@blamejs/core 0.14.1 → 0.14.2

package/lib/session-device-binding.js

@@ -79,8 +79,8 @@ var { SessionDeviceBindingError } = require("./framework-error");
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var DEFAULT_TTL_MS         = C.TIME.days(7);
-var DEFAULT_IP_V4_PREFIX   = 24; // allow:raw-byte-literal — IPv4 /24 fingerprint mask in bits
-var DEFAULT_IP_V6_PREFIX   = 48; // allow:raw-byte-literal — IPv6 /48 fingerprint mask in bits
+var DEFAULT_IP_V4_PREFIX   = 24; // IPv4 /24 fingerprint mask in bits
+var DEFAULT_IP_V6_PREFIX   = 48; // IPv6 /48 fingerprint mask in bits
 var FINGERPRINT_BYTES      = C.BYTES.bytes(32);
 
 var ALLOWED_OPTS = [
@@ -150,7 +150,7 @@ function _ipPrefix(ip, bits) {
     // Naive expansion — keep the first ceil(v6Bits/16) groups intact
     // and zero the rest. Sufficient for fingerprint stability; not a
     // canonical IPv6 representation.
-    var keepGroups = Math.ceil(v6Bits / 16); // allow:raw-byte-literal — IPv6 group width in bits
+    var keepGroups = Math.ceil(v6Bits / 16); // IPv6 group width in bits
     var kept = groups.slice(0, keepGroups).join(":");
     return "v6:" + kept + "/" + v6Bits;
   }
@@ -158,7 +158,7 @@ function _ipPrefix(ip, bits) {
   var parts = ip.split(".");
   if (parts.length !== 4) return "v4:" + ip + "/" + bits;
   var v4Bits = bits;
-  var keepOctets = Math.floor(v4Bits / 8); // allow:raw-byte-literal — IPv4 octet width in bits
+  var keepOctets = Math.floor(v4Bits / 8); // IPv4 octet width in bits
   var maskedOctets = parts.slice(0, keepOctets);
   while (maskedOctets.length < 4) maskedOctets.push("0");
   return "v4:" + maskedOctets.join(".") + "/" + v4Bits;
@@ -185,9 +185,9 @@ function create(opts) {
   }
 
   var ipBits = opts.ipPrefixBits || {};
-  var v4Bits = typeof ipBits.v4 === "number" && isFinite(ipBits.v4) && ipBits.v4 >= 0 && ipBits.v4 <= 32 // allow:raw-byte-literal — IPv4 max prefix length in bits
+  var v4Bits = typeof ipBits.v4 === "number" && isFinite(ipBits.v4) && ipBits.v4 >= 0 && ipBits.v4 <= 32 // IPv4 max prefix length in bits
     ? ipBits.v4 : DEFAULT_IP_V4_PREFIX;
-  var v6Bits = typeof ipBits.v6 === "number" && isFinite(ipBits.v6) && ipBits.v6 >= 0 && ipBits.v6 <= 128 // allow:raw-byte-literal — IPv6 max prefix length in bits
+  var v6Bits = typeof ipBits.v6 === "number" && isFinite(ipBits.v6) && ipBits.v6 >= 0 && ipBits.v6 <= 128 // IPv6 max prefix length in bits
     ? ipBits.v6 : DEFAULT_IP_V6_PREFIX;
 
   var ttlMs = opts.ttlMs !== undefined ? opts.ttlMs : DEFAULT_TTL_MS;
@@ -242,7 +242,7 @@ function create(opts) {
   function _hashTokenForAudit(token) {
     // Don't put the raw session id in the audit log. SHAKE256 to a
     // stable short label.
-    return nodeCrypto.createHash("sha3-256").update("bj-session-device:" + token).digest("hex").slice(0, 16); // allow:raw-byte-literal — sha3-256 hex truncation length in chars
+    return nodeCrypto.createHash("sha3-256").update("bj-session-device:" + token).digest("hex").slice(0, 16); // sha3-256 hex truncation length in chars
   }
 
   function _resolveBoundKey(req) {

package/lib/session.js

@@ -208,16 +208,16 @@ var DEFAULT_FINGERPRINT_FIELDS = ["clientIp", "userAgent", "acceptLanguage"];
 // fingerprint field for custom mask widths.
 //
 // Protocol constants — named so the bit-arithmetic stays readable.
-var IP_BITS_PER_BYTE      = 8;                                                                  // allow:raw-byte-literal — bits per byte; protocol constant, not a byte size
+var IP_BITS_PER_BYTE      = 8;                                                                  // bits per byte; protocol constant, not a byte size
 var IPV4_OCTET_COUNT      = 4;
-var IPV4_OCTET_RANGE      = 256;                                                                // allow:raw-byte-literal — 0..255 inclusive; v4 octet domain
-var IPV4_TOTAL_BITS       = 32;                                                                 // allow:raw-byte-literal — IPv4 address width in bits
-var IPV4_DEFAULT_PREFIX   = 24;                                                                 // allow:raw-byte-literal — /24 carrier-NAT pool stride
-var IPV6_GROUP_COUNT      = 8;                                                                  // allow:raw-byte-literal — 8 16-bit groups in v6
-var IPV6_BYTE_COUNT       = 16;                                                                 // allow:raw-byte-literal — 16 bytes in v6
-var IPV6_DEFAULT_PREFIX   = 64;                                                                 // allow:raw-byte-literal — /64 customer LAN per RFC 4291 §2.5.4
+var IPV4_OCTET_RANGE      = 256;                                                                // 0..255 inclusive; v4 octet domain
+var IPV4_TOTAL_BITS       = 32;                                                                 // IPv4 address width in bits
+var IPV4_DEFAULT_PREFIX   = 24;                                                                 // /24 carrier-NAT pool stride
+var IPV6_GROUP_COUNT      = 8;                                                                  // 8 16-bit groups in v6
+var IPV6_BYTE_COUNT       = 16;                                                                 // 16 bytes in v6
+var IPV6_DEFAULT_PREFIX   = 64;                                                                 // /64 customer LAN per RFC 4291 §2.5.4
 var BYTE_MASK             = 0xff;
-var HEX_RADIX             = 16;                                                                 // allow:raw-byte-literal — base-16 radix
+var HEX_RADIX             = 16;                                                                 // base-16 radix
 var V4_MAPPED_V6_PREFIX   = "::ffff:";
 
 function _maskIpv4(ip, prefix) {

package/lib/standard-webhooks.js

@@ -32,7 +32,7 @@ var { defineClass } = require("./framework-error");
 
 var StandardWebhooksError = defineClass("StandardWebhooksError", { alwaysPermanent: true });
 
-var DEFAULT_TOLERANCE_SEC = 300;                                                                      // allow:raw-time-literal allow:raw-byte-literal — 5min default per StandardWebhooks §3.2
+var DEFAULT_TOLERANCE_SEC = 300;                                                                      // allow:raw-time-literal — 5min default per StandardWebhooks §3.2
 
 /**
  * @primitive b.standardWebhooks.sign
@@ -58,7 +58,7 @@ function sign(opts) {
   opts = validateOpts.requireObject(opts, "standardWebhooks.sign",
     StandardWebhooksError, "standard-webhooks/bad-opts");
   validateOpts(opts, ["id", "timestamp", "body", "secret"], "standardWebhooks.sign");
-  if (!Buffer.isBuffer(opts.secret) || opts.secret.length < 32) {                                     // allow:raw-byte-literal — 32-byte HMAC secret floor
+  if (!Buffer.isBuffer(opts.secret) || opts.secret.length < 32) {                                     // 32-byte HMAC secret floor
     throw new StandardWebhooksError("standard-webhooks/bad-secret",
       "sign: opts.secret must be a Buffer (>= 32 bytes)");
   }
@@ -67,7 +67,7 @@ function sign(opts) {
       "sign: opts.body must be a non-empty Buffer or string");
   }
   var bodyBuf = Buffer.isBuffer(opts.body) ? opts.body : Buffer.from(opts.body, "utf8");
-  var id = opts.id || ("msg_" + bCrypto.generateToken(32));                                           // allow:raw-byte-literal — 32-char id token
+  var id = opts.id || ("msg_" + bCrypto.generateToken(32));                                           // 32-char id token
   var timestamp = typeof opts.timestamp === "number"
     ? opts.timestamp
     : Math.floor(Date.now() / 1000);                                                                  // allow:raw-time-literal — wall-clock seconds
@@ -118,7 +118,7 @@ function verify(opts) {
     throw new StandardWebhooksError("standard-webhooks/bad-headers",
       "verify: opts.headers required");
   }
-  if (!Buffer.isBuffer(opts.secret) || opts.secret.length < 32) {                                     // allow:raw-byte-literal — 32-byte HMAC secret floor
+  if (!Buffer.isBuffer(opts.secret) || opts.secret.length < 32) {                                     // 32-byte HMAC secret floor
     throw new StandardWebhooksError("standard-webhooks/bad-secret",
       "verify: opts.secret must be a Buffer (>= 32 bytes)");
   }

package/lib/storage.js

@@ -861,7 +861,7 @@ function _requireInit() {
 // assembly; that gate is the operator's surrounding handler.
 
 var ASSEMBLY_ID_MAX_LEN  = 128;
-var CHUNK_INDEX_MAX      = 100000;                                                                  // allow:raw-byte-literal — chunk-index cap (not bytes, not seconds)
+var CHUNK_INDEX_MAX      = 100000;                                                                  // chunk-index cap (not bytes, not seconds)
 var CHUNK_BYTES_DEFAULT  = C.BYTES.mib(16);
 var STALE_DEFAULT_MS     = C.TIME.hours(24);
 
@@ -1005,7 +1005,7 @@ function chunkScratch(opts) {
   var backendOverride = opts.backend;
 
   function _chunkKey(assemblyId, chunkIndex) {
-    return rootKeyPrefix + "/" + assemblyId + "/" + String(chunkIndex).padStart(8, "0") + ".chunk";   // allow:raw-byte-literal — 8-digit zero-pad covers CHUNK_INDEX_MAX
+    return rootKeyPrefix + "/" + assemblyId + "/" + String(chunkIndex).padStart(8, "0") + ".chunk";   // 8-digit zero-pad covers CHUNK_INDEX_MAX
   }
   function _pickOpts() {
     return backendOverride ? { backend: backendOverride } : {};

package/lib/stream-throttle.js

@@ -72,7 +72,7 @@ var StreamThrottleError = defineClass("StreamThrottleError", { alwaysPermanent:
 // memory cap or protocol-byte literal; the framework's C.TIME / C.BYTES
 // helpers don't apply.
 var MS_PER_SECOND = 1000;                                                                             // allow:raw-byte-literal — ms/sec unit conversion // allow:raw-time-literal — ms/sec unit conversion
-var NS_PER_MS     = 1e6;                                                                              // allow:raw-byte-literal — ns/ms unit conversion
+var NS_PER_MS     = 1e6;                                                                              // ns/ms unit conversion
 var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-byte-literal — hrtime seconds→ms // allow:raw-time-literal — hrtime seconds→ms
 
 /**

package/lib/structured-fields.js

@@ -158,8 +158,8 @@ function refuseControlBytes(value, opts) {
   var allowHt = opts.allowHt !== false;
   for (var i = 0; i < value.length; i += 1) {
     var cc = value.charCodeAt(i);
-    if (allowHt && cc === 9) continue;                                                            // allow:raw-byte-literal — ASCII HT (folding whitespace)
-    if (cc < 32 || cc === 127) {                                                                  // allow:raw-byte-literal — C0 + DEL codepoint range
+    if (allowHt && cc === 9) continue;                                                            // ASCII HT (folding whitespace)
+    if (cc < 32 || cc === 127) {                                                                  // C0 + DEL codepoint range
       var msg = opts.label + ": value contains control characters (C0 / DEL)";
       // opts.useNativeError === true → call the ErrorClass with a
       // single-arg `message` (matches native Error / TypeError /
@@ -234,8 +234,8 @@ function containsControlBytes(value, opts) {
   var allowHt = !opts || opts.allowHt !== false;
   for (var i = 0; i < value.length; i += 1) {
     var cc = value.charCodeAt(i);
-    if (allowHt && cc === 9) continue;                                                            // allow:raw-byte-literal — ASCII HT (folding whitespace)
-    if (cc < 32 || cc === 127) return true;                                                       // allow:raw-byte-literal — C0 + DEL codepoint range
+    if (allowHt && cc === 9) continue;                                                            // ASCII HT (folding whitespace)
+    if (cc < 32 || cc === 127) return true;                                                       // C0 + DEL codepoint range
   }
   return false;
 }
@@ -311,11 +311,11 @@ function _parseNumber(cx, E) {
     var c = cx.s.charAt(cx.i);
     if (_isDigit(c)) { num += c; cx.i += 1; }
     else if (type === "integer" && c === ".") {
-      if (num.length > 12) throw E("structured-fields/parse", "integer part of a decimal exceeds 12 digits");   // allow:raw-byte-literal — RFC 8941 §4.2.4 decimal integer-part cap
+      if (num.length > 12) throw E("structured-fields/parse", "integer part of a decimal exceeds 12 digits");   // RFC 8941 §4.2.4 decimal integer-part cap
       num += "."; type = "decimal"; cx.i += 1;
     } else break;
-    if (type === "integer" && num.length > 15) throw E("structured-fields/parse", "integer exceeds 15 digits");  // allow:raw-byte-literal — §3.3.1 integer digit cap
-    if (type === "decimal" && num.length > 16) throw E("structured-fields/parse", "decimal exceeds the digit limit");   // allow:raw-byte-literal — 12 int + "." + 3 frac
+    if (type === "integer" && num.length > 15) throw E("structured-fields/parse", "integer exceeds 15 digits");  // §3.3.1 integer digit cap
+    if (type === "decimal" && num.length > 16) throw E("structured-fields/parse", "decimal exceeds the digit limit");   // 12 int + "." + 3 frac
   }
   if (type === "integer") return sign * parseInt(num, 10);
   if (num.charAt(num.length - 1) === ".") throw E("structured-fields/parse", "decimal must not end with '.'");
@@ -336,7 +336,7 @@ function _parseString(cx, E) {
     } else if (c === "\"") { return out; }
     else {
       var cc = c.charCodeAt(0);
-      if (cc < 0x20 || cc > 0x7e) throw E("structured-fields/parse", "non-printable character in string");   // allow:raw-byte-literal — RFC 8941 §4.2.5 printable-ASCII range
+      if (cc < 0x20 || cc > 0x7e) throw E("structured-fields/parse", "non-printable character in string");   // RFC 8941 §4.2.5 printable-ASCII range
       out += c;
     }
   }
@@ -395,7 +395,7 @@ function _parseDisplayString(cx, E) {
     var c = cx.s.charAt(cx.i); cx.i += 1;
     if (c === "%") {
       var h = cx.s.substr(cx.i, 2);
-      if (h.length !== 2 || !/^[0-9a-f]{2}$/.test(h)) throw E("structured-fields/parse", "display string escape must be %<lowercase-hex><lowercase-hex>");   // allow:raw-byte-literal — RFC 9651 §4.2.10 two-hex-digit escape
+      if (h.length !== 2 || !/^[0-9a-f]{2}$/.test(h)) throw E("structured-fields/parse", "display string escape must be %<lowercase-hex><lowercase-hex>");   // RFC 9651 §4.2.10 two-hex-digit escape
       bytes.push(parseInt(h, 16));
       cx.i += 2;
     } else if (c === "\"") {
@@ -403,7 +403,7 @@ function _parseDisplayString(cx, E) {
       catch (_e) { throw E("structured-fields/parse", "display string is not valid UTF-8"); }
     } else {
       var cc = c.charCodeAt(0);
-      if (cc < 0x20 || cc > 0x7e) throw E("structured-fields/parse", "display string contains a raw non-printable / non-ASCII character");   // allow:raw-byte-literal — RFC 9651 §4.2.10 printable-ASCII range
+      if (cc < 0x20 || cc > 0x7e) throw E("structured-fields/parse", "display string contains a raw non-printable / non-ASCII character");   // RFC 9651 §4.2.10 printable-ASCII range
       bytes.push(cc);
     }
   }
@@ -542,8 +542,8 @@ function parse(input, type, opts) {
 
 function _serDecimal(v, E) {
   if (!isFinite(v)) throw E("structured-fields/serialize", "cannot serialize a non-finite decimal");
-  var n = Math.round(v * 1000) / 1000;                   // allow:raw-byte-literal allow:raw-time-literal — RFC 8941 §4.1.5 decimal scale 10^3 (3 fractional digits), not a size or duration
-  if (Math.abs(Math.trunc(n)).toString().length > 12) throw E("structured-fields/serialize", "decimal integer part exceeds 12 digits");   // allow:raw-byte-literal — §4.1.5 cap
+  var n = Math.round(v * 1000) / 1000;                   // allow:raw-time-literal — RFC 8941 §4.1.5 decimal scale 10^3 (3 fractional digits), not a size or duration
+  if (Math.abs(Math.trunc(n)).toString().length > 12) throw E("structured-fields/serialize", "decimal integer part exceeds 12 digits");   // §4.1.5 cap
   var s = n.toString();
   if (s.indexOf(".") === -1) s += ".0";                  // a Decimal must carry a fractional part
   return s;
@@ -559,8 +559,8 @@ function _serDisplayString(s, E) {
   var bytes = Buffer.from(s, "utf8"), out = "%\"";
   for (var i = 0; i < bytes.length; i += 1) {
     var b = bytes[i];
-    if (b >= 0x20 && b <= 0x7e && b !== 0x25 && b !== 0x22) out += String.fromCharCode(b);   // allow:raw-byte-literal — RFC 9651 §4.1.10 printable ASCII except % and "
-    else out += "%" + (b < 0x10 ? "0" : "") + b.toString(16);                                // allow:raw-byte-literal — lowercase 2-hex escape
+    if (b >= 0x20 && b <= 0x7e && b !== 0x25 && b !== 0x22) out += String.fromCharCode(b);   // RFC 9651 §4.1.10 printable ASCII except % and "
+    else out += "%" + (b < 0x10 ? "0" : "") + b.toString(16);                                // lowercase 2-hex escape
   }
   return out + "\"";
 }
@@ -585,7 +585,7 @@ function _serBareItem(v, E) {
     var out = "\"";
     for (var i = 0; i < v.length; i += 1) {
       var c = v.charAt(i), cc = v.charCodeAt(i);
-      if (cc < 0x20 || cc > 0x7e) throw E("structured-fields/serialize", "string contains a non-printable character");   // allow:raw-byte-literal — §4.1.6 printable-ASCII range
+      if (cc < 0x20 || cc > 0x7e) throw E("structured-fields/serialize", "string contains a non-printable character");   // §4.1.6 printable-ASCII range
       if (c === "\\" || c === "\"") out += "\\";
       out += c;
     }

package/lib/subject.js

@@ -478,7 +478,7 @@ function eraseHard(subjectId, opts) {
       perTable[spec.name] = deleted;
       // REINDEX the table so B-tree pages holding the deleted row's
       // index entries are rebuilt — closes the F-RTBF-2 residual class.
-      try { db().runSql('REINDEX "' + spec.name + '"'); }                                        // allow:identifier-from-schema — table name comes from FRAMEWORK_SCHEMA
+      try { db().runSql('REINDEX "' + spec.name + '"'); }                                        // table name comes from FRAMEWORK_SCHEMA
       catch (_e) { /* cluster mode / unsupported dialect */ }
     }
     _markErased(subjectId);

package/lib/tcpa-10dlc.js

@@ -65,7 +65,7 @@ var audit = require("./audit");
 var { defineClass } = require("./framework-error");
 var Tcpa10dlcError = defineClass("Tcpa10dlcError", { alwaysPermanent: true });
 
-var E164_RE = /^\+[1-9][0-9]{6,14}$/;                                                         // allow:raw-byte-literal — E.164 length range, not bytes
+var E164_RE = /^\+[1-9][0-9]{6,14}$/;                                                         // E.164 length range, not bytes
 var DISCLOSURE_PARTIES = ["first-party", "carrier-affiliate", "campaign-registrar"];
 
 var records = new Map();   // phoneE164 → record

package/lib/tenant-quota.js

@@ -62,8 +62,8 @@ var observability = lazyRequire(function () { return require("./observability");
 
 var DEFAULT_CACHE_TTL_MS = C.TIME.seconds(30);
 var DEFAULT_WINDOW_MS    = C.TIME.minutes(1);
-var DEFAULT_QPS_CAP      = 100;                                                    // allow:raw-byte-literal — request count, not bytes
-var DEFAULT_ROWS_READ    = 50000;                                                  // allow:raw-byte-literal — row count, not bytes
+var DEFAULT_QPS_CAP      = 100;                                                    // request count, not bytes
+var DEFAULT_ROWS_READ    = 50000;                                                  // row count, not bytes
 var DEFAULT_BYTES_CAP    = C.BYTES.gib(1);
 
 // ---- Per-tenant storage cap (assert / snapshot / list) ----
@@ -523,7 +523,7 @@ function instrumentQuery(opts) {
             claimedTenant: opts.tenantId,
             table:         opts.table || null,
             rowCount:      crossover.length,
-            sample:        crossover.slice(0, 5),                                  // allow:raw-byte-literal — sample size, not bytes
+            sample:        crossover.slice(0, 5),                                  // sample size, not bytes
           },
         });
       } catch (_e) { /* audit best-effort */ }

package/lib/test-harness.js

@@ -156,7 +156,7 @@ async function start(opts) {
     // even under SMOKE_PARALLEL=64 fan-out. Prefix surfaces the
     // process owner for grep-on-leak diagnosis.
     var prefix = nodePath.join(os.tmpdir(),
-      "blamejs-harness-" + bCrypto.generateToken(4) + "-");                                              // allow:raw-byte-literal — 4-byte token (8 hex) suffix
+      "blamejs-harness-" + bCrypto.generateToken(4) + "-");                                              // 4-byte token (8 hex) suffix
     dataDir = nodeFs.mkdtempSync(prefix);
     weCreatedDataDir = true;
   }

package/lib/tracing.js

@@ -330,7 +330,7 @@ function create(opts) {
     spanInst.end = function () {
       if (ended) return;
       ended = true;
-      try { tracer._pop && tracer._pop(); }                                                              // allow:try-catch-non-error — passthrough tracer lifecycle
+      try { tracer._pop && tracer._pop(); }                                                              // passthrough tracer lifecycle
       catch (_e) { /* best-effort */ }
       try { origEnd(); }
       catch (_e) { /* best-effort */ }

package/lib/tsa.js

@@ -180,7 +180,7 @@ function buildRequest(data, opts) {
 
   var nonce = null;
   if (opts.nonce !== false) {
-    nonce = Buffer.isBuffer(opts.nonce) ? opts.nonce : nodeCrypto.randomBytes(8);  // allow:raw-byte-literal — RFC 3161 nonce: 64-bit random
+    nonce = Buffer.isBuffer(opts.nonce) ? opts.nonce : nodeCrypto.randomBytes(8);  // RFC 3161 nonce: 64-bit random
     children.push(asn1.writeInteger(nonce));
   }
   // certReq DEFAULTS TRUE (RFC 3161 §2.4.1) — encode the boolean unless
@@ -264,7 +264,7 @@ function parseResponse(der) {
 }
 
 // PKIFailureInfo bit names (RFC 3161 §2.4.2 / RFC 2510).
-var FAIL_INFO_BITS = {                                                                 // allow:raw-byte-literal — RFC 3161 PKIFailureInfo bit positions
+var FAIL_INFO_BITS = {                                                                 // RFC 3161 PKIFailureInfo bit positions
   0: "badAlg", 2: "badRequest", 5: "badDataFormat", 14: "timeNotAvailable",
   15: "unacceptedPolicy", 16: "unacceptedExtension", 17: "addInfoNotAvailable", 25: "systemFailure",
 };
@@ -274,9 +274,9 @@ function _decodeFailInfo(bitStringNode) {
   if (v.length <= 1) return out;                      // first byte = unused-bit count
   var bits = v.slice(1);
   for (var byteIdx = 0; byteIdx < bits.length; byteIdx += 1) {
-    for (var b = 0; b < 8; b += 1) {                    // allow:raw-byte-literal — 8 bits per byte
+    for (var b = 0; b < 8; b += 1) {                    // 8 bits per byte
       if (bits[byteIdx] & (0x80 >> b)) {
-        var pos = byteIdx * 8 + b;                      // allow:raw-byte-literal — 8 bits per byte
+        var pos = byteIdx * 8 + b;                      // 8 bits per byte
         out.push(FAIL_INFO_BITS[pos] || ("bit" + pos));
       }
     }
@@ -363,7 +363,7 @@ function _parseAccuracy(node) {
 function _ctxInt(node) {
   // [n] IMPLICIT INTEGER — value bytes are the integer content directly.
   var v = node.value, n = 0;
-  for (var i = 0; i < v.length; i += 1) n = (n * 256) + v[i];  // allow:raw-byte-literal — base-256 integer accumulation
+  for (var i = 0; i < v.length; i += 1) n = (n * 256) + v[i];  // base-256 integer accumulation
   return n;
 }
 

package/lib/uri-template.js

@@ -32,7 +32,7 @@ var { defineClass } = require("./framework-error");
 
 var UriTemplateError = defineClass("UriTemplateError", { alwaysPermanent: true });
 
-var MAX_PREFIX = 10000;                                     // allow:raw-byte-literal — RFC 6570 caps prefix length at 9999
+var MAX_PREFIX = 10000;                                     // RFC 6570 caps prefix length at 9999
 
 // Operator table (RFC 6570 §2.2 / §3.2.1). first = prefix when any value is
 // present; sep = separator between values; named = emit "name=value";
@@ -68,15 +68,15 @@ function _pctEncode(str, allowReserved) {
     // which RFC 6570 unreserved-only expansion must escape.
     var cp = str.codePointAt(i);
     var bytes = Buffer.from(String.fromCodePoint(cp), "utf8");
-    for (var b = 0; b < bytes.length; b++) out += "%" + bytes[b].toString(16).toUpperCase().padStart(2, "0");   // allow:raw-byte-literal — hex radix
-    if (cp > 0xFFFF) i++;   // consumed a surrogate pair   // allow:raw-byte-literal — BMP boundary for surrogate-pair detection
+    for (var b = 0; b < bytes.length; b++) out += "%" + bytes[b].toString(16).toUpperCase().padStart(2, "0");   // hex radix
+    if (cp > 0xFFFF) i++;   // consumed a surrogate pair   // BMP boundary for surrogate-pair detection
   }
   return out;
 }
 
 function _allDigits(s) {
   if (s.length === 0) return false;
-  for (var i = 0; i < s.length; i++) { var c = s.charCodeAt(i); if (c < 48 || c > 57) return false; }   // allow:raw-byte-literal — ASCII '0'..'9' code-point bounds
+  for (var i = 0; i < s.length; i++) { var c = s.charCodeAt(i); if (c < 48 || c > 57) return false; }   // ASCII '0'..'9' code-point bounds
   return true;
 }
 
@@ -219,7 +219,7 @@ function _sliceChars(s, n) {
   for (var i = 0; i < s.length && count < n; i++) {
     var cp = s.codePointAt(i);
     out += String.fromCodePoint(cp);
-    if (cp > 0xFFFF) i++;   // allow:raw-byte-literal — BMP boundary for surrogate pairs
+    if (cp > 0xFFFF) i++;   // BMP boundary for surrogate pairs
     count++;
   }
   return out;

package/lib/vault/index.js

@@ -120,14 +120,14 @@ function _readOrCreateDerivedHashSalt() {
   }
   if (nodeFs.existsSync(paths.derivedHashSalt)) {
     var raw = atomicFile.readSync(paths.derivedHashSalt);
-    if (raw.length !== 32) {                                                       // allow:raw-byte-literal — 32-byte (256-bit) salt
+    if (raw.length !== 32) {                                                       // 32-byte (256-bit) salt
       throw new VaultError("vault/derived-hash-salt-corrupted",
         "vault.derived-hash-salt must be exactly 32 bytes; got " + raw.length);
     }
     return raw;
   }
   var nodeCrypto = require("node:crypto");
-  var salt = nodeCrypto.randomBytes(32);                                           // allow:raw-byte-literal — 32-byte salt
+  var salt = nodeCrypto.randomBytes(32);                                           // 32-byte salt
   atomicFile.writeSync(paths.derivedHashSalt, salt, { fileMode: 0o600 });
   log("generated per-deployment derivedHash salt at " + paths.derivedHashSalt);
   return salt;

package/lib/vault/seal-pem-file.js

@@ -230,10 +230,10 @@ function sealPemFile(opts) {
     if (process.platform !== "win32") {
       try {
         var dirStat = nodeFs.statSync(destDir);
-        if ((dirStat.mode & 0o022) !== 0) {                                       // allow:raw-byte-literal — POSIX mode mask
+        if ((dirStat.mode & 0o022) !== 0) {                                       // POSIX mode mask
           throw new SealPemFileError("seal-pem-file/parent-dir-writable",
             "destination parent dir '" + destDir + "' is group/other-writable " +
-            "(mode " + (dirStat.mode & 0o777).toString(8) +                       // allow:raw-byte-literal — POSIX mode mask
+            "(mode " + (dirStat.mode & 0o777).toString(8) +                       // POSIX mode mask
             ") — refuse to seal; chmod 0700 the dir");
         }
       } catch (e) {
@@ -242,9 +242,9 @@ function sealPemFile(opts) {
       }
     }
     var sealed = vault().seal(plaintextBytes);
-    nodeFs.writeFileSync(markerPath, String(Date.now()), { mode: 0o600 });   // allow:raw-byte-literal — POSIX file mode
+    nodeFs.writeFileSync(markerPath, String(Date.now()), { mode: 0o600 });   // POSIX file mode
     try {
-      atomicFile.writeSync(destination, sealed, { fileMode: 0o600 });    // allow:raw-byte-literal — POSIX file mode
+      atomicFile.writeSync(destination, sealed, { fileMode: 0o600 });    // POSIX file mode
     } catch (e) {
       try { nodeFs.unlinkSync(markerPath); } catch (_e) { /* best-effort */ }
       throw e;

package/lib/vc.js

@@ -54,9 +54,9 @@ var COSE_CONTENT_TYPE = "application/vc";
 var VP_JOSE_TYP = "vp+jwt";
 var VP_COSE_TYP = "application/vp+cose";
 var VP_COSE_CONTENT_TYPE = "application/vp";
-var MAX_PRESENTATION_CREDENTIALS = 64;                 // allow:raw-byte-literal — bounded count of enveloped VCs per presentation
+var MAX_PRESENTATION_CREDENTIALS = 64;                 // bounded count of enveloped VCs per presentation
 var ENVELOPED_VC_TYPE = "EnvelopedVerifiableCredential";
-var HDR_COSE_TYP = 16;                                 // allow:raw-byte-literal — COSE "typ" header label (RFC 9596)
+var HDR_COSE_TYP = 16;                                 // COSE "typ" header label (RFC 9596)
 
 // JOSE signature algorithms (final RFC 7518 / 8037), mapped to node
 // verify parameters. ECDSA uses the IEEE-P1363 fixed-width encoding JOSE

package/lib/vendor-data.js

@@ -501,7 +501,7 @@ if (_deferFlag === "1") {
       action:  "vendor-data.boot_verify_deferred",
       outcome: "denied",
       metadata: {
-        reason:          _deferReason.slice(0, 256),                          // allow:raw-byte-literal — audit metadata truncation limit
+        reason:          _deferReason.slice(0, 256),                          // audit metadata truncation limit
         vendorDataKnown: Object.keys(KNOWN_VENDOR_DATA),
       },
     });

package/lib/watcher.js

@@ -65,12 +65,12 @@ var DEFAULT_DEBOUNCE_MS = 100;
 // explicitly via `mode: "poll"`. Default cadence is 1s per tick;
 // pollMaxFiles caps the per-tick walk so a misconfigured root can't
 // stall the event loop by stat'ing 100k files every second.
-var DEFAULT_POLL_INTERVAL_MS = 1000;                                                              // allow:raw-byte-literal — 1-second poll cadence
-var DEFAULT_POLL_MAX_FILES   = 50000;                                                             // allow:raw-byte-literal — per-tick stat cap
+var DEFAULT_POLL_INTERVAL_MS = 1000;                                                              // 1-second poll cadence
+var DEFAULT_POLL_MAX_FILES   = 50000;                                                             // per-tick stat cap
 // Per-watcher event count cap before we self-terminate as a safety net
 // against runaway directories that emit millions of events per minute.
 // Operators with legitimate high-churn directories raise this via opts.
-var DEFAULT_MAX_PENDING = 10000;                                                   // allow:raw-byte-literal — pending-event queue cap
+var DEFAULT_MAX_PENDING = 10000;                                                   // pending-event queue cap
 
 // ---- glob-style matcher ----
 //
@@ -520,7 +520,7 @@ function create(opts) {
       throw new WatcherError("watcher/start-failed",
         "watcher.create: initial poll walk failed: " + ((e && e.message) || String(e)));
     }
-    pollTimer = setInterval(_pollTick, pollIntervalMs);                                            // allow:setinterval-unref — .unref() called immediately below; timer doesn't pin the event loop
+    pollTimer = setInterval(_pollTick, pollIntervalMs);                                            // allow:timer-no-unref — .unref() called immediately below; timer doesn't pin the event loop
     if (typeof pollTimer.unref === "function") pollTimer.unref();
   } else {
     try {

package/lib/web-push-vapid.js

@@ -64,7 +64,7 @@ function generateVapidKeypair() {
   var pubKeyObj = nodeCrypto.createPublicKey(kp.publicKey);
   var jwk = pubKeyObj.export({ format: "jwk" });
   var raw = Buffer.concat([
-    Buffer.from([0x04]),                                                                              // allow:raw-byte-literal — uncompressed point prefix per SEC1 §2.3.3
+    Buffer.from([0x04]),                                                                              // uncompressed point prefix per SEC1 §2.3.3
     Buffer.from(jwk.x, "base64url"),
     Buffer.from(jwk.y, "base64url"),
   ]);
@@ -153,31 +153,31 @@ function buildVapidAuthHeader(opts) {
   // node:crypto produces DER-encoded ECDSA signature; JWT ES256
   // requires the raw 64-byte r||s shape. Convert.
   var derSig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "utf8"), keyObj);
-  var rawSig = _ecdsaDerToRaw(derSig, 32);                                                            // allow:raw-byte-literal — 32-byte P-256 component
+  var rawSig = _ecdsaDerToRaw(derSig, 32);                                                            // 32-byte P-256 component
   var token = signingInput + "." + bCrypto.toBase64Url(rawSig);
   return "vapid t=" + token + ", k=" + opts.publicKeyB64Url;
 }
 
 function _ecdsaDerToRaw(der, componentLen) {
   // ECDSA-Sig-Value DER = SEQUENCE { r INTEGER, s INTEGER }.
-  if (der[0] !== 0x30) {                                                                              // allow:raw-byte-literal — ASN.1 SEQUENCE tag
+  if (der[0] !== 0x30) {                                                                              // ASN.1 SEQUENCE tag
     throw new WebPushError("web-push/bad-sig",
       "ECDSA signature is not a DER SEQUENCE");
   }
   var off = 2;
-  if (der[1] & 0x80) off = 2 + (der[1] & 0x7f);                                                       // allow:raw-byte-literal — long-form length byte
-  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing r INTEGER");             // allow:raw-byte-literal — ASN.1 INTEGER tag
+  if (der[1] & 0x80) off = 2 + (der[1] & 0x7f);                                                       // long-form length byte
+  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing r INTEGER");             // ASN.1 INTEGER tag
   var rLen = der[off + 1];
   var rStart = off + 2;
   var r = der.slice(rStart, rStart + rLen);
   off = rStart + rLen;
-  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing s INTEGER");             // allow:raw-byte-literal — ASN.1 INTEGER tag
+  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing s INTEGER");             // ASN.1 INTEGER tag
   var sLen = der[off + 1];
   var sStart = off + 2;
   var s = der.slice(sStart, sStart + sLen);
   // Trim leading zero pad (DER requires it when high bit set; JWT raw doesn't).
-  if (r.length > componentLen && r[0] === 0x00) r = r.slice(1);                                        // allow:raw-byte-literal — DER sign-bit pad
-  if (s.length > componentLen && s[0] === 0x00) s = s.slice(1);                                        // allow:raw-byte-literal — DER sign-bit pad
+  if (r.length > componentLen && r[0] === 0x00) r = r.slice(1);                                        // DER sign-bit pad
+  if (s.length > componentLen && s[0] === 0x00) s = s.slice(1);                                        // DER sign-bit pad
   var out = Buffer.alloc(componentLen * 2);
   r.copy(out, componentLen - r.length);
   s.copy(out, componentLen * 2 - s.length);
@@ -245,12 +245,12 @@ function encrypt(opts) {
   }
   // Decode the subscription's p256dh + auth.
   var recipientPubRaw = Buffer.from(opts.subscription.keys.p256dh, "base64url");
-  if (recipientPubRaw.length !== 65 || recipientPubRaw[0] !== 0x04) {                                 // allow:raw-byte-literal — uncompressed P-256 point shape per SEC1 §2.3.3
+  if (recipientPubRaw.length !== 65 || recipientPubRaw[0] !== 0x04) {                                 // uncompressed P-256 point shape per SEC1 §2.3.3
     throw new WebPushError("web-push/bad-p256dh",
       "encrypt: p256dh must be a 65-byte uncompressed P-256 point");
   }
   var authSecret = Buffer.from(opts.subscription.keys.auth, "base64url");
-  if (authSecret.length !== 16) {                                                                     // allow:raw-byte-literal — RFC 8291 §3.2 auth_secret length
+  if (authSecret.length !== 16) {                                                                     // RFC 8291 §3.2 auth_secret length
     throw new WebPushError("web-push/bad-auth",
       "encrypt: auth must be a 16-byte secret (got " + authSecret.length + ")");
   }
@@ -259,7 +259,7 @@ function encrypt(opts) {
   ephemeral.generateKeys();
   var ephemeralPubRaw = ephemeral.getPublicKey();   // uncompressed 65 bytes
   // ECDH shared secret.
-  var sharedSecret = ephemeral.computeSecret(recipientPubRaw);                                       // allow:raw-byte-literal — ECDH shared secret (32 bytes per P-256)
+  var sharedSecret = ephemeral.computeSecret(recipientPubRaw);                                       // ECDH shared secret (32 bytes per P-256)
   // RFC 8291 §3.4 two-stage HKDF:
   //   PRK_key = HKDF-Extract(salt=auth_secret, IKM=ECDH_shared)
   //   key_info = "WebPush: info\x00" || ua_public || as_public
@@ -276,23 +276,23 @@ function encrypt(opts) {
     recipientPubRaw,
     ephemeralPubRaw,
   ]);
-  var ikm = _hkdf(authSecret, sharedSecret, keyInfo, 32);                                              // allow:raw-byte-literal — 256-bit IKM
-  var salt = nodeCrypto.randomBytes(16);                                                              // allow:raw-byte-literal — RFC 8188 §2.2 16-byte salt
-  var cek   = _hkdf(salt, ikm, Buffer.from("Content-Encoding: aes128gcm\x00", "utf8"), 16);            // allow:raw-byte-literal — 128-bit AEAD key
-  var nonce = _hkdf(salt, ikm, Buffer.from("Content-Encoding: nonce\x00",     "utf8"), 12);            // allow:raw-byte-literal — 96-bit AEAD nonce
+  var ikm = _hkdf(authSecret, sharedSecret, keyInfo, 32);                                              // 256-bit IKM
+  var salt = nodeCrypto.randomBytes(16);                                                              // RFC 8188 §2.2 16-byte salt
+  var cek   = _hkdf(salt, ikm, Buffer.from("Content-Encoding: aes128gcm\x00", "utf8"), 16);            // 128-bit AEAD key
+  var nonce = _hkdf(salt, ikm, Buffer.from("Content-Encoding: nonce\x00",     "utf8"), 12);            // 96-bit AEAD nonce
   // RFC 8188 §2 padding: plaintext || 0x02 (delimiter for single-record).
   // RFC 8291 mandates single-record (record_size > plaintext+padding+tag).
-  var padded = Buffer.concat([plaintext, Buffer.from([0x02])]);                                        // allow:raw-byte-literal — RFC 8188 single-record delimiter
+  var padded = Buffer.concat([plaintext, Buffer.from([0x02])]);                                        // RFC 8188 single-record delimiter
   var cipher = nodeCrypto.createCipheriv("aes-128-gcm", cek, nonce);
   var ct = Buffer.concat([cipher.update(padded), cipher.final()]);
   var tag = cipher.getAuthTag();
   // RFC 8188 §2.1 header: salt(16) || rs(4 big-endian) || idlen(1) || keyid
   // For RFC 8291 the keyid is the as_public (ephemeral pubkey, 65 bytes).
-  var rs = padded.length + 16;                                                                        // allow:raw-byte-literal — record size = plaintext + tag length
-  var header = Buffer.alloc(16 + 4 + 1);                                                              // allow:raw-byte-literal — salt + rs + idlen layout
+  var rs = padded.length + 16;                                                                        // record size = plaintext + tag length
+  var header = Buffer.alloc(16 + 4 + 1);                                                              // salt + rs + idlen layout
   salt.copy(header, 0);
-  header.writeUInt32BE(rs, 16);                                                                       // allow:raw-byte-literal — salt offset
-  header[20] = ephemeralPubRaw.length;                                                                // allow:raw-byte-literal — rs offset
+  header.writeUInt32BE(rs, 16);                                                                       // salt offset
+  header[20] = ephemeralPubRaw.length;                                                                // rs offset
   var body = Buffer.concat([header, ephemeralPubRaw, ct, tag]);
   var ttlSec = opts.ttlSec || (28 * 24 * 3600);                                                       // allow:raw-time-literal — RFC 8030 §5.2 default
   return {
@@ -309,7 +309,7 @@ function _hkdf(salt, ikm, info, length) {
   // RFC 5869 HKDF-Extract + Expand using SHA-256 (per RFC 8291 / 8188).
   var prk = nodeCrypto.createHmac("sha256", salt).update(ikm).digest();
   // Expand with one-byte counter (length <= 32 always in this use).
-  var t = Buffer.concat([info, Buffer.from([0x01])]);                                                 // allow:raw-byte-literal — HKDF counter start
+  var t = Buffer.concat([info, Buffer.from([0x01])]);                                                 // HKDF counter start
   var out = nodeCrypto.createHmac("sha256", prk).update(t).digest();
   return out.slice(0, length);
 }

package/lib/webhook.js

@@ -751,7 +751,7 @@ function _writeError(res, status, code, message) {
 // b.crypto.timingSafeEqual — never `===`.
 
 var STRIPE_HMAC_ALG = "hmac-sha256-stripe";
-var STRIPE_SIG_MAX_HEX = 256;                                                                          // allow:raw-byte-literal — hex-char anti-DoS cap, not bytes
+var STRIPE_SIG_MAX_HEX = 256;                                                                          // hex-char anti-DoS cap, not bytes
 var STRIPE_DEFAULT_TOLERANCE_MS = C.TIME.minutes(5);                                                   // RFC 3161-ish 5 minute window default
 var STRIPE_MIN_TOLERANCE_MS = C.TIME.seconds(30);                                                      // refuse below 30s
 
@@ -764,7 +764,7 @@ function _parseStripeSignatureHeader(header) {
     throw new WebhookError("webhook/bad-stripe-header",
       "verify: Stripe-Signature header must be a non-empty string");
   }
-  if (header.length > 4096) {                                                                          // allow:raw-byte-literal — anti-DoS header cap
+  if (header.length > 4096) {                                                                          // anti-DoS header cap
     throw new WebhookError("webhook/bad-stripe-header",
       "verify: Stripe-Signature header exceeds 4096 bytes");
   }