@blamejs/core 0.14.0 → 0.14.2

package/lib/safe-icap.js

@@ -80,7 +80,7 @@ var { defineClass }    = require("./framework-error");
 
 var SafeIcapError = defineClass("SafeIcapError", { alwaysPermanent: true });
 
-// allow:raw-byte-literal — RFC 3507 §4.3.3 enumerated ICAP response status codes.
+// RFC 3507 §4.3.3 enumerated ICAP response status codes.
 var ALLOWED_STATUS = Object.freeze({
   100: "Continue",
   200: "OK",
@@ -98,7 +98,7 @@ var ALLOWED_STATUS = Object.freeze({
   505: "ICAP Version Not Supported",
 });
 
-// allow:raw-byte-literal — RFC 3507 §4.4 Encapsulated section names.
+// RFC 3507 §4.4 Encapsulated section names.
 var ENCAPSULATED_PARTS = Object.freeze({
   "req-hdr":   true,
   "req-body":  true,
@@ -114,19 +114,19 @@ var PROFILES = Object.freeze({
   strict: {
     maxResponseHeaderBytes: C.BYTES.kib(8),
     maxBodyBytes:           C.BYTES.mib(1),
-    maxHeaderCount:         64,                                                                  // allow:raw-byte-literal — count, not bytes
+    maxHeaderCount:         64,                                                                  // count, not bytes
     maxHeaderValueBytes:    C.BYTES.kib(4),
   },
   balanced: {
     maxResponseHeaderBytes: C.BYTES.kib(32),
     maxBodyBytes:           C.BYTES.mib(16),
-    maxHeaderCount:         128,                                                                 // allow:raw-byte-literal — count, not bytes
+    maxHeaderCount:         128,                                                                 // count, not bytes
     maxHeaderValueBytes:    C.BYTES.kib(16),
   },
   permissive: {
     maxResponseHeaderBytes: C.BYTES.kib(256),
     maxBodyBytes:           C.BYTES.mib(256),
-    maxHeaderCount:         256,                                                                 // allow:raw-byte-literal — count, not bytes
+    maxHeaderCount:         256,                                                                 // count, not bytes
     maxHeaderValueBytes:    C.BYTES.kib(64),
   },
 });
@@ -277,10 +277,10 @@ function compliancePosture(posture) {
 
 function _findHeaderEnd(buf, maxHeaderBytes) {
   var stop = Math.min(buf.length, maxHeaderBytes);
-  for (var i = 0; i + 3 < stop; i += 1) {                                                         // allow:raw-byte-literal — 4-byte CRLFCRLF terminator
+  for (var i = 0; i + 3 < stop; i += 1) {                                                         // 4-byte CRLFCRLF terminator
     if (buf[i] === 0x0d && buf[i + 1] === 0x0a &&
         buf[i + 2] === 0x0d && buf[i + 3] === 0x0a) {
-      return i + 4;                                                                                // allow:raw-byte-literal — past the CRLFCRLF
+      return i + 4;                                                                                // past the CRLFCRLF
     }
   }
   return -1;
@@ -293,18 +293,18 @@ function _refuseBadHeaderBytes(buf, headerEnd) {
   // not preceded by CR are smuggling vectors.
   for (var i = 0; i < headerEnd; i += 1) {
     var byte = buf[i];
-    if (byte === 0) {                                                                              // allow:raw-byte-literal — NUL byte refusal
+    if (byte === 0) {                                                                              // NUL byte refusal
       throw new SafeIcapError("safe-icap/nul-in-header",
         "safeIcap.parse: NUL byte in header region at offset=" + i);
     }
-    if (byte === 0x0d) {                                                                           // allow:raw-byte-literal — CR
-      if (i + 1 >= headerEnd || buf[i + 1] !== 0x0a) {                                             // allow:raw-byte-literal — LF
+    if (byte === 0x0d) {                                                                           // CR
+      if (i + 1 >= headerEnd || buf[i + 1] !== 0x0a) {                                             // LF
         throw new SafeIcapError("safe-icap/bare-cr-or-lf",
           "safeIcap.parse: bare-CR (CR without LF) at offset=" + i +
           " (RFC 3507 §4.3.1 ICAP-response-injection defense)");
       }
-    } else if (byte === 0x0a) {                                                                    // allow:raw-byte-literal — LF
-      if (i === 0 || buf[i - 1] !== 0x0d) {                                                        // allow:raw-byte-literal — CR
+    } else if (byte === 0x0a) {                                                                    // LF
+      if (i === 0 || buf[i - 1] !== 0x0d) {                                                        // CR
         throw new SafeIcapError("safe-icap/bare-cr-or-lf",
           "safeIcap.parse: bare-LF (LF without CR) at offset=" + i +
           " (RFC 3507 §4.3.1 ICAP-response-injection defense)");
@@ -319,7 +319,7 @@ function _splitCrlf(buf, start, end) {
   var lines = [];
   var lineStart = start;
   for (var i = start; i + 1 < end; i += 1) {
-    if (buf[i] === 0x0d && buf[i + 1] === 0x0a) {                                                  // allow:raw-byte-literal — CRLF terminator
+    if (buf[i] === 0x0d && buf[i + 1] === 0x0a) {                                                  // CRLF terminator
       lines.push(buf.toString("ascii", lineStart, i));
       i += 1;
       lineStart = i + 1;
@@ -335,7 +335,7 @@ function _parseStatusLine(line) {
   if (line.indexOf("ICAP/") !== 0) {
     throw new SafeIcapError("safe-icap/bad-status-line",
       "safeIcap.parse: status line must start with 'ICAP/' (got '" +
-      line.slice(0, 16) + "')");                                                                   // allow:raw-byte-literal — bound diagnostic slice
+      line.slice(0, 16) + "')");                                                                   // bound diagnostic slice
   }
   var sp1 = line.indexOf(" ");
   if (sp1 === -1) {
@@ -349,7 +349,7 @@ function _parseStatusLine(line) {
     throw new SafeIcapError("safe-icap/bad-status-line",
       "safeIcap.parse: status code not 3 ASCII digits (got '" + codeStr + "')");
   }
-  var statusCode = parseInt(codeStr, 10);                                                          // allow:raw-byte-literal — base-10 radix
+  var statusCode = parseInt(codeStr, 10);                                                          // base-10 radix
   if (!Object.prototype.hasOwnProperty.call(ALLOWED_STATUS, statusCode)) {
     throw new SafeIcapError("safe-icap/unexpected-status",
       "safeIcap.parse: status code " + statusCode +
@@ -364,7 +364,7 @@ function _parseHeaderLine(line, maxValueBytes) {
   var colon = line.indexOf(":");
   if (colon === -1) {
     throw new SafeIcapError("safe-icap/bad-status-line",
-      "safeIcap.parse: header line missing ':' (got '" + line.slice(0, 32) + "')");                // allow:raw-byte-literal — bound diagnostic slice
+      "safeIcap.parse: header line missing ':' (got '" + line.slice(0, 32) + "')");                // bound diagnostic slice
   }
   var name = line.slice(0, colon).toLowerCase();
   if (name.length === 0) {
@@ -375,13 +375,13 @@ function _parseHeaderLine(line, maxValueBytes) {
   // plus a fixed punctuation set). Refuse anything else.
   for (var i = 0; i < name.length; i += 1) {
     var cc = name.charCodeAt(i);
-    var ok = (cc >= 0x30 && cc <= 0x39) ||                                                         // allow:raw-byte-literal — DIGIT 0-9
-             (cc >= 0x41 && cc <= 0x5a) ||                                                         // allow:raw-byte-literal — UPPER (lowercased above; defensive)
-             (cc >= 0x61 && cc <= 0x7a) ||                                                         // allow:raw-byte-literal — lower a-z
-             cc === 0x21 || cc === 0x23 || cc === 0x24 || cc === 0x25 ||                           // allow:raw-byte-literal — ! # $ %
-             cc === 0x26 || cc === 0x27 || cc === 0x2a || cc === 0x2b ||                           // allow:raw-byte-literal — & ' * +
-             cc === 0x2d || cc === 0x2e || cc === 0x5e || cc === 0x5f ||                           // allow:raw-byte-literal — - . ^ _
-             cc === 0x60 || cc === 0x7c || cc === 0x7e;                                            // allow:raw-byte-literal — ` | ~
+    var ok = (cc >= 0x30 && cc <= 0x39) ||                                                         // DIGIT 0-9
+             (cc >= 0x41 && cc <= 0x5a) ||                                                         // UPPER (lowercased above; defensive)
+             (cc >= 0x61 && cc <= 0x7a) ||                                                         // lower a-z
+             cc === 0x21 || cc === 0x23 || cc === 0x24 || cc === 0x25 ||                           // ! # $ %
+             cc === 0x26 || cc === 0x27 || cc === 0x2a || cc === 0x2b ||                           // & ' * +
+             cc === 0x2d || cc === 0x2e || cc === 0x5e || cc === 0x5f ||                           // - . ^ _
+             cc === 0x60 || cc === 0x7c || cc === 0x7e;                                            // ` | ~
     if (!ok) {
       throw new SafeIcapError("safe-icap/bad-status-line",
         "safeIcap.parse: invalid char in header name '" + name + "' (RFC 7230 §3.2.6 tchar)");
@@ -447,7 +447,7 @@ function _parseEncapsulated(value) {
         "safeIcap.parse: Encapsulated offset for '" + part + "' must be a non-negative integer (got '" +
         offStr + "')");
     }
-    var off = parseInt(offStr, 10);                                                                // allow:raw-byte-literal — base-10 radix
+    var off = parseInt(offStr, 10);                                                                // base-10 radix
     if (!isFinite(off) || off < 0) {
       throw new SafeIcapError("safe-icap/bad-encapsulated",
         "safeIcap.parse: Encapsulated offset for '" + part + "' must be a non-negative integer (got '" +

package/lib/safe-jsonpath.js

@@ -86,7 +86,7 @@ function _hasControlOrNul(value) {
   // legitimate use in a JSON pointer / key / path expression.
   for (var i = 0; i < value.length; i++) {
     var c = value.charCodeAt(i);
-    if (c === 0 || (c < 32 && c !== 9) || c === 127) return true; // allow:raw-byte-literal — ASCII control-byte range
+    if (c === 0 || (c < 32 && c !== 9) || c === 127) return true; // ASCII control-byte range
   }
   if (codepointClass.BIDI_RE.test(value)) return true; // allow:regex-no-length-cap — callers cap length via MAX_KEY_BYTES / MAX_EXPRESSION_BYTES
   if (codepointClass.ZERO_WIDTH_RE.test(value)) return true; // allow:regex-no-length-cap — callers cap length via MAX_KEY_BYTES / MAX_EXPRESSION_BYTES
@@ -203,7 +203,7 @@ function validateExpression(expr, opts) {
   var maxDepth = opts.maxDepth || MAX_EXPRESSION_DEPTH;
   for (var j = 0; j < expr.length; j++) {
     var ch = expr.charCodeAt(j);
-    if (ch === 91 /* [ */ || ch === 40 /* ( */ || ch === 123 /* { */) { // allow:raw-byte-literal — ASCII '[' '(' '{' codepoints
+    if (ch === 91 /* [ */ || ch === 40 /* ( */ || ch === 123 /* { */) { // ASCII '[' '(' '{' codepoints
       depth += 1;
       if (depth > maxDepth) {
         throw _err("safe-jsonpath/expression-too-deep",

package/lib/safe-mime.js

@@ -49,7 +49,7 @@ var { defineClass } = require("./framework-error");
 
 var SafeMimeError = defineClass("SafeMimeError", { alwaysPermanent: true });
 
-var DEFAULT_MAX_PARTS         = 64;                          // allow:raw-byte-literal — total parts cap, not bytes
+var DEFAULT_MAX_PARTS         = 64;                          // total parts cap, not bytes
 var DEFAULT_MAX_NESTING_DEPTH = 16;
 var DEFAULT_MAX_BOUNDARY      = 70;                          // RFC 2046 §5.1.1
 var DEFAULT_MAX_HEADER_BYTES  = C.BYTES.kib(64);
@@ -61,7 +61,7 @@ var DEFAULT_MAX_HEADER_BYTES  = C.BYTES.kib(64);
 // strict 78-byte refusal would reject legitimate mail. We enforce
 // only the 998-byte MUST. Future drift attempting to "fix" this to
 // 78 would be a regression and should fail the audit gate.
-var DEFAULT_MAX_HEADER_LINE   = 998;                         // allow:raw-byte-literal — RFC 5322 §2.1.1 MUST (998); the SHOULD (78) is by design not enforced
+var DEFAULT_MAX_HEADER_LINE   = 998;                         // RFC 5322 §2.1.1 MUST (998); the SHOULD (78) is by design not enforced
 // Per-message header-count cap. RFC 5322 places no upper bound on
 // the number of headers in a message; without one, a sender can pack
 // tens of thousands of one-byte headers into the maxHeaderBytes budget
@@ -71,7 +71,7 @@ var DEFAULT_MAX_HEADER_LINE   = 998;                         // allow:raw-byte-l
 // Microsoft 365 `MaxRecipientEnvelopePerMessage`) cap in the low
 // hundreds; the framework picks 512 as a generous default with
 // `maxHeaderCount` exposed for operators that legitimately need more.
-var DEFAULT_MAX_HEADER_COUNT  = 512;                         // allow:raw-byte-literal — DoS bound, not bytes
+var DEFAULT_MAX_HEADER_COUNT  = 512;                         // DoS bound, not bytes
 var DEFAULT_MAX_BODY_BYTES    = C.BYTES.mib(25);
 var DEFAULT_MAX_MESSAGE_BYTES = C.BYTES.mib(50);
 
@@ -475,11 +475,11 @@ function _parseHeaders(buf, ctx) {
     // they're inspecting.
     for (var hci = 0; hci < value.length; hci += 1) {
       var hcc = value.charCodeAt(hci);
-      if ((hcc < 0x20 && hcc !== 0x09) || hcc === 0x7F) {                                          // allow:raw-byte-literal — C0 control char + DEL refusal
+      if ((hcc < 0x20 && hcc !== 0x09) || hcc === 0x7F) {                                          // C0 control char + DEL refusal
         var byteOffset = Buffer.byteLength(value.slice(0, hci), "utf8");
         throw new SafeMimeError("safe-mime/control-char-in-header",
           "safeMime.parse: header '" + name + "' contains control char 0x" +
-          hcc.toString(16) + " at byte offset " + byteOffset);                                            // allow:raw-byte-literal — toString radix 16 hex, not bytes
+          hcc.toString(16) + " at byte offset " + byteOffset);                                            // toString radix 16 hex, not bytes
       }
     }
     value = _decodeRfc2047Words(value);
@@ -596,7 +596,7 @@ function _splitMultipart(buf, boundary) {
 var _BOUNDARY_BCHARSNOSPACE = /^[0-9A-Za-z'()+_,./:=?-]+$/;                         // allow:regex-no-length-cap — length checked separately
 var _BOUNDARY_BCHARS_WITH_SP = /^[0-9A-Za-z'()+_,./:=? -]+$/;                       // allow:regex-no-length-cap — length checked separately
 function _isValidMimeBoundary(value) {
-  if (typeof value !== "string" || value.length === 0 || value.length > 70) return false; // allow:raw-byte-literal — RFC 2046 §5.1.1 bound
+  if (typeof value !== "string" || value.length === 0 || value.length > 70) return false; // RFC 2046 §5.1.1 bound
   // First char MUST be bcharsnospace; remainder MAY be bchars (which
   // permits SP). Last char MUST also be bcharsnospace (no trailing SP).
   if (!_BOUNDARY_BCHARSNOSPACE.test(value.charAt(0))) return false;
@@ -652,7 +652,7 @@ function _decodeQuotedPrintable(buf) {
   var s = buf.toString("binary");
   s = s.replace(/=\r?\n/g, "");
   s = s.replace(/=([0-9A-Fa-f]{2})/g, function (_, hex) {
-    return String.fromCharCode(parseInt(hex, 16));                                                 // allow:raw-byte-literal — parseInt radix 16, not bytes
+    return String.fromCharCode(parseInt(hex, 16));                                                 // parseInt radix 16, not bytes
   });
   return Buffer.from(s, "binary");
 }
@@ -666,7 +666,7 @@ function _decodeRfc2047Words(value) {
         raw = Buffer.from(text, "base64");
       } else {
         raw = Buffer.from(text.replace(/_/g, " ").replace(/=([0-9A-Fa-f]{2})/g,
-          function (__, hex) { return String.fromCharCode(parseInt(hex, 16)); }), "binary");      // allow:raw-byte-literal — parseInt radix 16, not bytes
+          function (__, hex) { return String.fromCharCode(parseInt(hex, 16)); }), "binary");      // parseInt radix 16, not bytes
       }
       // RFC 2047 §5 encoded-word header-injection defense — after
       // base64 / Q-encoded decode, check the DECODED bytes for header
@@ -714,7 +714,7 @@ function _decodeBufferAs(buf, charset) {
 // Byte-pair endian flip into a temporary buffer, then decode as
 // utf-16le. Allocates a single buffer (no per-character churn).
 function _decodeUtf16BE(buf) {
-  var n = buf.length & ~1;                                                                                // allow:raw-byte-literal — pair alignment mask
+  var n = buf.length & ~1;                                                                                // pair alignment mask
   var swapped = Buffer.alloc(n);
   for (var i = 0; i < n; i += 2) {
     swapped[i]     = buf[i + 1];
@@ -806,7 +806,7 @@ function _normalizeCharsetName(c) {
 
 function _previewBytes(line) {
   if (typeof line !== "string") line = String(line);
-  return line.length > 64 ? line.slice(0, 64) + "..." : line;                                       // allow:raw-byte-literal — log-preview length cap
+  return line.length > 64 ? line.slice(0, 64) + "..." : line;                                       // log-preview length cap
 }
 
 module.exports = {

package/lib/safe-mount-info.js

@@ -115,7 +115,7 @@ function parse(text, opts) {
   numericBounds.requirePositiveFiniteIntIfPresent(opts.maxLines,
     "safeMountInfo.parse: opts.maxLines",
     SafeMountInfoError, "safe-mount-info/bad-arg");
-  var maxLines = (typeof opts.maxLines === "number") ? opts.maxLines : 4096;         // allow:raw-byte-literal — line cap matches max kernel-published mount count
+  var maxLines = (typeof opts.maxLines === "number") ? opts.maxLines : 4096;         // line cap matches max kernel-published mount count
   var strict = opts.strict === true;
   var lines  = text.split("\n");
   // `text.split("\n").length` counts the trailing empty segment that
@@ -150,7 +150,7 @@ function parse(text, opts) {
     }
     var preFields  = ln.slice(0, sepIdx).split(" ");
     var postFields = ln.slice(sepIdx + 3).split(" ");
-    if (preFields.length < 6 || postFields.length < 1) {                             // allow:raw-byte-literal — kernel-mandated minimum field counts
+    if (preFields.length < 6 || postFields.length < 1) {                             // kernel-mandated minimum field counts
       if (strict) {
         throw new SafeMountInfoError(
           "safe-mount-info/parse-failed",
@@ -251,7 +251,7 @@ function bestMatch(entries, path) {
     if (path === mp ||
         (path.length > mp.length &&
          path.indexOf(mp) === 0 &&
-         (mp === "/" || path.charCodeAt(mp.length) === 47 /* "/" */))) {              // allow:raw-byte-literal — ASCII forward-slash
+         (mp === "/" || path.charCodeAt(mp.length) === 47 /* "/" */))) {              // ASCII forward-slash
       if (mp.length > bestLen) {
         bestLen = mp.length;
         best = e;

package/lib/safe-redirect.js

@@ -46,7 +46,7 @@ var DEFAULT_FALLBACK = "/";
 function _hasControlChar(s) {
   for (var i = 0; i < s.length; i += 1) {
     var c = s.charCodeAt(i);
-    if (c < 0x20 || c === 0x7f) return true;                                     // allow:raw-byte-literal — ASCII control range thresholds
+    if (c < 0x20 || c === 0x7f) return true;                                     // ASCII control range thresholds
   }
   return false;
 }

package/lib/safe-sieve.js

@@ -53,32 +53,32 @@ var { defineClass } = require("./framework-error");
 var SafeSieveError = defineClass("SafeSieveError", { alwaysPermanent: true });
 
 var DEFAULTS = Object.freeze({
-  maxScriptBytes:     65536,                                                                          // allow:raw-byte-literal — 64 KiB
-  maxDepth:           32,                                                                             // allow:raw-byte-literal — block nesting cap
-  maxIfChainLen:      32,                                                                             // allow:raw-byte-literal — elsif/elsif... cap
-  maxStringListLen:   256,                                                                            // allow:raw-byte-literal
-  maxStringBytes:     4096,                                                                           // allow:raw-byte-literal — per-string cap
-  maxArgsPerCmd:      32,                                                                             // allow:raw-byte-literal — per-command arg cap
-  maxRequiredCaps:    32,                                                                             // allow:raw-byte-literal
+  maxScriptBytes:     65536,                                                                          // 64 KiB
+  maxDepth:           32,                                                                             // block nesting cap
+  maxIfChainLen:      32,                                                                             // elsif/elsif... cap
+  maxStringListLen:   256,
+  maxStringBytes:     4096,                                                                           // per-string cap
+  maxArgsPerCmd:      32,                                                                             // per-command arg cap
+  maxRequiredCaps:    32,
 });
 
 var PROFILES = Object.freeze({
   strict:     Object.assign({}, DEFAULTS),
   balanced:   Object.assign({}, DEFAULTS, {
-    maxScriptBytes:  262144,                                                                          // allow:raw-byte-literal — 256 KiB
-    maxDepth:        64,                                                                              // allow:raw-byte-literal
-    maxIfChainLen:   64,                                                                              // allow:raw-byte-literal
-    maxStringListLen: 1024,                                                                           // allow:raw-byte-literal
-    maxStringBytes:  16384,                                                                           // allow:raw-byte-literal
-    maxArgsPerCmd:   64,                                                                              // allow:raw-byte-literal
+    maxScriptBytes:  262144,                                                                          // 256 KiB
+    maxDepth:        64,
+    maxIfChainLen:   64,
+    maxStringListLen: 1024,
+    maxStringBytes:  16384,
+    maxArgsPerCmd:   64,
   }),
   permissive: Object.assign({}, DEFAULTS, {
-    maxScriptBytes:  1048576,                                                                         // allow:raw-byte-literal — 1 MiB
-    maxDepth:        128,                                                                             // allow:raw-byte-literal
-    maxIfChainLen:   128,                                                                             // allow:raw-byte-literal
-    maxStringListLen: 4096,                                                                           // allow:raw-byte-literal
-    maxStringBytes:  65536,                                                                           // allow:raw-byte-literal
-    maxArgsPerCmd:   128,                                                                             // allow:raw-byte-literal
+    maxScriptBytes:  1048576,                                                                         // 1 MiB
+    maxDepth:        128,
+    maxIfChainLen:   128,
+    maxStringListLen: 4096,
+    maxStringBytes:  65536,
+    maxArgsPerCmd:   128,
   }),
 });
 
@@ -110,7 +110,7 @@ var KNOWN_CAPABILITIES = Object.freeze({
   "variables":    false,                                                                              // RFC 5229
   "vacation":     false,                                                                              // RFC 5230
   "relational":   false,                                                                              // RFC 5231
-  "imap4flags":   false,                                                                              // RFC 5232 // allow:raw-byte-literal — RFC number
+  "imap4flags":   false,                                                                              // RFC 5232 // RFC number
   "subaddress":   false,                                                                              // RFC 5233
   "spamtest":     false,                                                                              // RFC 5235
   "virustest":    false,                                                                              // RFC 5235
@@ -219,7 +219,7 @@ function _tokenize(script, caps) {
 
     // Control bytes outside strings refused (NUL / C0 except TAB/LF/CR).
     if (c < 0x20 && c !== 0x09 && c !== 0x0A && c !== 0x0D) {
-      _error("control byte 0x" + c.toString(16) + " refused outside string literal");                  // allow:raw-byte-literal — base-16 toString radix
+      _error("control byte 0x" + c.toString(16) + " refused outside string literal");                  // base-16 toString radix
     }
     if (c === 0x7F) _error("DEL byte refused outside string literal");
 
@@ -265,7 +265,7 @@ function _tokenize(script, caps) {
       var num = parseInt(script.slice(nStart, i), 10);
       if (i < n) {
         var suf = script.charCodeAt(i);
-        if (suf === 0x4B || suf === 0x6B) { num *= 1024; _advance(suf); }                             // allow:raw-byte-literal — K
+        if (suf === 0x4B || suf === 0x6B) { num *= 1024; _advance(suf); }                             // K
         else if (suf === 0x4D || suf === 0x6D) { num *= 1024 * 1024; _advance(suf); }                 // allow:raw-byte-literal — M
         else if (suf === 0x47 || suf === 0x67) { num *= 1024 * 1024 * 1024; _advance(suf); }          // allow:raw-byte-literal — G
       }
@@ -360,7 +360,7 @@ function _tokenize(script, caps) {
       continue;
     }
 
-    _error("unexpected byte 0x" + c.toString(16));                                                     // allow:raw-byte-literal — base-16 toString radix
+    _error("unexpected byte 0x" + c.toString(16));                                                     // base-16 toString radix
   }
 
   tokens.push({ k: "eof", line: line, col: col });

package/lib/safe-smtp.js

@@ -71,7 +71,7 @@ function findDotTerminator(buf) {
     throw new SafeSmtpError("safe-smtp/bad-input",
       "findDotTerminator: input must be a Buffer");
   }
-  for (var i = 0; i <= buf.length - 5; i += 1) {                                                     // allow:raw-byte-literal — 5-byte CRLF.CRLF terminator length
+  for (var i = 0; i <= buf.length - 5; i += 1) {                                                     // 5-byte CRLF.CRLF terminator length
     if (buf[i] === 0x0d && buf[i + 1] === 0x0a &&
         buf[i + 2] === 0x2e &&
         buf[i + 3] === 0x0d && buf[i + 4] === 0x0a) {

package/lib/safe-vcard.js

@@ -71,22 +71,22 @@ var PROFILES = Object.freeze({
     maxBytes:           C.BYTES.kib(256),
     maxLineBytes:       C.BYTES.kib(8),
     maxEmbedBytes:      C.BYTES.mib(1),
-    maxCards:           16,                                                                                // allow:raw-byte-literal — card count cap, not byte size
-    maxPropertiesPerCard: 256,                                                                             // allow:raw-byte-literal — prop count cap, not byte size
+    maxCards:           16,                                                                                // card count cap, not byte size
+    maxPropertiesPerCard: 256,                                                                             // prop count cap, not byte size
   }),
   balanced: Object.freeze({
     maxBytes:           C.BYTES.mib(1),
     maxLineBytes:       C.BYTES.kib(32),
     maxEmbedBytes:      C.BYTES.mib(4),
-    maxCards:           256,                                                                               // allow:raw-byte-literal — card count cap, not byte size
-    maxPropertiesPerCard: 1024,                                                                            // allow:raw-byte-literal — prop count cap, not byte size
+    maxCards:           256,                                                                               // card count cap, not byte size
+    maxPropertiesPerCard: 1024,                                                                            // prop count cap, not byte size
   }),
   permissive: Object.freeze({
     maxBytes:           C.BYTES.mib(4),
     maxLineBytes:       C.BYTES.kib(128),
     maxEmbedBytes:      C.BYTES.mib(16),
-    maxCards:           4096,                                                                              // allow:raw-byte-literal — card count cap, not byte size
-    maxPropertiesPerCard: 4096,                                                                            // allow:raw-byte-literal — prop count cap, not byte size
+    maxCards:           4096,                                                                              // card count cap, not byte size
+    maxPropertiesPerCard: 4096,                                                                            // prop count cap, not byte size
   }),
 });
 
@@ -270,7 +270,7 @@ function _unfold(s, caps) {
     var line = raw[i];
     if (line.length === 0) continue;
     var firstChar = line.charCodeAt(0);
-    if (firstChar === 0x20 || firstChar === 0x09) {                                                       // allow:raw-byte-literal — SPACE / HTAB fold markers per RFC 6350 §3.2
+    if (firstChar === 0x20 || firstChar === 0x09) {                                                       // SPACE / HTAB fold markers per RFC 6350 §3.2
       if (unfolded.length === 0) {
         throw new SafeVcardError("safe-vcard/bad-line",
           "safeVcard.parse: continuation line before any content line");
@@ -304,7 +304,7 @@ function _parseContentLine(line) {
 
   for (var k = 0; k < value.length; k++) {
     var cc = value.charCodeAt(k);
-    if ((cc < 0x20 && cc !== 0x09) || cc === 0x7F) {                                                      // allow:raw-byte-literal — C0 + DEL refusal
+    if ((cc < 0x20 && cc !== 0x09) || cc === 0x7F) {                                                      // C0 + DEL refusal
       throw new SafeVcardError("safe-vcard/control-char-in-value",
         "safeVcard.parse: control char 0x" + cc.toString(16) +
         " in property value (header-injection defense)");
@@ -346,8 +346,8 @@ function _findUnquotedColon(line) {
   var inQ = false;
   for (var i = 0; i < line.length; i++) {
     var c = line.charCodeAt(i);
-    if (c === 0x22) { inQ = !inQ; continue; }                                                             // allow:raw-byte-literal — DQUOTE per RFC 6350 §3.3
-    if (c === 0x3A && !inQ) return i;                                                                     // allow:raw-byte-literal — colon separator per RFC 6350 §3.3
+    if (c === 0x22) { inQ = !inQ; continue; }                                                             // DQUOTE per RFC 6350 §3.3
+    if (c === 0x3A && !inQ) return i;                                                                     // colon separator per RFC 6350 §3.3
   }
   return -1;
 }
@@ -443,15 +443,15 @@ function _embedByteLength(value) {
   var dataMatch = /^data:[^;,]*;base64,(.*)$/i.exec(value);
   if (dataMatch) {
     var payload = dataMatch[1].replace(/\s+/g, "");
-    return Math.floor(payload.length * 3 / 4);                                                            // allow:raw-byte-literal — base64 3/4 decode ratio per RFC 4648 §4
+    return Math.floor(payload.length * 3 / 4);                                                            // base64 3/4 decode ratio per RFC 4648 §4
   }
   // ENCODING=b / ENCODING=BASE64 puts the raw base64 in the value
   // directly (the param is parsed separately upstream; we do not have
   // access here, so check whether the payload is base64-shaped).
-  if (/^[A-Za-z0-9+/=\r\n\t ]+$/.test(value) && value.length > 32) {                                      // allow:raw-byte-literal — heuristic threshold for base64 detection
+  if (/^[A-Za-z0-9+/=\r\n\t ]+$/.test(value) && value.length > 32) {                                      // heuristic threshold for base64 detection
     var compact = value.replace(/\s+/g, "");
     if (compact.length > 0 && compact.length % 4 === 0) {
-      return Math.floor(compact.length * 3 / 4);                                                          // allow:raw-byte-literal — base64 3/4 decode ratio per RFC 4648 §4
+      return Math.floor(compact.length * 3 / 4);                                                          // base64 3/4 decode ratio per RFC 4648 §4
     }
   }
   return Buffer.byteLength(value, "utf8");
@@ -459,7 +459,7 @@ function _embedByteLength(value) {
 
 function _preview(s) {
   if (typeof s !== "string") s = String(s);
-  return s.length > 64 ? s.slice(0, 64) + "..." : s;                                                       // allow:raw-byte-literal — log-preview length cap
+  return s.length > 64 ? s.slice(0, 64) + "..." : s;                                                       // log-preview length cap
 }
 
 module.exports = {

package/lib/sandbox.js

@@ -221,11 +221,11 @@ function run(opts) {
   // The MiB-unit caps below are integers passed directly to v8's
   // resourceLimits (already typed in MiB by the v8 API), not byte
   // counts - the constants helpers don't apply.
-  var minHeapFloorMib = 64;     // allow:raw-byte-literal — MiB unit count, not bytes
-  var youngGenCapMib  = 32;     // allow:raw-byte-literal — MiB unit count, not bytes
-  var youngGenFloorMib = 8;     // allow:raw-byte-literal — MiB unit count, not bytes
-  var codeRangeCapMib = 16;     // allow:raw-byte-literal — MiB unit count, not bytes
-  var codeRangeFloorMib = 8;    // allow:raw-byte-literal — MiB unit count, not bytes
+  var minHeapFloorMib = 64;     // MiB unit count, not bytes
+  var youngGenCapMib  = 32;     // MiB unit count, not bytes
+  var youngGenFloorMib = 8;     // MiB unit count, not bytes
+  var codeRangeCapMib = 16;     // MiB unit count, not bytes
+  var codeRangeFloorMib = 8;    // MiB unit count, not bytes
   var stackMib = 4;             // MiB unit count, not bytes
   var heapMib = Math.max(minHeapFloorMib, Math.floor(maxBytes / oneMib));
   var resourceLimits = {

package/lib/sec-cyber.js

@@ -203,7 +203,7 @@ function eightKArtifact(opts) {
   return {
     artifact: { markdown: markdown, json: artifactJson },
     deadline: deadline,
-    deadlineBusinessDays: agDelayRequested ? null : 4,                                       // allow:raw-byte-literal — SEC Item 1.05 4-business-day deadline (17 CFR §229.106(c)(1))
+    deadlineBusinessDays: agDelayRequested ? null : 4,                                       // SEC Item 1.05 4-business-day deadline (17 CFR §229.106(c)(1))
   };
 }
 

package/lib/self-update-standalone-verifier.js

@@ -237,7 +237,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
       // are allowed to see. Without this, a concurrent appender grows
       // the file under us and the readSync returns more bytes than the
       // fullBuf was sized for.
-      var capped = chunk.length;                                                                     // allow:raw-byte-literal — buffer length is the read upper bound
+      var capped = chunk.length;                                                                     // buffer length is the read upper bound
       if (remaining < capped) capped = remaining;
       var n = nodeFs.readSync(assetFd, chunk, 0, capped, null);
       if (n === 0) break;
@@ -275,7 +275,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
     // verifier.verify ONCE — calling it a second time after a failed
     // verify returns stale state and silently passes tampered assets.
     // 96 = P-384 IEEE-P1363 signature length; protocol constant, not a byte-size.
-    var dsaEncoding = signature.length === 96 ? "ieee-p1363" : "der";   // allow:raw-byte-literal — IEEE-P1363 P-384 signature length
+    var dsaEncoding = signature.length === 96 ? "ieee-p1363" : "der";   // IEEE-P1363 P-384 signature length
     ok = verifier.verify({ key: key, dsaEncoding: dsaEncoding }, signature);
   } else if (alg === "ed25519") {
     // fullBuf may be shorter than allocated (sparse files / size-races);
@@ -287,7 +287,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
 
   if (!ok) {
     throw new Error("standalone-verifier.verify: " + alg + " signature INVALID for " +
-                    assetPath + " (sha3-512=" + sha3Hex.slice(0, 16) + "...). " +   // allow:raw-byte-literal — 16-char hex prefix for forensic display, not bytes
+                    assetPath + " (sha3-512=" + sha3Hex.slice(0, 16) + "...). " +   // 16-char hex prefix for forensic display, not bytes
                     "Either the asset was tampered with after signing, the signature " +
                     "doesn't match this asset, or the pubkey doesn't match the signing key.");
   }

package/lib/self-update.js

@@ -140,7 +140,7 @@ function _isAllNumeric(s) {
   if (typeof s !== "string" || s.length === 0) return false;
   for (var i = 0; i < s.length; i += 1) {
     var c = s.charCodeAt(i);
-    if (c < 0x30 || c > 0x39) return false;                                                          // allow:raw-byte-literal — ASCII codepoint range for digits
+    if (c < 0x30 || c > 0x39) return false;                                                          // ASCII codepoint range for digits
   }
   return true;
 }
@@ -349,7 +349,7 @@ async function poll(opts) {
       "selfUpdate.poll: request failed: " + ((e && e.message) || String(e)));
   }
 
-  if (res.statusCode === 304) {                                                    // allow:raw-byte-literal — HTTP status code (RFC 7232), not bytes
+  if (res.statusCode === 304) {                                                    // HTTP status code (RFC 7232), not bytes
     _safeAuditEmit("selfupdate.poll.checked", "success", {
       releasesUrl:    opts.releasesUrl,
       currentVersion: opts.currentVersion,
@@ -357,7 +357,7 @@ async function poll(opts) {
       etagHit:        true,
     });
     return { available: false, latestTag: null, currentVersion: opts.currentVersion,
-             asset: null, signature: null, etag: opts.etag, statusCode: 304 };    // allow:raw-byte-literal — HTTP status code (RFC 7232), not bytes
+             asset: null, signature: null, etag: opts.etag, statusCode: 304 };    // HTTP status code (RFC 7232), not bytes
   }
   if (res.statusCode < 200 || res.statusCode >= 300) {
     _safeAuditEmit("selfupdate.poll.checked", "denied", {

package/lib/server-timing.js

@@ -42,7 +42,7 @@ var ServerTimingError = defineClass("ServerTimingError", { alwaysPermanent: true
 
 // W3C Server-Timing §3 — metric-name is token shape (RFC 7230). Cap
 // at 128 chars for sanity; operator-supplied desc is sf-string.
-var METRIC_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;                                       // allow:raw-byte-literal — RFC 7230 token shape + length cap
+var METRIC_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;                                       // RFC 7230 token shape + length cap
 
 function _quoteDesc(s) {
   return "\"" + String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";
@@ -73,7 +73,7 @@ function create() {
   function mark(name, durationMs, description) {
     validateOpts.requireNonEmptyString(
       name, "serverTiming.mark.name", ServerTimingError, "server-timing/bad-name");
-    if (name.length > 128 || !METRIC_NAME_RE.test(name)) {                                         // allow:raw-byte-literal — metric-name length cap, not bytes
+    if (name.length > 128 || !METRIC_NAME_RE.test(name)) {                                         // metric-name length cap, not bytes
       throw new ServerTimingError("server-timing/bad-name",
         "metric name '" + name + "' must match RFC 7230 token + <= 128 chars");
     }
@@ -156,7 +156,7 @@ function _now() {
   // to Date.now in environments without it.
   if (typeof process !== "undefined" && typeof process.hrtime === "function" &&
       typeof process.hrtime.bigint === "function") {
-    return Number(process.hrtime.bigint() / 1000n) / 1000;                                         // allow:raw-byte-literal — hrtime ns→ms scale, not bytes
+    return Number(process.hrtime.bigint() / 1000n) / 1000;                                         // hrtime ns→ms scale, not bytes
   }
   return Date.now();
 }