@blamejs/core 0.14.0 → 0.14.2

package/lib/iab-tcf.js

@@ -100,14 +100,14 @@ var { defineClass } = require("./framework-error");
 var IabTcfError = defineClass("IabTcfError", { alwaysPermanent: true });
 
 // TCF v2.3 spec values.
-var TCF_V23_CORE_VERSION   = 4;                                                                // allow:raw-byte-literal — TCF spec version, not bytes
-var TCF_V23_POLICY_VERSION = 4;                                                                // allow:raw-byte-literal — TCF policy version, not bytes
+var TCF_V23_CORE_VERSION   = 4;                                                                // TCF spec version, not bytes
+var TCF_V23_POLICY_VERSION = 4;                                                                // TCF policy version, not bytes
 // SEGMENT_TYPE_CORE = 0 documented but not declared as a const — the
 // core segment is identified positionally (segment[0]) not by the
 // 3-bit type prefix the secondary segments use.
-var SEGMENT_TYPE_DISCLOSED_VENDORS = 1;                                                        // allow:raw-byte-literal — TCF segment-type marker, not bytes
-var SEGMENT_TYPE_ALLOWED_VENDORS   = 2;                                                        // allow:raw-byte-literal — TCF segment-type marker, not bytes
-var SEGMENT_TYPE_PUBLISHER_TC      = 3;                                                        // allow:raw-byte-literal — TCF segment-type marker, not bytes
+var SEGMENT_TYPE_DISCLOSED_VENDORS = 1;                                                        // TCF segment-type marker, not bytes
+var SEGMENT_TYPE_ALLOWED_VENDORS   = 2;                                                        // TCF segment-type marker, not bytes
+var SEGMENT_TYPE_PUBLISHER_TC      = 3;                                                        // TCF segment-type marker, not bytes
 var MAX_TC_STRING_BYTES = 64 * 1024;                                                           // allow:raw-byte-literal — request-payload cap
 
 // base64url decode (no padding) → Buffer.
@@ -124,7 +124,7 @@ function _b64urlDecode(s) {
 // Bit-level reader over a Buffer.
 function _bitReader(buf) {
   var bitOffset = 0;
-  var totalBits = buf.length * 8;                                                             // allow:raw-byte-literal — bits per byte
+  var totalBits = buf.length * 8;                                                             // bits per byte
   function read(n) {
     if (bitOffset + n > totalBits) {
       throw IabTcfError.factory("iab-tcf/bad-length",
@@ -137,7 +137,7 @@ function _bitReader(buf) {
     var v = 0;
     for (var i = 0; i < n; i += 1) {
       var byteIdx = (bitOffset + i) >> 3;
-      var bitIdx  = 7 - ((bitOffset + i) & 7);                                                  // allow:raw-byte-literal — high-bit-first ordering
+      var bitIdx  = 7 - ((bitOffset + i) & 7);                                                  // high-bit-first ordering
       v = (v * 2) + ((buf[byteIdx] >> bitIdx) & 1);
     }
     bitOffset += n;
@@ -159,25 +159,25 @@ function _bitReader(buf) {
 
 function _parseCore(buf) {
   var r = _bitReader(buf);
-  var version            = r.read(6);                                                          // allow:raw-byte-literal — TCF spec field width, not bytes
-  var createdRaw         = r.read(36);                                                         // allow:raw-byte-literal — TCF spec field width
-  var lastUpdatedRaw     = r.read(36);                                                         // allow:raw-byte-literal — TCF spec field width
-  var cmpId              = r.read(12);                                                         // allow:raw-byte-literal — TCF spec field width
-  var cmpVersion         = r.read(12);                                                         // allow:raw-byte-literal — TCF spec field width
-  var consentScreen      = r.read(6);                                                          // allow:raw-byte-literal — TCF spec field width
+  var version            = r.read(6);                                                          // TCF spec field width, not bytes
+  var createdRaw         = r.read(36);                                                         // TCF spec field width
+  var lastUpdatedRaw     = r.read(36);                                                         // TCF spec field width
+  var cmpId              = r.read(12);                                                         // TCF spec field width
+  var cmpVersion         = r.read(12);                                                         // TCF spec field width
+  var consentScreen      = r.read(6);                                                          // TCF spec field width
   // ConsentLanguage (12 bits = 2 chars × 6 bits, ASCII A-Z mapped 0-25)
-  var lang0 = r.read(6);                                                                       // allow:raw-byte-literal — TCF spec field width
-  var lang1 = r.read(6);                                                                       // allow:raw-byte-literal — TCF spec field width
-  var consentLanguage = String.fromCharCode(0x41 + lang0) + String.fromCharCode(0x41 + lang1); // allow:raw-byte-literal — ASCII 'A' offset
-  var vendorListVersion  = r.read(12);                                                         // allow:raw-byte-literal — TCF spec field width
-  var policyVersion      = r.read(6);                                                          // allow:raw-byte-literal — TCF spec field width
+  var lang0 = r.read(6);                                                                       // TCF spec field width
+  var lang1 = r.read(6);                                                                       // TCF spec field width
+  var consentLanguage = String.fromCharCode(0x41 + lang0) + String.fromCharCode(0x41 + lang1); // ASCII 'A' offset
+  var vendorListVersion  = r.read(12);                                                         // TCF spec field width
+  var policyVersion      = r.read(6);                                                          // TCF spec field width
   var isServiceSpecific  = r.read(1) === 1;
   var useNonStandardStacks = r.read(1) === 1;
-  var specialFeatureOptins = r.readBitField(12);                                               // allow:raw-byte-literal — TCF spec field width
-  var purposesConsent      = r.readBitField(24);                                               // allow:raw-byte-literal — TCF spec field width
-  var purposesLI           = r.readBitField(24);                                               // allow:raw-byte-literal — TCF spec field width
+  var specialFeatureOptins = r.readBitField(12);                                               // TCF spec field width
+  var purposesConsent      = r.readBitField(24);                                               // TCF spec field width
+  var purposesLI           = r.readBitField(24);                                               // TCF spec field width
   var purposeOneTreatment  = r.read(1) === 1;
-  var publisherCC          = String.fromCharCode(0x41 + r.read(6)) + String.fromCharCode(0x41 + r.read(6)); // allow:raw-byte-literal — TCF spec field width
+  var publisherCC          = String.fromCharCode(0x41 + r.read(6)) + String.fromCharCode(0x41 + r.read(6)); // TCF spec field width
   // MaxVendorIdConsent + ranged fields skipped for compactness — the
   // framework's defensive parse only extracts the top-level shape +
   // the vendorConsents/LIs bitmaps when present.
@@ -215,17 +215,17 @@ function _parseCore(buf) {
 // restrictions", which would let a malformed string validate.
 function _parsePublisherRestrictions(r) {
   var out = [];
-  var num = r.read(12);                                                                         // allow:raw-byte-literal — TCF spec field width
+  var num = r.read(12);                                                                         // TCF spec field width
   for (var i = 0; i < num; i += 1) {
-    var purposeId       = r.read(6);                                                            // allow:raw-byte-literal — TCF spec field width
+    var purposeId       = r.read(6);                                                            // TCF spec field width
     var restrictionType = r.read(2);
-    var numEntries      = r.read(12);                                                           // allow:raw-byte-literal — TCF spec field width
+    var numEntries      = r.read(12);                                                           // TCF spec field width
     var vendorIds = [];
     for (var e = 0; e < numEntries; e += 1) {
       var isRange       = r.read(1) === 1;
-      var startVendorId = r.read(16);                                                           // allow:raw-byte-literal — TCF spec field width
+      var startVendorId = r.read(16);                                                           // TCF spec field width
       if (isRange) {
-        var endVendorId = r.read(16);                                                           // allow:raw-byte-literal — TCF spec field width
+        var endVendorId = r.read(16);                                                           // TCF spec field width
         for (var v = startVendorId; v <= endVendorId; v += 1) vendorIds.push(v);
       } else {
         vendorIds.push(startVendorId);
@@ -240,10 +240,10 @@ function _parsePublisherRestrictions(r) {
 // then a custom-purpose count and its two bit-fields.
 function _parsePublisherTC(buf) {
   var r = _bitReader(buf);
-  r.read(3);                                                                                    // allow:raw-byte-literal — segment-type prefix
-  var pubPurposesConsent = r.readBitField(24);                                                  // allow:raw-byte-literal — TCF spec field width
-  var pubPurposesLI      = r.readBitField(24);                                                  // allow:raw-byte-literal — TCF spec field width
-  var numCustomPurposes  = r.read(6);                                                           // allow:raw-byte-literal — TCF spec field width
+  r.read(3);                                                                                    // segment-type prefix
+  var pubPurposesConsent = r.readBitField(24);                                                  // TCF spec field width
+  var pubPurposesLI      = r.readBitField(24);                                                  // TCF spec field width
+  var numCustomPurposes  = r.read(6);                                                           // TCF spec field width
   var customConsent      = r.readBitField(numCustomPurposes);
   var customLI           = r.readBitField(numCustomPurposes);
   return {
@@ -259,16 +259,16 @@ function _parsePublisherTC(buf) {
 // Vendor section: MaxVendorId (16 bits) + IsRangeEncoding (1 bit) +
 // either bitmap (MaxVendorId bits) or RangeEntries.
 function _parseVendorSection(r) {
-  var maxVendorId    = r.read(16);                                                             // allow:raw-byte-literal — TCF spec field width
+  var maxVendorId    = r.read(16);                                                             // TCF spec field width
   var isRangeEncoding = r.read(1) === 1;
   var ids = new Set();
   if (isRangeEncoding) {
-    var numEntries = r.read(12);                                                               // allow:raw-byte-literal — TCF spec field width
+    var numEntries = r.read(12);                                                               // TCF spec field width
     for (var i = 0; i < numEntries; i += 1) {
       var isRange = r.read(1) === 1;
-      var startVendorId = r.read(16);                                                          // allow:raw-byte-literal — TCF spec field width
+      var startVendorId = r.read(16);                                                          // TCF spec field width
       if (isRange) {
-        var endVendorId = r.read(16);                                                          // allow:raw-byte-literal — TCF spec field width
+        var endVendorId = r.read(16);                                                          // TCF spec field width
         for (var v = startVendorId; v <= endVendorId; v += 1) ids.add(v);
       } else {
         ids.add(startVendorId);
@@ -286,7 +286,7 @@ function _parseVendorSection(r) {
 // SegmentType (3 bits) + MaxVendorId + IsRangeEncoding + section.
 function _parseSecondaryVendorSegment(buf, expectedType) {
   var r = _bitReader(buf);
-  var segType = r.read(3);                                                                     // allow:raw-byte-literal — TCF spec field width
+  var segType = r.read(3);                                                                     // TCF spec field width
   if (segType !== expectedType) {
     throw IabTcfError.factory("iab-tcf/bad-segment-type",
       "iabTcf: expected segment type " + expectedType + ", got " + segType);
@@ -347,7 +347,7 @@ function parseString(tcString) {
       continue;
     }
     if (segBuf.length === 0) continue;
-    var segType = (segBuf[0] >> 5) & 0x07;                                                     // allow:raw-byte-literal — TCF segment-type lives in top 3 bits
+    var segType = (segBuf[0] >> 5) & 0x07;                                                     // TCF segment-type lives in top 3 bits
     try {
       if (segType === SEGMENT_TYPE_DISCLOSED_VENDORS) {
         disclosedVendors = { present: true, vendorIds: _parseSecondaryVendorSegment(segBuf, SEGMENT_TYPE_DISCLOSED_VENDORS).ids };
@@ -567,18 +567,18 @@ function _bitWriter() {
   function writeVendorSection(ids) {
     var clean = _idArray(ids);
     var maxVendorId = clean.length ? clean[clean.length - 1] : 0;
-    writeInt(maxVendorId, 16);                                                                  // allow:raw-byte-literal — TCF spec field width
+    writeInt(maxVendorId, 16);                                                                  // TCF spec field width
     if (maxVendorId === 0) { writeBool(false); return; }
     var runs = _idRuns(clean);
-    var rangeBits = 1 + 12;                                                                     // allow:raw-byte-literal — TCF spec field width
-    runs.forEach(function (run) { rangeBits += 1 + 16 + (run[0] === run[1] ? 0 : 16); });       // allow:raw-byte-literal — TCF spec field width
+    var rangeBits = 1 + 12;                                                                     // TCF spec field width
+    runs.forEach(function (run) { rangeBits += 1 + 16 + (run[0] === run[1] ? 0 : 16); });       // TCF spec field width
     var bitfieldBits = 1 + maxVendorId;
     if (rangeBits < bitfieldBits) {
       writeBool(true);
-      writeInt(runs.length, 12);                                                                // allow:raw-byte-literal — TCF spec field width
+      writeInt(runs.length, 12);                                                                // TCF spec field width
       runs.forEach(function (run) {
-        if (run[0] === run[1]) { writeBool(false); writeInt(run[0], 16); }                      // allow:raw-byte-literal — TCF spec field width
-        else { writeBool(true); writeInt(run[0], 16); writeInt(run[1], 16); }                   // allow:raw-byte-literal — TCF spec field width
+        if (run[0] === run[1]) { writeBool(false); writeInt(run[0], 16); }                      // TCF spec field width
+        else { writeBool(true); writeInt(run[0], 16); writeInt(run[1], 16); }                   // TCF spec field width
       });
     } else {
       writeBool(false);
@@ -586,10 +586,10 @@ function _bitWriter() {
     }
   }
   function toBuffer() {
-    var padded = bits + "0".repeat((8 - (bits.length % 8)) % 8);                                // allow:raw-byte-literal — pad to whole bytes
-    var byteLen = padded.length / 8;                                                            // allow:raw-byte-literal — bits per byte
+    var padded = bits + "0".repeat((8 - (bits.length % 8)) % 8);                                // pad to whole bytes
+    var byteLen = padded.length / 8;                                                            // bits per byte
     var out = Buffer.alloc(byteLen);
-    for (var i = 0; i < byteLen; i += 1) out[i] = parseInt(padded.slice(i * 8, i * 8 + 8), 2);  // allow:raw-byte-literal — bits per byte
+    for (var i = 0; i < byteLen; i += 1) out[i] = parseInt(padded.slice(i * 8, i * 8 + 8), 2);  // bits per byte
     return out;
   }
   return { writeInt: writeInt, writeBool: writeBool, writeBitField: writeBitField, writeVendorSection: writeVendorSection, toBuffer: toBuffer };
@@ -603,23 +603,23 @@ function _writeLetters(w, s, label) {
   var str = String(s).toUpperCase();
   if (str.length !== 2) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: " + label + " must be a 2-letter code, got '" + s + "'");
   for (var i = 0; i < 2; i += 1) {
-    var v = str.charCodeAt(i) - 0x41;                                                           // allow:raw-byte-literal — ASCII 'A' offset
+    var v = str.charCodeAt(i) - 0x41;                                                           // ASCII 'A' offset
     if (v < 0 || v > 25) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: '" + str.charAt(i) + "' is not an A-Z letter");
-    w.writeInt(v, 6);                                                                           // allow:raw-byte-literal — TCF spec field width
+    w.writeInt(v, 6);                                                                           // TCF spec field width
   }
 }
 
 function _encodePublisherTC(pub) {
   var w = _bitWriter();
-  w.writeInt(SEGMENT_TYPE_PUBLISHER_TC, 3);                                                     // allow:raw-byte-literal — segment-type prefix
-  w.writeBitField(pub.pubPurposesConsent || [], 24);                                            // allow:raw-byte-literal — TCF spec field width
-  w.writeBitField(pub.pubPurposesLITransparency || [], 24);                                     // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(SEGMENT_TYPE_PUBLISHER_TC, 3);                                                     // segment-type prefix
+  w.writeBitField(pub.pubPurposesConsent || [], 24);                                            // TCF spec field width
+  w.writeBitField(pub.pubPurposesLITransparency || [], 24);                                     // TCF spec field width
   var custom = _idArray(pub.customPurposesConsent || []);
   var customLI = _idArray(pub.customPurposesLITransparency || []);
   var n = pub.numCustomPurposes != null
     ? pub.numCustomPurposes
     : Math.max(custom.length ? custom[custom.length - 1] : 0, customLI.length ? customLI[customLI.length - 1] : 0);
-  w.writeInt(n, 6);                                                                             // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(n, 6);                                                                             // TCF spec field width
   w.writeBitField(custom, n);
   w.writeBitField(customLI, n);
   return _b64urlEncode(w.toBuffer());
@@ -654,47 +654,47 @@ function encode(obj) {
   }
   var c = obj.core;
   var w = _bitWriter();
-  w.writeInt(c.version != null ? c.version : TCF_V23_CORE_VERSION, 6);                          // allow:raw-byte-literal — TCF spec field width
-  w.writeInt(_decisec(c.createdAt), 36);                                                        // allow:raw-byte-literal — TCF spec field width
-  w.writeInt(_decisec(c.lastUpdatedAt != null ? c.lastUpdatedAt : c.createdAt), 36);            // allow:raw-byte-literal — TCF spec field width
-  w.writeInt(c.cmpId || 0, 12);                                                                 // allow:raw-byte-literal — TCF spec field width
-  w.writeInt(c.cmpVersion || 0, 12);                                                            // allow:raw-byte-literal — TCF spec field width
-  w.writeInt(c.consentScreen || 0, 6);                                                          // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(c.version != null ? c.version : TCF_V23_CORE_VERSION, 6);                          // TCF spec field width
+  w.writeInt(_decisec(c.createdAt), 36);                                                        // TCF spec field width
+  w.writeInt(_decisec(c.lastUpdatedAt != null ? c.lastUpdatedAt : c.createdAt), 36);            // TCF spec field width
+  w.writeInt(c.cmpId || 0, 12);                                                                 // TCF spec field width
+  w.writeInt(c.cmpVersion || 0, 12);                                                            // TCF spec field width
+  w.writeInt(c.consentScreen || 0, 6);                                                          // TCF spec field width
   _writeLetters(w, c.consentLanguage || "EN", "consentLanguage");
-  w.writeInt(c.vendorListVersion || 0, 12);                                                     // allow:raw-byte-literal — TCF spec field width
-  w.writeInt(c.policyVersion != null ? c.policyVersion : TCF_V23_POLICY_VERSION, 6);            // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(c.vendorListVersion || 0, 12);                                                     // TCF spec field width
+  w.writeInt(c.policyVersion != null ? c.policyVersion : TCF_V23_POLICY_VERSION, 6);            // TCF spec field width
   w.writeBool(c.isServiceSpecific !== false);
   w.writeBool(c.useNonStandardStacks === true);
-  w.writeBitField(c.specialFeatureOptins || [], 12);                                            // allow:raw-byte-literal — TCF spec field width
-  w.writeBitField(c.purposesConsent || [], 24);                                                 // allow:raw-byte-literal — TCF spec field width
-  w.writeBitField(c.purposesLI || [], 24);                                                      // allow:raw-byte-literal — TCF spec field width
+  w.writeBitField(c.specialFeatureOptins || [], 12);                                            // TCF spec field width
+  w.writeBitField(c.purposesConsent || [], 24);                                                 // TCF spec field width
+  w.writeBitField(c.purposesLI || [], 24);                                                      // TCF spec field width
   w.writeBool(c.purposeOneTreatment === true);
   _writeLetters(w, c.publisherCC || "AA", "publisherCC");
   w.writeVendorSection(c.vendorConsents || []);
   w.writeVendorSection(c.vendorLIs || []);
   var restrictions = c.publisherRestrictions || [];
-  w.writeInt(restrictions.length, 12);                                                          // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(restrictions.length, 12);                                                          // TCF spec field width
   restrictions.forEach(function (pr) {
-    w.writeInt(pr.purposeId, 6);                                                                // allow:raw-byte-literal — TCF spec field width
+    w.writeInt(pr.purposeId, 6);                                                                // TCF spec field width
     w.writeInt(typeof pr.restrictionType === "number" ? pr.restrictionType : 0, 2);
     var runs = _idRuns(_idArray(pr.vendorIds || []));
-    w.writeInt(runs.length, 12);                                                                // allow:raw-byte-literal — TCF spec field width
+    w.writeInt(runs.length, 12);                                                                // TCF spec field width
     runs.forEach(function (run) {
-      if (run[0] === run[1]) { w.writeBool(false); w.writeInt(run[0], 16); }                    // allow:raw-byte-literal — TCF spec field width
-      else { w.writeBool(true); w.writeInt(run[0], 16); w.writeInt(run[1], 16); }               // allow:raw-byte-literal — TCF spec field width
+      if (run[0] === run[1]) { w.writeBool(false); w.writeInt(run[0], 16); }                    // TCF spec field width
+      else { w.writeBool(true); w.writeInt(run[0], 16); w.writeInt(run[1], 16); }               // TCF spec field width
     });
   });
   var segs = [_b64urlEncode(w.toBuffer())];
 
   if (obj.disclosedVendors != null) {
     var dw = _bitWriter();
-    dw.writeInt(SEGMENT_TYPE_DISCLOSED_VENDORS, 3);                                              // allow:raw-byte-literal — segment-type prefix
+    dw.writeInt(SEGMENT_TYPE_DISCLOSED_VENDORS, 3);                                              // segment-type prefix
     dw.writeVendorSection(obj.disclosedVendors);
     segs.push(_b64urlEncode(dw.toBuffer()));
   }
   if (obj.allowedVendors != null) {
     var aw = _bitWriter();
-    aw.writeInt(SEGMENT_TYPE_ALLOWED_VENDORS, 3);                                                // allow:raw-byte-literal — segment-type prefix
+    aw.writeInt(SEGMENT_TYPE_ALLOWED_VENDORS, 3);                                                // segment-type prefix
     aw.writeVendorSection(obj.allowedVendors);
     segs.push(_b64urlEncode(aw.toBuffer()));
   }

package/lib/inbox.js

@@ -151,14 +151,14 @@ function create(opts) {
   var qTable         = safeSql.quoteIdentifier(tableRaw, "sqlite");
   var qIndex         = safeSql.quoteIdentifier(tableRaw + "_received_at_idx", "sqlite");
   var retentionDays  = (typeof opts.retentionDays === "number" && opts.retentionDays > 0)        // allow:numeric-opt-Infinity
-    ? opts.retentionDays : 30;                                                                   // allow:raw-byte-literal — default retention days
+    ? opts.retentionDays : 30;                                                                   // default retention days
   var auditOn        = opts.audit !== false;
   var maxPayloadBytes = (typeof opts.maxPayloadBytes === "number" && opts.maxPayloadBytes > 0)   // allow:numeric-opt-Infinity
     ? opts.maxPayloadBytes : C.BYTES.kib(64);
   var messageIdMaxLen = (typeof opts.messageIdMaxLen === "number" && opts.messageIdMaxLen > 0)   // allow:numeric-opt-Infinity
-    ? opts.messageIdMaxLen : 256;                                                                // allow:raw-byte-literal — message-id length cap
+    ? opts.messageIdMaxLen : 256;                                                                // message-id length cap
   var sourceMaxLen = (typeof opts.sourceMaxLen === "number" && opts.sourceMaxLen > 0)            // allow:numeric-opt-Infinity
-    ? opts.sourceMaxLen : 256;                                                                   // allow:raw-byte-literal — source length cap
+    ? opts.sourceMaxLen : 256;                                                                   // source length cap
 
   function _emitAudit(action, outcome, metadata) {
     if (!auditOn) return;
@@ -203,7 +203,7 @@ function create(opts) {
   function _rejectControlChars(value, label, field) {
     for (var i = 0; i < value.length; i += 1) {
       var code = value.charCodeAt(i);
-      if (code === 0 || (code < 32 && code !== 9) || code === 127) {     // allow:raw-byte-literal — ASCII control codepoints (NUL + C0 + DEL); allow tab
+      if (code === 0 || (code < 32 && code !== 9) || code === 127) {     // ASCII control codepoints (NUL + C0 + DEL); allow tab
         throw new InboxError("inbox/bad-receive",
           label + ": " + field + " contains control character at index " + i +
           " (codepoint " + code + ")");

package/lib/ip-utils.js

@@ -29,34 +29,34 @@ function expandIpv6Hex(ip) {
   var dual = ip.match(/^(.*?):(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);                                    // allow:regex-no-length-cap — dotted-quad has fixed shape; LHS bounded by IPv6 group cap below
   if (dual) {
     var v4 = dual[2].split(".").map(Number);
-    if (v4.some(function (o) { return !(o >= 0 && o <= 255); })) return null;                            // allow:raw-byte-literal — IPv4 octet range
-    var hi = (v4[0] << 8) | v4[1];                                                                       // allow:raw-byte-literal — 16-bit group pack
-    var lo = (v4[2] << 8) | v4[3];                                                                       // allow:raw-byte-literal — 16-bit group pack
+    if (v4.some(function (o) { return !(o >= 0 && o <= 255); })) return null;                            // IPv4 octet range
+    var hi = (v4[0] << 8) | v4[1];                                                                       // 16-bit group pack
+    var lo = (v4[2] << 8) | v4[3];                                                                       // 16-bit group pack
     ip = dual[1] + ":" + hi.toString(16) + ":" + lo.toString(16);
   }
   var dblColon = ip.split("::");
   if (dblColon.length > 2) return null;
   var leftGroups  = dblColon[0] === "" ? [] : dblColon[0].split(":");
   var rightGroups = dblColon.length === 2 ? (dblColon[1] === "" ? [] : dblColon[1].split(":")) : [];
-  if (dblColon.length === 1 && leftGroups.length !== 8) return null;                                      // allow:raw-byte-literal — RFC 4291 IPv6 group count
-  var fillCount = 8 - leftGroups.length - rightGroups.length;                                             // allow:raw-byte-literal — RFC 4291 IPv6 group count
+  if (dblColon.length === 1 && leftGroups.length !== 8) return null;                                      // RFC 4291 IPv6 group count
+  var fillCount = 8 - leftGroups.length - rightGroups.length;                                             // RFC 4291 IPv6 group count
   if (fillCount < 0) return null;
   var fill = [];
   for (var f = 0; f < fillCount; f += 1) fill.push("0");
   var groups = leftGroups.concat(fill).concat(rightGroups);
-  if (groups.length !== 8) return null;                                                                   // allow:raw-byte-literal — RFC 4291 IPv6 group count
+  if (groups.length !== 8) return null;                                                                   // RFC 4291 IPv6 group count
   var hex = "";
-  for (var i = 0; i < 8; i += 1) {                                                                        // allow:raw-byte-literal — RFC 4291 IPv6 group count
+  for (var i = 0; i < 8; i += 1) {                                                                        // RFC 4291 IPv6 group count
     var g = groups[i];
-    if (g.length === 0 || g.length > 4) return null;                                                      // allow:raw-byte-literal — RFC 4291 IPv6 hex-group max length
+    if (g.length === 0 || g.length > 4) return null;                                                      // RFC 4291 IPv6 hex-group max length
     for (var hc = 0; hc < g.length; hc += 1) {
       var cp = g.charCodeAt(hc);
-      var isDigit    = cp >= 0x30 && cp <= 0x39;                                                          // allow:raw-byte-literal — ASCII '0'..'9'
-      var isLowerHex = cp >= 0x61 && cp <= 0x66;                                                          // allow:raw-byte-literal — ASCII 'a'..'f'
-      var isUpperHex = cp >= 0x41 && cp <= 0x46;                                                          // allow:raw-byte-literal — ASCII 'A'..'F'
+      var isDigit    = cp >= 0x30 && cp <= 0x39;                                                          // ASCII '0'..'9'
+      var isLowerHex = cp >= 0x61 && cp <= 0x66;                                                          // ASCII 'a'..'f'
+      var isUpperHex = cp >= 0x41 && cp <= 0x46;                                                          // ASCII 'A'..'F'
       if (!isDigit && !isLowerHex && !isUpperHex) return null;
     }
-    hex += g.toLowerCase().padStart(4, "0");                                                              // allow:raw-byte-literal — 4 hex chars per IPv6 group
+    hex += g.toLowerCase().padStart(4, "0");                                                              // 4 hex chars per IPv6 group
   }
   return hex;
 }
@@ -72,9 +72,9 @@ function expandIpv6Hex(ip) {
 function expandIpv6Groups(ip) {
   var hex = expandIpv6Hex(ip);
   if (hex === null) return null;
-  var groups = new Array(8);                                                                              // allow:raw-byte-literal — RFC 4291 IPv6 group count
-  for (var i = 0; i < 8; i += 1) {                                                                        // allow:raw-byte-literal — RFC 4291 IPv6 group count
-    groups[i] = parseInt(hex.slice(i * 4, i * 4 + 4), 16);                                                // allow:raw-byte-literal — 4 hex chars per IPv6 group
+  var groups = new Array(8);                                                                              // RFC 4291 IPv6 group count
+  for (var i = 0; i < 8; i += 1) {                                                                        // RFC 4291 IPv6 group count
+    groups[i] = parseInt(hex.slice(i * 4, i * 4 + 4), 16);                                                // 4 hex chars per IPv6 group
   }
   return groups;
 }

package/lib/jose-jwe-experimental.js

@@ -151,7 +151,7 @@ function decrypt(compact, recipientPrivateKeyPem, opts) {
       "decrypt: recipientPrivateKeyPem must be a non-empty PEM string");
   }
   var parts = compact.split(".");
-  if (parts.length !== 5) {                                                                          // allow:raw-byte-literal — JWE compact serialization is 5 dot-separated segments (RFC 7516 §3.1)
+  if (parts.length !== 5) {                                                                          // JWE compact serialization is 5 dot-separated segments (RFC 7516 §3.1)
     throw new JoseJweExperimentalError("jose-jwe-exp/bad-format",
       "decrypt: JWE compact serialization MUST have 5 segments (RFC 7516 §3.1), got " + parts.length);
   }
@@ -168,7 +168,7 @@ function decrypt(compact, recipientPrivateKeyPem, opts) {
     throw new JoseJweExperimentalError("jose-jwe-exp/bad-header",
       "decrypt: protected header is not valid base64url");
   }
-  if (headerBytes.length > 4096) {                                                                   // allow:raw-byte-literal — JWE header byte cap, not bytes-as-storage
+  if (headerBytes.length > 4096) {                                                                   // JWE header byte cap, not bytes-as-storage
     throw new JoseJweExperimentalError("jose-jwe-exp/header-too-large",
       "decrypt: protected header exceeds 4 KiB cap");
   }

package/lib/json-path.js

@@ -34,7 +34,7 @@ var { defineClass } = require("./framework-error");
 
 var JsonPathError = defineClass("JsonPathError", { alwaysPermanent: true });
 
-var MAX_DESCEND_NODES = 1000000;                             // allow:raw-byte-literal — DoS ceiling on nodes visited by a descendant walk
+var MAX_DESCEND_NODES = 1000000;                             // DoS ceiling on nodes visited by a descendant walk
 
 // ---------------------------------------------------------------------------
 // Parser — recursive descent over the RFC 9535 ABNF.
@@ -179,12 +179,12 @@ _Parser.prototype.parseStringLiteral = function () {
       else if (e === "u") {
         var hex = this.s.substr(this.i, 4);
         if (!/^[0-9a-fA-F]{4}$/.test(hex)) this.err("invalid \\u escape");
-        var cp = parseInt(hex, 16); this.i += 4;             // allow:raw-byte-literal — base-16 radix for \uXXXX
+        var cp = parseInt(hex, 16); this.i += 4;             // base-16 radix for \uXXXX
         // Surrogate pair handling.
         if (cp >= 0xD800 && cp <= 0xDBFF && this.s.substr(this.i, 2) === "\\u") {
           var hex2 = this.s.substr(this.i + 2, 4);
           if (/^[0-9a-fA-F]{4}$/.test(hex2)) {
-            var lo = parseInt(hex2, 16);                     // allow:raw-byte-literal — base-16 radix for \uXXXX low surrogate
+            var lo = parseInt(hex2, 16);                     // base-16 radix for \uXXXX low surrogate
             if (lo >= 0xDC00 && lo <= 0xDFFF) { out += String.fromCharCode(cp, lo); this.i += 6; continue; }
           }
           this.err("invalid surrogate pair");

package/lib/json-schema.js

@@ -54,7 +54,7 @@ var { defineClass } = require("./framework-error");
 var JsonSchemaError = defineClass("JsonSchemaError", { alwaysPermanent: true });
 
 var DIALECT_2020_12 = "https://json-schema.org/draft/2020-12/schema";
-var MAX_REF_DEPTH = 10000;                                  // allow:raw-byte-literal — recursion-depth cap (count, not a byte size)
+var MAX_REF_DEPTH = 10000;                                  // recursion-depth cap (count, not a byte size)
 var DEFAULT_MAX_ERRORS = 100;                               // error-collection cap
 
 function _typeOf(v) {

package/lib/jsonapi.js

@@ -210,12 +210,12 @@ function parseQuery(queryString, opts) {
         return { field: s, asc: asc };
       });
     } else if (rawKey.indexOf("fields[") === 0 && rawKey.charAt(rawKey.length - 1) === "]") {
-      var type = rawKey.slice(7, -1);                                                                 // allow:raw-byte-literal — `fields[` length
+      var type = rawKey.slice(7, -1);                                                                 // `fields[` length
       out.fields[type] = rawVal.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
     } else if (rawKey.indexOf("filter[") === 0 && rawKey.charAt(rawKey.length - 1) === "]") {
-      out.filter[rawKey.slice(7, -1)] = rawVal;                                                       // allow:raw-byte-literal — `filter[` length
+      out.filter[rawKey.slice(7, -1)] = rawVal;                                                       // `filter[` length
     } else if (rawKey.indexOf("page[") === 0 && rawKey.charAt(rawKey.length - 1) === "]") {
-      out.page[rawKey.slice(5, -1)] = rawVal;                                                         // allow:raw-byte-literal — `page[` length
+      out.page[rawKey.slice(5, -1)] = rawVal;                                                         // `page[` length
     }
   }
   return out;

package/lib/jtd.js

@@ -40,8 +40,8 @@ var TYPES = {
   int8: 1, uint8: 1, int16: 1, uint16: 1, int32: 1, uint32: 1,
 };
 var INT_RANGES = {
-  int8: [-128, 127], uint8: [0, 255], int16: [-32768, 32767],                              // allow:raw-byte-literal — RFC 8927 integer type bounds
-  uint16: [0, 65535], int32: [-2147483648, 2147483647], uint32: [0, 4294967295],            // allow:raw-byte-literal — RFC 8927 integer type bounds
+  int8: [-128, 127], uint8: [0, 255], int16: [-32768, 32767],                              // RFC 8927 integer type bounds
+  uint16: [0, 65535], int32: [-2147483648, 2147483647], uint32: [0, 4294967295],            // RFC 8927 integer type bounds
 };
 var FORM_KEYWORDS = ["ref", "type", "enum", "elements", "properties", "optionalProperties", "values", "discriminator"];
 var SHARED_KEYWORDS = { definitions: 1, nullable: 1, metadata: 1 };

package/lib/link-header.js

@@ -32,7 +32,7 @@ var { defineClass } = require("./framework-error");
 
 var LinkHeaderError = defineClass("LinkHeaderError", { alwaysPermanent: true });
 
-var MAX_HEADER_BYTES = 16384;                                // allow:raw-byte-literal — defensive cap on a parsed Link header
+var MAX_HEADER_BYTES = 16384;                                // defensive cap on a parsed Link header
 
 // Split a Link header on the commas that separate links — those OUTSIDE
 // a <uri-reference> and outside a quoted-string. structuredFields'

package/lib/local-db-thin.js

@@ -65,7 +65,7 @@ var audit = lazyRequire(function () { return require("./audit"); });
 // LRU prepared-statement cache cap — same magnitude as lib/db.js's full
 // variant. Daemons issuing more than this many distinct SQL strings
 // likely have a string-concat bug rather than a legitimate need.
-var PREPARE_CACHE_MAX = 256;                                                       // allow:raw-byte-literal — distinct-statement cache cap
+var PREPARE_CACHE_MAX = 256;                                                       // distinct-statement cache cap
 
 var ALLOWED_RECOVERY = ["refuse", "rename-and-recreate"];
 

package/lib/log.js

@@ -554,7 +554,7 @@ var _BIDI_CONTROL_RE = /[؜‎‏‪‫‬‭‮⁦⁧⁨⁩]/g;
 function _escapeBidiControls(s) {
   if (typeof s !== "string" || s.length === 0) return s;
   return s.replace(_BIDI_CONTROL_RE, function (ch) {
-    var code = ch.charCodeAt(0).toString(16);                                      // allow:raw-byte-literal — Unicode hex radix
+    var code = ch.charCodeAt(0).toString(16);                                      // Unicode hex radix
     while (code.length < 4) code = "0" + code;
     return "\\u" + code;
   });

package/lib/lro.js

@@ -71,9 +71,9 @@ function create(opts) {
   var prefix = opts.namePrefix || "operations/";
   numericBounds.requirePositiveFiniteIntIfPresent(opts.maxConcurrent, "maxConcurrent",
     LroError, "lro/bad-max-concurrent");
-  var maxConcurrent = typeof opts.maxConcurrent === "number" ? opts.maxConcurrent : 1024;             // allow:raw-byte-literal — default in-flight cap
+  var maxConcurrent = typeof opts.maxConcurrent === "number" ? opts.maxConcurrent : 1024;             // default in-flight cap
 
-  function _newName() { return prefix + bCrypto.generateToken(32); }                                  // allow:raw-byte-literal — 32-char name token
+  function _newName() { return prefix + bCrypto.generateToken(32); }                                  // 32-char name token
 
   function submit(submitOpts) {
     submitOpts = validateOpts.requireObject(submitOpts, "lro.submit",
@@ -126,7 +126,7 @@ function create(opts) {
         stored.done = true;
         // AIP-151 error: { code, message, details? } shape.
         var msg = (err && err.message) || String(err);
-        stored.error = { code: 13, message: msg };                                                    // allow:raw-byte-literal — google.rpc.Code.INTERNAL = 13
+        stored.error = { code: 13, message: msg };                                                    // google.rpc.Code.INTERNAL = 13
         if (err && err.code) stored.error.errorCode = err.code;
         stored.completedAt = new Date().toISOString();
       });
@@ -175,7 +175,7 @@ function create(opts) {
     }
     // Mark cancelled per AIP-151 — error.code 1 = CANCELLED.
     op.done = true;
-    op.error = { code: 1, message: "operation cancelled" };                                           // allow:raw-byte-literal — google.rpc.Code.CANCELLED = 1
+    op.error = { code: 1, message: "operation cancelled" };                                           // google.rpc.Code.CANCELLED = 1
     op.completedAt = new Date().toISOString();
     return _stripPrivate(op);
   }

package/lib/mail-agent.js

@@ -89,7 +89,7 @@ var MailAgentError = defineClass("MailAgentError", { alwaysPermanent: true });
 
 var DEFAULT_QUEUE_TOPIC = "mail.agent.tasks";
 var DEFAULT_TASK_TIMEOUT_MS = C.TIME.seconds(30);
-var DEFAULT_QUEUE_DEPTH_CAP = 1024;                                                                   // allow:raw-byte-literal — queue depth, not bytes
+var DEFAULT_QUEUE_DEPTH_CAP = 1024;                                                                   // queue depth, not bytes
 
 // Methods that route to worker / queue dispatch under "auto" mode. The
 // rest are fast-path single-row ops that stay local even under "auto".

package/lib/mail-arc-sign.js

@@ -103,8 +103,8 @@ function _parseHeaderBlock(headerBlock) {
 }
 
 function _canonRelaxedHeader(name, value) {
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");                // allow:duplicate-regex allow:raw-byte-literal — DKIM/ARC RFC 6376 §3.4.2 unfolding
-  var trimmed = unfolded.replace(/[ \t]+/g, " ").replace(/^[ \t]+|[ \t]+$/g, "");  // allow:duplicate-regex allow:raw-byte-literal — DKIM/ARC RFC 6376 §3.4.2 WSP collapse
+  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");                // allow:duplicate-regex — DKIM/ARC RFC 6376 §3.4.2 unfolding
+  var trimmed = unfolded.replace(/[ \t]+/g, " ").replace(/^[ \t]+|[ \t]+$/g, "");  // allow:duplicate-regex — DKIM/ARC RFC 6376 §3.4.2 WSP collapse
   return name.toLowerCase() + ":" + trimmed + "\r\n";
 }
 
@@ -133,7 +133,7 @@ function _bodyHashB64(body, algorithm) {
 // extractor needs the same ceiling so a message arriving with a
 // hostile chain (51+ instances) doesn't expand the per-hop walk to
 // unbounded work before the signer's own validation catches up.
-var ARC_MAX_HOPS_FOR_EXTRACT = 50;                                                      // allow:raw-byte-literal — RFC 8617 §5 chain bound
+var ARC_MAX_HOPS_FOR_EXTRACT = 50;                                                      // RFC 8617 §5 chain bound
 
 function _arcExtractPriorHops(parsedHeaders) {
   // Walk parsedHeaders; for each ARC-Authentication-Results /
@@ -182,7 +182,7 @@ function sign(opts) {
   validateOpts.requireNonEmptyString(opts.rfc822, "sign: rfc822",
     MailAuthError, "arc-sign/bad-input");
   if (typeof opts.instance !== "number" || !isFinite(opts.instance) ||
-      opts.instance < 1 || opts.instance > 50 ||                                        // allow:raw-byte-literal — RFC 8617 §5 chain bound
+      opts.instance < 1 || opts.instance > 50 ||                                        // RFC 8617 §5 chain bound
       Math.floor(opts.instance) !== opts.instance) {
     throw new MailAuthError("arc-sign/bad-instance",
       "sign: instance must be an integer in [1, 50] — got " + JSON.stringify(opts.instance));
@@ -211,7 +211,7 @@ function sign(opts) {
     throw new MailAuthError("arc-sign/cv-rule",
       "sign: i=1 requires cv=none (per RFC 8617 §5.1.1)");
   }
-  if (opts.instance >= 2 && opts.cv === "none") {                                       // allow:raw-byte-literal — RFC 8617 chain rule
+  if (opts.instance >= 2 && opts.cv === "none") {                                       // RFC 8617 chain rule
     throw new MailAuthError("arc-sign/cv-rule",
       "sign: i>=2 disallows cv=none — must be cv=pass or cv=fail (per RFC 8617 §5.1.1)");
   }
@@ -247,7 +247,7 @@ function sign(opts) {
     }
   }
   var timestamp = (typeof opts.timestamp === "number" && opts.timestamp > 0)            // allow:numeric-opt-Infinity
-    ? Math.floor(opts.timestamp) : Math.floor(Date.now() / 1000);                       // allow:raw-byte-literal — Unix epoch seconds divisor
+    ? Math.floor(opts.timestamp) : Math.floor(Date.now() / 1000);                       // Unix epoch seconds divisor
   var auditOn = opts.audit !== false;
 
   var keyObject;