@blamejs/core 0.9.15 → 0.9.17

package/lib/crypto.js

@@ -44,9 +44,9 @@
  * @card
  *   The framework's PQC-first cryptography surface.
  */
-var nodeCrypto = require("crypto");
-var nodeFs = require("fs");
-var { pipeline } = require("stream/promises");
+var nodeCrypto = require("node:crypto");
+var nodeFs = require("node:fs");
+var { pipeline } = require("node:stream/promises");
 var { xchacha20poly1305 } = require("./vendor/noble-ciphers.cjs");
 var C = require("./constants");
 

package/lib/daemon.js

@@ -37,8 +37,8 @@
  *   Long-running process orchestration — supervisor wiring around `b.appShutdown`, foreground signal handling, detached-fork spawn via `b.processSpawn`, PID-file health probes, and a SIGTERM-then-SIGKILL restart policy on stop.
  */
 
-var nodeFs = require("fs");
-var nodePath = require("path");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
 var numericBounds = require("./numeric-bounds");
 var appShutdown = require("./app-shutdown");
 var processSpawn = require("./process-spawn");

package/lib/db-file-lifecycle.js

@@ -57,9 +57,9 @@
  *   bun:sqlite).
  */
 
-var nodeFs   = require("fs");
-var os   = require("os");
-var nodePath = require("path");
+var nodeFs   = require("node:fs");
+var os   = require("node:os");
+var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var { generateBytes, generateToken, encryptPacked, decryptPacked } = require("./crypto");
@@ -115,8 +115,8 @@ function _resolveTmpDir(operatorTmpDir, allowDiskFallback) {
  * Returns an encrypted-DB-file lifecycle handle. Methods:
  *
  *   - `decryptToTmp()` — decrypt the encrypted DB file to a fresh
- *     tmpfs path and return the nodePath. Idempotent: subsequent calls
- *     return the existing nodePath.
+ *     tmpfs path and return the path. Idempotent: subsequent calls
+ *     return the existing path.
  *   - `dbPath` — the resolved plaintext-tmpfs path (set after
  *     `decryptToTmp()` runs).
  *   - `startFlushTimer(db, opts?)` — start a periodic flush timer

package/lib/db-schema.js

@@ -36,7 +36,7 @@
  *                             surfaces a rollback throw without
  *                             swallowing the original error.
  */
-var nodePath = require("path");
+var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
 var safeSql = require("./safe-sql");
 

package/lib/db.js

@@ -41,8 +41,8 @@
  * @card
  *   Database core — SQLite (node:sqlite) wrapped in encrypted-at-rest storage, sealed-column field-level crypto, append-only audit-chain integration, declarative schema reconcile, and run-once migrations.
  */
-var nodeFs = require("fs");
-var nodePath = require("path");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
 var { DatabaseSync } = require("node:sqlite");
 var { Readable } = require("node:stream");
 var atomicFile = require("./atomic-file");
@@ -1479,7 +1479,7 @@ function stream(sql) {
           this.destroy(new DbError("db/stream-limit-exceeded",
             "db.stream: emitted " + emitted + " rows, exceeding streamLimit " +
             perCallLimit + ". Pass opts.streamLimit higher OR raise via " +
-            "db.init({ streamLimit }) after auditing the export nodePath."));
+            "db.init({ streamLimit }) after auditing the export path."));
           return;
         }
         var step = iter.next();

package/lib/dev.js

@@ -11,7 +11,7 @@
  *   spawned app's logs unchanged.
  *
  *   The hot-reload loop spawns the app as a child process, watches the
- *   source directories with `nodeFs.watch({ recursive: true })`, and
+ *   source directories with `fs.watch({ recursive: true })`, and
  *   restarts the child when an unignored file changes. On-disk state
  *   (vault keys, encrypted DB, sealed cookies) survives the restart
  *   because the child re-opens the files; only in-process state is
@@ -41,15 +41,15 @@
  *
  *   Test seams: `opts._spawn(cmd, args, sopts)` and
  *   `opts._watch(dir, wopts, listener)` default to `child_process.spawn`
- *   and `nodeFs.watch`; unit tests pass fakes to drive the engine without
+ *   and `fs.watch`; unit tests pass fakes to drive the engine without
  *   real subprocesses.
  *
  * @card
  *   Dev-mode helpers — hot-reload signal (file watch + child-process restart), route-list dump exposed via `dev.stats()`, and a request inspector courtesy of `stdio: 'inherit'` so the operator sees the spawned app's logs unchanged.
  */
 
-var nodePath = require("path");
-var nodeFs = require("fs");
+var nodePath = require("node:path");
+var nodeFs = require("node:fs");
 var lazyRequire = require("./lazy-require");
 var logModule = require("./log");
 var numericBounds = require("./numeric-bounds");
@@ -65,7 +65,7 @@ var { FrameworkError } = require("./framework-error");
 // inspecting a deployed bundle don't see it as a top-level dep of an
 // otherwise hermetic framework. Production deployments additionally
 // refuse to construct dev.create() — see _refuseInProduction below.
-var childProcess = lazyRequire(function () { return require("child_process"); });
+var childProcess = lazyRequire(function () { return require("node:child_process"); });
 
 class DevError extends FrameworkError {
   constructor(code, message) {

package/lib/dr-runbook.js

@@ -42,8 +42,8 @@
  *   Disaster-recovery runbook executor — composes pre-recorded regulatory steps, operator confirmation gates, and the framework's audit chain into a posture-appropriate Markdown runbook a regulator can read alongside `b.audit`.
  */
 
-var nodeFs = require("fs");
-var nodePath = require("path");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
 var C = require("./constants");
 var atomicFile = require("./atomic-file");
 var lazyRequire = require("./lazy-require");

package/lib/external-db-migrate.js

@@ -48,7 +48,7 @@
  *   - externaldb.migrate.lock.acquired   { holder }
  *   - externaldb.migrate.lock.released   { holder }
  */
-var nodePath = require("path");
+var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
 var canonicalJson = require("./canonical-json");
 var { sha3Hash } = require("./crypto");
@@ -64,7 +64,7 @@ var ExternalDbMigrateError = defineClass("ExternalDbMigrateError", { alwaysPerma
 
 // Lazy require — external-db imports back into this module via its
 // public `migrate` namespace; load-order would cycle without lazy.
-var externalDbModule = lazyRequire(function () { return require("./external-db"); });
+var externalDb = lazyRequire(function () { return require("./external-db"); });
 
 var TRACKING_TABLE = "_blamejs_externaldb_migrations";
 var LOCK_TABLE     = "_blamejs_externaldb_migrations_lock";
@@ -327,7 +327,7 @@ function _resolveBackendName(opts) {
   }
   // Default to the externalDb's defaultBackend; throw clear if not initialized.
   var listed;
-  try { listed = externalDbModule().listBackends(); }
+  try { listed = externalDb().listBackends(); }
   catch (_e) {
     throw _err("externaldb-migrate/not-initialized",
       "externalDb is not initialized — call b.externalDb.init({ backends }) first");
@@ -363,14 +363,14 @@ function create(opts) {
 
   function _ctx(backendName) {
     return {
-      externalDb:  externalDbModule(),
+      externalDb:  externalDb(),
       backendName: backendName,
     };
   }
 
   async function status() {
     var backendName = _resolveBackendName(opts);
-    return await externalDbModule().transaction(async function (xdb) {
+    return await externalDb().transaction(async function (xdb) {
       await _ensureTrackingTable(xdb);
       var res = await xdb.query(
         "SELECT name, description, appliedAt FROM " + Q_TRACKING +
@@ -394,7 +394,7 @@ function create(opts) {
     var backendName = _resolveBackendName(opts);
     var ctx = _ctx(backendName);
 
-    return await externalDbModule().transaction(async function (xdb) {
+    return await externalDb().transaction(async function (xdb) {
       await _ensureTrackingTable(xdb);
       await _ensureLockTable(xdb);
       await _ensureHistoryTable(xdb);
@@ -404,7 +404,7 @@ function create(opts) {
       // pool acquisition for the lock connection — the migrate runner
       // serializes apply order, so this single-connection lock is
       // sufficient.
-      var lockResult = await externalDbModule().transaction(async function (xdb) {
+      var lockResult = await externalDb().transaction(async function (xdb) {
         return await _acquireLock(xdb, opts);
       }, { backend: backendName });
       var lockHolder = lockResult.holder;
@@ -421,7 +421,7 @@ function create(opts) {
       }
 
       try {
-        var appliedRes = await externalDbModule().query(
+        var appliedRes = await externalDb().query(
           "SELECT name FROM " + Q_TRACKING, [], { backend: backendName }
         );
         var appliedSet = new Set(((appliedRes && appliedRes.rows) || []).map(function (r) { return r.name; }));
@@ -435,7 +435,7 @@ function create(opts) {
           var mod = _loadMigration(file, dir);
           var t0 = Date.now();
           try {
-            await externalDbModule().transaction(async function (xdb) {
+            await externalDb().transaction(async function (xdb) {
               await mod.up(xdb, ctx);
               var ranAt = new Date().toISOString();
               await xdb.query(
@@ -489,7 +489,7 @@ function create(opts) {
         return { applied: applied, skipped: skipped, backend: backendName };
       } finally {
         try {
-          await externalDbModule().transaction(async function (xdb) {
+          await externalDb().transaction(async function (xdb) {
             await _releaseLock(xdb, lockHolder);
           }, { backend: backendName });
           _emit(audit, "externaldb.migrate.lock.released", "success",
@@ -509,12 +509,12 @@ function create(opts) {
     var backendName = _resolveBackendName(opts);
     var ctx = _ctx(backendName);
 
-    await externalDbModule().transaction(async function (xdb) {
+    await externalDb().transaction(async function (xdb) {
       await _ensureTrackingTable(xdb);
       await _ensureLockTable(xdb);
     }, { backend: backendName });
 
-    var lockResultDown = await externalDbModule().transaction(async function (xdb) {
+    var lockResultDown = await externalDb().transaction(async function (xdb) {
       return await _acquireLock(xdb, opts);
     }, { backend: backendName });
     var lockHolder = lockResultDown.holder;
@@ -528,7 +528,7 @@ function create(opts) {
     }
 
     try {
-      var appliedRes = await externalDbModule().query(
+      var appliedRes = await externalDb().query(
         "SELECT name FROM " + Q_TRACKING + " ORDER BY appliedAt DESC, name DESC LIMIT $1",
         [steps], { backend: backendName }
       );
@@ -543,7 +543,7 @@ function create(opts) {
         }
         var t0 = Date.now();
         try {
-          await externalDbModule().transaction(async function (xdb) {
+          await externalDb().transaction(async function (xdb) {
             await mod.down(xdb, ctx);
             await xdb.query(
               "DELETE FROM " + Q_TRACKING + " WHERE name = $1",
@@ -564,7 +564,7 @@ function create(opts) {
       return { reverted: reverted, backend: backendName };
     } finally {
       try {
-        await externalDbModule().transaction(async function (xdb) {
+        await externalDb().transaction(async function (xdb) {
           await _releaseLock(xdb, lockHolder);
         }, { backend: backendName });
         _emit(audit, "externaldb.migrate.lock.released", "success",
@@ -588,7 +588,7 @@ function create(opts) {
   async function history(historyOpts) {
     historyOpts = historyOpts || {};
     var backendName = _resolveBackendName(opts);
-    return await externalDbModule().transaction(async function (xdb) {
+    return await externalDb().transaction(async function (xdb) {
       await _ensureHistoryTable(xdb);
       var res = await xdb.query(
         "SELECT version, ranAt, ranBy, schemaIntrospectionHash, signature, publicKeyFingerprint " +

package/lib/flag-evaluation-context.js

@@ -16,13 +16,13 @@
  * then evaluate.
  */
 
-var nodeCrypto    = require("crypto");
+var nodeCrypto    = require("node:crypto");
 var validateOpts  = require("./validate-opts");
 var lazyRequire   = require("./lazy-require");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
-var fwCrypto = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 
 function _normalize(input, label) {
   if (input == null) return {};
@@ -96,7 +96,7 @@ function fromRequest(req, opts) {
               headers["x-forwarded-for"].split(",")[0].trim()) ||
              (req.connection && req.connection.remoteAddress) || "";
     var ua = headers["user-agent"] || "";
-    tk = "anon:" + fwCrypto().sha3Hash(ip + ":" + ua).slice(0, 16);   // allow:raw-byte-literal — base16 prefix len
+    tk = "anon:" + bCrypto().sha3Hash(ip + ":" + ua).slice(0, 16);   // allow:raw-byte-literal — base16 prefix len
   }
   ctx.targetingKey = tk;
 

package/lib/flag-providers.js

@@ -36,7 +36,7 @@
  *   provider.kind   -> "local-file" | "memory" | "environment" | <operator-defined>
  */
 
-var nodeFs = require("fs");
+var nodeFs = require("node:fs");
 var validateOpts   = require("./validate-opts");
 var lazyRequire    = require("./lazy-require");
 var safeJson       = require("./safe-json");

package/lib/http-client.js

@@ -35,15 +35,15 @@
  *   Outbound HTTP client with SSRF gate, retry, circuit breaker, wall-clock + idle timeouts, AbortSignal propagation, connection pooling, streaming, and ALPN-negotiated HTTP/2.
  */
 
-var nodeFs = require("fs");
-var http  = require("http");
-var https = require("https");
-var http2 = require("http2");
-var nodeCrypto = require("crypto");
-var nodePath = require("path");
+var nodeFs = require("node:fs");
+var http  = require("node:http");
+var https = require("node:https");
+var http2 = require("node:http2");
+var nodeCrypto = require("node:crypto");
+var nodePath = require("node:path");
 var nodeStream = require("node:stream");
 var streamPromises = require("node:stream/promises");
-var { URL } = require("url");
+var { URL } = require("node:url");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var bCrypto = require("./crypto");
@@ -476,9 +476,9 @@ function _attachJarCookie(headers, jar, url) {
 function _buildMultipartBody(spec) {
   var boundary = "----blamejs-mp-" + bCrypto.generateToken(C.BYTES.bytes(16));
   var CRLF = "\r\n";
-  var nodeFs = require("fs");                                             // allow:inline-require — only on multipart paths that touch the filesystem
-  var path = require("path");                                         // allow:inline-require — same
-  var nodeStream = require("stream");                                 // allow:inline-require — Readable subclass only when streaming
+  var nodeFs = require("node:fs");                                             // allow:inline-require — only on multipart paths that touch the filesystem
+  var path = require("node:path");                                         // allow:inline-require — same
+  var nodeStream = require("node:stream");                                 // allow:inline-require — Readable subclass only when streaming
 
   // Each entry is { headerBytes, source } where source is one of:
   //   { kind: "buffer", buf: Buffer }
@@ -1959,7 +1959,7 @@ function _validateUploadOpts(opts) {
  *
  * POSTs a file body via `multipart/form-data` without buffering the
  * file in memory. Streams from disk through the request body using
- * `nodeFs.createReadStream` + `node:stream/promises` pipeline. Throws
+ * `fs.createReadStream` + `node:stream/promises` pipeline. Throws
  * `httpclient/missing-file` when `opts.file.path` doesn't exist or
  * isn't a regular file. Composes through `request()` so SSRF gating,
  * proxy routing, and the per-origin transport cache apply unchanged.

package/lib/http-message-signature.js

@@ -59,7 +59,7 @@
  *   // → { valid, label, keyid, alg, covered, reason? }
  */
 
-var nodeCrypto       = require("crypto");
+var nodeCrypto       = require("node:crypto");
 var safeUrl          = require("./safe-url");
 var safeBuffer       = require("./safe-buffer");
 var C                = require("./constants");

package/lib/keychain.js

@@ -43,8 +43,8 @@
  *   OS keychain abstraction with encrypted-file fallback — stores / retrieves / removes a `(service, account) -> password` binding via the host operating system's native credential store.
  */
 
-var nodeFs = require("fs");
-var nodePath = require("path");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
 
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
@@ -161,7 +161,7 @@ function _validateFallbackFile(filepath, primitive) {
     KeychainError, "keychain/bad-fallback-file");
   if (!nodePath.isAbsolute(filepath)) {
     throw new KeychainError("keychain/relative-fallback-file",
-      primitive + ": fallbackFile must be an absolute nodePath; got " + filepath);
+      primitive + ": fallbackFile must be an absolute path; got " + filepath);
   }
 }
 
@@ -613,7 +613,7 @@ function _isFallbackError(e) {
  *     service:       string,        // required, no NUL/CR/LF bytes
  *     account:       string,        // required, no NUL/CR/LF bytes
  *     password:      string,        // required, non-empty
- *     fallbackFile?: string,        // absolute nodePath; required if file fallback may engage
+ *     fallbackFile?: string,        // absolute path; required if file fallback may engage
  *     passphrase?:   string,        // required when fallbackFile engages (Argon2id-derived KEK)
  *     preferFile?:   boolean,       // default: false
  *     audit?:        boolean,       // default: true (emits keychain.stored)
@@ -685,7 +685,7 @@ async function store(opts) {
  *   {
  *     service:       string,        // required
  *     account:       string,        // required
- *     fallbackFile?: string,        // absolute nodePath; required for file-backend lookup
+ *     fallbackFile?: string,        // absolute path; required for file-backend lookup
  *     passphrase?:   string,        // required when fallbackFile engages
  *     preferFile?:   boolean,       // default: false
  *     audit?:        boolean,       // default: true (emits keychain.retrieved)
@@ -781,7 +781,7 @@ async function retrieve(opts) {
  *   {
  *     service:       string,        // required
  *     account:       string,        // required
- *     fallbackFile?: string,        // absolute nodePath; required for file-backend cleanup
+ *     fallbackFile?: string,        // absolute path; required for file-backend cleanup
  *     passphrase?:   string,        // required when fallbackFile engages
  *     preferFile?:   boolean,       // default: false
  *     audit?:        boolean,       // default: true (emits keychain.removed)

package/lib/local-db-thin.js

@@ -53,8 +53,8 @@
  *   localdb.thin.closed     { file }
  */
 
-var nodeFs   = require("fs");
-var nodePath = require("path");
+var nodeFs   = require("node:fs");
+var nodePath = require("node:path");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");

package/lib/log-stream-local.js

@@ -23,9 +23,9 @@
  *     fileNamePrefix:     'blamejs'
  *   }
  */
-var nodeFs = require("fs");
-var nodePath = require("path");
-var zlib = require("zlib");
+var nodeFs = require("node:fs");
+var nodePath = require("node:path");
+var zlib = require("node:zlib");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var { boot } = require("./log");

package/lib/log-stream-syslog.js

@@ -27,10 +27,10 @@
  *   reconnect and replay them on the new connection. UDP is best-effort
  *   (datagrams that race a closed socket are dropped to onDrop).
  */
-var dgram = require("dgram");
-var net   = require("net");
-var os    = require("os");
-var nodeTls   = require("tls");
+var dgram = require("node:dgram");
+var net   = require("node:net");
+var os    = require("node:os");
+var nodeTls   = require("node:tls");
 var C = require("./constants");
 var { boot } = require("./log");
 var safeAsync = require("./safe-async");

package/lib/log.js

@@ -72,7 +72,7 @@ var { FrameworkError } = require("./framework-error");
 //     pulling the whole crypto bundle into the framework's earliest
 //     boot path (request-id middleware needs only generateToken).
 var safeEnv = lazyRequire(function () { return require("./parsers/safe-env"); });
-var crypto  = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 
 // Request-id correlation token — 8 bytes hex-encoded (16 chars). Short
 // enough to read in a log line, long enough to keep collisions far below
@@ -384,7 +384,7 @@ function create(opts) {
           // 16 random hex chars — short, sufficient correlation entropy.
           // Routes through the framework token primitive so the entropy
           // source matches the rest of the codebase.
-          return crypto().generateToken(REQUEST_ID_BYTES);
+          return bCrypto().generateToken(REQUEST_ID_BYTES);
         };
       return function logRequestIdMiddleware(req, res, next) {
         var inbound = req.headers && req.headers[headerName];

package/lib/mail-arc-sign.js

@@ -48,7 +48,7 @@
  * hop: `dkim.arc.signed`.
  */
 
-var nodeCrypto = require("crypto");
+var nodeCrypto = require("node:crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeBuffer = require("./safe-buffer");

package/lib/mail-dkim.js

@@ -40,7 +40,7 @@
  */
 var lazyRequire = require("./lazy-require");
 var audit       = lazyRequire(function () { return require("./audit"); });
-var nodeCrypto  = require("crypto");
+var nodeCrypto  = require("node:crypto");
 var safeBuffer  = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");

package/lib/mail.js

@@ -68,11 +68,11 @@ var dkim = require("./mail-dkim");
 var mailAuth = require("./mail-auth");
 var mailBimi = require("./mail-bimi");
 var mailUnsubscribe = require("./mail-unsubscribe");
-var net = lazyRequire(function () { return require("net"); });
+var net = lazyRequire(function () { return require("node:net"); });
 var networkDns = lazyRequire(function () { return require("./network-dns"); });
-var nodeUrl = require("url");
+var nodeUrl = require("node:url");
 var numericBounds = require("./numeric-bounds");
-var tls = lazyRequire(function () { return require("tls"); });
+var nodeTls = lazyRequire(function () { return require("node:tls"); });
 var safeJson = require("./safe-json");
 var safeSchema = require("./safe-schema");
 var validateOpts = require("./validate-opts");
@@ -221,7 +221,7 @@ async function reverseDns(ip) {
   // the original input. RFC 8601 §3 says the forward query must use
   // the same family as the source; mismatched families don't count
   // as confirmation.
-  var net = require("net");
+  var net = require("node:net");
   var forwardAddrs = [];
   try {
     if (net.isIPv6(ip)) {
@@ -916,7 +916,7 @@ function _messageRequires8BitMime(message) {
 // resultOrder applies).
 function _autoDetectFamily() {
   try {
-    var os = require("os");
+    var os = require("node:os");
     var ifaces = os.networkInterfaces();
     var hasV6 = false;
     var hasV4 = false;
@@ -1142,7 +1142,7 @@ function _smtpSend(message, cfg) {
         tlsConnectOpts.host = cfg.host;
         tlsConnectOpts.port = cfg.port;
         if (family === 4 || family === 6) tlsConnectOpts.family = family;
-        attachSocket(tls().connect(tlsConnectOpts));
+        attachSocket(nodeTls().connect(tlsConnectOpts));
       } else {
         var netOpts = { host: cfg.host, port: cfg.port };
         if (family === 4 || family === 6) netOpts.family = family;
@@ -1211,7 +1211,7 @@ function _smtpSend(message, cfg) {
         if (code !== 220) { fail("starttls-rejected (code " + code + ")"); return; }
         var tlsConnectOpts = Object.assign({ socket: socket }, cfg.tlsOpts);
         if (cfg.servername) tlsConnectOpts.servername = cfg.servername;
-        var tlsSocket = tls().connect(tlsConnectOpts, function () {
+        var tlsSocket = nodeTls().connect(tlsConnectOpts, function () {
           upgradedToTLS = true;
           try { socket.removeAllListeners("data"); } catch (_e) { /* listeners migrate to upgraded socket */ }
           attachSocket(tlsSocket);

package/lib/mcp-tool-registry.js

@@ -64,7 +64,7 @@ var lazyRequire   = require("./lazy-require");
 var validateOpts  = require("./validate-opts");
 var { McpError }  = require("./framework-error");
 
-var crypto = lazyRequire(function () { return require("./crypto"); });
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 var audit  = lazyRequire(function () { return require("./audit"); });
 var C      = require("./constants");
 
@@ -202,7 +202,7 @@ function create(opts) {
       outputSchema: tool.outputSchema || null,
       alg:         alg,
     });
-    var sig = crypto().sign(Buffer.from(payload, "utf8"), signingKey);
+    var sig = bCrypto().sign(Buffer.from(payload, "utf8"), signingKey);
     return {
       tool:         tool.name,
       description:  tool.description || "",
@@ -254,7 +254,7 @@ function create(opts) {
       }),
       issuedAt: new Date().toISOString(),
     });
-    var sig = crypto().sign(Buffer.from(manifestBody, "utf8"), signingKey);
+    var sig = bCrypto().sign(Buffer.from(manifestBody, "utf8"), signingKey);
     return {
       body:      manifestBody,
       signature: sig.toString("base64"),
@@ -309,7 +309,7 @@ function create(opts) {
     }
     var nonce = typeof callOpts.nonce === "string" && callOpts.nonce.length > 0
       ? callOpts.nonce
-      : crypto().generateToken(16);                                                                // allow:raw-byte-literal — 128-bit nonce, not byte arithmetic on a payload
+      : bCrypto().generateToken(16);                                                                // allow:raw-byte-literal — 128-bit nonce, not byte arithmetic on a payload
     var iat = new Date();
     var exp = new Date(iat.getTime() + ttlMs);
     var envelope = {
@@ -320,7 +320,7 @@ function create(opts) {
       exp:      exp.toISOString(),
     };
     var payload = Buffer.from(canonicalJson.stringify(envelope), "utf8");
-    var sig = crypto().sign(payload, signingKey);
+    var sig = bCrypto().sign(payload, signingKey);
     _emitAudit("mcp.tool_registry.call_signed",
       { tool: envelope.tool, nonce: nonce, alg: alg });
     return {
@@ -438,7 +438,7 @@ function create(opts) {
         "verifyCall: signature not valid base64");
     }
     var ok;
-    try { ok = crypto().verify(payload, sigBuf, verifyingKey); }
+    try { ok = bCrypto().verify(payload, sigBuf, verifyingKey); }
     catch (verifyErr) {
       _emitAudit("mcp.tool_registry.call_verify_error",
         { tool: env.tool, nonce: env.nonce, error: String(verifyErr.message || verifyErr) }, "denied");

package/lib/middleware/asyncapi-serve.js

@@ -19,7 +19,7 @@
  * paths / methods.
  */
 
-var nodeCrypto    = require("crypto");
+var nodeCrypto    = require("node:crypto");
 var validateOpts  = require("../validate-opts");
 var lazyRequire   = require("../lazy-require");
 var { defineClass } = require("../framework-error");

package/lib/middleware/body-parser.js

@@ -100,7 +100,7 @@
  *     dots collapsed, control characters stripped, length capped at 255.
  *     Tmp file path is generated by the framework, never derived from
  *     the operator-supplied filename — so a malicious filename can't
- *     collide with a sensitive nodePath.
+ *     collide with a sensitive path.
  *   - Multipart parser refuses fields whose `name` is in POISONED_KEYS
  *     (consistent with the JSON path).
  *   - Tmp files set with mode 0o600, parent dir created with 0o700.
@@ -108,9 +108,9 @@
  *     error) so a crashing handler doesn't leak files.
  */
 
-var nodeFs = require("fs");
-var os = require("os");
-var nodePath = require("path");
+var nodeFs = require("node:fs");
+var os = require("node:os");
+var nodePath = require("node:path");
 var nodeCrypto = require("node:crypto");
 var atomicFile      = require("../atomic-file");
 var bCrypto         = require("../crypto");
@@ -123,7 +123,7 @@ var validateOpts    = require("../validate-opts");
 var C = require("../constants");
 var { defineClass } = require("../framework-error");
 
-var auditFwk = lazyRequire(function () { return require("../audit"); });
+var audit = lazyRequire(function () { return require("../audit"); });
 
 // Node's HTTP parser surfaces malformed chunked-transfer-encoding via a
 // stable family of HPE_* codes. RFC 9112 §7.1 — when a server rejects a
@@ -1294,7 +1294,7 @@ function create(opts) {
           ? "http.chunked.extension.refused"
           : "http.chunked.malformed.refused";
         try {
-          auditFwk().safeEmit({
+          audit().safeEmit({
             action:  chunkAction,
             outcome: "denied",
             metadata: {