@blamejs/core 0.14.7 → 0.14.9

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.9 (2026-05-30) — **Corrects EU AI Act doc paths that named an uncallable namespace, plus source-comment hygiene and two new codebase checks.** A documentation fix and internal hygiene. The `@primitive` / `@signature` / `@example` blocks for the EU AI Act fundamental-rights-impact-assessment and GPAI training-data-summary helpers advertised `b.complianceAiAct.*`, which is undefined — the callable path is `b.compliance.aiAct.*` — so an operator copying the documented call got `undefined is not a function`. The documented paths now match the real surface. Alongside that: a duplicate parser entry in a doc block is removed, version stamps embedded in section-divider comments are stripped, and two codebase checks are added — one that fails the build when a `@primitive` block documents a wholly-unresolvable namespace (the gap that hid the AI Act paths), and one that flags a version stamp left inside a section divider. No exported API, error code, wire format, or runtime behaviour changes. **Changed:** *Source-comment hygiene* — Removed a duplicate `env` entry from the parsers `@module` doc block, and stripped internal version stamps (`vX.Y.Z`) from `// ---- ... ----` section-divider comments across several files, keeping the descriptive label. Comment-only; no behaviour change. **Fixed:** *EU AI Act helper documentation named an uncallable path* — `b.compliance.aiAct.fundamentalRightsImpactAssessment` and `b.compliance.aiAct.gpai.trainingDataSummary` were documented as `b.complianceAiAct.*` in their `@primitive` / `@signature` / `@example` blocks (and one returned reference string). `b.complianceAiAct` is undefined, so the documented call failed; the documented paths now match the callable surface. **Detectors:** *`@primitive` reachability covers wrong-namespace paths* — The reachability check previously only flagged a missing leaf on a resolved namespace; a `@primitive` whose entire dotted prefix is unresolvable (the shape that hid the AI Act doc paths) was silently skipped. It now walks each prefix segment and fails the build on any unresolvable one, while preserving the factory-instance-shorthand exemption. · *Version-stamp-in-divider check* — A new check flags a version stamp (`vX.Y.Z`) left immediately after a section divider's dashes (`// ---- vX.Y.Z ...`) — internal release vocabulary that does not belong in shipped source comments — without matching legitimate `@since` tags or prose version references.
+
+- v0.14.8 (2026-05-30) — **Source-comment and codebase-check hygiene, plus a new require-block alignment check; no API or behaviour changes.** Internal lint and comment cleanup with no operator-facing surface change. Several codebase-check comments and one stub helper name that described behaviour the check no longer has are corrected; an unused lint-suppression class and a set of stale duplicate-cluster qualifiers (functions that were since renamed or extracted) are pruned or re-pointed. Fifty-nine `// allow:` markers that named the byte-size or time-literal check on values those checks no longer flag are removed, and twenty self-negating rationales on markers the time check genuinely fires on are rewritten to say why the value coincidentally matches. A new codebase check holds top-of-file require blocks to consistent `=` column alignment, with the files that currently carry drift listed as a migration allowlist. No exported API, error code, wire format, or runtime behaviour changes. **Changed:** *Lint-suppression and codebase-check comment cleanup* — Corrected codebase-check comments that overstated their check's scope (a duplicate-code threshold described as three files when the advisory threshold is two, a narrowed byte-literal check carrying its pre-narrowing description, and a deferred-scan helper named as though it enforced a guarantee it does not yet provide). Removed an unused lint-suppression class and its one dead in-code marker, and pruned or re-pointed stale duplicate-cluster qualifiers that named functions since renamed or extracted into shared helpers. Removed fifty-nine `// allow:` markers that suppressed nothing, and rewrote twenty self-negating marker rationales (which read "not seconds" while sitting on a value the time check fires on) to explain the coincidental match. Source-comment and test hygiene only. **Detectors:** *Require-block `=` alignment check* — A new codebase check flags a top-of-file require block that mixes its `=` column alignment — a fittable line whose `=` drifts off the column the rest of the block shares. Compact single-space blocks are exempt (only blocks that declare alignment intent are checked), as are destructures and long names physically too wide to reach the column, and blank- or comment-separated tiers align independently. The files that currently carry such drift are an explicit migration allowlist, reflowed over time; new code is held to the rule.
+
 - v0.14.7 (2026-05-30) — **Storage and audit-trail hardening: queries are gated to declared columns, raw SQL refuses embedded literals, the database key is bound to its location, sealed-column lookup hashes gain a keyed mode, audit-chain purges can require dual control, and breach deadlines ship a running clock.** This release tightens the data and audit layers against a set of failure modes that were previously reachable. Database queries are now checked against the columns a table declared in its schema: a reference to an undeclared column fails closed by default instead of silently matching nothing, and the `whereRaw` escape hatch refuses an embedded string literal so values bind through placeholders. The database encryption key is sealed with its purpose, data directory, and key path as additional authenticated data, so a key file cannot be relocated to another deployment and unsealed there; an older key without that binding upgrades itself on first load. Sealed-column equality-lookup hashes can now be computed as a keyed MAC (HMAC-SHAKE256) off a per-deployment key, making the lookup hash unforgeable without that key, while the salted-SHA3 default is unchanged. Purging the tamper-evident audit chain can be placed under a two-authorizer dual-control grant so one operator cannot erase it alone, and database credential-rejection audits now record which relation the rejected credential tried to reach. Finally, breach-notification deadlines get a running clock that raises approaching and passed alerts as each regime's window elapses. One behavior change to note: the column gate defaults to reject — if a service issues queries against columns it did not declare in its schema, set `db.init({ columnGate: "warn" })` (audited, allowed) or `"off"` while the schema is reconciled. **Added:** *Column-membership gate on every query* — `b.db.from(table)` now checks each referenced column against the table's declared schema. The mode is set with `db.init({ columnGate: "reject" | "warn" | "off" })` (default `reject`), and `query.allowedColumns([...])` narrows a single query to an explicit allowlist that is always enforced. `b.db.getDeclaredColumns(table)` returns a table's declared column names (or `null` for an unknown table). This is defense in depth against typo'd or caller-influenced column names reaching the SQL layer (CWE-89). · *Keyed mode for sealed-column lookup hashes* — Equality-lookup ("derived") hashes for sealed columns can be computed as `hmac-shake256` — a keyed MAC over a per-deployment key — instead of the default `salted-sha3`. Set it per table with `cryptoField.registerTable(name, { derivedHashMode: "hmac-shake256" })` or per column with `{ from, mode: "hmac-shake256" }`. The keyed hash is unforgeable and un-correlatable without the deployment's MAC key, which raises the bar against offline lookup-table attacks on low-entropy sealed values (CWE-916). `b.vault.getDerivedHashMacKey()` exposes the 32-byte per-deployment key; it is created on first use and re-sealed across key rotation automatically. · *Dual-control gate on audit-chain purge* — `b.auditTools.purge` accepts `dualControlGrant`. When `audit_log` is placed under dual control, a verified archive and `confirm: true` are no longer sufficient: the purge additionally requires a consumed m-of-n grant whose action is bound to the purge, so a grant minted for another operation cannot be replayed and one operator cannot erase the tamper-evident chain alone (NIST SP 800-53 AU-9, separation of duties). · *Running clock for breach-notification deadlines* — `b.incident.report.createDeadlineClock({ notify, approachThresholds })` tracks open incidents and raises `deadline_approaching` and `deadline_passed` alerts as each regime's window elapses (GDPR 72h, DORA, NIS2, and the rest of the registry). Alerts are deduplicated per incident and stage, suppressed once a submission stage is acknowledged, and the clock can run on an interval or be ticked manually. **Changed:** *Queries against undeclared columns now fail closed by default* — The column gate defaults to `reject`: a query that references a column the table did not declare throws rather than silently matching nothing. A service that intentionally queries undeclared columns can set `db.init({ columnGate: "warn" })` to audit and allow, or `"off"` to disable the gate, while its schema is reconciled. Framework-declared columns (including `_id` and derived-hash columns) are always members. **Security:** *Database encryption key bound to its location* — `db.key.enc` is sealed with additional authenticated data over its purpose, resolved data directory, and resolved key path. A sealed key copied to a different deployment or path no longer unseals there — the AEAD authentication fails — which prevents silent key relocation. A legacy key sealed without this binding is detected and re-sealed in the bound format on first load, with no operator action required. · *`whereRaw` refuses embedded string literals* — `whereRaw(sql, params)` and `WhereBuilder.raw(sql, params)` reject a raw fragment containing a string literal (`'...'`); values must bind through the `params` array. A static, operator-controlled literal can opt in with `{ allowLiterals: true }`. This closes a path where a value concatenated into a raw fragment would reintroduce SQL injection (CWE-89). · *Credential-rejection audits record the attempted relation* — A `db.auth.failed` audit row (SQLSTATE 28000 / 28P01 / 42501) now carries `attemptedTable`, the relation the rejected credential tried to reach, extracted defensively from the statement. Triage can scope the blast radius of a credential-abuse event without correlating back to the raw SQL log (CWE-778). **Detectors:** *Audit-purge dual-control gate* — A new check fails the build if a call to `purgeAuditChain` appears in a file that does not also route through the dual-control gate, so a future caller cannot physically delete chain rows without two-authorizer enforcement. · *Raw-SQL literal/interpolation guard* — A new check fails the build on a `whereRaw` / `.raw` call whose SQL argument is built by template interpolation or string concatenation, keeping the bound-params discipline enforceable in framework code. · *Hand-rolled lookup-hash guard* — A new check fails the build if a sealed-column lookup hash is derived from the per-deployment salt outside the canonical helper, so call sites cannot bypass the keyed-mode and per-column mode policy. · *Auth-audit attempted-relation guard* — A new check fails the build if a `db.auth.failed` audit is emitted in a file that does not name `attemptedTable`, so the forensic field cannot be dropped from a future emitter.
 
 - v0.14.6 (2026-05-30) — **Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable.** Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed. **Added:** *Uniform `onDeny` and `problemDetails` options on every access-refusal middleware* — Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`). **Fixed:** *`b.middleware.requireBoundKey` is now callable* — The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface. · *`b.middleware.bearerAuth` accepts `requiredScopes`* — The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option. · *RFC 6750 challenge codes on API-key refusals* — `b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal. · *Corrected two documented call paths* — The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths. · *GitHub Actions pins refreshed* — `github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases. **Detectors:** *`@primitive` reachability gate* — A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above. · *Deny-path composition gate* — A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`. · *Actions and vendor currency in the release flow* — The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release.

package/lib/a2a-tasks.js

@@ -62,17 +62,17 @@ var A2aTasksError = defineClass("A2aTasksError", { alwaysPermanent: true });
 var JSONRPC_VERSION = "2.0";
 
 // JSON-RPC 2.0 fixed error codes — A2A inherits these.
-var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST  = -32600;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND = -32601;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS   = -32602;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR   = -32603;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-time-literal — JSON-RPC error code -32700; coincidental multiple-of-60, not a time value, C.TIME N/A
+var JSONRPC_INVALID_REQUEST  = -32600;
+var JSONRPC_METHOD_NOT_FOUND = -32601;
+var JSONRPC_INVALID_PARAMS   = -32602;
+var JSONRPC_INTERNAL_ERROR   = -32603;
 
 // A2A-specific error codes per the spec's task-error vocabulary.
 // A2A_TASK_NOT_FOUND (-32002) + A2A_TASK_NOT_CANCELABLE (-32003) are
 // raised by operator handlers — they're reserved here for documentation
 // purposes only.
-var A2A_SCOPE_DENIED         = -32001;                                                             // allow:raw-time-literal — not seconds
+var A2A_SCOPE_DENIED         = -32001;
 
 var ALLOWED_METHODS = Object.freeze(["tasks/send", "tasks/get", "tasks/cancel"]);
 

package/lib/ai-input.js

@@ -26,7 +26,7 @@ var audit = require("./audit");
 var { AiInputError } = require("./framework-error");
 
 var SAMPLE_TRUNC = 80;                                                                       // sample truncation length, not bytes
-var CONFIDENCE_BASE = 60;                                                                    // allow:raw-time-literal — not seconds
+var CONFIDENCE_BASE = 60;                                                                    // allow:raw-time-literal — confidence-score base 60; coincidental multiple-of-60, not a duration, C.TIME N/A
 
 var PATTERNS = [
   { id: "ignore-prior-instructions", severity: 3, re:

package/lib/auth/acr-vocabulary.js

@@ -90,7 +90,7 @@ var BUILTIN_RANKS = {
   "urn:mace:incommon:iap:silver":      32,    // ACR rank, not bytes
 
   // Phishing-resistant multi-factor (passkey UV)
-  "phrh":                              60,    // allow:raw-time-literal — ACR rank, not seconds
+  "phrh":                              60,    // allow:raw-time-literal — ACR rank value 60; coincidental multiple-of-60, not a duration, C.TIME N/A
 
   // Hardware-bound + phishing-resistant + multi-factor
   "loa3":                              70,

package/lib/auth/ciba.js

@@ -68,9 +68,9 @@ var emit = validateOpts.makeNamespacedEmitters("auth.ciba", { audit: audit, obse
 var DEFAULT_INTERVAL_SEC = 5;
 var DEFAULT_EXPIRES_SEC  = 600;
 var MAX_BINDING_MSG_LEN  = 200;
-var MAX_RESPONSE_BYTES   = 64 * 1024;                                                            // allow:raw-byte-literal — JSON token-response cap
+var MAX_RESPONSE_BYTES   = 64 * 1024;
 var MIN_INTERVAL_SEC     = 1;
-var MAX_INTERVAL_SEC     = 300;                                                                  // allow:raw-time-literal — interval ceiling
+var MAX_INTERVAL_SEC     = 300;                                                                  // allow:raw-time-literal — 300s polling-interval ceiling; time-derived literal, C.TIME.seconds(300) applies, retained pending migration
 
 // _emitAudit emits under the "auth.ciba.<action>" namespace; _emitMetric
 // fires the matching observability counter. Implementations live in
@@ -490,7 +490,7 @@ function create(opts) {
         var current = entry ? entry.interval : DEFAULT_INTERVAL_SEC;
         var idpSuggested = err.cibaError && typeof err.cibaError.interval === "number"
           ? err.cibaError.interval : null;
-        var next = current + 5;                                                                 // allow:raw-time-literal — §11.3 mandates +5s minimum
+        var next = current + 5;
         if (idpSuggested !== null && idpSuggested > next && idpSuggested <= MAX_INTERVAL_SEC) {
           next = idpSuggested;
         }

package/lib/auth/oauth.js

@@ -220,7 +220,7 @@ var PSS_SALT_BYTES_SHA512      = C.BYTES.bytes(64);
 // CSPRNG output and refuses pathological payloads.
 var MAX_DEVICE_CODE_BYTES      = C.BYTES.kib(8);
 // RFC 8628 §3.4 — 5s is the spec-documented MINIMUM polling interval.
-var MIN_DEVICE_POLL_INTERVAL_SEC = 5;                                                              // allow:raw-time-literal — RFC 8628 §3.4 spec floor
+var MIN_DEVICE_POLL_INTERVAL_SEC = 5;
 // OIDC Back-Channel Logout §2.6 — replay defense via jti store catches
 // duplicate-jti reuse, but pre-v0.9.x an old captured logout-token
 // with a fresh jti could still pass. Enforce iat freshness against

package/lib/auth/oid4vci.js

@@ -69,7 +69,7 @@ var emit = validateOpts.makeNamespacedEmitters("auth.oid4vci", { audit: audit, o
 var DEFAULT_PRE_AUTH_TTL_MS  = C.TIME.minutes(5);
 var DEFAULT_ACCESS_TOKEN_TTL = C.TIME.minutes(15);
 var DEFAULT_C_NONCE_TTL_MS   = C.TIME.minutes(5);
-var MAX_PROOF_BYTES          = 32 * 1024;                                                       // allow:raw-byte-literal — proof-JWT cap
+var MAX_PROOF_BYTES          = 32 * 1024;
 var SUPPORTED_CREDENTIAL_FORMATS = ["vc+sd-jwt", "dc+sd-jwt"];
 
 var _emitAudit  = emit.audit;

package/lib/auth/openid-federation.js

@@ -81,7 +81,7 @@ var _emitAudit  = emit.audit;
 var _emitMetric = emit.metric;
 
 var SUPPORTED_ALGS = ["ES256", "ES384", "ES512", "PS256", "PS384", "PS512", "RS256", "EdDSA"];
-var MAX_STATEMENT_BYTES = 64 * 1024;                                                            // allow:raw-byte-literal — entity-statement size cap
+var MAX_STATEMENT_BYTES = 64 * 1024;
 var MAX_CHAIN_DEPTH = 10;                                                                       // federation chain depth ceiling
 
 function _b64uDecodeStr(s) { return Buffer.from(s, "base64url").toString("utf8"); }

package/lib/auth/saml.js

@@ -842,7 +842,7 @@ function create(opts) {
       "</md:EntityDescriptor>";
   }
 
-  // ---- v0.10.16 — Single Logout (RFC SAML Bindings §3.4 HTTP-Redirect) ----
+  // ---- Single Logout (RFC SAML Bindings §3.4 HTTP-Redirect) ----
 
   /**
    * @primitive b.auth.saml.sp.buildLogoutRequest
@@ -1250,7 +1250,7 @@ function create(opts) {
     };
   }
 
-  // ---- v0.10.16 — SLO HTTP-POST binding (SAML Bindings §3.5) ----
+  // ---- SLO HTTP-POST binding (SAML Bindings §3.5) ----
 
   /**
    * @primitive b.auth.saml.sp.buildLogoutRequestPost
@@ -1524,7 +1524,7 @@ function create(opts) {
   };
 }
 
-// ---- v0.10.16 — SAML EncryptedAssertion decrypt (XMLEnc) ----
+// ---- SAML EncryptedAssertion decrypt (XMLEnc) ----
 
 // XMLEnc Algorithm URIs we support.
 //
@@ -1722,7 +1722,7 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
   return clearBytes.toString("utf8");
 }
 
-// ---- v0.10.16 — SAML SLO XMLDSig-Enveloped (HTTP-POST/SOAP) ----
+// ---- SAML SLO XMLDSig-Enveloped (HTTP-POST/SOAP) ----
 
 // PQC SignatureMethod URIs used by the embedded XMLDSig signatures.
 // Standard XMLDSig vocabulary classical signing URIs (W3C XMLDSig
@@ -1936,7 +1936,7 @@ function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLoc
   }
 }
 
-// ---- v0.10.16 SAML SLO signature-alg dispatch ----
+// ---- SAML SLO signature-alg dispatch ----
 
 function _sigAlgUrn(alg) {
   // PQC signers — framework-private experimental URIs. The `urn:`

package/lib/backup/index.js

@@ -1015,7 +1015,7 @@ module.exports = {
   BUNDLE_ID_RE:              BUNDLE_ID_RE,
 };
 
-// ---- v0.12.7: bundleAdapterStorage ---------------------------------------
+// ---- bundleAdapterStorage ---------------------------------------
 
 /**
  * @primitive b.backup.bundleAdapterStorage
@@ -2257,7 +2257,7 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
   };
 };
 
-// ---- v0.12.13: objectStoreAdapter ----------------------------------------
+// ---- objectStoreAdapter ----------------------------------------
 
 /**
  * @primitive b.backup.bundleAdapterStorage.objectStoreAdapter
@@ -2475,7 +2475,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
   };
 };
 
-// ---- v0.12.8: migrate ----------------------------------------------------
+// ---- migrate ----------------------------------------------------
 
 /**
  * @primitive b.backup.migrate

package/lib/breach-deadline.js

@@ -48,8 +48,8 @@ var STATE_DEADLINES = Object.freeze({
   // Each entry: { days, statute, asapCeilingDays }
   // Days = statutory hard deadline in days. asapCeilingDays = the
   // operator-defensible ceiling for "without unreasonable delay" states.
-  AL: { days: 45,  statute: "Ala. Code §8-38-5" }, /* allow:raw-time-literal — statutory deadline days */
-  AK: { days: 45,  statute: "Alaska Stat. §45.48.010" }, /* allow:raw-time-literal — statutory deadline days */
+  AL: { days: 45,  statute: "Ala. Code §8-38-5" },
+  AK: { days: 45,  statute: "Alaska Stat. §45.48.010" },
   AZ: { days: 45,  statute: "Ariz. Rev. Stat. §18-552" }, /* allow:raw-time-literal — statutory deadline days */
   AR: { days: 45,  statute: "Ark. Code §4-110-105" }, /* allow:raw-time-literal — statutory deadline days */
   CA: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Cal. Civ. Code §1798.82", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
@@ -67,7 +67,7 @@ var STATE_DEADLINES = Object.freeze({
   KS: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Kan. Stat. §50-7a02", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
   KY: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Ky. Rev. Stat. §365.732", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
   LA: { days: 60,  statute: "La. Rev. Stat. §51:3074" }, /* allow:raw-time-literal — statutory deadline days */
-  ME: { days: 30,  statute: "Me. Rev. Stat. tit. 10 §1348" }, /* allow:raw-time-literal — statutory deadline days */
+  ME: { days: 30,  statute: "Me. Rev. Stat. tit. 10 §1348" },
   MD: { days: 45,  statute: "Md. Code Com. Law §14-3504" }, /* allow:raw-time-literal — statutory deadline days */
   MA: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Mass. Gen. Laws ch. 93H §3", asapCeilingDays: 30 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
   MI: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Mich. Comp. Laws §445.72", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */

package/lib/calendar.js

@@ -697,7 +697,7 @@ function _expandSingleRule(rule, startMs, ctx) {
   }
   var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // RFC 5545 hour range
   var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // RFC 5545 minute range
-  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-time-literal — second-of-minute bound, not a duration
+  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-time-literal — second-of-minute upper bound (0..60); coincidental multiple-of-60, not a duration, C.TIME N/A
 
   function _isoWeekParts(d) {
     // ISO 8601 week-of-year + week-year. The week-YEAR can differ
@@ -709,7 +709,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // ISO week-year anchor (Thursday)
     var weekYear = tmp.getUTCFullYear();
     var yearStart = new Date(Date.UTC(weekYear, 0, 1));
-    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week
+    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);
     return { week: week, year: weekYear };
   }
   function _isoWeekOf(d) {

package/lib/compliance-ai-act.js

@@ -538,8 +538,8 @@ function deployerChecklist(assessment) {
 }
 
 /**
- * @primitive b.complianceAiAct.fundamentalRightsImpactAssessment
- * @signature b.complianceAiAct.fundamentalRightsImpactAssessment(opts)
+ * @primitive b.compliance.aiAct.fundamentalRightsImpactAssessment
+ * @signature b.compliance.aiAct.fundamentalRightsImpactAssessment(opts)
  * @since     0.8.77
  *
  * EU AI Act Article 27 — Fundamental Rights Impact Assessment (FRIA).
@@ -569,7 +569,7 @@ function deployerChecklist(assessment) {
  *   }
  *
  * @example
- *   var fria = b.complianceAiAct.fundamentalRightsImpactAssessment({
+ *   var fria = b.compliance.aiAct.fundamentalRightsImpactAssessment({
  *     systemId: "credit-scoring-v3",
  *     deploymentContext: { purpose: "loan approval", sector: "financial",
  *                          geography: "EU", scale: "1M decisions/year" },
@@ -603,13 +603,13 @@ function fundamentalRightsImpactAssessment(opts) {
     notificationStatus:   "operator-must-notify",
     note:                 "Notify national market-surveillance authority before first use (Art 27(3))",
     auditHook:            "b.audit emission action='aiact.fria.completed' recommended",
-    annexIVReference:     "see b.complianceAiAct.annexIVScaffold for technical documentation",
+    annexIVReference:     "see b.compliance.aiAct.annexIVScaffold for technical documentation",
   };
 }
 
 /**
- * @primitive b.complianceAiAct.gpai.trainingDataSummary
- * @signature b.complianceAiAct.gpai.trainingDataSummary(opts)
+ * @primitive b.compliance.aiAct.gpai.trainingDataSummary
+ * @signature b.compliance.aiAct.gpai.trainingDataSummary(opts)
  * @since     0.8.77
  *
  * EU AI Act Article 53(1)(d) — GPAI training-data summary template
@@ -634,7 +634,7 @@ function fundamentalRightsImpactAssessment(opts) {
  *   contentProvenance: object,    // { synthIdEmbed, c2paManifestEmbed, watermarkProvider }
  *
  * @example
- *   var summary = b.complianceAiAct.gpai.trainingDataSummary({
+ *   var summary = b.compliance.aiAct.gpai.trainingDataSummary({
  *     modelId:        "acme-llm-7b",
  *     modelVersion:   "1.0",
  *     provider:       { name: "Acme AI", address: "1 St", contact: "ai@acme.example" },

package/lib/compliance.js

@@ -107,12 +107,12 @@ var KNOWN_POSTURES = Object.freeze([
   "bsi-c5",          // Germany BSI C5
   "ens-es",          // Spain Esquema Nacional de Seguridad
   "uk-g-cloud",      // UK G-Cloud
-  // ---- v0.8.70 expansion — 2026 effective deadlines ----
+  // ---- 2026 effective deadlines ----
   "modpa",           // Maryland Online Data Privacy Act (effective 2025-10-01) — strict data-min
   "nydfs-500",       // NYDFS 23 NYCRR 500 Amendment 2 — financial cybersecurity (multi-factor + asset inventory + governance)
   "hipaa-2026",      // HHS HIPAA Security Rule 2026-Q4 final — extends hipaa with mandatory MFA + asset inventory + 72h restoration testing
   "quebec-25",       // Quebec Law 25 final phase (effective 2026-09-22) — DPIA + automated-decision opt-out
-  // ---- v0.8.77 expansion — US state consumer-privacy postures ----
+  // ---- US state consumer-privacy postures ----
   // Each posture carries per-state cure-period, profiling opt-out
   // and minor-consent metadata via b.dsr.stateRules(state). The
   // generic DSR primitive (b.dsr.submit) covers ~80% of the surface;
@@ -139,7 +139,7 @@ var KNOWN_POSTURES = Object.freeze([
   "ct-sb3",          // Connecticut SB 3 Consumer Health Data
   "tx-cubi",         // Texas Capture or Use of Biometric Identifier
   "fl-fdbr",         // Florida Digital Bill of Rights (SB 262, effective 2024-07-01) — narrow scope ($1B+ revenue threshold)
-  // ---- v0.8.81 expansion — AI-governance postures ----
+  // ---- AI-governance postures ----
   // State + sectoral AI regulations crystallizing through 2026. Each
   // posture is a flag that operators pin alongside their base
   // privacy/sectoral posture; the floors enforce audit-chain signing
@@ -153,20 +153,20 @@ var KNOWN_POSTURES = Object.freeze([
   "ca-tfaia",        // California SB 53 — Transparency in Frontier AI Act (effective 2026-01-01)
   "kr-ai-basic",     // South Korea AI Basic Act (effective 2026-01-22)
   "cn-ai-label",     // China Measures for Labelling of AI-Generated Content (effective 2025-09-01)
-  // ---- v0.8.81 expansion — AI management cross-walks ----
+  // ---- AI management cross-walks ----
   "iso-42001",       // ISO/IEC 42001:2023 — AI Management System
   "iso-23894",       // ISO/IEC 23894:2023 — AI Risk Management Guidance
-  // ---- v0.8.81 expansion — content-credentials posture flags ----
+  // ---- content-credentials posture flags ----
   "ca-sb942",        // California SB-942 (Cal. Bus. & Prof. Code §22757) gen-AI disclosure (effective 2026-08-02)             // regulatory identifier + date, not bytes
   "ca-ab853",        // California AB-853 platform-side gen-AI detection (effective 2026-08-02)                                // regulatory identifier + date, not bytes
-  // ---- v0.8.81 expansion — substrate-to-posture cleanup ----
+  // ---- substrate-to-posture cleanup ----
   "eaa",             // EU Accessibility Act / Directive (EU) 2019/882 (effective 2025-06-28)
   "wcag-2-2",        // W3C Web Content Accessibility Guidelines 2.2 (Oct 2023 Recommendation)
   "eu-data-act",     // EU Data Act / Regulation (EU) 2023/2854 (effective 2025-09-12)
   "hitech",          // Health Information Technology for Economic and Clinical Health Act (2009)
   "ferpa",           // Family Educational Rights and Privacy Act (20 U.S.C. §1232g)
   "dpdp",            // India Digital Personal Data Protection Act 2023 (rules-pending; cascade tier exists)
-  // ---- v0.8.82 expansion — privacy 2026 sweep ----
+  // ---- privacy 2026 sweep ----
   // US federal child / financial privacy
   "coppa",           // Children's Online Privacy Protection Act (15 U.S.C. §6501)
   "coppa-2025",      // COPPA 2025 Amendment (FTC final 2025-04-22; effective 2026-06-23 — biometric expansion + knowing-collection disclosure)
@@ -203,7 +203,7 @@ var KNOWN_POSTURES = Object.freeze([
   "eu-cer",          // EU Critical Entities Resilience Directive (2022/2557; transposition 2024-10-17)
   "eu-cyber-sol",    // EU Cyber Solidarity Act (Regulation 2025/38; effective 2025-02-04)
   "eidas-2",         // eIDAS 2 / EUDI Wallet (Regulation 2024/1183; rollout 2026-2027)
-  // ---- v0.8.86 expansion — sectoral + cybersecurity directives ----
+  // ---- sectoral + cybersecurity directives ----
   "cmmc-2.0",        // US DoD Cybersecurity Maturity Model Certification 2.0 (effective 2025-Q1)
   "cjis-v6",         // FBI Criminal Justice Information Services Security Policy v6.0 (Dec 2024)
   "iso-27001-2022",  // ISO/IEC 27001:2022 — Information Security Management System
@@ -214,7 +214,7 @@ var KNOWN_POSTURES = Object.freeze([
   "nist-800-66-r2",  // NIST SP 800-66 Rev 2 — HIPAA Security Rule implementation guidance                                       // NIST publication number, not bytes
   "ehds",            // EU European Health Data Space (Regulation 2025/327; phased 2027-2029)
   "circia",          // US Cyber Incident Reporting for Critical Infrastructure Act (final rule pending)
-  // ---- v0.9.6 expansion — exceptd framework-control-gap closure ----
+  // ---- exceptd framework-control-gap closure ----
   // Postures added to recognise every framework cited in the
   // exceptd 2026-05-11 framework-control-gaps catalog. Each posture
   // either (a) maps to a framework the operator must audit against,
@@ -248,7 +248,7 @@ var KNOWN_POSTURES = Object.freeze([
   "cwe-top-25-2024",             // CWE Top 25 Most Dangerous Software Weaknesses (2024)
   "cis-controls-v8",             // CIS Controls v8
   "cmmc-2.0-level-2",            // CMMC 2.0 Level 2 (Advanced) — 110 NIST 800-171 Rev 2 controls                                                                                                          // NIST pub number / level, not bytes
-  // ---- v0.9.57 — granular CMMC level distinction ----
+  // ---- granular CMMC level distinction ----
   // CMMC 2.0 maturity levels carry distinct control-mapping
   // expectations: Level 1 = 15 controls (FAR 52.204-21), Level 2 =
   // 110 controls (NIST 800-171 Rev 2), Level 3 = additional NIST
@@ -257,7 +257,7 @@ var KNOWN_POSTURES = Object.freeze([
   // L1/L2/L3 postures are the recommended pin for new deployments.
   "cmmc-2.0-level-1",            // CMMC 2.0 Level 1 (Foundational) — 15 FAR controls; FCI-only data        // regulatory identifier, not bytes
   "cmmc-2.0-level-3",            // CMMC 2.0 Level 3 (Expert) — NIST 800-172 enhanced controls atop L2       // regulatory identifier, not bytes
-  // ---- v0.12.1 — promote POSTURE_DEFAULTS-only entries into the
+  // ---- promote POSTURE_DEFAULTS-only entries into the
   // canonical KNOWN_POSTURES surface so operators can actually
   // `b.compliance.set(...)` them. Each entry had cascade
   // configuration wired but couldn't be pinned because set()'s
@@ -757,7 +757,7 @@ var REGIME_MAP = Object.freeze({
   "ct-sb3":    { name: "Connecticut SB 3 Consumer Health Data",        citation: "Conn. P.A. 23-56 (effective 2023-07-01)", jurisdiction: "US-CT", domain: "health" },
   "tx-cubi":   { name: "Texas Capture or Use of Biometric Identifier", citation: "Tex. Bus. & Com. Code §503.001 (effective 2009-09-01)", jurisdiction: "US-TX", domain: "biometric" },
   "fl-fdbr":   { name: "Florida Digital Bill of Rights",              citation: "Fla. Stat. §501.701 et seq. SB 262 (effective 2024-07-01)", jurisdiction: "US-FL", domain: "privacy" },
-  // ---- v0.8.81 — AI governance ----
+  // ---- AI governance ----
   "co-ai":       { name: "Colorado AI Act",                            citation: "C.R.S. §6-1-1701 et seq. SB24-205 (postponed to 2026-06-30; enforcement stayed)", jurisdiction: "US-CO", domain: "ai-governance" },
   "il-hb3773":   { name: "Illinois HB 3773 — AI in Employment",        citation: "775 ILCS 5 IHRA AI amendment (effective 2026-01-01)", jurisdiction: "US-IL", domain: "ai-governance" },
   "tx-traiga":   { name: "Texas Responsible AI Governance Act",        citation: "Tex. Bus. & Com. Code Ch. 552 HB 149 (effective 2026-01-01)", jurisdiction: "US-TX", domain: "ai-governance" },
@@ -766,20 +766,20 @@ var REGIME_MAP = Object.freeze({
   "ca-tfaia":    { name: "California Transparency in Frontier AI Act",  citation: "Cal. Bus. & Prof. Code §22757.10 et seq. SB 53 (effective 2026-01-01)", jurisdiction: "US-CA", domain: "ai-governance" },
   "kr-ai-basic": { name: "South Korea AI Basic Act",                    citation: "Framework Act on Development of AI (effective 2026-01-22)", jurisdiction: "KR", domain: "ai-governance" },
   "cn-ai-label": { name: "China — Measures for Labelling AI-Generated Content", citation: "CAC + MIIT + Ministry of Public Security + NRTA Order (effective 2025-09-01)", jurisdiction: "CN", domain: "ai-governance" },
-  // ---- v0.8.81 — AI management cross-walks ----
+  // ---- AI management cross-walks ----
   "iso-42001":   { name: "ISO/IEC 42001 — AI Management System",        citation: "ISO/IEC 42001:2023", jurisdiction: "international", domain: "ai-governance" },
   "iso-23894":   { name: "ISO/IEC 23894 — AI Risk Management",          citation: "ISO/IEC 23894:2023", jurisdiction: "international", domain: "ai-governance" },
-  // ---- v0.8.81 — content-credentials posture flags ----
+  // ---- content-credentials posture flags ----
   "ca-sb942":    { name: "California Gen-AI Provenance Disclosure",     citation: "Cal. Bus. & Prof. Code §22757 SB-942 (effective 2026-08-02)", jurisdiction: "US-CA", domain: "content-credentials" },
   "ca-ab853":    { name: "California Platform Gen-AI Detection",        citation: "Cal. Bus. & Prof. Code §22757 AB-853 (effective 2026-08-02)", jurisdiction: "US-CA", domain: "content-credentials" },
-  // ---- v0.8.81 — substrate-to-posture cleanup ----
+  // ---- substrate-to-posture cleanup ----
   "eaa":         { name: "EU Accessibility Act",                        citation: "Directive (EU) 2019/882 (effective 2025-06-28)", jurisdiction: "EU", domain: "accessibility" },
   "wcag-2-2":    { name: "W3C Web Content Accessibility Guidelines 2.2", citation: "W3C Recommendation (Oct 2023)", jurisdiction: "international", domain: "accessibility" },
   "eu-data-act": { name: "EU Data Act",                                 citation: "Regulation (EU) 2023/2854 (effective 2025-09-12)", jurisdiction: "EU", domain: "data-sharing" },
   "hitech":      { name: "Health Information Technology for Economic and Clinical Health Act", citation: "Pub. L. 111-5, Title XIII, Subtitle D (2009)", jurisdiction: "US", domain: "health" },
   "ferpa":       { name: "Family Educational Rights and Privacy Act",   citation: "20 U.S.C. §1232g; 34 CFR Part 99", jurisdiction: "US", domain: "student-records" },
   "dpdp":        { name: "Digital Personal Data Protection Act 2023",   citation: "Act 22 of 2023 (India; rules pending)", jurisdiction: "IN", domain: "privacy" },
-  // ---- v0.8.82 — privacy 2026 sweep ----
+  // ---- privacy 2026 sweep ----
   // US federal
   "coppa":           { name: "Children's Online Privacy Protection Act",         citation: "15 U.S.C. §§6501-6506; 16 CFR Part 312 (effective 2000-04-21)", jurisdiction: "US", domain: "child-privacy" },
   "coppa-2025":      { name: "COPPA 2025 Amendment",                              citation: "FTC final rule (2025-04-22; effective 2026-06-23) — biometric expansion + knowing-collection-13-and-under disclosure", jurisdiction: "US", domain: "child-privacy" },
@@ -815,7 +815,7 @@ var REGIME_MAP = Object.freeze({
   "eu-cer":          { name: "EU Critical Entities Resilience Directive",        citation: "Directive (EU) 2022/2557 (transposition 2024-10-17)", jurisdiction: "EU", domain: "cybersecurity" },
   "eu-cyber-sol":    { name: "EU Cyber Solidarity Act",                          citation: "Regulation (EU) 2025/38 (effective 2025-02-04)", jurisdiction: "EU", domain: "cybersecurity" },
   "eidas-2":         { name: "eIDAS 2 / EUDI Wallet",                            citation: "Regulation (EU) 2024/1183 (rollout 2026-2027)", jurisdiction: "EU", domain: "identity" },
-  // ---- v0.8.86 — sectoral + cybersecurity directives ----
+  // ---- sectoral + cybersecurity directives ----
   "cmmc-2.0":        { name: "Cybersecurity Maturity Model Certification 2.0",   citation: "32 CFR Part 170 (DFARS rule effective 2025-Q1)", jurisdiction: "US", domain: "cybersecurity" },
   "cjis-v6":         { name: "FBI CJIS Security Policy v6.0",                    citation: "CJIS Security Policy v6.0 (effective 2024-12)", jurisdiction: "US", domain: "law-enforcement" },
   "iso-27001-2022":  { name: "ISO/IEC 27001:2022 Information Security Management System", citation: "ISO/IEC 27001:2022", jurisdiction: "international", domain: "cybersecurity" },
@@ -826,7 +826,7 @@ var REGIME_MAP = Object.freeze({
   "nist-800-66-r2":  { name: "NIST SP 800-66 Rev 2 — HIPAA Security Rule Guidance", citation: "NIST SP 800-66 Rev 2 (Feb 2024)", jurisdiction: "US", domain: "health" },
   "ehds":            { name: "European Health Data Space",                        citation: "Regulation (EU) 2025/327 (phased 2027-2029)", jurisdiction: "EU", domain: "health" },
   "circia":          { name: "Cyber Incident Reporting for Critical Infrastructure Act", citation: "6 U.S.C. §681 et seq. (final rule pending)", jurisdiction: "US", domain: "cybersecurity" },
-  // ---- v0.12.1 — REGIME_MAP backfill for KNOWN_POSTURES without
+  // ---- REGIME_MAP backfill for KNOWN_POSTURES without
   // describe() coverage. Each entry resolves `b.compliance.describe
   // (posture)` → { name, citation, jurisdiction, domain } so admin
   // UI / generated audit reports rendering "running under <name>
@@ -870,7 +870,7 @@ var REGIME_MAP = Object.freeze({
   "bsi-c5":          { name: "Germany BSI C5 — Cloud Computing Compliance Catalogue", citation: "BSI Cloud Computing Compliance Criteria Catalogue (C5:2020)", jurisdiction: "DE", domain: "cybersecurity" },
   "ens-es":          { name: "Spain Esquema Nacional de Seguridad",             citation: "Real Decreto 311/2022",                            jurisdiction: "ES", domain: "cybersecurity" },
   "uk-g-cloud":      { name: "UK G-Cloud Framework",                            citation: "UK Crown Commercial Service G-Cloud 14",          jurisdiction: "UK", domain: "cybersecurity" },
-  // ---- v0.9.6 expansion REGIME_MAP backfill (cybersecurity / AI / supply-chain frameworks) ----
+  // ---- REGIME_MAP backfill (cybersecurity / AI / supply-chain frameworks) ----
   "nist-800-53":              { name: "NIST SP 800-53 Rev 5 — Security & Privacy Controls", citation: "NIST SP 800-53 Rev 5",                jurisdiction: "US", domain: "cybersecurity" },
   "nist-ai-rmf-1.0":          { name: "NIST AI Risk Management Framework 1.0",  citation: "NIST AI 100-1 (Jan 2023)",                        jurisdiction: "US", domain: "ai" },
   "iso-42001-2023":           { name: "ISO/IEC 42001:2023 — AI Management System", citation: "ISO/IEC 42001:2023",                          jurisdiction: "international", domain: "ai" },
@@ -1176,7 +1176,7 @@ var POSTURE_DEFAULTS = Object.freeze({
   "nist-800-66-r2":  Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   "ehds":            Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   "circia":          Object.freeze({ backupEncryptionRequired: false, auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: false }),
-  // ---- v0.9.6 — exceptd framework-control-gap closure cascade ----
+  // ---- exceptd framework-control-gap closure cascade ----
   "nist-800-53":             Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   // NIST AI-RMF MANAGE.4.3 / ISO 23894 §6.5 / ISO 42001
   // §A.6 require encrypted backups for AI system state (model
@@ -1242,7 +1242,7 @@ var POSTURE_DEFAULTS = Object.freeze({
   "cmmc-2.0-level-1":        Object.freeze({ backupEncryptionRequired: false, auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: false }),
   "cmmc-2.0-level-2":        Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   "cmmc-2.0-level-3":        Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true, fipsMode: false }),
-  // ---- v0.10.16 — sectoral catch-up ----
+  // ---- sectoral catch-up ----
   // 42 CFR Part 2 — Substance Use Disorder records confidentiality
   // (HHS final rule 2024-04-16 aligns Part 2 with HIPAA but retains
   // a stricter consent floor; encrypted backups + signed audit chain

package/lib/content-credentials.js

@@ -492,7 +492,7 @@ function signCose(manifest, opts) {
     }
     unprotectedHdr = Buffer.concat([
       _cborMapHeader(1),
-      _cborInt(33),             // allow:raw-time-literal — RFC 9360 x5chain header label, not a duration
+      _cborInt(33),             // allow:raw-time-literal — RFC 9360 x5chain COSE header label; coincidental multiple-of-60, not a duration, C.TIME N/A
       chainArray,
     ]);
   } else {
@@ -590,7 +590,7 @@ var CAC_KIND_ENUM = Object.freeze({
   text: true, image: true, audio: true, video: true,
   "virtual-scene": true, other: true,
 });
-var CAC_USCC_RE = /^[0-9A-HJ-NPQRTUWXY]{18}$/;                                                  // allow:raw-time-literal — 18 is char-count of the credit code, not seconds
+var CAC_USCC_RE = /^[0-9A-HJ-NPQRTUWXY]{18}$/;
 var ISO8601_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
 
 function cacImplicitLabel(opts) {
@@ -605,7 +605,7 @@ function cacImplicitLabel(opts) {
     throw new ContentCredentialsError("cac-implicit-label/oversize-provider-name",
       "cacImplicitLabel: providerName exceeds " + STR_LEN_MAX + " bytes (UTF-8)");
   }
-  if (typeof opts.providerCode !== "string" || opts.providerCode.length !== 18 ||                // allow:raw-time-literal — string length, not seconds
+  if (typeof opts.providerCode !== "string" || opts.providerCode.length !== 18 ||
       !CAC_USCC_RE.test(opts.providerCode)) {                                                    // allow:regex-no-length-cap — length-bounded immediately above
     throw new ContentCredentialsError("cac-implicit-label/bad-provider-code",
       "cacImplicitLabel: providerCode must be an 18-char unified social credit code " +

package/lib/ddl-change-control.js

@@ -132,7 +132,7 @@ function _parseHHMM(s) {
     throw new DdlChangeControlError("ddl-change-control/bad-window",
       "windowSpec time out of range - got " + s);
   }
-  return hh * 60 + mm; // allow:raw-time-literal — converting HH:MM to minute-of-day, not "60 seconds"
+  return hh * 60 + mm; // allow:raw-time-literal — HH*60+MM minute-of-day conversion; coincidental multiple-of-60 factor, not a duration, C.TIME N/A
 }
 
 function _isInWindow(window, nowMs) {
@@ -141,7 +141,7 @@ function _isInWindow(window, nowMs) {
   var d = new Date(nowMs);
   var dayIdx = d.getUTCDay();
   if (!window.days.has(dayIdx)) return false;
-  var min = d.getUTCHours() * 60 + d.getUTCMinutes(); // allow:raw-time-literal — converting HH:MM to minute-of-day, not "60 seconds"
+  var min = d.getUTCHours() * 60 + d.getUTCMinutes(); // allow:raw-time-literal — HH*60+MM minute-of-day conversion; coincidental multiple-of-60 factor, not a duration, C.TIME N/A
   return min >= window.startMin && min < window.endMin;
 }
 

package/lib/did.js

@@ -65,7 +65,7 @@ var MAX_JWK_B64_CHARS = 8192;                          // bounded did:jwk encode
 // keyLen is the multicodec payload: Ed25519 raw 32; EC compressed point.
 var MULTICODEC = {
   0xed:   { name: "Ed25519",   kind: "okp" },                                    // ed25519-pub
-  0x1200: { name: "P-256",     kind: "ec", curveOid: "1.2.840.10045.3.1.7" },    // allow:raw-time-literal — p256-pub multicodec code + OID dotted-form
+  0x1200: { name: "P-256",     kind: "ec", curveOid: "1.2.840.10045.3.1.7" },
   0x1201: { name: "P-384",     kind: "ec", curveOid: "1.3.132.0.34" },           // p384-pub multicodec code
   0xe7:   { name: "secp256k1", kind: "ec", curveOid: "1.3.132.0.10" },           // secp256k1-pub
 };
@@ -159,7 +159,7 @@ function _keyObjectFromMulticodec(code, keyBytes) {
 
 // AlgorithmIdentifier SEQUENCE { id-ecPublicKey, namedCurve OID }.
 function _ecAlgId(curveOid) {
-  var idEcPublicKey = Buffer.from("06072a8648ce3d0201", "hex");            // allow:raw-time-literal — DER OID for id-ecPublicKey
+  var idEcPublicKey = Buffer.from("06072a8648ce3d0201", "hex");
   var curve = _oidDer(curveOid);
   var inner = Buffer.concat([idEcPublicKey, curve]);
   return Buffer.concat([Buffer.from([0x30, inner.length]), inner]);

package/lib/dsr.js

@@ -1078,7 +1078,7 @@ function dbTicketStore(opts) {
   };
 }
 
-// ---- v0.8.77 — US state-law DSR drift registry -------------------
+// ---- US state-law DSR drift registry -------------------
 //
 // Each US state consumer-privacy law expresses the same DSR core
 // (access / deletion / correction / portability) but with per-state
@@ -1094,7 +1094,7 @@ function dbTicketStore(opts) {
 
 // State DSR rule table — `responseDays` / `extensionDays` / `cureDays`
 // are integer day-counts from per-state statutes (not durations in
-// seconds/ms). allow:raw-time-literal — statute-defined day counts.
+// seconds/ms).
 var STATE_RULES = Object.freeze({
   "vcdpa":     { posture: "vcdpa",     state: "VA", responseDays: 45, extensionDays: 45, cureDays: 30,  profilingOptOut: true,  minorOptIn: 13,  notes: "Cure right sunset 2025-01-01" },                                                                          // allow:raw-time-literal
   "co-cpa":    { posture: "co-cpa",    state: "CO", responseDays: 45, extensionDays: 45, cureDays: 60,  profilingOptOut: true,  minorOptIn: 13,  notes: "Cure right sunset 2025-01-01; UOOM (GPC) mandatory" },                                                    // allow:raw-time-literal
@@ -1110,7 +1110,7 @@ var STATE_RULES = Object.freeze({
   "nj-njdpa":  { posture: "nj-njdpa",  state: "NJ", responseDays: 45, extensionDays: 45, cureDays: 30,  profilingOptOut: true,  minorOptIn: 17,  notes: "Under-17 opt-in default" },                                                                                // allow:raw-time-literal
   "ky-kcdpa":  { posture: "ky-kcdpa",  state: "KY", responseDays: 45, extensionDays: 45, cureDays: 30,  profilingOptOut: true,  minorOptIn: 13,  notes: "Effective 2026-01-01" },                                                                                  // allow:raw-time-literal
   "tn-tipa":   { posture: "tn-tipa",   state: "TN", responseDays: 45, extensionDays: 45, cureDays: 60,  profilingOptOut: true,  minorOptIn: 13,  notes: "NIST CSF safe-harbor available" },                                                                        // allow:raw-time-literal
-  "mn-mncdpa": { posture: "mn-mncdpa", state: "MN", responseDays: 45, extensionDays: 45, cureDays: 30,  profilingOptOut: true,  minorOptIn: 13,  notes: "Effective 2026-07-31; profiling opt-out for consequential decisions" },                                   // allow:raw-time-literal
+  "mn-mncdpa": { posture: "mn-mncdpa", state: "MN", responseDays: 45, extensionDays: 45, cureDays: 30,  profilingOptOut: true,  minorOptIn: 13,  notes: "Effective 2026-07-31; profiling opt-out for consequential decisions" },
   "ri-ricpa":  { posture: "ri-ricpa",  state: "RI", responseDays: 45, extensionDays: 45, cureDays: 0,   profilingOptOut: true,  minorOptIn: 13,  notes: "Effective 2026-01-01; no cure period" },                                                                  // allow:raw-time-literal
   "ne-dpa":    { posture: "ne-dpa",    state: "NE", responseDays: 45, extensionDays: 45, cureDays: 30,  profilingOptOut: true,  minorOptIn: 13,  notes: "Effective 2025-01-01" },                                                                                  // allow:raw-time-literal
   "nv-sb370":  { posture: "nv-sb370",  state: "NV", responseDays: 60, extensionDays: 30, cureDays: 0,   profilingOptOut: false, minorOptIn: null, notes: "Consumer-health data only" },                                                                            // allow:raw-time-literal
@@ -1118,8 +1118,8 @@ var STATE_RULES = Object.freeze({
   "ct-sb3":    { posture: "ct-sb3",    state: "CT", responseDays: 45, extensionDays: 45, cureDays: 60,  profilingOptOut: false, minorOptIn: null, notes: "Consumer-health data only" },                                                                            // allow:raw-time-literal
   "tx-cubi":   { posture: "tx-cubi",   state: "TX", responseDays: 0,  extensionDays: 0,  cureDays: 0,   profilingOptOut: false, minorOptIn: null, notes: "Biometric-only; private-right-of-action absent" },                                                       // allow:raw-time-literal
   "modpa":     { posture: "modpa",     state: "MD", responseDays: 45, extensionDays: 45, cureDays: 60,  profilingOptOut: true,  minorOptIn: 13,  notes: "Strict data-minimization; effective 2026-10-01" },                                                       // allow:raw-time-literal
-  "quebec-25": { posture: "quebec-25", state: "QC", responseDays: 30, extensionDays: 30, cureDays: 0,   profilingOptOut: true,  minorOptIn: 14,  notes: "DPIA + automated-decision opt-out; FR-language obligations" },                                            // allow:raw-time-literal
-  "fl-fdbr":   { posture: "fl-fdbr",   state: "FL", responseDays: 45, extensionDays: 15, cureDays: 30,  profilingOptOut: true,  minorOptIn: 13,  notes: "Narrow scope ($1B+ revenue threshold); effective 2024-07-01; AG-only enforcement" },                       // allow:raw-time-literal
+  "quebec-25": { posture: "quebec-25", state: "QC", responseDays: 30, extensionDays: 30, cureDays: 0,   profilingOptOut: true,  minorOptIn: 14,  notes: "DPIA + automated-decision opt-out; FR-language obligations" },
+  "fl-fdbr":   { posture: "fl-fdbr",   state: "FL", responseDays: 45, extensionDays: 15, cureDays: 30,  profilingOptOut: true,  minorOptIn: 13,  notes: "Narrow scope ($1B+ revenue threshold); effective 2024-07-01; AG-only enforcement" },
 });
 
 /**

package/lib/external-db.js

@@ -803,7 +803,7 @@ async function transaction(fn, opts) {
             _emitMetric("externaldb.transaction.retry", 1,
               { backend: b.name, code: txErr.code, attempt: String(attempt) });
             var jitter = bCrypto.randomInt(0, 6);                                // 0-5ms jitter
-            await safeAsync.sleep(attempt * 5 + jitter);                           // allow:raw-time-literal — sub-second backoff
+            await safeAsync.sleep(attempt * 5 + jitter);
             continue;
           }
           var failureMs = Date.now() - t0;

package/lib/guard-archive.js

@@ -905,7 +905,7 @@ module.exports = {
   tarEntryPolicy:      tarEntryPolicy,
 };
 
-// ---- v0.12.7 extensions ---------------------------------------------------
+// ---- extensions ---------------------------------------------------
 
 /**
  * @primitive b.guardArchive.inspect

package/lib/guard-cidr.js

@@ -73,7 +73,7 @@ var IPV4_RESERVED = Object.freeze([
   { net: _ipv4ToUint32([127, 0, 0, 0]),      prefix: 8,  label: "loopback" },                    // IPv4 octets
   { net: _ipv4ToUint32([169, 254, 0, 0]),    prefix: 16, label: "link-local" },                  // IPv4 octets
   { net: _ipv4ToUint32([224, 0, 0, 0]),      prefix: 4,  label: "multicast" },                   // IPv4 octets
-  { net: _ipv4ToUint32([240, 0, 0, 0]),      prefix: 4,  label: "reserved-class-e" },            // allow:raw-time-literal — 240 is an IPv4 octet not seconds
+  { net: _ipv4ToUint32([240, 0, 0, 0]),      prefix: 4,  label: "reserved-class-e" },            // allow:raw-time-literal — IPv4 octet 240; coincidental multiple-of-60, not a duration, C.TIME N/A
   { net: _ipv4ToUint32([192, 0, 2, 0]),      prefix: 24, label: "documentation-test-net-1" },    // IPv4 octets
   { net: _ipv4ToUint32([198, 51, 100, 0]),   prefix: 24, label: "documentation-test-net-2" },    // IPv4 octets
   { net: _ipv4ToUint32([203, 0, 113, 0]),    prefix: 24, label: "documentation-test-net-3" },    // IPv4 octets

package/lib/guard-image.js

@@ -111,7 +111,7 @@ var PROFILES = Object.freeze({
     framesPolicy:              "reject",
     maxWidth:                  C.BYTES.bytes(8192),                              // pixel cap, repurposing bytes() for clarity
     maxHeight:                 C.BYTES.bytes(8192),
-    maxFrames:                 60,                                               // allow:raw-time-literal — animation frame count, not seconds
+    maxFrames:                 60,                                               // allow:raw-time-literal — max-frame count 60; coincidental multiple-of-60, not a duration, C.TIME N/A
     maxBytes:                  C.BYTES.mib(32),
     maxRuntimeMs:              C.TIME.seconds(5),
   },

package/lib/guard-list-unsubscribe.js

@@ -371,7 +371,7 @@ function _hasControlChar(s) {
 
 function _trunc(s) {
   if (s.length <= 64) return s;                                                                          // error-message truncation
-  return s.slice(0, 60) + "…";                                                                          // allow:raw-time-literal — char count for error-message truncation, not seconds
+  return s.slice(0, 60) + "…";                                                                          // allow:raw-time-literal — truncation char-count 60; coincidental multiple-of-60, not a duration, C.TIME N/A
 }
 
 function _verdict(action, reason, extra) {

package/lib/guard-time.js

@@ -254,7 +254,7 @@ function _detectIssues(input, opts) {
       snippet: "minute " + minute + " > 59",
     });
   }
-  if (second > 60) {                                                             // allow:raw-time-literal — leap-second ceiling, RFC 3339 §5.6 (not seconds-of-time)
+  if (second > 60) {                                                             // allow:raw-time-literal — leap-second ceiling literal 60 (RFC 3339 5.6); coincidental multiple-of-60, not a duration, C.TIME N/A
     issues.push({
       kind: "second-range", severity: "high",
       ruleId: "time.second-range",

package/lib/guard-xml.js

@@ -303,7 +303,7 @@ function _detectIssues(input, opts) {
   // get the NCR cap disabled with them. The `maxNumericCharRefs` opt
   // is validated by `numericBounds.requireAllPositiveFiniteIntIfPresent`
   // at the public-surface boundary above.
-  var ncrCap = opts.maxNumericCharRefs;                                          // allow:numeric-opt-no-bounds-check — validated at public boundary
+  var ncrCap = opts.maxNumericCharRefs;
   if (ncrCap !== undefined && ncrCap !== null) {
     var ncrMatches = input.match(NUMERIC_CHAR_REF_RE);                           // allow:regex-no-length-cap — input bounded by maxBytes above
     var ncrCount = ncrMatches === null ? 0 : ncrMatches.length;

package/lib/http-client-cache.js

@@ -66,7 +66,7 @@ var HEURISTIC_MAX_AGE_MS = C.TIME.hours(24);
 // Statuses RFC 9110 designates as heuristically cacheable. (Plus 200/206
 // which are universally cacheable when a freshness lifetime is given.)
 var CACHEABLE_STATUSES = new Set([
-  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-time-literal — same line, status codes not seconds
+  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-time-literal — RFC 9111 cacheable status-code set; coincidental multiple-of-60 entries, not durations, C.TIME N/A
 ]);
 
 // Headers that MUST not be forwarded when serving a 304-updated entry.

package/lib/iab-tcf.js

@@ -108,7 +108,7 @@ var TCF_V23_POLICY_VERSION = 4;
 var SEGMENT_TYPE_DISCLOSED_VENDORS = 1;                                                        // TCF segment-type marker, not bytes
 var SEGMENT_TYPE_ALLOWED_VENDORS   = 2;                                                        // TCF segment-type marker, not bytes
 var SEGMENT_TYPE_PUBLISHER_TC      = 3;                                                        // TCF segment-type marker, not bytes
-var MAX_TC_STRING_BYTES = 64 * 1024;                                                           // allow:raw-byte-literal — request-payload cap
+var MAX_TC_STRING_BYTES = 64 * 1024;
 
 // base64url decode (no padding) → Buffer.
 function _b64urlDecode(s) {
@@ -186,8 +186,8 @@ function _parseCore(buf) {
   var publisherRestrictions = _parsePublisherRestrictions(r);
   return {
     version:               version,
-    createdAt:             createdRaw * 100,                                                   // allow:raw-time-literal — TCF spec deciseconds → ms
-    lastUpdatedAt:         lastUpdatedRaw * 100,                                               // allow:raw-time-literal — TCF spec deciseconds → ms
+    createdAt:             createdRaw * 100,
+    lastUpdatedAt:         lastUpdatedRaw * 100,
     cmpId:                 cmpId,
     cmpVersion:            cmpVersion,
     consentScreen:         consentScreen,
@@ -545,7 +545,7 @@ function _idRuns(ids) {
 function _decisec(t) {
   var ms = t instanceof Date ? t.getTime() : (t == null ? Date.now() : Number(t));
   if (!isFinite(ms) || ms < 0) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: timestamp must be a Date or non-negative epoch-ms");
-  return Math.round(ms / 100);                                                                  // allow:raw-time-literal — ms → TCF deciseconds
+  return Math.round(ms / 100);
 }
 
 // Bit writer mirroring _bitReader: bits are packed high-bit-first, then the

package/lib/json-schema.js

@@ -487,7 +487,7 @@ function _typeMatches(typeKw, instance, actual) {
 function _checkNumber(schema, n, emit) {
   if (typeof schema.multipleOf === "number") {
     var q = n / schema.multipleOf;
-    if (!isFinite(q) || Math.abs(q - Math.round(q)) > 1e-9 * Math.max(1, Math.abs(q))) {   // allow:raw-time-literal — float tolerance for multipleOf
+    if (!isFinite(q) || Math.abs(q - Math.round(q)) > 1e-9 * Math.max(1, Math.abs(q))) {
       // Exact check for integers; tolerance only bridges float error.
       if (n % schema.multipleOf !== 0) emit("multipleOf", "value is not a multiple of " + schema.multipleOf);
     }

package/lib/jtd.js

@@ -33,7 +33,7 @@ var rfc3339 = require("./rfc3339");
 
 var JtdError = defineClass("JtdError", { alwaysPermanent: true });
 
-var MAX_DEPTH = 10000;                                       // allow:raw-time-literal — recursion cap for self-referential refs
+var MAX_DEPTH = 10000;
 
 var TYPES = {
   boolean: 1, string: 1, timestamp: 1, float32: 1, float64: 1,

package/lib/mail-auth.js

@@ -1819,7 +1819,7 @@ function authResultsEmit(opts) {
 //   //   }
 
 var DMARC_RUA_MAX_REPORT_BYTES = C.BYTES.mib(8);
-var DMARC_RUA_MAX_RECORDS_PER_REPORT = 10000;                                     // allow:raw-time-literal — record cap, not seconds
+var DMARC_RUA_MAX_RECORDS_PER_REPORT = 10000;
 
 function _arrayOf(value) {
   if (value === undefined || value === null) return [];

package/lib/mail-bimi.js

@@ -444,7 +444,7 @@ function validateTinyPsSvg(svgBytes) {
         if (lname === "href" || lname === "xlink:href") {
           if (aval.length > 0 && aval.charAt(0) !== "#") {
             _vio("external-ref-forbidden",
-              "external reference in `" + aname + "='" + aval.slice(0, 60) /* allow:raw-time-literal — display truncation chars, not seconds */ + "...'` " +
+              "external reference in `" + aname + "='" + aval.slice(0, 60) /* allow:raw-time-literal — display truncation char-count 60; coincidental multiple-of-60, not a duration, C.TIME N/A */ + "...'` " +
               "is forbidden in Tiny-PS (only `#fragment` permitted)");
           }
         }

package/lib/mail-crypto-pgp.js

@@ -928,7 +928,7 @@ function _audit(auditHandle, action, outcome, metadata) {
   } catch (_e) { /* drop-silent — audit failures must not crash callers */ }
 }
 
-// ---- v0.10.16 experimental encrypt/decrypt + WKD ----
+// ---- experimental encrypt/decrypt + WKD ----
 //
 // PQC PGP encrypt/decrypt for ML-KEM-1024 recipients shipped under
 // `experimental` namespace (RFC 9580bis PKESK ML-KEM codepoints

package/lib/mail-crypto-smime.js

@@ -754,7 +754,7 @@ function checkCert(opts) {
   if (pub && pub.asymmetricKeyType === "rsa") {
     var jwk = pub.export({ format: "jwk" });
     var nBytes = Buffer.from(jwk.n, "base64url");
-    var bits = nBytes.length * 8;                                                                     // allow:raw-time-literal — RFC 5280 in comment, not seconds
+    var bits = nBytes.length * 8;                                                                     // allow:raw-time-literal — byte-length*8 bit count; coincidental multiple-of-60 product, not a duration, C.TIME N/A
     if (bits < RSA_MIN_BITS) {
       throw new MailCryptoError("mail-crypto/smime/rsa-too-small",
         "cert public key is " + bits + " RSA bits; minimum is " + RSA_MIN_BITS +

package/lib/mail-server-mx.js

@@ -998,7 +998,7 @@ function create(opts) {
     });
     var deadline = Date.now() + timeoutMs;
     while (connections.size > 0 && Date.now() < deadline) {
-      await safeAsync.sleep(100);                                                                    // allow:raw-time-literal — close-drain poll interval (sub-second; operator-bounded by timeoutMs)
+      await safeAsync.sleep(100);
     }
     connections.forEach(function (sock) {
       try { sock.destroy(); } catch (_e) { /* best-effort */ }

package/lib/mail-server-rate-limit.js

@@ -96,7 +96,7 @@ var MailServerRateLimitError = defineClass("MailServerRateLimitError", { alwaysP
 
 var DEFAULTS = Object.freeze({
   maxConcurrentConnectionsPerIp: 10,
-  connectionsPerIpPerMinute:     60,                                                                  // allow:raw-time-literal — connection count, not a time value
+  connectionsPerIpPerMinute:     60,                                                                  // allow:raw-time-literal — per-minute connection rate 60; time-derived (per-minute) single source of truth, C.TIME N/A as a count
   authFailuresPerIpPer15Min:     10,
   minBytesPerSecond:             100,                                                                 // slow-loris byte-rate floor
   // RCPT-TO recipient-failure cap defends against the 550-vs-250

package/lib/mail-server-submission.js

@@ -1347,7 +1347,7 @@ function create(opts) {
     });
     var deadline = Date.now() + timeoutMs;
     while (connections.size > 0 && Date.now() < deadline) {
-      await safeAsync.sleep(100);                                                                    // allow:raw-time-literal — sub-second drain poll
+      await safeAsync.sleep(100);
     }
     connections.forEach(function (sock) {
       try { sock.destroy(); } catch (_e) { /* best-effort */ }

package/lib/mcp.js

@@ -45,12 +45,12 @@ var METHOD_NAME_MAX   = 256;
 // JSON-RPC 2.0 error codes (https://www.jsonrpc.org/specification#error_object).
 // Negative numerics by spec; mapped to HTTP status for the framework's
 // HTTP-shaped reply envelope.
-var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST = -32600;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND= -32601;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS  = -32602;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR  = -32603;                                                        // allow:raw-time-literal — not seconds
-var JSONRPC_AUTH_REQUIRED   = -32001;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-time-literal — JSON-RPC error code -32700; coincidental multiple-of-60, not a time value, C.TIME N/A
+var JSONRPC_INVALID_REQUEST = -32600;
+var JSONRPC_METHOD_NOT_FOUND= -32601;
+var JSONRPC_INVALID_PARAMS  = -32602;
+var JSONRPC_INTERNAL_ERROR  = -32603;
+var JSONRPC_AUTH_REQUIRED   = -32001;
 var TOOL_NAME_RE     = /^[a-zA-Z][a-zA-Z0-9._-]{0,63}$/;
 var RESOURCE_NAME_RE = /^[a-zA-Z][a-zA-Z0-9._/-]{0,255}$/;
 
@@ -424,7 +424,7 @@ function serverGuard(opts) {
  *   var safe = b.mcp.toolResult.sanitize(toolResp, { posture: "sanitize" });
  *   // → { content: [{ type: "text", text: "<cleaned>" }] }
  */
-var DEFAULT_TOOL_OUTPUT_MAX_BYTES = 64 * 1024;                                                   // allow:raw-byte-literal — 64 KiB per content block
+var DEFAULT_TOOL_OUTPUT_MAX_BYTES = 64 * 1024;
 var PROMPT_INJECTION_MARKERS = [
   "ignore (previous|prior|all) instructions",
   "system:\\s*you are",

package/lib/mdoc.js

@@ -58,7 +58,7 @@ var { defineClass } = require("./framework-error");
 
 var MdocError = defineClass("MdocError", { alwaysPermanent: true });
 
-var HDR_X5CHAIN = 33;                                  // allow:raw-time-literal — x5chain COSE header label (RFC 9360 is a spec number, not a size/duration)
+var HDR_X5CHAIN = 33;
 var TAG_ENCODED_CBOR = 24;                             // RFC 8949 §3.4.5.1 embedded-CBOR tag
 // Tags ISO 18013-5 uses in issuer data: tdate(0), epoch(1), embedded
 // CBOR(24), full-date(1004, RFC 8943). Bounded — others are refused.

package/lib/metrics.js

@@ -729,7 +729,7 @@ function create(opts) {
           exemplar = {
             labels:    { trace_id: req.span.traceId, span_id: req.span.spanId },
             value:     elapsedSec,
-            timestamp: Date.now() / 1000,                                         // allow:raw-time-literal — OpenMetrics §6.2 unix epoch seconds with subsecond fraction
+            timestamp: Date.now() / 1000,
           };
         } else if (req.trace && req.trace.sampled && req.trace.traceId && req.trace.spanId) {
           // Operators wiring traceparent directly without
@@ -740,7 +740,7 @@ function create(opts) {
           exemplar = {
             labels:    { trace_id: req.trace.traceId, span_id: req.trace.spanId },
             value:     elapsedSec,
-            timestamp: Date.now() / 1000,                                         // allow:raw-time-literal — OpenMetrics §6.2 unix epoch seconds with subsecond fraction
+            timestamp: Date.now() / 1000,
           };
         }
         try { requestDuration.observe(durLabels, elapsedSec, exemplar); }

package/lib/middleware/compose-pipeline.js

@@ -97,7 +97,7 @@ var CANONICAL_POSITIONS = Object.freeze({
   botGuard:      42,                                                                                      // canonical position bucket
   requireAuth:   50,                                                                                      // canonical position bucket
   attachUser:    52,                                                                                      // canonical position bucket
-  handler:       60,                                                                                      // allow:raw-time-literal — pipeline position int, not seconds
+  handler:       60,                                                                                      // allow:raw-time-literal — pipeline position bucket; coincidental multiple-of-60, C.TIME N/A
   errorHandler:  90,                                                                                      // canonical position bucket
 });
 

package/lib/network-dnssec.js

@@ -293,7 +293,7 @@ function verifyRrset(opts) {
   } else {
     atMs = Date.now();
   }
-  var nowSec = Math.floor(atMs / 1000);                       // allow:raw-time-literal — ms→NumericDate seconds (RRSIG inception/expiration are seconds since epoch, RFC 4034 §3.1.5)
+  var nowSec = Math.floor(atMs / 1000);
   if (nowSec < (rrsig.inception >>> 0)) throw new DnssecError("dnssec/not-yet-valid", "dnssec.verifyRrset: RRSIG inception is in the future");
   if (nowSec > (rrsig.expiration >>> 0)) throw new DnssecError("dnssec/expired", "dnssec.verifyRrset: RRSIG has expired");
 
@@ -349,7 +349,7 @@ var BASE32HEX = "0123456789ABCDEFGHIJKLMNOPQRSTUV";          // RFC 4648 §7 ext
 var TYPE_DS = 43;                                            // IANA RR type DS
 var TYPE_CNAME = 5;
 var NSEC3_HASH_SHA1 = 1;                                     // RFC 5155 §5 — the only registered NSEC3 hash
-var DEFAULT_MAX_NSEC3_ITERATIONS = 150;                      // allow:raw-time-literal — DoS ceiling on iterated SHA-1; matches BIND 9.16.33+/Unbound 1.17.1 post-CVE-2023-50868 (RFC 9276 wants 0; deployed zones still use >0)
+var DEFAULT_MAX_NSEC3_ITERATIONS = 150;
 
 // KeyTrap (CVE-2023-50387) amplification caps. A hostile zone can publish
 // many DNSKEYs sharing one 16-bit key tag and many RRSIGs, forcing a

package/lib/network-smtp-policy.js

@@ -716,7 +716,7 @@ async function tlsRptSubmit(report, opts) {
 // tlsRpt.recordShape / tlsRpt.submit on the send side.
 
 var TLS_RPT_MAX_REPORT_BYTES = C.BYTES.mib(8);
-var TLS_RPT_MAX_POLICIES_PER_REPORT = 1024;                                       // allow:raw-time-literal — count cap, not seconds
+var TLS_RPT_MAX_POLICIES_PER_REPORT = 1024;
 
 function tlsRptParseReport(body, opts) {
   opts = opts || {};

package/lib/network-tls.js

@@ -837,7 +837,7 @@ function _parseTime(node) {
   if (s.length === 13 && s.charAt(12) === "Z") {                                 // UTCTime length per X.690
     // UTCTime YYMMDDhhmmssZ — 50+ → 19xx, else 20xx (RFC 5280 §4.1.2.5).
     year  = parseInt(s.slice(0, 2), 10);
-    year += year >= 50 ? 1900 : 2000;                                            // allow:raw-time-literal — RFC 5280 century pivot, calendar years
+    year += year >= 50 ? 1900 : 2000;
     month = parseInt(s.slice(2, 4), 10);
     day   = parseInt(s.slice(4, 6), 10);
     hour  = parseInt(s.slice(6, 8), 10);                                         // UTCTime hour-byte offsets

package/lib/network-tsig.js

@@ -41,7 +41,7 @@ var TsigError = defineClass("TsigError", { alwaysPermanent: true });
 
 var TYPE_TSIG = 250;                                        // IANA RR type TSIG
 var CLASS_ANY = 255;                                        // TSIG RRs use CLASS ANY
-var DEFAULT_FUDGE = 300;                                    // allow:raw-time-literal — RFC 8945 recommended fudge window (seconds)
+var DEFAULT_FUDGE = 300;
 
 // Algorithm name → Node hash. The strong HMAC-SHA-2 family is the safe set;
 // HMAC-MD5 and HMAC-SHA-1 are refused unless allowLegacy (kept only for
@@ -225,7 +225,7 @@ function sign(message, opts) {
   var secret = _secretBuf(opts.secret);
   var fudge = opts.fudge == null ? DEFAULT_FUDGE : opts.fudge;
   if (typeof fudge !== "number" || !isFinite(fudge) || fudge < 0 || fudge > 0xffff) throw new TsigError("tsig/bad-opt", "tsig.sign: fudge must be 0..65535 seconds");   // 16-bit fudge field
-  var time = opts.time == null ? Math.floor(Date.now() / 1000) : opts.time;   // allow:raw-time-literal — ms→s
+  var time = opts.time == null ? Math.floor(Date.now() / 1000) : opts.time;
   if (typeof time !== "number" || !isFinite(time) || time < 0) throw new TsigError("tsig/bad-opt", "tsig.sign: time must be a non-negative Unix-seconds number");
   var error = opts.error == null ? 0 : opts.error;
   var otherData = Buffer.isBuffer(opts.otherData) ? opts.otherData : Buffer.alloc(0);
@@ -379,7 +379,7 @@ function verify(message, opts) {
     macValid = timingSafeEqual(rr.mac, expected.slice(0, rr.mac.length));
   }
 
-  var now = opts.now == null ? Math.floor(Date.now() / 1000) : opts.now;   // allow:raw-time-literal — ms→s
+  var now = opts.now == null ? Math.floor(Date.now() / 1000) : opts.now;
   var timeValid = Math.abs(now - rr.timeSigned) <= rr.fudge;
 
   var reason = null;

package/lib/parsers/index.js

@@ -36,12 +36,6 @@
  *           parsed as `country: false`). Block + flow style;
  *           literal `|` and folded `>` block scalars with chomp
  *           indicators.
- *   env  — .env file loader with size cap + schema validation;
- *           refuses to expand $VAR references; refuses to silently
- *           overwrite existing process.env values unless explicitly
- *           opted in. Dev-tooling — production secrets should still
- *           come through the operator's secrets-management; this is
- *           the local-development convenience.
  *   ini  — INI / .gitconfig / systemd-unit / php.ini / tox.ini parser.
  *           Sections (incl. [parent.child] / [parent "child"] nesting),
  *           ; or # comments (inline + leading), single + double quoting

package/lib/rfc3339.js

@@ -25,11 +25,11 @@ function isValidDateTime(s) {
   if (!m) return false;
   var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
   if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
-  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month (Gregorian)
+  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
   if (d > days[mo - 1]) return false;
   var tz = m[8];
   if (tz !== "Z" && tz !== "z") {
-    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
+    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;
   }
   return true;
 }

package/lib/safe-decompress.js

@@ -105,7 +105,7 @@ var _algorithms = {
 // classic bomb shapes (1000:1) while leaving headroom for legitimate
 // text / JSON / XML payloads (which compress 20-50:1 commonly). Per
 // RFC 8460 §5.2 community guidance for TLS-RPT report decompression.
-var DEFAULT_MAX_RATIO = 50;                                                          // allow:raw-time-literal — RFC number not seconds
+var DEFAULT_MAX_RATIO = 50;
 
 // Default input cap when operator omits opts.maxCompressedBytes —
 // 4 MiB matches the TLS-RPT receive surface and is a reasonable

package/lib/standard-webhooks.js

@@ -32,7 +32,7 @@ var { defineClass } = require("./framework-error");
 
 var StandardWebhooksError = defineClass("StandardWebhooksError", { alwaysPermanent: true });
 
-var DEFAULT_TOLERANCE_SEC = 300;                                                                      // allow:raw-time-literal — 5min default per StandardWebhooks §3.2
+var DEFAULT_TOLERANCE_SEC = 300;
 
 /**
  * @primitive b.standardWebhooks.sign
@@ -70,7 +70,7 @@ function sign(opts) {
   var id = opts.id || ("msg_" + bCrypto.generateToken(32));                                           // 32-char id token
   var timestamp = typeof opts.timestamp === "number"
     ? opts.timestamp
-    : Math.floor(Date.now() / 1000);                                                                  // allow:raw-time-literal — wall-clock seconds
+    : Math.floor(Date.now() / 1000);
   if (timestamp <= 0 || !isFinite(timestamp)) {
     throw new StandardWebhooksError("standard-webhooks/bad-timestamp",
       "sign: timestamp must be a positive finite integer");
@@ -148,7 +148,7 @@ function verify(opts) {
   numericBounds.requirePositiveFiniteIntIfPresent(opts.toleranceSec, "toleranceSec",
     StandardWebhooksError, "standard-webhooks/bad-tolerance");
   var tolerance = typeof opts.toleranceSec === "number" ? opts.toleranceSec : DEFAULT_TOLERANCE_SEC;
-  var nowSec = Math.floor(Date.now() / 1000);                                                         // allow:raw-time-literal — wall-clock seconds
+  var nowSec = Math.floor(Date.now() / 1000);
   if (Math.abs(nowSec - ts) > tolerance) {
     throw new StandardWebhooksError("standard-webhooks/timestamp-skew",
       "verify: timestamp skew " + Math.abs(nowSec - ts) + "s exceeds tolerance " + tolerance + "s");

package/lib/stream-throttle.js

@@ -71,9 +71,9 @@ var StreamThrottleError = defineClass("StreamThrottleError", { alwaysPermanent:
 // (bytes/sec ↔ wait-ms). This is a unit-conversion constant, not a
 // memory cap or protocol-byte literal; the framework's C.TIME / C.BYTES
 // helpers don't apply.
-var MS_PER_SECOND = 1000;                                                                             // allow:raw-time-literal — ms/sec unit conversion
+var MS_PER_SECOND = 1000;
 var NS_PER_MS     = 1e6;                                                                              // ns/ms unit conversion
-var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-time-literal — hrtime seconds→ms
+var MS_PER_SECOND_HRTIME = 1000;
 
 /**
  * @primitive b.streamThrottle.create

package/lib/structured-fields.js

@@ -542,7 +542,7 @@ function parse(input, type, opts) {
 
 function _serDecimal(v, E) {
   if (!isFinite(v)) throw E("structured-fields/serialize", "cannot serialize a non-finite decimal");
-  var n = Math.round(v * 1000) / 1000;                   // allow:raw-time-literal — RFC 8941 §4.1.5 decimal scale 10^3 (3 fractional digits), not a size or duration
+  var n = Math.round(v * 1000) / 1000;                   // allow:raw-time-literal — RFC 8941 4.1.5 decimal-scale 10^3 rounding; coincidental * 1000, not a duration, C.TIME N/A
   if (Math.abs(Math.trunc(n)).toString().length > 12) throw E("structured-fields/serialize", "decimal integer part exceeds 12 digits");   // §4.1.5 cap
   var s = n.toString();
   if (s.indexOf(".") === -1) s += ".0";                  // a Decimal must carry a fractional part

package/lib/vault/seal-pem-file.js

@@ -81,7 +81,7 @@ var SealPemFileError = defineClass("SealPemFileError", { alwaysPermanent: true }
 // doesn't sneak past the watcher. Operators with extremely-quiet
 // renewal cycles can override via opts.pollInterval; the cost of
 // 500ms polling on an idle PEM file is ~2 stat() syscalls/sec.
-var DEFAULT_POLL_MS = 500;                                                         // allow:raw-time-literal — 500ms watchFile cadence (sub-second)
+var DEFAULT_POLL_MS = 500;
 
 // PEM files are tiny — 4 KiB for an ECDSA key, ~8 KiB for a 4096-bit
 // RSA key, ~64 KiB for a long cert chain. Cap at 1 MiB so an operator

package/lib/web-push-vapid.js

@@ -134,7 +134,7 @@ function buildVapidAuthHeader(opts) {
       "buildVapidAuthHeader: subscription.endpoint is not a parseable URL");
   }
   var aud = endpointUrl.origin;
-  var now = Math.floor(Date.now() / 1000);                                                            // allow:raw-time-literal — wall-clock seconds for JWT exp
+  var now = Math.floor(Date.now() / 1000);
   // Inline JWT sign with ES256 — VAPID strictly mandates ECDSA-P256
   // (RFC 8292 §3.1). The framework jwt.sign is PQC-first and refuses
   // ES256 by design; VAPID is a wire-protocol constraint outside

package/lib/webhook.js

@@ -955,7 +955,7 @@ function sign(input) {
     }
     ts = Math.floor(input.timestamp);
   } else {
-    ts = Math.floor(Date.now() / 1000);                                                                // allow:raw-time-literal — unix-seconds conversion, Stripe spec uses seconds-not-ms
+    ts = Math.floor(Date.now() / 1000);
   }
   var hex = _hmacSha256Hex(secretBytes, ts + "." + bodyStr);
   return "t=" + ts + ",v1=" + hex;

package/lib/websocket.js

@@ -191,7 +191,7 @@ var CLOSE_GRACE_MS            = C.TIME.seconds(2);
 function _isValidCloseCode(code) {
   if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // RFC 6455 §7.4.2 reserved codes
   if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
-  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — WebSocket close-code range bound (RFC 6455 7.4.2); coincidental multiple-of-60, C.TIME N/A
   return false;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.7",
+  "version": "0.14.9",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:5777b851-3edb-4e73-9a6a-0538d8e52a91",
+  "serialNumber": "urn:uuid:1e3ccafc-71e3-4207-a3d7-5672ad58b137",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-30T21:03:08.883Z",
+    "timestamp": "2026-05-31T04:50:32.275Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.14.7",
+      "bom-ref": "@blamejs/core@0.14.9",
       "type": "application",
       "name": "blamejs",
-      "version": "0.14.7",
+      "version": "0.14.9",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.14.7",
+      "purl": "pkg:npm/%40blamejs/core@0.14.9",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.14.7",
+      "ref": "@blamejs/core@0.14.9",
       "dependsOn": []
     }
   ]