@blamejs/core 0.14.3 → 0.14.5

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.5 (2026-05-30) — **Finished cleaning up the mislabeled byte-literal lint suppressions, with no API or behavior changes.** A follow-up to the byte-literal lint tightening. The remaining suppression comments that named the byte-literal check on values that are not byte sizes — JSON-RPC error codes, HTTP status codes, octet ranges, day-in-milliseconds constants — are removed, keeping their explanatory text and any correctly-named companion suppression. Every byte-literal suppression that remains is now on genuine 1024-scale byte arithmetic. Source-comment hygiene only. **Changed:** *Remaining mislabeled byte-literal suppressions removed* — The byte-literal lint was previously a check on any multiple-of-8 integer, so suppression comments naming it were scattered across non-byte values. The last of those (in a handful of files, in mixed comment formats) are now removed — their explanatory text is retained as plain comments, and any correctly-named companion suppression is kept. The only byte-literal suppressions that remain are on genuine 1024-scale byte arithmetic. No change to any exported API, error code, wire format, or runtime behavior.
+
+- v0.14.4 (2026-05-30) — **Removed three pieces of dead code from the SAML, TLS, and JMAP surfaces; no API or behavior changes.** Cleanup of unreachable code. A reverse signature-algorithm lookup in the SAML verifier was never called — the actual verification path resolves the algorithm through the supported-signature table — so it is removed and a stale comment that referenced it is corrected. A leftover no-op placeholder in the TLS certificate re-encode path (a zero-length slice that was assigned and discarded) is removed, leaving the verbatim extension re-encode it sat next to. An unused JMAP well-known-path constant that existed only to be discarded is removed. None of this changes any exported API, error code, wire format, or runtime behavior. **Removed:** *Unreachable code in SAML, TLS, and JMAP* — Removed `_sigAlgFromUri` from the SAML module (a reverse alg lookup that was never called — the embedded XML-DSig verifier resolves the algorithm via the supported-signature table, and the redirect-binding path uses the forward `_sigAlgUrn`), a discarded zero-length-slice placeholder in the TLS certificate extension re-encode path, and an unused well-known-path constant in the JMAP server. Internal cleanup only — no change to any exported API, error code, wire format, or runtime behavior.
+
 - v0.14.3 (2026-05-30) — **A codebase check now ensures every lint-suppression marker names a real check, so a typo can't silently disable a guard.** Source files suppress an individual lint with an `// allow:<class>` comment. If the class is mistyped or stale, the comment suppresses nothing — the check it names does not exist — so the issue it was meant to explain ships unflagged. A new codebase check now verifies every `// allow:<class>` marker names a registered check class and fails if it does not, with the full set of valid classes maintained as an explicit registry. Two markers that named a non-kebab class were corrected as part of this. No runtime, API, or wire-format changes. **Detectors:** *Lint-suppression markers must name a registered check* — A new check flags any `// allow:<class>` suppression comment whose class is not one of the registered check classes — catching typos and stale markers (for example a marker that named a check which was later renamed) that would otherwise silently disable the guard they appear to explain. The valid classes are kept as an explicit registry, so adding a check with a new allow-class is a one-line registration. Source-comment hygiene only — no change to any exported API, error code, wire format, or runtime behavior.
 
 - v0.14.2 (2026-05-29) — **Internal lint hygiene: the byte-literal check now flags only genuine byte-scale arithmetic, with no API or behavior changes.** A no-behavior-change cleanup of the source tree's internal lint markers. The byte-literal lint previously flagged every integer that was a multiple of 8 — which is most numbers — so the source carried a large number of suppression comments on values that were not byte sizes at all (status codes, counts, lengths, radixes, opcodes). The lint now flags only 1024-scale byte arithmetic (the case the C.BYTES.kib/mib/gib helpers exist to replace), and the now-unnecessary suppression comments have been removed while keeping their explanatory text. Several lint-suppression markers that named a check that does not exist were also corrected. None of this changes any API, wire format, or runtime behavior. **Changed:** *Source-tree lint markers cleaned up* — The internal byte-literal lint was tightened to flag only genuine byte-scale (`* 1024`) arithmetic, and the suppression comments it previously required on non-byte integers were removed (their explanatory text is retained as plain comments). A handful of suppression markers that referenced a non-existent check were pointed at the correct one or removed. This is source-comment hygiene only — there is no change to any exported API, error code, wire format, or runtime behavior.

package/lib/a2a-tasks.js

@@ -62,17 +62,17 @@ var A2aTasksError = defineClass("A2aTasksError", { alwaysPermanent: true });
 var JSONRPC_VERSION = "2.0";
 
 // JSON-RPC 2.0 fixed error codes — A2A inherits these.
-var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST  = -32600;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND = -32601;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS   = -32602;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR   = -32603;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_REQUEST  = -32600;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_METHOD_NOT_FOUND = -32601;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_PARAMS   = -32602;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_INTERNAL_ERROR   = -32603;                                                             // allow:raw-time-literal — not seconds
 
 // A2A-specific error codes per the spec's task-error vocabulary.
 // A2A_TASK_NOT_FOUND (-32002) + A2A_TASK_NOT_CANCELABLE (-32003) are
 // raised by operator handlers — they're reserved here for documentation
 // purposes only.
-var A2A_SCOPE_DENIED         = -32001;                                                             // allow:raw-byte-literal — JSON-RPC server-error range / allow:raw-time-literal — not seconds
+var A2A_SCOPE_DENIED         = -32001;                                                             // allow:raw-time-literal — not seconds
 
 var ALLOWED_METHODS = Object.freeze(["tasks/send", "tasks/get", "tasks/cancel"]);
 

package/lib/ai-input.js

@@ -26,7 +26,7 @@ var audit = require("./audit");
 var { AiInputError } = require("./framework-error");
 
 var SAMPLE_TRUNC = 80;                                                                       // sample truncation length, not bytes
-var CONFIDENCE_BASE = 60;                                                                    // allow:raw-byte-literal — confidence percentage base / allow:raw-time-literal — not seconds
+var CONFIDENCE_BASE = 60;                                                                    // allow:raw-time-literal — not seconds
 
 var PATTERNS = [
   { id: "ignore-prior-instructions", severity: 3, re:

package/lib/auth/saml.js

@@ -1726,8 +1726,8 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
 
 // PQC SignatureMethod URIs used by the embedded XMLDSig signatures.
 // Standard XMLDSig vocabulary classical signing URIs (W3C XMLDSig
-// Core 1.1 + RFC 9231 for Ed25519) are dispatched via _sigAlgUrn /
-// _sigAlgFromUri. The framework adds two non-standard URNs for
+// Core 1.1 + RFC 9231 for Ed25519) are dispatched via _sigAlgUrn (sign
+// side) and the SUPPORTED_SIG table (verify side). The framework adds two non-standard URNs for
 // ML-DSA because no W3C/IETF XMLDSig URI registration exists for
 // post-quantum signers yet (LAMPS WG has open drafts but none final).
 // Operators integrating with PQC-aware IdPs that exchange those URNs
@@ -2027,22 +2027,6 @@ function _sigAlgUrn(alg) {
   return null;
 }
 
-// Reverse lookup — SignatureMethod URI on the inbound wire → alg
-// shorthand for _sigAlgUrn dispatch. Used by _verifyEmbeddedXmlDsig
-// to pick the right verifier when an IdP signs with a classical alg.
-function _sigAlgFromUri(uri) {
-  if (uri === "urn:blamejs:experimental:saml-sig-alg:ml-dsa-65") return "ml-dsa-65";
-  if (uri === "urn:blamejs:experimental:saml-sig-alg:ml-dsa-87") return "ml-dsa-87";
-  if (uri === "http://www.w3.org/2021/04/xmldsig-more#ed25519") return "ed25519";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")   return "rsa-sha256";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384")   return "rsa-sha384";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512")   return "rsa-sha512";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256") return "ecdsa-sha256";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384") return "ecdsa-sha384";
-  if (uri === "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512") return "ecdsa-sha512";
-  return null;
-}
-
 /**
  * @primitive b.auth.saml.fetchMdq
  * @signature b.auth.saml.fetchMdq(opts)

package/lib/auth/sd-jwt-vc.js

@@ -597,7 +597,7 @@ async function verify(presentation, opts) {
     }
     // Verify KB-JWT signature
     var kbHeaderObj;
-    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies // allow:raw-byte-literal — kb-header cap (4 KB)
+    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies
     catch (e) {
       throw new AuthError("auth-sd-jwt-vc/bad-kb-header",
         "verify: malformed KB-JWT header: " + e.message);

package/lib/calendar.js

@@ -99,7 +99,7 @@ var JSCAL_NOTE_STATUS = Object.freeze({
 // Recurrence-expansion caps. Mirror b.safeIcal's RRULE limits so the
 // expand path can't outpace what the parser already permitted.
 var MAX_EXPAND_INSTANCES = 4096;                                                                       // instance count cap, not bytes
-var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;                                             // allow:raw-byte-literal + allow:raw-time-literal — 10 year max expansion span
+var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;                                             // allow:raw-time-literal — 10 year max expansion span
 
 /**
  * @primitive b.calendar.validate
@@ -697,7 +697,7 @@ function _expandSingleRule(rule, startMs, ctx) {
   }
   var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // RFC 5545 hour range
   var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // RFC 5545 minute range
-  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-byte-literal — RFC 5545 second range incl. leap second // allow:raw-time-literal — second-of-minute bound, not a duration
+  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-time-literal — second-of-minute bound, not a duration
 
   function _isoWeekParts(d) {
     // ISO 8601 week-of-year + week-year. The week-YEAR can differ
@@ -709,7 +709,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // ISO week-year anchor (Thursday)
     var weekYear = tmp.getUTCFullYear();
     var yearStart = new Date(Date.UTC(weekYear, 0, 1));
-    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week // allow:raw-byte-literal
+    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week
     return { week: week, year: weekYear };
   }
   function _isoWeekOf(d) {
@@ -717,7 +717,7 @@ function _expandSingleRule(rule, startMs, ctx) {
   }
   function _yearDayOf(d) {
     var startOfYear = new Date(Date.UTC(d.getUTCFullYear(), 0, 1));
-    return Math.floor((d - startOfYear) / 86400000) + 1;                                               // allow:raw-time-literal — 86400000 ms/day // allow:raw-byte-literal
+    return Math.floor((d - startOfYear) / 86400000) + 1;                                               // allow:raw-time-literal — 86400000 ms/day
   }
   function _daysInYear(year) {
     return ((year % 4 === 0 && year % 100 !== 0) || year % 400 === 0) ? 366 : 365;                      // Gregorian leap-year rule
@@ -869,7 +869,7 @@ function _expandWithBysetpos(ctx) {
       stepBudgetRef.remaining -= 1;
       var candidate = _withTimeOfDay(dayMs, hh, mm, ss, ms);
       if (matchesBy(candidate)) candidates.push(candidate);
-      dayMs += 86400000;                                                                               // allow:raw-time-literal — 86400000 ms/day step // allow:raw-byte-literal — same constant in ms/day form
+      dayMs += 86400000;                                                                               // allow:raw-time-literal — 86400000 ms/day step
     }
 
     // Sort + apply BYSETPOS. Positive index 1-based from start;
@@ -930,7 +930,7 @@ function _periodForIndex(freq, startDate, offset) {
   var dow = anchor.getUTCDay() || 7;
   anchor.setUTCDate(anchor.getUTCDate() - (dow - 1) + offset * 7);                                     // days/week
   var ws = anchor.getTime();
-  var we = ws + 7 * 86400000 - 1;                                                                      // allow:raw-byte-literal + allow:raw-time-literal — 7-day window
+  var we = ws + 7 * 86400000 - 1;                                                                      // allow:raw-time-literal — 7-day window
   return { startMs: ws, endMs: we };
 }
 

package/lib/content-credentials.js

@@ -590,7 +590,7 @@ var CAC_KIND_ENUM = Object.freeze({
   text: true, image: true, audio: true, video: true,
   "virtual-scene": true, other: true,
 });
-var CAC_USCC_RE = /^[0-9A-HJ-NPQRTUWXY]{18}$/;                                                  // allow:raw-byte-literal — GB 32100-2015 USCC fixed length, not bytes // allow:raw-time-literal — 18 is char-count of the credit code, not seconds
+var CAC_USCC_RE = /^[0-9A-HJ-NPQRTUWXY]{18}$/;                                                  // allow:raw-time-literal — 18 is char-count of the credit code, not seconds
 var ISO8601_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
 
 function cacImplicitLabel(opts) {
@@ -605,7 +605,7 @@ function cacImplicitLabel(opts) {
     throw new ContentCredentialsError("cac-implicit-label/oversize-provider-name",
       "cacImplicitLabel: providerName exceeds " + STR_LEN_MAX + " bytes (UTF-8)");
   }
-  if (typeof opts.providerCode !== "string" || opts.providerCode.length !== 18 ||                // allow:raw-byte-literal — USCC fixed length (GB 32100-2015), not bytes // allow:raw-time-literal — string length, not seconds
+  if (typeof opts.providerCode !== "string" || opts.providerCode.length !== 18 ||                // allow:raw-time-literal — string length, not seconds
       !CAC_USCC_RE.test(opts.providerCode)) {                                                    // allow:regex-no-length-cap — length-bounded immediately above
     throw new ContentCredentialsError("cac-implicit-label/bad-provider-code",
       "cacImplicitLabel: providerCode must be an 18-char unified social credit code " +

package/lib/guard-cidr.js

@@ -73,7 +73,7 @@ var IPV4_RESERVED = Object.freeze([
   { net: _ipv4ToUint32([127, 0, 0, 0]),      prefix: 8,  label: "loopback" },                    // IPv4 octets
   { net: _ipv4ToUint32([169, 254, 0, 0]),    prefix: 16, label: "link-local" },                  // IPv4 octets
   { net: _ipv4ToUint32([224, 0, 0, 0]),      prefix: 4,  label: "multicast" },                   // IPv4 octets
-  { net: _ipv4ToUint32([240, 0, 0, 0]),      prefix: 4,  label: "reserved-class-e" },            // allow:raw-byte-literal — IPv4 octets allow:raw-time-literal — 240 is an IPv4 octet not seconds
+  { net: _ipv4ToUint32([240, 0, 0, 0]),      prefix: 4,  label: "reserved-class-e" },            // allow:raw-time-literal — 240 is an IPv4 octet not seconds
   { net: _ipv4ToUint32([192, 0, 2, 0]),      prefix: 24, label: "documentation-test-net-1" },    // IPv4 octets
   { net: _ipv4ToUint32([198, 51, 100, 0]),   prefix: 24, label: "documentation-test-net-2" },    // IPv4 octets
   { net: _ipv4ToUint32([203, 0, 113, 0]),    prefix: 24, label: "documentation-test-net-3" },    // IPv4 octets

package/lib/http-client-cache.js

@@ -66,7 +66,7 @@ var HEURISTIC_MAX_AGE_MS = C.TIME.hours(24);
 // Statuses RFC 9110 designates as heuristically cacheable. (Plus 200/206
 // which are universally cacheable when a freshness lifetime is given.)
 var CACHEABLE_STATUSES = new Set([
-  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-byte-literal — HTTP status codes per RFC 9110 / allow:raw-time-literal — same line, status codes not seconds
+  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-time-literal — same line, status codes not seconds
 ]);
 
 // Headers that MUST not be forwarded when serving a 304-updated entry.

package/lib/mail-auth.js

@@ -1476,7 +1476,7 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
 
 function _parseArcTagList(value) {
   var tags = {};
-  var parts = String(value).split(";");                                                          // allow:bare-split-on-quoted-header — allow:raw-byte-literal — RFC 8617 §4 ARC tag-list grammar (same as the DKIM RFC's): `tag-spec *( ";" tag-spec )`, tag-value contains no DQUOTE
+  var parts = String(value).split(";");                                                          // allow:bare-split-on-quoted-header — RFC 8617 §4 ARC tag-list grammar (same as the DKIM RFC's): `tag-spec *( ";" tag-spec )`, tag-value contains no DQUOTE
 
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i].trim();

package/lib/mail-crypto-smime.js

@@ -754,7 +754,7 @@ function checkCert(opts) {
   if (pub && pub.asymmetricKeyType === "rsa") {
     var jwk = pub.export({ format: "jwk" });
     var nBytes = Buffer.from(jwk.n, "base64url");
-    var bits = nBytes.length * 8;                                                                     // allow:raw-byte-literal — bits-per-byte conversion // allow:raw-time-literal — RFC 5280 in comment, not seconds
+    var bits = nBytes.length * 8;                                                                     // allow:raw-time-literal — RFC 5280 in comment, not seconds
     if (bits < RSA_MIN_BITS) {
       throw new MailCryptoError("mail-crypto/smime/rsa-too-small",
         "cert public key is " + bits + " RSA bits; minimum is " + RSA_MIN_BITS +

package/lib/mail-deploy.js

@@ -155,7 +155,7 @@ function mtaStsPublish(opts) {
     throw new MailDeployError("mail-deploy/bad-max-age",
       "mtaStsPublish: opts.maxAgeSec must be a positive integer");
   }
-  if (opts.maxAgeSec > 31557600) {                                                                    // allow:raw-time-literal — 1 year in seconds (RFC 8461 §3.2 max_age unit) // allow:raw-byte-literal — same numeric, no byte semantic
+  if (opts.maxAgeSec > 31557600) {                                                                    // allow:raw-time-literal — 1 year in seconds (RFC 8461 §3.2 max_age unit)
     throw new MailDeployError("mail-deploy/bad-max-age",
       "mtaStsPublish: opts.maxAgeSec exceeds 1 year (RFC 8461 §3.2 SHOULD ≤ 31557600)");
   }

package/lib/mail-dkim.js

@@ -950,7 +950,7 @@ async function verify(rfc822, opts) {
       // Allow up to 24h future-skew; beyond that, refuse — neither
       // operator clock drift nor delivery latency explains a future-
       // dated signing time of more than a day.
-      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-byte-literal — Unix-seconds offset, not bytes / allow:raw-time-literal — 24h future-date sanity ceiling
+      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-time-literal — 24h future-date sanity ceiling
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
           errors: ["DKIM-Signature t=" + tSec + " is more than 24h in the future (RFC 6376 §3.5 sanity)"] });

package/lib/mail-server-jmap.js

@@ -133,9 +133,7 @@ var audit = lazyRequire(function () { return require("./audit"); });
 var MailServerJmapError = defineClass("MailServerJmapError", { alwaysPermanent: true });
 
 var DEFAULT_PROFILE = "strict";
-var WELL_KNOWN_PATH = "/.well-known/jmap";
 void C;                                                                                               // reserved for future cap constants
-void WELL_KNOWN_PATH;
 
 /**
  * @primitive b.mail.server.jmap.create
@@ -597,7 +595,7 @@ function create(opts) {
     } else {
       pingN = parseInt(params.ping, 10);
       if (!isFinite(pingN) || pingN < 5) pingN = 30;                                                   // RFC 8620 §7.3 default ping seconds
-      if (pingN > 900) pingN = 900;                                                                    // allow:raw-byte-literal — operator-supplied ping seconds, not bytes // allow:raw-time-literal — explicit max-ping cap (15 minutes)
+      if (pingN > 900) pingN = 900;                                                                    // allow:raw-time-literal — explicit max-ping cap (15 minutes)
     }
 
     // SSE wire headers per the HTML5 spec § "Server-sent events"
@@ -678,7 +676,7 @@ function create(opts) {
         }
         unsubscribe = typeof unsub === "function" ? unsub : null;
         if (!pingDisabled) {
-          pingTimer = setInterval(_pingTick, pingN * 1000);                                            // allow:raw-time-literal — seconds → ms conversion // allow:raw-byte-literal — not bytes, time conversion
+          pingTimer = setInterval(_pingTick, pingN * 1000);                                            // allow:raw-time-literal — seconds → ms conversion
           if (pingTimer && typeof pingTimer.unref === "function") pingTimer.unref();
         }
       })

package/lib/mcp.js

@@ -45,12 +45,12 @@ var METHOD_NAME_MAX   = 256;
 // JSON-RPC 2.0 error codes (https://www.jsonrpc.org/specification#error_object).
 // Negative numerics by spec; mapped to HTTP status for the framework's
 // HTTP-shaped reply envelope.
-var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST = -32600;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND= -32601;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS  = -32602;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR  = -32603;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_AUTH_REQUIRED   = -32001;                                                        // allow:raw-byte-literal — JSON-RPC server-error reserved range / allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_REQUEST = -32600;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_METHOD_NOT_FOUND= -32601;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_PARAMS  = -32602;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_INTERNAL_ERROR  = -32603;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_AUTH_REQUIRED   = -32001;                                                        // allow:raw-time-literal — not seconds
 var TOOL_NAME_RE     = /^[a-zA-Z][a-zA-Z0-9._-]{0,63}$/;
 var RESOURCE_NAME_RE = /^[a-zA-Z][a-zA-Z0-9._/-]{0,255}$/;
 

package/lib/middleware/compose-pipeline.js

@@ -97,7 +97,7 @@ var CANONICAL_POSITIONS = Object.freeze({
   botGuard:      42,                                                                                      // canonical position bucket
   requireAuth:   50,                                                                                      // canonical position bucket
   attachUser:    52,                                                                                      // canonical position bucket
-  handler:       60,                                                                                      // allow:raw-byte-literal — canonical position bucket // allow:raw-time-literal — pipeline position int, not seconds
+  handler:       60,                                                                                      // allow:raw-time-literal — pipeline position int, not seconds
   errorHandler:  90,                                                                                      // canonical position bucket
 });
 

package/lib/network-tls.js

@@ -1797,11 +1797,8 @@ function _stripSctExtensionFromCert(certDer) {
             if (oid === OID_CT_SCT_LIST) continue;                               // drop the SCT extension
           } catch (_e) { /* not an OID — keep the extension as-is */ }
         }
-        // Re-encode this extension verbatim (we have the original bytes).
-        var origExt = certDer.slice(0, 0);                                       // placeholder; we rebuild from the parsed node below
-        void origExt;
+        // Re-encode this extension verbatim from its parsed bytes.
         keptExtBytes.push(_encodeAsn1(asn1.TAG.SEQUENCE, true, extBytes));
-        void extBytes;
       }
       var newExtSeq = _encodeAsn1(asn1.TAG.SEQUENCE, true, Buffer.concat(keptExtBytes));
       var newExplicit3 = _encodeContextExplicit(3, newExtSeq);

package/lib/safe-decompress.js

@@ -105,7 +105,7 @@ var _algorithms = {
 // classic bomb shapes (1000:1) while leaving headroom for legitimate
 // text / JSON / XML payloads (which compress 20-50:1 commonly). Per
 // RFC 8460 §5.2 community guidance for TLS-RPT report decompression.
-var DEFAULT_MAX_RATIO = 50;                                                          // allow:raw-byte-literal — RFC 8460 §5.2 community guidance / allow:raw-time-literal — RFC number not seconds
+var DEFAULT_MAX_RATIO = 50;                                                          // allow:raw-time-literal — RFC number not seconds
 
 // Default input cap when operator omits opts.maxCompressedBytes —
 // 4 MiB matches the TLS-RPT receive surface and is a reasonable

package/lib/safe-url.js

@@ -407,7 +407,7 @@ function format(url) {
     }
     // Constructing URL() is the path that surfaces the IDN-crash on
     // older Node — wrap so the listener never crashes.
-    var u = new URL(url);   // allow:raw-new-url — safeUrl.format wraps URL ctor for CVE-2026-21712; this IS the safe wrapper.   // allow:raw-byte-literal — no byte literal; suppresses cross-detector false-positive from neighboring text
+    var u = new URL(url);   // allow:raw-new-url — safeUrl.format wraps URL ctor for CVE-2026-21712; this IS the safe wrapper.
     return u.href;
   } catch (e) {
     if (e && e.isSafeUrlError) throw e;

package/lib/stream-throttle.js

@@ -71,9 +71,9 @@ var StreamThrottleError = defineClass("StreamThrottleError", { alwaysPermanent:
 // (bytes/sec ↔ wait-ms). This is a unit-conversion constant, not a
 // memory cap or protocol-byte literal; the framework's C.TIME / C.BYTES
 // helpers don't apply.
-var MS_PER_SECOND = 1000;                                                                             // allow:raw-byte-literal — ms/sec unit conversion // allow:raw-time-literal — ms/sec unit conversion
+var MS_PER_SECOND = 1000;                                                                             // allow:raw-time-literal — ms/sec unit conversion
 var NS_PER_MS     = 1e6;                                                                              // ns/ms unit conversion
-var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-byte-literal — hrtime seconds→ms // allow:raw-time-literal — hrtime seconds→ms
+var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-time-literal — hrtime seconds→ms
 
 /**
  * @primitive b.streamThrottle.create

package/lib/websocket.js

@@ -190,8 +190,8 @@ var CLOSE_GRACE_MS            = C.TIME.seconds(2);
 // invalid.
 function _isValidCloseCode(code) {
   if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // RFC 6455 §7.4.2 reserved codes
-  if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 spec range / allow:raw-time-literal — code is a numeric, not seconds
-  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 IANA / private range / allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
   return false;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:bfe58661-57c7-4e95-87a0-d0a82ae37a6b",
+  "serialNumber": "urn:uuid:5c0853e1-1ea7-4fb1-8fb6-58b2ae51671f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-30T08:21:39.433Z",
+    "timestamp": "2026-05-30T15:10:40.322Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.14.3",
+      "bom-ref": "@blamejs/core@0.14.5",
       "type": "application",
       "name": "blamejs",
-      "version": "0.14.3",
+      "version": "0.14.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.14.3",
+      "purl": "pkg:npm/%40blamejs/core@0.14.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.14.3",
+      "ref": "@blamejs/core@0.14.5",
       "dependsOn": []
     }
   ]