@blamejs/core 0.14.0 → 0.14.2

package/lib/guard-graphql.js

@@ -113,9 +113,9 @@ var PROFILES = Object.freeze({
     aliasBombPolicy:            "reject",
     depthPolicy:                "reject",
     variableShapePolicy:        "reject",
-    maxDepth:                   8,                                               // allow:raw-byte-literal — selection-set depth ceiling
-    maxAliasesPerSelection:     8,                                               // allow:raw-byte-literal — alias breadth ceiling
-    maxBatchSize:               1,                                               // allow:raw-byte-literal — strict refuses batch
+    maxDepth:                   8,                                               // selection-set depth ceiling
+    maxAliasesPerSelection:     8,                                               // alias breadth ceiling
+    maxBatchSize:               1,                                               // strict refuses batch
     maxQueryBytes:              C.BYTES.kib(8),
     maxVariableBytes:           C.BYTES.kib(8),
     maxBytes:                   C.BYTES.kib(32),
@@ -133,9 +133,9 @@ var PROFILES = Object.freeze({
     aliasBombPolicy:            "audit",
     depthPolicy:                "audit",
     variableShapePolicy:        "audit",
-    maxDepth:                   12,                                              // allow:raw-byte-literal — selection-set depth ceiling
-    maxAliasesPerSelection:     16,                                              // allow:raw-byte-literal — alias breadth ceiling
-    maxBatchSize:               10,                                              // allow:raw-byte-literal — batch size ceiling
+    maxDepth:                   12,                                              // selection-set depth ceiling
+    maxAliasesPerSelection:     16,                                              // alias breadth ceiling
+    maxBatchSize:               10,                                              // batch size ceiling
     maxQueryBytes:              C.BYTES.kib(16),
     maxVariableBytes:           C.BYTES.kib(16),
     maxBytes:                   C.BYTES.kib(64),
@@ -153,9 +153,9 @@ var PROFILES = Object.freeze({
     aliasBombPolicy:            "audit",
     depthPolicy:                "audit",
     variableShapePolicy:        "audit",
-    maxDepth:                   24,                                              // allow:raw-byte-literal — selection-set depth ceiling
-    maxAliasesPerSelection:     32,                                              // allow:raw-byte-literal — alias breadth ceiling
-    maxBatchSize:               50,                                              // allow:raw-byte-literal — batch size ceiling
+    maxDepth:                   24,                                              // selection-set depth ceiling
+    maxAliasesPerSelection:     32,                                              // alias breadth ceiling
+    maxBatchSize:               50,                                              // batch size ceiling
     maxQueryBytes:              C.BYTES.kib(64),
     maxVariableBytes:           C.BYTES.kib(64),
     maxBytes:                   C.BYTES.kib(256),

package/lib/guard-html-wcag-tagwalk.js

@@ -31,7 +31,7 @@ function lineColAt(html, offset) {
   var line = 1;
   var lastNl = -1;
   for (var i = 0; i < offset; i++) {
-    if (html.charCodeAt(i) === 10) { line += 1; lastNl = i; }                      // allow:raw-byte-literal — ASCII LF
+    if (html.charCodeAt(i) === 10) { line += 1; lastNl = i; }                      // ASCII LF
   }
   return { line: line, column: offset - lastNl };
 }

package/lib/guard-html-wcag.js

@@ -181,7 +181,7 @@ function _checkButtonText(html, tagOpenEnd, attrs, offset, report, opts) {
 function _checkHeadingOrder(html, attrs, tagName, offset, report, opts, ctx) {
   if (!/^h[1-6]$/.test(tagName)) return;
   if (opts.ignore.indexOf("1.3.1") !== -1) return;
-  var level = parseInt(tagName.charAt(1), 10);                                     // allow:raw-byte-literal — base-10 parse radix
+  var level = parseInt(tagName.charAt(1), 10);                                     // base-10 parse radix
   if (ctx.headingLevels.length === 0) {
     if (level !== 1) {
       var pos = _lineColAt(html, offset);
@@ -447,9 +447,9 @@ function audit(html, opts) {
   }
 
   // Heuristic score: 1 - weighted-violations / heuristic-max
-  var weighted = report.summary.error * 3 + report.summary.warning * 1.5 +        // allow:raw-byte-literal — severity weights for heuristic score
-                 report.summary.info * 0.5;                                        // allow:raw-byte-literal — severity weights for heuristic score
-  var maxFor = Math.max(50, weighted * 2);                                         // allow:raw-byte-literal — heuristic-score floor
+  var weighted = report.summary.error * 3 + report.summary.warning * 1.5 +        // severity weights for heuristic score
+                 report.summary.info * 0.5;                                        // severity weights for heuristic score
+  var maxFor = Math.max(50, weighted * 2);                                         // heuristic-score floor
   report.score = Math.max(0, 1 - weighted / maxFor);
 
   try { observability().safeEvent("guard-html.wcag.audited", 1, {

package/lib/guard-html.js

@@ -105,7 +105,7 @@ var observability = lazyRequire(function () { return require("./observability");
 void observability;
 
 var _err = GuardHtmlError.factory;
-var HEX_RADIX = 16;                                                 // allow:raw-byte-literal — base-16 radix, not byte size
+var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 // ---- Codepoint catalog (shared via lib/codepoint-class) ----
 
@@ -242,8 +242,8 @@ var PROFILES = Object.freeze({
     mxssHintPolicy:     "reject",
     maxBytes:           C.BYTES.mib(2),
     maxAttrValueBytes:  C.BYTES.kib(8),
-    maxTagDepth:        128,                                          // allow:raw-byte-literal — tag-nesting depth count, not bytes
-    maxAttrsPerTag:     64,                                           // allow:raw-byte-literal — attribute count per tag, not bytes
+    maxTagDepth:        128,                                          // tag-nesting depth count, not bytes
+    maxAttrsPerTag:     64,                                           // attribute count per tag, not bytes
   },
   "balanced": {
     allowedTags:        BALANCED_ALLOWED_TAGS,
@@ -264,8 +264,8 @@ var PROFILES = Object.freeze({
     mxssHintPolicy:     "audit",
     maxBytes:           C.BYTES.mib(8),
     maxAttrValueBytes:  C.BYTES.kib(32),
-    maxTagDepth:        256,                                          // allow:raw-byte-literal — tag-nesting depth count, not bytes
-    maxAttrsPerTag:     128,                                          // allow:raw-byte-literal — attribute count per tag, not bytes
+    maxTagDepth:        256,                                          // tag-nesting depth count, not bytes
+    maxAttrsPerTag:     128,                                          // attribute count per tag, not bytes
   },
   "permissive": {
     allowedTags:        PERMISSIVE_ALLOWED_TAGS,
@@ -286,8 +286,8 @@ var PROFILES = Object.freeze({
     mxssHintPolicy:     "audit",
     maxBytes:           C.BYTES.mib(32),
     maxAttrValueBytes:  C.BYTES.kib(64),
-    maxTagDepth:        512,                                          // allow:raw-byte-literal — tag-nesting depth count, not bytes
-    maxAttrsPerTag:     256,                                          // allow:raw-byte-literal — attribute count per tag, not bytes
+    maxTagDepth:        512,                                          // tag-nesting depth count, not bytes
+    maxAttrsPerTag:     256,                                          // attribute count per tag, not bytes
   },
 });
 

package/lib/guard-idempotency-key.js

@@ -36,9 +36,9 @@ var GuardIdempotencyKeyError = defineClass("GuardIdempotencyKeyError", { alwaysP
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxBytes: 256,  asciiOnly: true  },                                                   // allow:raw-byte-literal
-  balanced:   { maxBytes: 512,  asciiOnly: true  },                                                   // allow:raw-byte-literal
-  permissive: { maxBytes: 2048, asciiOnly: false },                                                   // allow:raw-byte-literal
+  strict:     { maxBytes: 256,  asciiOnly: true  },
+  balanced:   { maxBytes: 512,  asciiOnly: true  },
+  permissive: { maxBytes: 2048, asciiOnly: false },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -94,15 +94,15 @@ function validate(value, opts) {
   // C0 / DEL / slash refusal.
   for (var i = 0; i < value.length; i += 1) {
     var c = value.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                     // allow:raw-byte-literal — C0 + DEL refusal
+    if (c < 0x20 || c === 0x7F) {                                                                     // C0 + DEL refusal
       throw new GuardIdempotencyKeyError("idempotency-key/control-char",
         "guardIdempotencyKey.validate: control char 0x" + c.toString(16) + " at offset " + i);
     }
-    if (c === 0x2F || c === 0x5C) {                                                                   // allow:raw-byte-literal — / and \ refusal
+    if (c === 0x2F || c === 0x5C) {                                                                   // / and \ refusal
       throw new GuardIdempotencyKeyError("idempotency-key/slash",
         "guardIdempotencyKey.validate: key contains '/' or '\\' at offset " + i);
     }
-    if (profile.asciiOnly && c > 0x7F) {                                                              // allow:raw-byte-literal — ASCII-only cap
+    if (profile.asciiOnly && c > 0x7F) {                                                              // ASCII-only cap
       throw new GuardIdempotencyKeyError("idempotency-key/non-ascii",
         "guardIdempotencyKey.validate: non-ASCII codepoint at offset " + i +
         " (use profile='permissive' to allow)");

package/lib/guard-image.js

@@ -82,7 +82,7 @@ var MAGIC_BYTES = Object.freeze([
   { mime: "image/gif", bytes: [0x47, 0x49, 0x46, 0x38, 0x37, 0x61] },
   { mime: "image/gif", bytes: [0x47, 0x49, 0x46, 0x38, 0x39, 0x61] },
   // WebP: RIFF????WEBP — check at offsets 0..3 + 8..11.
-  { mime: "image/webp", bytes: [0x52, 0x49, 0x46, 0x46], tail: [0x57, 0x45, 0x42, 0x50], tailOffset: 8 }, // allow:raw-byte-literal — RIFF + WEBP magic-byte tail offset
+  { mime: "image/webp", bytes: [0x52, 0x49, 0x46, 0x46], tail: [0x57, 0x45, 0x42, 0x50], tailOffset: 8 }, // RIFF + WEBP magic-byte tail offset
   // BMP: 42 4D
   { mime: "image/bmp", bytes: [0x42, 0x4D] },
   // ICO: 00 00 01 00
@@ -124,7 +124,7 @@ var PROFILES = Object.freeze({
     framesPolicy:              "audit",
     maxWidth:                  C.BYTES.bytes(16384),
     maxHeight:                 C.BYTES.bytes(16384),
-    maxFrames:                 200,                                              // allow:raw-byte-literal — animation frame ceiling
+    maxFrames:                 200,                                              // animation frame ceiling
     maxBytes:                  C.BYTES.mib(64),
     maxRuntimeMs:              C.TIME.seconds(5),
   },
@@ -137,7 +137,7 @@ var PROFILES = Object.freeze({
     framesPolicy:              "audit",
     maxWidth:                  C.BYTES.bytes(65536),
     maxHeight:                 C.BYTES.bytes(65536),
-    maxFrames:                 1000,                                             // allow:raw-byte-literal — animation frame ceiling
+    maxFrames:                 1000,                                             // animation frame ceiling
     maxBytes:                  C.BYTES.mib(256),
     maxRuntimeMs:              C.TIME.seconds(5),
   },
@@ -562,7 +562,7 @@ module.exports = {
     benignMetadata: {
       bytes: Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
       declaredMime: "image/png",
-      width: 100, height: 100, frames: 1,                                        // allow:raw-byte-literal — pixel + frame count fixture
+      width: 100, height: 100, frames: 1,                                        // pixel + frame count fixture
     },
     hostileMetadata: {
       bytes: Buffer.from([0xFF, 0xD8, 0xFF]),

package/lib/guard-imap-command.js

@@ -89,31 +89,31 @@ var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
   strict: {
-    maxLineBytes:          8192,                                                                      // allow:raw-byte-literal — 8 KiB command-line cap
-    maxLiteralBytes:       67108864,                                                                  // allow:raw-byte-literal — 64 MiB per-literal cap
-    maxMailboxBytes:       1024,                                                                      // allow:raw-byte-literal — RFC 9051 §5.1 mailbox cap
-    maxSequenceSetItems:   10000,                                                                     // allow:raw-byte-literal — FETCH/STORE sequence-set element cap
-    maxSearchDepth:        32,                                                                        // allow:raw-byte-literal — SEARCH AND/OR/NOT nesting cap
+    maxLineBytes:          8192,                                                                      // 8 KiB command-line cap
+    maxLiteralBytes:       67108864,                                                                  // 64 MiB per-literal cap
+    maxMailboxBytes:       1024,                                                                      // RFC 9051 §5.1 mailbox cap
+    maxSequenceSetItems:   10000,                                                                     // FETCH/STORE sequence-set element cap
+    maxSearchDepth:        32,                                                                        // SEARCH AND/OR/NOT nesting cap
     allowBareLf:           false,
     allowLiteralPlus:      false,                                                                     // LITERAL+ (RFC 7888) only post-AUTH; the listener flips this
     allowLegacyMUtf7:      false,                                                                     // RFC 3501 §5.1.3 modified-UTF7 mailbox names — legacy MUA escape hatch
   },
   balanced: {
-    maxLineBytes:          16384,                                                                     // allow:raw-byte-literal — 16 KiB command-line cap
-    maxLiteralBytes:       134217728,                                                                 // allow:raw-byte-literal — 128 MiB per-literal cap
-    maxMailboxBytes:       2048,                                                                      // allow:raw-byte-literal — balanced mailbox cap
-    maxSequenceSetItems:   50000,                                                                     // allow:raw-byte-literal — balanced sequence-set cap
-    maxSearchDepth:        48,                                                                        // allow:raw-byte-literal — balanced SEARCH-depth cap
+    maxLineBytes:          16384,                                                                     // 16 KiB command-line cap
+    maxLiteralBytes:       134217728,                                                                 // 128 MiB per-literal cap
+    maxMailboxBytes:       2048,                                                                      // balanced mailbox cap
+    maxSequenceSetItems:   50000,                                                                     // balanced sequence-set cap
+    maxSearchDepth:        48,                                                                        // balanced SEARCH-depth cap
     allowBareLf:           false,
     allowLiteralPlus:      true,
     allowLegacyMUtf7:      true,
   },
   permissive: {
-    maxLineBytes:          65536,                                                                     // allow:raw-byte-literal — 64 KiB command-line cap (legacy peers)
-    maxLiteralBytes:       268435456,                                                                 // allow:raw-byte-literal — 256 MiB per-literal cap
-    maxMailboxBytes:       4096,                                                                      // allow:raw-byte-literal — permissive mailbox cap
-    maxSequenceSetItems:   100000,                                                                    // allow:raw-byte-literal — permissive sequence-set cap
-    maxSearchDepth:        64,                                                                        // allow:raw-byte-literal — permissive SEARCH-depth cap
+    maxLineBytes:          65536,                                                                     // 64 KiB command-line cap (legacy peers)
+    maxLiteralBytes:       268435456,                                                                 // 256 MiB per-literal cap
+    maxMailboxBytes:       4096,                                                                      // permissive mailbox cap
+    maxSequenceSetItems:   100000,                                                                    // permissive sequence-set cap
+    maxSearchDepth:        64,                                                                        // permissive SEARCH-depth cap
     allowBareLf:           true,
     allowLiteralPlus:      true,
     allowLegacyMUtf7:      true,
@@ -224,10 +224,10 @@ function validate(line, opts) {
   // shape.
   for (var i = 0; i < line.length; i += 1) {
     var c = line.charCodeAt(i);
-    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                       // allow:raw-byte-literal — control-byte refusal
+    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                       // control-byte refusal
       if (c === 0x0A && caps.allowBareLf) continue;
       throw new GuardImapCommandError("guard-imap-command/bad-byte",
-        "guardImapCommand.validate: control byte 0x" + c.toString(16) + " at offset " + i);          // allow:raw-byte-literal — hex format literal in error message
+        "guardImapCommand.validate: control byte 0x" + c.toString(16) + " at offset " + i);          // hex format literal in error message
     }
   }
 

package/lib/guard-jmap.js

@@ -66,28 +66,28 @@ var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
   strict: {
-    maxCallsInRequest:     32,                                                                       // allow:raw-byte-literal — RFC 8620 §3.6 default
-    maxObjectsInGet:       500,                                                                      // allow:raw-byte-literal — RFC 8620 §3.6 default
-    maxObjectsInSet:       500,                                                                      // allow:raw-byte-literal — RFC 8620 §3.6 default
-    maxSizeRequest:        10485760,                                                                 // allow:raw-byte-literal — 10 MiB request body cap
+    maxCallsInRequest:     32,                                                                       // RFC 8620 §3.6 default
+    maxObjectsInGet:       500,                                                                      // RFC 8620 §3.6 default
+    maxObjectsInSet:       500,                                                                      // RFC 8620 §3.6 default
+    maxSizeRequest:        10485760,                                                                 // 10 MiB request body cap
     maxBackRefDepth:       8,
-    maxUsingCapabilities:  32,                                                                       // allow:raw-byte-literal — `using` array length cap
+    maxUsingCapabilities:  32,                                                                       // `using` array length cap
   },
   balanced: {
-    maxCallsInRequest:     128,                                                                      // allow:raw-byte-literal — balanced call cap
-    maxObjectsInGet:       1000,                                                                     // allow:raw-byte-literal — balanced object cap
-    maxObjectsInSet:       1000,                                                                     // allow:raw-byte-literal — balanced object cap
-    maxSizeRequest:        52428800,                                                                 // allow:raw-byte-literal — 50 MiB balanced
-    maxBackRefDepth:       16,                                                                       // allow:raw-byte-literal — balanced depth
-    maxUsingCapabilities:  64,                                                                       // allow:raw-byte-literal — balanced using cap
+    maxCallsInRequest:     128,                                                                      // balanced call cap
+    maxObjectsInGet:       1000,                                                                     // balanced object cap
+    maxObjectsInSet:       1000,                                                                     // balanced object cap
+    maxSizeRequest:        52428800,                                                                 // 50 MiB balanced
+    maxBackRefDepth:       16,                                                                       // balanced depth
+    maxUsingCapabilities:  64,                                                                       // balanced using cap
   },
   permissive: {
-    maxCallsInRequest:     512,                                                                      // allow:raw-byte-literal — permissive call cap
-    maxObjectsInGet:       5000,                                                                     // allow:raw-byte-literal — permissive object cap
-    maxObjectsInSet:       5000,                                                                     // allow:raw-byte-literal — permissive object cap
-    maxSizeRequest:        104857600,                                                                // allow:raw-byte-literal — 100 MiB permissive
-    maxBackRefDepth:       32,                                                                       // allow:raw-byte-literal — permissive depth
-    maxUsingCapabilities:  128,                                                                      // allow:raw-byte-literal — permissive using cap
+    maxCallsInRequest:     512,                                                                      // permissive call cap
+    maxObjectsInGet:       5000,                                                                     // permissive object cap
+    maxObjectsInSet:       5000,                                                                     // permissive object cap
+    maxSizeRequest:        104857600,                                                                // 100 MiB permissive
+    maxBackRefDepth:       32,                                                                       // permissive depth
+    maxUsingCapabilities:  128,                                                                      // permissive using cap
   },
 });
 
@@ -239,7 +239,7 @@ function validate(rawBody, opts) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:invalidArguments",
         "guardJmap.validate: methodCalls[" + ci + "][2] (clientId) must be a string");
     }
-    if (call[2].length === 0 || call[2].length > 256) {                                              // allow:raw-byte-literal — clientId length cap
+    if (call[2].length === 0 || call[2].length > 256) {                                              // clientId length cap
       throw new GuardJmapError("urn:ietf:params:jmap:error:invalidArguments",
         "guardJmap.validate: methodCalls[" + ci + "][2] (clientId) length must be 1..256");
     }
@@ -283,11 +283,11 @@ function _countBackRefs(node, depth, maxDepth) {
     return maxA;
   }
   var keys = Object.keys(node);
-  if (keys.length > 1000) return -1;                                                                  // allow:raw-byte-literal — per-object key cap
+  if (keys.length > 1000) return -1;                                                                  // per-object key cap
   var maxO = depth;
   for (var k = 0; k < keys.length; k += 1) {
     var key = keys[k];
-    var inc = (key === "resultOf" || key.charCodeAt(0) === 0x23) ? 1 : 0;                            // allow:raw-byte-literal — `#` (0x23) is the JMAP back-ref prefix
+    var inc = (key === "resultOf" || key.charCodeAt(0) === 0x23) ? 1 : 0;                            // `#` (0x23) is the JMAP back-ref prefix
     var d2 = _countBackRefs(node[key], depth + inc, maxDepth);
     if (d2 === -1) return -1;
     if (d2 > maxO) maxO = d2;

package/lib/guard-json.js

@@ -140,11 +140,11 @@ var PROFILES = Object.freeze({
     requireTopLevelKeyAllowlist: false,     // operator opts in via topLevelKeyAllowlist
     topLevelKeyAllowlist:   null,
     maxBytes:               C.BYTES.mib(2),
-    maxDepth:               8,                                                   // allow:raw-byte-literal — recursion depth, not byte size
-    maxKeysPerObject:       256,                                                 // allow:raw-byte-literal — key count cap, not byte size
-    maxArrayLength:         1024,                                                // allow:raw-byte-literal — array length cap, not byte size
+    maxDepth:               8,                                                   // recursion depth, not byte size
+    maxKeysPerObject:       256,                                                 // key count cap, not byte size
+    maxArrayLength:         1024,                                                // array length cap, not byte size
     maxStringLength:        C.BYTES.kib(8),
-    maxTotalNodes:          0x2000,                                              // allow:raw-byte-literal — node count cap, not byte size
+    maxTotalNodes:          0x2000,                                              // node count cap, not byte size
   },
   "balanced": {
     pollutionPolicy:        "strip",        // remove __proto__ keys silently
@@ -162,11 +162,11 @@ var PROFILES = Object.freeze({
     requireTopLevelKeyAllowlist: false,
     topLevelKeyAllowlist:   null,
     maxBytes:               C.BYTES.mib(8),
-    maxDepth:               32,                                                  // allow:raw-byte-literal — recursion depth, not byte size
-    maxKeysPerObject:       4096,                                                // allow:raw-byte-literal — key count cap, not byte size
-    maxArrayLength:         65536,                                               // allow:raw-byte-literal — array length cap, not byte size
+    maxDepth:               32,                                                  // recursion depth, not byte size
+    maxKeysPerObject:       4096,                                                // key count cap, not byte size
+    maxArrayLength:         65536,                                               // array length cap, not byte size
     maxStringLength:        C.BYTES.kib(64),
-    maxTotalNodes:          0x10000,                                             // allow:raw-byte-literal — node count cap, not byte size
+    maxTotalNodes:          0x10000,                                             // node count cap, not byte size
   },
   "permissive": {
     pollutionPolicy:        "audit",
@@ -184,11 +184,11 @@ var PROFILES = Object.freeze({
     requireTopLevelKeyAllowlist: false,
     topLevelKeyAllowlist:   null,
     maxBytes:               C.BYTES.mib(64),
-    maxDepth:               64,                                                  // allow:raw-byte-literal — recursion depth, not byte size
-    maxKeysPerObject:       65536,                                               // allow:raw-byte-literal — key count cap, not byte size
-    maxArrayLength:         1048576,                                             // allow:raw-byte-literal — array length cap, not byte size
+    maxDepth:               64,                                                  // recursion depth, not byte size
+    maxKeysPerObject:       65536,                                               // key count cap, not byte size
+    maxArrayLength:         1048576,                                             // array length cap, not byte size
     maxStringLength:        C.BYTES.kib(256),
-    maxTotalNodes:          0x40000,                                             // allow:raw-byte-literal — node count cap, not byte size
+    maxTotalNodes:          0x40000,                                             // node count cap, not byte size
   },
 });
 

package/lib/guard-jsonpath.js

@@ -90,7 +90,7 @@ var PROFILES = Object.freeze({
     dynamicHintPolicy:         "reject",
     bracketNestingPolicy:      "reject",
     recursiveDescentPolicy:    "reject",
-    maxRecursiveDescents:      2,                                                // allow:raw-byte-literal — recursion depth ceiling
+    maxRecursiveDescents:      2,                                                // recursion depth ceiling
     maxPatternBytes:           C.BYTES.kib(1),
     maxBytes:                  C.BYTES.kib(1),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -105,7 +105,7 @@ var PROFILES = Object.freeze({
     dynamicHintPolicy:         "reject",                                         // RCE class — refused at every profile
     bracketNestingPolicy:      "audit",
     recursiveDescentPolicy:    "audit",
-    maxRecursiveDescents:      4,                                                // allow:raw-byte-literal — recursion depth ceiling
+    maxRecursiveDescents:      4,                                                // recursion depth ceiling
     maxPatternBytes:           C.BYTES.kib(2),
     maxBytes:                  C.BYTES.kib(2),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -120,7 +120,7 @@ var PROFILES = Object.freeze({
     dynamicHintPolicy:         "reject",                                          // RCE class refused at every profile
     bracketNestingPolicy:      "audit",
     recursiveDescentPolicy:    "allow",
-    maxRecursiveDescents:      16,                                               // allow:raw-byte-literal — recursion depth ceiling
+    maxRecursiveDescents:      16,                                               // recursion depth ceiling
     maxPatternBytes:           C.BYTES.kib(8),
     maxBytes:                  C.BYTES.kib(8),
     maxRuntimeMs:              C.TIME.seconds(2),

package/lib/guard-jwt.js

@@ -368,7 +368,7 @@ function _detectIssues(input, opts) {
   // Payload claim sanity (only if payload is decodable).
   var payload = _b64urlDecodeJson(payloadSeg);
   if (payload && typeof payload === "object") {
-    var nowSec = Math.floor(Date.now() / 1000);                                  // allow:raw-byte-literal — seconds-per-millisecond conversion
+    var nowSec = Math.floor(Date.now() / 1000);                                  // seconds-per-millisecond conversion
 
     // exp in the past.
     if (typeof payload.exp === "number" &&
@@ -387,7 +387,7 @@ function _detectIssues(input, opts) {
     // nbf far-future.
     if (typeof payload.nbf === "number" &&
         opts.nbfSanityPolicy !== "allow") {
-      var nbfSlackSec = Math.floor(opts.nbfFutureSlackMs / 1000);                // allow:raw-byte-literal — seconds-per-millisecond conversion
+      var nbfSlackSec = Math.floor(opts.nbfFutureSlackMs / 1000);                // seconds-per-millisecond conversion
       if (payload.nbf > nowSec + nbfSlackSec) {
         issues.push({
           kind: "nbf-far-future",
@@ -402,7 +402,7 @@ function _detectIssues(input, opts) {
     // iat far-future.
     if (typeof payload.iat === "number" &&
         opts.iatSanityPolicy !== "allow") {
-      var iatSlackSec = Math.floor(opts.iatFutureSlackMs / 1000);                // allow:raw-byte-literal — seconds-per-millisecond conversion
+      var iatSlackSec = Math.floor(opts.iatFutureSlackMs / 1000);                // seconds-per-millisecond conversion
       if (payload.iat > nowSec + iatSlackSec) {
         issues.push({
           kind: "iat-far-future",
@@ -727,7 +727,7 @@ function kidSafe(kid) {
   }
   for (var i = 0; i < kid.length; i += 1) {
     var cc = kid.charCodeAt(i);
-    if (cc < 0x20 || cc === 0x7F) {                                              // allow:raw-byte-literal — control-byte boundary check
+    if (cc < 0x20 || cc === 0x7F) {                                              // control-byte boundary check
       throw _err("jwt.kid-control",
         "kid contains control byte at index " + i);
     }

package/lib/guard-list-id.js

@@ -80,22 +80,22 @@ var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
   strict: {
-    maxBytes:           998,                                                                             // allow:raw-byte-literal — RFC 5322 §2.1.1 line cap
-    maxListIdBytes:     255,                                                                             // allow:raw-byte-literal — RFC 2919 §3 cap
+    maxBytes:           998,                                                                             // RFC 5322 §2.1.1 line cap
+    maxListIdBytes:     255,                                                                             // RFC 2919 §3 cap
     requireFqdn:        true,
     requireRandomForLocalhost: true,
     allowPhrase:        true,
   },
   balanced: {
-    maxBytes:           998,                                                                             // allow:raw-byte-literal — RFC 5322 §2.1.1 line cap
-    maxListIdBytes:     255,                                                                             // allow:raw-byte-literal — RFC 2919 §3 cap
+    maxBytes:           998,                                                                             // RFC 5322 §2.1.1 line cap
+    maxListIdBytes:     255,                                                                             // RFC 2919 §3 cap
     requireFqdn:        true,
     requireRandomForLocalhost: false,
     allowPhrase:        true,
   },
   permissive: {
     maxBytes:           C.BYTES.kib(4),
-    maxListIdBytes:     512,                                                                             // allow:raw-byte-literal — permissive max
+    maxListIdBytes:     512,                                                                             // permissive max
     requireFqdn:        false,
     requireRandomForLocalhost: false,
     allowPhrase:        true,
@@ -238,7 +238,7 @@ function validate(headerValue, opts) {
   // grammar). No trailing-dot bypass surface here.
   var isLocalScopeTld = lastLabel === "localhost" || lastLabel === "local" || lastLabel === "lan"; // allow:hostname-compare-trailing-dot — see comment above; List-Id parts already split on `.` so trailing-dot label is empty and refused upstream
   if (caps.requireFqdn) {
-    if (parts.length < 3 && !isLocalScopeTld) {                                                          // allow:raw-byte-literal — FQDN requires ≥ 3 labels for non-local-scope namespace
+    if (parts.length < 3 && !isLocalScopeTld) {                                                          // FQDN requires ≥ 3 labels for non-local-scope namespace
       return _refuse("list-id has < 3 labels for non-local-scope namespace (FQDN required under '" +
         (opts.profile || DEFAULT_PROFILE) + "')");
     }
@@ -280,7 +280,7 @@ function compliancePosture(posture) {
 function _hasControlChar(s) {
   for (var i = 0; i < s.length; i += 1) {
     var c = s.charCodeAt(i);
-    if (c === 0x00 || c === 0x7f || (c < 0x20 && c !== 0x09)) {                                          // allow:raw-byte-literal — RFC 5322 control + TAB allow
+    if (c === 0x00 || c === 0x7f || (c < 0x20 && c !== 0x09)) {                                          // RFC 5322 control + TAB allow
       return true;
     }
   }

package/lib/guard-list-unsubscribe.js

@@ -87,24 +87,24 @@ var DEFAULT_PROFILE = "strict";
 var PROFILES = Object.freeze({
   strict: {
     maxBytes:           C.BYTES.kib(4),
-    maxUris:            4,                                                                               // allow:raw-byte-literal — URI-count cap
-    maxUriBytes:        2048,                                                                            // allow:raw-byte-literal — per-URI byte cap
+    maxUris:            4,                                                                               // URI-count cap
+    maxUriBytes:        2048,                                                                            // per-URI byte cap
     requireHttpsUri:    true,
     requirePostHeader:  true,
     refuseHttp:         true,
   },
   balanced: {
     maxBytes:           C.BYTES.kib(4),
-    maxUris:            8,                                                                               // allow:raw-byte-literal — URI-count cap
-    maxUriBytes:        2048,                                                                            // allow:raw-byte-literal — per-URI byte cap
+    maxUris:            8,                                                                               // URI-count cap
+    maxUriBytes:        2048,                                                                            // per-URI byte cap
     requireHttpsUri:    false,
     requirePostHeader:  false,
     refuseHttp:         true,
   },
   permissive: {
     maxBytes:           C.BYTES.kib(8),
-    maxUris:            16,                                                                              // allow:raw-byte-literal — URI-count cap
-    maxUriBytes:        4096,                                                                            // allow:raw-byte-literal — per-URI byte cap
+    maxUris:            16,                                                                              // URI-count cap
+    maxUriBytes:        4096,                                                                            // per-URI byte cap
     requireHttpsUri:    false,
     requirePostHeader:  false,
     refuseHttp:         false,
@@ -363,7 +363,7 @@ function _extractUris(raw, maxUris) {
 function _hasControlChar(s) {
   for (var i = 0; i < s.length; i += 1) {
     var c = s.charCodeAt(i);
-    if (c === 0x00 || c === 0x7f || (c < 0x20 && c !== 0x09)) {                                          // allow:raw-byte-literal — RFC 5322 control + TAB allow
+    if (c === 0x00 || c === 0x7f || (c < 0x20 && c !== 0x09)) {                                          // RFC 5322 control + TAB allow
       return true;
     }
   }
@@ -371,7 +371,7 @@ function _hasControlChar(s) {
 }
 
 function _trunc(s) {
-  if (s.length <= 64) return s;                                                                          // allow:raw-byte-literal — error-message truncation
+  if (s.length <= 64) return s;                                                                          // error-message truncation
   return s.slice(0, 60) + "…";                                                                          // allow:raw-time-literal — char count for error-message truncation, not seconds
 }
 

package/lib/guard-mail-compose.js

@@ -42,9 +42,9 @@ var GuardMailComposeError = defineClass("GuardMailComposeError", { alwaysPermane
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxRecipients: 100,  maxAttachmentBytes: 26214400, maxSubjectBytes: 998 },            // allow:raw-byte-literal — 25 MiB, RFC 5322 §2.1.1 line cap
-  balanced:   { maxRecipients: 500,  maxAttachmentBytes: 52428800, maxSubjectBytes: 998 },            // allow:raw-byte-literal — 50 MiB
-  permissive: { maxRecipients: 2000, maxAttachmentBytes: 104857600, maxSubjectBytes: 998 },           // allow:raw-byte-literal — 100 MiB
+  strict:     { maxRecipients: 100,  maxAttachmentBytes: 26214400, maxSubjectBytes: 998 },            // 25 MiB, RFC 5322 §2.1.1 line cap
+  balanced:   { maxRecipients: 500,  maxAttachmentBytes: 52428800, maxSubjectBytes: 998 },            // 50 MiB
+  permissive: { maxRecipients: 2000, maxAttachmentBytes: 104857600, maxSubjectBytes: 998 },           // 100 MiB
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -239,7 +239,7 @@ function _checkBody(body, profile, allowAlt) {
 function _checkHeaderValue(v, label) {
   for (var i = 0; i < v.length; i += 1) {
     var c = v.charCodeAt(i);
-    if ((c < 0x20 && c !== 0x09) || c === 0x7F) {                                                     // allow:raw-byte-literal — C0 + DEL refusal in header
+    if ((c < 0x20 && c !== 0x09) || c === 0x7F) {                                                     // C0 + DEL refusal in header
       throw new GuardMailComposeError("mail-compose/control-char-in-header",
         "guardMailCompose.validate: control char 0x" + c.toString(16) + " in " + label);
     }

package/lib/guard-mail-move.js

@@ -40,9 +40,9 @@ var GuardMailMoveError = defineClass("GuardMailMoveError", { alwaysPermanent: tr
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxObjectIds: 1000,  maxFolderNameBytes: 255  },                                      // allow:raw-byte-literal
-  balanced:   { maxObjectIds: 5000,  maxFolderNameBytes: 255  },                                      // allow:raw-byte-literal
-  permissive: { maxObjectIds: 50000, maxFolderNameBytes: 1024 },                                      // allow:raw-byte-literal
+  strict:     { maxObjectIds: 1000,  maxFolderNameBytes: 255  },
+  balanced:   { maxObjectIds: 5000,  maxFolderNameBytes: 255  },
+  permissive: { maxObjectIds: 50000, maxFolderNameBytes: 1024 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -167,11 +167,11 @@ function _checkFolderName(name, label, profile) {
   }
   for (var i = 0; i < name.length; i += 1) {
     var c = name.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                     // allow:raw-byte-literal — C0 + DEL refusal
+    if (c < 0x20 || c === 0x7F) {                                                                     // C0 + DEL refusal
       throw new GuardMailMoveError("mail-move/control-char-in-name",
         "guardMailMove.validate: " + label + " contains control char 0x" + c.toString(16));
     }
-    if (c === 0x2F) {                                                                                 // allow:raw-byte-literal — '/' refusal
+    if (c === 0x2F) {                                                                                 // '/' refusal
       throw new GuardMailMoveError("mail-move/slash-in-name",
         "guardMailMove.validate: " + label + " contains '/' (use IMAP '.' hierarchy separator)");
     }

package/lib/guard-mail-query.js

@@ -33,9 +33,9 @@ var GuardMailQueryError = defineClass("GuardMailQueryError", { alwaysPermanent:
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxDepth: 8,  maxKeys: 64,  maxStringBytes: 8192,  maxArrayLen: 256 },                // allow:raw-byte-literal — caps for filter spec
-  balanced:   { maxDepth: 16, maxKeys: 128, maxStringBytes: 16384, maxArrayLen: 1024 },               // allow:raw-byte-literal
-  permissive: { maxDepth: 24, maxKeys: 512, maxStringBytes: 65536, maxArrayLen: 4096 },               // allow:raw-byte-literal
+  strict:     { maxDepth: 8,  maxKeys: 64,  maxStringBytes: 8192,  maxArrayLen: 256 },                // caps for filter spec
+  balanced:   { maxDepth: 16, maxKeys: 128, maxStringBytes: 16384, maxArrayLen: 1024 },
+  permissive: { maxDepth: 24, maxKeys: 512, maxStringBytes: 65536, maxArrayLen: 4096 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({

package/lib/guard-mail-reply.js

@@ -36,9 +36,9 @@ var GuardMailReplyError = defineClass("GuardMailReplyError", { alwaysPermanent:
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxChainLength: 100,  maxQuotedBytes: 524288,   maxForwardedAttachments: 32 },        // allow:raw-byte-literal — chain count + 512 KiB
-  balanced:   { maxChainLength: 500,  maxQuotedBytes: 2097152,  maxForwardedAttachments: 128 },       // allow:raw-byte-literal — chain count + 2 MiB
-  permissive: { maxChainLength: 2000, maxQuotedBytes: 10485760, maxForwardedAttachments: 512 },       // allow:raw-byte-literal — chain count + 10 MiB
+  strict:     { maxChainLength: 100,  maxQuotedBytes: 524288,   maxForwardedAttachments: 32 },        // chain count + 512 KiB
+  balanced:   { maxChainLength: 500,  maxQuotedBytes: 2097152,  maxForwardedAttachments: 128 },       // chain count + 2 MiB
+  permissive: { maxChainLength: 2000, maxQuotedBytes: 10485760, maxForwardedAttachments: 512 },       // chain count + 10 MiB
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({