@blamejs/core 0.14.0 → 0.14.2

package/lib/cms-codec.js

@@ -107,14 +107,14 @@ var OID = Object.freeze({
 });
 
 // Refusal ceilings.
-var MAX_DEPTH       = 32;                                                                             // allow:raw-byte-literal — ASN.1 recursion ceiling
+var MAX_DEPTH       = 32;                                                                             // ASN.1 recursion ceiling
 var DEFAULT_MAX_LEN = 64 * 1024 * 1024;                                                               // allow:raw-byte-literal — 64 MiB default decode cap
 
 // Universal-tag bytes used in encode helpers.
-var TAG_SEQUENCE = 0x30;                                                                              // allow:raw-byte-literal — ASN.1 SEQUENCE constructed
-var TAG_SET      = 0x31;                                                                              // allow:raw-byte-literal — ASN.1 SET constructed
-var TAG_UTCTIME  = 0x17;                                                                              // allow:raw-byte-literal — UTCTime universal
-var TAG_GENTIME  = 0x18;                                                                              // allow:raw-byte-literal — GeneralizedTime universal
+var TAG_SEQUENCE = 0x30;                                                                              // ASN.1 SEQUENCE constructed
+var TAG_SET      = 0x31;                                                                              // ASN.1 SET constructed
+var TAG_UTCTIME  = 0x17;                                                                              // UTCTime universal
+var TAG_GENTIME  = 0x18;                                                                              // GeneralizedTime universal
 
 /**
  * @primitive b.cms.encodeSignedData
@@ -197,7 +197,7 @@ function encodeSignedData(opts) {
 
   // SignedData SEQUENCE per §5.1.
   var signedDataSeq = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([1])),                                                              // allow:raw-byte-literal — CMSVersion 1 per §5.1
+    asn1.writeInteger(Buffer.from([1])),                                                              // CMSVersion 1 per §5.1
     digestAlgs,
     encapInfo,
     certsBlock,
@@ -258,7 +258,7 @@ function encodeEnvelopedData(opts) {
       "encodeEnvelopedData: opts.recipients must be a non-empty array");
   }
   // Fresh ChaCha20-Poly1305 content key.
-  var contentKey = bCrypto.generateBytes(32);                                                         // allow:raw-byte-literal — 256-bit ChaCha20 key
+  var contentKey = bCrypto.generateBytes(32);                                                         // 256-bit ChaCha20 key
 
   // recipientInfos SET — one KEMRecipientInfo per recipient.
   var ris = opts.recipients.map(function (r) {
@@ -272,7 +272,7 @@ function encodeEnvelopedData(opts) {
   // EnvelopedData SEQUENCE per §6.1. CMSVersion 4 (RFC 9629 §3 — when
   // any RecipientInfo is OtherRecipientInfo, here KEMRecipientInfo).
   var envelopedSeq = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([4])),                                                              // allow:raw-byte-literal — CMSVersion 4 per RFC 9629 §3
+    asn1.writeInteger(Buffer.from([4])),                                                              // CMSVersion 4 per RFC 9629 §3
     recipientInfosSet,
     encContent,
   ]));
@@ -334,7 +334,7 @@ function decode(buf, opts) {
   }
   if (!(node.tag === asn1.TAG.SEQUENCE && node.constructed)) {
     throw new CmsCodecError("cms/bad-content-info",
-      "decode: top-level must be SEQUENCE (got tag 0x" + node.tag.toString(16) + ")");                // allow:raw-byte-literal — hex radix for error-message formatting
+      "decode: top-level must be SEQUENCE (got tag 0x" + node.tag.toString(16) + ")");                // hex radix for error-message formatting
   }
   // ContentInfo SEQUENCE children: { contentType OID, [0] EXPLICIT ANY }.
   var children;
@@ -399,7 +399,7 @@ function _writeImplicitConstructed(tagNumber, payload) {
   // [N] IMPLICIT context-specific CONSTRUCTED — for wrapping SEQUENCE /
   // SET payloads (e.g. certificates [0], crls [1], OtherRecipientInfo
   // value).
-  var tagByte = 0xa0 | (tagNumber & 0x1f);                                                            // allow:raw-byte-literal — context-specific constructed mask
+  var tagByte = 0xa0 | (tagNumber & 0x1f);                                                            // context-specific constructed mask
   return asn1.writeNode(tagByte, payload);
 }
 
@@ -410,7 +410,7 @@ function _writeImplicitPrimitive(tagNumber, value) {
   // reject the structure (Codex P1 finding on PR #102 — RecipientIdentifier
   // CHOICE's SubjectKeyIdentifier alternative is `[0] IMPLICIT OCTET STRING`,
   // a primitive type).
-  var tagByte = 0x80 | (tagNumber & 0x1f);                                                            // allow:raw-byte-literal — context-specific primitive mask
+  var tagByte = 0x80 | (tagNumber & 0x1f);                                                            // context-specific primitive mask
   return asn1.writeNode(tagByte, value);
 }
 
@@ -459,7 +459,7 @@ function _signerInfo(signer, msgDigest, digestOid) {
   // SignerInfo, and use the original `31 LL VV...` form as the signature
   // input.
   var signatureInput = signedAttrs;
-  var signedAttrsImplicit = Buffer.concat([Buffer.from([0xa0]),                                       // allow:raw-byte-literal — IMPLICIT [0] tag per RFC 5652 §5.3
+  var signedAttrsImplicit = Buffer.concat([Buffer.from([0xa0]),                                       // IMPLICIT [0] tag per RFC 5652 §5.3
                                             signedAttrs.slice(1)]);
 
   var signature;
@@ -474,7 +474,7 @@ function _signerInfo(signer, msgDigest, digestOid) {
 
   // SignerInfo SEQUENCE per §5.3 (issuerAndSerialNumber variant — CMSVersion 1).
   return asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([1])),                                                              // allow:raw-byte-literal — CMSVersion 1 for issuerAndSerialNumber
+    asn1.writeInteger(Buffer.from([1])),                                                              // CMSVersion 1 for issuerAndSerialNumber
     _issuerAndSerialNumber(signer.certificate),
     _algorithmIdentifier(digestOid),
     signedAttrsImplicit,
@@ -576,9 +576,9 @@ function _reEncodeNode(node) {
   // TLV. writeNode rebuilds canonical DER from the original tag byte +
   // value bytes; the tag byte is reconstructed from tagClass + constructed +
   // tag number.
-  var classBits  = (node.tagClass & 0x03) << 6;                                                       // allow:raw-byte-literal — tag-class shift
-  var consBit    = node.constructed ? 0x20 : 0x00;                                                    // allow:raw-byte-literal — constructed bit
-  var tagBits    = node.tag & 0x1f;                                                                   // allow:raw-byte-literal — short-form tag
+  var classBits  = (node.tagClass & 0x03) << 6;                                                       // tag-class shift
+  var consBit    = node.constructed ? 0x20 : 0x00;                                                    // constructed bit
+  var tagBits    = node.tag & 0x1f;                                                                   // short-form tag
   var tagByte    = classBits | consBit | tagBits;
   return asn1.writeNode(tagByte, node.value);
 }
@@ -620,7 +620,7 @@ function _recipientInfo(recipient, contentKey) {
   // composition path.
   var infoLabel = Buffer.from("cms/kemri/chacha20-poly1305", "ascii");
   var kdfInput  = Buffer.concat([Buffer.from(encap.sharedSecret), infoLabel]);
-  var kek       = bCrypto.kdf(kdfInput, 32);                                                          // allow:raw-byte-literal — 256-bit KEK
+  var kek       = bCrypto.kdf(kdfInput, 32);                                                          // 256-bit KEK
   // Wrap the content key under the KEK using ChaCha20-Poly1305.
   var wrapped;
   try { wrapped = bCrypto.encryptPacked(contentKey, kek); }
@@ -631,7 +631,7 @@ function _recipientInfo(recipient, contentKey) {
   // KEMRecipientInfo SEQUENCE.
   // Simplified ordering, version 0 per RFC 9629 §3.
   var kemRi = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([0])),                                                              // allow:raw-byte-literal — KEMRecipientInfo version 0
+    asn1.writeInteger(Buffer.from([0])),                                                              // KEMRecipientInfo version 0
     // rid CHOICE per RFC 9629 §3: this module ships the [0] IMPLICIT
     // SubjectKeyIdentifier alternative — SKI is `[0] IMPLICIT OCTET
     // STRING` (PRIMITIVE per RFC 5652 §10.2.4). The constructed form
@@ -642,7 +642,7 @@ function _recipientInfo(recipient, contentKey) {
     _algorithmIdentifier(OID.mlkem1024),                                                              // kem
     asn1.writeOctetString(Buffer.from(encap.cipherText)),                                             // kemct
     _algorithmIdentifier(OID.shake256),                                                               // kdf
-    asn1.writeInteger(Buffer.from([32])),                                                             // allow:raw-byte-literal — kekLength = 32 bytes
+    asn1.writeInteger(Buffer.from([32])),                                                             // kekLength = 32 bytes
     _algorithmIdentifier(OID.chacha20Poly1305),                                                       // wrap (also used as content-encryption AlgId; same OID)
     asn1.writeOctetString(wrapped),                                                                   // encryptedKey
   ]));
@@ -653,7 +653,7 @@ function _recipientInfo(recipient, contentKey) {
     asn1.writeOid(OID.kemri),
     kemRi,
   ]);
-  return asn1.writeNode(0xa4, oriValue);                                                              // allow:raw-byte-literal — [4] IMPLICIT context-specific constructed (ori CHOICE)
+  return asn1.writeNode(0xa4, oriValue);                                                              // [4] IMPLICIT context-specific constructed (ori CHOICE)
 }
 
 function _encryptedContentInfo(plaintext, contentKey) {
@@ -797,7 +797,7 @@ function _readSignerInfo(siNode) {
   var signedAttrsRaw = null;
   if (c[idx] && c[idx].tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && c[idx].tag === 0) {
     var implicitRaw = _reEncodeNode(c[idx]);
-    signedAttrsRaw = Buffer.concat([Buffer.from([0x31]), implicitRaw.slice(1)]);                      // allow:raw-byte-literal — universal SET tag per RFC 5652 §5.4
+    signedAttrsRaw = Buffer.concat([Buffer.from([0x31]), implicitRaw.slice(1)]);                      // universal SET tag per RFC 5652 §5.4
     idx += 1;
   }
   var sigAlgOid = _readAlgIdOid(c[idx]); idx += 1;

package/lib/codepoint-class.js

@@ -50,7 +50,7 @@
  *     WJ   U+2060  BOM  U+FEFF
  */
 
-var HEX_RADIX = 16;                                                 // allow:raw-byte-literal — base-16 radix, not byte size
+var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 function hex4(cp) {
   var s = cp.toString(HEX_RADIX).toUpperCase();
@@ -94,17 +94,17 @@ var BOM_CHAR  = fromCp(0xFEFF);
 // is a single edit.
 var SCRIPT_RANGES = {
   latin:    [[0x0041, 0x005A], [0x0061, 0x007A],
-             [0x00C0, 0x024F], [0x1E00, 0x1EFF]],                                 // allow:raw-byte-literal — Unicode script ranges
-  cyrillic: [[0x0400, 0x04FF], [0x0500, 0x052F]],                                 // allow:raw-byte-literal — Unicode Cyrillic + Cyrillic Supplement
-  greek:    [[0x0370, 0x03FF], [0x1F00, 0x1FFF]],                                 // allow:raw-byte-literal — Unicode Greek + Greek Extended
-  armenian: [[0x0530, 0x058F]],                                                   // allow:raw-byte-literal — Unicode Armenian
-  cherokee: [[0x13A0, 0x13FF], [0xAB70, 0xABBF]],                                 // allow:raw-byte-literal — Unicode Cherokee + Cherokee Supplement
-  han:      [[0x4E00, 0x9FFF]],                                                   // allow:raw-byte-literal — CJK Unified Ideographs
-  hiragana: [[0x3040, 0x309F]],                                                   // allow:raw-byte-literal — Hiragana
-  katakana: [[0x30A0, 0x30FF]],                                                   // allow:raw-byte-literal — Katakana
-  hangul:   [[0xAC00, 0xD7AF]],                                                   // allow:raw-byte-literal — Hangul Syllables
-  arabic:   [[0x0600, 0x06FF]],                                                   // allow:raw-byte-literal — Arabic
-  hebrew:   [[0x0590, 0x05FF]],                                                   // allow:raw-byte-literal — Hebrew
+             [0x00C0, 0x024F], [0x1E00, 0x1EFF]],                                 // Unicode script ranges
+  cyrillic: [[0x0400, 0x04FF], [0x0500, 0x052F]],                                 // Unicode Cyrillic + Cyrillic Supplement
+  greek:    [[0x0370, 0x03FF], [0x1F00, 0x1FFF]],                                 // Unicode Greek + Greek Extended
+  armenian: [[0x0530, 0x058F]],                                                   // Unicode Armenian
+  cherokee: [[0x13A0, 0x13FF], [0xAB70, 0xABBF]],                                 // Unicode Cherokee + Cherokee Supplement
+  han:      [[0x4E00, 0x9FFF]],                                                   // CJK Unified Ideographs
+  hiragana: [[0x3040, 0x309F]],                                                   // Hiragana
+  katakana: [[0x30A0, 0x30FF]],                                                   // Katakana
+  hangul:   [[0xAC00, 0xD7AF]],                                                   // Hangul Syllables
+  arabic:   [[0x0600, 0x06FF]],                                                   // Arabic
+  hebrew:   [[0x0590, 0x05FF]],                                                   // Hebrew
 };
 
 // scriptFor(cp) — returns the script-name string for a codepoint, or

package/lib/compliance-sanctions-fuzzy.js

@@ -104,7 +104,7 @@ function tokenize(name) {
   return n.split(" ").filter(function (t) { return t.length > 0; });
 }
 
-var MAX_INPUT_LEN = 512;                                                           // allow:raw-byte-literal — name length sanity cap (operators can override fuzzy.create)
+var MAX_INPUT_LEN = 512;                                                           // name length sanity cap (operators can override fuzzy.create)
 
 // ---- Levenshtein with cap + early-exit ----
 
@@ -155,7 +155,7 @@ function jaro(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return 0;
   if (a === b) return a.length === 0 ? 0 : 1;
   if (a.length === 0 || b.length === 0) return 0;
-  var matchWindow = Math.max(0, Math.floor(Math.max(a.length, b.length) / 2) - 1);  // allow:raw-byte-literal — Jaro match-window formula
+  var matchWindow = Math.max(0, Math.floor(Math.max(a.length, b.length) / 2) - 1);  // Jaro match-window formula
   var aMatched = new Array(a.length).fill(false);
   var bMatched = new Array(b.length).fill(false);
   var matches = 0;
@@ -183,7 +183,7 @@ function jaro(a, b) {
   }
   var transpositions = t / 2;
   return (matches / a.length + matches / b.length +
-          (matches - transpositions) / matches) / 3;                                // allow:raw-byte-literal — Jaro 3-term formula
+          (matches - transpositions) / matches) / 3;                                // Jaro 3-term formula
 }
 
 function jaroWinkler(a, b, prefixWeight) {
@@ -198,7 +198,7 @@ function jaroWinkler(a, b, prefixWeight) {
   var j = jaro(a, b);
   if (j === 0) return 0;
   // Common prefix up to 4 chars (Winkler's cap)
-  var maxPrefix = 4;                                                               // allow:raw-byte-literal — Jaro-Winkler prefix cap (Winkler 1990)
+  var maxPrefix = 4;                                                               // Jaro-Winkler prefix cap (Winkler 1990)
   var prefixLen = 0;
   var max = Math.min(a.length, b.length, maxPrefix);
   for (var i = 0; i < max; i++) {

package/lib/compliance-sanctions.js

@@ -274,7 +274,7 @@ function create(opts) {
       VALID_STRATEGIES.join(", "));
   }
   var maxLevenshtein = (typeof fuzzyOpts.maxLevenshtein === "number" && isFinite(fuzzyOpts.maxLevenshtein))
-    ? fuzzyOpts.maxLevenshtein : 3;                                                // allow:raw-byte-literal — default edit-distance cap (operator-tunable)
+    ? fuzzyOpts.maxLevenshtein : 3;                                                // default edit-distance cap (operator-tunable)
   var auditOn = opts.audit !== false;
   var ruleVersion = opts.ruleVersion || ("entries:" + opts.entries.length);
 
@@ -327,10 +327,10 @@ function create(opts) {
       }
       // Substring containment scores 0.92 (high but below exact)
       if (fuzzy.substringContains(name, qNorm)) {
-        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // allow:raw-byte-literal — substring-match score weight
+        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // substring-match score weight
       }
       if (fuzzy.substringContains(qNorm, name)) {
-        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // allow:raw-byte-literal — substring-match score weight
+        if (0.92 > bestScore) { bestScore = 0.92; bestName = name; }                // substring-match score weight
       }
     }
     return { score: bestScore, name: bestName };
@@ -491,7 +491,7 @@ function create(opts) {
       algorithm:    algorithm,
       ruleVersion:  ruleVersion,
       entryCount:   index.length,
-      digest:       hash.digest("hex").slice(0, 32),                                // allow:raw-byte-literal — first 32 hex chars (128 bits) of SHA-3 digest, sufficient for snapshot identity
+      digest:       hash.digest("hex").slice(0, 32),                                // first 32 hex chars (128 bits) of SHA-3 digest, sufficient for snapshot identity
       digestAlg:    "sha3-512-trunc128",
       capturedAt:   Date.now(),
     };

package/lib/compliance.js

@@ -93,14 +93,14 @@ var KNOWN_POSTURES = Object.freeze([
   "tcpa-10dlc",      // TCPA 10DLC carrier-shaped consent + FCC 1:1 disclosure
   "fda-21cfr11",     // FDA 21 CFR Part 11 — audit-trail + electronic signatures (general-purpose subset)
   "fda-annex-11",    // EU GMP Annex 11 — computerized systems (Part-11 equivalent)
-  "sec-1.05",        // SEC Cybersecurity Disclosure Item 1.05 — material-incident 8-K filing                                  // allow:raw-byte-literal — regulatory identifier, not bytes
+  "sec-1.05",        // SEC Cybersecurity Disclosure Item 1.05 — material-incident 8-K filing                                  // regulatory identifier, not bytes
   // ---- US state student-data privacy (F5.1 posture group) ----
   "ny-2-d",          // NY Education Law §2-d
   "il-soppa",        // Illinois Student Online Personal Protection Act
   "ca-sopipa",       // California Student Online Personal Information Protection Act
   "ct-pa-5-2",       // Connecticut Public Act 5-2
-  "tx-hb-4504",      // Texas HB 4504                                                                                            // allow:raw-byte-literal — statute identifier, not bytes
-  "va-sb-1376",      // Virginia SB 1376                                                                                         // allow:raw-byte-literal — statute identifier, not bytes
+  "tx-hb-4504",      // Texas HB 4504                                                                                            // statute identifier, not bytes
+  "va-sb-1376",      // Virginia SB 1376                                                                                         // statute identifier, not bytes
   // ---- EU government / cloud-region ----
   "staterramp",      // StateRAMP / TX-RAMP / AZ-RAMP / GovRAMP family (FedRAMP-Moderate cross-walks)
   "irap",            // Australia IRAP / Essential Eight / ISM
@@ -149,7 +149,7 @@ var KNOWN_POSTURES = Object.freeze([
   "il-hb3773",       // Illinois HB 3773 — IHRA AI amendment (effective 2026-01-01)
   "tx-traiga",       // Texas Responsible AI Governance Act HB 149 (effective 2026-01-01)
   "ut-aipa",         // Utah AI Disclosure Act (UAIPA + 2025 amendments; sunset 2027-07-01)
-  "nyc-ll144",       // NYC Local Law 144 — Automated Employment Decision Tools (in force)                                    // allow:raw-byte-literal — regulatory identifier, not bytes
+  "nyc-ll144",       // NYC Local Law 144 — Automated Employment Decision Tools (in force)                                    // regulatory identifier, not bytes
   "ca-tfaia",        // California SB 53 — Transparency in Frontier AI Act (effective 2026-01-01)
   "kr-ai-basic",     // South Korea AI Basic Act (effective 2026-01-22)
   "cn-ai-label",     // China Measures for Labelling of AI-Generated Content (effective 2025-09-01)
@@ -157,8 +157,8 @@ var KNOWN_POSTURES = Object.freeze([
   "iso-42001",       // ISO/IEC 42001:2023 — AI Management System
   "iso-23894",       // ISO/IEC 23894:2023 — AI Risk Management Guidance
   // ---- v0.8.81 expansion — content-credentials posture flags ----
-  "ca-sb942",        // California SB-942 (Cal. Bus. & Prof. Code §22757) gen-AI disclosure (effective 2026-08-02)             // allow:raw-byte-literal — regulatory identifier + date, not bytes
-  "ca-ab853",        // California AB-853 platform-side gen-AI detection (effective 2026-08-02)                                // allow:raw-byte-literal — regulatory identifier + date, not bytes
+  "ca-sb942",        // California SB-942 (Cal. Bus. & Prof. Code §22757) gen-AI disclosure (effective 2026-08-02)             // regulatory identifier + date, not bytes
+  "ca-ab853",        // California AB-853 platform-side gen-AI detection (effective 2026-08-02)                                // regulatory identifier + date, not bytes
   // ---- v0.8.81 expansion — substrate-to-posture cleanup ----
   "eaa",             // EU Accessibility Act / Directive (EU) 2019/882 (effective 2025-06-28)
   "wcag-2-2",        // W3C Web Content Accessibility Guidelines 2.2 (Oct 2023 Recommendation)
@@ -170,7 +170,7 @@ var KNOWN_POSTURES = Object.freeze([
   // US federal child / financial privacy
   "coppa",           // Children's Online Privacy Protection Act (15 U.S.C. §6501)
   "coppa-2025",      // COPPA 2025 Amendment (FTC final 2025-04-22; effective 2026-06-23 — biometric expansion + knowing-collection disclosure)
-  "glba-safeguards", // GLBA Safeguards Rule 2024 Amendment (16 CFR Part 314 — effective 2024-05-13)                            // allow:raw-byte-literal — CFR title number, not bytes
+  "glba-safeguards", // GLBA Safeguards Rule 2024 Amendment (16 CFR Part 314 — effective 2024-05-13)                            // CFR title number, not bytes
   // UK
   "uk-duaa",         // UK Data (Use and Access) Act 2025 (Royal Assent 2025-06-19; replaces DPDI Bill)
   // Latin America
@@ -199,7 +199,7 @@ var KNOWN_POSTURES = Object.freeze([
   "nist-pf-1.1",     // NIST Privacy Framework 1.1 (final 2025-04-14)
   // EU non-personal-data + adjacent
   "dsa",             // EU Digital Services Act (Regulation 2022/2065; fully applicable 2024-02-17)
-  "dga",             // EU Data Governance Act (Regulation 2022/868; applicable 2023-09-24)                                     // allow:raw-byte-literal — calendar day, not bytes
+  "dga",             // EU Data Governance Act (Regulation 2022/868; applicable 2023-09-24)                                     // calendar day, not bytes
   "eu-cer",          // EU Critical Entities Resilience Directive (2022/2557; transposition 2024-10-17)
   "eu-cyber-sol",    // EU Cyber Solidarity Act (Regulation 2025/38; effective 2025-02-04)
   "eidas-2",         // eIDAS 2 / EUDI Wallet (Regulation 2024/1183; rollout 2026-2027)
@@ -211,7 +211,7 @@ var KNOWN_POSTURES = Object.freeze([
   "iso-27017",       // ISO/IEC 27017 — Cloud-services security controls
   "iso-27018",       // ISO/IEC 27018 — PII protection in public-cloud processors
   "iso-27701",       // ISO/IEC 27701 — Privacy Information Management System
-  "nist-800-66-r2",  // NIST SP 800-66 Rev 2 — HIPAA Security Rule implementation guidance                                       // allow:raw-byte-literal — NIST publication number, not bytes
+  "nist-800-66-r2",  // NIST SP 800-66 Rev 2 — HIPAA Security Rule implementation guidance                                       // NIST publication number, not bytes
   "ehds",            // EU European Health Data Space (Regulation 2025/327; phased 2027-2029)
   "circia",          // US Cyber Incident Reporting for Critical Infrastructure Act (final rule pending)
   // ---- v0.9.6 expansion — exceptd framework-control-gap closure ----
@@ -224,16 +224,16 @@ var KNOWN_POSTURES = Object.freeze([
   // the named regime's evidence expectations.
   "nist-800-53",                 // NIST SP 800-53 Rev 5 — full Moderate / High baseline
   "nist-ai-rmf-1.0",             // NIST AI Risk Management Framework 1.0
-  "iso-42001-2023",              // ISO/IEC 42001:2023 — AI management system (alias for v0.8.81 iso-42001 entry, kept for posture-vocabulary stability)                                              // allow:raw-byte-literal — standard publication year, not bytes
+  "iso-42001-2023",              // ISO/IEC 42001:2023 — AI management system (alias for v0.8.81 iso-42001 entry, kept for posture-vocabulary stability)                                              // standard publication year, not bytes
   "iso-23894-2023",              // ISO/IEC 23894:2023 — AI risk management guidance (alias)
   "owasp-llm-top-10-2025",       // OWASP Top 10 for LLM Applications 2025
   "owasp-asvs-v5.0",             // OWASP Application Security Verification Standard v5.0
-  "nist-800-218-ssdf",           // NIST SP 800-218 Secure Software Development Framework v1.1                                                                                                            // allow:raw-byte-literal — NIST pub number, not bytes
-  "nist-800-82-r3",              // NIST SP 800-82 Rev 3 — OT security guide                                                       // allow:raw-byte-literal — NIST pub number, not bytes
+  "nist-800-218-ssdf",           // NIST SP 800-218 Secure Software Development Framework v1.1                                                                                                            // NIST pub number, not bytes
+  "nist-800-82-r3",              // NIST SP 800-82 Rev 3 — OT security guide                                                       // NIST pub number, not bytes
   "nist-800-63b-rev4",           // NIST SP 800-63B Rev 4 — Digital Identity (AAL/IAL/FAL)
   "iec-62443-3-3",               // IEC 62443-3-3 — IACS system security
   "fedramp-rev5-moderate",       // FedRAMP Rev 5 Moderate baseline
-  "hipaa-security-rule",         // HIPAA Security Rule 45 CFR §164.312 (technical safeguards)                                     // allow:raw-byte-literal — CFR section, not bytes
+  "hipaa-security-rule",         // HIPAA Security Rule 45 CFR §164.312 (technical safeguards)                                     // CFR section, not bytes
   "hitrust-csf-v11.4",           // HITRUST CSF v11.4
   "nerc-cip-007-6",              // NERC CIP-007-6 — BES Cyber System Security Management
   "psd2-rts-sca",                // EU PSD2 RTS on Strong Customer Authentication (Commission Delegated Regulation 2018/389)
@@ -244,10 +244,10 @@ var KNOWN_POSTURES = Object.freeze([
   "spdx-v3.0",                   // SPDX v3.0 SBOM — framework ships sbom.spdx.json (v0.9.6+)
   "owasp-wstg-v5",               // OWASP Web Security Testing Guide v5
   "ptes",                        // Penetration Testing Execution Standard
-  "nist-800-115",                // NIST SP 800-115 Technical Guide to Information Security Testing                               // allow:raw-byte-literal — NIST pub number, not bytes
+  "nist-800-115",                // NIST SP 800-115 Technical Guide to Information Security Testing                               // NIST pub number, not bytes
   "cwe-top-25-2024",             // CWE Top 25 Most Dangerous Software Weaknesses (2024)
   "cis-controls-v8",             // CIS Controls v8
-  "cmmc-2.0-level-2",            // CMMC 2.0 Level 2 (Advanced) — 110 NIST 800-171 Rev 2 controls                                                                                                          // allow:raw-byte-literal — NIST pub number / level, not bytes
+  "cmmc-2.0-level-2",            // CMMC 2.0 Level 2 (Advanced) — 110 NIST 800-171 Rev 2 controls                                                                                                          // NIST pub number / level, not bytes
   // ---- v0.9.57 — granular CMMC level distinction ----
   // CMMC 2.0 maturity levels carry distinct control-mapping
   // expectations: Level 1 = 15 controls (FAR 52.204-21), Level 2 =
@@ -255,29 +255,29 @@ var KNOWN_POSTURES = Object.freeze([
   // 800-172 enhanced controls. The umbrella "cmmc-2.0" posture
   // remains for back-compat with existing operators; the explicit
   // L1/L2/L3 postures are the recommended pin for new deployments.
-  "cmmc-2.0-level-1",            // CMMC 2.0 Level 1 (Foundational) — 15 FAR controls; FCI-only data        // allow:raw-byte-literal — regulatory identifier, not bytes
-  "cmmc-2.0-level-3",            // CMMC 2.0 Level 3 (Expert) — NIST 800-172 enhanced controls atop L2       // allow:raw-byte-literal — regulatory identifier, not bytes
+  "cmmc-2.0-level-1",            // CMMC 2.0 Level 1 (Foundational) — 15 FAR controls; FCI-only data        // regulatory identifier, not bytes
+  "cmmc-2.0-level-3",            // CMMC 2.0 Level 3 (Expert) — NIST 800-172 enhanced controls atop L2       // regulatory identifier, not bytes
   // ---- v0.12.1 — promote POSTURE_DEFAULTS-only entries into the
   // canonical KNOWN_POSTURES surface so operators can actually
   // `b.compliance.set(...)` them. Each entry had cascade
   // configuration wired but couldn't be pinned because set()'s
   // KNOWN_POSTURES check refused unknown strings.
-  "42-cfr-part-2",               // 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records (HHS final rule 2024-02-08)                                                                                  // allow:raw-byte-literal — CFR section identifier, not bytes
+  "42-cfr-part-2",               // 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records (HHS final rule 2024-02-08)                                                                                  // CFR section identifier, not bytes
   "hti-1",                       // ONC HTI-1 — Health IT certification + algorithm transparency (45 CFR Part 170; effective 2024-12-31)
-  "uscdi-v4",                    // USCDI v4 — US Core Data for Interoperability v4 (ONC; 2024-01)                                          // allow:raw-byte-literal — version identifier, not bytes
-  "irs-1075",                    // IRS Publication 1075 — Tax Information Security Guidelines (Rev. 11-2023)                              // allow:raw-byte-literal — publication number, not bytes
-  "nist-800-172-r3",             // NIST SP 800-172 Rev 3 — Enhanced Security Requirements for CUI                                          // allow:raw-byte-literal — publication number, not bytes
+  "uscdi-v4",                    // USCDI v4 — US Core Data for Interoperability v4 (ONC; 2024-01)                                          // version identifier, not bytes
+  "irs-1075",                    // IRS Publication 1075 — Tax Information Security Guidelines (Rev. 11-2023)                              // publication number, not bytes
+  "nist-800-172-r3",             // NIST SP 800-172 Rev 3 — Enhanced Security Requirements for CUI                                          // publication number, not bytes
   "tlp-2.0",                     // FIRST Traffic Light Protocol 2.0 — information-sharing classifications (TLP:CLEAR / GREEN / AMBER / AMBER+STRICT / RED)
   "soci-au",                     // Australia Security of Critical Infrastructure Act (SOCI 2018) + 2022 amendments
-  "ffiec-cat-2",                 // FFIEC Cybersecurity Assessment Tool 2.0 (federal financial institution exam)                            // allow:raw-byte-literal — tool version, not bytes
-  "cri-profile-v2.0",            // Cyber Risk Institute Profile v2.0 — financial-services framework mapping (NIST CSF cross-walk)         // allow:raw-byte-literal — version identifier, not bytes
+  "ffiec-cat-2",                 // FFIEC Cybersecurity Assessment Tool 2.0 (federal financial institution exam)                            // tool version, not bytes
+  "cri-profile-v2.0",            // Cyber Risk Institute Profile v2.0 — financial-services framework mapping (NIST CSF cross-walk)         // version identifier, not bytes
   "m-22-09",                     // OMB M-22-09 — Federal Zero Trust Architecture Strategy
   "m-22-18",                     // OMB M-22-18 — Enhancing Software Supply Chain Security (SSDF attestation)
-  "nist-800-53-r5-privacy",      // NIST SP 800-53 Rev 5 — Privacy Control Family overlay                                                   // allow:raw-byte-literal — publication number, not bytes
-  "nist-ai-600-1-genai",         // NIST AI 600-1 — Generative AI Profile (companion to AI RMF 1.0)                                          // allow:raw-byte-literal — publication number, not bytes
-  "nist-csf-2.0",                // NIST Cybersecurity Framework 2.0 (Feb 2024)                                                              // allow:raw-byte-literal — framework version, not bytes
-  "sb-53",                       // California SB-53 — Transparency in Frontier AI Act (effective 2025-09-29)                                // allow:raw-byte-literal — statute identifier, not bytes
-  "nyc-ll144-2024",              // NYC Local Law 144 — Automated Employment Decision Tool bias audits (2024 enforcement update)             // allow:raw-byte-literal — statute identifier, not bytes
+  "nist-800-53-r5-privacy",      // NIST SP 800-53 Rev 5 — Privacy Control Family overlay                                                   // publication number, not bytes
+  "nist-ai-600-1-genai",         // NIST AI 600-1 — Generative AI Profile (companion to AI RMF 1.0)                                          // publication number, not bytes
+  "nist-csf-2.0",                // NIST Cybersecurity Framework 2.0 (Feb 2024)                                                              // framework version, not bytes
+  "sb-53",                       // California SB-53 — Transparency in Frontier AI Act (effective 2025-09-29)                                // statute identifier, not bytes
+  "nyc-ll144-2024",              // NYC Local Law 144 — Automated Employment Decision Tool bias audits (2024 enforcement update)             // statute identifier, not bytes
 ]);
 
 // SUPPLY-34 — Artifact standards (SBOM / VEX format families) are NOT
@@ -965,7 +965,7 @@ var POSTURE_DEFAULTS = Object.freeze({
     requireVacuumAfterErase:  false,
   }),
   "gdpr": Object.freeze({
-    backupEncryptionRequired: false,           // GDPR Art. 32 says "appropriate" — not mandatory floor // allow:protocol-constant — regulatory article number in prose
+    backupEncryptionRequired: false,           // GDPR Art. 32 says "appropriate" — not mandatory floor
     auditChainSignedRequired: true,
     tlsMinVersion:            "TLSv1.3",
     // GDPR Art. 17 — "right to erasure" includes residual indexes; B-tree

package/lib/content-credentials.js

@@ -36,11 +36,11 @@ var audit = require("./audit");
 var { defineClass } = require("./framework-error");
 var ContentCredentialsError = defineClass("ContentCredentialsError", { alwaysPermanent: true });
 
-var STR_LEN_MAX = 256;                                                                        // allow:raw-byte-literal — string-length cap, not bytes
-var ID_LEN_MAX  = 128;                                                                        // allow:raw-byte-literal — string-length cap, not bytes
+var STR_LEN_MAX = 256;                                                                        // string-length cap, not bytes
+var ID_LEN_MAX  = 128;                                                                        // string-length cap, not bytes
 var SEMVER_RE = /^[0-9]+\.[0-9]+(?:\.[0-9]+)?(?:[-+][A-Za-z0-9.-]+)?$/;
 var ID_RE     = /^[a-zA-Z0-9._:/-]{1,128}$/;
-var SHA3_HEX_LEN = 128;                                                                       // allow:raw-byte-literal — SHA3-512 hex length, not bytes
+var SHA3_HEX_LEN = 128;                                                                       // SHA3-512 hex length, not bytes
 
 // Required fields per SB-942 §22757(a) — every AI-generated asset
 // must disclose provider + system + timestamp + contentId.
@@ -64,7 +64,7 @@ function _validateBuildOpts(opts) {
     throw ContentCredentialsError.factory("content-credentials/bad-system",
       "system must match " + ID_RE);
   }
-  if (opts.systemVersion.length > 64 || !SEMVER_RE.test(opts.systemVersion)) {                // allow:raw-byte-literal — semver length cap, not bytes
+  if (opts.systemVersion.length > 64 || !SEMVER_RE.test(opts.systemVersion)) {                // semver length cap, not bytes
     throw ContentCredentialsError.factory("content-credentials/bad-version",
       "systemVersion must be semver");
   }
@@ -347,35 +347,35 @@ function verify(envelope, publicKeyPem, opts) {
 // libraries (jose-py / c2pa-rs / etc.).
 
 // COSE algorithm registry codepoints (RFC 9053 §2.1 + draft-ietf-cose-* for PQ).
-// allow:raw-byte-literal — IANA registry IDs, not byte counts.
+// IANA registry IDs, not byte counts.
 var COSE_ALGS = {
-  "ed25519":    -8,    // allow:raw-byte-literal — COSE alg id
-  "es256":      -7,    // allow:raw-byte-literal — COSE alg id
-  "es384":      -35,   // allow:raw-byte-literal — COSE alg id
-  "es512":      -36,   // allow:raw-byte-literal — COSE alg id
-  "ml-dsa-44":  -48,   // allow:raw-byte-literal — COSE alg id (draft)
-  "ml-dsa-65":  -49,   // allow:raw-byte-literal — COSE alg id (draft)
-  "ml-dsa-87":  -50,   // allow:raw-byte-literal — COSE alg id (draft)
-  "slh-dsa-sha2-128s":   -51,   // allow:raw-byte-literal — COSE alg id (draft)
-  "slh-dsa-shake-256f":  -56,   // allow:raw-byte-literal — COSE alg id (draft)
+  "ed25519":    -8,    // COSE alg id
+  "es256":      -7,    // COSE alg id
+  "es384":      -35,   // COSE alg id
+  "es512":      -36,   // COSE alg id
+  "ml-dsa-44":  -48,   // COSE alg id (draft)
+  "ml-dsa-65":  -49,   // COSE alg id (draft)
+  "ml-dsa-87":  -50,   // COSE alg id (draft)
+  "slh-dsa-sha2-128s":   -51,   // COSE alg id (draft)
+  "slh-dsa-shake-256f":  -56,   // COSE alg id (draft)
 };
 
 // CBOR encoder (RFC 8949 §3). The integer thresholds 24/256/65536/4294967296
 // are CBOR-spec length-encoding boundaries — not byte counts.
-// allow:raw-byte-literal — CBOR encoding thresholds, not byte counts.
+// CBOR encoding thresholds, not byte counts.
 function _cborUint(n) {
-  if (n < 24)         return Buffer.from([n]);                                                                                                // allow:raw-byte-literal — CBOR threshold
-  if (n < 256)        return Buffer.from([0x18, n]);                                                                                          // allow:raw-byte-literal — CBOR threshold
-  if (n < 65536)      return Buffer.from([0x19, (n >> 8) & 0xFF, n & 0xFF]);                                                                  // allow:raw-byte-literal — CBOR threshold
-  if (n < 4294967296) return Buffer.from([0x1A, (n >> 24) & 0xFF, (n >> 16) & 0xFF, (n >> 8) & 0xFF, n & 0xFF]);                              // allow:raw-byte-literal — CBOR threshold
+  if (n < 24)         return Buffer.from([n]);                                                                                                // CBOR threshold
+  if (n < 256)        return Buffer.from([0x18, n]);                                                                                          // CBOR threshold
+  if (n < 65536)      return Buffer.from([0x19, (n >> 8) & 0xFF, n & 0xFF]);                                                                  // CBOR threshold
+  if (n < 4294967296) return Buffer.from([0x1A, (n >> 24) & 0xFF, (n >> 16) & 0xFF, (n >> 8) & 0xFF, n & 0xFF]);                              // CBOR threshold
   throw ContentCredentialsError.factory("content-credentials/cbor-overflow", "cbor uint too large: " + n);
 }
 
 function _cborNint(n) {
   var v = -1 - n;
-  if (v < 24)    return Buffer.from([0x20 | v]);                                                                                              // allow:raw-byte-literal — CBOR threshold
-  if (v < 256)   return Buffer.from([0x38, v]);                                                                                               // allow:raw-byte-literal — CBOR threshold
-  if (v < 65536) return Buffer.from([0x39, (v >> 8) & 0xFF, v & 0xFF]);                                                                       // allow:raw-byte-literal — CBOR threshold
+  if (v < 24)    return Buffer.from([0x20 | v]);                                                                                              // CBOR threshold
+  if (v < 256)   return Buffer.from([0x38, v]);                                                                                               // CBOR threshold
+  if (v < 65536) return Buffer.from([0x39, (v >> 8) & 0xFF, v & 0xFF]);                                                                       // CBOR threshold
   return Buffer.from([0x3A, (v >> 24) & 0xFF, (v >> 16) & 0xFF, (v >> 8) & 0xFF, v & 0xFF]);
 }
 
@@ -386,30 +386,30 @@ function _cborInt(n) {
 function _cborBytes(buf) {
   var n = buf.length;
   var head;
-  if (n < 24)         head = Buffer.from([0x40 | n]);                                                                                          // allow:raw-byte-literal — CBOR threshold
-  else if (n < 256)   head = Buffer.from([0x58, n]);                                                                                           // allow:raw-byte-literal — CBOR threshold
-  else if (n < 65536) head = Buffer.from([0x59, (n >> 8) & 0xFF, n & 0xFF]);                                                                   // allow:raw-byte-literal — CBOR threshold
+  if (n < 24)         head = Buffer.from([0x40 | n]);                                                                                          // CBOR threshold
+  else if (n < 256)   head = Buffer.from([0x58, n]);                                                                                           // CBOR threshold
+  else if (n < 65536) head = Buffer.from([0x59, (n >> 8) & 0xFF, n & 0xFF]);                                                                   // CBOR threshold
   else                head = Buffer.from([0x5A, (n >>> 24) & 0xFF, (n >> 16) & 0xFF, (n >> 8) & 0xFF, n & 0xFF]);
   return Buffer.concat([head, buf]);
 }
 
 function _cborArrayHeader(n) {
-  if (n < 24)    return Buffer.from([0x80 | n]);                                                                                               // allow:raw-byte-literal — CBOR threshold
-  if (n < 256)   return Buffer.from([0x98, n]);                                                                                                // allow:raw-byte-literal — CBOR threshold
-  if (n < 65536) return Buffer.from([0x99, (n >> 8) & 0xFF, n & 0xFF]);                                                                        // allow:raw-byte-literal — CBOR threshold
+  if (n < 24)    return Buffer.from([0x80 | n]);                                                                                               // CBOR threshold
+  if (n < 256)   return Buffer.from([0x98, n]);                                                                                                // CBOR threshold
+  if (n < 65536) return Buffer.from([0x99, (n >> 8) & 0xFF, n & 0xFF]);                                                                        // CBOR threshold
   throw ContentCredentialsError.factory("content-credentials/cbor-overflow", "cbor array too large: " + n);
 }
 
 function _cborMapHeader(n) {
-  if (n < 24)    return Buffer.from([0xA0 | n]);                                                                                               // allow:raw-byte-literal — CBOR threshold
-  if (n < 256)   return Buffer.from([0xB8, n]);                                                                                                // allow:raw-byte-literal — CBOR threshold
+  if (n < 24)    return Buffer.from([0xA0 | n]);                                                                                               // CBOR threshold
+  if (n < 256)   return Buffer.from([0xB8, n]);                                                                                                // CBOR threshold
   throw ContentCredentialsError.factory("content-credentials/cbor-overflow", "cbor map too large: " + n);
 }
 
 function _cborTag(tag) {
-  if (tag < 24)         return Buffer.from([0xC0 | tag]);                                                                                      // allow:raw-byte-literal — CBOR threshold
-  if (tag < 256)        return Buffer.from([0xD8, tag]);                                                                                       // allow:raw-byte-literal — CBOR threshold
-  if (tag < 65536)      return Buffer.from([0xD9, (tag >> 8) & 0xFF, tag & 0xFF]);                                                             // allow:raw-byte-literal — CBOR threshold
+  if (tag < 24)         return Buffer.from([0xC0 | tag]);                                                                                      // CBOR threshold
+  if (tag < 256)        return Buffer.from([0xD8, tag]);                                                                                       // CBOR threshold
+  if (tag < 65536)      return Buffer.from([0xD9, (tag >> 8) & 0xFF, tag & 0xFF]);                                                             // CBOR threshold
   return Buffer.from([0xDA, (tag >> 24) & 0xFF, (tag >> 16) & 0xFF, (tag >> 8) & 0xFF, tag & 0xFF]);
 }
 
@@ -492,7 +492,7 @@ function signCose(manifest, opts) {
     }
     unprotectedHdr = Buffer.concat([
       _cborMapHeader(1),
-      _cborInt(33),             // allow:raw-byte-literal allow:raw-time-literal — RFC 9360 x5chain header label, not a duration
+      _cborInt(33),             // allow:raw-time-literal — RFC 9360 x5chain header label, not a duration
       chainArray,
     ]);
   } else {
@@ -514,7 +514,7 @@ function signCose(manifest, opts) {
   // First entry is the text string "Signature1" — major-type 3
   var sigText = Buffer.from("Signature1", "utf8");
   var sigTextBstr;
-  if (sigText.length < 24)      sigTextBstr = Buffer.concat([Buffer.from([0x60 | sigText.length]), sigText]);                                 // allow:raw-byte-literal — CBOR text-string threshold
+  if (sigText.length < 24)      sigTextBstr = Buffer.concat([Buffer.from([0x60 | sigText.length]), sigText]);                                 // CBOR text-string threshold
   else                          sigTextBstr = Buffer.concat([Buffer.from([0x78, sigText.length]), sigText]);
   sigStructureBufs[1] = sigTextBstr;
   var toBeSigned = Buffer.concat(sigStructureBufs);
@@ -612,7 +612,7 @@ function cacImplicitLabel(opts) {
       "(统一社会信用代码 per GB 32100-2015 / GB 45438-2025)");
   }
   if (typeof opts.contentId !== "string" || opts.contentId.length === 0 ||
-      opts.contentId.length > 128) {                                                             // allow:raw-byte-literal — contentId char cap, not bytes
+      opts.contentId.length > 128) {                                                             // contentId char cap, not bytes
     throw new ContentCredentialsError("cac-implicit-label/bad-content-id",
       "cacImplicitLabel: contentId must be 1-128 chars");
   }

package/lib/cookies.js

@@ -485,7 +485,7 @@ function parseSafe(cookieHeader, opts) {
   }
   for (var hi = 0; hi < cookieHeader.length; hi += 1) {
     var ch = cookieHeader.charCodeAt(hi);
-    if (ch === 0x0D || ch === 0x0A || ch === 0x00) {                             // allow:raw-byte-literal — CR / LF / NUL forbidden in cookie header
+    if (ch === 0x0D || ch === 0x0A || ch === 0x00) {                             // CR / LF / NUL forbidden in cookie header
       issues.push({
         kind: "header-control-byte", severity: "high",
         snippet: "Cookie header contains CR / LF / NUL — proxy-side " +