chore: use prefixed node builtins where appropriate

This change adds the `node:` prefix to (almost) all `require()` calls of Node.js builtins.

Two places were special cases:

1. In `viz`, old Webpack does not understand the `node:` prefix; this had to be exempted from the rule.
2. In `tofu`, I added another test to assert both prefixed and non-prefixed builtin references work as expected.

Note that test fixture projects are ignored by ESLint; they have not been changed.

packages/aa/test/bench.js

@@ -47,7 +47,7 @@ const recordMemorySpike = (frequency = 10) => {
 
 const history = (name, value) => {
   const fs = require('node:fs')
-  const { execSync } = require('child_process')
+  const { execSync } = require('node:child_process')
   const filePath = `.bench-${name}.log` // the intention is for the file to be gitignored and only referred locally
   let log = {}
   if (fs.existsSync(filePath)) {

packages/allow-scripts/src/index.js

@@ -1,7 +1,7 @@
 // @ts-check
 
-const { promises: fs } = require('fs')
-const path = require('path')
+const { promises: fs } = require('node:fs')
+const path = require('node:path')
 const npmRunScript = require('@npmcli/run-script')
 const normalizeBin = require('npm-normalize-package-bin')
 const { linkBinAbsolute, linkBinRelative } = require('./linker.js')

packages/allow-scripts/src/linker.js

@@ -7,7 +7,7 @@ const linkBin = isWindows
   ? require('bin-links/lib/shim-bin.js')
   : require('bin-links/lib/link-bin.js')
 
-const { dirname, resolve, relative } = require('path')
+const { dirname, resolve, relative } = require('node:path')
 
 /**
  * @param {LinkBinOpts} opts

packages/allow-scripts/src/setup.js

@@ -3,9 +3,9 @@ const {
   appendFileSync,
   readFileSync,
   writeFileSync,
-} = require('fs')
-const { spawnSync } = require('child_process')
-const path = require('path')
+} = require('node:fs')
+const { spawnSync } = require('node:child_process')
+const path = require('node:path')
 const { FEATURE } = require('./toggles')
 
 const NPM = {

packages/allow-scripts/src/whichbin.js

@@ -2,7 +2,7 @@
 /* eslint-disable n/shebang */
 
 // @ts-check
-const path = require('path')
+const path = require('node:path')
 const { getOptionsForBin } = require('./index.js')
 const { FEATURE } = require('./toggles.js')
 

packages/browserify/src/createPackageDataStream.js

@@ -1,4 +1,4 @@
-const { callbackify } = require('util')
+const { callbackify } = require('node:util')
 const through = require('through2').obj
 const { getPackageNameForModulePath } = require('@lavamoat/aa')
 

packages/browserify/src/index.js

@@ -1,5 +1,5 @@
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const { getDefaultPaths } = require('lavamoat-core')
 const jsonStringify = require('json-stable-stringify')
 const { createModuleInspectorSpy } = require('./createModuleInspectorSpy.js')

packages/browserify/src/sesTransforms.js

@@ -1,4 +1,4 @@
-const path = require('path')
+const path = require('node:path')
 const { PassThrough } = require('readable-stream')
 const duplexify = require('duplexify')
 const concatStream = require('concat-stream')

packages/browserify/test/fixtures/secureBundling/lavamoat/node/policy.json

@@ -109,13 +109,13 @@
     },
     "@lavamoat/lavapack": {
       "builtin": {
-        "assert": true,
-        "buffer.Buffer.from": true,
-        "fs.promises.readFile": true,
-        "fs.promises.writeFile": true,
-        "fs.readFileSync": true,
-        "path.join": true,
-        "path.relative": true
+        "node:assert": true,
+        "node:buffer.Buffer.from": true,
+        "node:fs.promises.readFile": true,
+        "node:fs.promises.writeFile": true,
+        "node:fs.readFileSync": true,
+        "node:path.join": true,
+        "node:path.relative": true
       },
       "globals": {
         "__dirname": true,
@@ -1022,12 +1022,11 @@
     },
     "lavamoat-core": {
       "builtin": {
-        "events": true,
-        "fs.readFileSync": true,
+        "node:events": true,
         "node:fs.readFileSync": true,
         "node:fs/promises.writeFile": true,
-        "path.extname": true,
-        "path.join": true
+        "node:path.extname": true,
+        "node:path.join": true
       },
       "globals": {
         "__dirname": true,

packages/browserify/test/lavamoatNode.spec.js

@@ -1,6 +1,6 @@
 const test = require('ava')
-const { execSync } = require('child_process')
-const path = require('path')
+const { execSync } = require('node:child_process')
+const path = require('node:path')
 const { evalBundle } = require('./util')
 
 test('lavamoat-node compat - bundle works under lavamoat node', (t) => {

packages/browserify/test/policy.spec.js

@@ -1,7 +1,7 @@
 /* eslint-disable ava/use-t-well */
 const test = require('ava')
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const {
   createScenarioFromScaffold,
   runAndTestScenario,

packages/browserify/test/util.js

@@ -1,8 +1,8 @@
-const { runInNewContext } = require('vm')
+const { runInNewContext } = require('node:vm')
 const browserify = require('browserify')
 const pify = require('pify')
-const { promises: fs } = require('fs')
-const path = require('path')
+const { promises: fs } = require('node:fs')
+const path = require('node:path')
 const watchify = require('watchify')
 const lavamoatPlugin = require('../src/index')
 const { verifySourceMaps } = require('./sourcemaps')
@@ -12,10 +12,10 @@ const {
   evaluateWithSourceUrl,
   createHookedConsole,
 } = require('lavamoat-core/test/util.js')
-const util = require('util')
+const util = require('node:util')
 const tmp = require('tmp-promise')
-const { spawnSync } = require('child_process')
-const execFile = util.promisify(require('child_process').execFile)
+const { spawnSync } = require('node:child_process')
+const execFile = util.promisify(require('node:child_process').execFile)
 
 const WORKSPACE_ROOT = path.resolve(__dirname, '..', '..', '..')
 

packages/core/src/generateKernel.js

@@ -4,8 +4,8 @@
 // The prelude is defined in the `preludeTemplate` file, and here we inject the dynamic components,
 // such as the upgradeable SES and app specific config.
 
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const kernelTemplate = fs.readFileSync(
   path.join(__dirname, '/kernelTemplate.js'),
   'utf-8'

packages/core/src/generatePolicy.js

@@ -1,7 +1,7 @@
 // @ts-check
 
-const EventEmitter = require('events')
-const path = require('path')
+const EventEmitter = require('node:events')
+const path = require('node:path')
 const jsonStringify = require('json-stable-stringify')
 const {
   parse,

packages/core/test/builtin.spec.js

@@ -68,7 +68,7 @@ test('builtin - access via paths', async (t) => {
 test('builtin - paths soft-bindings preserve "this" but allow override', async (t) => {
   const scenario = createScenarioFromScaffold({
     defineOne: () => {
-      const { Buffer } = require('buffer')
+      const { Buffer } = require('node:buffer')
       const two = require('two')
       module.exports = {
         overrideCheck: two.overrideCheck(Buffer.from([1, 2, 3])),
@@ -78,7 +78,7 @@ test('builtin - paths soft-bindings preserve "this" but allow override', async (
     },
 
     defineTwo: () => {
-      const { Buffer } = require('buffer')
+      const { Buffer } = require('node:buffer')
       const thisChecker = require('thisChecker')
       const { SomeClass } = require('someClass')
       // this test ensures "Buffer.prototype.slice" is copied in a way that allows "this" to be overridden
@@ -101,13 +101,13 @@ test('builtin - paths soft-bindings preserve "this" but allow override', async (
       resources: {
         one: {
           builtin: {
-            'buffer.Buffer.from': true,
+            'node:buffer.Buffer.from': true,
           },
         },
         two: {
           builtin: {
             // these paths are carefully constructed to try and split the fn from its parent
-            'buffer.Buffer.prototype.slice': true,
+            'node:buffer.Buffer.prototype.slice': true,
             'thisChecker.check': true,
             'someClass.SomeClass': true,
           },
@@ -120,7 +120,7 @@ test('builtin - paths soft-bindings preserve "this" but allow override', async (
       classCheck: true,
     },
     builtin: {
-      buffer: require('buffer'),
+      'node:buffer': require('node:buffer'),
       thisChecker: (() => {
         const parent = {}
         parent.check = function () {

packages/lavapack/src/builder-runtime.js

@@ -1,7 +1,7 @@
-const { join: pathJoin } = require('path')
+const { join: pathJoin } = require('node:path')
 const {
   promises: { readFile, writeFile },
-} = require('fs')
+} = require('node:fs')
 const { generateKernel, makeInitStatsHook } = require('lavamoat-core')
 const {
   getStrictScopeTerminatorShimSrc,

packages/lavapack/src/pack.js

@@ -9,14 +9,14 @@
 // - cleanup: var -> const/let
 // - cleanup/refactor
 
-const fs = require('fs')
-const path = require('path')
-const assert = require('assert')
+const fs = require('node:fs')
+const path = require('node:path')
+const assert = require('node:assert')
 const JSONStream = require('JSONStream')
 const through = require('through2')
 const umd = require('umd')
 // eslint-disable-next-line n/prefer-global/buffer
-const { Buffer } = require('buffer')
+const { Buffer } = require('node:buffer')
 const combineSourceMap = require('combine-source-map')
 const convertSourceMap = require('convert-source-map')
 const jsonStringify = require('json-stable-stringify')

packages/lavapack/test/index.spec.js

@@ -1,4 +1,4 @@
-const fs = require('fs')
+const fs = require('node:fs')
 const test = require('ava')
 const { pipe, from, concat } = require('mississippi')
 const { SourceMapConsumer } = require('source-map')

packages/node/src/freshRealmCompartment.js

@@ -1,4 +1,4 @@
-const vm = require('vm')
+const vm = require('node:vm')
 const { getSesShimSrc } = require('lavamoat-core/src/generateKernel')
 
 module.exports = { createFreshRealmCompartment }

packages/node/src/index.js

@@ -1,7 +1,7 @@
 /* eslint-disable no-eval */
 
-const path = require('path')
-const fs = require('fs')
+const path = require('node:path')
+const fs = require('node:fs')
 const jsonStringify = require('json-stable-stringify')
 const { loadPolicy, loadPolicyAndApplyOverrides } = require('lavamoat-core')
 const { loadCanonicalNameMap } = require('@lavamoat/aa')

packages/node/src/kernel.js

@@ -1,6 +1,6 @@
 /* eslint no-eval: 0 */
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const resolve = require('resolve')
 const { sanitize } = require('htmlescape')
 const {

packages/node/src/parseForPolicy.js

@@ -1,6 +1,6 @@
-const path = require('path')
-const { promises: fs } = require('fs')
-const { builtinModules } = require('module')
+const path = require('node:path')
+const { promises: fs } = require('node:fs')
+const { builtinModules } = require('node:module')
 const resolve = require('resolve')
 const bindings = require('bindings')
 const gypBuild = require('node-gyp-build')

packages/node/src/run-command.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /* eslint-disable no-eval */
 
-const path = require('path')
-const fs = require('fs')
+const path = require('node:path')
+const fs = require('node:fs')
 const yargs = require('yargs')
 const yargsFlags = require('./yargsFlags')
 const { runLava } = require('./index')

packages/node/test/util.js

@@ -1,7 +1,7 @@
 // @ts-check
 
-const util = require('util')
-const execFile = util.promisify(require('child_process').execFile)
+const util = require('node:util')
+const execFile = util.promisify(require('node:child_process').execFile)
 const { prepareScenarioOnDisk } = require('lavamoat-core/test/util.js')
 module.exports = {
   runLavamoat,
@@ -12,6 +12,7 @@ module.exports = {
  * Add one or more CLI options to an array of args
  *
  * Mutates `args`
+ *
  * @param {string[]} args - Array of args
  * @param {string} key - Option name
  * @param {any} value - Value; if array, `key` will be set multiple times

packages/node/test/waysToRun.spec.js

@@ -1,6 +1,6 @@
 const test = require('ava')
-const util = require('util')
-const execFile = util.promisify(require('child_process').execFile)
+const util = require('node:util')
+const execFile = util.promisify(require('node:child_process').execFile)
 
 const { runLava } = require('../src/index')
 

packages/perf/build.js

@@ -1,7 +1,7 @@
-const fs = require('fs')
+const fs = require('node:fs')
 const browserify = require('browserify')
 const lavamoatPlugin = require('lavamoat-browserify')
-const { pipeline } = require('stream')
+const { pipeline } = require('node:stream')
 
 // "autogen": "--plugin [ lavamoat-browserify --writeAutoPolicy --policy ./lavamoat-policy.json ] > /dev/null",
 // "default": "--plugin [ lavamoat-browserify --policy ./lavamoat-policy.json ] > bundle.js",

packages/perf/endo.js

@@ -1,6 +1,6 @@
-const fs = require('fs')
-const url = require('url')
-const crypto = require('crypto')
+const fs = require('node:fs')
+const url = require('node:url')
+const crypto = require('node:crypto')
 
 require('ses')
 lockdown()
@@ -48,14 +48,14 @@ async function main() {
     transforms
 
   const modules = {
-    stream: await addToCompartment('stream', require('stream')),
-    events: await addToCompartment('events', require('events')),
-    buffer: await addToCompartment('buffer', require('buffer')),
-    util: await addToCompartment('util', require('util')),
-    crypto: await addToCompartment('crypto', require('crypto')),
-    assert: await addToCompartment('assert', require('assert')),
-    path: await addToCompartment('path', require('path')),
-    fs: await addToCompartment('fs', require('fs')),
+    stream: await addToCompartment('stream', require('node:stream')),
+    events: await addToCompartment('events', require('node:events')),
+    buffer: await addToCompartment('buffer', require('node:buffer')),
+    util: await addToCompartment('util', require('node:util')),
+    crypto: await addToCompartment('crypto', require('node:crypto')),
+    assert: await addToCompartment('assert', require('node:assert')),
+    path: await addToCompartment('path', require('node:path')),
+    fs: await addToCompartment('fs', require('node:fs')),
   }
 
   const readPowers = makeReadPowers({ fs, url, crypto })

packages/perf/performTask.js

@@ -1,5 +1,5 @@
-const util = require('util')
-const exec = util.promisify(require('child_process').exec)
+const util = require('node:util')
+const exec = util.promisify(require('node:child_process').exec)
 
 module.exports = { performTest }
 

packages/survey/src/downloadPackage.js

@@ -1,7 +1,7 @@
-const util = require('util')
-const execFile = util.promisify(require('child_process').execFile)
-const { promises: fs } = require('fs')
-const { resolve, join } = require('path')
+const util = require('node:util')
+const execFile = util.promisify(require('node:child_process').execFile)
+const { promises: fs } = require('node:fs')
+const { resolve, join } = require('node:path')
 
 module.exports = {
   downloadPackage,