@blamejs/core 0.14.1 → 0.14.3

package/lib/websocket.js

@@ -189,7 +189,7 @@ var CLOSE_GRACE_MS            = C.TIME.seconds(2);
 // IANA-registered. 4000..4999 are private-use. Anything else is
 // invalid.
 function _isValidCloseCode(code) {
-  if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // allow:raw-byte-literal — RFC 6455 §7.4.2 reserved codes
+  if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // RFC 6455 §7.4.2 reserved codes
   if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 spec range / allow:raw-time-literal — code is a numeric, not seconds
   if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 IANA / private range / allow:raw-time-literal — code is a numeric, not seconds
   return false;
@@ -1322,7 +1322,7 @@ function handleUpgrade(req, socket, head, opts) {
   // breaking the upgrade in a way that's hard to diagnose; the format
   // check at the top of handleUpgrade catches it loudly. Empty /
   // undefined falls through to the RFC default in computeAcceptKey.
-  var GUID_MAX_LENGTH = C.BYTES.bytes(64); // allow:raw-byte-literal — UUID is 36 chars; 64 is a tolerant upper bound for the regex engine.
+  var GUID_MAX_LENGTH = C.BYTES.bytes(64); // UUID is 36 chars; 64 is a tolerant upper bound for the regex engine.
   if (opts.handshakeGuid !== undefined && opts.handshakeGuid !== null) {
     // Length cap before the regex test — UUIDs are exactly 36 chars so
     // a > GUID_MAX_LENGTH input never matches the format and shouldn't
@@ -1341,7 +1341,7 @@ function handleUpgrade(req, socket, head, opts) {
   // consumer would expect for a malformed request.
   var v = validateUpgradeRequest(req, opts);
   if (!v.ok) {
-    _refuseUpgrade(socket, v.status || 400, v.reason);          // allow:raw-byte-literal — HTTP 400 fallback
+    _refuseUpgrade(socket, v.status || 400, v.reason);          // HTTP 400 fallback
     return null;
   }
 

package/lib/worker-pool.js

@@ -77,9 +77,9 @@ var { WorkerPoolError } = require("./framework-error");
 var audit = lazyRequire(function () { return require("./audit"); });
 
 var MIN_SIZE = 1;
-var MAX_SIZE = 256;                                                              // allow:raw-byte-literal — sanity ceiling on worker count, not bytes
-var DEFAULT_MAX_QUEUE_DEPTH = 1024;                                              // allow:raw-byte-literal — task-queue depth, not bytes
-var MAX_QUEUE_DEPTH_CAP = 1048576;                                               // allow:raw-byte-literal — task-queue depth ceiling, not bytes
+var MAX_SIZE = 256;                                                              // sanity ceiling on worker count, not bytes
+var DEFAULT_MAX_QUEUE_DEPTH = 1024;                                              // task-queue depth, not bytes
+var MAX_QUEUE_DEPTH_CAP = 1048576;                                               // task-queue depth ceiling, not bytes
 var DEFAULT_TASK_TIMEOUT_MS = C.TIME.minutes(5);
 var MAX_TASK_TIMEOUT_MS = C.TIME.hours(1);
 

package/lib/ws-client.js

@@ -76,16 +76,16 @@ var DEFAULT_RECONNECT_BASE_MS    = C.TIME.seconds(1) / 2;
 var DEFAULT_RECONNECT_MAX_MS     = C.TIME.seconds(30);
 var DEFAULT_RECONNECT_MAX_ATTEMPTS = 10;
 
-var OPCODE_CONT   = 0x00;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_TEXT   = 0x01;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_BINARY = 0x02;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_CLOSE  = 0x08;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_PING   = 0x09;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_PONG   = 0x0A;                                // allow:raw-byte-literal — RFC 6455 opcode
+var OPCODE_CONT   = 0x00;                                // RFC 6455 opcode
+var OPCODE_TEXT   = 0x01;                                // RFC 6455 opcode
+var OPCODE_BINARY = 0x02;                                // RFC 6455 opcode
+var OPCODE_CLOSE  = 0x08;                                // RFC 6455 opcode
+var OPCODE_PING   = 0x09;                                // RFC 6455 opcode
+var OPCODE_PONG   = 0x0A;                                // RFC 6455 opcode
 
-var CLOSE_NORMAL          = 1000;                        // allow:raw-byte-literal — RFC 6455 close code
-var CLOSE_GOING_AWAY      = 1001;                        // allow:raw-byte-literal — RFC 6455 close code
-var CLOSE_ABNORMAL        = 1006;                        // allow:raw-byte-literal — RFC 6455 close code (synthetic — never on wire)
+var CLOSE_NORMAL          = 1000;                        // RFC 6455 close code
+var CLOSE_GOING_AWAY      = 1001;                        // RFC 6455 close code
+var CLOSE_ABNORMAL        = 1006;                        // RFC 6455 close code (synthetic — never on wire)
 
 // Permanent vs transient error classifier — used by reconnect logic
 // so client doesn't hammer the server on credentials / handshake
@@ -360,7 +360,7 @@ class WsClient extends EventEmitter {
 
     var parsed = dialParsed;
     var port = parsed.port ? parseInt(parsed.port, 10) :
-               (parsed.protocol === "wss:" ? 443 : 80);                                  // allow:raw-byte-literal — TLS / HTTP default port
+               (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
 
     function _onError(err) { self._handleSocketError(err); }
@@ -443,7 +443,7 @@ class WsClient extends EventEmitter {
       "Upgrade: websocket",
       "Connection: Upgrade",
       "Sec-WebSocket-Key: " + key,
-      "Sec-WebSocket-Version: 13",                                                       // allow:raw-byte-literal — RFC 6455 §1.9
+      "Sec-WebSocket-Version: 13",                                                       // RFC 6455 §1.9
     ];
     if (opts.origin) {
       if (safeBuffer.hasCrlf(opts.origin)) {
@@ -510,7 +510,7 @@ class WsClient extends EventEmitter {
       return;
     }
     var status = parseInt(match[1], 10);
-    if (status !== 101) {                                                                 // allow:raw-byte-literal — HTTP 101
+    if (status !== 101) {                                                                 // HTTP 101
       // Body bytes after the header section are the server's
       // explanation. Surface them on the error so callers can branch
       // on the status code and inspect the body without re-parsing
@@ -560,7 +560,7 @@ class WsClient extends EventEmitter {
     this._negotiatedSubprotocol = negotiatedSubprotocol;
 
     this._negotiatedDeflate = false;
-    this._negotiatedWindowBits = 15;                                                      // allow:raw-byte-literal — RFC 7692 default windowBits
+    this._negotiatedWindowBits = 15;                                                      // RFC 7692 default windowBits
     if (this._opts.permessageDeflate &&
         (headers["sec-websocket-extensions"] || "").indexOf("permessage-deflate") !== -1) {
       this._negotiatedDeflate = true;
@@ -572,7 +572,7 @@ class WsClient extends EventEmitter {
       var smwbMatch = extLine.match(/server_max_window_bits\s*=\s*"?(\d+)"?/);             // allow:regex-no-length-cap — bounded by header line + RFC 7692 §7.1
       if (smwbMatch) {
         var smwb = parseInt(smwbMatch[1], 10);
-        if (smwb < 8 || smwb > 15) {                                                      // allow:raw-byte-literal — RFC 7692 windowBits range
+        if (smwb < 8 || smwb > 15) {                                                      // RFC 7692 windowBits range
           this._handleSocketError(new WsClientError("ws-client/deflate-error",
             "server_max_window_bits=" + smwb + " is outside RFC 7692 range [8, 15]"));
           return;
@@ -635,7 +635,7 @@ class WsClient extends EventEmitter {
                     frame.opcode === OPCODE_PONG ||
                     frame.opcode === OPCODE_CLOSE;
     if (isControl) {
-      if (frame.payload.length > 125) {                                                   // allow:raw-byte-literal — RFC 6455 §5.5 control-frame cap
+      if (frame.payload.length > 125) {                                                   // RFC 6455 §5.5 control-frame cap
         this._handleSocketError(new WsClientError("ws-client/control-too-big",
           "control-frame payload exceeds 125 bytes (RFC 6455 §5.5)"));
         return;
@@ -665,7 +665,7 @@ class WsClient extends EventEmitter {
       var code = CLOSE_NORMAL, reason = "";
       if (frame.payload.length >= 2) {
         code = frame.payload.readUInt16BE(0);
-        var reasonBytes = frame.payload.subarray(2);                                      // allow:raw-byte-literal — RFC 6455 close-frame layout
+        var reasonBytes = frame.payload.subarray(2);                                      // RFC 6455 close-frame layout
         try {
           reason = new TextDecoder("utf-8", { fatal: true }).decode(reasonBytes);
         } catch (_e) {
@@ -711,7 +711,7 @@ class WsClient extends EventEmitter {
       if (this._negotiatedDeflate && firstFrameRsv1) {
         try {
           var zlib = require("node:zlib");                                                     // allow:inline-require — zlib only on deflate-negotiated path
-          var compressed = Buffer.concat([fullPayload, Buffer.from([0x00, 0x00, 0xff, 0xff])]); // allow:raw-byte-literal — RFC 7692 §7.2.2 deflate trailer
+          var compressed = Buffer.concat([fullPayload, Buffer.from([0x00, 0x00, 0xff, 0xff])]); // RFC 7692 §7.2.2 deflate trailer
           // Decompression-bomb defense: zlib.inflateRawSync's
           // `maxOutputLength` aborts the inflate the moment the
           // output would exceed maxMessageBytes — never decode GBs
@@ -828,26 +828,26 @@ class WsClient extends EventEmitter {
     // mid-codepoint — to be RFC-safe we truncate at code-point
     // boundaries.
     var rb = Buffer.from(reason, "utf8");
-    if (rb.length > 123) {                                                                // allow:raw-byte-literal — RFC 6455 §5.5 (125 - 2)
+    if (rb.length > 123) {                                                                // RFC 6455 §5.5 (125 - 2)
       // Truncate at last complete codepoint within 123 bytes. Use a
       // fatal TextDecoder to validate; back off one byte at a time
       // until the slice decodes cleanly. Bounded by [123 - 3, 123]
       // since a single UTF-8 codepoint is at most 4 bytes.
       var fatal = new TextDecoder("utf-8", { fatal: true });
-      var truncated = rb.subarray(0, 123);                                                // allow:raw-byte-literal — RFC 6455 §5.5
-      for (var bi = 0; bi < 4; bi += 1) {                                                 // allow:raw-byte-literal — max UTF-8 codepoint width
+      var truncated = rb.subarray(0, 123);                                                // RFC 6455 §5.5
+      for (var bi = 0; bi < 4; bi += 1) {                                                 // max UTF-8 codepoint width
         try { fatal.decode(truncated); break; }
         catch (_e) { truncated = truncated.subarray(0, truncated.length - 1); }
       }
       rb = truncated;
     }
-    var payload = Buffer.alloc(2 + rb.length);                                            // allow:raw-byte-literal — RFC 6455 close-frame layout
+    var payload = Buffer.alloc(2 + rb.length);                                            // RFC 6455 close-frame layout
     payload.writeUInt16BE(code, 0);
-    rb.copy(payload, 2);                                                                  // allow:raw-byte-literal — RFC 6455 close-frame layout
+    rb.copy(payload, 2);                                                                  // RFC 6455 close-frame layout
     this._readyState = "closing";
     this._sendFrame(OPCODE_CLOSE, payload, { fin: true });
     var self = this;
-    setTimeout(function () { self._teardown(code, reason, false); }, 1000).unref();       // allow:raw-byte-literal — graceful close grace window
+    setTimeout(function () { self._teardown(code, reason, false); }, 1000).unref();       // graceful close grace window
   }
 
   _teardown(code, reason, willReconnect) {
@@ -921,7 +921,7 @@ class WsClient extends EventEmitter {
   _scheduleReconnect() {
     var rOpts = this._opts.reconnectOpts;
     this._reconnectAttempt += 1;
-    var attempt = Math.min(this._reconnectAttempt, 30);                                   // allow:raw-byte-literal — clamp 2^attempt overflow
+    var attempt = Math.min(this._reconnectAttempt, 30);                                   // clamp 2^attempt overflow
     var ceiling = Math.min(rOpts.maxMs, rOpts.baseMs * Math.pow(2, attempt - 1));
     var delay   = Math.floor(Math.random() * ceiling);                                    // allow:math-random-noncrypto — backoff jitter, not security
     var self = this;

package/lib/xml-c14n.js

@@ -62,7 +62,7 @@ var XmlC14nError = defineClass("XmlC14nError", { alwaysPermanent: true });
 function _xmlErr(code, message) { return new XmlC14nError(code, message); }
 
 var MAX_INPUT_BYTES = 8 * 1024 * 1024;                                                          // allow:raw-byte-literal — XML doc cap (8 MiB)
-var MAX_DEPTH       = 200;                                                                      // allow:raw-byte-literal — element nesting depth ceiling
+var MAX_DEPTH       = 200;                                                                      // element nesting depth ceiling
 
 /**
  * @primitive b.xmlC14n.parse
@@ -172,7 +172,7 @@ function parse(xml) {
           if (name.charAt(0) === "#") {
             var code;
             if (name.charAt(1) === "x" || name.charAt(1) === "X") {
-              code = parseInt(name.slice(2), 16);                                              // allow:raw-byte-literal — hex radix
+              code = parseInt(name.slice(2), 16);                                              // hex radix
             } else {
               code = parseInt(name.slice(1), 10);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:5ae2d0f7-e30f-4d02-90d0-975129430c5f",
+  "serialNumber": "urn:uuid:bfe58661-57c7-4e95-87a0-d0a82ae37a6b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-30T05:49:41.774Z",
+    "timestamp": "2026-05-30T08:21:39.433Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.14.1",
+      "bom-ref": "@blamejs/core@0.14.3",
       "type": "application",
       "name": "blamejs",
-      "version": "0.14.1",
+      "version": "0.14.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.14.1",
+      "purl": "pkg:npm/%40blamejs/core@0.14.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.14.1",
+      "ref": "@blamejs/core@0.14.3",
       "dependsOn": []
     }
   ]