@blamejs/blamejs-shop 0.3.15 → 0.3.16

package/lib/vendor/blamejs/lib/guard-image.js

@@ -111,7 +111,7 @@ var PROFILES = Object.freeze({
     framesPolicy:              "reject",
     maxWidth:                  C.BYTES.bytes(8192),                              // pixel cap, repurposing bytes() for clarity
     maxHeight:                 C.BYTES.bytes(8192),
-    maxFrames:                 60,                                               // allow:raw-time-literal — animation frame count, not seconds
+    maxFrames:                 60,                                               // allow:raw-time-literal — max-frame count 60; coincidental multiple-of-60, not a duration, C.TIME N/A
     maxBytes:                  C.BYTES.mib(32),
     maxRuntimeMs:              C.TIME.seconds(5),
   },

package/lib/vendor/blamejs/lib/guard-list-unsubscribe.js

@@ -371,7 +371,7 @@ function _hasControlChar(s) {
 
 function _trunc(s) {
   if (s.length <= 64) return s;                                                                          // error-message truncation
-  return s.slice(0, 60) + "…";                                                                          // allow:raw-time-literal — char count for error-message truncation, not seconds
+  return s.slice(0, 60) + "…";                                                                          // allow:raw-time-literal — truncation char-count 60; coincidental multiple-of-60, not a duration, C.TIME N/A
 }
 
 function _verdict(action, reason, extra) {

package/lib/vendor/blamejs/lib/guard-time.js

@@ -254,7 +254,7 @@ function _detectIssues(input, opts) {
       snippet: "minute " + minute + " > 59",
     });
   }
-  if (second > 60) {                                                             // allow:raw-time-literal — leap-second ceiling, RFC 3339 §5.6 (not seconds-of-time)
+  if (second > 60) {                                                             // allow:raw-time-literal — leap-second ceiling literal 60 (RFC 3339 5.6); coincidental multiple-of-60, not a duration, C.TIME N/A
     issues.push({
       kind: "second-range", severity: "high",
       ruleId: "time.second-range",

package/lib/vendor/blamejs/lib/guard-xml.js

@@ -303,7 +303,7 @@ function _detectIssues(input, opts) {
   // get the NCR cap disabled with them. The `maxNumericCharRefs` opt
   // is validated by `numericBounds.requireAllPositiveFiniteIntIfPresent`
   // at the public-surface boundary above.
-  var ncrCap = opts.maxNumericCharRefs;                                          // allow:numeric-opt-no-bounds-check — validated at public boundary
+  var ncrCap = opts.maxNumericCharRefs;
   if (ncrCap !== undefined && ncrCap !== null) {
     var ncrMatches = input.match(NUMERIC_CHAR_REF_RE);                           // allow:regex-no-length-cap — input bounded by maxBytes above
     var ncrCount = ncrMatches === null ? 0 : ncrMatches.length;

package/lib/vendor/blamejs/lib/http-client-cache.js

@@ -66,7 +66,7 @@ var HEURISTIC_MAX_AGE_MS = C.TIME.hours(24);
 // Statuses RFC 9110 designates as heuristically cacheable. (Plus 200/206
 // which are universally cacheable when a freshness lifetime is given.)
 var CACHEABLE_STATUSES = new Set([
-  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-time-literal — same line, status codes not seconds
+  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-time-literal — RFC 9111 cacheable status-code set; coincidental multiple-of-60 entries, not durations, C.TIME N/A
 ]);
 
 // Headers that MUST not be forwarded when serving a 304-updated entry.

package/lib/vendor/blamejs/lib/iab-tcf.js

@@ -108,7 +108,7 @@ var TCF_V23_POLICY_VERSION = 4;
 var SEGMENT_TYPE_DISCLOSED_VENDORS = 1;                                                        // TCF segment-type marker, not bytes
 var SEGMENT_TYPE_ALLOWED_VENDORS   = 2;                                                        // TCF segment-type marker, not bytes
 var SEGMENT_TYPE_PUBLISHER_TC      = 3;                                                        // TCF segment-type marker, not bytes
-var MAX_TC_STRING_BYTES = 64 * 1024;                                                           // allow:raw-byte-literal — request-payload cap
+var MAX_TC_STRING_BYTES = 64 * 1024;
 
 // base64url decode (no padding) → Buffer.
 function _b64urlDecode(s) {
@@ -186,8 +186,8 @@ function _parseCore(buf) {
   var publisherRestrictions = _parsePublisherRestrictions(r);
   return {
     version:               version,
-    createdAt:             createdRaw * 100,                                                   // allow:raw-time-literal — TCF spec deciseconds → ms
-    lastUpdatedAt:         lastUpdatedRaw * 100,                                               // allow:raw-time-literal — TCF spec deciseconds → ms
+    createdAt:             createdRaw * 100,
+    lastUpdatedAt:         lastUpdatedRaw * 100,
     cmpId:                 cmpId,
     cmpVersion:            cmpVersion,
     consentScreen:         consentScreen,
@@ -545,7 +545,7 @@ function _idRuns(ids) {
 function _decisec(t) {
   var ms = t instanceof Date ? t.getTime() : (t == null ? Date.now() : Number(t));
   if (!isFinite(ms) || ms < 0) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: timestamp must be a Date or non-negative epoch-ms");
-  return Math.round(ms / 100);                                                                  // allow:raw-time-literal — ms → TCF deciseconds
+  return Math.round(ms / 100);
 }
 
 // Bit writer mirroring _bitReader: bits are packed high-bit-first, then the

package/lib/vendor/blamejs/lib/json-schema.js

@@ -487,7 +487,7 @@ function _typeMatches(typeKw, instance, actual) {
 function _checkNumber(schema, n, emit) {
   if (typeof schema.multipleOf === "number") {
     var q = n / schema.multipleOf;
-    if (!isFinite(q) || Math.abs(q - Math.round(q)) > 1e-9 * Math.max(1, Math.abs(q))) {   // allow:raw-time-literal — float tolerance for multipleOf
+    if (!isFinite(q) || Math.abs(q - Math.round(q)) > 1e-9 * Math.max(1, Math.abs(q))) {
       // Exact check for integers; tolerance only bridges float error.
       if (n % schema.multipleOf !== 0) emit("multipleOf", "value is not a multiple of " + schema.multipleOf);
     }

package/lib/vendor/blamejs/lib/jtd.js

@@ -33,7 +33,7 @@ var rfc3339 = require("./rfc3339");
 
 var JtdError = defineClass("JtdError", { alwaysPermanent: true });
 
-var MAX_DEPTH = 10000;                                       // allow:raw-time-literal — recursion cap for self-referential refs
+var MAX_DEPTH = 10000;
 
 var TYPES = {
   boolean: 1, string: 1, timestamp: 1, float32: 1, float64: 1,

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -1819,7 +1819,7 @@ function authResultsEmit(opts) {
 //   //   }
 
 var DMARC_RUA_MAX_REPORT_BYTES = C.BYTES.mib(8);
-var DMARC_RUA_MAX_RECORDS_PER_REPORT = 10000;                                     // allow:raw-time-literal — record cap, not seconds
+var DMARC_RUA_MAX_RECORDS_PER_REPORT = 10000;
 
 function _arrayOf(value) {
   if (value === undefined || value === null) return [];

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -444,7 +444,7 @@ function validateTinyPsSvg(svgBytes) {
         if (lname === "href" || lname === "xlink:href") {
           if (aval.length > 0 && aval.charAt(0) !== "#") {
             _vio("external-ref-forbidden",
-              "external reference in `" + aname + "='" + aval.slice(0, 60) /* allow:raw-time-literal — display truncation chars, not seconds */ + "...'` " +
+              "external reference in `" + aname + "='" + aval.slice(0, 60) /* allow:raw-time-literal — display truncation char-count 60; coincidental multiple-of-60, not a duration, C.TIME N/A */ + "...'` " +
               "is forbidden in Tiny-PS (only `#fragment` permitted)");
           }
         }

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -754,7 +754,7 @@ function checkCert(opts) {
   if (pub && pub.asymmetricKeyType === "rsa") {
     var jwk = pub.export({ format: "jwk" });
     var nBytes = Buffer.from(jwk.n, "base64url");
-    var bits = nBytes.length * 8;                                                                     // allow:raw-time-literal — RFC 5280 in comment, not seconds
+    var bits = nBytes.length * 8;                                                                     // allow:raw-time-literal — byte-length*8 bit count; coincidental multiple-of-60 product, not a duration, C.TIME N/A
     if (bits < RSA_MIN_BITS) {
       throw new MailCryptoError("mail-crypto/smime/rsa-too-small",
         "cert public key is " + bits + " RSA bits; minimum is " + RSA_MIN_BITS +

package/lib/vendor/blamejs/lib/mail-server-mx.js

@@ -998,7 +998,7 @@ function create(opts) {
     });
     var deadline = Date.now() + timeoutMs;
     while (connections.size > 0 && Date.now() < deadline) {
-      await safeAsync.sleep(100);                                                                    // allow:raw-time-literal — close-drain poll interval (sub-second; operator-bounded by timeoutMs)
+      await safeAsync.sleep(100);
     }
     connections.forEach(function (sock) {
       try { sock.destroy(); } catch (_e) { /* best-effort */ }

package/lib/vendor/blamejs/lib/mail-server-rate-limit.js

@@ -96,7 +96,7 @@ var MailServerRateLimitError = defineClass("MailServerRateLimitError", { alwaysP
 
 var DEFAULTS = Object.freeze({
   maxConcurrentConnectionsPerIp: 10,
-  connectionsPerIpPerMinute:     60,                                                                  // allow:raw-time-literal — connection count, not a time value
+  connectionsPerIpPerMinute:     60,                                                                  // allow:raw-time-literal — per-minute connection rate 60; time-derived (per-minute) single source of truth, C.TIME N/A as a count
   authFailuresPerIpPer15Min:     10,
   minBytesPerSecond:             100,                                                                 // slow-loris byte-rate floor
   // RCPT-TO recipient-failure cap defends against the 550-vs-250

package/lib/vendor/blamejs/lib/mail-server-submission.js

@@ -1347,7 +1347,7 @@ function create(opts) {
     });
     var deadline = Date.now() + timeoutMs;
     while (connections.size > 0 && Date.now() < deadline) {
-      await safeAsync.sleep(100);                                                                    // allow:raw-time-literal — sub-second drain poll
+      await safeAsync.sleep(100);
     }
     connections.forEach(function (sock) {
       try { sock.destroy(); } catch (_e) { /* best-effort */ }

package/lib/vendor/blamejs/lib/mcp.js

@@ -45,12 +45,12 @@ var METHOD_NAME_MAX   = 256;
 // JSON-RPC 2.0 error codes (https://www.jsonrpc.org/specification#error_object).
 // Negative numerics by spec; mapped to HTTP status for the framework's
 // HTTP-shaped reply envelope.
-var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST = -32600;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND= -32601;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS  = -32602;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR  = -32603;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_AUTH_REQUIRED   = -32001;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-time-literal — JSON-RPC error code -32700; coincidental multiple-of-60, not a time value, C.TIME N/A
+var JSONRPC_INVALID_REQUEST = -32600;
+var JSONRPC_METHOD_NOT_FOUND= -32601;
+var JSONRPC_INVALID_PARAMS  = -32602;
+var JSONRPC_INTERNAL_ERROR  = -32603;
+var JSONRPC_AUTH_REQUIRED   = -32001;
 var TOOL_NAME_RE     = /^[a-zA-Z][a-zA-Z0-9._-]{0,63}$/;
 var RESOURCE_NAME_RE = /^[a-zA-Z][a-zA-Z0-9._/-]{0,255}$/;
 
@@ -424,7 +424,7 @@ function serverGuard(opts) {
  *   var safe = b.mcp.toolResult.sanitize(toolResp, { posture: "sanitize" });
  *   // → { content: [{ type: "text", text: "<cleaned>" }] }
  */
-var DEFAULT_TOOL_OUTPUT_MAX_BYTES = 64 * 1024;                                                   // allow:raw-byte-literal — 64 KiB per content block
+var DEFAULT_TOOL_OUTPUT_MAX_BYTES = 64 * 1024;
 var PROMPT_INJECTION_MARKERS = [
   "ignore (previous|prior|all) instructions",
   "system:\\s*you are",

package/lib/vendor/blamejs/lib/mdoc.js

@@ -58,7 +58,7 @@ var { defineClass } = require("./framework-error");
 
 var MdocError = defineClass("MdocError", { alwaysPermanent: true });
 
-var HDR_X5CHAIN = 33;                                  // allow:raw-time-literal — x5chain COSE header label (RFC 9360 is a spec number, not a size/duration)
+var HDR_X5CHAIN = 33;
 var TAG_ENCODED_CBOR = 24;                             // RFC 8949 §3.4.5.1 embedded-CBOR tag
 // Tags ISO 18013-5 uses in issuer data: tdate(0), epoch(1), embedded
 // CBOR(24), full-date(1004, RFC 8943). Bounded — others are refused.

package/lib/vendor/blamejs/lib/metrics.js

@@ -729,7 +729,7 @@ function create(opts) {
           exemplar = {
             labels:    { trace_id: req.span.traceId, span_id: req.span.spanId },
             value:     elapsedSec,
-            timestamp: Date.now() / 1000,                                         // allow:raw-time-literal — OpenMetrics §6.2 unix epoch seconds with subsecond fraction
+            timestamp: Date.now() / 1000,
           };
         } else if (req.trace && req.trace.sampled && req.trace.traceId && req.trace.spanId) {
           // Operators wiring traceparent directly without
@@ -740,7 +740,7 @@ function create(opts) {
           exemplar = {
             labels:    { trace_id: req.trace.traceId, span_id: req.trace.spanId },
             value:     elapsedSec,
-            timestamp: Date.now() / 1000,                                         // allow:raw-time-literal — OpenMetrics §6.2 unix epoch seconds with subsecond fraction
+            timestamp: Date.now() / 1000,
           };
         }
         try { requestDuration.observe(durLabels, elapsedSec, exemplar); }

package/lib/vendor/blamejs/lib/middleware/compose-pipeline.js

@@ -97,7 +97,7 @@ var CANONICAL_POSITIONS = Object.freeze({
   botGuard:      42,                                                                                      // canonical position bucket
   requireAuth:   50,                                                                                      // canonical position bucket
   attachUser:    52,                                                                                      // canonical position bucket
-  handler:       60,                                                                                      // allow:raw-time-literal — pipeline position int, not seconds
+  handler:       60,                                                                                      // allow:raw-time-literal — pipeline position bucket; coincidental multiple-of-60, C.TIME N/A
   errorHandler:  90,                                                                                      // canonical position bucket
 });
 

package/lib/vendor/blamejs/lib/network-dnssec.js

@@ -293,7 +293,7 @@ function verifyRrset(opts) {
   } else {
     atMs = Date.now();
   }
-  var nowSec = Math.floor(atMs / 1000);                       // allow:raw-time-literal — ms→NumericDate seconds (RRSIG inception/expiration are seconds since epoch, RFC 4034 §3.1.5)
+  var nowSec = Math.floor(atMs / 1000);
   if (nowSec < (rrsig.inception >>> 0)) throw new DnssecError("dnssec/not-yet-valid", "dnssec.verifyRrset: RRSIG inception is in the future");
   if (nowSec > (rrsig.expiration >>> 0)) throw new DnssecError("dnssec/expired", "dnssec.verifyRrset: RRSIG has expired");
 
@@ -349,7 +349,7 @@ var BASE32HEX = "0123456789ABCDEFGHIJKLMNOPQRSTUV";          // RFC 4648 §7 ext
 var TYPE_DS = 43;                                            // IANA RR type DS
 var TYPE_CNAME = 5;
 var NSEC3_HASH_SHA1 = 1;                                     // RFC 5155 §5 — the only registered NSEC3 hash
-var DEFAULT_MAX_NSEC3_ITERATIONS = 150;                      // allow:raw-time-literal — DoS ceiling on iterated SHA-1; matches BIND 9.16.33+/Unbound 1.17.1 post-CVE-2023-50868 (RFC 9276 wants 0; deployed zones still use >0)
+var DEFAULT_MAX_NSEC3_ITERATIONS = 150;
 
 // KeyTrap (CVE-2023-50387) amplification caps. A hostile zone can publish
 // many DNSKEYs sharing one 16-bit key tag and many RRSIGs, forcing a

package/lib/vendor/blamejs/lib/network-smtp-policy.js

@@ -716,7 +716,7 @@ async function tlsRptSubmit(report, opts) {
 // tlsRpt.recordShape / tlsRpt.submit on the send side.
 
 var TLS_RPT_MAX_REPORT_BYTES = C.BYTES.mib(8);
-var TLS_RPT_MAX_POLICIES_PER_REPORT = 1024;                                       // allow:raw-time-literal — count cap, not seconds
+var TLS_RPT_MAX_POLICIES_PER_REPORT = 1024;
 
 function tlsRptParseReport(body, opts) {
   opts = opts || {};

package/lib/vendor/blamejs/lib/network-tls.js

@@ -837,7 +837,7 @@ function _parseTime(node) {
   if (s.length === 13 && s.charAt(12) === "Z") {                                 // UTCTime length per X.690
     // UTCTime YYMMDDhhmmssZ — 50+ → 19xx, else 20xx (RFC 5280 §4.1.2.5).
     year  = parseInt(s.slice(0, 2), 10);
-    year += year >= 50 ? 1900 : 2000;                                            // allow:raw-time-literal — RFC 5280 century pivot, calendar years
+    year += year >= 50 ? 1900 : 2000;
     month = parseInt(s.slice(2, 4), 10);
     day   = parseInt(s.slice(4, 6), 10);
     hour  = parseInt(s.slice(6, 8), 10);                                         // UTCTime hour-byte offsets

package/lib/vendor/blamejs/lib/network-tsig.js

@@ -41,7 +41,7 @@ var TsigError = defineClass("TsigError", { alwaysPermanent: true });
 
 var TYPE_TSIG = 250;                                        // IANA RR type TSIG
 var CLASS_ANY = 255;                                        // TSIG RRs use CLASS ANY
-var DEFAULT_FUDGE = 300;                                    // allow:raw-time-literal — RFC 8945 recommended fudge window (seconds)
+var DEFAULT_FUDGE = 300;
 
 // Algorithm name → Node hash. The strong HMAC-SHA-2 family is the safe set;
 // HMAC-MD5 and HMAC-SHA-1 are refused unless allowLegacy (kept only for
@@ -225,7 +225,7 @@ function sign(message, opts) {
   var secret = _secretBuf(opts.secret);
   var fudge = opts.fudge == null ? DEFAULT_FUDGE : opts.fudge;
   if (typeof fudge !== "number" || !isFinite(fudge) || fudge < 0 || fudge > 0xffff) throw new TsigError("tsig/bad-opt", "tsig.sign: fudge must be 0..65535 seconds");   // 16-bit fudge field
-  var time = opts.time == null ? Math.floor(Date.now() / 1000) : opts.time;   // allow:raw-time-literal — ms→s
+  var time = opts.time == null ? Math.floor(Date.now() / 1000) : opts.time;
   if (typeof time !== "number" || !isFinite(time) || time < 0) throw new TsigError("tsig/bad-opt", "tsig.sign: time must be a non-negative Unix-seconds number");
   var error = opts.error == null ? 0 : opts.error;
   var otherData = Buffer.isBuffer(opts.otherData) ? opts.otherData : Buffer.alloc(0);
@@ -379,7 +379,7 @@ function verify(message, opts) {
     macValid = timingSafeEqual(rr.mac, expected.slice(0, rr.mac.length));
   }
 
-  var now = opts.now == null ? Math.floor(Date.now() / 1000) : opts.now;   // allow:raw-time-literal — ms→s
+  var now = opts.now == null ? Math.floor(Date.now() / 1000) : opts.now;
   var timeValid = Math.abs(now - rr.timeSigned) <= rr.fudge;
 
   var reason = null;

package/lib/vendor/blamejs/lib/rfc3339.js

@@ -25,11 +25,11 @@ function isValidDateTime(s) {
   if (!m) return false;
   var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
   if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
-  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month (Gregorian)
+  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
   if (d > days[mo - 1]) return false;
   var tz = m[8];
   if (tz !== "Z" && tz !== "z") {
-    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
+    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;
   }
   return true;
 }

package/lib/vendor/blamejs/lib/safe-decompress.js

@@ -105,7 +105,7 @@ var _algorithms = {
 // classic bomb shapes (1000:1) while leaving headroom for legitimate
 // text / JSON / XML payloads (which compress 20-50:1 commonly). Per
 // RFC 8460 §5.2 community guidance for TLS-RPT report decompression.
-var DEFAULT_MAX_RATIO = 50;                                                          // allow:raw-time-literal — RFC number not seconds
+var DEFAULT_MAX_RATIO = 50;
 
 // Default input cap when operator omits opts.maxCompressedBytes —
 // 4 MiB matches the TLS-RPT receive surface and is a reasonable

package/lib/vendor/blamejs/lib/standard-webhooks.js

@@ -32,7 +32,7 @@ var { defineClass } = require("./framework-error");
 
 var StandardWebhooksError = defineClass("StandardWebhooksError", { alwaysPermanent: true });
 
-var DEFAULT_TOLERANCE_SEC = 300;                                                                      // allow:raw-time-literal — 5min default per StandardWebhooks §3.2
+var DEFAULT_TOLERANCE_SEC = 300;
 
 /**
  * @primitive b.standardWebhooks.sign
@@ -70,7 +70,7 @@ function sign(opts) {
   var id = opts.id || ("msg_" + bCrypto.generateToken(32));                                           // 32-char id token
   var timestamp = typeof opts.timestamp === "number"
     ? opts.timestamp
-    : Math.floor(Date.now() / 1000);                                                                  // allow:raw-time-literal — wall-clock seconds
+    : Math.floor(Date.now() / 1000);
   if (timestamp <= 0 || !isFinite(timestamp)) {
     throw new StandardWebhooksError("standard-webhooks/bad-timestamp",
       "sign: timestamp must be a positive finite integer");
@@ -148,7 +148,7 @@ function verify(opts) {
   numericBounds.requirePositiveFiniteIntIfPresent(opts.toleranceSec, "toleranceSec",
     StandardWebhooksError, "standard-webhooks/bad-tolerance");
   var tolerance = typeof opts.toleranceSec === "number" ? opts.toleranceSec : DEFAULT_TOLERANCE_SEC;
-  var nowSec = Math.floor(Date.now() / 1000);                                                         // allow:raw-time-literal — wall-clock seconds
+  var nowSec = Math.floor(Date.now() / 1000);
   if (Math.abs(nowSec - ts) > tolerance) {
     throw new StandardWebhooksError("standard-webhooks/timestamp-skew",
       "verify: timestamp skew " + Math.abs(nowSec - ts) + "s exceeds tolerance " + tolerance + "s");

package/lib/vendor/blamejs/lib/stream-throttle.js

@@ -71,9 +71,9 @@ var StreamThrottleError = defineClass("StreamThrottleError", { alwaysPermanent:
 // (bytes/sec ↔ wait-ms). This is a unit-conversion constant, not a
 // memory cap or protocol-byte literal; the framework's C.TIME / C.BYTES
 // helpers don't apply.
-var MS_PER_SECOND = 1000;                                                                             // allow:raw-time-literal — ms/sec unit conversion
+var MS_PER_SECOND = 1000;
 var NS_PER_MS     = 1e6;                                                                              // ns/ms unit conversion
-var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-time-literal — hrtime seconds→ms
+var MS_PER_SECOND_HRTIME = 1000;
 
 /**
  * @primitive b.streamThrottle.create

package/lib/vendor/blamejs/lib/structured-fields.js

@@ -542,7 +542,7 @@ function parse(input, type, opts) {
 
 function _serDecimal(v, E) {
   if (!isFinite(v)) throw E("structured-fields/serialize", "cannot serialize a non-finite decimal");
-  var n = Math.round(v * 1000) / 1000;                   // allow:raw-time-literal — RFC 8941 §4.1.5 decimal scale 10^3 (3 fractional digits), not a size or duration
+  var n = Math.round(v * 1000) / 1000;                   // allow:raw-time-literal — RFC 8941 4.1.5 decimal-scale 10^3 rounding; coincidental * 1000, not a duration, C.TIME N/A
   if (Math.abs(Math.trunc(n)).toString().length > 12) throw E("structured-fields/serialize", "decimal integer part exceeds 12 digits");   // §4.1.5 cap
   var s = n.toString();
   if (s.indexOf(".") === -1) s += ".0";                  // a Decimal must carry a fractional part

package/lib/vendor/blamejs/lib/vault/seal-pem-file.js

@@ -81,7 +81,7 @@ var SealPemFileError = defineClass("SealPemFileError", { alwaysPermanent: true }
 // doesn't sneak past the watcher. Operators with extremely-quiet
 // renewal cycles can override via opts.pollInterval; the cost of
 // 500ms polling on an idle PEM file is ~2 stat() syscalls/sec.
-var DEFAULT_POLL_MS = 500;                                                         // allow:raw-time-literal — 500ms watchFile cadence (sub-second)
+var DEFAULT_POLL_MS = 500;
 
 // PEM files are tiny — 4 KiB for an ECDSA key, ~8 KiB for a 4096-bit
 // RSA key, ~64 KiB for a long cert chain. Cap at 1 MiB so an operator

package/lib/vendor/blamejs/lib/web-push-vapid.js

@@ -134,7 +134,7 @@ function buildVapidAuthHeader(opts) {
       "buildVapidAuthHeader: subscription.endpoint is not a parseable URL");
   }
   var aud = endpointUrl.origin;
-  var now = Math.floor(Date.now() / 1000);                                                            // allow:raw-time-literal — wall-clock seconds for JWT exp
+  var now = Math.floor(Date.now() / 1000);
   // Inline JWT sign with ES256 — VAPID strictly mandates ECDSA-P256
   // (RFC 8292 §3.1). The framework jwt.sign is PQC-first and refuses
   // ES256 by design; VAPID is a wire-protocol constraint outside

package/lib/vendor/blamejs/lib/webhook.js

@@ -955,7 +955,7 @@ function sign(input) {
     }
     ts = Math.floor(input.timestamp);
   } else {
-    ts = Math.floor(Date.now() / 1000);                                                                // allow:raw-time-literal — unix-seconds conversion, Stripe spec uses seconds-not-ms
+    ts = Math.floor(Date.now() / 1000);
   }
   var hex = _hmacSha256Hex(secretBytes, ts + "." + bodyStr);
   return "t=" + ts + ",v1=" + hex;

package/lib/vendor/blamejs/lib/websocket.js

@@ -191,7 +191,7 @@ var CLOSE_GRACE_MS            = C.TIME.seconds(2);
 function _isValidCloseCode(code) {
   if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // RFC 6455 §7.4.2 reserved codes
   if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
-  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — WebSocket close-code range bound (RFC 6455 7.4.2); coincidental multiple-of-60, C.TIME N/A
   return false;
 }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.7",
+  "version": "0.14.8",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.14.8.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.8",
+  "date": "2026-05-30",
+  "headline": "Source-comment and codebase-check hygiene, plus a new require-block alignment check; no API or behaviour changes",
+  "summary": "Internal lint and comment cleanup with no operator-facing surface change. Several codebase-check comments and one stub helper name that described behaviour the check no longer has are corrected; an unused lint-suppression class and a set of stale duplicate-cluster qualifiers (functions that were since renamed or extracted) are pruned or re-pointed. Fifty-nine `// allow:` markers that named the byte-size or time-literal check on values those checks no longer flag are removed, and twenty self-negating rationales on markers the time check genuinely fires on are rewritten to say why the value coincidentally matches. A new codebase check holds top-of-file require blocks to consistent `=` column alignment, with the files that currently carry drift listed as a migration allowlist. No exported API, error code, wire format, or runtime behaviour changes.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Lint-suppression and codebase-check comment cleanup",
+          "body": "Corrected codebase-check comments that overstated their check's scope (a duplicate-code threshold described as three files when the advisory threshold is two, a narrowed byte-literal check carrying its pre-narrowing description, and a deferred-scan helper named as though it enforced a guarantee it does not yet provide). Removed an unused lint-suppression class and its one dead in-code marker, and pruned or re-pointed stale duplicate-cluster qualifiers that named functions since renamed or extracted into shared helpers. Removed fifty-nine `// allow:` markers that suppressed nothing, and rewrote twenty self-negating marker rationales (which read \"not seconds\" while sitting on a value the time check fires on) to explain the coincidental match. Source-comment and test hygiene only."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Require-block `=` alignment check",
+          "body": "A new codebase check flags a top-of-file require block that mixes its `=` column alignment — a fittable line whose `=` drifts off the column the rest of the block shares. Compact single-space blocks are exempt (only blocks that declare alignment intent are checked), as are destructures and long names physically too wide to reach the column, and blank- or comment-separated tiers align independently. The files that currently carry such drift are an explicit migration allowlist, reflowed over time; new code is held to the rule."
+        }
+      ]
+    }
+  ]
+}