@blamejs/core 0.14.1 → 0.14.3

package/lib/guard-markdown.js

@@ -100,8 +100,8 @@ var EMPH_RUN_RE = /[*_]{20,}/;
 
 function _decodeHtmlEntities(s) {
   return s.replace(HTML_ENTITY_NUM_RE, function (match, hex, dec) {
-    var code = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);       // allow:raw-byte-literal — parseInt radix args (16 hex / 10 decimal)
-    if (!isFinite(code) || code < 0 || code > 0x10ffff) return match;            // allow:raw-byte-literal — Unicode codepoint range
+    var code = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);       // parseInt radix args (16 hex / 10 decimal)
+    if (!isFinite(code) || code < 0 || code > 0x10ffff) return match;            // Unicode codepoint range
     try { return String.fromCodePoint(code); } catch (_e) { return match; }
   });
 }
@@ -118,7 +118,7 @@ function _isDangerousUrl(url, opts) {
   var stripped = "";
   for (var ci = 0; ci < s.length; ci += 1) {
     var cc = s.charCodeAt(ci);
-    if (cc > 0x1f && cc !== 0x7f) stripped += s.charAt(ci);                     // allow:raw-byte-literal — ASCII control range thresholds
+    if (cc > 0x1f && cc !== 0x7f) stripped += s.charAt(ci);                     // ASCII control range thresholds
   }
   s = stripped;
   if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap — `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
@@ -147,13 +147,13 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "reject",
     zeroWidthPolicy:        "reject",
     maxBytes:               C.BYTES.mib(1),
-    maxLines:               4096,                                                // allow:raw-byte-literal — line count cap
-    maxLinks:               256,                                                 // allow:raw-byte-literal — link count cap
-    maxImages:              128,                                                 // allow:raw-byte-literal — image count cap
-    maxAutolinks:           128,                                                 // allow:raw-byte-literal — autolink count cap
-    maxRefDefs:             64,                                                  // allow:raw-byte-literal — ref-def count cap
-    maxListDepth:           16,                                                  // allow:raw-byte-literal — nesting depth
-    maxBlockquoteDepth:     16,                                                  // allow:raw-byte-literal — nesting depth
+    maxLines:               4096,                                                // line count cap
+    maxLinks:               256,                                                 // link count cap
+    maxImages:              128,                                                 // image count cap
+    maxAutolinks:           128,                                                 // autolink count cap
+    maxRefDefs:             64,                                                  // ref-def count cap
+    maxListDepth:           16,                                                  // nesting depth
+    maxBlockquoteDepth:     16,                                                  // nesting depth
   },
   "balanced": {
     rawHtmlPolicy:          "audit",
@@ -173,13 +173,13 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "strip",
     zeroWidthPolicy:        "strip",
     maxBytes:               C.BYTES.mib(8),
-    maxLines:               32768,                                               // allow:raw-byte-literal — line count cap
-    maxLinks:               2048,                                                // allow:raw-byte-literal — link count cap
-    maxImages:              1024,                                                // allow:raw-byte-literal — image count cap
-    maxAutolinks:           1024,                                                // allow:raw-byte-literal — autolink count cap
-    maxRefDefs:             512,                                                 // allow:raw-byte-literal — ref-def count cap
-    maxListDepth:           64,                                                  // allow:raw-byte-literal — nesting depth
-    maxBlockquoteDepth:     64,                                                  // allow:raw-byte-literal — nesting depth
+    maxLines:               32768,                                               // line count cap
+    maxLinks:               2048,                                                // link count cap
+    maxImages:              1024,                                                // image count cap
+    maxAutolinks:           1024,                                                // autolink count cap
+    maxRefDefs:             512,                                                 // ref-def count cap
+    maxListDepth:           64,                                                  // nesting depth
+    maxBlockquoteDepth:     64,                                                  // nesting depth
   },
   "permissive": {
     rawHtmlPolicy:          "allow",
@@ -199,13 +199,13 @@ var PROFILES = Object.freeze({
     nullBytePolicy:         "reject",
     zeroWidthPolicy:        "audit",
     maxBytes:               C.BYTES.mib(64),
-    maxLines:               262144,                                              // allow:raw-byte-literal — line count cap
-    maxLinks:               16384,                                               // allow:raw-byte-literal — link count cap
-    maxImages:              8192,                                                // allow:raw-byte-literal — image count cap
-    maxAutolinks:           8192,                                                // allow:raw-byte-literal — autolink count cap
-    maxRefDefs:             4096,                                                // allow:raw-byte-literal — ref-def count cap
-    maxListDepth:           256,                                                 // allow:raw-byte-literal — nesting depth
-    maxBlockquoteDepth:     256,                                                 // allow:raw-byte-literal — nesting depth
+    maxLines:               262144,                                              // line count cap
+    maxLinks:               16384,                                               // link count cap
+    maxImages:              8192,                                                // image count cap
+    maxAutolinks:           8192,                                                // autolink count cap
+    maxRefDefs:             4096,                                                // ref-def count cap
+    maxListDepth:           256,                                                 // nesting depth
+    maxBlockquoteDepth:     256,                                                 // nesting depth
   },
 });
 
@@ -261,7 +261,7 @@ function _detectIssues(input, opts) {
   // Line count cap — line-based parsers scale O(lines).
   var lineCount = 0;
   for (var li = 0; li < input.length; li += 1) {
-    if (input.charCodeAt(li) === 10) lineCount += 1;                             // allow:raw-byte-literal — newline char code
+    if (input.charCodeAt(li) === 10) lineCount += 1;                             // newline char code
   }
   if (lineCount > opts.maxLines) {
     issues.push({
@@ -342,7 +342,7 @@ function _detectIssues(input, opts) {
       snippet: (isImage ? "image" : "link") +
                " uses dangerous scheme '" + scheme + ":'",
     });
-    if (issues.length > 256) break;                                              // allow:raw-byte-literal — issue accumulator cap
+    if (issues.length > 256) break;                                              // issue accumulator cap
   }
   if (linkCount > opts.maxLinks) {
     issues.push({
@@ -372,7 +372,7 @@ function _detectIssues(input, opts) {
       ruleId: "markdown.autolink-scheme",
       snippet: "autolink uses dangerous scheme '" + aScheme + ":'",
     });
-    if (issues.length > 256) break;                                              // allow:raw-byte-literal — issue accumulator cap
+    if (issues.length > 256) break;                                              // issue accumulator cap
   }
   if (autolinkCount > opts.maxAutolinks) {
     issues.push({
@@ -398,7 +398,7 @@ function _detectIssues(input, opts) {
       snippet: "reference-link definition uses dangerous scheme '" +
                rScheme + ":' (smuggled through `[ref]` text)",
     });
-    if (issues.length > 256) break;                                              // allow:raw-byte-literal — issue accumulator cap
+    if (issues.length > 256) break;                                              // issue accumulator cap
   }
   if (refDefCount > opts.maxRefDefs) {
     issues.push({
@@ -422,9 +422,9 @@ function _detectIssues(input, opts) {
           severity: opts.codeFenceLangPolicy === "reject" ? "critical" : "high",
           ruleId: "markdown.code-fence-lang",
           snippet: "code-fence language tag contains attribute-breaking " +
-                   "characters: " + JSON.stringify(lang.slice(0, 64)),         // allow:raw-byte-literal — snippet truncation
+                   "characters: " + JSON.stringify(lang.slice(0, 64)),         // snippet truncation
         });
-        if (issues.length > 256) break;                                          // allow:raw-byte-literal — issue accumulator cap
+        if (issues.length > 256) break;                                          // issue accumulator cap
       }
     }
   }
@@ -458,7 +458,7 @@ function _detectIssues(input, opts) {
       var marker = line.charAt(leading);
       if (marker === "-" || marker === "*" || marker === "+" ||
           (marker >= "0" && marker <= "9")) {
-        var depth = Math.floor(leading / 2);                                     // allow:raw-byte-literal — markdown convention: 2 spaces per nest level
+        var depth = Math.floor(leading / 2);                                     // markdown convention: 2 spaces per nest level
         if (depth > maxListDepthSeen) maxListDepthSeen = depth;
       }
     }

package/lib/guard-message-id.js

@@ -56,9 +56,9 @@ var GuardMessageIdError = defineClass("GuardMessageIdError", { alwaysPermanent:
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { requireBrackets: true,  maxBytes: 998 },                                          // allow:raw-byte-literal
-  balanced:   { requireBrackets: false, maxBytes: 998 },                                          // allow:raw-byte-literal
-  permissive: { requireBrackets: false, maxBytes: 4096 },                                         // allow:raw-byte-literal — permissive cap, not bytes-as-storage
+  strict:     { requireBrackets: true,  maxBytes: 998 },
+  balanced:   { requireBrackets: false, maxBytes: 998 },
+  permissive: { requireBrackets: false, maxBytes: 4096 },                                         // permissive cap, not bytes-as-storage
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -130,7 +130,7 @@ function validate(value, opts) {
   // CR/LF into a Message-Id to fold an attacker-chosen From: line).
   for (var i = 0; i < value.length; i += 1) {
     var c = value.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                 // allow:raw-byte-literal — C0 + DEL refusal
+    if (c < 0x20 || c === 0x7F) {                                                                 // C0 + DEL refusal
       throw new GuardMessageIdError("message-id/control-char",
         "guardMessageId.validate: control char 0x" + c.toString(16) + " at offset " + i);
     }
@@ -209,7 +209,7 @@ function validate(value, opts) {
  */
 function validateList(value, opts) {
   opts = opts || {};
-  var maxIds = typeof opts.maxIds === "number" ? opts.maxIds : 100;                              // allow:raw-byte-literal — References-chain cap, not bytes
+  var maxIds = typeof opts.maxIds === "number" ? opts.maxIds : 100;                              // References-chain cap, not bytes
   if (typeof value !== "string") {
     throw new GuardMessageIdError("message-id/bad-input",
       "guardMessageId.validateList: value must be a string");

package/lib/guard-mime.js

@@ -58,7 +58,7 @@ var TOKEN_RE = /^[A-Za-z0-9][A-Za-z0-9!#$&\-^_.+]{0,126}$/;
 var PARAM_TOKEN_RE = safeBuffer.RFC7230_TCHAR_RE;
 
 // Quoted-string body (between double quotes) per RFC 7230 §3.2.6.
-var QUOTED_STRING_BODY_RE = /^[\t\x20-\x7e]*$/;                                   // allow:raw-byte-literal — printable ASCII range
+var QUOTED_STRING_BODY_RE = /^[\t\x20-\x7e]*$/;                                   // printable ASCII range
 
 // Risky-type refuse list (operator-supplied scripts handed to a host).
 var RISKY_TYPES = Object.freeze([

package/lib/guard-oauth.js

@@ -91,7 +91,7 @@ void observability;
 
 var _err = GuardOauthError.factory;
 
-var SCOPE_TOKEN_RE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;                              // allow:raw-byte-literal — RFC 6749 §3.3 scope-token charset
+var SCOPE_TOKEN_RE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;                              // RFC 6749 §3.3 scope-token charset
 var DEFAULT_RESPONSE_TYPES = Object.freeze(["code"]);
 
 // ---- Profile presets ----
@@ -612,7 +612,7 @@ module.exports = {
       redirect_uri:  "https://app.example.com/callback",
       state:         "csrf-rand-1",
       scope:         "openid profile",
-      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // allow:raw-byte-literal — base64url-shaped fixture
+      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // base64url-shaped fixture
       code_challenge_method: "S256",
     }), "utf8"),
     hostileBytes:      Buffer.from(JSON.stringify({
@@ -626,7 +626,7 @@ module.exports = {
       redirect_uri:  "https://app.example.com/callback",
       state:         "csrf-rand-1",
       scope:         "openid profile",
-      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // allow:raw-byte-literal — base64url-shaped fixture
+      code_challenge: "abc123def456ghi789jkl012mno345pqr678",                   // base64url-shaped fixture
       code_challenge_method: "S256",
     },
     hostileOauthFlow: {

package/lib/guard-pdf.js

@@ -95,8 +95,8 @@ var PROFILES = Object.freeze({
     polyglotPolicy:            "reject",
     pageCountPolicy:           "reject",
     embeddedFileCountPolicy:   "reject",
-    maxPageCount:              500,                                              // allow:raw-byte-literal — page-count ceiling
-    maxEmbeddedFileCount:      0,                                                // allow:raw-byte-literal — strict refuses any embedded file
+    maxPageCount:              500,                                              // page-count ceiling
+    maxEmbeddedFileCount:      0,                                                // strict refuses any embedded file
     maxBytes:                  C.BYTES.mib(64),
     maxRuntimeMs:              C.TIME.seconds(5),
   },
@@ -110,8 +110,8 @@ var PROFILES = Object.freeze({
     polyglotPolicy:            "reject",                                         // polyglot refused at every profile
     pageCountPolicy:           "audit",
     embeddedFileCountPolicy:   "audit",
-    maxPageCount:              5000,                                             // allow:raw-byte-literal — page-count ceiling
-    maxEmbeddedFileCount:      10,                                               // allow:raw-byte-literal — embedded file ceiling
+    maxPageCount:              5000,                                             // page-count ceiling
+    maxEmbeddedFileCount:      10,                                               // embedded file ceiling
     maxBytes:                  C.BYTES.mib(128),
     maxRuntimeMs:              C.TIME.seconds(5),
   },
@@ -125,8 +125,8 @@ var PROFILES = Object.freeze({
     polyglotPolicy:            "reject",                                          // polyglot refused at every profile
     pageCountPolicy:           "audit",
     embeddedFileCountPolicy:   "audit",
-    maxPageCount:              50000,                                            // allow:raw-byte-literal — page-count ceiling
-    maxEmbeddedFileCount:      100,                                              // allow:raw-byte-literal — embedded file ceiling
+    maxPageCount:              50000,                                            // page-count ceiling
+    maxEmbeddedFileCount:      100,                                              // embedded file ceiling
     maxBytes:                  C.BYTES.mib(512),
     maxRuntimeMs:              C.TIME.seconds(5),
   },

package/lib/guard-pop3-command.js

@@ -81,23 +81,23 @@ var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
   strict: {
-    maxLineBytes:       255,                                                                         // allow:raw-byte-literal — RFC 2449 §4 cap
-    maxUsernameBytes:   40,                                                                          // allow:raw-byte-literal — RFC 1939 §3 cap
-    maxPasswordBytes:   40,                                                                          // allow:raw-byte-literal — RFC 1939 §3 cap
+    maxLineBytes:       255,                                                                         // RFC 2449 §4 cap
+    maxUsernameBytes:   40,                                                                          // RFC 1939 §3 cap
+    maxPasswordBytes:   40,                                                                          // RFC 1939 §3 cap
     allowBareLf:        false,
     allowApop:          false,                                                                       // RFC 1939 §7 — legacy challenge-response with MD5; refuse under strict (M³AAWG)
   },
   balanced: {
-    maxLineBytes:       512,                                                                         // allow:raw-byte-literal — RFC 2449 §4 response cap
-    maxUsernameBytes:   128,                                                                         // allow:raw-byte-literal — balanced username cap
-    maxPasswordBytes:   128,                                                                         // allow:raw-byte-literal — balanced password cap
+    maxLineBytes:       512,                                                                         // RFC 2449 §4 response cap
+    maxUsernameBytes:   128,                                                                         // balanced username cap
+    maxPasswordBytes:   128,                                                                         // balanced password cap
     allowBareLf:        false,
     allowApop:          true,
   },
   permissive: {
-    maxLineBytes:       1024,                                                                        // allow:raw-byte-literal — permissive cap for legacy peers
-    maxUsernameBytes:   256,                                                                         // allow:raw-byte-literal — permissive username cap
-    maxPasswordBytes:   256,                                                                         // allow:raw-byte-literal — permissive password cap
+    maxLineBytes:       1024,                                                                        // permissive cap for legacy peers
+    maxUsernameBytes:   256,                                                                         // permissive username cap
+    maxPasswordBytes:   256,                                                                         // permissive password cap
     allowBareLf:        true,
     allowApop:          true,
   },
@@ -173,10 +173,10 @@ function validate(line, opts) {
   }
   for (var i = 0; i < line.length; i += 1) {
     var c = line.charCodeAt(i);
-    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                       // allow:raw-byte-literal — control-byte refusal
+    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                       // control-byte refusal
       if (c === 0x0A && caps.allowBareLf) continue;
       throw new GuardPop3CommandError("guard-pop3-command/bad-byte",
-        "guardPop3Command.validate: control byte 0x" + c.toString(16) + " at offset " + i);          // allow:raw-byte-literal — hex format literal in error message
+        "guardPop3Command.validate: control byte 0x" + c.toString(16) + " at offset " + i);          // hex format literal in error message
     }
   }
 

package/lib/guard-posture-chain.js

@@ -32,9 +32,9 @@ var GuardPostureChainError = defineClass("GuardPostureChainError", { alwaysPerma
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxHops: 16,  maxHopBytes: 64,  maxRegimes: 8  },                                     // allow:raw-byte-literal
-  balanced:   { maxHops: 32,  maxHopBytes: 128, maxRegimes: 16 },                                     // allow:raw-byte-literal
-  permissive: { maxHops: 128, maxHopBytes: 256, maxRegimes: 64 },                                     // allow:raw-byte-literal
+  strict:     { maxHops: 16,  maxHopBytes: 64,  maxRegimes: 8  },
+  balanced:   { maxHops: 32,  maxHopBytes: 128, maxRegimes: 16 },
+  permissive: { maxHops: 128, maxHopBytes: 256, maxRegimes: 64 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -119,11 +119,11 @@ function validate(envelope, opts) {
     }
     for (var hi = 0; hi < hop.length; hi += 1) {
       var hc = hop.charCodeAt(hi);
-      if (hc > 0x7F) {                                                                                // allow:raw-byte-literal — ASCII-only
+      if (hc > 0x7F) {                                                                                // ASCII-only
         throw new GuardPostureChainError("posture-chain/non-ascii-hop",
           "guardPostureChain.validate: chainTrail[" + h + "] has non-ASCII codepoint");
       }
-      if (hc < 0x20 || hc === 0x7F) {                                                                 // allow:raw-byte-literal — C0/DEL
+      if (hc < 0x20 || hc === 0x7F) {                                                                 // C0/DEL
         throw new GuardPostureChainError("posture-chain/bad-hop-char",
           "guardPostureChain.validate: chainTrail[" + h + "] has forbidden char 0x" + hc.toString(16));
       }

package/lib/guard-regex.js

@@ -93,8 +93,8 @@ var PROFILES = Object.freeze({
     consecutiveStarPolicy:    "reject",
     nestedExtglobPolicy:      "reject",
     inputKind:                "regex",                                            // CVE-2026-26996 + CVE-2026-33671 detectors apply only when inputKind=="glob"
-    maxBoundedRepeat:          100,                                              // allow:raw-byte-literal — bounded repeat ceiling
-    maxConsecutiveStars:        2,                                                // allow:raw-byte-literal — `**` recursive glob permitted; >=3 refused
+    maxBoundedRepeat:          100,                                              // bounded repeat ceiling
+    maxConsecutiveStars:        2,                                                // `**` recursive glob permitted; >=3 refused
     maxPatternBytes:           C.BYTES.kib(1),
     maxBytes:                  C.BYTES.kib(1),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -110,8 +110,8 @@ var PROFILES = Object.freeze({
     lookaroundQuantPolicy:     "audit",
     consecutiveStarPolicy:    "reject",                                          // CVE-2026-26996 refused at every profile
     nestedExtglobPolicy:      "reject",                                          // CVE-2026-33671 refused at every profile
-    maxBoundedRepeat:          1000,                                             // allow:raw-byte-literal — bounded repeat ceiling
-    maxConsecutiveStars:        2,                                                // allow:raw-byte-literal — `**` recursive glob permitted; >=3 refused
+    maxBoundedRepeat:          1000,                                             // bounded repeat ceiling
+    maxConsecutiveStars:        2,                                                // `**` recursive glob permitted; >=3 refused
     maxPatternBytes:           C.BYTES.kib(2),
     maxBytes:                  C.BYTES.kib(2),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -127,8 +127,8 @@ var PROFILES = Object.freeze({
     lookaroundQuantPolicy:     "audit",
     consecutiveStarPolicy:    "reject",                                          // CVE-2026-26996 refused at every profile
     nestedExtglobPolicy:      "reject",                                          // CVE-2026-33671 refused at every profile
-    maxBoundedRepeat:          10000,                                            // allow:raw-byte-literal — bounded repeat ceiling
-    maxConsecutiveStars:        2,                                                // allow:raw-byte-literal — `**` recursive glob permitted; >=3 refused
+    maxBoundedRepeat:          10000,                                            // bounded repeat ceiling
+    maxConsecutiveStars:        2,                                                // `**` recursive glob permitted; >=3 refused
     maxPatternBytes:           C.BYTES.kib(8),
     maxBytes:                  C.BYTES.kib(8),
     maxRuntimeMs:              C.TIME.seconds(2),
@@ -223,9 +223,9 @@ function _detectIssues(input, opts) {
     BOUNDED_REPEAT_RE.lastIndex = 0;
     var match;
     while ((match = BOUNDED_REPEAT_RE.exec(input)) !== null) {                   // allow:regex-no-length-cap — input bounded by maxPatternBytes
-      var lower = parseInt(match[1], 10);                                        // allow:raw-byte-literal — base-10 radix
+      var lower = parseInt(match[1], 10);                                        // base-10 radix
       var upper = match[2] === undefined ? lower :
-                  match[2] === "" ? Infinity : parseInt(match[2], 10);           // allow:raw-byte-literal — base-10 radix
+                  match[2] === "" ? Infinity : parseInt(match[2], 10);           // base-10 radix
       var ceiling = (upper === Infinity || upper > lower) ? upper : lower;
       if (ceiling > opts.maxBoundedRepeat) {
         issues.push({
@@ -273,7 +273,7 @@ function _detectConsecutiveStar(input, opts, issues) {
     }
   }
   var starCeiling = opts.maxConsecutiveStars === undefined ?
-                    2 : opts.maxConsecutiveStars;                                // allow:raw-byte-literal — `**` glob ceiling
+                    2 : opts.maxConsecutiveStars;                                // `**` glob ceiling
   if (starRunMax > starCeiling) {
     issues.push({
       kind: "consecutive-star",
@@ -315,7 +315,7 @@ function _detectNestedExtglob(input, opts, issues) {
     }
     heads.push(idx);
     scanFrom = idx + 1;
-    if (heads.length > 1024) break;                                              // allow:raw-byte-literal — head-count safety cap
+    if (heads.length > 1024) break;                                              // head-count safety cap
   }
   var nested = false;
   for (var hi = 0; hi < heads.length && !nested; hi += 1) {

package/lib/guard-saga-config.js

@@ -22,9 +22,9 @@ var GuardSagaConfigError = defineClass("GuardSagaConfigError", { alwaysPermanent
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxSteps: 32,   maxNameBytes: 64  },                                                  // allow:raw-byte-literal
-  balanced:   { maxSteps: 128,  maxNameBytes: 128 },                                                  // allow:raw-byte-literal
-  permissive: { maxSteps: 512,  maxNameBytes: 256 },                                                  // allow:raw-byte-literal
+  strict:     { maxSteps: 32,   maxNameBytes: 64  },
+  balanced:   { maxSteps: 128,  maxNameBytes: 128 },
+  permissive: { maxSteps: 512,  maxNameBytes: 256 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -72,11 +72,11 @@ function validate(config, opts) {
   }
   for (var i = 0; i < config.name.length; i += 1) {
     var c = config.name.charCodeAt(i);
-    if (c > 0x7F) {                                                                                   // allow:raw-byte-literal — ASCII-only
+    if (c > 0x7F) {                                                                                   // ASCII-only
       throw new GuardSagaConfigError("saga-config/non-ascii-name",
         "guardSagaConfig.validate: name has non-ASCII codepoint at offset " + i);
     }
-    if (c < 0x20 || c === 0x7F) {                                                                     // allow:raw-byte-literal — C0/DEL
+    if (c < 0x20 || c === 0x7F) {                                                                     // C0/DEL
       throw new GuardSagaConfigError("saga-config/bad-name-char",
         "guardSagaConfig.validate: name has forbidden char 0x" + c.toString(16));
     }

package/lib/guard-smtp-command.js

@@ -98,9 +98,9 @@ var DEFAULT_PROFILE = "strict";
 // CRLF). SMTPUTF8 / EAI extends this in practice; balanced/permissive
 // raise the cap accordingly.
 var PROFILES = Object.freeze({
-  strict:     { maxLineBytes: 512, maxMailbox: 256, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: false },                                                                          // allow:raw-byte-literal — RFC 5321 §4.5.3.1.1 caps
-  balanced:   { maxLineBytes: 1024, maxMailbox: 320, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: true },                                                                          // allow:raw-byte-literal — SMTPUTF8 (RFC 6531) line cap
-  permissive: { maxLineBytes: 4096, maxMailbox: 512, maxLocalPart: 64, maxDomain: 255, allowBareLf: true,  allowSmtpUtf8: true },                                                                          // allow:raw-byte-literal — permissive cap for legacy peers
+  strict:     { maxLineBytes: 512, maxMailbox: 256, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: false },                                                                          // RFC 5321 §4.5.3.1.1 caps
+  balanced:   { maxLineBytes: 1024, maxMailbox: 320, maxLocalPart: 64, maxDomain: 255, allowBareLf: false, allowSmtpUtf8: true },                                                                          // SMTPUTF8 (RFC 6531) line cap
+  permissive: { maxLineBytes: 4096, maxMailbox: 512, maxLocalPart: 64, maxDomain: 255, allowBareLf: true,  allowSmtpUtf8: true },                                                                          // permissive cap for legacy peers
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -191,12 +191,12 @@ function validate(line, opts) {
     // bare-LF refusal earlier in this fn. Skip the control-char throw
     // so the documented allowBareLf path actually accepts LF (Codex
     // caught this: permissive profile was effectively broken).
-    if (c === 0x0a && caps.allowBareLf) continue;                                                                                                                                                            // allow:raw-byte-literal — RFC 5321 §2.3.8 LF, permissive bypass
-    if (c < 0x20 || c === 0x7f) {                                                                                                                                                                          // allow:raw-byte-literal — RFC 5321 §2.3.8 forbids C0 / DEL
+    if (c === 0x0a && caps.allowBareLf) continue;                                                                                                                                                            // RFC 5321 §2.3.8 LF, permissive bypass
+    if (c < 0x20 || c === 0x7f) {                                                                                                                                                                          // RFC 5321 §2.3.8 forbids C0 / DEL
       throw new GuardSmtpCommandError("guard-smtp-command/control-char",
         "guardSmtpCommand.validate: control char 0x" + c.toString(16) + " refused");
     }
-    if (!caps.allowSmtpUtf8 && c > 0x7e) {                                                                                                                                                                 // allow:raw-byte-literal — RFC 5321 §2.3.1 7-bit ASCII; SMTPUTF8 relaxes
+    if (!caps.allowSmtpUtf8 && c > 0x7e) {                                                                                                                                                                 // RFC 5321 §2.3.1 7-bit ASCII; SMTPUTF8 relaxes
       throw new GuardSmtpCommandError("guard-smtp-command/non-ascii",
         "guardSmtpCommand.validate: non-ASCII byte refused (no SMTPUTF8 negotiated)");
     }

package/lib/guard-snapshot-envelope.js

@@ -35,9 +35,9 @@ var GuardSnapshotEnvelopeError = defineClass("GuardSnapshotEnvelopeError", { alw
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxBytes: 52428800,  maxInFlight: 65536   },                                          // allow:raw-byte-literal — 50 MiB cap
-  balanced:   { maxBytes: 209715200, maxInFlight: 262144  },                                          // allow:raw-byte-literal — 200 MiB
-  permissive: { maxBytes: 1073741824, maxInFlight: 1048576 },                                         // allow:raw-byte-literal — 1 GiB
+  strict:     { maxBytes: 52428800,  maxInFlight: 65536   },                                          // 50 MiB cap
+  balanced:   { maxBytes: 209715200, maxInFlight: 262144  },                                          // 200 MiB
+  permissive: { maxBytes: 1073741824, maxInFlight: 1048576 },                                         // 1 GiB
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({

package/lib/guard-stream-args.js

@@ -26,9 +26,9 @@ var GuardStreamArgsError = defineClass("GuardStreamArgsError", { alwaysPermanent
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxBatchSize: 1024,  minBatchSize: 1, maxOpenStreams: 4   },                          // allow:raw-byte-literal
-  balanced:   { maxBatchSize: 4096,  minBatchSize: 1, maxOpenStreams: 16  },                          // allow:raw-byte-literal
-  permissive: { maxBatchSize: 16384, minBatchSize: 1, maxOpenStreams: 64  },                          // allow:raw-byte-literal
+  strict:     { maxBatchSize: 1024,  minBatchSize: 1, maxOpenStreams: 4   },
+  balanced:   { maxBatchSize: 4096,  minBatchSize: 1, maxOpenStreams: 16  },
+  permissive: { maxBatchSize: 16384, minBatchSize: 1, maxOpenStreams: 64  },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -109,7 +109,7 @@ function compliancePosture(posture) {
 
 function _checkCursorOpts(cursorOpts, depth) {
   depth = depth || 0;
-  if (depth > 8) {                                                                                    // allow:raw-byte-literal — recursion depth cap
+  if (depth > 8) {                                                                                    // recursion depth cap
     throw new GuardStreamArgsError("stream-args/cursor-opts-too-deep",
       "guardStreamArgs.validate: cursorOpts nesting depth exceeds 8");
   }

package/lib/guard-svg.js

@@ -118,7 +118,7 @@ var observability = lazyRequire(function () { return require("./observability");
 void observability;
 
 var _err = GuardSvgError.factory;
-var HEX_RADIX = 16;                                                 // allow:raw-byte-literal — base-16 radix, not byte size
+var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 // ---- Codepoint catalog (shared via lib/codepoint-class) ----
 
@@ -221,7 +221,7 @@ var EVENT_HANDLER_RE = /^on[a-z]/i;
 // signature; SVG spec allows compressed delivery but content-safety
 // gates can't peer inside without ungzipping. Refused at gate level
 // regardless of profile.
-var GZIP_MAGIC = Buffer.from([0x1F, 0x8B]);                          // allow:raw-byte-literal — gzip RFC 1952 §2.3.1 magic, not byte size
+var GZIP_MAGIC = Buffer.from([0x1F, 0x8B]);                          // gzip RFC 1952 §2.3.1 magic, not byte size
 
 // ---- Profile presets ----
 
@@ -253,9 +253,9 @@ var PROFILES = Object.freeze({
     svgzPolicy:            "reject",
     maxBytes:              C.BYTES.mib(2),
     maxAttrValueBytes:     C.BYTES.kib(8),
-    maxElementCount:       0x2000,                                  // allow:raw-byte-literal — element count limit, not bytes
-    maxUseDepth:           8,                                       // allow:raw-byte-literal — use-element nesting count, not bytes
-    maxAttrsPerTag:        64,                                      // allow:raw-byte-literal — attribute count, not bytes
+    maxElementCount:       0x2000,                                  // element count limit, not bytes
+    maxUseDepth:           8,                                       // use-element nesting count, not bytes
+    maxAttrsPerTag:        64,                                      // attribute count, not bytes
   },
   "balanced": {
     allowedTags:           BALANCED_ALLOWED_TAGS,
@@ -276,9 +276,9 @@ var PROFILES = Object.freeze({
     svgzPolicy:            "reject",
     maxBytes:              C.BYTES.mib(8),
     maxAttrValueBytes:     C.BYTES.kib(32),
-    maxElementCount:       0x10000,                                 // allow:raw-byte-literal — element count limit, not bytes
-    maxUseDepth:           16,                                      // allow:raw-byte-literal — use-element nesting count, not bytes
-    maxAttrsPerTag:        128,                                     // allow:raw-byte-literal — attribute count, not bytes
+    maxElementCount:       0x10000,                                 // element count limit, not bytes
+    maxUseDepth:           16,                                      // use-element nesting count, not bytes
+    maxAttrsPerTag:        128,                                     // attribute count, not bytes
   },
   "permissive": {
     allowedTags:           PERMISSIVE_ALLOWED_TAGS,
@@ -299,9 +299,9 @@ var PROFILES = Object.freeze({
     svgzPolicy:            "reject",
     maxBytes:              C.BYTES.mib(32),
     maxAttrValueBytes:     C.BYTES.kib(64),
-    maxElementCount:       0x40000,                                 // allow:raw-byte-literal — element count limit, not bytes
-    maxUseDepth:           32,                                      // allow:raw-byte-literal — use-element nesting count, not bytes
-    maxAttrsPerTag:        256,                                     // allow:raw-byte-literal — attribute count, not bytes
+    maxElementCount:       0x40000,                                 // element count limit, not bytes
+    maxUseDepth:           32,                                      // use-element nesting count, not bytes
+    maxAttrsPerTag:        256,                                     // attribute count, not bytes
   },
 });
 

package/lib/guard-tenant-id.js

@@ -29,9 +29,9 @@ var GuardTenantIdError = defineClass("GuardTenantIdError", { alwaysPermanent: tr
 var DEFAULT_PROFILE = "strict";
 
 var PROFILES = Object.freeze({
-  strict:     { maxBytes: 64  },                                                                      // allow:raw-byte-literal
-  balanced:   { maxBytes: 128 },                                                                      // allow:raw-byte-literal
-  permissive: { maxBytes: 512 },                                                                      // allow:raw-byte-literal
+  strict:     { maxBytes: 64  },
+  balanced:   { maxBytes: 128 },
+  permissive: { maxBytes: 512 },
 });
 
 var COMPLIANCE_POSTURES = Object.freeze({
@@ -85,11 +85,11 @@ function validate(tenantId, opts) {
   }
   for (var i = 0; i < tenantId.length; i += 1) {
     var c = tenantId.charCodeAt(i);
-    if (c > 0x7F) {                                                                                   // allow:raw-byte-literal — ASCII-only cap
+    if (c > 0x7F) {                                                                                   // ASCII-only cap
       throw new GuardTenantIdError("tenant-id/non-ascii",
         "guardTenantId.validate: non-ASCII codepoint at offset " + i);
     }
-    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // allow:raw-byte-literal — C0/DEL/slash/backslash
+    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // C0/DEL/slash/backslash
       throw new GuardTenantIdError("tenant-id/bad-char",
         "guardTenantId.validate: forbidden char 0x" + c.toString(16) + " at offset " + i);
     }