" + ua).slice(0, 16);   // allow:raw-byte-literal — base16 prefix len
   }
   ctx.targetingKey = tk;
 

package/lib/keychain.js

@@ -161,7 +161,7 @@ function _validateFallbackFile(filepath, primitive) {
     KeychainError, "keychain/bad-fallback-file");
   if (!nodePath.isAbsolute(filepath)) {
     throw new KeychainError("keychain/relative-fallback-file",
-      primitive + ": fallbackFile must be an absolute nodePath; got " + filepath);
+      primitive + ": fallbackFile must be an absolute path; got " + filepath);
   }
 }
 
@@ -613,7 +613,7 @@ function _isFallbackError(e) {
  *     service:       string,        // required, no NUL/CR/LF bytes
  *     account:       string,        // required, no NUL/CR/LF bytes
  *     password:      string,        // required, non-empty
- *     fallbackFile?: string,        // absolute nodePath; required if file fallback may engage
+ *     fallbackFile?: string,        // absolute path; required if file fallback may engage
  *     passphrase?:   string,        // required when fallbackFile engages (Argon2id-derived KEK)
  *     preferFile?:   boolean,       // default: false
  *     audit?:        boolean,       // default: true (emits keychain.stored)
@@ -685,7 +685,7 @@ async function store(opts) {
  *   {
  *     service:       string,        // required
  *     account:       string,        // required
- *     fallbackFile?: string,        // absolute nodePath; required for file-backend lookup
+ *     fallbackFile?: string,        // absolute path; required for file-backend lookup
  *     passphrase?:   string,        // required when fallbackFile engages
  *     preferFile?:   boolean,       // default: false
  *     audit?:        boolean,       // default: true (emits keychain.retrieved)
@@ -781,7 +781,7 @@ async function retrieve(opts) {
  *   {
  *     service:       string,        // required
  *     account:       string,        // required
- *     fallbackFile?: string,        // absolute nodePath; required for file-backend cleanup
+ *     fallbackFile?: string,        // absolute path; required for file-backend cleanup
  *     passphrase?:   string,        // required when fallbackFile engages
  *     preferFile?:   boolean,       // default: false
  *     audit?:        boolean,       // default: true (emits keychain.removed)

package/lib/log.js

@@ -72,7 +72,7 @@ var { FrameworkError } = require("./framework-error");
 //     pulling the whole crypto bundle into the framework's earliest
 //     boot path (request-id middleware needs only generateToken).
 var safeEnv = lazyRequire(function () { return require("./parsers/safe-env"); });
-var crypto  = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 
 // Request-id correlation token — 8 bytes hex-encoded (16 chars). Short
 // enough to read in a log line, long enough to keep collisions far below
@@ -384,7 +384,7 @@ function create(opts) {
           // 16 random hex chars — short, sufficient correlation entropy.
           // Routes through the framework token primitive so the entropy
           // source matches the rest of the codebase.
-          return crypto().generateToken(REQUEST_ID_BYTES);
+          return bCrypto().generateToken(REQUEST_ID_BYTES);
         };
       return function logRequestIdMiddleware(req, res, next) {
         var inbound = req.headers && req.headers[headerName];

package/lib/mail.js

@@ -72,7 +72,7 @@ var net = lazyRequire(function () { return require("net"); });
 var networkDns = lazyRequire(function () { return require("./network-dns"); });
 var nodeUrl = require("url");
 var numericBounds = require("./numeric-bounds");
-var tls = lazyRequire(function () { return require("tls"); });
+var nodeTls = lazyRequire(function () { return require("tls"); });
 var safeJson = require("./safe-json");
 var safeSchema = require("./safe-schema");
 var validateOpts = require("./validate-opts");
@@ -1142,7 +1142,7 @@ function _smtpSend(message, cfg) {
         tlsConnectOpts.host = cfg.host;
         tlsConnectOpts.port = cfg.port;
         if (family === 4 || family === 6) tlsConnectOpts.family = family;
-        attachSocket(tls().connect(tlsConnectOpts));
+        attachSocket(nodeTls().connect(tlsConnectOpts));
       } else {
         var netOpts = { host: cfg.host, port: cfg.port };
         if (family === 4 || family === 6) netOpts.family = family;
@@ -1211,7 +1211,7 @@ function _smtpSend(message, cfg) {
         if (code !== 220) { fail("starttls-rejected (code " + code + ")"); return; }
         var tlsConnectOpts = Object.assign({ socket: socket }, cfg.tlsOpts);
         if (cfg.servername) tlsConnectOpts.servername = cfg.servername;
-        var tlsSocket = tls().connect(tlsConnectOpts, function () {
+        var tlsSocket = nodeTls().connect(tlsConnectOpts, function () {
           upgradedToTLS = true;
           try { socket.removeAllListeners("data"); } catch (_e) { /* listeners migrate to upgraded socket */ }
           attachSocket(tlsSocket);

package/lib/mcp-tool-registry.js

@@ -64,7 +64,7 @@ var lazyRequire   = require("./lazy-require");
 var validateOpts  = require("./validate-opts");
 var { McpError }  = require("./framework-error");
 
-var crypto = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 var audit  = lazyRequire(function () { return require("./audit"); });
 var C      = require("./constants");
 
@@ -202,7 +202,7 @@ function create(opts) {
       outputSchema: tool.outputSchema || null,
       alg:         alg,
     });
-    var sig = crypto().sign(Buffer.from(payload, "utf8"), signingKey);
+    var sig = bCrypto().sign(Buffer.from(payload, "utf8"), signingKey);
     return {
       tool:         tool.name,
       description:  tool.description || "",
@@ -254,7 +254,7 @@ function create(opts) {
       }),
       issuedAt: new Date().toISOString(),
     });
-    var sig = crypto().sign(Buffer.from(manifestBody, "utf8"), signingKey);
+    var sig = bCrypto().sign(Buffer.from(manifestBody, "utf8"), signingKey);
     return {
       body:      manifestBody,
       signature: sig.toString("base64"),
@@ -309,7 +309,7 @@ function create(opts) {
     }
     var nonce = typeof callOpts.nonce === "string" && callOpts.nonce.length > 0
       ? callOpts.nonce
-      : crypto().generateToken(16);                                                                // allow:raw-byte-literal — 128-bit nonce, not byte arithmetic on a payload
+      : bCrypto().generateToken(16);                                                                // allow:raw-byte-literal — 128-bit nonce, not byte arithmetic on a payload
     var iat = new Date();
     var exp = new Date(iat.getTime() + ttlMs);
     var envelope = {
@@ -320,7 +320,7 @@ function create(opts) {
       exp:      exp.toISOString(),
     };
     var payload = Buffer.from(canonicalJson.stringify(envelope), "utf8");
-    var sig = crypto().sign(payload, signingKey);
+    var sig = bCrypto().sign(payload, signingKey);
     _emitAudit("mcp.tool_registry.call_signed",
       { tool: envelope.tool, nonce: nonce, alg: alg });
     return {
@@ -438,7 +438,7 @@ function create(opts) {
         "verifyCall: signature not valid base64");
     }
     var ok;
-    try { ok = crypto().verify(payload, sigBuf, verifyingKey); }
+    try { ok = bCrypto().verify(payload, sigBuf, verifyingKey); }
     catch (verifyErr) {
       _emitAudit("mcp.tool_registry.call_verify_error",
         { tool: env.tool, nonce: env.nonce, error: String(verifyErr.message || verifyErr) }, "denied");

package/lib/middleware/body-parser.js

@@ -123,7 +123,7 @@ var validateOpts    = require("../validate-opts");
 var C = require("../constants");
 var { defineClass } = require("../framework-error");
 
-var auditFwk = lazyRequire(function () { return require("../audit"); });
+var audit = lazyRequire(function () { return require("../audit"); });
 
 // Node's HTTP parser surfaces malformed chunked-transfer-encoding via a
 // stable family of HPE_* codes. RFC 9112 §7.1 — when a server rejects a
@@ -1294,7 +1294,7 @@ function create(opts) {
           ? "http.chunked.extension.refused"
           : "http.chunked.malformed.refused";
         try {
-          auditFwk().safeEmit({
+          audit().safeEmit({
             action:  chunkAction,
             outcome: "denied",
             metadata: {

package/lib/middleware/require-bound-key.js

@@ -52,7 +52,7 @@ var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 
-var crypto = lazyRequire(function () { return require("../crypto"); });
+var bCrypto = lazyRequire(function () { return require("../crypto"); });
 var audit  = lazyRequire(function () { return require("../audit"); });
 
 var RequireBoundKeyError = defineClass("RequireBoundKeyError", { alwaysPermanent: true });
@@ -67,7 +67,7 @@ function _parseBearer(req) {
 function _timingSafeStringEqual(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return false;
   if (a.length !== b.length) return false;
-  return crypto().timingSafeEqual(Buffer.from(a), Buffer.from(b));
+  return bCrypto().timingSafeEqual(Buffer.from(a), Buffer.from(b));
 }
 
 /**
@@ -243,7 +243,7 @@ function create(opts) {
       var fpColon = req.peerFingerprint && req.peerFingerprint.colon;
       if (!fpHex && req.peerCert && req.peerCert.raw) {
         try {
-          var fp = crypto().hashCertFingerprint(req.peerCert.raw);
+          var fp = bCrypto().hashCertFingerprint(req.peerCert.raw);
           fpHex = fp.hex; fpColon = fp.colon;
         } catch (_e) { /* fall through to refused below */ }
       }
@@ -256,7 +256,7 @@ function create(opts) {
             keyId: record.id || null,
           });
         }
-      } else if (!crypto().isCertRevoked(req.peerCert.raw, pinned)) {
+      } else if (!bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
         // isCertRevoked returns true on MATCH against the deny-list
         // shape; we use it here as a fingerprint-set membership test
         // because it does the same constant-time hex/colon comparison

package/lib/middleware/require-mtls.js

@@ -49,7 +49,7 @@ var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 
-var crypto = lazyRequire(function () { return require("../crypto"); });
+var bCrypto = lazyRequire(function () { return require("../crypto"); });
 var audit  = lazyRequire(function () { return require("../audit"); });
 
 var RequireMtlsError = defineClass("RequireMtlsError", { alwaysPermanent: true });
@@ -169,18 +169,18 @@ function create(opts) {
     // allow/deny matching.
     var fp;
     try {
-      fp = crypto().hashCertFingerprint(peerCert.raw);
+      fp = bCrypto().hashCertFingerprint(peerCert.raw);
     } catch (e) {
       return _refuse(res, "fingerprint-failed", { error: (e && e.message) || String(e) });
     }
 
-    if (denyList.length > 0 && crypto().isCertRevoked(peerCert.raw, denyList)) {
+    if (denyList.length > 0 && bCrypto().isCertRevoked(peerCert.raw, denyList)) {
       return _refuse(res, "fingerprint-on-deny-list", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,
       });
     }
-    if (allowList && allowList.length > 0 && !crypto().isCertRevoked(peerCert.raw, allowList)) {
+    if (allowList && allowList.length > 0 && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
       return _refuse(res, "fingerprint-not-allowed", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,

package/lib/migrations.js

@@ -45,7 +45,7 @@ var lazyRequire = require("./lazy-require");
 var { boot } = require("./log");
 var migrationFiles = require("./migration-files");
 var numericBounds = require("./numeric-bounds");
-var dbModule = lazyRequire(function () { return require("./db"); });
+var db = lazyRequire(function () { return require("./db"); });
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
 
@@ -224,7 +224,7 @@ function _resolveDb(opts) {
   if (opts && opts.db && typeof opts.db.prepare === "function") return opts.db;
   // Fall back to the framework's singleton db when one isn't passed —
   // operator-side wiring usually does `b.migrations.create({ dir })`.
-  var d = dbModule();
+  var d = db();
   if (typeof d.prepare !== "function") {
     throw new MigrationError("migrations/no-db",
       "no db handle: pass opts.db or initialize b.db before create()",

package/lib/network-byte-quota.js

@@ -43,7 +43,7 @@ var defineClass = require("./framework-error").defineClass;
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 
-var auditFwk = lazyRequire(function () { return require("./audit"); });
+var audit = lazyRequire(function () { return require("./audit"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var ByteQuotaError = defineClass("ByteQuotaError", { alwaysPermanent: true });
@@ -181,7 +181,7 @@ function create(opts) {
   function _emitAudit(action, outcome, metadata) {
     if (!auditOn) return;
     try {
-      auditFwk().safeEmit({
+      audit().safeEmit({
         action:   "network.byte_quota." + action,
         outcome:  outcome,
         metadata: metadata || {},

package/lib/network.js

@@ -33,7 +33,7 @@
 var byteQuota = require("./network-byte-quota");
 var ntpCheck = require("./ntp-check");
 var nts      = require("./network-nts");
-var dns      = require("./network-dns");
+var networkDns = require("./network-dns");
 var networkProxy = require("./network-proxy");
 var networkTls = require("./network-tls");
 var heartbeat = require("./network-heartbeat");
@@ -211,15 +211,15 @@ function bootFromEnv(opts) {
   var dnsServers = env.BLAMEJS_DNS_SERVERS;
   if (dnsServers) {
     var dl = String(dnsServers).split(",").map(function (s) { return s.trim(); }).filter(Boolean);
-    if (dl.length > 0) { dns.setServers(dl); applied.dns.servers = dl.length; }
+    if (dl.length > 0) { networkDns.setServers(dl); applied.dns.servers = dl.length; }
   }
-  if (env.BLAMEJS_DNS_RESULT_ORDER)  { dns.setResultOrder(env.BLAMEJS_DNS_RESULT_ORDER); applied.dns.resultOrder = env.BLAMEJS_DNS_RESULT_ORDER; }
-  if (env.BLAMEJS_DNS_FAMILY)        { dns.setFamily(parseInt(env.BLAMEJS_DNS_FAMILY, 10)); applied.dns.family = parseInt(env.BLAMEJS_DNS_FAMILY, 10); }
-  if (env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS) { dns.setLookupTimeoutMs(parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10)); applied.dns.lookupTimeoutMs = parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10); }
-  if (env.BLAMEJS_DNS_CACHE_TTL_MS)      { dns.setCacheTtlMs(parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10)); applied.dns.cacheTtlMs = parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10); }
-  if (env.BLAMEJS_DOH_URL)               { dns.useDnsOverHttps({ url: env.BLAMEJS_DOH_URL }); applied.dns.doh = env.BLAMEJS_DOH_URL; }
-  else if (env.BLAMEJS_DOH_PROVIDER)     { dns.useDnsOverHttps({ provider: env.BLAMEJS_DOH_PROVIDER }); applied.dns.dohProvider = env.BLAMEJS_DOH_PROVIDER; }
-  if (env.BLAMEJS_DOT_HOST)              { dns.useDnsOverTls({ host: env.BLAMEJS_DOT_HOST, port: env.BLAMEJS_DOT_PORT ? parseInt(env.BLAMEJS_DOT_PORT, 10) : 853 }); applied.dns.dot = env.BLAMEJS_DOT_HOST; }
+  if (env.BLAMEJS_DNS_RESULT_ORDER)  { networkDns.setResultOrder(env.BLAMEJS_DNS_RESULT_ORDER); applied.dns.resultOrder = env.BLAMEJS_DNS_RESULT_ORDER; }
+  if (env.BLAMEJS_DNS_FAMILY)        { networkDns.setFamily(parseInt(env.BLAMEJS_DNS_FAMILY, 10)); applied.dns.family = parseInt(env.BLAMEJS_DNS_FAMILY, 10); }
+  if (env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS) { networkDns.setLookupTimeoutMs(parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10)); applied.dns.lookupTimeoutMs = parseInt(env.BLAMEJS_DNS_LOOKUP_TIMEOUT_MS, 10); }
+  if (env.BLAMEJS_DNS_CACHE_TTL_MS)      { networkDns.setCacheTtlMs(parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10)); applied.dns.cacheTtlMs = parseInt(env.BLAMEJS_DNS_CACHE_TTL_MS, 10); }
+  if (env.BLAMEJS_DOH_URL)               { networkDns.useDnsOverHttps({ url: env.BLAMEJS_DOH_URL }); applied.dns.doh = env.BLAMEJS_DOH_URL; }
+  else if (env.BLAMEJS_DOH_PROVIDER)     { networkDns.useDnsOverHttps({ provider: env.BLAMEJS_DOH_PROVIDER }); applied.dns.dohProvider = env.BLAMEJS_DOH_PROVIDER; }
+  if (env.BLAMEJS_DOT_HOST)              { networkDns.useDnsOverTls({ host: env.BLAMEJS_DOT_HOST, port: env.BLAMEJS_DOT_PORT ? parseInt(env.BLAMEJS_DOT_PORT, 10) : 853 }); applied.dns.dot = env.BLAMEJS_DOT_HOST; }
 
   if (env.HTTP_PROXY || env.http_proxy || env.HTTPS_PROXY || env.https_proxy ||
       env.NO_PROXY  || env.no_proxy  || env.ALL_PROXY    || env.all_proxy) {
@@ -286,7 +286,7 @@ function snapshot() {
       servers:     ntpFacade.getServers(),
       thresholds:  ntpCheck.getThresholds(),
     },
-    dns: dns._stateForTest(),
+    dns: networkDns._stateForTest(),
     proxy: networkProxy.snapshot(),
     tls:  {
       systemTrust: networkTls.isSystemTrustEnabled(),
@@ -305,7 +305,7 @@ function _resetForTest() {
   ntpFacade._defaultServers = null;
   ntpFacade._defaultTimeoutMs = null;
   if (typeof ntpCheck._resetThresholdsForTest === "function") ntpCheck._resetThresholdsForTest();
-  dns._resetForTest();
+  networkDns._resetForTest();
   networkProxy._resetForTest();
   networkTls._resetForTest();
   heartbeat._resetForTest();
@@ -316,7 +316,7 @@ function _resetForTest() {
 
 module.exports = {
   ntp:        ntpFacade,
-  dns:        dns,
+  dns:        networkDns,
   proxy:      networkProxy,
   tls:        networkTls,
   heartbeat:  heartbeat,

package/lib/notify.js

@@ -53,10 +53,10 @@ var { NotifyError } = require("./framework-error");
 // Lazy-required modules to avoid load-order cycles. retry / observability /
 // redact / httpClient don't currently import notify, but treating them
 // the same way every primitive does keeps the load-order story uniform.
-var retryModule = lazyRequire(function () { return require("./retry"); });
+var retryHelper = lazyRequire(function () { return require("./retry"); });
 var observability = lazyRequire(function () { return require("./observability"); });
-var redactModule = lazyRequire(function () { return require("./redact"); });
-var httpClientModule = lazyRequire(function () { return require("./http-client"); });
+var redact = lazyRequire(function () { return require("./redact"); });
+var httpClient = lazyRequire(function () { return require("./http-client"); });
 
 var _err = NotifyError.factory;
 
@@ -222,7 +222,7 @@ function httpJson(opts) {
   return {
     name: name,
     send: async function (message, sendOpts) {
-      var client = customClient || httpClientModule();
+      var client = customClient || httpClient();
       var body;
       var contentType;
       if (bodyFormat === "form") {
@@ -380,7 +380,7 @@ function create(opts) {
   var redactFn = (typeof opts.redact === "function")
     ? opts.redact
     // Default: b.redact.redact — the framework's PII detector chain.
-    : function (m) { return redactModule().redact(m); };
+    : function (m) { return redact().redact(m); };
   var defaultTimeoutMs = cfg.defaultTimeoutMs;
   var defaultRetry = opts.defaultRetry || null;
   var defaultBreaker = opts.defaultBreaker || null;
@@ -402,7 +402,7 @@ function create(opts) {
     };
     var breakerOpts = entry.breaker || defaultBreaker;
     if (breakerOpts) {
-      registry.breaker = new (retryModule().CircuitBreaker)(n, breakerOpts);
+      registry.breaker = new (retryHelper().CircuitBreaker)(n, breakerOpts);
     }
     if (entry.serialize) registry.mutex = new safeAsync.Mutex();
     channels[n] = registry;
@@ -519,7 +519,7 @@ function create(opts) {
       try {
         // b.retry.withRetry IS the retry loop. Notify never hand-rolls
         // backoff/jitter/classification — the framework owns it.
-        var result = await retryModule().withRetry(function (attempt) {
+        var result = await retryHelper().withRetry(function (attempt) {
           return _attemptSerialized(attempt);
         }, perCallRetry);
 
@@ -647,7 +647,7 @@ function create(opts) {
       mutex:     null,
     };
     var breakerOpts = entry.breaker || defaultBreaker;
-    if (breakerOpts) registry.breaker = new (retryModule().CircuitBreaker)(name, breakerOpts);
+    if (breakerOpts) registry.breaker = new (retryHelper().CircuitBreaker)(name, breakerOpts);
     if (entry.serialize) registry.mutex = new safeAsync.Mutex();
     channels[name] = registry;
   }

package/lib/parsers/safe-env.js

@@ -68,7 +68,7 @@ var { boot } = require("../log");
 // (transitively) vault, which leaves safe-env's module.exports
 // half-built when vault first reaches readVar. Defer audit resolution
 // until the first emit-driven call.
-var auditModule = lazyRequire(function () { return require("../audit"); });
+var audit = lazyRequire(function () { return require("../audit"); });
 
 var log = boot("env");
 
@@ -519,11 +519,11 @@ function _writeAuditRows(filepath, diff) {
   // we're a follower, audit.record will throw NotLeaderError. Catch
   // explicitly: a follower's local config-load shouldn't crash because
   // the cluster's audit chain belongs to the leader.
-  var audit = auditModule();   // resolve the lazy-required audit module
+  var auditInst = audit();   // resolve the lazy-required audit module
 
   function _safeRecord(action, metadata) {
     try {
-      audit.emit({
+      auditInst.emit({
         actor:    { kind: "system", id: "config-loader" },
         action:   action,
         outcome:  "success",

package/lib/restore-bundle.js

@@ -131,7 +131,7 @@ async function extract(opts) {
   if (nodeFs.existsSync(opts.stagingDir)) {
     throw new RestoreBundleError("restore-bundle/staging-exists",
       "extract: stagingDir already exists: " + opts.stagingDir +
-      " (refusing to merge into existing directory — pick a fresh nodePath)");
+      " (refusing to merge into existing directory — pick a fresh path)");
   }
   if (!Buffer.isBuffer(opts.passphrase) && typeof opts.passphrase !== "string") {
     throw new RestoreBundleError("restore-bundle/no-passphrase",

package/lib/router.js

@@ -46,11 +46,11 @@ var websocket = require("./websocket");
 var { boot } = require("./log");
 var { RouterError } = require("./framework-error");
 
-var auditFwk = lazyRequire(function () { return require("./audit"); });
+var audit = lazyRequire(function () { return require("./audit"); });
 // compliance — lazy because router.js is required during boot before
 // the operator's `b.compliance.set(...)` runs; the posture lookup only
 // matters at listen() time, well after boot finishes.
-var complianceLazy = lazyRequire(function () { return require("./compliance"); });
+var compliance = lazyRequire(function () { return require("./compliance"); });
 
 var log = boot("router");
 var HTTP_STATUS = requestHelpers.HTTP_STATUS;
@@ -733,12 +733,12 @@ class Router {
     if (declared !== "replay-cache") return declared;
     var active = null;
     try {
-      var compliance = complianceLazy();
-      if (compliance && typeof compliance.current === "function") active = compliance.current();
+      var complianceInst = compliance();
+      if (complianceInst && typeof complianceInst.current === "function") active = complianceInst.current();
     } catch (_e) { /* compliance not initialized */ }
     if (active && TLS_0RTT_FAILCLOSED_POSTURES.indexOf(active) !== -1) {
       try {
-        auditFwk().safeEmit({
+        audit().safeEmit({
           action:   "tls.0rtt.refused",
           outcome:  "denied",
           metadata: { reason: "posture-failclosed", posture: active, declared: declared },
@@ -759,7 +759,7 @@ class Router {
     if (String(earlyDataHeader).trim() !== "1") return null;                       // RFC 8470: only "1" means early data
     if (posture === "refuse") {
       try {
-        auditFwk().safeEmit({
+        audit().safeEmit({
           action:   "tls.0rtt.refused",
           outcome:  "denied",
           metadata: { reason: "posture-refuse", method: req.method, url: req.url },
@@ -783,7 +783,7 @@ class Router {
     var key = hash.digest("hex");
     if (this._tls0RttReplayCache.has(key)) {
       try {
-        auditFwk().safeEmit({
+        audit().safeEmit({
           action:   "tls.0rtt.replayed",
           outcome:  "denied",
           metadata: { reason: "cache-hit", method: req.method, url: req.url,
@@ -805,7 +805,7 @@ class Router {
     }
     this._tls0RttReplayCache.set(key, nowMs + TLS_0RTT_REPLAY_WINDOW_MS);
     try {
-      auditFwk().safeEmit({
+      audit().safeEmit({
         action:   "tls.0rtt.accepted",
         outcome:  "success",
         metadata: { method: req.method, url: req.url, windowMs: TLS_0RTT_REPLAY_WINDOW_MS },
@@ -889,7 +889,7 @@ class Router {
           });
         } catch (parseErr) {
           try {
-            auditFwk().safeEmit({
+            audit().safeEmit({
               action:   "router.redirect.cross_origin.refused",
               outcome:  "denied",
               metadata: {
@@ -913,7 +913,7 @@ class Router {
         }
         if (!match) {
           try {
-            auditFwk().safeEmit({
+            audit().safeEmit({
               action:   "router.redirect.cross_origin.refused",
               outcome:  "denied",
               metadata: {
@@ -930,7 +930,7 @@ class Router {
           );
         }
         try {
-          auditFwk().safeEmit({
+          audit().safeEmit({
             action:   "router.redirect.cross_origin.allowed",
             outcome:  "success",
             metadata: { target: url, origin: targetOrigin },
@@ -1064,7 +1064,7 @@ class Router {
         // (a clean peer would not initiate after GOAWAY).
         h2session.on("stream", function (stream) {
           if (h2session._blamejsGoawaySent) {
-            try { auditFwk().safeEmit({
+            try { audit().safeEmit({
               action:   "http2.window_update.refused",
               outcome:  "denied",
               metadata: { reason: "post-goaway-stream", streamId: stream.id || null,

package/lib/seeders.js

@@ -67,7 +67,7 @@ var { SeederError } = require("./framework-error");
 
 var log = boot("seeders");
 
-var dbModule = lazyRequire(function () { return require("./db"); });
+var db = lazyRequire(function () { return require("./db"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var _err = SeederError.factory;
@@ -151,7 +151,7 @@ function _validateCreateOpts(opts) {
 
 function _resolveDb(opts) {
   if (opts && opts.db && typeof opts.db.prepare === "function") return opts.db;
-  var d = dbModule();
+  var d = db();
   if (typeof d.prepare !== "function") {
     throw _err("NO_DB", "seeders: no db handle: pass opts.db or initialize b.db before create()");
   }

package/lib/testing.js

@@ -62,7 +62,7 @@ var { TestingError } = require("./framework-error");
 // metrics is the only place that exposes the global `tap` slot the
 // captureMetricsTap helper swaps; pulling it lazily keeps testing.js
 // safe to require at any framework load order.
-var metricsModule = lazyRequire(function () { return require("./metrics"); });
+var metrics = lazyRequire(function () { return require("./metrics"); });
 
 var _err = TestingError.factory;
 
@@ -563,7 +563,7 @@ function captureObservability() {
  *   }
  */
 function captureMetricsTap() {
-  var m = metricsModule();
+  var m = metrics();
   var original = m.tap;
   var captured = [];
   m.tap = function (name, value, labels) {

package/lib/vault-aad.js

@@ -52,7 +52,7 @@ var C               = require("./constants");
 var { defineClass } = require("./framework-error");
 var VaultAadError = defineClass("VaultAadError", { alwaysPermanent: true });
 
-var crypto = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 var vault  = lazyRequire(function () { return require("./vault"); });
 var audit  = lazyRequire(function () { return require("./audit"); });
 
@@ -154,11 +154,11 @@ function _deriveKey(aadBytes) {
   // this is a deterministic derivation; rotating vault keys produces
   // a different root and breaks all prior AAD-sealed values (operator
   // intent: rotation = re-seal).
-  var rootHash = crypto().sha3Hash(keysJson);
+  var rootHash = bCrypto().sha3Hash(keysJson);
   var prefix   = Buffer.from("vault.aad/v1/", "utf8");
   var rootBuf  = Buffer.from(rootHash, "hex");
   var input    = Buffer.concat([prefix, rootBuf, aadBytes]);
-  return crypto().kdf(input, C.BYTES.bytes(32));
+  return bCrypto().kdf(input, C.BYTES.bytes(32));
 }
 
 function seal(plaintext, aadParts) {
@@ -178,7 +178,7 @@ function seal(plaintext, aadParts) {
   var aadBytes = _canonicalize(aadParts);
   var key = _deriveKey(aadBytes);
   var ptBuf = Buffer.from(plaintext, "utf8");
-  var packed = crypto().encryptPacked(ptBuf, key, aadBytes);
+  var packed = bCrypto().encryptPacked(ptBuf, key, aadBytes);
 
   try {
     audit().safeEmit({
@@ -213,7 +213,7 @@ function unseal(value, aadParts) {
       "unseal: base64 decode failed - " + e.message);
   }
   var pt;
-  try { pt = crypto().decryptPacked(packed, key, aadBytes); }
+  try { pt = bCrypto().decryptPacked(packed, key, aadBytes); }
   catch (e) {
     try {
       audit().safeEmit({

package/lib/watcher.js

@@ -434,7 +434,7 @@ function create(opts) {
           ((e && e.message) || String(e)) + " — pass mode: \"poll\" to fall back to interval polling");
       }
       throw new WatcherError("watcher/start-failed",
-        "watcher.create: nodeFs.watch failed: " + ((e && e.message) || String(e)));
+        "watcher.create: fs.watch failed: " + ((e && e.message) || String(e)));
     }
   }
 

package/lib/ws-client.js

@@ -54,7 +54,7 @@ var lazyRequire    = require("./lazy-require");
 var validateOpts   = require("./validate-opts");
 var safeAsync      = require("./safe-async");
 var safeBuffer     = require("./safe-buffer");
-var fwCrypto       = lazyRequire(function () { return require("./crypto"); });
+var bCrypto        = lazyRequire(function () { return require("./crypto"); });
 var websocket      = lazyRequire(function () { return require("./websocket"); });
 var audit          = lazyRequire(function () { return require("./audit"); });
 var networkTls     = lazyRequire(function () { return require("./network-tls"); });
@@ -137,7 +137,7 @@ function _inflateRawCappedSync(zlib, compressed, maxBytes, windowBits) {
 }
 
 function _generateKey() {
-  return fwCrypto().generateBytes(C.BYTES.bytes(16)).toString("base64");
+  return bCrypto().generateBytes(C.BYTES.bytes(16)).toString("base64");
 }
 
 function _expectedAccept(secKey, handshakeGuid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:40df0b28-c547-4f48-9bbf-f005b59cbd1b",
+  "serialNumber": "urn:uuid:8e662af8-d254-46ec-8625-aa19174598d2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-14T00:04:25.956Z",
+    "timestamp": "2026-05-14T04:47:34.904Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.9.15",
+      "bom-ref": "@blamejs/core@0.9.16",
       "type": "library",
       "name": "blamejs",
-      "version": "0.9.15",
+      "version": "0.9.16",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.9.15",
+      "purl": "pkg:npm/%40blamejs/core@0.9.16",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.9.15",
+      "ref": "@blamejs/core@0.9.16",
       "dependsOn": []
     }
   ]