@blamejs/core 0.14.0 → 0.14.2

package/lib/guard-mail-sieve.js

@@ -39,9 +39,9 @@ var GuardMailSieveError = defineClass("GuardMailSieveError", { alwaysPermanent:
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxScriptBytes: 65536,   maxNameBytes: 256,  maxLines: 2000  },                       // allow:raw-byte-literal
-  balanced:   { maxScriptBytes: 262144,  maxNameBytes: 256,  maxLines: 10000 },                       // allow:raw-byte-literal
-  permissive: { maxScriptBytes: 1048576, maxNameBytes: 1024, maxLines: 50000 },                       // allow:raw-byte-literal
+  strict:     { maxScriptBytes: 65536,   maxNameBytes: 256,  maxLines: 2000  },
+  balanced:   { maxScriptBytes: 262144,  maxNameBytes: 256,  maxLines: 10000 },
+  permissive: { maxScriptBytes: 1048576, maxNameBytes: 1024, maxLines: 50000 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -112,7 +112,7 @@ function validate(op, opts) {
     // but blows up later parser stages; refuse here).
     var lineCount = 1;
     for (var i = 0; i < op.script.length; i += 1) {
-      if (op.script.charCodeAt(i) === 0x0A) lineCount += 1;                                           // allow:raw-byte-literal — LF
+      if (op.script.charCodeAt(i) === 0x0A) lineCount += 1;                                           // LF
     }
     if (lineCount > profile.maxLines) {
       throw new GuardMailSieveError("mail-sieve/too-many-lines",
@@ -123,7 +123,7 @@ function validate(op, opts) {
     // text-only per RFC 5228 §1.4).
     for (var j = 0; j < op.script.length; j += 1) {
       var c = op.script.charCodeAt(j);
-      if (c === 0x00 || (c < 0x20 && c !== 0x09 && c !== 0x0A && c !== 0x0D) || c === 0x7F) {         // allow:raw-byte-literal — NUL / C0 except TAB/LF/CR / DEL refusal
+      if (c === 0x00 || (c < 0x20 && c !== 0x09 && c !== 0x0A && c !== 0x0D) || c === 0x7F) {         // NUL / C0 except TAB/LF/CR / DEL refusal
         throw new GuardMailSieveError("mail-sieve/control-char-in-script",
           "guardMailSieve.validate: control char 0x" + c.toString(16) + " at offset " + j);
       }
@@ -177,7 +177,7 @@ function _checkName(name, profile) {
   }
   for (var i = 0; i < name.length; i += 1) {
     var c = name.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // allow:raw-byte-literal — C0 / DEL / slash / backslash refusal
+    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // C0 / DEL / slash / backslash refusal
       throw new GuardMailSieveError("mail-sieve/bad-name-char",
         "guardMailSieve.validate: op.name contains forbidden char 0x" + c.toString(16));
     }

package/lib/guard-managesieve-command.js

@@ -109,25 +109,25 @@ var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
   strict: {
-    maxLineBytes:        8192,                                                                          // allow:raw-byte-literal — 8 KiB per-line cap (strict)
-    maxScriptBytes:      65536,                                                                         // allow:raw-byte-literal — 64 KiB script cap (matches safeSieve strict)
-    maxScriptNameBytes:  512,                                                                           // allow:raw-byte-literal — RFC 5804 §2.1 script-name cap
+    maxLineBytes:        8192,                                                                          // 8 KiB per-line cap (strict)
+    maxScriptBytes:      65536,                                                                         // 64 KiB script cap (matches safeSieve strict)
+    maxScriptNameBytes:  512,                                                                           // RFC 5804 §2.1 script-name cap
     allowBareLf:         false,
     allowCleartextAuth:  false,
-    allowLiteralPlus:    true,                                                                          // RFC 7888 LITERAL+ accepted under strict (operator MAY refuse via opts.allowLiteralPlus=false) // allow:raw-byte-literal — RFC number
+    allowLiteralPlus:    true,                                                                          // RFC 7888 LITERAL+ accepted under strict (operator MAY refuse via opts.allowLiteralPlus=false) // RFC number
   },
   balanced: {
-    maxLineBytes:        16384,                                                                         // allow:raw-byte-literal — 16 KiB per-line cap (balanced)
-    maxScriptBytes:      262144,                                                                        // allow:raw-byte-literal — 256 KiB script cap (matches safeSieve balanced)
-    maxScriptNameBytes:  512,                                                                           // allow:raw-byte-literal — RFC 5804 §2.1 script-name cap
+    maxLineBytes:        16384,                                                                         // 16 KiB per-line cap (balanced)
+    maxScriptBytes:      262144,                                                                        // 256 KiB script cap (matches safeSieve balanced)
+    maxScriptNameBytes:  512,                                                                           // RFC 5804 §2.1 script-name cap
     allowBareLf:         false,
     allowCleartextAuth:  false,
     allowLiteralPlus:    true,
   },
   permissive: {
-    maxLineBytes:        65536,                                                                         // allow:raw-byte-literal — 64 KiB per-line cap (permissive)
-    maxScriptBytes:      1048576,                                                                       // allow:raw-byte-literal — 1 MiB script cap (matches safeSieve permissive)
-    maxScriptNameBytes:  512,                                                                           // allow:raw-byte-literal — RFC 5804 §2.1 script-name cap
+    maxLineBytes:        65536,                                                                         // 64 KiB per-line cap (permissive)
+    maxScriptBytes:      1048576,                                                                       // 1 MiB script cap (matches safeSieve permissive)
+    maxScriptNameBytes:  512,                                                                           // RFC 5804 §2.1 script-name cap
     allowBareLf:         true,
     allowCleartextAuth:  true,
     allowLiteralPlus:    true,
@@ -231,16 +231,16 @@ function validate(line, opts) {
   var inQuote = false;
   for (var i = 0; i < line.length; i += 1) {
     var c = line.charCodeAt(i);
-    if (c === 0x22 && !_isEscaped(line, i)) {                                                           // allow:raw-byte-literal — DQUOTE
+    if (c === 0x22 && !_isEscaped(line, i)) {                                                           // DQUOTE
       inQuote = !inQuote;
       continue;
     }
     if (inQuote) continue;
-    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                         // allow:raw-byte-literal — control-byte refusal
+    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                         // control-byte refusal
       if (c === 0x0A && caps.allowBareLf) continue;
       throw new GuardManageSieveCommandError("guard-managesieve-command/bad-byte",
         "guardManageSieveCommand.validate: control byte 0x" +
-        c.toString(16) + " at offset " + i);                                                            // allow:raw-byte-literal — base-16 toString radix
+        c.toString(16) + " at offset " + i);                                                            // base-16 toString radix
     }
   }
   if (inQuote) {
@@ -322,7 +322,7 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
       // Base64-initial-response cap: bound by the script-name cap
       // (initial-response is a SASL token, not a script body; 4 KiB
       // is generous).
-      if (n > 4096) {                                                                                   // allow:raw-byte-literal — 4 KiB SASL initial-response cap
+      if (n > 4096) {                                                                                   // 4 KiB SASL initial-response cap
         throw new GuardManageSieveCommandError("guard-managesieve-command/literal-too-large",
           "guardManageSieveCommand.validate: AUTHENTICATE initial-response " +
           n + " bytes exceeds 4096-byte cap");
@@ -463,26 +463,26 @@ function _validateRenamescript(rest, caps) {
 // Returns null if `s` does not begin with a DQUOTE. RFC 5804 §1.2
 // quoted strings allow UTF-8 content and `\"` / `\\` escape sequences.
 function _parseQuotedString(s) {
-  if (s.length === 0 || s.charCodeAt(0) !== 0x22) return null;                                          // allow:raw-byte-literal — DQUOTE
+  if (s.length === 0 || s.charCodeAt(0) !== 0x22) return null;                                          // DQUOTE
   var out = "";
   var i = 1;
   while (i < s.length) {
     var c = s.charCodeAt(i);
-    if (c === 0x5C) {                                                                                   // allow:raw-byte-literal — backslash escape
+    if (c === 0x5C) {                                                                                   // backslash escape
       if (i + 1 >= s.length) return null;
       var esc = s.charCodeAt(i + 1);
-      if (esc === 0x22) { out += '"'; i += 2; continue; }                                               // allow:raw-byte-literal — DQUOTE
-      if (esc === 0x5C) { out += "\\"; i += 2; continue; }                                              // allow:raw-byte-literal — backslash
+      if (esc === 0x22) { out += '"'; i += 2; continue; }                                               // DQUOTE
+      if (esc === 0x5C) { out += "\\"; i += 2; continue; }                                              // backslash
       return null;
     }
-    if (c === 0x22) {                                                                                   // allow:raw-byte-literal — closing DQUOTE
+    if (c === 0x22) {                                                                                   // closing DQUOTE
       var rest = s.slice(i + 1);
       // Trim leading whitespace from rest.
       var k = 0;
-      while (k < rest.length && (rest.charCodeAt(k) === 0x20 || rest.charCodeAt(k) === 0x09)) k += 1;   // allow:raw-byte-literal — SP / HTAB
+      while (k < rest.length && (rest.charCodeAt(k) === 0x20 || rest.charCodeAt(k) === 0x09)) k += 1;   // SP / HTAB
       return { value: out, rest: rest.slice(k) };
     }
-    if (c === 0x00 || c === 0x0D || c === 0x0A) return null;                                            // allow:raw-byte-literal — NUL/CR/LF refused in quoted strings
+    if (c === 0x00 || c === 0x0D || c === 0x0A) return null;                                            // NUL/CR/LF refused in quoted strings
     out += s[i];
     i += 1;
   }
@@ -495,7 +495,7 @@ function _parseQuotedString(s) {
 function _isEscaped(line, i) {
   var n = 0;
   var j = i - 1;
-  while (j >= 0 && line.charCodeAt(j) === 0x5C) { n += 1; j -= 1; }                                     // allow:raw-byte-literal — backslash count
+  while (j >= 0 && line.charCodeAt(j) === 0x5C) { n += 1; j -= 1; }                                     // backslash count
   return (n & 1) === 1;
 }
 
@@ -513,12 +513,12 @@ function _checkScriptName(name, caps) {
   _checkScriptNameBytes(name, caps);
   for (var i = 0; i < name.length; i += 1) {
     var c = name.charCodeAt(i);
-    if (c === 0x2F || c === 0x5C) {                                                                     // allow:raw-byte-literal — forward-slash + backslash refused
+    if (c === 0x2F || c === 0x5C) {                                                                     // forward-slash + backslash refused
       throw new GuardManageSieveCommandError("guard-managesieve-command/bad-name-byte",
         "guardManageSieveCommand.validate: script-name byte 0x" +
-        c.toString(16) + " refused (RFC 5804 §2.1)");                                                  // allow:raw-byte-literal — base-16 toString radix
+        c.toString(16) + " refused (RFC 5804 §2.1)");                                                  // base-16 toString radix
     }
-    if (c === 0x00) {                                                                                   // allow:raw-byte-literal — NUL refused
+    if (c === 0x00) {                                                                                   // NUL refused
       throw new GuardManageSieveCommandError("guard-managesieve-command/bad-name-byte",
         "guardManageSieveCommand.validate: NUL byte refused in script-name (RFC 5804 §2.1)");
     }

package/lib/guard-markdown.js

@@ -100,8 +100,8 @@ var EMPH_RUN_RE = /[*_]{20,}/;
 
 function _decodeHtmlEntities(s) {
   return s.replace(HTML_ENTITY_NUM_RE, function (match, hex, dec) {
-    var code = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);       // allow:raw-byte-literal — parseInt radix args (16 hex / 10 decimal)
-    if (!isFinite(code) || code < 0 || code > 0x10ffff) return match;            // allow:raw-byte-literal — Unicode codepoint range
+    var code = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);       // parseInt radix args (16 hex / 10 decimal)
+    if (!isFinite(code) || code < 0 || code > 0x10ffff) return match;            // Unicode codepoint range
     try { return String.fromCodePoint(code); } catch (_e) { return match; }
   });
 }
@@ -118,7 +118,7 @@ function _isDangerousUrl(url, opts) {
   var stripped = "";
   for (var ci = 0; ci < s.length; ci += 1) {
     var cc = s.charCodeAt(ci);
-    if (cc > 0x1f && cc !== 0x7f) stripped += s.charAt(ci);                     // allow:raw-byte-literal — ASCII control range thresholds
+    if (cc > 0x1f && cc !== 0x7f) stripped += s.charAt(ci);                     // ASCII control range thresholds
   }
   s = stripped;
   if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap — `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
@@ -147,13 +147,13 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "reject",
     zeroWidthPolicy:        "reject",
     maxBytes:               C.BYTES.mib(1),
-    maxLines:               4096,                                                // allow:raw-byte-literal — line count cap
-    maxLinks:               256,                                                 // allow:raw-byte-literal — link count cap
-    maxImages:              128,                                                 // allow:raw-byte-literal — image count cap
-    maxAutolinks:           128,                                                 // allow:raw-byte-literal — autolink count cap
-    maxRefDefs:             64,                                                  // allow:raw-byte-literal — ref-def count cap
-    maxListDepth:           16,                                                  // allow:raw-byte-literal — nesting depth
-    maxBlockquoteDepth:     16,                                                  // allow:raw-byte-literal — nesting depth
+    maxLines:               4096,                                                // line count cap
+    maxLinks:               256,                                                 // link count cap
+    maxImages:              128,                                                 // image count cap
+    maxAutolinks:           128,                                                 // autolink count cap
+    maxRefDefs:             64,                                                  // ref-def count cap
+    maxListDepth:           16,                                                  // nesting depth
+    maxBlockquoteDepth:     16,                                                  // nesting depth
   },
   "balanced": {
     rawHtmlPolicy:          "audit",
@@ -173,13 +173,13 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "strip",
     zeroWidthPolicy:        "strip",
     maxBytes:               C.BYTES.mib(8),
-    maxLines:               32768,                                               // allow:raw-byte-literal — line count cap
-    maxLinks:               2048,                                                // allow:raw-byte-literal — link count cap
-    maxImages:              1024,                                                // allow:raw-byte-literal — image count cap
-    maxAutolinks:           1024,                                                // allow:raw-byte-literal — autolink count cap
-    maxRefDefs:             512,                                                 // allow:raw-byte-literal — ref-def count cap
-    maxListDepth:           64,                                                  // allow:raw-byte-literal — nesting depth
-    maxBlockquoteDepth:     64,                                                  // allow:raw-byte-literal — nesting depth
+    maxLines:               32768,                                               // line count cap
+    maxLinks:               2048,                                                // link count cap
+    maxImages:              1024,                                                // image count cap
+    maxAutolinks:           1024,                                                // autolink count cap
+    maxRefDefs:             512,                                                 // ref-def count cap
+    maxListDepth:           64,                                                  // nesting depth
+    maxBlockquoteDepth:     64,                                                  // nesting depth
   },
   "permissive": {
     rawHtmlPolicy:          "allow",
@@ -199,13 +199,13 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "reject",
     zeroWidthPolicy:        "audit",
     maxBytes:               C.BYTES.mib(64),
-    maxLines:               262144,                                              // allow:raw-byte-literal — line count cap
-    maxLinks:               16384,                                               // allow:raw-byte-literal — link count cap
-    maxImages:              8192,                                                // allow:raw-byte-literal — image count cap
-    maxAutolinks:           8192,                                                // allow:raw-byte-literal — autolink count cap
-    maxRefDefs:             4096,                                                // allow:raw-byte-literal — ref-def count cap
-    maxListDepth:           256,                                                 // allow:raw-byte-literal — nesting depth
-    maxBlockquoteDepth:     256,                                                 // allow:raw-byte-literal — nesting depth
+    maxLines:               262144,                                              // line count cap
+    maxLinks:               16384,                                               // link count cap
+    maxImages:              8192,                                                // image count cap
+    maxAutolinks:           8192,                                                // autolink count cap
+    maxRefDefs:             4096,                                                // ref-def count cap
+    maxListDepth:           256,                                                 // nesting depth
+    maxBlockquoteDepth:     256,                                                 // nesting depth
   },
 });
 
@@ -261,7 +261,7 @@ function _detectIssues(input, opts) {
   // Line count cap — line-based parsers scale O(lines).
   var lineCount = 0;
   for (var li = 0; li < input.length; li += 1) {
-    if (input.charCodeAt(li) === 10) lineCount += 1;                             // allow:raw-byte-literal — newline char code
+    if (input.charCodeAt(li) === 10) lineCount += 1;                             // newline char code
   }
   if (lineCount > opts.maxLines) {
     issues.push({
@@ -342,7 +342,7 @@ function _detectIssues(input, opts) {
       snippet: (isImage ? "image" : "link") +
                " uses dangerous scheme '" + scheme + ":'",
     });
-    if (issues.length > 256) break;                                              // allow:raw-byte-literal — issue accumulator cap
+    if (issues.length > 256) break;                                              // issue accumulator cap
   }
   if (linkCount > opts.maxLinks) {
     issues.push({
@@ -372,7 +372,7 @@ function _detectIssues(input, opts) {
       ruleId: "markdown.autolink-scheme",
       snippet: "autolink uses dangerous scheme '" + aScheme + ":'",
     });
-    if (issues.length > 256) break;                                              // allow:raw-byte-literal — issue accumulator cap
+    if (issues.length > 256) break;                                              // issue accumulator cap
   }
   if (autolinkCount > opts.maxAutolinks) {
     issues.push({
@@ -398,7 +398,7 @@ function _detectIssues(input, opts) {
       snippet: "reference-link definition uses dangerous scheme '" +
                rScheme + ":' (smuggled through `[ref]` text)",
     });
-    if (issues.length > 256) break;                                              // allow:raw-byte-literal — issue accumulator cap
+    if (issues.length > 256) break;                                              // issue accumulator cap
   }
   if (refDefCount > opts.maxRefDefs) {
     issues.push({
@@ -422,9 +422,9 @@ function _detectIssues(input, opts) {
           severity: opts.codeFenceLangPolicy === "reject" ? "critical" : "high",
           ruleId: "markdown.code-fence-lang",
           snippet: "code-fence language tag contains attribute-breaking " +
-                   "characters: " + JSON.stringify(lang.slice(0, 64)),         // allow:raw-byte-literal — snippet truncation
+                   "characters: " + JSON.stringify(lang.slice(0, 64)),         // snippet truncation
         });
-        if (issues.length > 256) break;                                          // allow:raw-byte-literal — issue accumulator cap
+        if (issues.length > 256) break;                                          // issue accumulator cap
       }
     }
   }
@@ -458,7 +458,7 @@ function _detectIssues(input, opts) {
       var marker = line.charAt(leading);
       if (marker === "-" || marker === "*" || marker === "+" ||
           (marker >= "0" && marker <= "9")) {
-        var depth = Math.floor(leading / 2);                                     // allow:raw-byte-literal — markdown convention: 2 spaces per nest level
+        var depth = Math.floor(leading / 2);                                     // markdown convention: 2 spaces per nest level
         if (depth > maxListDepthSeen) maxListDepthSeen = depth;
       }
     }

package/lib/guard-message-id.js

@@ -56,9 +56,9 @@ var GuardMessageIdError = defineClass("GuardMessageIdError", { alwaysPermanent:
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { requireBrackets: true,  maxBytes: 998 },                                          // allow:raw-byte-literal
-  balanced:   { requireBrackets: false, maxBytes: 998 },                                          // allow:raw-byte-literal
-  permissive: { requireBrackets: false, maxBytes: 4096 },                                         // allow:raw-byte-literal — permissive cap, not bytes-as-storage
+  strict:     { requireBrackets: true,  maxBytes: 998 },
+  balanced:   { requireBrackets: false, maxBytes: 998 },
+  permissive: { requireBrackets: false, maxBytes: 4096 },                                         // permissive cap, not bytes-as-storage
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -130,7 +130,7 @@ function validate(value, opts) {
   // CR/LF into a Message-Id to fold an attacker-chosen From: line).
   for (var i = 0; i < value.length; i += 1) {
     var c = value.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                 // allow:raw-byte-literal — C0 + DEL refusal
+    if (c < 0x20 || c === 0x7F) {                                                                 // C0 + DEL refusal
       throw new GuardMessageIdError("message-id/control-char",
         "guardMessageId.validate: control char 0x" + c.toString(16) + " at offset " + i);
     }
@@ -209,7 +209,7 @@ function validate(value, opts) {
  */
 function validateList(value, opts) {
   opts = opts || {};
-  var maxIds = typeof opts.maxIds === "number" ? opts.maxIds : 100;                              // allow:raw-byte-literal — References-chain cap, not bytes
+  var maxIds = typeof opts.maxIds === "number" ? opts.maxIds : 100;                              // References-chain cap, not bytes
   if (typeof value !== "string") {
     throw new GuardMessageIdError("message-id/bad-input",
       "guardMessageId.validateList: value must be a string");

package/lib/guard-mime.js

@@ -58,7 +58,7 @@ var TOKEN_RE = /^[A-Za-z0-9][A-Za-z0-9!#$&\-^_.+]{0,126}$/;
 var PARAM_TOKEN_RE = safeBuffer.RFC7230_TCHAR_RE;
 
 // Quoted-string body (between double quotes) per RFC 7230 §3.2.6.
-var QUOTED_STRING_BODY_RE = /^[\t\x20-\x7e]*$/;                                   // allow:raw-byte-literal — printable ASCII range
+var QUOTED_STRING_BODY_RE = /^[\t\x20-\x7e]*$/;                                   // printable ASCII range
 
 // Risky-type refuse list (operator-supplied scripts handed to a host).
 var RISKY_TYPES = Object.freeze([

package/lib/guard-oauth.js

@@ -91,7 +91,7 @@ void observability;
 
 var _err = GuardOauthError.factory;
 
-var SCOPE_TOKEN_RE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;                              // allow:raw-byte-literal — RFC 6749 §3.3 scope-token charset
+var SCOPE_TOKEN_RE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;                              // RFC 6749 §3.3 scope-token charset
 var DEFAULT_RESPONSE_TYPES = Object.freeze(["code"]);
 
 // ---- Profile presets ----
@@ -612,7 +612,7 @@ module.exports = {
       redirect_uri:  "https://app.example.com/callback",
       state:         "csrf-rand-1",
       scope:         "openid profile",
-      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // allow:raw-byte-literal — base64url-shaped fixture
+      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // base64url-shaped fixture
       code_challenge_method: "S256",
     }), "utf8"),
     hostileBytes:      Buffer.from(JSON.stringify({
@@ -626,7 +626,7 @@ module.exports = {
       redirect_uri:  "https://app.example.com/callback",
       state:         "csrf-rand-1",
       scope:         "openid profile",
-      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // allow:raw-byte-literal — base64url-shaped fixture
+      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // base64url-shaped fixture
       code_challenge_method: "S256",
     },
     hostileOauthFlow: {

package/lib/guard-pdf.js

@@ -95,8 +95,8 @@ var PROFILES = Object.freeze({
     polyglotPolicy:            "reject",
     pageCountPolicy:           "reject",
     embeddedFileCountPolicy:   "reject",
-    maxPageCount:              500,                                              // allow:raw-byte-literal — page-count ceiling
-    maxEmbeddedFileCount:      0,                                                // allow:raw-byte-literal — strict refuses any embedded file
+    maxPageCount:              500,                                              // page-count ceiling
+    maxEmbeddedFileCount:      0,                                                // strict refuses any embedded file
     maxBytes:                  C.BYTES.mib(64),
     maxRuntimeMs:              C.TIME.seconds(5),
   },
@@ -110,8 +110,8 @@ var PROFILES = Object.freeze({
     polyglotPolicy:            "reject",                                         // polyglot refused at every profile
     pageCountPolicy:           "audit",
     embeddedFileCountPolicy:   "audit",
-    maxPageCount:              5000,                                             // allow:raw-byte-literal — page-count ceiling
-    maxEmbeddedFileCount:      10,                                               // allow:raw-byte-literal — embedded file ceiling
+    maxPageCount:              5000,                                             // page-count ceiling
+    maxEmbeddedFileCount:      10,                                               // embedded file ceiling
     maxBytes:                  C.BYTES.mib(128),
     maxRuntimeMs:              C.TIME.seconds(5),
   },
@@ -125,8 +125,8 @@ var PROFILES = Object.freeze({
     polyglotPolicy:            "reject",                                          // polyglot refused at every profile
     pageCountPolicy:           "audit",
     embeddedFileCountPolicy:   "audit",
-    maxPageCount:              50000,                                            // allow:raw-byte-literal — page-count ceiling
-    maxEmbeddedFileCount:      100,                                              // allow:raw-byte-literal — embedded file ceiling
+    maxPageCount:              50000,                                            // page-count ceiling
+    maxEmbeddedFileCount:      100,                                              // embedded file ceiling
     maxBytes:                  C.BYTES.mib(512),
     maxRuntimeMs:              C.TIME.seconds(5),
   },

package/lib/guard-pop3-command.js

@@ -81,23 +81,23 @@ var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
   strict: {
-    maxLineBytes:       255,                                                                         // allow:raw-byte-literal — RFC 2449 §4 cap
-    maxUsernameBytes:   40,                                                                          // allow:raw-byte-literal — RFC 1939 §3 cap
-    maxPasswordBytes:   40,                                                                          // allow:raw-byte-literal — RFC 1939 §3 cap
+    maxLineBytes:       255,                                                                         // RFC 2449 §4 cap
+    maxUsernameBytes:   40,                                                                          // RFC 1939 §3 cap
+    maxPasswordBytes:   40,                                                                          // RFC 1939 §3 cap
     allowBareLf:        false,
     allowApop:          false,                                                                       // RFC 1939 §7 — legacy challenge-response with MD5; refuse under strict (M³AAWG)
   },
   balanced: {
-    maxLineBytes:       512,                                                                         // allow:raw-byte-literal — RFC 2449 §4 response cap
-    maxUsernameBytes:   128,                                                                         // allow:raw-byte-literal — balanced username cap
-    maxPasswordBytes:   128,                                                                         // allow:raw-byte-literal — balanced password cap
+    maxLineBytes:       512,                                                                         // RFC 2449 §4 response cap
+    maxUsernameBytes:   128,                                                                         // balanced username cap
+    maxPasswordBytes:   128,                                                                         // balanced password cap
     allowBareLf:        false,
     allowApop:          true,
   },
   permissive: {
-    maxLineBytes:       1024,                                                                        // allow:raw-byte-literal — permissive cap for legacy peers
-    maxUsernameBytes:   256,                                                                         // allow:raw-byte-literal — permissive username cap
-    maxPasswordBytes:   256,                                                                         // allow:raw-byte-literal — permissive password cap
+    maxLineBytes:       1024,                                                                        // permissive cap for legacy peers
+    maxUsernameBytes:   256,                                                                         // permissive username cap
+    maxPasswordBytes:   256,                                                                         // permissive password cap
     allowBareLf:        true,
     allowApop:          true,
   },
@@ -173,10 +173,10 @@ function validate(line, opts) {
   }
   for (var i = 0; i < line.length; i += 1) {
     var c = line.charCodeAt(i);
-    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                       // allow:raw-byte-literal — control-byte refusal
+    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                       // control-byte refusal
       if (c === 0x0A && caps.allowBareLf) continue;
       throw new GuardPop3CommandError("guard-pop3-command/bad-byte",
-        "guardPop3Command.validate: control byte 0x" + c.toString(16) + " at offset " + i);          // allow:raw-byte-literal — hex format literal in error message
+        "guardPop3Command.validate: control byte 0x" + c.toString(16) + " at offset " + i);          // hex format literal in error message
     }
   }
 

package/lib/guard-posture-chain.js

@@ -32,9 +32,9 @@ var GuardPostureChainError = defineClass("GuardPostureChainError", { alwaysPerma
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxHops: 16,  maxHopBytes: 64,  maxRegimes: 8  },                                     // allow:raw-byte-literal
-  balanced:   { maxHops: 32,  maxHopBytes: 128, maxRegimes: 16 },                                     // allow:raw-byte-literal
-  permissive: { maxHops: 128, maxHopBytes: 256, maxRegimes: 64 },                                     // allow:raw-byte-literal
+  strict:     { maxHops: 16,  maxHopBytes: 64,  maxRegimes: 8  },
+  balanced:   { maxHops: 32,  maxHopBytes: 128, maxRegimes: 16 },
+  permissive: { maxHops: 128, maxHopBytes: 256, maxRegimes: 64 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -119,11 +119,11 @@ function validate(envelope, opts) {
     }
     for (var hi = 0; hi < hop.length; hi += 1) {
       var hc = hop.charCodeAt(hi);
-      if (hc > 0x7F) {                                                                                // allow:raw-byte-literal — ASCII-only
+      if (hc > 0x7F) {                                                                                // ASCII-only
         throw new GuardPostureChainError("posture-chain/non-ascii-hop",
           "guardPostureChain.validate: chainTrail[" + h + "] has non-ASCII codepoint");
       }
-      if (hc < 0x20 || hc === 0x7F) {                                                                 // allow:raw-byte-literal — C0/DEL
+      if (hc < 0x20 || hc === 0x7F) {                                                                 // C0/DEL
         throw new GuardPostureChainError("posture-chain/bad-hop-char",
           "guardPostureChain.validate: chainTrail[" + h + "] has forbidden char 0x" + hc.toString(16));
       }

package/lib/guard-regex.js

@@ -93,8 +93,8 @@ var PROFILES = Object.freeze({
     consecutiveStarPolicy:    "reject",
     nestedExtglobPolicy:      "reject",
     inputKind:                "regex",                                            // CVE-2026-26996 + CVE-2026-33671 detectors apply only when inputKind=="glob"
-    maxBoundedRepeat:          100,                                              // allow:raw-byte-literal — bounded repeat ceiling
-    maxConsecutiveStars:        2,                                                // allow:raw-byte-literal — `**` recursive glob permitted; >=3 refused
+    maxBoundedRepeat:          100,                                              // bounded repeat ceiling
+    maxConsecutiveStars:        2,                                                // `**` recursive glob permitted; >=3 refused
     maxPatternBytes:           C.BYTES.kib(1),
     maxBytes:                  C.BYTES.kib(1),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -110,8 +110,8 @@ var PROFILES = Object.freeze({
     lookaroundQuantPolicy:     "audit",
     consecutiveStarPolicy:    "reject",                                          // CVE-2026-26996 refused at every profile
     nestedExtglobPolicy:      "reject",                                          // CVE-2026-33671 refused at every profile
-    maxBoundedRepeat:          1000,                                             // allow:raw-byte-literal — bounded repeat ceiling
-    maxConsecutiveStars:        2,                                                // allow:raw-byte-literal — `**` recursive glob permitted; >=3 refused
+    maxBoundedRepeat:          1000,                                             // bounded repeat ceiling
+    maxConsecutiveStars:        2,                                                // `**` recursive glob permitted; >=3 refused
     maxPatternBytes:           C.BYTES.kib(2),
     maxBytes:                  C.BYTES.kib(2),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -127,8 +127,8 @@ var PROFILES = Object.freeze({
     lookaroundQuantPolicy:     "audit",
     consecutiveStarPolicy:    "reject",                                          // CVE-2026-26996 refused at every profile
     nestedExtglobPolicy:      "reject",                                          // CVE-2026-33671 refused at every profile
-    maxBoundedRepeat:          10000,                                            // allow:raw-byte-literal — bounded repeat ceiling
-    maxConsecutiveStars:        2,                                                // allow:raw-byte-literal — `**` recursive glob permitted; >=3 refused
+    maxBoundedRepeat:          10000,                                            // bounded repeat ceiling
+    maxConsecutiveStars:        2,                                                // `**` recursive glob permitted; >=3 refused
     maxPatternBytes:           C.BYTES.kib(8),
     maxBytes:                  C.BYTES.kib(8),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -223,9 +223,9 @@ function _detectIssues(input, opts) {
     BOUNDED_REPEAT_RE.lastIndex = 0;
     var match;
     while ((match = BOUNDED_REPEAT_RE.exec(input)) !== null) {                   // allow:regex-no-length-cap — input bounded by maxPatternBytes
-      var lower = parseInt(match[1], 10);                                        // allow:raw-byte-literal — base-10 radix
+      var lower = parseInt(match[1], 10);                                        // base-10 radix
       var upper = match[2] === undefined ? lower :
-                  match[2] === "" ? Infinity : parseInt(match[2], 10);           // allow:raw-byte-literal — base-10 radix
+                  match[2] === "" ? Infinity : parseInt(match[2], 10);           // base-10 radix
       var ceiling = (upper === Infinity || upper > lower) ? upper : lower;
       if (ceiling > opts.maxBoundedRepeat) {
         issues.push({
@@ -273,7 +273,7 @@ function _detectConsecutiveStar(input, opts, issues) {
     }
   }
   var starCeiling = opts.maxConsecutiveStars === undefined ?
-                    2 : opts.maxConsecutiveStars;                                // allow:raw-byte-literal — `**` glob ceiling
+                    2 : opts.maxConsecutiveStars;                                // `**` glob ceiling
   if (starRunMax > starCeiling) {
     issues.push({
       kind: "consecutive-star",
@@ -315,7 +315,7 @@ function _detectNestedExtglob(input, opts, issues) {
     }
     heads.push(idx);
     scanFrom = idx + 1;
-    if (heads.length > 1024) break;                                              // allow:raw-byte-literal — head-count safety cap
+    if (heads.length > 1024) break;                                              // head-count safety cap
   }
   var nested = false;
   for (var hi = 0; hi < heads.length && !nested; hi += 1) {

package/lib/guard-saga-config.js

@@ -22,9 +22,9 @@ var GuardSagaConfigError = defineClass("GuardSagaConfigError", { alwaysPermanent
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxSteps: 32,   maxNameBytes: 64  },                                                  // allow:raw-byte-literal
-  balanced:   { maxSteps: 128,  maxNameBytes: 128 },                                                  // allow:raw-byte-literal
-  permissive: { maxSteps: 512,  maxNameBytes: 256 },                                                  // allow:raw-byte-literal
+  strict:     { maxSteps: 32,   maxNameBytes: 64  },
+  balanced:   { maxSteps: 128,  maxNameBytes: 128 },
+  permissive: { maxSteps: 512,  maxNameBytes: 256 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -72,11 +72,11 @@ function validate(config, opts) {
   }
   for (var i = 0; i < config.name.length; i += 1) {
     var c = config.name.charCodeAt(i);
-    if (c > 0x7F) {                                                                                   // allow:raw-byte-literal — ASCII-only
+    if (c > 0x7F) {                                                                                   // ASCII-only
       throw new GuardSagaConfigError("saga-config/non-ascii-name",
         "guardSagaConfig.validate: name has non-ASCII codepoint at offset " + i);
     }
-    if (c < 0x20 || c === 0x7F) {                                                                     // allow:raw-byte-literal — C0/DEL
+    if (c < 0x20 || c === 0x7F) {                                                                     // C0/DEL
       throw new GuardSagaConfigError("saga-config/bad-name-char",
         "guardSagaConfig.validate: name has forbidden char 0x" + c.toString(16));
     }

package/lib/guard-smtp-command.js

@@ -98,9 +98,9 @@ var DEFAULT_PROFILE = "strict";
 // CRLF). SMTPUTF8 / EAI extends this in practice; balanced/permissive
 // raise the cap accordingly.
 var PROFILES = Object.freeze({
-  strict:     { maxLineBytes: 512, maxMailbox: 256, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: false },                                                                          // allow:raw-byte-literal — RFC 5321 §4.5.3.1.1 caps
-  balanced:   { maxLineBytes: 1024, maxMailbox: 320, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: true },                                                                          // allow:raw-byte-literal — SMTPUTF8 (RFC 6531) line cap
-  permissive: { maxLineBytes: 4096, maxMailbox: 512, maxLocalPart: 64, maxDomain: 255, allowBareLf: true,  allowSmtpUtf8: true },                                                                          // allow:raw-byte-literal — permissive cap for legacy peers
+  strict:     { maxLineBytes: 512, maxMailbox: 256, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: false },                                                                          // RFC 5321 §4.5.3.1.1 caps
+  balanced:   { maxLineBytes: 1024, maxMailbox: 320, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: true },                                                                          // SMTPUTF8 (RFC 6531) line cap
+  permissive: { maxLineBytes: 4096, maxMailbox: 512, maxLocalPart: 64, maxDomain: 255, allowBareLf: true,  allowSmtpUtf8: true },                                                                          // permissive cap for legacy peers
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -191,12 +191,12 @@ function validate(line, opts) {
     // bare-LF refusal earlier in this fn. Skip the control-char throw
     // so the documented allowBareLf path actually accepts LF (Codex
     // caught this: permissive profile was effectively broken).
-    if (c === 0x0a && caps.allowBareLf) continue;                                                                                                                                                            // allow:raw-byte-literal — RFC 5321 §2.3.8 LF, permissive bypass
-    if (c < 0x20 || c === 0x7f) {                                                                                                                                                                          // allow:raw-byte-literal — RFC 5321 §2.3.8 forbids C0 / DEL
+    if (c === 0x0a && caps.allowBareLf) continue;                                                                                                                                                            // RFC 5321 §2.3.8 LF, permissive bypass
+    if (c < 0x20 || c === 0x7f) {                                                                                                                                                                          // RFC 5321 §2.3.8 forbids C0 / DEL
       throw new GuardSmtpCommandError("guard-smtp-command/control-char",
         "guardSmtpCommand.validate: control char 0x" + c.toString(16) + " refused");
     }
-    if (!caps.allowSmtpUtf8 && c > 0x7e) {                                                                                                                                                                 // allow:raw-byte-literal — RFC 5321 §2.3.1 7-bit ASCII; SMTPUTF8 relaxes
+    if (!caps.allowSmtpUtf8 && c > 0x7e) {                                                                                                                                                                 // RFC 5321 §2.3.1 7-bit ASCII; SMTPUTF8 relaxes
       throw new GuardSmtpCommandError("guard-smtp-command/non-ascii",
         "guardSmtpCommand.validate: non-ASCII byte refused (no SMTPUTF8 negotiated)");
     }