@blamejs/core 0.14.1 → 0.14.3

package/lib/cwt.js

@@ -52,7 +52,7 @@ Object.keys(STD).forEach(function (k) { STD_BY_LABEL[STD[k]] = k; });
 var NUMERIC_DATE_CLAIMS = { exp: true, nbf: true, iat: true };
 
 // CWT CBOR tag (RFC 8392 §6) — 61, encoded as the 2-byte head 0xd8 0x3d.
-var CWT_TAG_PREFIX = Buffer.from([0xd8, 0x3d]);                                        // allow:raw-byte-literal — CBOR tag-61 head (0xd8=tag 1-byte arg, 0x3d=61)
+var CWT_TAG_PREFIX = Buffer.from([0xd8, 0x3d]);                                        // CBOR tag-61 head (0xd8=tag 1-byte arg, 0x3d=61)
 
 function _nowSec(opts) {
   var ms = (opts && typeof opts.now === "number") ? opts.now : Date.now();
@@ -62,10 +62,10 @@ function _nowSec(opts) {
 // Read a leading CBOR tag head (major type 6) in any of its encodings;
 // returns { tag, len } or null if the buffer doesn't start with a tag.
 function _readTagHead(buf) {
-  if (buf.length < 1 || (buf[0] >> 5) !== 6) return null;                               // allow:raw-byte-literal — CBOR major-type 6 (tag) shift
+  if (buf.length < 1 || (buf[0] >> 5) !== 6) return null;                               // CBOR major-type 6 (tag) shift
   var ai = buf[0] & 0x1f;
   if (ai < 24) return { tag: ai, len: 1 };
-  if (ai === 24) return buf.length >= 2 ? { tag: buf[1], len: 2 } : null;               // allow:raw-byte-literal — CBOR additional-info threshold (RFC 8949 §3), not a size
+  if (ai === 24) return buf.length >= 2 ? { tag: buf[1], len: 2 } : null;               // CBOR additional-info threshold (RFC 8949 §3), not a size
   if (ai === 25) return buf.length >= 3 ? { tag: buf.readUInt16BE(1), len: 3 } : null;
   if (ai === 26) return buf.length >= 5 ? { tag: buf.readUInt32BE(1), len: 5 } : null;
   if (ai === 27) return buf.length >= 9 ? { tag: Number(buf.readBigUInt64BE(1)), len: 9 } : null;
@@ -178,7 +178,7 @@ async function verify(cwt, opts) {
   // an external CBOR encoder may emit a non-minimal but valid tag 61.
   var coseBytes = Buffer.from(cwt);
   var head = _readTagHead(coseBytes);
-  if (head && head.tag === 61) coseBytes = coseBytes.subarray(head.len);                // allow:raw-byte-literal — CWT CBOR tag number (RFC 8392 §6)
+  if (head && head.tag === 61) coseBytes = coseBytes.subarray(head.len);                // CWT CBOR tag number (RFC 8392 §6)
 
   var verified = await cose.verify(coseBytes, {
     algorithms: opts.algorithms, publicKey: opts.publicKey,

package/lib/dark-patterns.js

@@ -28,8 +28,8 @@
 var audit = require("./audit");
 var { defineClass } = require("./framework-error");
 
-var STR_LEN_MAX     = 256;                                                                  // allow:raw-byte-literal — string-length cap, not bytes
-var FONT_WEIGHT_MAX = 1000;                                                                 // allow:raw-byte-literal — CSS font-weight ceiling (CSS Fonts L4)
+var STR_LEN_MAX     = 256;                                                                  // string-length cap, not bytes
+var FONT_WEIGHT_MAX = 1000;                                                                 // CSS font-weight ceiling (CSS Fonts L4)
 var DarkPatternsError = defineClass("DarkPatternsError", { alwaysPermanent: true });
 
 var CHANNELS = ["web", "mobile", "phone", "email", "in-person", "mail"];

package/lib/data-act.js

@@ -298,8 +298,8 @@ function recordSwitchRequest(opts) {
     throw new DataActError("dataact/no-data-slices",
       "recordSwitchRequest: dataSlices must be a non-empty array");
   }
-  var noticePeriod = typeof opts.noticePeriodDays === "number" ? opts.noticePeriodDays : 30;     // allow:raw-byte-literal — Art 28 §3 30-day cap
-  if (noticePeriod > 30) {                                                                       // allow:raw-byte-literal — Art 28 §3 30-day cap
+  var noticePeriod = typeof opts.noticePeriodDays === "number" ? opts.noticePeriodDays : 30;     // Art 28 §3 30-day cap
+  if (noticePeriod > 30) {                                                                       // Art 28 §3 30-day cap
     throw new DataActError("dataact/notice-period-too-long",
       "recordSwitchRequest: noticePeriodDays " + noticePeriod + " exceeds Art 28 §3 cap of 30 days");
   }

package/lib/db-file-lifecycle.js

@@ -74,8 +74,8 @@ var emit = validateOpts.makeNamespacedEmitters("db.fileLifecycle", { audit: audi
 var DbFileLifecycleError = defineClass("DbFileLifecycleError", { alwaysPermanent: true });
 
 var DEFAULT_FLUSH_INTERVAL_MS = C.TIME.minutes(5);
-var DB_ENC_KEY_BYTES = 32;                                                                       // allow:raw-byte-literal — 256-bit symmetric key
-var TMP_NAME_BYTES   = 16;                                                                       // allow:raw-byte-literal — random suffix
+var DB_ENC_KEY_BYTES = 32;                                                                       // 256-bit symmetric key
+var TMP_NAME_BYTES   = 16;                                                                       // random suffix
 
 var _emitAudit  = emit.audit;
 var _emitMetric = emit.metric;
@@ -212,7 +212,7 @@ function fileLifecycle(opts) {
       generateToken(TMP_NAME_BYTES) + ".db");
     if (nodeFs.existsSync(encPath)) {
       var packed = nodeFs.readFileSync(encPath);
-      if (packed.length < 26) {                                                                  // allow:raw-byte-literal — minimum envelope length
+      if (packed.length < 26) {                                                                  // minimum envelope length
         throw new DbFileLifecycleError("db-file-lifecycle/short-envelope",
           "fileLifecycle: " + encPath + " too short to be a valid envelope (" + packed.length + " bytes)");
       }
@@ -279,7 +279,7 @@ function fileLifecycle(opts) {
         "fileLifecycle.startFlushTimer: timer already running — call stop() first");
     }
     var interval = sopts.intervalMs || flushIntervalMs;
-    encTimer = setInterval(function () {                                                          // allow:setinterval-unref — .unref() called immediately below; timer doesn't pin the event loop
+    encTimer = setInterval(function () {                                                          // allow:timer-no-unref — .unref() called immediately below; timer doesn't pin the event loop
       try { flushNow(db); }
       catch (e) {
         _emitAudit("flush_failed", "failure", {

package/lib/db-query.js

@@ -629,7 +629,7 @@ class Query {
     opts = opts || {};
     var limit = opts.limit === undefined ? 25 : opts.limit;
     var offset = opts.offset === undefined ? 0 : opts.offset;
-    if (!Number.isInteger(limit) || limit <= 0 || limit > 1000) {                          // allow:raw-byte-literal — paginate page-size cap, not bytes
+    if (!Number.isInteger(limit) || limit <= 0 || limit > 1000) {                          // paginate page-size cap, not bytes
       throw new Error("paginate: limit must be a positive integer ≤ 1000 (default 25)");
     }
     if (!Number.isInteger(offset) || offset < 0) {

package/lib/db.js

@@ -158,7 +158,7 @@ var tableMetadata = {};     // table name → metadata snapshot (PK/FK/sealed/de
 // generous-but-bounded 1M rows so an accidentally-unbounded export
 // surfaces a thrown error instead of OOM. v0.7.67's maxRowsPerQuery
 // bounds .all() / .first() — this is its streaming counterpart.
-var streamLimit = C.BYTES.bytes(1000000);                                                              // allow:raw-byte-literal — row-count ceiling, not bytes
+var streamLimit = C.BYTES.bytes(1000000);                                                              // row-count ceiling, not bytes
 
 // ---- Framework-baked tables ----
 //
@@ -1501,7 +1501,7 @@ function from(tableName) {
 // the same SQL string returns the cached Statement (the canonical
 // node:sqlite-style win); previously this was ad-hoc and operators
 // re-preparing in a hot path leaked fds.
-var PREPARE_CACHE_MAX = 256;                                                       // allow:raw-byte-literal — distinct-statement cache cap
+var PREPARE_CACHE_MAX = 256;                                                       // distinct-statement cache cap
 var _prepareCache = new Map();                                                     // sql → Statement (insertion order = LRU)
 
 /**
@@ -1688,7 +1688,7 @@ function _reportSlowSqlite(durationMs, statement) {
           backend:        "sqlite",
           bucket:         bucket.label,
           statementClass: _classifyStatementLocal(statement),
-          "db.statement": String(statement || "").slice(0, 256),                                       // allow:raw-byte-literal — log-truncation length, not bytes
+          "db.statement": String(statement || "").slice(0, 256),                                       // log-truncation length, not bytes
         });
       } catch (_e) { /* hot-path observability sink — drop-silent by design */ }
       return;
@@ -1717,7 +1717,7 @@ function execRaw(sql) {
           // OTel can correlate without an adapter.
           "db.system":     "sqlite",
           "db.operation":  String(sql).match(DDL_RE)[1].toUpperCase(),
-          "db.statement":  String(sql).slice(0, 256),                                          // allow:raw-byte-literal — log-truncation length, not bytes
+          "db.statement":  String(sql).slice(0, 256),                                          // log-truncation length, not bytes
           durationMs:      durationMs,
         },
       });
@@ -1734,7 +1734,7 @@ function execRaw(sql) {
         metadata: {
           "db.system":     "sqlite",
           "db.operation":  String(sql).match(DDL_RE)[1].toUpperCase(),
-          "db.statement":  String(sql).slice(0, 256),                                          // allow:raw-byte-literal — log-truncation length, not bytes
+          "db.statement":  String(sql).slice(0, 256),                                          // log-truncation length, not bytes
           durationMs:      failureMs,
         },
       });
@@ -2684,7 +2684,7 @@ function vacuumAfterErase(opts) {
   } else {
     require("./numeric-bounds").requirePositiveFiniteIntIfPresent(
       opts.pages, "pages", DbError, "db/bad-vacuum-pages");
-    var pages = (opts.pages == null) ? 1000                                       // allow:raw-byte-literal — incremental_vacuum default page count
+    var pages = (opts.pages == null) ? 1000                                       // incremental_vacuum default page count
       : Math.floor(opts.pages);
     sqlStmt = "PRAGMA incremental_vacuum(" + pages + ");";
   }

package/lib/dbsc.js

@@ -69,14 +69,14 @@ var DEFAULT_CHALLENGE_TTL_MS = C.TIME.minutes(5);
 function challenge(opts) {
   opts = validateOpts.requireObject(opts, "dbsc.challenge", DbscError, "dbsc/bad-opts");
   validateOpts(opts, ["secretKey", "ttlMs", "nonce"], "dbsc.challenge");
-  if (!Buffer.isBuffer(opts.secretKey) || opts.secretKey.length < 32) {                               // allow:raw-byte-literal — 32-byte HMAC secret floor
+  if (!Buffer.isBuffer(opts.secretKey) || opts.secretKey.length < 32) {                               // 32-byte HMAC secret floor
     throw new DbscError("dbsc/bad-secret",
       "challenge: opts.secretKey must be a Buffer (>= 32 bytes)");
   }
   validateOpts.optionalPositiveFinite(opts.ttlMs, "dbsc.challenge: ttlMs",
     DbscError, "dbsc/bad-ttl");
   var ttlMs     = opts.ttlMs || DEFAULT_CHALLENGE_TTL_MS;
-  var nonceBuf  = opts.nonce ? Buffer.from(String(opts.nonce), "utf8") : bCrypto.generateBytes(32);   // allow:raw-byte-literal — 32-byte nonce
+  var nonceBuf  = opts.nonce ? Buffer.from(String(opts.nonce), "utf8") : bCrypto.generateBytes(32);   // 32-byte nonce
   var expiresAt = Date.now() + ttlMs;
   var msg = nonceBuf.toString("base64") + "." + expiresAt;
   var mac = nodeCrypto.createHmac("sha3-512", opts.secretKey).update(msg).digest("base64");
@@ -110,7 +110,7 @@ function verifyChallenge(challengeStr, opts) {
     throw new DbscError("dbsc/bad-challenge",
       "verifyChallenge: challenge must be a string");
   }
-  if (!Buffer.isBuffer(opts.secretKey) || opts.secretKey.length < 32) {                               // allow:raw-byte-literal — 32-byte HMAC secret floor
+  if (!Buffer.isBuffer(opts.secretKey) || opts.secretKey.length < 32) {                               // 32-byte HMAC secret floor
     throw new DbscError("dbsc/bad-secret",
       "verifyChallenge: opts.secretKey must be a Buffer (>= 32 bytes)");
   }
@@ -209,7 +209,7 @@ function verifyBindingAssertion(assertion, opts) {
   var ok;
   if (headerJson.alg === "ES256") {
     // JWT raw r||s → DER for nodeCrypto.verify.
-    if (sigBytes.length !== 64) {                                                                     // allow:raw-byte-literal — P-256 r||s shape
+    if (sigBytes.length !== 64) {                                                                     // P-256 r||s shape
       throw new DbscError("dbsc/bad-sig", "ES256 signature must be 64 bytes raw");
     }
     var derSig = _ecdsaRawToDer(sigBytes);
@@ -237,8 +237,8 @@ function verifyBindingAssertion(assertion, opts) {
       "or 'challenge' (server-nonce-bound); without freshness material the " +
       "assertion replays indefinitely");
   }
-  var maxAge = (opts.maxAgeSec || 300) * 1000;                                                        // allow:raw-byte-literal allow:raw-time-literal — 5min default
-  if (typeof payloadJson.iat === "number" && Date.now() - payloadJson.iat * 1000 > maxAge) {          // allow:raw-byte-literal allow:raw-time-literal — sec→ms
+  var maxAge = (opts.maxAgeSec || 300) * 1000;                                                        // allow:raw-time-literal — 5min default
+  if (typeof payloadJson.iat === "number" && Date.now() - payloadJson.iat * 1000 > maxAge) {          // allow:raw-time-literal — sec→ms
     throw new DbscError("dbsc/stale",
       "verifyBindingAssertion: iat is more than " + opts.maxAgeSec + "s old");
   }
@@ -252,23 +252,23 @@ function verifyBindingAssertion(assertion, opts) {
 }
 
 function _ecdsaRawToDer(raw) {
-  if (raw.length !== 64) throw new DbscError("dbsc/bad-sig", "raw r||s must be 64 bytes");            // allow:raw-byte-literal — P-256 r||s shape
-  var r = _trimLeadingZeros(raw.slice(0, 32));                                                        // allow:raw-byte-literal — 32-byte r
-  var s = _trimLeadingZeros(raw.slice(32));                                                           // allow:raw-byte-literal — 32-byte s offset
+  if (raw.length !== 64) throw new DbscError("dbsc/bad-sig", "raw r||s must be 64 bytes");            // P-256 r||s shape
+  var r = _trimLeadingZeros(raw.slice(0, 32));                                                        // 32-byte r
+  var s = _trimLeadingZeros(raw.slice(32));                                                           // 32-byte s offset
   function _intDer(buf) {
     // Prepend 0x00 if high bit set (positive INTEGER per DER).
-    if (buf[0] & 0x80) buf = Buffer.concat([Buffer.from([0x00]), buf]);                               // allow:raw-byte-literal — DER sign-bit pad
-    return Buffer.concat([Buffer.from([0x02, buf.length]), buf]);                                      // allow:raw-byte-literal — ASN.1 INTEGER tag
+    if (buf[0] & 0x80) buf = Buffer.concat([Buffer.from([0x00]), buf]);                               // DER sign-bit pad
+    return Buffer.concat([Buffer.from([0x02, buf.length]), buf]);                                      // ASN.1 INTEGER tag
   }
   var rDer = _intDer(r);
   var sDer = _intDer(s);
   var seqBody = Buffer.concat([rDer, sDer]);
-  return Buffer.concat([Buffer.from([0x30, seqBody.length]), seqBody]);                               // allow:raw-byte-literal — ASN.1 SEQUENCE tag
+  return Buffer.concat([Buffer.from([0x30, seqBody.length]), seqBody]);                               // ASN.1 SEQUENCE tag
 }
 
 function _trimLeadingZeros(buf) {
   var i = 0;
-  while (i < buf.length - 1 && buf[i] === 0x00) i += 1;                                                // allow:raw-byte-literal — leading zero byte
+  while (i < buf.length - 1 && buf[i] === 0x00) i += 1;                                                // leading zero byte
   return buf.slice(i);
 }
 

package/lib/did.js

@@ -58,15 +58,15 @@ var B58_MAP = (function () {
   for (var i = 0; i < B58_ALPHABET.length; i += 1) m[B58_ALPHABET[i]] = i;
   return m;
 })();
-var MAX_MULTIBASE_CHARS = 1024;                        // allow:raw-byte-literal — bounded did:key multibase length (DoS cap)
-var MAX_JWK_B64_CHARS = 8192;                          // allow:raw-byte-literal — bounded did:jwk encoded-JWK length (DoS cap)
+var MAX_MULTIBASE_CHARS = 1024;                        // bounded did:key multibase length (DoS cap)
+var MAX_JWK_B64_CHARS = 8192;                          // bounded did:jwk encoded-JWK length (DoS cap)
 
 // multicodec public-key codes (unsigned-varint) → curve descriptor.
 // keyLen is the multicodec payload: Ed25519 raw 32; EC compressed point.
 var MULTICODEC = {
   0xed:   { name: "Ed25519",   kind: "okp" },                                    // ed25519-pub
-  0x1200: { name: "P-256",     kind: "ec", curveOid: "1.2.840.10045.3.1.7" },    // allow:raw-byte-literal allow:raw-time-literal — p256-pub multicodec code + OID dotted-form
-  0x1201: { name: "P-384",     kind: "ec", curveOid: "1.3.132.0.34" },           // allow:raw-byte-literal — p384-pub multicodec code
+  0x1200: { name: "P-256",     kind: "ec", curveOid: "1.2.840.10045.3.1.7" },    // allow:raw-time-literal — p256-pub multicodec code + OID dotted-form
+  0x1201: { name: "P-384",     kind: "ec", curveOid: "1.3.132.0.34" },           // p384-pub multicodec code
   0xe7:   { name: "secp256k1", kind: "ec", curveOid: "1.3.132.0.10" },           // secp256k1-pub
 };
 var NAME_TO_CODE = {};
@@ -86,9 +86,9 @@ function _b58decode(str) {
     for (var j = 0; j < bytes.length; j += 1) {
       carry += bytes[j] * 58;
       bytes[j] = carry & 0xff;
-      carry >>= 8;                                     // allow:raw-byte-literal — base-256 carry
+      carry >>= 8;                                     // base-256 carry
     }
-    while (carry > 0) { bytes.push(carry & 0xff); carry >>= 8; }   // allow:raw-byte-literal — base-256 carry
+    while (carry > 0) { bytes.push(carry & 0xff); carry >>= 8; }   // base-256 carry
   }
   // Leading '1's are leading zero bytes.
   for (var k = 0; k < str.length && str[k] === "1"; k += 1) bytes.push(0);
@@ -100,7 +100,7 @@ function _b58encode(buf) {
   for (var i = 0; i < buf.length; i += 1) {
     var carry = buf[i];
     for (var j = 0; j < digits.length; j += 1) {
-      carry += digits[j] << 8;                         // allow:raw-byte-literal — base-256 shift
+      carry += digits[j] << 8;                         // base-256 shift
       digits[j] = carry % 58;
       carry = (carry / 58) | 0;
     }
@@ -115,19 +115,19 @@ function _b58encode(buf) {
 // Read an unsigned LEB128 varint (multicodec code). Bounded to 4 bytes.
 function _readVarint(buf) {
   var value = 0, shift = 0, len = 0;
-  for (var i = 0; i < buf.length && i < 4; i += 1) {   // allow:raw-byte-literal — multicodec varint ≤ 4 bytes
+  for (var i = 0; i < buf.length && i < 4; i += 1) {   // multicodec varint ≤ 4 bytes
     var b = buf[i];
     value |= (b & 0x7f) << shift;
     len += 1;
     if ((b & 0x80) === 0) return { value: value >>> 0, length: len };
-    shift += 7;                                        // allow:raw-byte-literal — 7 bits per varint byte
+    shift += 7;                                        // 7 bits per varint byte
   }
   throw new DidError("did/bad-multicodec", "did: multicodec varint did not terminate");
 }
 function _encodeVarint(code) {
   var out = [];
   var n = code;
-  do { var b = n & 0x7f; n >>>= 7; if (n > 0) b |= 0x80; out.push(b); } while (n > 0);   // allow:raw-byte-literal — LEB128 7-bit groups
+  do { var b = n & 0x7f; n >>>= 7; if (n > 0) b |= 0x80; out.push(b); } while (n > 0);   // LEB128 7-bit groups
   return Buffer.from(out);
 }
 
@@ -137,9 +137,9 @@ var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");   // R
 
 function _keyObjectFromMulticodec(code, keyBytes) {
   var desc = MULTICODEC[code];
-  if (!desc) throw new DidError("did/unsupported-key", "did: unsupported multicodec key code 0x" + code.toString(16));   // allow:raw-byte-literal — hex radix
+  if (!desc) throw new DidError("did/unsupported-key", "did: unsupported multicodec key code 0x" + code.toString(16));   // hex radix
   if (desc.kind === "okp") {
-    if (keyBytes.length !== 32) {                      // allow:raw-byte-literal — Ed25519 public key is 32 bytes
+    if (keyBytes.length !== 32) {                      // Ed25519 public key is 32 bytes
       throw new DidError("did/bad-key", "did: Ed25519 key must be 32 bytes (got " + keyBytes.length + ")");
     }
     return nodeCrypto.createPublicKey({ key: Buffer.concat([ED25519_SPKI_PREFIX, keyBytes]), format: "der", type: "spki" });
@@ -152,25 +152,25 @@ function _keyObjectFromMulticodec(code, keyBytes) {
   var algid = _ecAlgId(desc.curveOid);
   var bitstr = Buffer.concat([Buffer.from([0x03, keyBytes.length + 1, 0x00]), keyBytes]);
   var body = Buffer.concat([algid, bitstr]);
-  var spki = Buffer.concat([Buffer.from([0x30, body.length]), body]);      // allow:raw-byte-literal — SEQUENCE tag; single-byte DER length holds for these curves
+  var spki = Buffer.concat([Buffer.from([0x30, body.length]), body]);      // SEQUENCE tag; single-byte DER length holds for these curves
   try { return nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" }); }
   catch (e) { throw new DidError("did/bad-key", "did: could not import EC key: " + ((e && e.message) || e)); }
 }
 
 // AlgorithmIdentifier SEQUENCE { id-ecPublicKey, namedCurve OID }.
 function _ecAlgId(curveOid) {
-  var idEcPublicKey = Buffer.from("06072a8648ce3d0201", "hex");            // allow:raw-byte-literal allow:raw-time-literal — DER OID for id-ecPublicKey
+  var idEcPublicKey = Buffer.from("06072a8648ce3d0201", "hex");            // allow:raw-time-literal — DER OID for id-ecPublicKey
   var curve = _oidDer(curveOid);
   var inner = Buffer.concat([idEcPublicKey, curve]);
   return Buffer.concat([Buffer.from([0x30, inner.length]), inner]);
 }
 function _oidDer(dotted) {
   var parts = dotted.split(".").map(Number);
-  var bytes = [parts[0] * 40 + parts[1]];                                  // allow:raw-byte-literal — X.690 first-arc encoding
+  var bytes = [parts[0] * 40 + parts[1]];                                  // X.690 first-arc encoding
   for (var i = 2; i < parts.length; i += 1) {
     var arc = parts[i], stack = [];
-    do { stack.unshift(arc & 0x7f); arc >>>= 7; } while (arc > 0);        // allow:raw-byte-literal — base-128 OID arc
-    for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;       // allow:raw-byte-literal — continuation bit
+    do { stack.unshift(arc & 0x7f); arc >>>= 7; } while (arc > 0);        // base-128 OID arc
+    for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;       // continuation bit
     bytes = bytes.concat(stack);
   }
   return Buffer.concat([Buffer.from([0x06, bytes.length]), Buffer.from(bytes)]);

package/lib/dora.js

@@ -46,9 +46,9 @@ var observability = lazyRequire(function () { return require("./observability");
 //   - Critical-process disruption >= 8h
 //   - Reputational impact (media coverage)
 var MAJOR_INCIDENT_THRESHOLDS = Object.freeze({
-  affectedClientsAbsolute:      100000,                                          // allow:raw-byte-literal — RTS 2024/1772 Art. 1(1)(a) regulator-fixed cap (100k clients)
+  affectedClientsAbsolute:      100000,                                          // RTS 2024/1772 Art. 1(1)(a) regulator-fixed cap (100k clients)
   affectedClientsPercentile:    0.10,                                            // RTS Art. 1(1)(a) — 10% client base
-  economicImpactEur:            100000,                                          // allow:raw-byte-literal — RTS 2024/1772 Art. 1(1)(c) regulator-fixed cap (100k EUR)
+  economicImpactEur:            100000,                                          // RTS 2024/1772 Art. 1(1)(c) regulator-fixed cap (100k EUR)
   geographicMemberStates:       2,                                               // RTS Art. 1(1)(d) — 2+ member states
   durationCriticalProcessMs:    C.TIME.hours(8),                                 // RTS Art. 1(1)(e) — 8h
 });
@@ -56,9 +56,9 @@ var MAJOR_INCIDENT_THRESHOLDS = Object.freeze({
 // Article 8 — significant incident (one threshold below major).
 // Default threshold values per ESA guidelines.
 var SIGNIFICANT_INCIDENT_THRESHOLDS = Object.freeze({
-  affectedClientsAbsolute:      10000,                                           // allow:raw-byte-literal — ESA-guideline regulator-fixed cap (10k clients)
+  affectedClientsAbsolute:      10000,                                           // ESA-guideline regulator-fixed cap (10k clients)
   affectedClientsPercentile:    0.01,                                            // 1% client base
-  economicImpactEur:            10000,                                           // allow:raw-byte-literal — ESA-guideline regulator-fixed cap (10k EUR)
+  economicImpactEur:            10000,                                           // ESA-guideline regulator-fixed cap (10k EUR)
   durationCriticalProcessMs:    C.TIME.hours(2),                                 // 2h
 });
 

package/lib/dsr.js

@@ -368,7 +368,7 @@ function create(opts) {
   }
 
   function _newTicketId() {
-    var ts = String(Date.now()).slice(-7);                                         // allow:raw-byte-literal — last 7 chars of unix-ms timestamp; collision-resistant when paired with the random suffix
+    var ts = String(Date.now()).slice(-7);                                         // last 7 chars of unix-ms timestamp; collision-resistant when paired with the random suffix
     var rnd = bCrypto.generateBytes(C.BYTES.bytes(6)).toString("hex").toUpperCase();
     return "DSR-" + ts + "-" + rnd;
   }

package/lib/early-hints.js

@@ -67,7 +67,7 @@ var REFUSED_HEADERS = Object.freeze([
 ]);
 
 var LINK_RELATION_RE = /^(preload|preconnect|prefetch|dns-prefetch|modulepreload|prerender|next|prev)$/i;
-var LINK_MAX_BYTES = 4096;                                                                         // allow:raw-byte-literal — per-link length cap, not bytes
+var LINK_MAX_BYTES = 4096;                                                                         // per-link length cap, not bytes
 
 /**
  * @primitive b.earlyHints.send
@@ -194,7 +194,7 @@ function _validateLink(linkValue, idx) {
     throw new EarlyHintsError("early-hints/bad-link",
       "link[" + idx + "] missing rel= parameter (RFC 8288)");
   }
-  if (relMatch[1].length > 32 || !LINK_RELATION_RE.test(relMatch[1])) {                            // allow:raw-byte-literal — rel-token length cap, not bytes
+  if (relMatch[1].length > 32 || !LINK_RELATION_RE.test(relMatch[1])) {                            // rel-token length cap, not bytes
     throw new EarlyHintsError("early-hints/bad-link",
       "link[" + idx + "].rel '" + relMatch[1] + "' must be one of: " +
       "preload, preconnect, prefetch, dns-prefetch, modulepreload, prerender, next, prev");

package/lib/eat.js

@@ -54,10 +54,10 @@ var { defineClass } = require("./framework-error");
 var EatError = defineClass("EatError", { alwaysPermanent: true });
 
 // RFC 9711 / IANA CWT Claims registry claim keys.
-var EAT = {                                                                            // allow:raw-byte-literal — RFC 9711 / IANA CWT claim-key labels, not byte sizes
-  nonce: 10, ueid: 256, sueids: 257, oemid: 258, hwmodel: 259, hwversion: 260,         // allow:raw-byte-literal — CWT claim keys
-  uptime: 261, oemboot: 262, dbgstat: 263, location: 264, eat_profile: 265,            // allow:raw-byte-literal — CWT claim keys
-  submods: 266, swname: 270, swversion: 271, manifests: 272, measurements: 273,        // allow:raw-byte-literal — CWT claim keys
+var EAT = {                                                                            // RFC 9711 / IANA CWT claim-key labels, not byte sizes
+  nonce: 10, ueid: 256, sueids: 257, oemid: 258, hwmodel: 259, hwversion: 260,         // CWT claim keys
+  uptime: 261, oemboot: 262, dbgstat: 263, location: 264, eat_profile: 265,            // CWT claim keys
+  submods: 266, swname: 270, swversion: 271, manifests: 272, measurements: 273,        // CWT claim keys
 };
 var EAT_BY_LABEL = {};
 Object.keys(EAT).forEach(function (k) { EAT_BY_LABEL[EAT[k]] = k; });

package/lib/external-db-migrate.js

@@ -132,7 +132,7 @@ function _err(code, message) {
 // without it, a stolen-and-released migration lock could be wrongly
 // attributed back to the new boot. The token is process-scoped so
 // every replica picks a fresh one at module load.
-var _BOOT_TOKEN = require("node:crypto").randomBytes(8).toString("hex");          // allow:raw-byte-literal — boot-id token entropy
+var _BOOT_TOKEN = require("node:crypto").randomBytes(8).toString("hex");          // boot-id token entropy
 
 function _lockHolderId() {
   return String(process.pid) + "@" +

package/lib/external-db.js

@@ -755,7 +755,7 @@ async function transaction(fn, opts) {
           if (isTransient && attempt <= maxRetries) {
             _emitMetric("externaldb.transaction.retry", 1,
               { backend: b.name, code: txErr.code, attempt: String(attempt) });
-            var jitter = bCrypto.randomInt(0, 6);                                // allow:raw-byte-literal — 0-5ms jitter
+            var jitter = bCrypto.randomInt(0, 6);                                // 0-5ms jitter
             await safeAsync.sleep(attempt * 5 + jitter);                           // allow:raw-time-literal — sub-second backoff
             continue;
           }

package/lib/flag-cache.js

@@ -47,7 +47,7 @@ function cache(downstream, opts) {
   // allow:numeric-opt-Infinity — maxEntries default + Math.floor coerce; throws on bad type at config time
   var maxEntries = (typeof opts.maxEntries === "number" && opts.maxEntries > 0)
     ? Math.floor(opts.maxEntries)
-    : 10000;                                       // allow:raw-byte-literal — entry-count default
+    : 10000;                                       // entry-count default
   var auditOn = opts.audit === true;            // off by default — too chatty
   var entries = new Map();
   var hits   = 0;

package/lib/flag-evaluation-context.js

@@ -96,7 +96,7 @@ function fromRequest(req, opts) {
               headers["x-forwarded-for"].split(",")[0].trim()) ||
              (req.connection && req.connection.remoteAddress) || "";
     var ua = headers["user-agent"] || "";
-    tk = "anon:" + bCrypto().sha3Hash(ip + ":" + ua).slice(0, 16);   // allow:raw-byte-literal — base16 prefix len
+    tk = "anon:" + bCrypto().sha3Hash(ip + ":" + ua).slice(0, 16);   // base16 prefix len
   }
   ctx.targetingKey = tk;
 
@@ -123,7 +123,7 @@ function bucketOf(targetingKey, flagKey) {
   // Use first 4 bytes as a uint32, then mod 10000 → 0.00-99.99 with
   // sub-percent granularity.
   var n = digest.readUInt32BE(0);
-  return (n % 10000) / 100;                                 // allow:raw-byte-literal — bucket-precision divisor
+  return (n % 10000) / 100;                                 // bucket-precision divisor
 }
 
 module.exports = {

package/lib/graphql-federation.js

@@ -31,10 +31,10 @@ var audit = require("./audit");
 var { GraphqlFederationError } = require("./framework-error");
 
 var SDL_PROBE_MAX = C.BYTES.kib(64);
-var ROUTER_TOKEN_MIN_LEN = 32;                                                              // allow:raw-byte-literal — string-length floor for token entropy, not bytes
-var NONCE_MIN_LEN = 16;                                                                     // allow:raw-byte-literal — string-length floor for nonce entropy, not bytes
-var NONCE_MAX_LEN = 256;                                                                    // allow:raw-byte-literal — string-length cap, not bytes
-var NONCE_PREVIEW_LEN = 8;                                                                  // allow:raw-byte-literal — log-preview slice length, not bytes
+var ROUTER_TOKEN_MIN_LEN = 32;                                                              // string-length floor for token entropy, not bytes
+var NONCE_MIN_LEN = 16;                                                                     // string-length floor for nonce entropy, not bytes
+var NONCE_MAX_LEN = 256;                                                                    // string-length cap, not bytes
+var NONCE_PREVIEW_LEN = 8;                                                                  // log-preview slice length, not bytes
 var SDL_PROBE_RE = /(^|[\s,{])_service\b|_entities\b/;
 
 /**
@@ -175,7 +175,7 @@ function guardSdl(opts) {
       return _readBody(req, errorClass).then(function (rawBody) {
         var query = null;
         try {
-          var parsed = typeof rawBody === "string" ? safeJson.parse(rawBody, { maxBytes: C.BYTES.mib(1) }) : rawBody;             // allow:JSON.parse — routed via safeJson.parse
+          var parsed = typeof rawBody === "string" ? safeJson.parse(rawBody, { maxBytes: C.BYTES.mib(1) }) : rawBody;             // routed via safeJson.parse
           query = parsed && typeof parsed === "object" ? parsed.query : null;
         } catch (_e) { /* not JSON; pass through */ }
         if (req.body === undefined) req.body = rawBody;

package/lib/guard-agent-registry.js

@@ -29,9 +29,9 @@ var GuardAgentRegistryError = defineClass("GuardAgentRegistryError", { alwaysPer
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxNameBytes: 64,  maxKindBytes: 32  },                                               // allow:raw-byte-literal
-  balanced:   { maxNameBytes: 128, maxKindBytes: 64  },                                               // allow:raw-byte-literal
-  permissive: { maxNameBytes: 512, maxKindBytes: 128 },                                               // allow:raw-byte-literal
+  strict:     { maxNameBytes: 64,  maxKindBytes: 32  },
+  balanced:   { maxNameBytes: 128, maxKindBytes: 64  },
+  permissive: { maxNameBytes: 512, maxKindBytes: 128 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -132,11 +132,11 @@ function _checkName(name, profile) {
   }
   for (var i = 0; i < name.length; i += 1) {
     var c = name.charCodeAt(i);
-    if (c > 0x7F) {                                                                                   // allow:raw-byte-literal — ASCII-only cap
+    if (c > 0x7F) {                                                                                   // ASCII-only cap
       throw new GuardAgentRegistryError("agent-registry/non-ascii",
         "guardAgentRegistry.validate: name contains non-ASCII codepoint at offset " + i);
     }
-    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // allow:raw-byte-literal — C0 / DEL / slash / backslash
+    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // C0 / DEL / slash / backslash
       throw new GuardAgentRegistryError("agent-registry/bad-name-char",
         "guardAgentRegistry.validate: name contains forbidden char 0x" + c.toString(16));
     }

package/lib/guard-archive.js

@@ -93,17 +93,17 @@ var ARCHIVE_EXTENSIONS = Object.freeze([
 // Magic-byte signatures keyed by format name. First N bytes uniquely
 // identify the format; we read up to 8 bytes for matching.
 var MAGIC_SIGNATURES = Object.freeze([
-  { format: "zip",   bytes: [0x50, 0x4B, 0x03, 0x04] },              // allow:raw-byte-literal — ZIP local file header magic per APPNOTE.TXT §4.3.7
-  { format: "zip",   bytes: [0x50, 0x4B, 0x05, 0x06] },              // allow:raw-byte-literal — ZIP empty-archive end-of-central-directory magic
-  { format: "zip",   bytes: [0x50, 0x4B, 0x07, 0x08] },              // allow:raw-byte-literal — ZIP spanned-archive marker
-  { format: "gzip",  bytes: [0x1F, 0x8B] },                          // allow:raw-byte-literal — gzip magic per RFC 1952 §2.3.1
-  { format: "bzip2", bytes: [0x42, 0x5A, 0x68] },                    // allow:raw-byte-literal — bzip2 "BZh" magic
-  { format: "xz",    bytes: [0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00] },  // allow:raw-byte-literal — XZ magic per xz spec §2.1.1.1
-  { format: "7z",    bytes: [0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C] },  // allow:raw-byte-literal — 7-zip magic per 7z spec
-  { format: "rar4",  bytes: [0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00] }, // allow:raw-byte-literal — RAR4 magic
-  { format: "rar5",  bytes: [0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00] }, // allow:raw-byte-literal — RAR5 magic
-  { format: "lzma",  bytes: [0x5D, 0x00, 0x00] },                    // allow:raw-byte-literal — LZMA magic byte sequence (heuristic)
-  { format: "zstd",  bytes: [0x28, 0xB5, 0x2F, 0xFD] },              // allow:raw-byte-literal — Zstandard magic per RFC 8478 §3.1.1
+  { format: "zip",   bytes: [0x50, 0x4B, 0x03, 0x04] },              // ZIP local file header magic per APPNOTE.TXT §4.3.7
+  { format: "zip",   bytes: [0x50, 0x4B, 0x05, 0x06] },              // ZIP empty-archive end-of-central-directory magic
+  { format: "zip",   bytes: [0x50, 0x4B, 0x07, 0x08] },              // ZIP spanned-archive marker
+  { format: "gzip",  bytes: [0x1F, 0x8B] },                          // gzip magic per RFC 1952 §2.3.1
+  { format: "bzip2", bytes: [0x42, 0x5A, 0x68] },                    // bzip2 "BZh" magic
+  { format: "xz",    bytes: [0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00] },  // XZ magic per xz spec §2.1.1.1
+  { format: "7z",    bytes: [0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C] },  // 7-zip magic per 7z spec
+  { format: "rar4",  bytes: [0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00] }, // RAR4 magic
+  { format: "rar5",  bytes: [0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00] }, // RAR5 magic
+  { format: "lzma",  bytes: [0x5D, 0x00, 0x00] },                    // LZMA magic byte sequence (heuristic)
+  { format: "zstd",  bytes: [0x28, 0xB5, 0x2F, 0xFD] },              // Zstandard magic per RFC 8478 §3.1.1
   // tar is identified by the "ustar" magic at byte offset 257 inside
   // the first 512-byte header; handled separately in inspectMagic().
 ]);
@@ -126,12 +126,12 @@ var PROFILES = Object.freeze({
     caseInsensitiveCollisionPolicy: "reject",
     sparseEntryPolicy:         "reject",
     filenameProfile:           "balanced",   // per-entry name validation profile
-    maxEntries:                100,           // allow:raw-byte-literal — entry count cap, not byte size
+    maxEntries:                100,           // entry count cap, not byte size
     maxTotalBytes:             C.BYTES.mib(100),
     maxEntryBytes:             C.BYTES.mib(50),
-    maxCompressionRatio:       100,           // allow:raw-byte-literal — ratio multiplier, not byte size
-    maxAggregateRatio:         200,           // allow:raw-byte-literal — aggregate-ratio multiplier, not byte size
-    maxNestedDepth:            0,             // allow:raw-byte-literal — recursion depth, not byte size
+    maxCompressionRatio:       100,           // ratio multiplier, not byte size
+    maxAggregateRatio:         200,           // aggregate-ratio multiplier, not byte size
+    maxNestedDepth:            0,             // recursion depth, not byte size
   },
   "balanced": {
     bidiPolicy:                "reject",
@@ -148,12 +148,12 @@ var PROFILES = Object.freeze({
     caseInsensitiveCollisionPolicy: "audit",
     sparseEntryPolicy:         "audit",
     filenameProfile:           "balanced",
-    maxEntries:                10000,         // allow:raw-byte-literal — entry count cap, not byte size
+    maxEntries:                10000,         // entry count cap, not byte size
     maxTotalBytes:             C.BYTES.gib(1),
     maxEntryBytes:             C.BYTES.mib(500),
-    maxCompressionRatio:       100,           // allow:raw-byte-literal — ratio multiplier, not byte size
-    maxAggregateRatio:         1000,          // allow:raw-byte-literal — aggregate-ratio multiplier, not byte size
-    maxNestedDepth:            2,             // allow:raw-byte-literal — recursion depth, not byte size
+    maxCompressionRatio:       100,           // ratio multiplier, not byte size
+    maxAggregateRatio:         1000,          // aggregate-ratio multiplier, not byte size
+    maxNestedDepth:            2,             // recursion depth, not byte size
   },
   "permissive": {
     bidiPolicy:                "audit",
@@ -170,12 +170,12 @@ var PROFILES = Object.freeze({
     caseInsensitiveCollisionPolicy: "audit",
     sparseEntryPolicy:         "audit",
     filenameProfile:           "permissive",
-    maxEntries:                100000,        // allow:raw-byte-literal — entry count cap, not byte size
+    maxEntries:                100000,        // entry count cap, not byte size
     maxTotalBytes:             C.BYTES.gib(10),
     maxEntryBytes:             C.BYTES.gib(2),
-    maxCompressionRatio:       1000,          // allow:raw-byte-literal — ratio multiplier, not byte size
-    maxAggregateRatio:         10000,         // allow:raw-byte-literal — aggregate-ratio multiplier, not byte size
-    maxNestedDepth:            4,             // allow:raw-byte-literal — recursion depth, not byte size
+    maxCompressionRatio:       1000,          // ratio multiplier, not byte size
+    maxAggregateRatio:         10000,         // aggregate-ratio multiplier, not byte size
+    maxNestedDepth:            4,             // recursion depth, not byte size
   },
 });
 
@@ -869,7 +869,7 @@ module.exports = {
     kind:           "entries",
     contentType:    "application/zip",
     extension:      ".zip",
-    benignEntries:  [{ name: "README.txt", size: 1000, compressedSize: 500 }], // allow:raw-byte-literal — integration-fixture sample size, not byte config
+    benignEntries:  [{ name: "README.txt", size: 1000, compressedSize: 500 }], // integration-fixture sample size, not byte config
     // Hostile: zip-slip path traversal in entry name (CVE-2025-3445 class).
     hostileEntries: [{ name: "../etc/passwd", size: 100, compressedSize: 50 }],
   }),