@blamejs/core 0.14.1 → 0.14.2

package/lib/mail-server-imap.js

@@ -140,10 +140,10 @@ var DEFAULT_GREETING_VENDOR  = "blamejs IMAP4rev2";
 var pkgVersion = require("../package.json").version;
 
 // Error-message clamp bytes — protocol-string clamp, not a byte count.
-// Centralized so the allow:raw-byte-literal marker lives in one place
+// Centralized so the marker lives in one place
 // and the per-call sites read cleanly.
-var ERR_CLAMP = 200;                                                                                  // allow:raw-byte-literal — protocol-reply error-message clamp
-var LINE_PREVIEW = 80;                                                                                // allow:raw-byte-literal — audit-line preview clamp
+var ERR_CLAMP = 200;                                                                                  // protocol-reply error-message clamp
+var LINE_PREVIEW = 80;                                                                                // audit-line preview clamp
 
 // RFC 9051 §6.3.12 + RFC 5322 §3.3 date-time parser for IMAP APPEND.
 // Format: `DD-Mon-YYYY HH:MM:SS ±HHMM` where Mon is the 3-letter
@@ -152,8 +152,8 @@ var LINE_PREVIEW = 80;
 // millisecond epoch, or null on any parse failure — the caller emits
 // `BAD` rather than silently using `Date.now()`.
 var IMAP_MONTHS = Object.freeze({
-  jan: 0, feb: 1, mar: 2, apr: 3, may: 4, jun: 5,                                                         // allow:raw-byte-literal — month-index table (0-5)
-  jul: 6, aug: 7, sep: 8, oct: 9, nov: 10, dec: 11,                                                       // allow:raw-byte-literal — month-index table (6-11)
+  jan: 0, feb: 1, mar: 2, apr: 3, may: 4, jun: 5,                                                         // month-index table (0-5)
+  jul: 6, aug: 7, sep: 8, oct: 9, nov: 10, dec: 11,                                                       // month-index table (6-11)
 });
 var IMAP_DT_RE = /^\s*(\d{1,2})-([A-Za-z]{3})-(\d{4})\s+(\d{2}):(\d{2}):(\d{2})\s+([+-])(\d{2})(\d{2})\s*$/;
 function _parseImapDateTime(s) {
@@ -195,10 +195,10 @@ function _parseImapDateTime(s) {
 // oversize.
 function _validateMailboxName(name, opts) {
   if (typeof name !== "string" || name.length === 0) return false;
-  if (name.length > 1024) return false;                                                              // allow:raw-byte-literal — mailbox name cap
+  if (name.length > 1024) return false;                                                              // mailbox name cap
   for (var i = 0; i < name.length; i += 1) {
     var c = name.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) return false;                                                        // allow:raw-byte-literal — control-byte refusal
+    if (c < 0x20 || c === 0x7F) return false;                                                        // control-byte refusal
   }
   if (name.indexOf("..") !== -1) return false;
   if (name === "/" || name[0] === "/" || name[name.length - 1] === "/") return false;
@@ -311,7 +311,7 @@ function create(opts) {
     }
     rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
-    var connectionId = "imapconn-" + bCrypto.generateToken(8);                                       // allow:raw-byte-literal — connection-id length
+    var connectionId = "imapconn-" + bCrypto.generateToken(8);                                       // connection-id length
     var socket = rawSocket;
     connections.add(socket);
 
@@ -655,8 +655,8 @@ function create(opts) {
     // exercise them; each handler refuses gracefully when the operator
     // backend doesn't supply the corresponding hook).
     caps.push("NOTIFY");                                // RFC 5465
-    caps.push("METADATA");                              // RFC 5464 — per-mailbox annotations          // allow:raw-byte-literal — RFC number in comment
-    caps.push("METADATA-SERVER");                       // RFC 5464 §3.1 — server-wide annotations    // allow:raw-byte-literal — RFC number in comment
+    caps.push("METADATA");                              // RFC 5464 — per-mailbox annotations          // RFC number in comment
+    caps.push("METADATA-SERVER");                       // RFC 5464 §3.1 — server-wide annotations    // RFC number in comment
     caps.push("CATENATE");                              // RFC 4469 — APPEND from existing parts
     // NB: COMPRESS=DEFLATE (RFC 4978) intentionally NOT advertised —
     // CRIME-class compression-oracle attack on the encrypted IMAP
@@ -1369,7 +1369,7 @@ function create(opts) {
         while (pi < partsBody.length && /\s/.test(partsBody[pi])) pi += 1;
         if (pi >= partsBody.length) break;
         if (/^URL\b/i.test(partsBody.slice(pi))) {
-          pi += 3;                                                                                     // allow:raw-byte-literal — length of literal "URL" keyword
+          pi += 3;                                                                                     // length of literal "URL" keyword
           while (pi < partsBody.length && /\s/.test(partsBody[pi])) pi += 1;
           if (partsBody[pi] !== "\"") {
             _writeTagged(socket, tag, "BAD APPEND CATENATE URL value must be quoted-string");
@@ -1818,7 +1818,7 @@ function create(opts) {
       throw new MailServerImapError("mail-server-imap/already-listening",
         "listen: already listening");
     }
-    var port    = listenOpts.port    === undefined ? 143 : listenOpts.port;                           // allow:raw-byte-literal — RFC 9051 IMAP port (IANA)
+    var port    = listenOpts.port    === undefined ? 143 : listenOpts.port;                           // RFC 9051 IMAP port (IANA)
     var address = listenOpts.address || "0.0.0.0";
     tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
     return new Promise(function (resolve, reject) {

package/lib/mail-server-jmap.js

@@ -232,7 +232,7 @@ function create(opts) {
     tenantScope:   opts.tenantScope   || null,
     agentTenantId: opts.agentTenantId || null,
   });
-  var sessionState = bCrypto.generateToken(16);                                                       // allow:raw-byte-literal — opaque session-state token length
+  var sessionState = bCrypto.generateToken(16);                                                       // opaque session-state token length
 
   function _emit(action, metadata, outcome) {
     try {
@@ -262,7 +262,7 @@ function create(opts) {
     for (var k = 0; k < keys.length; k += 1) {
       var key = keys[k];
       var val = args[key];
-      if (key.charCodeAt(0) === 0x23) {                                                              // allow:raw-byte-literal — `#` (0x23) is the JMAP back-ref-key prefix
+      if (key.charCodeAt(0) === 0x23) {                                                              // `#` (0x23) is the JMAP back-ref-key prefix
         // `#<srcClientId>` → key strips the `#`; value is { resultOf, name, path }
         var targetKey = key.slice(1);
         if (!val || typeof val !== "object" || Array.isArray(val) ||
@@ -443,11 +443,11 @@ function create(opts) {
       // re-auth flow (a 400 looks like a malformed request, which it
       // isn't). Everything else stays 400 per RFC 8620 §3.6.1.
       if (response && response.type === "urn:ietf:params:jmap:error:forbidden") {
-        res.statusCode = 401;                                                                        // allow:raw-byte-literal — HTTP status codes
+        res.statusCode = 401;                                                                        // HTTP status codes
       } else if (response && response.type) {
-        res.statusCode = 400;                                                                        // allow:raw-byte-literal — HTTP status codes
+        res.statusCode = 400;                                                                        // HTTP status codes
       } else {
-        res.statusCode = 200;                                                                        // allow:raw-byte-literal — HTTP status codes
+        res.statusCode = 200;                                                                        // HTTP status codes
       }
       res.setHeader("Content-Type", "application/json; charset=utf-8");
       res.end(JSON.stringify(response));
@@ -596,7 +596,7 @@ function create(opts) {
       pingN = 0;
     } else {
       pingN = parseInt(params.ping, 10);
-      if (!isFinite(pingN) || pingN < 5) pingN = 30;                                                   // allow:raw-byte-literal — RFC 8620 §7.3 default ping seconds
+      if (!isFinite(pingN) || pingN < 5) pingN = 30;                                                   // RFC 8620 §7.3 default ping seconds
       if (pingN > 900) pingN = 900;                                                                    // allow:raw-byte-literal — operator-supplied ping seconds, not bytes // allow:raw-time-literal — explicit max-ping cap (15 minutes)
     }
 
@@ -613,7 +613,7 @@ function create(opts) {
     // the current session state so a fresh subscriber can compare
     // against its cached `state` to know whether a missed update
     // happened during the (re)connect.
-    res.write("retry: 5000\n\n");                                                                      // allow:raw-byte-literal — SSE reconnect-after hint (5s)
+    res.write("retry: 5000\n\n");                                                                      // SSE reconnect-after hint (5s)
     res.write(": connected\n\n");
 
     var closed = false;
@@ -709,12 +709,12 @@ function create(opts) {
   // RFC 8620 §1.2 — JMAP `Id` is a non-empty string of < 256 octets in
   // `[A-Za-z0-9_-]`. The earlier shape capped at 64 chars which refused
   // legitimate-shape accounts; widen to the full spec maximum.
-  var MAX_JMAP_ID_LEN = 255;                                                                           // allow:raw-byte-literal — RFC 8620 §1.2 Id max length
+  var MAX_JMAP_ID_LEN = 255;                                                                           // RFC 8620 §1.2 Id max length
   var JMAP_ID_RE      = /^[A-Za-z0-9_-]{1,255}$/;
   // Anti-polynomial: bound the URL length BEFORE any regex / split runs
   // (CodeQL flags `\/+` on uncontrolled input). Headers + URL paths in
   // practice stay well under 8 KiB; over-long URLs refuse outright.
-  var MAX_URL_LEN     = 8192;                                                                          // allow:raw-byte-literal — 8 KiB URL cap
+  var MAX_URL_LEN     = 8192;                                                                          // 8 KiB URL cap
 
   // Strip a query string + walk the path producing non-empty segments,
   // WITHOUT any unbounded regex. Returns an empty array when the URL
@@ -729,7 +729,7 @@ function create(opts) {
     var cur = "";
     for (var i = 0; i < pathOnly.length; i += 1) {
       var ch = pathOnly.charCodeAt(i);
-      if (ch === 0x2f) {                                                                               // allow:raw-byte-literal — '/' (0x2f)
+      if (ch === 0x2f) {                                                                               // '/' (0x2f)
         if (cur.length > 0) { out.push(cur); cur = ""; }
       } else {
         cur += pathOnly[i];
@@ -821,7 +821,7 @@ function create(opts) {
             throw new MailServerJmapError("mail-server-jmap/bad-upload-result",
               "uploadBlob backend MUST return { blobId, type?, size? }");
           }
-          res.statusCode = 201;                                                                        // allow:raw-byte-literal — HTTP 201 Created
+          res.statusCode = 201;                                                                        // HTTP 201 Created
           res.setHeader("Content-Type", "application/json; charset=utf-8");
           res.end(JSON.stringify({
             accountId: accountId,
@@ -844,7 +844,7 @@ function create(opts) {
     req.on("error", function () {
       if (!refused) {
         refused = true;
-        try { res.statusCode = 400; res.end(); }                                                       // allow:raw-byte-literal — HTTP 400
+        try { res.statusCode = 400; res.end(); }                                                       // HTTP 400
         catch (_e) { /* silent-catch: socket already torn down */ }
       }
     });
@@ -1019,7 +1019,7 @@ function create(opts) {
     // RFC 8887 §3.1 — server MUST select `jmap` if offered. Refuse the
     // connection cleanly if subprotocol negotiation came back null.
     if (conn.subprotocol !== "jmap") {
-      try { conn.close(1002, "RFC 8887 requires Sec-WebSocket-Protocol: jmap"); }                      // allow:raw-byte-literal — RFC 6455 protocol-error close code
+      try { conn.close(1002, "RFC 8887 requires Sec-WebSocket-Protocol: jmap"); }                      // RFC 6455 protocol-error close code
       catch (_e) { /* silent-catch: closed */ }
       return null;
     }
@@ -1302,7 +1302,7 @@ function emailSubmissionSetHandler(opts) {
     throw new MailServerJmapError("mail-server-jmap/no-identities",
       "emailSubmissionSetHandler: opts.identities(accountId) function is required (returns Array<{id,email}>)");
   }
-  var maxRecipients = opts.maxRecipients || 1000;                                                       // allow:raw-byte-literal — recipient cap mirrors b.mail.send.deliver
+  var maxRecipients = opts.maxRecipients || 1000;                                                       // recipient cap mirrors b.mail.send.deliver
   if (typeof maxRecipients !== "number" || !isFinite(maxRecipients) || maxRecipients < 1) {
     throw new MailServerJmapError("mail-server-jmap/bad-max-recipients",
       "emailSubmissionSetHandler: opts.maxRecipients MUST be a positive integer");
@@ -1422,7 +1422,7 @@ function emailSubmissionSetHandler(opts) {
     return {
       accountId:    accountId,
       oldState:     args.ifInState || null,
-      newState:     bCrypto.generateToken(16),                                                          // allow:raw-byte-literal — opaque state token length
+      newState:     bCrypto.generateToken(16),                                                          // opaque state token length
       created:      Object.keys(created).length     > 0 ? created     : null,
       notCreated:   Object.keys(notCreated).length  > 0 ? notCreated  : null,
       updated:      Object.keys(updated).length     > 0 ? updated     : null,
@@ -1519,7 +1519,7 @@ function emailSubmissionSetHandler(opts) {
       };
     }
 
-    var newId = bCrypto.generateToken(12);                                                              // allow:raw-byte-literal — JMAP-server-assigned id
+    var newId = bCrypto.generateToken(12);                                                              // JMAP-server-assigned id
     return {
       id:             newId,
       identityId:     sub.identityId,

package/lib/mail-server-managesieve.js

@@ -145,12 +145,12 @@ var MailServerManageSieveError = defineClass("MailServerManageSieveError",
   { alwaysPermanent: true });
 
 // RFC 5804 §1 default port (IANA-assigned).
-var DEFAULT_PORT             = 4190;                                                                    // allow:raw-byte-literal — RFC 5804 §1 / IANA managesieve port
-var DEFAULT_MAX_LINE_BYTES   = 8192;                                                                    // allow:raw-byte-literal — matches guardManageSieveCommand strict cap
+var DEFAULT_PORT             = 4190;                                                                    // RFC 5804 §1 / IANA managesieve port
+var DEFAULT_MAX_LINE_BYTES   = 8192;                                                                    // matches guardManageSieveCommand strict cap
 var DEFAULT_IDLE_TIMEOUT_MS  = C.TIME.minutes(5);
 var DEFAULT_GREETING_VENDOR  = "blamejs ManageSieve";
 
-var ERR_CLAMP                = 200;                                                                     // allow:raw-byte-literal — protocol-reply error-message clamp
+var ERR_CLAMP                = 200;                                                                     // protocol-reply error-message clamp
 
 /**
  * @primitive b.mail.server.managesieve.create
@@ -260,7 +260,7 @@ function create(opts) {
       try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
       return;
     }
-    var connectionId = "msvconn-" + bCrypto.generateToken(8);                                            // allow:raw-byte-literal — connection-id length
+    var connectionId = "msvconn-" + bCrypto.generateToken(8);                                            // connection-id length
     var socket = rawSocket;
     connections.add(socket);
     // Single close handler covers BOTH operator-driven `_close(socket)`

package/lib/mail-server-mx.js

@@ -150,7 +150,7 @@ var MailServerMxError = defineClass("MailServerMxError", { alwaysPermanent: true
 // RFC 5321 §4.5.3.1 — wire-protocol limits.
 var DEFAULT_MAX_LINE_BYTES        = C.BYTES.kib(1);
 var DEFAULT_MAX_MESSAGE_BYTES     = C.BYTES.mib(50);
-var DEFAULT_MAX_RCPTS_PER_MESSAGE = 100;                                                              // allow:raw-byte-literal — RFC 5321 §4.5.3.1.8 recipient cap
+var DEFAULT_MAX_RCPTS_PER_MESSAGE = 100;                                                              // RFC 5321 §4.5.3.1.8 recipient cap
 var DEFAULT_IDLE_TIMEOUT_MS       = C.TIME.minutes(5);
 var DEFAULT_GREETING              = "blamejs ESMTP";
 
@@ -161,18 +161,18 @@ var REPLY_220_READY              = "220";
 var REPLY_221_BYE                = "221";
 var REPLY_250_OK                 = "250";
 var REPLY_354_START_INPUT        = "354";
-var REPLY_421_SERVICE_NOT_AVAIL  = "421";                                                             // allow:raw-byte-literal — SMTP transient code
-var REPLY_450_MAILBOX_BUSY       = "450";                                                             // allow:raw-byte-literal — SMTP transient code (greylist tempfail)
-var REPLY_451_LOCAL_ERROR        = "451";                                                             // allow:raw-byte-literal — SMTP transient code
-var REPLY_452_INSUFFICIENT_STG   = "452";                                                             // allow:raw-byte-literal — SMTP transient code
-var REPLY_500_SYNTAX             = "500";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_501_BAD_ARGS           = "501";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_502_NOT_IMPLEMENTED    = "502";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_503_BAD_SEQUENCE       = "503";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_530_AUTH_REQUIRED      = "530";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_550_MAILBOX_UNAVAIL    = "550";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_552_SIZE_EXCEEDED      = "552";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_554_TRANSACTION_FAILED = "554";                                                             // allow:raw-byte-literal — SMTP permanent code
+var REPLY_421_SERVICE_NOT_AVAIL  = "421";                                                             // SMTP transient code
+var REPLY_450_MAILBOX_BUSY       = "450";                                                             // SMTP transient code (greylist tempfail)
+var REPLY_451_LOCAL_ERROR        = "451";                                                             // SMTP transient code
+var REPLY_452_INSUFFICIENT_STG   = "452";                                                             // SMTP transient code
+var REPLY_500_SYNTAX             = "500";                                                             // SMTP permanent code
+var REPLY_501_BAD_ARGS           = "501";                                                             // SMTP permanent code
+var REPLY_502_NOT_IMPLEMENTED    = "502";                                                             // SMTP permanent code
+var REPLY_503_BAD_SEQUENCE       = "503";                                                             // SMTP permanent code
+var REPLY_530_AUTH_REQUIRED      = "530";                                                             // SMTP permanent code
+var REPLY_550_MAILBOX_UNAVAIL    = "550";                                                             // SMTP permanent code
+var REPLY_552_SIZE_EXCEEDED      = "552";                                                             // SMTP permanent code
+var REPLY_554_TRANSACTION_FAILED = "554";                                                             // SMTP permanent code
 
 var RE_MAIL_FROM = /^MAIL\s+FROM:\s*<([^>]*)>(?:\s+(.*))?$/i;
 var RE_RCPT_TO   = /^RCPT\s+TO:\s*<([^>]+)>(?:\s+.*)?$/i;
@@ -346,7 +346,7 @@ function create(opts) {
     }
     socket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
-    var connectionId = "mxconn-" + bCrypto.generateToken(8);                                          // allow:raw-byte-literal — connection-id length
+    var connectionId = "mxconn-" + bCrypto.generateToken(8);                                          // connection-id length
     connections.add(socket);
 
     // Backpressure observer — `_writeReply` flips `_bpEmitted` after
@@ -520,7 +520,7 @@ function create(opts) {
             err.code === "guard-smtp-command/bare-cr" ||
             err.code === "guard-smtp-command/nul-byte") {
           _emit("mail.server.mx.smtp_smuggling_detected",
-            { connectionId: state.id, code: err.code, line: line.slice(0, 200) },                     // allow:raw-byte-literal — audit-log line truncation
+            { connectionId: state.id, code: err.code, line: line.slice(0, 200) },                     // audit-log line truncation
             "denied");
         }
         _writeReply(socket, REPLY_500_SYNTAX, "5.5.2 Syntax error (" + (err.code || "bad-line") + ")");
@@ -936,7 +936,7 @@ function create(opts) {
     // for observability. Bounded to keep the audit metadata size
     // predictable; the per-IP recipient-failure rate-limit elsewhere
     // bounds long-run scanner damage.
-    var MAX_REFUSED_RCPTS_PER_TXN = 32;                                                                   // allow:raw-byte-literal — bounded audit-metadata list cap
+    var MAX_REFUSED_RCPTS_PER_TXN = 32;                                                                   // bounded audit-metadata list cap
     function _trackRefusedRcpt(state, rcpt, reason) {
       if (!Array.isArray(state.refusedRcpts)) state.refusedRcpts = [];
       if (state.refusedRcpts.length >= MAX_REFUSED_RCPTS_PER_TXN) return;
@@ -968,7 +968,7 @@ function create(opts) {
     }
     // Port 0 (ephemeral, test mode) must NOT fall back to 25 — the
     // `|| 25` short-circuit was a footgun on the test path.
-    var port    = listenOpts.port    === undefined ? 25 : listenOpts.port;                           // allow:raw-byte-literal — SMTP MX port (IANA)
+    var port    = listenOpts.port    === undefined ? 25 : listenOpts.port;                           // SMTP MX port (IANA)
     var address = listenOpts.address || "0.0.0.0";
     tcpServer = net.createServer(function (socket) {
       _handleConnection(socket);

package/lib/mail-server-pop3.js

@@ -119,7 +119,7 @@ var audit = lazyRequire(function () { return require("./audit"); });
 
 var MailServerPop3Error = defineClass("MailServerPop3Error", { alwaysPermanent: true });
 
-var DEFAULT_MAX_LINE_BYTES   = 1024;                                                                  // allow:raw-byte-literal — RFC 2449 §4 line cap (permissive)
+var DEFAULT_MAX_LINE_BYTES   = 1024;                                                                  // RFC 2449 §4 line cap (permissive)
 var DEFAULT_IDLE_TIMEOUT_MS  = C.TIME.minutes(10);
 // RFC 1939 §6 — UPDATE-state commit (the actual delete on QUIT) is
 // the only place the backend writes; a hung commitPop3Drop leaves
@@ -130,7 +130,7 @@ var DEFAULT_IDLE_TIMEOUT_MS  = C.TIME.minutes(10);
 var DEFAULT_COMMIT_TIMEOUT_MS = C.TIME.seconds(30);
 var DEFAULT_GREETING_VENDOR  = "blamejs POP3";
 
-var ERR_CLAMP = 200;                                                                                  // allow:raw-byte-literal — protocol-reply error-message clamp
+var ERR_CLAMP = 200;                                                                                  // protocol-reply error-message clamp
 
 /**
  * @primitive b.mail.server.pop3.create
@@ -263,7 +263,7 @@ function create(opts) {
       try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
       return;
     }
-    var connectionId = "pop3conn-" + bCrypto.generateToken(8);                                       // allow:raw-byte-literal — connection-id length
+    var connectionId = "pop3conn-" + bCrypto.generateToken(8);                                       // connection-id length
     var socket = rawSocket;
     connections.add(socket);
     // Single close handler covers BOTH operator-driven `_close(socket)`
@@ -876,7 +876,7 @@ function create(opts) {
       throw new MailServerPop3Error("mail-server-pop3/already-listening",
         "listen: already listening");
     }
-    var port    = listenOpts.port    === undefined ? 110 : listenOpts.port;                          // allow:raw-byte-literal — RFC 1939 POP3 port (IANA)
+    var port    = listenOpts.port    === undefined ? 110 : listenOpts.port;                          // RFC 1939 POP3 port (IANA)
     var address = listenOpts.address || "0.0.0.0";
     tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
     return new Promise(function (resolve, reject) {

package/lib/mail-server-rate-limit.js

@@ -98,7 +98,7 @@ var DEFAULTS = Object.freeze({
   maxConcurrentConnectionsPerIp: 10,
   connectionsPerIpPerMinute:     60,                                                                  // allow:raw-time-literal — connection count, not a time value
   authFailuresPerIpPer15Min:     10,
-  minBytesPerSecond:             100,                                                                 // allow:raw-byte-literal — slow-loris byte-rate floor
+  minBytesPerSecond:             100,                                                                 // slow-loris byte-rate floor
   // RCPT-TO recipient-failure cap defends against the 550-vs-250
   // enumeration shape (RFC 5321 §3.5 — RCPT-TO surfaces the
   // mailbox-exists oracle; an attacker that hammers RCPT TO can
@@ -106,7 +106,7 @@ var DEFAULTS = Object.freeze({
   // Per-IP, per-minute. Tuned higher than auth-failure since
   // legitimate senders can RCPT-TO multiple recipients per message;
   // operator overrides via `rcptFailuresPerIpPerMinute`.
-  rcptFailuresPerIpPerMinute:    50,                                                                  // allow:raw-byte-literal — RCPT enumeration bound
+  rcptFailuresPerIpPerMinute:    50,                                                                  // RCPT enumeration bound
   disabled:                      false,
 });
 

package/lib/mail-server-submission.js

@@ -123,31 +123,31 @@ var MailServerSubmissionError = defineClass("MailServerSubmissionError", { alway
 
 var DEFAULT_MAX_LINE_BYTES        = C.BYTES.kib(1);
 var DEFAULT_MAX_MESSAGE_BYTES     = C.BYTES.mib(50);
-var DEFAULT_MAX_RCPTS_PER_MESSAGE = 100;                                                              // allow:raw-byte-literal — RFC 5321 §4.5.3.1.8 recipient cap
+var DEFAULT_MAX_RCPTS_PER_MESSAGE = 100;                                                              // RFC 5321 §4.5.3.1.8 recipient cap
 var DEFAULT_IDLE_TIMEOUT_MS       = C.TIME.minutes(5);
 var DEFAULT_GREETING              = "blamejs Submission";
 var DEFAULT_AUTH_MECHANISMS       = Object.freeze(["PLAIN", "LOGIN"]);
 
 var REPLY_220_READY              = "220";
 var REPLY_221_BYE                = "221";
-var REPLY_235_AUTH_OK            = "235";                                                             // allow:raw-byte-literal — SMTP AUTH success code
+var REPLY_235_AUTH_OK            = "235";                                                             // SMTP AUTH success code
 var REPLY_250_OK                 = "250";
-var REPLY_334_AUTH_CHALLENGE     = "334";                                                             // allow:raw-byte-literal — SMTP AUTH challenge code
+var REPLY_334_AUTH_CHALLENGE     = "334";                                                             // SMTP AUTH challenge code
 var REPLY_354_START_INPUT        = "354";
-var REPLY_421_SERVICE_NOT_AVAIL  = "421";                                                             // allow:raw-byte-literal — SMTP transient code
-var REPLY_451_LOCAL_ERROR        = "451";                                                             // allow:raw-byte-literal — SMTP transient code
-var REPLY_452_INSUFFICIENT_STG   = "452";                                                             // allow:raw-byte-literal — SMTP transient code
-var REPLY_500_SYNTAX             = "500";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_501_BAD_ARGS           = "501";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_502_NOT_IMPLEMENTED    = "502";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_503_BAD_SEQUENCE       = "503";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_530_AUTH_REQUIRED      = "530";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_535_AUTH_FAILED        = "535";                                                             // allow:raw-byte-literal — RFC 4954 §6 AUTH refusal
-var REPLY_538_AUTH_NEEDS_TLS     = "538";                                                             // allow:raw-byte-literal — RFC 4954 §4 AUTH-needs-TLS
-var REPLY_550_MAILBOX_UNAVAIL    = "550";                                                             // allow:raw-byte-literal — SMTP permanent code (recipient-policy refusal shape)
-var REPLY_552_SIZE_EXCEEDED      = "552";                                                             // allow:raw-byte-literal — SMTP permanent code
-var REPLY_553_SENDER_REJECTED    = "553";                                                             // allow:raw-byte-literal — identity-binding mismatch
-var REPLY_554_TRANSACTION_FAILED = "554";                                                             // allow:raw-byte-literal — SMTP permanent code
+var REPLY_421_SERVICE_NOT_AVAIL  = "421";                                                             // SMTP transient code
+var REPLY_451_LOCAL_ERROR        = "451";                                                             // SMTP transient code
+var REPLY_452_INSUFFICIENT_STG   = "452";                                                             // SMTP transient code
+var REPLY_500_SYNTAX             = "500";                                                             // SMTP permanent code
+var REPLY_501_BAD_ARGS           = "501";                                                             // SMTP permanent code
+var REPLY_502_NOT_IMPLEMENTED    = "502";                                                             // SMTP permanent code
+var REPLY_503_BAD_SEQUENCE       = "503";                                                             // SMTP permanent code
+var REPLY_530_AUTH_REQUIRED      = "530";                                                             // SMTP permanent code
+var REPLY_535_AUTH_FAILED        = "535";                                                             // RFC 4954 §6 AUTH refusal
+var REPLY_538_AUTH_NEEDS_TLS     = "538";                                                             // RFC 4954 §4 AUTH-needs-TLS
+var REPLY_550_MAILBOX_UNAVAIL    = "550";                                                             // SMTP permanent code (recipient-policy refusal shape)
+var REPLY_552_SIZE_EXCEEDED      = "552";                                                             // SMTP permanent code
+var REPLY_553_SENDER_REJECTED    = "553";                                                             // identity-binding mismatch
+var REPLY_554_TRANSACTION_FAILED = "554";                                                             // SMTP permanent code
 
 var RE_MAIL_FROM = /^MAIL\s+FROM:\s*<([^>]*)>(?:\s+(.*))?$/i;
 var RE_RCPT_TO   = /^RCPT\s+TO:\s*<([^>]+)>(?:\s+.*)?$/i;
@@ -159,7 +159,7 @@ var RE_AUTH      = /^AUTH\s+([A-Za-z0-9_-]{1,32})(?:\s+(.*))?$/i;
 // SIMD-accelerated needle scan over the haystack without an
 // interpreter-level char-by-char walk, and the 4-byte literal
 // `_CRLF_CRLF` is a module-level singleton so the JIT folds it.
-var _CRLF_CRLF = Buffer.from([0x0d, 0x0a, 0x0d, 0x0a]);                                                 // allow:raw-byte-literal — RFC 5322 §2.1 header/body separator
+var _CRLF_CRLF = Buffer.from([0x0d, 0x0a, 0x0d, 0x0a]);                                                 // RFC 5322 §2.1 header/body separator
 function _findHeaderEnd(buf) {
   return buf.indexOf(_CRLF_CRLF);
 }
@@ -408,7 +408,7 @@ function create(opts) {
     }
     rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
-    var connectionId = "submitconn-" + bCrypto.generateToken(8);                                      // allow:raw-byte-literal — connection-id length
+    var connectionId = "submitconn-" + bCrypto.generateToken(8);                                      // connection-id length
     var socket = implicitTls
       ? new nodeTls.TLSSocket(rawSocket, { isServer: true, secureContext: opts.tlsContext })
       : rawSocket;
@@ -623,7 +623,7 @@ function create(opts) {
             err.code === "guard-smtp-command/bare-cr" ||
             err.code === "guard-smtp-command/nul-byte") {
           _emit("mail.server.submission.smtp_smuggling_detected",
-            { connectionId: state.id, code: err.code, line: line.slice(0, 200) },                     // allow:raw-byte-literal — audit-log line truncation
+            { connectionId: state.id, code: err.code, line: line.slice(0, 200) },                     // audit-log line truncation
             "denied");
         }
         _writeReply(socket, REPLY_500_SYNTAX, "5.5.2 Syntax error (" + (err.code || "bad-line") + ")");
@@ -1319,7 +1319,7 @@ function create(opts) {
     // Port 0 (ephemeral, test mode) must NOT fall back to the protocol
     // default — the `|| <default>` short-circuit was a footgun on the
     // test path.
-    var defaultPort = implicitTls ? 465 : 587;                                                        // allow:raw-byte-literal — RFC 8314 implicit-TLS / RFC 6409 submission ports
+    var defaultPort = implicitTls ? 465 : 587;                                                        // RFC 8314 implicit-TLS / RFC 6409 submission ports
     var port    = listenOpts.port    === undefined ? defaultPort : listenOpts.port;
     var address = listenOpts.address || "0.0.0.0";
     tcpServer = net.createServer(function (socket) { _handleConnection(socket); });

package/lib/mail-sieve.js

@@ -64,8 +64,8 @@ var validateOpts = require("./validate-opts");
 
 var MailSieveError = defineClass("MailSieveError", { alwaysPermanent: true });
 
-var DEFAULT_GAS_UNITS = 10000;                                                                        // allow:raw-byte-literal — operation cap
-var MAX_GAS_UNITS     = 1_000_000;                                                                    // allow:raw-byte-literal — operator opt-up cap
+var DEFAULT_GAS_UNITS = 10000;                                                                        // operation cap
+var MAX_GAS_UNITS     = 1_000_000;                                                                    // operator opt-up cap
 
 // ---- env helpers ---------------------------------------------------------
 

package/lib/mail-spam-score.js

@@ -77,15 +77,15 @@ var MailSpamScoreError = defineClass("MailSpamScoreError", { alwaysPermanent: tr
 
 var DEFAULT_PROFILE = "strict";
 
-// allow:raw-byte-literal — reason-tag length cap defends outbound
+// reason-tag length cap defends outbound
 // header / audit-store from hostile expansion via compromised scorer.
 var MAX_REASON_BYTES = 256;
 
-// allow:raw-byte-literal — reason-list count cap, defends audit volume.
+// reason-list count cap, defends audit volume.
 var MAX_REASONS = 32;
 
 var PROFILES = Object.freeze({
-  strict:     { threshold: 5.0,  maxReasons: MAX_REASONS, maxReasonBytes: MAX_REASON_BYTES },      // allow:raw-byte-literal — matches SpamAssassin default required_score
+  strict:     { threshold: 5.0,  maxReasons: MAX_REASONS, maxReasonBytes: MAX_REASON_BYTES },      // matches SpamAssassin default required_score
   balanced:   { threshold: 7.5,  maxReasons: MAX_REASONS, maxReasonBytes: MAX_REASON_BYTES },
   permissive: { threshold: 10.0, maxReasons: MAX_REASONS, maxReasonBytes: MAX_REASON_BYTES },
 });
@@ -256,10 +256,10 @@ function _sanitizeReasons(reasons, caps) {
     // header.
     for (var c = 0; c < r.length; c += 1) {
       var cc = r.charCodeAt(c);
-      if (cc < 0x20 || cc === 0x7f) {                                                              // allow:raw-byte-literal — RFC 5234 CTL refusal range
+      if (cc < 0x20 || cc === 0x7f) {                                                              // RFC 5234 CTL refusal range
         throw new MailSpamScoreError("mail-spam-score/control-byte",
           "mail.spamScore.score: reasons[" + i + "] contains control byte 0x" +
-          cc.toString(16));                                                                        // allow:raw-byte-literal — hex radix
+          cc.toString(16));                                                                        // hex radix
       }
     }
     out.push(r);

package/lib/mail-srs.js

@@ -59,8 +59,8 @@ function _base32Encode(buf) {
   var bits = 0;
   var value = 0;
   for (var i = 0; i < buf.length; i += 1) {
-    value = (value << 8) | buf[i];                                                                 // allow:raw-byte-literal — byte-aligned shift
-    bits += 8;                                                                                     // allow:raw-byte-literal — bits-per-byte constant
+    value = (value << 8) | buf[i];                                                                 // byte-aligned shift
+    bits += 8;                                                                                     // bits-per-byte constant
     while (bits >= 5) {
       out += BASE32.charAt((value >>> (bits - 5)) & 31);
       bits -= 5;
@@ -72,13 +72,13 @@ function _base32Encode(buf) {
 
 function _hashTag(secret, hashInput) {
   var mac = nodeCrypto.createHmac("sha256", secret).update(hashInput.toLowerCase(), "utf8").digest();
-  return _base32Encode(mac.subarray(0, 4)).slice(0, 4);                                            // allow:raw-byte-literal — SRS spec 4-char short-tag
+  return _base32Encode(mac.subarray(0, 4)).slice(0, 4);                                            // SRS spec 4-char short-tag
 }
 
 function _dayStamp(nowMs) {
   // Days since epoch, mod 1024. Two-char base32 = 1024 possible values.
-  var days = Math.floor(nowMs / 86400000) % 1024;                                                  // allow:raw-byte-literal — ms-per-day + mod-1024 SRS rotation
-  return BASE32.charAt(days >>> 5) + BASE32.charAt(days & 31);                                     // allow:raw-byte-literal — 5-bit base32 split
+  var days = Math.floor(nowMs / 86400000) % 1024;                                                  // ms-per-day + mod-1024 SRS rotation
+  return BASE32.charAt(days >>> 5) + BASE32.charAt(days & 31);                                     // 5-bit base32 split
 }
 
 function _dayDiff(stamp, nowMs) {
@@ -86,11 +86,11 @@ function _dayDiff(stamp, nowMs) {
   var hi = BASE32.indexOf(stamp.charAt(0));
   var lo = BASE32.indexOf(stamp.charAt(1));
   if (hi < 0 || lo < 0) return Infinity;
-  var stampVal = (hi << 5) | lo;                                                                   // allow:raw-byte-literal — 5-bit base32 split
-  var nowVal = Math.floor(nowMs / 86400000) % 1024;                                                // allow:raw-byte-literal — ms-per-day + mod-1024 rotation
+  var stampVal = (hi << 5) | lo;                                                                   // 5-bit base32 split
+  var nowVal = Math.floor(nowMs / 86400000) % 1024;                                                // ms-per-day + mod-1024 rotation
   // Modular distance — assume positive (rewrites in the future are
   // refused via _dayDiff > 0 callers).
-  var diff = (nowVal - stampVal + 1024) % 1024;                                                    // allow:raw-byte-literal — mod-1024 rotation
+  var diff = (nowVal - stampVal + 1024) % 1024;                                                    // mod-1024 rotation
   return diff;
 }
 
@@ -131,13 +131,13 @@ function create(opts) {
     opts.secret, "srs.create.secret", SrsError, "srs/bad-secret");
   validateOpts.requireNonEmptyString(
     opts.forwarderDomain, "srs.create.forwarderDomain", SrsError, "srs/bad-forwarder");
-  if (opts.secret.length < 16) {                                                                   // allow:raw-byte-literal — minimum HMAC secret length
+  if (opts.secret.length < 16) {                                                                   // minimum HMAC secret length
     throw new SrsError("srs/bad-secret",
       "srs.create: secret must be >= 16 chars (operator-supplied entropy floor)");
   }
-  var expiryDays = opts.expiryDays !== undefined ? opts.expiryDays : 30;                           // allow:raw-byte-literal — default expiry window in days
+  var expiryDays = opts.expiryDays !== undefined ? opts.expiryDays : 30;                           // default expiry window in days
   if (typeof expiryDays !== "number" || !Number.isInteger(expiryDays) ||
-      expiryDays < 1 || expiryDays > 1024) {                                                       // allow:raw-byte-literal — SRS rotation cycle cap
+      expiryDays < 1 || expiryDays > 1024) {                                                       // SRS rotation cycle cap
     throw new SrsError("srs/bad-expiry",
       "srs.create: expiryDays must be an integer 1..1024 (SRS rotation cycle)");
   }
@@ -154,7 +154,7 @@ function create(opts) {
     }
     var localPart = originalAddress.slice(0, at);
     var domain    = originalAddress.slice(at + 1);
-    if (localPart.length > 64 || domain.length > 253) {                                            // allow:raw-byte-literal — RFC 5321 local-part / domain caps
+    if (localPart.length > 64 || domain.length > 253) {                                            // RFC 5321 local-part / domain caps
       throw new SrsError("srs/bad-address",
         "srs.rewrite: localPart / domain exceeds RFC 5321 length cap");
     }

package/lib/mail-store-fts.js

@@ -77,7 +77,7 @@ var MAX_TOKEN_LEN = 64;
 // millions of tokens; FTS5 row insert + index update must stay
 // bounded. The cap is applied AFTER stopword + length filter so the
 // surviving tokens are the highest-signal subset.
-var MAX_TOKENS_PER_FIELD = 8192;                                                                       // allow:raw-byte-literal — token-count cap, not bytes
+var MAX_TOKENS_PER_FIELD = 8192;                                                                       // token-count cap, not bytes
 
 // Per-field FTS column names. Kept symmetric with the messages table
 // columns so callers can reason about which FTS column corresponds
@@ -187,7 +187,7 @@ function hashToken(table, field, token) {
   var ns = "bj-" + table + "-" + field + ":fts:";
   var salt = vault.getDerivedHashSalt();
   var saltHex = (salt && typeof salt.toString === "function") ? salt.toString("hex") : "";
-  return bCrypto.sha3Hash(saltHex + ns + token).slice(0, 16);                                          // allow:raw-byte-literal — 16-char hex prefix length, not bytes
+  return bCrypto.sha3Hash(saltHex + ns + token).slice(0, 16);                                          // 16-char hex prefix length, not bytes
 }
 
 // Hash a token array → space-separated string suitable for FTS5