@blamejs/core 0.14.1 → 0.14.2

package/lib/mail-deploy.js

@@ -66,14 +66,14 @@ var TlsRptParseError = defineClass("TlsRptParseError", { alwaysPermanent: true }
 var STS_MODES = Object.freeze({ enforce: 1, testing: 1, none: 1 });
 
 function _domainOk(d) {
-  if (typeof d !== "string" || d.length === 0 || d.length > 253) return false;                        // allow:raw-byte-literal — RFC 1035 §2.3.4
+  if (typeof d !== "string" || d.length === 0 || d.length > 253) return false;                        // RFC 1035 §2.3.4
   // Bounded LDH check; we don't pull in b.guardDomain here because
   // the helper is text-generation and the operator owns the value.
   // Refuse C0 (covers CR / LF / NUL), DEL, and `"` outright —
   // header-injection class + XML-attribute-injection class.
   for (var i = 0; i < d.length; i++) {
     var c = d.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F || c === 0x22) return false;                                           // allow:raw-byte-literal — refuse C0 / DEL / "
+    if (c < 0x20 || c === 0x7F || c === 0x22) return false;                                           // refuse C0 / DEL / "
   }
   return true;
 }
@@ -134,13 +134,13 @@ function mtaStsPublish(opts) {
     throw new MailDeployError("mail-deploy/bad-mx",
       "mtaStsPublish: opts.mxHosts must be a non-empty array");
   }
-  if (opts.mxHosts.length > 64) {                                                                     // allow:raw-byte-literal — array cap
+  if (opts.mxHosts.length > 64) {                                                                     // array cap
     throw new MailDeployError("mail-deploy/bad-mx",
       "mtaStsPublish: opts.mxHosts must contain at most 64 entries");
   }
   for (var i = 0; i < opts.mxHosts.length; i++) {
     var m = opts.mxHosts[i];
-    if (typeof m !== "string" || m.length === 0 || m.length > 253) {                                  // allow:raw-byte-literal — RFC 1035 cap
+    if (typeof m !== "string" || m.length === 0 || m.length > 253) {                                  // RFC 1035 cap
       throw new MailDeployError("mail-deploy/bad-mx",
         "mtaStsPublish: opts.mxHosts[" + i + "] invalid");
     }
@@ -175,14 +175,14 @@ function mtaStsPublish(opts) {
   // so peers can detect the change without re-fetching every fetch.
   var policyId;
   if (typeof opts.policyId === "string" && opts.policyId.length > 0) {
-    if (!/^[a-zA-Z0-9_-]{1,32}$/.test(opts.policyId)) {                                               // allow:raw-byte-literal — RFC 8461 §3.1 token shape
+    if (!/^[a-zA-Z0-9_-]{1,32}$/.test(opts.policyId)) {                                               // RFC 8461 §3.1 token shape
       throw new MailDeployError("mail-deploy/bad-policy-id",
         "mtaStsPublish: opts.policyId must match [a-zA-Z0-9_-]{1,32}");
     }
     policyId = opts.policyId;
   } else {
     // ISO 8601 timestamp w/o punctuation = unique-by-second.
-    policyId = new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 16);                         // allow:raw-byte-literal — yyyymmddhhmmssms
+    policyId = new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 16);                         // yyyymmddhhmmssms
   }
 
   return {
@@ -229,7 +229,7 @@ function danePublish(opts) {
     MailDeployError, "mail-deploy/bad-opts");
   validateOpts.requireNonEmptyString(opts.certPem,
     "b.mail.deploy.danePublish: opts.certPem", MailDeployError, "mail-deploy/bad-cert");
-  if (opts.certPem.length > 65536) {                                                                  // allow:raw-byte-literal — sanity cap on PEM input
+  if (opts.certPem.length > 65536) {                                                                  // sanity cap on PEM input
     throw new MailDeployError("mail-deploy/bad-cert",
       "danePublish: opts.certPem too large");
   }
@@ -237,14 +237,14 @@ function danePublish(opts) {
     throw new MailDeployError("mail-deploy/bad-mx-host",
       "danePublish: opts.mxHost must be a valid hostname");
   }
-  var port = opts.port === undefined ? 25 : opts.port;                                                // allow:raw-byte-literal — RFC 7672 §3.1 default port
-  if (!numericBounds.isPositiveFiniteInt(port) || port > 65535) {                                     // allow:raw-byte-literal — IANA port range
+  var port = opts.port === undefined ? 25 : opts.port;                                                // RFC 7672 §3.1 default port
+  if (!numericBounds.isPositiveFiniteInt(port) || port > 65535) {                                     // IANA port range
     throw new MailDeployError("mail-deploy/bad-port",
       "danePublish: opts.port must be 1..65535");
   }
-  var usage     = opts.usage === undefined ? 3 : opts.usage;                                          // allow:raw-byte-literal — DANE-EE
-  var selector  = opts.selector === undefined ? 1 : opts.selector;                                    // allow:raw-byte-literal — SPKI
-  var matchType = opts.matchType === undefined ? 1 : opts.matchType;                                  // allow:raw-byte-literal — SHA-256
+  var usage     = opts.usage === undefined ? 3 : opts.usage;                                          // DANE-EE
+  var selector  = opts.selector === undefined ? 1 : opts.selector;                                    // SPKI
+  var matchType = opts.matchType === undefined ? 1 : opts.matchType;                                  // SHA-256
   if ([0, 1, 2, 3].indexOf(usage) === -1) {
     throw new MailDeployError("mail-deploy/bad-usage",
       "danePublish: opts.usage must be 0|1|2|3 (RFC 6698 §2.1.1)");
@@ -330,7 +330,7 @@ function autoConfigXml(opts) {
   }
   var brand = typeof opts.displayName === "string" && opts.displayName.length > 0 ?
               opts.displayName : opts.domain;
-  if (brand.length > 256) {                                                                           // allow:raw-byte-literal — DOM attr cap
+  if (brand.length > 256) {                                                                           // DOM attr cap
     throw new MailDeployError("mail-deploy/bad-displayName",
       "autoConfigXml: opts.displayName too long");
   }
@@ -347,7 +347,7 @@ function autoConfigXml(opts) {
       throw new MailDeployError("mail-deploy/bad-host",
         "autoConfigXml: opts." + protocol + ".host invalid");
     }
-    if (!numericBounds.isPositiveFiniteInt(cfg.port) || cfg.port > 65535) {                           // allow:raw-byte-literal — IANA port
+    if (!numericBounds.isPositiveFiniteInt(cfg.port) || cfg.port > 65535) {                           // IANA port
       throw new MailDeployError("mail-deploy/bad-port",
         "autoConfigXml: opts." + protocol + ".port invalid");
     }
@@ -368,14 +368,14 @@ function autoConfigXml(opts) {
   // `jmapServer` per the Mozilla draft + Fastmail convention).
   function _jmapServer(cfg) {
     if (!cfg) return "";
-    if (typeof cfg.url !== "string" || cfg.url.length === 0 || cfg.url.length > 1024) {               // allow:raw-byte-literal — URL cap
+    if (typeof cfg.url !== "string" || cfg.url.length === 0 || cfg.url.length > 1024) {               // URL cap
       throw new MailDeployError("mail-deploy/bad-jmap-url",
         "autoConfigXml: opts.jmap.url must be a non-empty string");
     }
     // Refuse control bytes / quote in the URL.
     for (var k = 0; k < cfg.url.length; k++) {
       var c = cfg.url.charCodeAt(k);
-      if (c < 0x20 || c === 0x7F || c === 0x22) {                                                     // allow:raw-byte-literal — C0 / DEL / "
+      if (c < 0x20 || c === 0x7F || c === 0x22) {                                                     // C0 / DEL / "
         throw new MailDeployError("mail-deploy/bad-jmap-url",
           "autoConfigXml: opts.jmap.url contains control byte");
       }
@@ -437,14 +437,14 @@ function autoConfigXml(opts) {
 function autoDiscoverXml(opts) {
   validateOpts.requireObject(opts || {}, "b.mail.deploy.autoDiscoverXml",
     MailDeployError, "mail-deploy/bad-opts");
-  if (typeof opts.email !== "string" || opts.email.length === 0 || opts.email.length > 254) {        // allow:raw-byte-literal — RFC 5321 cap
+  if (typeof opts.email !== "string" || opts.email.length === 0 || opts.email.length > 254) {        // RFC 5321 cap
     throw new MailDeployError("mail-deploy/bad-email",
       "autoDiscoverXml: opts.email must be a non-empty string");
   }
   // Refuse CR / LF / NUL / control bytes in email (XML injection class).
   for (var i = 0; i < opts.email.length; i++) {
     var c = opts.email.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                     // allow:raw-byte-literal — C0 / DEL
+    if (c < 0x20 || c === 0x7F) {                                                                     // C0 / DEL
       throw new MailDeployError("mail-deploy/bad-email",
         "autoDiscoverXml: opts.email contains control byte");
     }
@@ -455,7 +455,7 @@ function autoDiscoverXml(opts) {
       throw new MailDeployError("mail-deploy/bad-host",
         "autoDiscoverXml: opts." + kind.toLowerCase() + ".host invalid");
     }
-    if (!numericBounds.isPositiveFiniteInt(cfg.port) || cfg.port > 65535) {                           // allow:raw-byte-literal — IANA port
+    if (!numericBounds.isPositiveFiniteInt(cfg.port) || cfg.port > 65535) {                           // IANA port
       throw new MailDeployError("mail-deploy/bad-port",
         "autoDiscoverXml: opts." + kind.toLowerCase() + ".port invalid");
     }
@@ -530,13 +530,13 @@ function autoDiscoverXml(opts) {
 // integer overflow) and the decompression-amplification class
 // (CWE-409), plus the §5.2 community ceiling (receivers commonly cap
 // at 10 MiB).
-var TLSRPT_MAX_COMPRESSED_BYTES   = C.BYTES.mib(4);                                                   // allow:raw-byte-literal — 4 MiB compressed cap per §5.2 community practice
-var TLSRPT_MAX_DECOMPRESSED_BYTES = C.BYTES.mib(32);                                                  // allow:raw-byte-literal — 32 MiB decompressed cap (operators override via opts)
-var TLSRPT_MAX_RATIO              = 50;                                                               // allow:raw-byte-literal — 50:1 compression ratio refusal
-var TLSRPT_MAX_POLICIES           = 1000;                                                             // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §4.4 policy-cardinality cap
-var TLSRPT_MAX_FAILURE_DETAILS    = 10000;                                                            // allow:raw-byte-literal — per-policy failure-details cap
-var TLSRPT_GZIP_MAGIC_0           = 0x1f;                                                             // allow:raw-byte-literal — RFC 1952 gzip magic byte 0
-var TLSRPT_GZIP_MAGIC_1           = 0x8b;                                                             // allow:raw-byte-literal — RFC 1952 gzip magic byte 1
+var TLSRPT_MAX_COMPRESSED_BYTES   = C.BYTES.mib(4);                                                   // 4 MiB compressed cap per §5.2 community practice
+var TLSRPT_MAX_DECOMPRESSED_BYTES = C.BYTES.mib(32);                                                  // 32 MiB decompressed cap (operators override via opts)
+var TLSRPT_MAX_RATIO              = 50;                                                               // 50:1 compression ratio refusal
+var TLSRPT_MAX_POLICIES           = 1000;                                                             // allow:raw-time-literal — RFC 8460 §4.4 policy-cardinality cap
+var TLSRPT_MAX_FAILURE_DETAILS    = 10000;                                                            // per-policy failure-details cap
+var TLSRPT_GZIP_MAGIC_0           = 0x1f;                                                             // RFC 1952 gzip magic byte 0
+var TLSRPT_GZIP_MAGIC_1           = 0x8b;                                                             // RFC 1952 gzip magic byte 1
 
 // Valid RFC 8460 §4.4 result-type values for `failure-details[].result-type`.
 var TLSRPT_RESULT_TYPES = Object.freeze({
@@ -658,8 +658,8 @@ function parseTlsRptReport(input, opts) {
   try {
     raw = guardJson().parse(bytes.toString("utf8"), {
       maxBytes:  maxDecompressed,
-      maxDepth:  32,                                                                                  // allow:raw-byte-literal — JSON depth cap
-      maxKeys:   1000,                                                                                // allow:raw-byte-literal — top-level key cap
+      maxDepth:  32,                                                                                  // JSON depth cap
+      maxKeys:   1000,                                                                                // top-level key cap
     });
   } catch (_e) {
     // Fall back to b.safeJson.parse if guardJson isn't available (in
@@ -946,7 +946,7 @@ function tlsRptIngestHttp(opts) {
 
   return function tlsRptHandler(req, res) {
     if (req.method !== "POST") {
-      res.writeHead(405, { "Allow": "POST", "Content-Type": "text/plain" });                          // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+      res.writeHead(405, { "Allow": "POST", "Content-Type": "text/plain" });                          // allow:raw-time-literal — RFC 8460 §5.4 status code
       res.end("RFC 8460 §5.4 requires POST\n");
       return;
     }
@@ -958,7 +958,7 @@ function tlsRptIngestHttp(opts) {
       });
       if (onRefuse) try { onRefuse("mail-tlsrpt/bad-content-type", "unexpected content-type " + ctRoot, req); }
       catch (_e) { /* drop-silent */ }
-      res.writeHead(415, { "Content-Type": "text/plain", "Accept": "application/tlsrpt+json, application/tlsrpt+gzip" });   // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+      res.writeHead(415, { "Content-Type": "text/plain", "Accept": "application/tlsrpt+json, application/tlsrpt+gzip" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
       res.end("RFC 8460 §6.4-6.5 media types required\n");
       return;
     }
@@ -975,7 +975,7 @@ function tlsRptIngestHttp(opts) {
           _safeAuditEmit(opts.audit, "mail.tlsrpt.ingest_http", "denied", { reason: "unauthenticated" });
           if (onRefuse) try { onRefuse("mail-tlsrpt/unauthenticated", "authenticate(req) returned falsy", req); }
           catch (_e) { /* drop-silent */ }
-          res.writeHead(401, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/unauthenticated" });   // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+          res.writeHead(401, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/unauthenticated" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
           res.end("authentication required\n");
           return;
         }
@@ -986,7 +986,7 @@ function tlsRptIngestHttp(opts) {
         });
         if (onRefuse) try { onRefuse("mail-tlsrpt/auth-error", (err && err.message) || String(err), req); }
         catch (_e) { /* drop-silent */ }
-        res.writeHead(500, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/auth-error" });   // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+        res.writeHead(500, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/auth-error" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
         res.end("authenticate hook threw\n");
       });
       return;
@@ -1012,7 +1012,7 @@ function tlsRptIngestHttp(opts) {
         if (onRefuse) try { onRefuse("mail-tlsrpt/oversize-compressed", "body exceeded " + maxCompressed + " bytes", req); }
         catch (_e) { /* drop-silent */ }
         if (!res.headersSent) {
-          res.writeHead(413, { "Content-Type": "text/plain" });                                       // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+          res.writeHead(413, { "Content-Type": "text/plain" });                                       // allow:raw-time-literal — RFC 8460 §5.4 status code
           res.end("RFC 8460 §5.4 — body exceeds " + maxCompressed + " bytes\n");
         }
         void e;   // _e shadowed by lower scope; mark intent
@@ -1036,7 +1036,7 @@ function tlsRptIngestHttp(opts) {
                   : code === "mail-tlsrpt/gunzip-bomb"           ? 413
                   : code === "mail-tlsrpt/ratio-bomb"             ? 413
                   : code === "mail-tlsrpt/bad-content-type"       ? 415
-                  : 400;                                                                              // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+                  : 400;                                                                              // allow:raw-time-literal — RFC 8460 §5.4 status code
         res.writeHead(status, { "Content-Type": "text/plain", "Error-Type": code });
         res.end("RFC 8460 §5.4 — refused: " + code + "\n");
         return;
@@ -1048,7 +1048,7 @@ function tlsRptIngestHttp(opts) {
         if (onRefuse) try { onRefuse("mail-tlsrpt/untrusted-reporter",
           "reporter '" + report["organization-name"] + "' not in trustedReporters", req); }
         catch (_e) { /* drop-silent */ }
-        res.writeHead(403, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/untrusted-reporter" });   // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+        res.writeHead(403, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/untrusted-reporter" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
         res.end("RFC 8460 §5.3-class: untrusted reporter\n");
         return;
       }
@@ -1069,12 +1069,12 @@ function tlsRptIngestHttp(opts) {
           if (ret && typeof ret.then === "function") {
             ret.then(function () {
               if (!res.headersSent) {
-                res.writeHead(201, { "Content-Type": "text/plain" });                                 // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+                res.writeHead(201, { "Content-Type": "text/plain" });                                 // allow:raw-time-literal — RFC 8460 §5.4 status code
                 res.end("RFC 8460 §5.4 — accepted\n");
               }
             }, function (_e) {
               if (!res.headersSent) {
-                res.writeHead(500, { "Content-Type": "text/plain" });                                 // allow:raw-byte-literal — internal-error status
+                res.writeHead(500, { "Content-Type": "text/plain" });                                 // internal-error status
                 res.end("internal error processing report\n");
               }
             });
@@ -1082,7 +1082,7 @@ function tlsRptIngestHttp(opts) {
           }
         } catch (_e) { /* fall through to 201 — operator hook is best-effort */ }
       }
-      res.writeHead(201, { "Content-Type": "text/plain" });                                           // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+      res.writeHead(201, { "Content-Type": "text/plain" });                                           // allow:raw-time-literal — RFC 8460 §5.4 status code
       res.end("RFC 8460 §5.4 — accepted\n");
     });
     req.on("error", function () {
@@ -1090,7 +1090,7 @@ function tlsRptIngestHttp(opts) {
       aborted = true;
       _safeAuditEmit(opts.audit, "mail.tlsrpt.ingest_http", "denied", { reason: "req-error" });
       if (!res.headersSent) {
-        res.writeHead(400, { "Content-Type": "text/plain" });                                         // allow:raw-byte-literal allow:raw-time-literal — RFC 8460 §5.4 status code
+        res.writeHead(400, { "Content-Type": "text/plain" });                                         // allow:raw-time-literal — RFC 8460 §5.4 status code
         res.end("malformed request\n");
       }
     });

package/lib/mail-dkim.js

@@ -76,9 +76,9 @@ var DEFAULT_HEADERS = ["from", "to", "subject", "date", "message-id"];
 // before bulk-sending) opt down via verify({ minRsaBits: 1024 }) per-call
 // — the historical floor stays available for migration but the
 // framework default refuses sub-2048 inbound.
-var RSA_MIN_BITS  = 2048;                                                        // allow:raw-byte-literal — RFC 8301bis + 2024 bulk-sender floor
-var RSA_WEAK_BITS = 2048;                                                        // allow:raw-byte-literal — RFC 8301bis weak threshold (same as floor)
-var RSA_LEGACY_MIN_BITS = 1024;                                                  // allow:raw-byte-literal — RFC 8301 historical floor, opt-in only
+var RSA_MIN_BITS  = 2048;                                                        // RFC 8301bis + 2024 bulk-sender floor
+var RSA_WEAK_BITS = 2048;                                                        // RFC 8301bis weak threshold (same as floor)
+var RSA_LEGACY_MIN_BITS = 1024;                                                  // RFC 8301 historical floor, opt-in only
 
 // ---- Canonicalization (RFC 6376 §3.4) ----
 
@@ -232,7 +232,7 @@ function create(opts) {
   // keys). Each label is the LDH set; refuse leading/trailing dots and
   // empty labels.
   if (typeof opts.selector !== "string" ||
-      opts.selector.length === 0 || opts.selector.length > 253 ||                            // allow:raw-byte-literal — DNS label length cap (RFC 1035)
+      opts.selector.length === 0 || opts.selector.length > 253 ||                            // DNS label length cap (RFC 1035)
       !/^[a-z0-9_-]+(?:\.[a-z0-9_-]+)*$/i.test(opts.selector)) {
     throw new DkimError("dkim/bad-selector",
       "selector must be a non-empty LDH token, optionally dot-separated (e.g. 's1', '2024.s1') (RFC 6376 §3.1)");
@@ -524,12 +524,12 @@ var DKIM_KEY_CACHE_MAX_ENTRIES = 1024;
 // permits multiple signatures but doesn't bound them; mainstream
 // receivers cap at 5–8. Operators that legitimately accept more
 // override via verify({ maxSignatures }).
-var DKIM_MAX_SIGNATURES_PER_MESSAGE = 8;                                         // allow:raw-byte-literal — receiver-fan-out DoS bound
+var DKIM_MAX_SIGNATURES_PER_MESSAGE = 8;                                         // receiver-fan-out DoS bound
 // Operator-supplied `maxSignatures` opt is range-checked against this
 // ceiling. RFC 6376 §6.1 sets no upper bound; 16 is generous headroom
 // for legitimate relay chains with hop signatures while keeping the
 // verify-fan-out within a CPU-DoS envelope.
-var DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING = 16;                                // allow:raw-byte-literal — operator-opt range ceiling
+var DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING = 16;                                // operator-opt range ceiling
 
 function _cacheGet(qname) {
   var ent = DKIM_KEY_CACHE.get(qname);
@@ -579,7 +579,7 @@ async function _safeResolveTxt(qname, operatorLookup) {
   var out = [];
   for (var i = 0; i < r.rrs.length; i += 1) {
     var rr = r.rrs[i];
-    if (rr && rr.type === 16) {                                                  // allow:raw-byte-literal — IANA DNS qtype TXT
+    if (rr && rr.type === 16) {                                                  // IANA DNS qtype TXT
       out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
     }
   }
@@ -599,8 +599,8 @@ function _pemFromB64KeyMaterial(b64) {
   // accepts it.
   var pem = "-----BEGIN PUBLIC KEY-----\n";
   // 64-char wrap (PEM convention).
-  for (var i = 0; i < b64.length; i += 64) {                                     // allow:raw-byte-literal — PEM wrap width
-    pem += b64.slice(i, i + 64) + "\n";                                          // allow:raw-byte-literal — PEM wrap width
+  for (var i = 0; i < b64.length; i += 64) {                                     // PEM wrap width
+    pem += b64.slice(i, i + 64) + "\n";                                          // PEM wrap width
   }
   pem += "-----END PUBLIC KEY-----\n";
   return pem;
@@ -1226,9 +1226,9 @@ function _bootstrapSingle(algorithm, domain, selector, rsaBits) {
 // each capped at 255 octets. Long RSA p= values are split into multiple
 // quoted strings so the zone file is valid.
 function _wrapDnsTxt(value) {
-  if (value.length <= 255) return '"' + value + '"';                                                // allow:raw-byte-literal — RFC 1035 character-string cap
+  if (value.length <= 255) return '"' + value + '"';                                                // RFC 1035 character-string cap
   var parts = [];
-  for (var i = 0; i < value.length; i += 255) parts.push('"' + value.slice(i, i + 255) + '"');     // allow:raw-byte-literal — RFC 1035 character-string cap
+  for (var i = 0; i < value.length; i += 255) parts.push('"' + value.slice(i, i + 255) + '"');     // RFC 1035 character-string cap
   return parts.join(" ");
 }
 

package/lib/mail-greylist.js

@@ -109,21 +109,21 @@ var MailGreylistError = defineClass("MailGreylistError", { alwaysPermanent: true
 
 var DEFAULT_MIN_DELAY_MS    = C.TIME.minutes(5);
 var DEFAULT_WHITELIST_TTL   = C.TIME.days(36);
-var DEFAULT_MAX_ENTRIES     = 1000000;                                                                   // allow:raw-byte-literal — entry-count cap, not bytes
-var DEFAULT_IPV4_PREFIX     = 24;                                                                        // allow:raw-byte-literal — RFC 6647 §4.4 IP-clustering granularity
-var DEFAULT_IPV6_PREFIX     = 64;                                                                        // allow:raw-byte-literal — RFC 6647 §4.4 IPv6 IP-clustering granularity
+var DEFAULT_MAX_ENTRIES     = 1000000;                                                                   // entry-count cap, not bytes
+var DEFAULT_IPV4_PREFIX     = 24;                                                                        // RFC 6647 §4.4 IP-clustering granularity
+var DEFAULT_IPV6_PREFIX     = 64;                                                                        // RFC 6647 §4.4 IPv6 IP-clustering granularity
 var DEFAULT_PROFILE         = "strict";
 
 var PROFILES = Object.freeze({
   // Strict: low delay, modest whitelist TTL. Catches snowshoe but
   // retries from legitimate MTAs (which back off 5-15 min on tempfail)
   // pass quickly.
-  strict:     { minDelayMs: C.TIME.minutes(5),  whitelistTtlMs: C.TIME.days(36), ipv4Prefix: 24, ipv6Prefix: 64 },                                                                                          // allow:raw-byte-literal — RFC 6647 §4.4 prefixes
+  strict:     { minDelayMs: C.TIME.minutes(5),  whitelistTtlMs: C.TIME.days(36), ipv4Prefix: 24, ipv6Prefix: 64 },                                                                                          // RFC 6647 §4.4 prefixes
   // Balanced: minimum 1 min delay, shorter TTL for higher churn.
-  balanced:   { minDelayMs: C.TIME.minutes(1),  whitelistTtlMs: C.TIME.days(7),  ipv4Prefix: 24, ipv6Prefix: 64 },                                                                                          // allow:raw-byte-literal — RFC 6647 §4.4 prefixes
+  balanced:   { minDelayMs: C.TIME.minutes(1),  whitelistTtlMs: C.TIME.days(7),  ipv4Prefix: 24, ipv6Prefix: 64 },                                                                                          // RFC 6647 §4.4 prefixes
   // Permissive: 30s delay, 30-day TTL. For operators that want
   // greylisting present but minimally visible.
-  permissive: { minDelayMs: C.TIME.seconds(30), whitelistTtlMs: C.TIME.days(30), ipv4Prefix: 32, ipv6Prefix: 128 },                                                                                         // allow:raw-byte-literal — RFC 6647 §4.4 prefixes
+  permissive: { minDelayMs: C.TIME.seconds(30), whitelistTtlMs: C.TIME.days(30), ipv4Prefix: 32, ipv6Prefix: 128 },                                                                                         // RFC 6647 §4.4 prefixes
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -347,13 +347,13 @@ function _hashFingerprint(cidr, mailFrom, rcptTo) {
 function _cidrKey(ip, ipv4Prefix, ipv6Prefix) {
   if (IPV4_RE.test(ip)) {
     var octets = ip.split(".").map(function (s) { return parseInt(s, 10); });
-    var prefix = Math.min(32, Math.max(0, ipv4Prefix));                                                  // allow:raw-byte-literal — IPv4 address bit width
+    var prefix = Math.min(32, Math.max(0, ipv4Prefix));                                                  // IPv4 address bit width
     // Apply prefix: zero out the host bits.
-    var int = (octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3];                      // allow:raw-byte-literal — IPv4 byte shifts
-    var mask = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;                                           // allow:raw-byte-literal — IPv4 mask construction
+    var int = (octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3];                      // IPv4 byte shifts
+    var mask = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;                                           // IPv4 mask construction
     var masked = (int & mask) >>> 0;
     return [
-      (masked >>> 24) & 0xff,                                                                            // allow:raw-byte-literal — IPv4 byte extraction
+      (masked >>> 24) & 0xff,                                                                            // IPv4 byte extraction
       (masked >>> 16) & 0xff,
       (masked >>> 8)  & 0xff,
       masked & 0xff,
@@ -368,8 +368,8 @@ function _cidrKey(ip, ipv4Prefix, ipv6Prefix) {
         "IP '" + ip + "' is not a parseable IPv6 address");
     }
     // expanded is 32 hex chars; mask to ipv6Prefix bits.
-    var prefixBits = Math.min(128, Math.max(0, ipv6Prefix));                                             // allow:raw-byte-literal — IPv6 address bit width
-    var keepNibbles = Math.floor(prefixBits / 4);                                                        // allow:raw-byte-literal — bits-per-hex-nibble
+    var prefixBits = Math.min(128, Math.max(0, ipv6Prefix));                                             // IPv6 address bit width
+    var keepNibbles = Math.floor(prefixBits / 4);                                                        // bits-per-hex-nibble
     var keptHex = expanded.slice(0, keepNibbles);
     return keptHex + "*/" + prefixBits;
   }

package/lib/mail-helo.js

@@ -116,7 +116,7 @@ var LDH_LABEL_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
 var ADDR_LIT_V4_RE = /^\[((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})\]$/;  // allow:regex-no-length-cap — anchored + per-octet repeat cap
 var ADDR_LIT_V6_RE = /^\[IPv6:([0-9a-fA-F:.]+)\]$/;                                                       // allow:regex-no-length-cap — IPv6 textual bounded by overall maxBytes
 
-var DEFAULT_MAX_BYTES = 255;                                                                              // allow:raw-byte-literal — RFC 1035 §2.3.4 cap
+var DEFAULT_MAX_BYTES = 255;                                                                              // RFC 1035 §2.3.4 cap
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({

package/lib/mail-journal.js

@@ -102,7 +102,7 @@ function _validateRegimes(regimes) {
       "b.mail.journal.create: opts.regimes must be a non-empty array of regime names " +
       "(known: " + Object.keys(REGIME_FLOOR_MS).join(", ") + ")");
   }
-  if (regimes.length > 16) {                                                                          // allow:raw-byte-literal — regime-list cap
+  if (regimes.length > 16) {                                                                          // regime-list cap
     throw new MailJournalError("mail-journal/bad-regimes",
       "b.mail.journal.create: opts.regimes must contain at most 16 entries");
   }
@@ -191,7 +191,7 @@ function create(opts) {
 
   var namespace = typeof opts.namespace === "string" && opts.namespace.length > 0 ?
                   opts.namespace : "mail-journal";
-  if (!/^[a-zA-Z0-9_-]{1,64}$/.test(namespace)) {                                                     // allow:raw-byte-literal — namespace token shape
+  if (!/^[a-zA-Z0-9_-]{1,64}$/.test(namespace)) {                                                     // namespace token shape
     throw new MailJournalError("mail-journal/bad-namespace",
       "b.mail.journal.create: opts.namespace must match [a-zA-Z0-9_-]{1,64}");
   }
@@ -250,7 +250,7 @@ function create(opts) {
     }
     validateOpts.requireNonEmptyString(req.actorId,
       "mail.journal.record: opts.actorId", MailJournalError, "mail-journal/bad-actor");
-    if (typeof req.messageId !== "string" || req.messageId.length === 0 || req.messageId.length > 1024) {  // allow:raw-byte-literal — Message-Id cap
+    if (typeof req.messageId !== "string" || req.messageId.length === 0 || req.messageId.length > 1024) {  // Message-Id cap
       throw new MailJournalError("mail-journal/bad-message-id",
         "mail.journal.record: opts.messageId must be a non-empty string");
     }
@@ -258,13 +258,13 @@ function create(opts) {
       throw new MailJournalError("mail-journal/bad-body",
         "mail.journal.record: opts.bodyBytes must be a Buffer");
     }
-    if (req.bodyBytes.length > C.BYTES.mib(256)) {                                                    // allow:raw-byte-literal — per-message cap
+    if (req.bodyBytes.length > C.BYTES.mib(256)) {                                                    // per-message cap
       throw new MailJournalError("mail-journal/too-large",
         "mail.journal.record: message " + req.bodyBytes.length + " bytes exceeds 256 MiB cap");
     }
 
     var journalId  = "j" + Date.now().toString(36) + "-" +
-                     require("node:crypto").randomBytes(8).toString("hex");                           // allow:raw-byte-literal — 8-byte rand
+                     require("node:crypto").randomBytes(8).toString("hex");                           // 8-byte rand
     var archivedAt = Date.now();
     var sizeBytes  = req.bodyBytes.length;
     var storageKey = namespace + "/" + archivedAt + "/" + journalId + ".eml.sealed";
@@ -313,7 +313,7 @@ function create(opts) {
   }
 
   async function getById(journalId) {
-    if (typeof journalId !== "string" || journalId.length === 0 || journalId.length > 256) {          // allow:raw-byte-literal — id cap
+    if (typeof journalId !== "string" || journalId.length === 0 || journalId.length > 256) {          // id cap
       throw new MailJournalError("mail-journal/bad-id",
         "mail.journal.getById: journalId must be a non-empty string");
     }
@@ -362,7 +362,7 @@ function create(opts) {
       clauses.push("actor_id = ?");
       args.push(filter.actorId);
     }
-    var limit = numericBounds.isPositiveFiniteInt(filter.limit) ? Math.min(filter.limit, 1000) : 100; // allow:raw-byte-literal — list page cap
+    var limit = numericBounds.isPositiveFiniteInt(filter.limit) ? Math.min(filter.limit, 1000) : 100; // list page cap
     var where = clauses.length > 0 ? " WHERE " + clauses.join(" AND ") : "";
     var sql = "SELECT journal_id, direction, actor_id, message_id, archived_at, " +
               "size_bytes, regimes, floor_until, legal_hold, storage_key FROM " +
@@ -389,7 +389,7 @@ function create(opts) {
     if (now === undefined) now = Date.now();
     var rows = opts.db.runSql(
       "SELECT journal_id, archived_at, floor_until, message_id, regimes FROM " +
-      qTable + " WHERE floor_until < ? AND legal_hold = 0 ORDER BY archived_at ASC LIMIT 1000;",   // allow:raw-byte-literal — expiry-surface cap
+      qTable + " WHERE floor_until < ? AND legal_hold = 0 ORDER BY archived_at ASC LIMIT 1000;",   // expiry-surface cap
       [now]
     );
     _emit("mail.journal.expire_surface", "success", { count: rows ? rows.length : 0, now: now });

package/lib/mail-rbl.js

@@ -93,16 +93,16 @@ var MailRblError = defineClass("MailRblError", { alwaysPermanent: true });
 
 var IPV4_RE       = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;  // allow:regex-no-length-cap — anchored + per-octet repeat-cap
 var IPV6_HEX_RE   = /^[0-9a-fA-F:]+$/;                                                                    // allow:regex-no-length-cap — checked by length cap below
-var IPV6_MAX_LEN  = 39;                                                                                   // allow:raw-byte-literal — max IPv6 textual length (8 groups × 4 hex + 7 colons)
+var IPV6_MAX_LEN  = 39;                                                                                   // max IPv6 textual length (8 groups × 4 hex + 7 colons)
 
 var DEFAULT_TIMEOUT_MS    = C.TIME.seconds(5);
-var DEFAULT_CONCURRENCY   = 8;                                                                           // allow:raw-byte-literal — concurrent-query cap, not bytes
+var DEFAULT_CONCURRENCY   = 8;                                                                           // concurrent-query cap, not bytes
 var DEFAULT_PROFILE       = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxConcurrent: 8, perListTimeoutMs: C.TIME.seconds(5), maxListsPerQuery: 16 },           // allow:raw-byte-literal — list-count cap
-  balanced:   { maxConcurrent: 16, perListTimeoutMs: C.TIME.seconds(10), maxListsPerQuery: 32 },         // allow:raw-byte-literal — list-count cap
-  permissive: { maxConcurrent: 32, perListTimeoutMs: C.TIME.seconds(20), maxListsPerQuery: 64 },         // allow:raw-byte-literal — list-count cap
+  strict:     { maxConcurrent: 8, perListTimeoutMs: C.TIME.seconds(5), maxListsPerQuery: 16 },           // list-count cap
+  balanced:   { maxConcurrent: 16, perListTimeoutMs: C.TIME.seconds(10), maxListsPerQuery: 32 },         // list-count cap
+  permissive: { maxConcurrent: 32, perListTimeoutMs: C.TIME.seconds(20), maxListsPerQuery: 64 },         // list-count cap
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -328,7 +328,7 @@ function compliancePosture(posture) {
 function _validateZoneNames(zones) {
   for (var i = 0; i < zones.length; i += 1) {
     var z = zones[i];
-    if (typeof z !== "string" || z.length === 0 || z.length > 253) {                                     // allow:raw-byte-literal — RFC 1035 §2.3.4 total name cap
+    if (typeof z !== "string" || z.length === 0 || z.length > 253) {                                     // RFC 1035 §2.3.4 total name cap
       throw new MailRblError("mail-rbl/bad-zone",
         "list zone '" + z + "' must be a non-empty string under 253 bytes");
     }
@@ -340,7 +340,7 @@ function _validateZoneNames(zones) {
     // if non-ASCII upstream).
     for (var c = 0; c < z.length; c += 1) {
       var cc = z.charCodeAt(c);
-      if (cc < 0x20 || cc === 0x7f || cc > 0x7e) {                                                       // allow:raw-byte-literal — RFC 1035 ASCII zone-name shape
+      if (cc < 0x20 || cc === 0x7f || cc > 0x7e) {                                                       // RFC 1035 ASCII zone-name shape
         throw new MailRblError("mail-rbl/bad-zone",
           "list zone '" + z + "' contains non-ASCII or control chars");
       }

package/lib/mail-scan.js

@@ -95,16 +95,16 @@ var DEFAULT_PROFILE      = "strict";
 var DEFAULT_PROTOCOL     = "icap";
 var DEFAULT_ICAP_SERVICE = "srv_clamav";
 
-// allow:raw-byte-literal — ClamAV INSTREAM 4-byte length prefix.
+// ClamAV INSTREAM 4-byte length prefix.
 var CLAMAV_LENGTH_PREFIX_BYTES = 4;
 
-// allow:raw-byte-literal — ClamAV INSTREAM chunk size for streaming.
+// ClamAV INSTREAM chunk size for streaming.
 var CLAMAV_CHUNK_BYTES = 65536;
 
 var PROFILES = Object.freeze({
-  strict:     { timeoutMs: C.TIME.seconds(30),  maxMessageBytes: C.BYTES.mib(25),  maxResponseBytes: C.BYTES.mib(50) },   // allow:raw-byte-literal — operator-facing default mailbox cap
-  balanced:   { timeoutMs: C.TIME.seconds(60),  maxMessageBytes: C.BYTES.mib(50),  maxResponseBytes: C.BYTES.mib(100) },  // allow:raw-byte-literal — operator-facing default mailbox cap
-  permissive: { timeoutMs: C.TIME.seconds(120), maxMessageBytes: C.BYTES.mib(150), maxResponseBytes: C.BYTES.mib(300) },  // allow:raw-byte-literal — operator-facing default mailbox cap
+  strict:     { timeoutMs: C.TIME.seconds(30),  maxMessageBytes: C.BYTES.mib(25),  maxResponseBytes: C.BYTES.mib(50) },   // operator-facing default mailbox cap
+  balanced:   { timeoutMs: C.TIME.seconds(60),  maxMessageBytes: C.BYTES.mib(50),  maxResponseBytes: C.BYTES.mib(100) },  // operator-facing default mailbox cap
+  permissive: { timeoutMs: C.TIME.seconds(120), maxMessageBytes: C.BYTES.mib(150), maxResponseBytes: C.BYTES.mib(300) },  // operator-facing default mailbox cap
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -165,7 +165,7 @@ function create(opts) {
 
   validateOpts.requireNonEmptyString(opts.host, "mail.scan.create.host",
     MailScanError, "mail-scan/bad-host");
-  if (!numericBounds.isPositiveFiniteInt(opts.port) || opts.port > 65535) {                        // allow:raw-byte-literal — TCP port-number range cap
+  if (!numericBounds.isPositiveFiniteInt(opts.port) || opts.port > 65535) {                        // TCP port-number range cap
     throw new MailScanError("mail-scan/bad-port",
       "mail.scan.create.port must be a positive integer in [1,65535]; got " +
       numericBounds.shape(opts.port));
@@ -329,7 +329,7 @@ function create(opts) {
         // RFC 3507 §4.4.3 — body is chunked-transfer; we write a single
         // chunk + terminator for simplicity. The wire format is the same
         // as HTTP/1.1 chunked: `<hex-length>\r\n<bytes>\r\n0\r\n\r\n`.
-        var lenHex = messageBytes.length.toString(16);                                              // allow:raw-byte-literal — hex radix
+        var lenHex = messageBytes.length.toString(16);                                              // hex radix
         sock.write(lenHex + "\r\n");
         sock.write(messageBytes);
         sock.write("\r\n0\r\n\r\n");

package/lib/mail-send-deliver.js

@@ -73,7 +73,7 @@ var audit        = lazyRequire(function () { return require("./audit"); });
 
 var DeliverError = defineClass("DeliverError");
 
-var DEFAULT_PORT_SMTP            = 25;                                                              // allow:raw-byte-literal — IANA SMTP port, not a byte literal
+var DEFAULT_PORT_SMTP            = 25;                                                              // IANA SMTP port, not a byte literal
 var DEFAULT_RETRY_BACKOFF_MS     = Object.freeze([
   C.TIME.minutes(1),
   C.TIME.minutes(5),
@@ -83,7 +83,7 @@ var DEFAULT_RETRY_BACKOFF_MS     = Object.freeze([
 ]);
 var DEFAULT_MX_LOOKUP_TIMEOUT_MS = C.TIME.seconds(10);
 var DEFAULT_PER_HOST_TIMEOUT_MS  = C.TIME.seconds(60);
-var MAX_RECIPIENTS_PER_CALL      = 1000;                                                            // allow:raw-byte-literal — manifest-size cap, not byte count
+var MAX_RECIPIENTS_PER_CALL      = 1000;                                                            // manifest-size cap, not byte count
 
 // ---- Outcome classifier ----