@blamejs/core 0.14.1 → 0.14.2

package/lib/guard-time.js

@@ -57,9 +57,9 @@ var _err = GuardTimeError.factory;
 //   7: fractional incl. dot (optional)              8: offset (Z or +HH:MM/-HH:MM)
 var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt ](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})?$/;
 
-var DEFAULT_MIN_YEAR = 1970;                                                     // allow:raw-byte-literal — Unix epoch year
-var DEFAULT_MAX_YEAR = 9999;                                                     // allow:raw-byte-literal — RFC 3339 4-digit year ceiling
-var MAX_FRACTIONAL_DIGITS = 9;                                                   // allow:raw-byte-literal — nanosecond precision cap
+var DEFAULT_MIN_YEAR = 1970;                                                     // Unix epoch year
+var DEFAULT_MAX_YEAR = 9999;                                                     // RFC 3339 4-digit year ceiling
+var MAX_FRACTIONAL_DIGITS = 9;                                                   // nanosecond precision cap
 
 // ---- Profile presets ----
 
@@ -206,12 +206,12 @@ function _detectIssues(input, opts) {
     return issues;
   }
 
-  var year = parseInt(match[1], 10);                                             // allow:raw-byte-literal — base-10 radix
-  var month = parseInt(match[2], 10);                                            // allow:raw-byte-literal — base-10 radix
-  var day = parseInt(match[3], 10);                                              // allow:raw-byte-literal — base-10 radix
-  var hour = parseInt(match[4], 10);                                             // allow:raw-byte-literal — base-10 radix
-  var minute = parseInt(match[5], 10);                                           // allow:raw-byte-literal — base-10 radix
-  var second = parseInt(match[6], 10);                                           // allow:raw-byte-literal — base-10 radix
+  var year = parseInt(match[1], 10);                                             // base-10 radix
+  var month = parseInt(match[2], 10);                                            // base-10 radix
+  var day = parseInt(match[3], 10);                                              // base-10 radix
+  var hour = parseInt(match[4], 10);                                             // base-10 radix
+  var minute = parseInt(match[5], 10);                                           // base-10 radix
+  var second = parseInt(match[6], 10);                                           // base-10 radix
   var fractional = match[7] || "";
   var offset = match[8];
 
@@ -226,28 +226,28 @@ function _detectIssues(input, opts) {
   }
 
   // Month / day / hour / minute structural ranges.
-  if (month < 1 || month > 12) {                                                 // allow:raw-byte-literal — month range
+  if (month < 1 || month > 12) {                                                 // month range
     issues.push({
       kind: "month-range", severity: "high",
       ruleId: "time.month-range",
       snippet: "month " + month + " outside [1, 12]",
     });
   }
-  if (day < 1 || day > 31) {                                                     // allow:raw-byte-literal — day-of-month upper bound
+  if (day < 1 || day > 31) {                                                     // day-of-month upper bound
     issues.push({
       kind: "day-range", severity: "high",
       ruleId: "time.day-range",
       snippet: "day " + day + " outside [1, 31]",
     });
   }
-  if (hour > 23) {                                                               // allow:raw-byte-literal — hour ceiling
+  if (hour > 23) {                                                               // hour ceiling
     issues.push({
       kind: "hour-range", severity: "high",
       ruleId: "time.hour-range",
       snippet: "hour " + hour + " > 23",
     });
   }
-  if (minute > 59) {                                                             // allow:raw-byte-literal — minute ceiling
+  if (minute > 59) {                                                             // minute ceiling
     issues.push({
       kind: "minute-range", severity: "high",
       ruleId: "time.minute-range",
@@ -277,8 +277,8 @@ function _detectIssues(input, opts) {
   // Day-in-month structural sanity (light — not full Gregorian
   // rollover; the framework refuses obviously-out-of-bounds dates
   // like Feb 30 / Apr 31).
-  var daysInMonth = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];            // allow:raw-byte-literal — Gregorian month-day table
-  if (month >= 1 && month <= 12 && day > daysInMonth[month - 1]) {               // allow:raw-byte-literal — month range
+  var daysInMonth = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];            // Gregorian month-day table
+  if (month >= 1 && month <= 12 && day > daysInMonth[month - 1]) {               // month range
     issues.push({
       kind: "day-in-month", severity: "high",
       ruleId: "time.day-in-month",

package/lib/guard-trace-context.js

@@ -33,9 +33,9 @@ var GuardTraceContextError = defineClass("GuardTraceContextError", { alwaysPerma
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { allowedVersions: ["00"],       maxTracestateEntries: 32, maxTracestateBytes: 512  },  // allow:raw-byte-literal
-  balanced:   { allowedVersions: ["00", "01"], maxTracestateEntries: 32, maxTracestateBytes: 512  },  // allow:raw-byte-literal
-  permissive: { allowedVersions: ["*"],         maxTracestateEntries: 64, maxTracestateBytes: 1024 }, // allow:raw-byte-literal
+  strict:     { allowedVersions: ["00"],       maxTracestateEntries: 32, maxTracestateBytes: 512  },
+  balanced:   { allowedVersions: ["00", "01"], maxTracestateEntries: 32, maxTracestateBytes: 512  },
+  permissive: { allowedVersions: ["*"],         maxTracestateEntries: 64, maxTracestateBytes: 1024 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -79,7 +79,7 @@ function validate(ctx, opts) {
   }
   // Length bound BEFORE regex test so a hostile input can't burn
   // regex-engine CPU. W3C section 3.2.1: exactly 55 chars.
-  if (ctx.traceparent.length !== 55) {                                                                // allow:raw-byte-literal — W3C fixed length
+  if (ctx.traceparent.length !== 55) {                                                                // W3C fixed length
     throw new GuardTraceContextError("trace-context/bad-traceparent-length",
       "guardTraceContext.validate: traceparent must be exactly 55 chars (got " +
       ctx.traceparent.length + ")");

package/lib/guard-uuid.js

@@ -77,7 +77,7 @@ var PROFILES = Object.freeze({
     maxPolicy:         "reject",
     urnPolicy:         "reject",
     bracedPolicy:      "reject",
-    allowedVersions:   [1, 2, 3, 4, 5, 6, 7, 8],                                 // allow:raw-byte-literal — UUID version digits
+    allowedVersions:   [1, 2, 3, 4, 5, 6, 7, 8],                                 // UUID version digits
     maxBytes:          C.BYTES.bytes(64),
     maxRuntimeMs:      C.TIME.seconds(2),
   },
@@ -93,7 +93,7 @@ var PROFILES = Object.freeze({
     maxPolicy:         "audit",
     urnPolicy:         "audit",
     bracedPolicy:      "audit",
-    allowedVersions:   [1, 2, 3, 4, 5, 6, 7, 8],                                 // allow:raw-byte-literal — UUID version digits
+    allowedVersions:   [1, 2, 3, 4, 5, 6, 7, 8],                                 // UUID version digits
     maxBytes:          C.BYTES.bytes(64),
     maxRuntimeMs:      C.TIME.seconds(2),
   },
@@ -155,8 +155,8 @@ function _classifyForm(input) {
 function _toCanonicalHex(input, form) {
   // Strips dashes / braces / urn prefix, returns 32-char lowercase hex.
   var s = input.toLowerCase();
-  if (form === "urn")     s = s.slice("urn:uuid:".length);                       // allow:raw-byte-literal — string-length offset
-  if (form === "braced")  s = s.slice(1, -1);                                    // allow:raw-byte-literal — string-length offset
+  if (form === "urn")     s = s.slice("urn:uuid:".length);                       // string-length offset
+  if (form === "braced")  s = s.slice(1, -1);                                    // string-length offset
   return s.replace(/-/g, "");
 }
 
@@ -253,8 +253,8 @@ function _detectIssues(input, opts) {
   // Version + variant inspection (skip for nil / max — those bypass the
   // version-bits check by definition).
   if (hex !== NIL_HEX && hex !== MAX_HEX) {
-    var versionDigit = parseInt(hex.charAt(12), 16);                             // allow:raw-byte-literal — hex digit position 12
-    var variantNibble = parseInt(hex.charAt(16), 16);                            // allow:raw-byte-literal — hex digit position 16
+    var versionDigit = parseInt(hex.charAt(12), 16);                             // hex digit position 12
+    var variantNibble = parseInt(hex.charAt(16), 16);                            // hex digit position 16
 
     if (opts.versionPolicy !== "allow") {
       var allowed = opts.allowedVersions;
@@ -274,13 +274,13 @@ function _detectIssues(input, opts) {
     if (opts.variantPolicy !== "allow") {
       // RFC 4122 / 9562 variant: high two bits of the variant nibble are
       // 10xx (i.e. nibble in 8/9/a/b).
-      var isRfcVariant = (variantNibble & 0xC) === 0x8;                          // allow:raw-byte-literal — variant-bit mask
+      var isRfcVariant = (variantNibble & 0xC) === 0x8;                          // variant-bit mask
       if (!isRfcVariant) {
         issues.push({
           kind: "variant-non-rfc",
           severity: opts.variantPolicy === "reject-non-rfc" ? "high" : "warn",
           ruleId: "uuid.variant-non-rfc",
-          snippet: "uuid variant nibble `" + hex.charAt(16) + "` is not " +    // allow:raw-byte-literal — hex digit position 16
+          snippet: "uuid variant nibble `" + hex.charAt(16) + "` is not " +    // hex digit position 16
                    "the RFC 4122 / 9562 variant (10xx — nibble 8-b)",
         });
       }
@@ -393,9 +393,9 @@ function sanitize(input, opts) {
   var form = _classifyForm(input);
   if (!form) return input;
   var hex = _toCanonicalHex(input, form);
-  return hex.slice(0, 8) + "-" + hex.slice(8, 12) + "-" +                        // allow:raw-byte-literal — UUID hex slice positions
-         hex.slice(12, 16) + "-" + hex.slice(16, 20) + "-" +                     // allow:raw-byte-literal — UUID hex slice positions
-         hex.slice(20);                                                          // allow:raw-byte-literal — UUID hex slice positions
+  return hex.slice(0, 8) + "-" + hex.slice(8, 12) + "-" +                        // UUID hex slice positions
+         hex.slice(12, 16) + "-" + hex.slice(16, 20) + "-" +                     // UUID hex slice positions
+         hex.slice(20);                                                          // UUID hex slice positions
 }
 
 /**

package/lib/guard-xml.js

@@ -118,11 +118,11 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "reject",
     zeroWidthPolicy:        "reject",
     maxBytes:               C.BYTES.mib(2),
-    maxDepth:               64,                                                  // allow:raw-byte-literal — recursion depth, not byte size
-    maxElements:            8192,                                                // allow:raw-byte-literal — element count cap, not byte size
-    maxAttrsPerElement:     64,                                                  // allow:raw-byte-literal — attr count, not byte size
+    maxDepth:               64,                                                  // recursion depth, not byte size
+    maxElements:            8192,                                                // element count cap, not byte size
+    maxAttrsPerElement:     64,                                                  // attr count, not byte size
     maxAttrValueBytes:      C.BYTES.kib(8),
-    maxNumericCharRefs:     1024,                                                // allow:raw-byte-literal — NCR fan-out cap (CVE-2026-26278)
+    maxNumericCharRefs:     1024,                                                // NCR fan-out cap (CVE-2026-26278)
   },
   "balanced": {
     doctypePolicy:          "reject",                // DOCTYPE is XXE vector regardless
@@ -138,11 +138,11 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "strip",
     zeroWidthPolicy:        "strip",
     maxBytes:               C.BYTES.mib(8),
-    maxDepth:               256,                                                 // allow:raw-byte-literal — recursion depth, not byte size
-    maxElements:            65536,                                               // allow:raw-byte-literal — element count cap, not byte size
-    maxAttrsPerElement:     128,                                                 // allow:raw-byte-literal — attr count, not byte size
+    maxDepth:               256,                                                 // recursion depth, not byte size
+    maxElements:            65536,                                               // element count cap, not byte size
+    maxAttrsPerElement:     128,                                                 // attr count, not byte size
     maxAttrValueBytes:      C.BYTES.kib(32),
-    maxNumericCharRefs:     16384,                                               // allow:raw-byte-literal — NCR fan-out cap (CVE-2026-26278)
+    maxNumericCharRefs:     16384,                                               // NCR fan-out cap (CVE-2026-26278)
   },
   "permissive": {
     doctypePolicy:          "reject",                // billion-laughs class always
@@ -158,11 +158,11 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "reject",
     zeroWidthPolicy:        "strip",
     maxBytes:               C.BYTES.mib(64),
-    maxDepth:               1024,                                                // allow:raw-byte-literal — recursion depth, not byte size
-    maxElements:            262144,                                              // allow:raw-byte-literal — element count cap, not byte size
-    maxAttrsPerElement:     256,                                                 // allow:raw-byte-literal — attr count, not byte size
+    maxDepth:               1024,                                                // recursion depth, not byte size
+    maxElements:            262144,                                              // element count cap, not byte size
+    maxAttrsPerElement:     256,                                                 // attr count, not byte size
     maxAttrValueBytes:      C.BYTES.kib(64),
-    maxNumericCharRefs:     262144,                                              // allow:raw-byte-literal — NCR fan-out cap (CVE-2026-26278)
+    maxNumericCharRefs:     262144,                                              // NCR fan-out cap (CVE-2026-26278)
   },
 });
 

package/lib/guard-yaml.js

@@ -126,11 +126,11 @@ var PROFILES = Object.freeze({
     zeroWidthPolicy:        "reject",
     safeCoreTagsAllowed:    false,
     maxBytes:               C.BYTES.mib(2),
-    maxDepth:               8,                                                   // allow:raw-byte-literal — recursion depth, not byte size
-    maxAnchors:             16,                                                  // allow:raw-byte-literal — anchor count cap, not byte size
-    maxAliasDepth:          1,                                                   // allow:raw-byte-literal — alias chain cap, not byte size
-    maxDocuments:           1,                                                   // allow:raw-byte-literal — doc count cap, not byte size
-    maxNodes:               1024,                                                // allow:raw-byte-literal — node count cap, not byte size
+    maxDepth:               8,                                                   // recursion depth, not byte size
+    maxAnchors:             16,                                                  // anchor count cap, not byte size
+    maxAliasDepth:          1,                                                   // alias chain cap, not byte size
+    maxDocuments:           1,                                                   // doc count cap, not byte size
+    maxNodes:               1024,                                                // node count cap, not byte size
     maxScalarLength:        C.BYTES.kib(8),
   },
   "balanced": {
@@ -147,11 +147,11 @@ var PROFILES = Object.freeze({
     zeroWidthPolicy:        "strip",
     safeCoreTagsAllowed:    true,
     maxBytes:               C.BYTES.mib(8),
-    maxDepth:               32,                                                  // allow:raw-byte-literal — recursion depth, not byte size
-    maxAnchors:             64,                                                  // allow:raw-byte-literal — anchor count cap, not byte size
-    maxAliasDepth:          3,                                                   // allow:raw-byte-literal — alias chain cap, not byte size
-    maxDocuments:           16,                                                  // allow:raw-byte-literal — doc count cap, not byte size
-    maxNodes:               16384,                                               // allow:raw-byte-literal — node count cap, not byte size
+    maxDepth:               32,                                                  // recursion depth, not byte size
+    maxAnchors:             64,                                                  // anchor count cap, not byte size
+    maxAliasDepth:          3,                                                   // alias chain cap, not byte size
+    maxDocuments:           16,                                                  // doc count cap, not byte size
+    maxNodes:               16384,                                               // node count cap, not byte size
     maxScalarLength:        C.BYTES.kib(64),
   },
   "permissive": {
@@ -168,11 +168,11 @@ var PROFILES = Object.freeze({
     zeroWidthPolicy:        "strip",
     safeCoreTagsAllowed:    true,
     maxBytes:               C.BYTES.mib(64),
-    maxDepth:               64,                                                  // allow:raw-byte-literal — recursion depth, not byte size
-    maxAnchors:             1024,                                                // allow:raw-byte-literal — anchor count cap, not byte size
-    maxAliasDepth:          8,                                                   // allow:raw-byte-literal — alias chain cap, not byte size
-    maxDocuments:           256,                                                 // allow:raw-byte-literal — doc count cap, not byte size
-    maxNodes:               65536,                                               // allow:raw-byte-literal — node count cap, not byte size
+    maxDepth:               64,                                                  // recursion depth, not byte size
+    maxAnchors:             1024,                                                // anchor count cap, not byte size
+    maxAliasDepth:          8,                                                   // alias chain cap, not byte size
+    maxDocuments:           256,                                                 // doc count cap, not byte size
+    maxNodes:               65536,                                               // node count cap, not byte size
     maxScalarLength:        C.BYTES.kib(256),
   },
 });
@@ -314,7 +314,7 @@ function _detectIssues(input, opts) {
   // is ratio >= 8. Independent of maxAnchors absolute cap (which is
   // about overall load); ratio is about exponential expansion shape.
   var ampRatio = aliases.length / Math.max(anchors.length, 1);
-  if (anchors.length >= 1 && ampRatio >= 8) {                                    // allow:raw-byte-literal — multiplier ratio, not byte size
+  if (anchors.length >= 1 && ampRatio >= 8) {                                    // multiplier ratio, not byte size
     issues.push({
       kind: "alias-explosion", severity: "critical",
       ruleId: "yaml.alias-explosion",

package/lib/honeytoken.js

@@ -40,10 +40,10 @@ var audit = lazyRequire(function () { return require("./audit"); });
 var HoneytokenError = defineClass("HoneytokenError", { alwaysPermanent: true });
 
 var KINDS = Object.freeze({
-  apiKey:  function () { return "bk_canary_"  + bCrypto.generateToken(16); },     // allow:raw-byte-literal — 16-byte (128-bit) canary entropy
-  session: function () { return "bks_canary_" + bCrypto.generateToken(24); },     // allow:raw-byte-literal — 24-byte (192-bit) canary entropy
-  url:     function () { return "/admin/canary-" + bCrypto.generateToken(16); },  // allow:raw-byte-literal — 16-byte canary entropy
-  rowId:   function () { return "ht_canary_"  + bCrypto.generateToken(16); },     // allow:raw-byte-literal — 16-byte canary entropy
+  apiKey:  function () { return "bk_canary_"  + bCrypto.generateToken(16); },     // 16-byte (128-bit) canary entropy
+  session: function () { return "bks_canary_" + bCrypto.generateToken(24); },     // 24-byte (192-bit) canary entropy
+  url:     function () { return "/admin/canary-" + bCrypto.generateToken(16); },  // 16-byte canary entropy
+  rowId:   function () { return "ht_canary_"  + bCrypto.generateToken(16); },     // 16-byte canary entropy
 });
 
 /**
@@ -102,7 +102,7 @@ function create(opts) {
         "(supported: " + Object.keys(KINDS).join(", ") + ")");
     }
     var value = KINDS[kind]();
-    var id = "ht_" + bCrypto.generateToken(8);                                    // allow:raw-byte-literal — 8-byte registry id
+    var id = "ht_" + bCrypto.generateToken(8);                                    // 8-byte registry id
     var record = Object.freeze({
       id:        id,
       kind:      kind,

package/lib/http-client.js

@@ -1035,7 +1035,7 @@ function _revalidate(cache, method, opts, entry, requestHeaders) {
 
   return p.then(function (boxed) {
     var res = boxed.res;
-    if (res.statusCode === 304) {                                                            // allow:raw-byte-literal — HTTP 304 Not Modified status code, not bytes
+    if (res.statusCode === 304) {                                                            // HTTP 304 Not Modified status code, not bytes
       // Merge 304 headers into the stored entry.
       var refreshed;
       try { refreshed = cache._refreshFrom304(entry, res.headers); }

package/lib/http-message-signature.js

@@ -91,7 +91,7 @@ function _sfQuotedString(s) {
   // information.
   for (var i = 0; i < s.length; i++) {
     var c = s.charCodeAt(i);
-    if (c < 0x20 || c > 0x7E) {                                                  // allow:raw-byte-literal — RFC 8941 §3.3.3 printable-ASCII range
+    if (c < 0x20 || c > 0x7E) {                                                  // RFC 8941 §3.3.3 printable-ASCII range
       throw _err("BAD_PARAM",
         "httpSig: parameter string contains non-printable byte at offset " + i);
     }
@@ -539,7 +539,7 @@ function verify(msg, opts) {
   var sigB64;
   try { sigB64 = _parseSignature(sig, parsedInput.label); }
   catch (e) { return { valid: false, reason: "bad-signature-header", error: e.message }; }
-  if (!safeBuffer.BASE64URL_RE && typeof sigB64 !== "string") {                  // allow:raw-byte-literal — defensive base64 shape check
+  if (!safeBuffer.BASE64URL_RE && typeof sigB64 !== "string") {                  // defensive base64 shape check
     return { valid: false, reason: "bad-signature-encoding" };
   }
   var sigBuf;

package/lib/iab-mspa.js

@@ -35,7 +35,7 @@ var IabMspaError = defineClass("IabMspaError", { alwaysPermanent: true });
 // https://iabtechlab.com/standards/global-privacy-platform/sections).
 var SECTION_IDS = {
   7:  "usnat",  // US National Privacy
-  8:  "usca",   // California (CCPA / CPRA)                                                  // allow:raw-byte-literal — IAB GPP section ID, not bytes
+  8:  "usca",   // California (CCPA / CPRA)                                                  // IAB GPP section ID, not bytes
   9:  "usva",   // Virginia
   10: "usco",   // Colorado
   11: "usut",   // Utah
@@ -43,7 +43,7 @@ var SECTION_IDS = {
   13: "usnv",   // Nevada
   14: "usia",   // Iowa
   15: "usde",   // Delaware
-  16: "usnj",   // New Jersey                                                               // allow:raw-byte-literal — IAB GPP section ID, not bytes
+  16: "usnj",   // New Jersey                                                               // IAB GPP section ID, not bytes
   17: "ustx",   // Texas (TDPSA)
   18: "usor",   // Oregon
   19: "usmt",   // Montana
@@ -77,7 +77,7 @@ function parseGpp(gppString) {
     throw IabMspaError.factory("iab-mspa/bad-input",
       "iabMspa.parseGpp: gppString required");
   }
-  if (gppString.length > 8192) {                                                              // allow:raw-byte-literal — GPP string cap, not bytes
+  if (gppString.length > 8192) {                                                              // GPP string cap, not bytes
     throw IabMspaError.factory("iab-mspa/input-too-large",
       "iabMspa.parseGpp: gppString exceeds 8192 chars");
   }