@blamejs/blamejs-shop 0.3.5 → 0.3.7

package/lib/vendor/blamejs/lib/calendar.js

@@ -98,8 +98,8 @@ var JSCAL_NOTE_STATUS = Object.freeze({
 
 // Recurrence-expansion caps. Mirror b.safeIcal's RRULE limits so the
 // expand path can't outpace what the parser already permitted.
-var MAX_EXPAND_INSTANCES = 4096;                                                                       // allow:raw-byte-literal — instance count cap, not bytes
-var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;                                             // allow:raw-byte-literal + allow:raw-time-literal — 10 year max expansion span
+var MAX_EXPAND_INSTANCES = 4096;                                                                       // instance count cap, not bytes
+var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;                                             // allow:raw-time-literal — 10 year max expansion span
 
 /**
  * @primitive b.calendar.validate
@@ -138,7 +138,7 @@ function validate(jsCal) {
     throw new CalendarError("calendar/no-uid",
       "b.calendar.validate: uid is required (RFC 8984 §5.1.4)");
   }
-  if (jsCal.uid.length > 1024) {                                                                       // allow:raw-byte-literal — anti-DoS uid length cap
+  if (jsCal.uid.length > 1024) {                                                                       // anti-DoS uid length cap
     throw new CalendarError("calendar/oversize-uid",
       "b.calendar.validate: uid exceeds 1024 bytes");
   }
@@ -183,7 +183,7 @@ function validate(jsCal) {
       // refuse.
       if (typeof jsCal.percentComplete !== "number" || !isFinite(jsCal.percentComplete) ||
           !Number.isInteger(jsCal.percentComplete) ||
-          jsCal.percentComplete < 0 || jsCal.percentComplete > 100) {                                  // allow:raw-byte-literal — RFC 8984 §6 percent range
+          jsCal.percentComplete < 0 || jsCal.percentComplete > 100) {                                  // RFC 8984 §6 percent range
         throw new CalendarError("calendar/bad-percent",
           "b.calendar.validate: Task.percentComplete MUST be an integer in 0..100 (RFC 8984 §6.4.4 UnsignedInt)");
       }
@@ -586,7 +586,7 @@ function expandRecurrence(event, opts) {
   // specified, they are expanded independently and the resulting
   // instances are UNIONed (deduped + sorted ascending). Per-rule
   // count caps apply per-rule per the same section.
-  var globalStepBudget = MAX_EXPAND_INSTANCES * 366;                                                   // allow:raw-byte-literal — total days/year step budget shared across all rules
+  var globalStepBudget = MAX_EXPAND_INSTANCES * 366;                                                   // total days/year step budget shared across all rules
   var seen = Object.create(null);
   var unioned = [];
   for (var rrIndex = 0; rrIndex < event.recurrenceRules.length; rrIndex += 1) {
@@ -644,7 +644,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byMonthSet = Object.create(null);
     for (var mi = 0; mi < rule.byMonth.length; mi += 1) {
       var mn = parseInt(rule.byMonth[mi], 10);
-      if (isFinite(mn) && mn >= 1 && mn <= 12) byMonthSet[mn] = true;                                  // allow:raw-byte-literal — 12 calendar months
+      if (isFinite(mn) && mn >= 1 && mn <= 12) byMonthSet[mn] = true;                                  // 12 calendar months
     }
   }
   var byMonthDaySet = null;
@@ -652,7 +652,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byMonthDaySet = Object.create(null);
     for (var mdi = 0; mdi < rule.byMonthDay.length; mdi += 1) {
       var mdn = parseInt(rule.byMonthDay[mdi], 10);
-      if (isFinite(mdn) && mdn !== 0 && mdn >= -31 && mdn <= 31) byMonthDaySet[mdn] = true;            // allow:raw-byte-literal — calendar day-of-month bounds
+      if (isFinite(mdn) && mdn !== 0 && mdn >= -31 && mdn <= 31) byMonthDaySet[mdn] = true;            // calendar day-of-month bounds
     }
   }
   // RFC 5545 §3.3.10 — BYWEEKNO refines yearly recurrences to specific
@@ -663,7 +663,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byWeekNoSet = Object.create(null);
     for (var wni = 0; wni < rule.byWeekNo.length; wni += 1) {
       var wn = parseInt(rule.byWeekNo[wni], 10);
-      if (isFinite(wn) && wn !== 0 && wn >= -53 && wn <= 53) byWeekNoSet[wn] = true;                   // allow:raw-byte-literal — ISO 8601 week-number bounds
+      if (isFinite(wn) && wn !== 0 && wn >= -53 && wn <= 53) byWeekNoSet[wn] = true;                   // ISO 8601 week-number bounds
     }
   }
   // BYYEARDAY — day-of-year (1..366 or -1..-366; negative counts from
@@ -673,7 +673,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byYearDaySet = Object.create(null);
     for (var ydi = 0; ydi < rule.byYearDay.length; ydi += 1) {
       var yd = parseInt(rule.byYearDay[ydi], 10);
-      if (isFinite(yd) && yd !== 0 && yd >= -366 && yd <= 366) byYearDaySet[yd] = true;                // allow:raw-byte-literal — day-of-year bounds
+      if (isFinite(yd) && yd !== 0 && yd >= -366 && yd <= 366) byYearDaySet[yd] = true;                // day-of-year bounds
     }
   }
   // BYHOUR / BYMINUTE / BYSECOND — time-of-day filters. RFC 5545 §3.3.10
@@ -695,9 +695,9 @@ function _expandSingleRule(rule, startMs, ctx) {
     // unfiltered candidate per RFC 5545's tolerant grammar.
     return hasAny ? s : null;
   }
-  var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // allow:raw-byte-literal — RFC 5545 hour range
-  var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // allow:raw-byte-literal — RFC 5545 minute range
-  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-byte-literal — RFC 5545 second range incl. leap second // allow:raw-time-literal — second-of-minute bound, not a duration
+  var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // RFC 5545 hour range
+  var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // RFC 5545 minute range
+  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-time-literal — second-of-minute bound, not a duration
 
   function _isoWeekParts(d) {
     // ISO 8601 week-of-year + week-year. The week-YEAR can differ
@@ -706,10 +706,10 @@ function _expandSingleRule(rule, startMs, ctx) {
     // Returns { week, year }.
     var tmp = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));
     var dayOfWeek = tmp.getUTCDay() || 7;
-    tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // allow:raw-byte-literal — ISO week-year anchor (Thursday)
+    tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // ISO week-year anchor (Thursday)
     var weekYear = tmp.getUTCFullYear();
     var yearStart = new Date(Date.UTC(weekYear, 0, 1));
-    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week // allow:raw-byte-literal
+    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week
     return { week: week, year: weekYear };
   }
   function _isoWeekOf(d) {
@@ -717,10 +717,10 @@ function _expandSingleRule(rule, startMs, ctx) {
   }
   function _yearDayOf(d) {
     var startOfYear = new Date(Date.UTC(d.getUTCFullYear(), 0, 1));
-    return Math.floor((d - startOfYear) / 86400000) + 1;                                               // allow:raw-time-literal — 86400000 ms/day // allow:raw-byte-literal
+    return Math.floor((d - startOfYear) / 86400000) + 1;                                               // allow:raw-time-literal — 86400000 ms/day
   }
   function _daysInYear(year) {
-    return ((year % 4 === 0 && year % 100 !== 0) || year % 400 === 0) ? 366 : 365;                      // allow:raw-byte-literal — Gregorian leap-year rule
+    return ((year % 4 === 0 && year % 100 !== 0) || year % 400 === 0) ? 366 : 365;                      // Gregorian leap-year rule
   }
   function _matchesBy(t) {
     var d = new Date(t);
@@ -738,7 +738,7 @@ function _expandSingleRule(rule, startMs, ctx) {
       // a future explicit knob if demand surfaces.
       var iso = _isoWeekParts(d);
       if (iso.year !== d.getUTCFullYear()) return false;
-      var lastWeek = _isoWeekOf(new Date(Date.UTC(d.getUTCFullYear(), 11, 28)));                       // allow:raw-byte-literal — Dec 28 always in last ISO week
+      var lastWeek = _isoWeekOf(new Date(Date.UTC(d.getUTCFullYear(), 11, 28)));                       // Dec 28 always in last ISO week
       if (!byWeekNoSet[iso.week] && !byWeekNoSet[-(lastWeek - iso.week + 1)]) return false;
     }
     if (byYearDaySet) {
@@ -814,7 +814,7 @@ function _bySetPosArray(raw) {
   var out = [];
   for (var i = 0; i < raw.length; i += 1) {
     var n = parseInt(raw[i], 10);
-    if (isFinite(n) && n !== 0 && n >= -366 && n <= 366) out.push(n);                                  // allow:raw-byte-literal — RFC 5545 §3.3.10 bysetpos range
+    if (isFinite(n) && n !== 0 && n >= -366 && n <= 366) out.push(n);                                  // RFC 5545 §3.3.10 bysetpos range
   }
   return out.length > 0 ? out : null;
 }
@@ -864,12 +864,12 @@ function _expandWithBysetpos(ctx) {
     // periods (e.g. YEARLY = 366 days) can't loop forever.
     var candidates = [];
     var dayMs = period.startMs;
-    var safety = 400;                                                                                  // allow:raw-byte-literal — period day cap (covers leap year 366 + slack)
+    var safety = 400;                                                                                  // period day cap (covers leap year 366 + slack)
     while (dayMs <= period.endMs && safety-- > 0 && stepBudgetRef.remaining > 0) {
       stepBudgetRef.remaining -= 1;
       var candidate = _withTimeOfDay(dayMs, hh, mm, ss, ms);
       if (matchesBy(candidate)) candidates.push(candidate);
-      dayMs += 86400000;                                                                               // allow:raw-time-literal — 86400000 ms/day step // allow:raw-byte-literal — same constant in ms/day form
+      dayMs += 86400000;                                                                               // allow:raw-time-literal — 86400000 ms/day step
     }
 
     // Sort + apply BYSETPOS. Positive index 1-based from start;
@@ -919,8 +919,8 @@ function _periodForIndex(freq, startDate, offset) {
   }
   if (freq === "monthly") {
     var bm = startDate.getUTCMonth() + offset;
-    var by = startDate.getUTCFullYear() + Math.floor(bm / 12);                                         // allow:raw-byte-literal — months/year
-    var mm = ((bm % 12) + 12) % 12;                                                                    // allow:raw-byte-literal — months/year
+    var by = startDate.getUTCFullYear() + Math.floor(bm / 12);                                         // months/year
+    var mm = ((bm % 12) + 12) % 12;                                                                    // months/year
     var ms = Date.UTC(by, mm, 1, 0, 0, 0, 0);
     var me = Date.UTC(by, mm + 1, 1, 0, 0, 0, 0) - 1;
     return { startMs: ms, endMs: me };
@@ -928,9 +928,9 @@ function _periodForIndex(freq, startDate, offset) {
   // weekly — align to WKST=Monday (RFC 5545 default WKST).
   var anchor = new Date(Date.UTC(startDate.getUTCFullYear(), startDate.getUTCMonth(), startDate.getUTCDate(), 0, 0, 0, 0));
   var dow = anchor.getUTCDay() || 7;
-  anchor.setUTCDate(anchor.getUTCDate() - (dow - 1) + offset * 7);                                     // allow:raw-byte-literal — days/week
+  anchor.setUTCDate(anchor.getUTCDate() - (dow - 1) + offset * 7);                                     // days/week
   var ws = anchor.getTime();
-  var we = ws + 7 * 86400000 - 1;                                                                      // allow:raw-byte-literal + allow:raw-time-literal — 7-day window
+  var we = ws + 7 * 86400000 - 1;                                                                      // allow:raw-time-literal — 7-day window
   return { startMs: ws, endMs: we };
 }
 
@@ -1021,7 +1021,7 @@ function _vtodoToJsCalTask(vt) {
   var percent = _firstValue(props["PERCENT-COMPLETE"]);
   if (percent !== null && percent !== undefined) {
     var pn = parseInt(percent, 10);
-    if (isFinite(pn) && pn >= 0 && pn <= 100) jsCal.percentComplete = pn;                              // allow:raw-byte-literal — RFC 8984 §6 percent range
+    if (isFinite(pn) && pn >= 0 && pn <= 100) jsCal.percentComplete = pn;                              // RFC 8984 §6 percent range
   }
   var completed = _firstValue(props.COMPLETED);
   if (completed) jsCal.progressUpdated = _icalDateTimeToUtc(completed);
@@ -1202,7 +1202,7 @@ function _advance(ms, freq, interval) {
   var d = new Date(ms);
   switch (freq) {
   case "daily":   d.setUTCDate(d.getUTCDate() + interval); break;
-  case "weekly":  d.setUTCDate(d.getUTCDate() + 7 * interval); break;                                  // allow:raw-byte-literal — 7 days/week
+  case "weekly":  d.setUTCDate(d.getUTCDate() + 7 * interval); break;                                  // 7 days/week
   case "monthly": d.setUTCMonth(d.getUTCMonth() + interval); break;
   case "yearly":  d.setUTCFullYear(d.getUTCFullYear() + interval); break;
   case "hourly":  d.setUTCHours(d.getUTCHours() + interval); break;
@@ -1227,10 +1227,10 @@ function _foldLine(s) {
   // RFC 5545 §3.1 — content lines SHOULD NOT exceed 75 octets; fold
   // with CRLF + leading space. We let the joining code add the
   // trailing CRLF; this helper only inserts the intra-line fold.
-  if (s.length <= 75) return s;                                                                        // allow:raw-byte-literal — RFC 5545 §3.1 line-length cap
+  if (s.length <= 75) return s;                                                                        // RFC 5545 §3.1 line-length cap
   var out = "";
-  for (var i = 0; i < s.length; i += 73) {                                                             // allow:raw-byte-literal — 73 = 75 minus the CR/LF wrap
-    out += (i === 0 ? "" : "\r\n ") + s.slice(i, i + 73);                                              // allow:raw-byte-literal — same cap
+  for (var i = 0; i < s.length; i += 73) {                                                             // 73 = 75 minus the CR/LF wrap
+    out += (i === 0 ? "" : "\r\n ") + s.slice(i, i + 73);                                              // same cap
   }
   return out;
 }

package/lib/vendor/blamejs/lib/cbor.js

@@ -58,15 +58,15 @@ var { defineClass } = require("./framework-error");
 
 var CborError = defineClass("CborError", { alwaysPermanent: true });
 
-var DEFAULT_MAX_DEPTH = 64;                                                            // allow:raw-byte-literal — nesting depth, not a size
-var ABSOLUTE_MAX_DEPTH = 256;                                                          // allow:raw-byte-literal — nesting depth ceiling, not a size
+var DEFAULT_MAX_DEPTH = 64;                                                            // nesting depth, not a size
+var ABSOLUTE_MAX_DEPTH = 256;                                                          // nesting depth ceiling, not a size
 var DEFAULT_MAX_BYTES = C.BYTES.mib(16);
 var ABSOLUTE_MAX_BYTES = C.BYTES.mib(64);
 
 // CBOR / IEEE-754 wire constants (not byte sizes — protocol values).
-var CBOR_AI_1BYTE = 24;            // allow:raw-byte-literal — RFC 8949 §3 additional-info boundary (inline vs 1-byte argument)
-var BYTES_64BIT = 8;               // allow:raw-byte-literal — width of a CBOR uint64 / float64 argument, not a cap
-var FLOAT16_MANT_DIV = 1024;       // allow:raw-byte-literal — IEEE 754 half-precision mantissa scale (2^10), not a size
+var CBOR_AI_1BYTE = 24;            // RFC 8949 §3 additional-info boundary (inline vs 1-byte argument)
+var BYTES_64BIT = 8;               // width of a CBOR uint64 / float64 argument, not a cap
+var FLOAT16_MANT_DIV = 1024;       // IEEE 754 half-precision mantissa scale (2^10), not a size
 
 /**
  * @primitive b.cbor.Tag
@@ -110,9 +110,9 @@ function _capInt(v, dflt, absolute) {
 // + SCITT depend on this — emitting float64 for a value representable
 // in float16 is non-canonical and trips requireDeterministic.
 function _encodeFloat(value) {
-  if (Number.isNaN(value)) return Buffer.from([0xf9, 0x7e, 0x00]);                      // allow:raw-byte-literal — canonical half NaN (RFC 8949 §4.2.1)
-  if (value === Infinity) return Buffer.from([0xf9, 0x7c, 0x00]);                       // allow:raw-byte-literal — half +Inf
-  if (value === -Infinity) return Buffer.from([0xf9, 0xfc, 0x00]);                      // allow:raw-byte-literal — half -Inf
+  if (Number.isNaN(value)) return Buffer.from([0xf9, 0x7e, 0x00]);                      // canonical half NaN (RFC 8949 §4.2.1)
+  if (value === Infinity) return Buffer.from([0xf9, 0x7c, 0x00]);                       // half +Inf
+  if (value === -Infinity) return Buffer.from([0xf9, 0xfc, 0x00]);                      // half -Inf
   var half = _doubleToHalfBits(value);
   if (half >= 0) { var hb = Buffer.alloc(3); hb[0] = 0xf9; hb.writeUInt16BE(half, 1); return hb; }
   var f4 = Buffer.alloc(5); f4[0] = 0xfa; f4.writeFloatBE(value, 1);
@@ -167,10 +167,10 @@ function _head(major, argument) {
 }
 
 function _encodeValue(value, opts) {
-  if (value === null) return Buffer.from([0xf6]);                                       // allow:raw-byte-literal — CBOR null simple value
-  if (value === undefined) return Buffer.from([0xf7]);                                  // allow:raw-byte-literal — CBOR undefined simple value
-  if (value === true) return Buffer.from([0xf5]);                                       // allow:raw-byte-literal — CBOR true simple value
-  if (value === false) return Buffer.from([0xf4]);                                      // allow:raw-byte-literal — CBOR false simple value
+  if (value === null) return Buffer.from([0xf6]);                                       // CBOR null simple value
+  if (value === undefined) return Buffer.from([0xf7]);                                  // CBOR undefined simple value
+  if (value === true) return Buffer.from([0xf5]);                                       // CBOR true simple value
+  if (value === false) return Buffer.from([0xf4]);                                      // CBOR false simple value
 
   if (typeof value === "number") {
     // Exact integers within the safe range encode as CBOR integers;

package/lib/vendor/blamejs/lib/cdn-cache-control.js

@@ -251,7 +251,7 @@ function build(opts) {
     // regex. RFC 7234 §5.2 token directives are tiny in practice
     // (max-age = 7 chars, stale-while-revalidate = 22); 64 is the
     // operator-headroom ceiling.
-    var DIRECTIVE_MAX = 64;                                                                        // allow:raw-byte-literal — directive key/value length cap
+    var DIRECTIVE_MAX = 64;                                                                        // directive key/value length cap
     for (var e = 0; e < ekeys.length; e += 1) {
       var ek = ekeys[e];
       if (ek.length === 0 || ek.length > DIRECTIVE_MAX || !DIRECTIVE_KEY_RE.test(ek)) {

package/lib/vendor/blamejs/lib/cert.js

@@ -69,8 +69,8 @@ var log = boot("cert");
 var DEFAULT_RENEW_INTERVAL_MS    = C.TIME.hours(6);
 var DEFAULT_MIN_DAYS_BEFORE_EXPIRY = 14;
 var DEFAULT_OCSP_REFRESH_MS      = C.TIME.hours(12);
-var MAX_DOMAINS_PER_CERT         = 100;                                              // allow:raw-byte-literal — operator-facing manifest size cap, not a byte count (RFC 6066 SNI permits more)
-var MAX_CERTS_PER_MANAGER        = 1000;                                             // allow:raw-byte-literal — operator-facing manifest size cap, not a byte count
+var MAX_DOMAINS_PER_CERT         = 100;                                              // operator-facing manifest size cap, not a byte count (RFC 6066 SNI permits more)
+var MAX_CERTS_PER_MANAGER        = 1000;                                             // operator-facing manifest size cap, not a byte count
 
 function _positiveFiniteOrDefault(value, defaultValue, label, code) {
   if (value === undefined || value === null) return defaultValue;
@@ -481,9 +481,9 @@ function create(opts) {
   // counts. The framework's leaf-key alg names embed the bit length
   // verbatim ("rsa-2048" / "rsa-3072" / "rsa-4096"), so the literals
   // here are protocol-constant references.
-  var RSA_MODULUS_BITS_2048 = 2048;                                                  // allow:raw-byte-literal — RSA modulus length, not a byte count
-  var RSA_MODULUS_BITS_3072 = 3072;                                                  // allow:raw-byte-literal — RSA modulus length, not a byte count
-  var RSA_MODULUS_BITS_4096 = 4096;                                                  // allow:raw-byte-literal — RSA modulus length, not a byte count
+  var RSA_MODULUS_BITS_2048 = 2048;                                                  // RSA modulus length, not a byte count
+  var RSA_MODULUS_BITS_3072 = 3072;                                                  // RSA modulus length, not a byte count
+  var RSA_MODULUS_BITS_4096 = 4096;                                                  // RSA modulus length, not a byte count
 
   function _generateLeafKeypair(keyAlg) {
     switch (keyAlg) {

package/lib/vendor/blamejs/lib/cloud-events.js

@@ -275,8 +275,8 @@ function parse(envelope) {
 
 // ---- validate / isValid (non-throwing spec check) ----
 
-var INT_MIN = -2147483648;                                  // allow:raw-byte-literal — CloudEvents Integer type range
-var INT_MAX = 2147483647;                                   // allow:raw-byte-literal — CloudEvents Integer type range
+var INT_MIN = -2147483648;                                  // CloudEvents Integer type range
+var INT_MAX = 2147483647;                                   // CloudEvents Integer type range
 // JSON-formatted media type essence (after the parameters are stripped):
 // type/json or type/anything+json. Each run is bounded by the single "/"
 // separator so the match is linear (no overlapping quantifiers → no
@@ -515,8 +515,8 @@ function _pctEncode(s) {
   var out = "";
   for (var i = 0; i < bytes.length; i += 1) {
     var by = bytes[i];
-    if (by < 0x21 || by > 0x7E || by === 0x22 || by === 0x25) {   // allow:raw-byte-literal — printable-ASCII bounds + double-quote and percent (HTTP binding header rule)
-      out += "%" + bytes[i].toString(16).toUpperCase().padStart(2, "0");   // allow:raw-byte-literal — 16 is the hex radix
+    if (by < 0x21 || by > 0x7E || by === 0x22 || by === 0x25) {   // printable-ASCII bounds + double-quote and percent (HTTP binding header rule)
+      out += "%" + bytes[i].toString(16).toUpperCase().padStart(2, "0");   // 16 is the hex radix
     } else {
       out += String.fromCharCode(by);
     }
@@ -528,7 +528,7 @@ function _pctDecode(s) {
   var i = 0;
   while (i < s.length) {
     if (s[i] === "%" && /^[0-9A-Fa-f]{2}$/.test(s.slice(i + 1, i + 3))) {
-      bytes.push(parseInt(s.slice(i + 1, i + 3), 16));   // allow:raw-byte-literal — 16 is the hex radix
+      bytes.push(parseInt(s.slice(i + 1, i + 3), 16));   // 16 is the hex radix
       i += 3;
     } else {
       var ch = Buffer.from(s[i], "utf8");

package/lib/vendor/blamejs/lib/cms-codec.js

@@ -107,14 +107,14 @@ var OID = Object.freeze({
 });
 
 // Refusal ceilings.
-var MAX_DEPTH       = 32;                                                                             // allow:raw-byte-literal — ASN.1 recursion ceiling
+var MAX_DEPTH       = 32;                                                                             // ASN.1 recursion ceiling
 var DEFAULT_MAX_LEN = 64 * 1024 * 1024;                                                               // allow:raw-byte-literal — 64 MiB default decode cap
 
 // Universal-tag bytes used in encode helpers.
-var TAG_SEQUENCE = 0x30;                                                                              // allow:raw-byte-literal — ASN.1 SEQUENCE constructed
-var TAG_SET      = 0x31;                                                                              // allow:raw-byte-literal — ASN.1 SET constructed
-var TAG_UTCTIME  = 0x17;                                                                              // allow:raw-byte-literal — UTCTime universal
-var TAG_GENTIME  = 0x18;                                                                              // allow:raw-byte-literal — GeneralizedTime universal
+var TAG_SEQUENCE = 0x30;                                                                              // ASN.1 SEQUENCE constructed
+var TAG_SET      = 0x31;                                                                              // ASN.1 SET constructed
+var TAG_UTCTIME  = 0x17;                                                                              // UTCTime universal
+var TAG_GENTIME  = 0x18;                                                                              // GeneralizedTime universal
 
 /**
  * @primitive b.cms.encodeSignedData
@@ -197,7 +197,7 @@ function encodeSignedData(opts) {
 
   // SignedData SEQUENCE per §5.1.
   var signedDataSeq = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([1])),                                                              // allow:raw-byte-literal — CMSVersion 1 per §5.1
+    asn1.writeInteger(Buffer.from([1])),                                                              // CMSVersion 1 per §5.1
     digestAlgs,
     encapInfo,
     certsBlock,
@@ -258,7 +258,7 @@ function encodeEnvelopedData(opts) {
       "encodeEnvelopedData: opts.recipients must be a non-empty array");
   }
   // Fresh ChaCha20-Poly1305 content key.
-  var contentKey = bCrypto.generateBytes(32);                                                         // allow:raw-byte-literal — 256-bit ChaCha20 key
+  var contentKey = bCrypto.generateBytes(32);                                                         // 256-bit ChaCha20 key
 
   // recipientInfos SET — one KEMRecipientInfo per recipient.
   var ris = opts.recipients.map(function (r) {
@@ -272,7 +272,7 @@ function encodeEnvelopedData(opts) {
   // EnvelopedData SEQUENCE per §6.1. CMSVersion 4 (RFC 9629 §3 — when
   // any RecipientInfo is OtherRecipientInfo, here KEMRecipientInfo).
   var envelopedSeq = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([4])),                                                              // allow:raw-byte-literal — CMSVersion 4 per RFC 9629 §3
+    asn1.writeInteger(Buffer.from([4])),                                                              // CMSVersion 4 per RFC 9629 §3
     recipientInfosSet,
     encContent,
   ]));
@@ -334,7 +334,7 @@ function decode(buf, opts) {
   }
   if (!(node.tag === asn1.TAG.SEQUENCE && node.constructed)) {
     throw new CmsCodecError("cms/bad-content-info",
-      "decode: top-level must be SEQUENCE (got tag 0x" + node.tag.toString(16) + ")");                // allow:raw-byte-literal — hex radix for error-message formatting
+      "decode: top-level must be SEQUENCE (got tag 0x" + node.tag.toString(16) + ")");                // hex radix for error-message formatting
   }
   // ContentInfo SEQUENCE children: { contentType OID, [0] EXPLICIT ANY }.
   var children;
@@ -399,7 +399,7 @@ function _writeImplicitConstructed(tagNumber, payload) {
   // [N] IMPLICIT context-specific CONSTRUCTED — for wrapping SEQUENCE /
   // SET payloads (e.g. certificates [0], crls [1], OtherRecipientInfo
   // value).
-  var tagByte = 0xa0 | (tagNumber & 0x1f);                                                            // allow:raw-byte-literal — context-specific constructed mask
+  var tagByte = 0xa0 | (tagNumber & 0x1f);                                                            // context-specific constructed mask
   return asn1.writeNode(tagByte, payload);
 }
 
@@ -410,7 +410,7 @@ function _writeImplicitPrimitive(tagNumber, value) {
   // reject the structure (Codex P1 finding on PR #102 — RecipientIdentifier
   // CHOICE's SubjectKeyIdentifier alternative is `[0] IMPLICIT OCTET STRING`,
   // a primitive type).
-  var tagByte = 0x80 | (tagNumber & 0x1f);                                                            // allow:raw-byte-literal — context-specific primitive mask
+  var tagByte = 0x80 | (tagNumber & 0x1f);                                                            // context-specific primitive mask
   return asn1.writeNode(tagByte, value);
 }
 
@@ -459,7 +459,7 @@ function _signerInfo(signer, msgDigest, digestOid) {
   // SignerInfo, and use the original `31 LL VV...` form as the signature
   // input.
   var signatureInput = signedAttrs;
-  var signedAttrsImplicit = Buffer.concat([Buffer.from([0xa0]),                                       // allow:raw-byte-literal — IMPLICIT [0] tag per RFC 5652 §5.3
+  var signedAttrsImplicit = Buffer.concat([Buffer.from([0xa0]),                                       // IMPLICIT [0] tag per RFC 5652 §5.3
                                             signedAttrs.slice(1)]);
 
   var signature;
@@ -474,7 +474,7 @@ function _signerInfo(signer, msgDigest, digestOid) {
 
   // SignerInfo SEQUENCE per §5.3 (issuerAndSerialNumber variant — CMSVersion 1).
   return asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([1])),                                                              // allow:raw-byte-literal — CMSVersion 1 for issuerAndSerialNumber
+    asn1.writeInteger(Buffer.from([1])),                                                              // CMSVersion 1 for issuerAndSerialNumber
     _issuerAndSerialNumber(signer.certificate),
     _algorithmIdentifier(digestOid),
     signedAttrsImplicit,
@@ -576,9 +576,9 @@ function _reEncodeNode(node) {
   // TLV. writeNode rebuilds canonical DER from the original tag byte +
   // value bytes; the tag byte is reconstructed from tagClass + constructed +
   // tag number.
-  var classBits  = (node.tagClass & 0x03) << 6;                                                       // allow:raw-byte-literal — tag-class shift
-  var consBit    = node.constructed ? 0x20 : 0x00;                                                    // allow:raw-byte-literal — constructed bit
-  var tagBits    = node.tag & 0x1f;                                                                   // allow:raw-byte-literal — short-form tag
+  var classBits  = (node.tagClass & 0x03) << 6;                                                       // tag-class shift
+  var consBit    = node.constructed ? 0x20 : 0x00;                                                    // constructed bit
+  var tagBits    = node.tag & 0x1f;                                                                   // short-form tag
   var tagByte    = classBits | consBit | tagBits;
   return asn1.writeNode(tagByte, node.value);
 }
@@ -620,7 +620,7 @@ function _recipientInfo(recipient, contentKey) {
   // composition path.
   var infoLabel = Buffer.from("cms/kemri/chacha20-poly1305", "ascii");
   var kdfInput  = Buffer.concat([Buffer.from(encap.sharedSecret), infoLabel]);
-  var kek       = bCrypto.kdf(kdfInput, 32);                                                          // allow:raw-byte-literal — 256-bit KEK
+  var kek       = bCrypto.kdf(kdfInput, 32);                                                          // 256-bit KEK
   // Wrap the content key under the KEK using ChaCha20-Poly1305.
   var wrapped;
   try { wrapped = bCrypto.encryptPacked(contentKey, kek); }
@@ -631,7 +631,7 @@ function _recipientInfo(recipient, contentKey) {
   // KEMRecipientInfo SEQUENCE.
   // Simplified ordering, version 0 per RFC 9629 §3.
   var kemRi = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([0])),                                                              // allow:raw-byte-literal — KEMRecipientInfo version 0
+    asn1.writeInteger(Buffer.from([0])),                                                              // KEMRecipientInfo version 0
     // rid CHOICE per RFC 9629 §3: this module ships the [0] IMPLICIT
     // SubjectKeyIdentifier alternative — SKI is `[0] IMPLICIT OCTET
     // STRING` (PRIMITIVE per RFC 5652 §10.2.4). The constructed form
@@ -642,7 +642,7 @@ function _recipientInfo(recipient, contentKey) {
     _algorithmIdentifier(OID.mlkem1024),                                                              // kem
     asn1.writeOctetString(Buffer.from(encap.cipherText)),                                             // kemct
     _algorithmIdentifier(OID.shake256),                                                               // kdf
-    asn1.writeInteger(Buffer.from([32])),                                                             // allow:raw-byte-literal — kekLength = 32 bytes
+    asn1.writeInteger(Buffer.from([32])),                                                             // kekLength = 32 bytes
     _algorithmIdentifier(OID.chacha20Poly1305),                                                       // wrap (also used as content-encryption AlgId; same OID)
     asn1.writeOctetString(wrapped),                                                                   // encryptedKey
   ]));
@@ -653,7 +653,7 @@ function _recipientInfo(recipient, contentKey) {
     asn1.writeOid(OID.kemri),
     kemRi,
   ]);
-  return asn1.writeNode(0xa4, oriValue);                                                              // allow:raw-byte-literal — [4] IMPLICIT context-specific constructed (ori CHOICE)
+  return asn1.writeNode(0xa4, oriValue);                                                              // [4] IMPLICIT context-specific constructed (ori CHOICE)
 }
 
 function _encryptedContentInfo(plaintext, contentKey) {
@@ -797,7 +797,7 @@ function _readSignerInfo(siNode) {
   var signedAttrsRaw = null;
   if (c[idx] && c[idx].tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && c[idx].tag === 0) {
     var implicitRaw = _reEncodeNode(c[idx]);
-    signedAttrsRaw = Buffer.concat([Buffer.from([0x31]), implicitRaw.slice(1)]);                      // allow:raw-byte-literal — universal SET tag per RFC 5652 §5.4
+    signedAttrsRaw = Buffer.concat([Buffer.from([0x31]), implicitRaw.slice(1)]);                      // universal SET tag per RFC 5652 §5.4
     idx += 1;
   }
   var sigAlgOid = _readAlgIdOid(c[idx]); idx += 1;

package/lib/vendor/blamejs/lib/codepoint-class.js

@@ -50,7 +50,7 @@
  *     WJ   U+2060  BOM  U+FEFF
  */
 
-var HEX_RADIX = 16;                                                 // allow:raw-byte-literal — base-16 radix, not byte size
+var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 function hex4(cp) {
   var s = cp.toString(HEX_RADIX).toUpperCase();
@@ -94,17 +94,17 @@ var BOM_CHAR  = fromCp(0xFEFF);
 // is a single edit.
 var SCRIPT_RANGES = {
   latin:    [[0x0041, 0x005A], [0x0061, 0x007A],
-             [0x00C0, 0x024F], [0x1E00, 0x1EFF]],                                 // allow:raw-byte-literal — Unicode script ranges
-  cyrillic: [[0x0400, 0x04FF], [0x0500, 0x052F]],                                 // allow:raw-byte-literal — Unicode Cyrillic + Cyrillic Supplement
-  greek:    [[0x0370, 0x03FF], [0x1F00, 0x1FFF]],                                 // allow:raw-byte-literal — Unicode Greek + Greek Extended
-  armenian: [[0x0530, 0x058F]],                                                   // allow:raw-byte-literal — Unicode Armenian
-  cherokee: [[0x13A0, 0x13FF], [0xAB70, 0xABBF]],                                 // allow:raw-byte-literal — Unicode Cherokee + Cherokee Supplement
-  han:      [[0x4E00, 0x9FFF]],                                                   // allow:raw-byte-literal — CJK Unified Ideographs
-  hiragana: [[0x3040, 0x309F]],                                                   // allow:raw-byte-literal — Hiragana
-  katakana: [[0x30A0, 0x30FF]],                                                   // allow:raw-byte-literal — Katakana
-  hangul:   [[0xAC00, 0xD7AF]],                                                   // allow:raw-byte-literal — Hangul Syllables
-  arabic:   [[0x0600, 0x06FF]],                                                   // allow:raw-byte-literal — Arabic
-  hebrew:   [[0x0590, 0x05FF]],                                                   // allow:raw-byte-literal — Hebrew
+             [0x00C0, 0x024F], [0x1E00, 0x1EFF]],                                 // Unicode script ranges
+  cyrillic: [[0x0400, 0x04FF], [0x0500, 0x052F]],                                 // Unicode Cyrillic + Cyrillic Supplement
+  greek:    [[0x0370, 0x03FF], [0x1F00, 0x1FFF]],                                 // Unicode Greek + Greek Extended
+  armenian: [[0x0530, 0x058F]],                                                   // Unicode Armenian
+  cherokee: [[0x13A0, 0x13FF], [0xAB70, 0xABBF]],                                 // Unicode Cherokee + Cherokee Supplement
+  han:      [[0x4E00, 0x9FFF]],                                                   // CJK Unified Ideographs
+  hiragana: [[0x3040, 0x309F]],                                                   // Hiragana
+  katakana: [[0x30A0, 0x30FF]],                                                   // Katakana
+  hangul:   [[0xAC00, 0xD7AF]],                                                   // Hangul Syllables
+  arabic:   [[0x0600, 0x06FF]],                                                   // Arabic
+  hebrew:   [[0x0590, 0x05FF]],                                                   // Hebrew
 };
 
 // scriptFor(cp) — returns the script-name string for a codepoint, or

package/lib/vendor/blamejs/lib/compliance-sanctions-fuzzy.js

@@ -104,7 +104,7 @@ function tokenize(name) {
   return n.split(" ").filter(function (t) { return t.length > 0; });
 }
 
-var MAX_INPUT_LEN = 512;                                                           // allow:raw-byte-literal — name length sanity cap (operators can override fuzzy.create)
+var MAX_INPUT_LEN = 512;                                                           // name length sanity cap (operators can override fuzzy.create)
 
 // ---- Levenshtein with cap + early-exit ----
 
@@ -155,7 +155,7 @@ function jaro(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return 0;
   if (a === b) return a.length === 0 ? 0 : 1;
   if (a.length === 0 || b.length === 0) return 0;
-  var matchWindow = Math.max(0, Math.floor(Math.max(a.length, b.length) / 2) - 1);  // allow:raw-byte-literal — Jaro match-window formula
+  var matchWindow = Math.max(0, Math.floor(Math.max(a.length, b.length) / 2) - 1);  // Jaro match-window formula
   var aMatched = new Array(a.length).fill(false);
   var bMatched = new Array(b.length).fill(false);
   var matches = 0;
@@ -183,7 +183,7 @@ function jaro(a, b) {
   }
   var transpositions = t / 2;
   return (matches / a.length + matches / b.length +
-          (matches - transpositions) / matches) / 3;                                // allow:raw-byte-literal — Jaro 3-term formula
+          (matches - transpositions) / matches) / 3;                                // Jaro 3-term formula
 }
 
 function jaroWinkler(a, b, prefixWeight) {
@@ -198,7 +198,7 @@ function jaroWinkler(a, b, prefixWeight) {
   var j = jaro(a, b);
   if (j === 0) return 0;
   // Common prefix up to 4 chars (Winkler's cap)
-  var maxPrefix = 4;                                                               // allow:raw-byte-literal — Jaro-Winkler prefix cap (Winkler 1990)
+  var maxPrefix = 4;                                                               // Jaro-Winkler prefix cap (Winkler 1990)
   var prefixLen = 0;
   var max = Math.min(a.length, b.length, maxPrefix);
   for (var i = 0; i < max; i++) {

package/lib/vendor/blamejs/lib/compliance-sanctions.js

@@ -274,7 +274,7 @@ function create(opts) {
       VALID_STRATEGIES.join(", "));
   }
   var maxLevenshtein = (typeof fuzzyOpts.maxLevenshtein === "number" && isFinite(fuzzyOpts.maxLevenshtein))
-    ? fuzzyOpts.maxLevenshtein : 3;                                                // allow:raw-byte-literal — default edit-distance cap (operator-tunable)
+    ? fuzzyOpts.maxLevenshtein : 3;                                                // default edit-distance cap (operator-tunable)
   var auditOn = opts.audit !== false;
   var ruleVersion = opts.ruleVersion || ("entries:" + opts.entries.length);
 
@@ -327,10 +327,10 @@ function create(opts) {
       }
       // Substring containment scores 0.92 (high but below exact)
       if (fuzzy.substringContains(name, qNorm)) {
-        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // allow:raw-byte-literal — substring-match score weight
+        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // substring-match score weight
       }
       if (fuzzy.substringContains(qNorm, name)) {
-        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // allow:raw-byte-literal — substring-match score weight
+        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // substring-match score weight
       }
     }
     return { score: bestScore, name: bestName };
@@ -491,7 +491,7 @@ function create(opts) {
       algorithm:    algorithm,
       ruleVersion:  ruleVersion,
       entryCount:   index.length,
-      digest:       hash.digest("hex").slice(0, 32),                                // allow:raw-byte-literal — first 32 hex chars (128 bits) of SHA-3 digest, sufficient for snapshot identity
+      digest:       hash.digest("hex").slice(0, 32),                                // first 32 hex chars (128 bits) of SHA-3 digest, sufficient for snapshot identity
       digestAlg:    "sha3-512-trunc128",
       capturedAt:   Date.now(),
     };