@blamejs/core 0.14.3 → 0.14.4

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.4 (2026-05-30) — **Removed three pieces of dead code from the SAML, TLS, and JMAP surfaces; no API or behavior changes.** Cleanup of unreachable code. A reverse signature-algorithm lookup in the SAML verifier was never called — the actual verification path resolves the algorithm through the supported-signature table — so it is removed and a stale comment that referenced it is corrected. A leftover no-op placeholder in the TLS certificate re-encode path (a zero-length slice that was assigned and discarded) is removed, leaving the verbatim extension re-encode it sat next to. An unused JMAP well-known-path constant that existed only to be discarded is removed. None of this changes any exported API, error code, wire format, or runtime behavior. **Removed:** *Unreachable code in SAML, TLS, and JMAP* — Removed `_sigAlgFromUri` from the SAML module (a reverse alg lookup that was never called — the embedded XML-DSig verifier resolves the algorithm via the supported-signature table, and the redirect-binding path uses the forward `_sigAlgUrn`), a discarded zero-length-slice placeholder in the TLS certificate extension re-encode path, and an unused well-known-path constant in the JMAP server. Internal cleanup only — no change to any exported API, error code, wire format, or runtime behavior.
+
 - v0.14.3 (2026-05-30) — **A codebase check now ensures every lint-suppression marker names a real check, so a typo can't silently disable a guard.** Source files suppress an individual lint with an `// allow:<class>` comment. If the class is mistyped or stale, the comment suppresses nothing — the check it names does not exist — so the issue it was meant to explain ships unflagged. A new codebase check now verifies every `// allow:<class>` marker names a registered check class and fails if it does not, with the full set of valid classes maintained as an explicit registry. Two markers that named a non-kebab class were corrected as part of this. No runtime, API, or wire-format changes. **Detectors:** *Lint-suppression markers must name a registered check* — A new check flags any `// allow:<class>` suppression comment whose class is not one of the registered check classes — catching typos and stale markers (for example a marker that named a check which was later renamed) that would otherwise silently disable the guard they appear to explain. The valid classes are kept as an explicit registry, so adding a check with a new allow-class is a one-line registration. Source-comment hygiene only — no change to any exported API, error code, wire format, or runtime behavior.
 
 - v0.14.2 (2026-05-29) — **Internal lint hygiene: the byte-literal check now flags only genuine byte-scale arithmetic, with no API or behavior changes.** A no-behavior-change cleanup of the source tree's internal lint markers. The byte-literal lint previously flagged every integer that was a multiple of 8 — which is most numbers — so the source carried a large number of suppression comments on values that were not byte sizes at all (status codes, counts, lengths, radixes, opcodes). The lint now flags only 1024-scale byte arithmetic (the case the C.BYTES.kib/mib/gib helpers exist to replace), and the now-unnecessary suppression comments have been removed while keeping their explanatory text. Several lint-suppression markers that named a check that does not exist were also corrected. None of this changes any API, wire format, or runtime behavior. **Changed:** *Source-tree lint markers cleaned up* — The internal byte-literal lint was tightened to flag only genuine byte-scale (`* 1024`) arithmetic, and the suppression comments it previously required on non-byte integers were removed (their explanatory text is retained as plain comments). A handful of suppression markers that referenced a non-existent check were pointed at the correct one or removed. This is source-comment hygiene only — there is no change to any exported API, error code, wire format, or runtime behavior.

package/lib/auth/saml.js

@@ -1726,8 +1726,8 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
 
 // PQC SignatureMethod URIs used by the embedded XMLDSig signatures.
 // Standard XMLDSig vocabulary classical signing URIs (W3C XMLDSig
-// Core 1.1 + RFC 9231 for Ed25519) are dispatched via _sigAlgUrn /
-// _sigAlgFromUri. The framework adds two non-standard URNs for
+// Core 1.1 + RFC 9231 for Ed25519) are dispatched via _sigAlgUrn (sign
+// side) and the SUPPORTED_SIG table (verify side). The framework adds two non-standard URNs for
 // ML-DSA because no W3C/IETF XMLDSig URI registration exists for
 // post-quantum signers yet (LAMPS WG has open drafts but none final).
 // Operators integrating with PQC-aware IdPs that exchange those URNs
@@ -2027,22 +2027,6 @@ function _sigAlgUrn(alg) {
   return null;
 }
 
-// Reverse lookup — SignatureMethod URI on the inbound wire → alg
-// shorthand for _sigAlgUrn dispatch. Used by _verifyEmbeddedXmlDsig
-// to pick the right verifier when an IdP signs with a classical alg.
-function _sigAlgFromUri(uri) {
-  if (uri === "urn:blamejs:experimental:saml-sig-alg:ml-dsa-65") return "ml-dsa-65";
-  if (uri === "urn:blamejs:experimental:saml-sig-alg:ml-dsa-87") return "ml-dsa-87";
-  if (uri === "http://www.w3.org/2021/04/xmldsig-more#ed25519") return "ed25519";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")   return "rsa-sha256";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384")   return "rsa-sha384";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512")   return "rsa-sha512";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256") return "ecdsa-sha256";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384") return "ecdsa-sha384";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512") return "ecdsa-sha512";
-  return null;
-}
-
 /**
  * @primitive b.auth.saml.fetchMdq
  * @signature b.auth.saml.fetchMdq(opts)

package/lib/mail-server-jmap.js

@@ -133,9 +133,7 @@ var audit = lazyRequire(function () { return require("./audit"); });
 var MailServerJmapError = defineClass("MailServerJmapError", { alwaysPermanent: true });
 
 var DEFAULT_PROFILE = "strict";
-var WELL_KNOWN_PATH = "/.well-known/jmap";
 void C;                                                                                               // reserved for future cap constants
-void WELL_KNOWN_PATH;
 
 /**
  * @primitive b.mail.server.jmap.create

package/lib/network-tls.js

@@ -1797,11 +1797,8 @@ function _stripSctExtensionFromCert(certDer) {
             if (oid === OID_CT_SCT_LIST) continue;                               // drop the SCT extension
           } catch (_e) { /* not an OID — keep the extension as-is */ }
         }
-        // Re-encode this extension verbatim (we have the original bytes).
-        var origExt = certDer.slice(0, 0);                                       // placeholder; we rebuild from the parsed node below
-        void origExt;
+        // Re-encode this extension verbatim from its parsed bytes.
         keptExtBytes.push(_encodeAsn1(asn1.TAG.SEQUENCE, true, extBytes));
-        void extBytes;
       }
       var newExtSeq = _encodeAsn1(asn1.TAG.SEQUENCE, true, Buffer.concat(keptExtBytes));
       var newExplicit3 = _encodeContextExplicit(3, newExtSeq);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.3",
+  "version": "0.14.4",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:bfe58661-57c7-4e95-87a0-d0a82ae37a6b",
+  "serialNumber": "urn:uuid:3b6688f8-8f17-4d81-9bad-f0e6166a53c7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-30T08:21:39.433Z",
+    "timestamp": "2026-05-30T08:50:20.572Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.14.3",
+      "bom-ref": "@blamejs/core@0.14.4",
       "type": "application",
       "name": "blamejs",
-      "version": "0.14.3",
+      "version": "0.14.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.14.3",
+      "purl": "pkg:npm/%40blamejs/core@0.14.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.14.3",
+      "ref": "@blamejs/core@0.14.4",
       "dependsOn": []
     }
   ]