@blamejs/core 0.16.7 → 0.16.9

package/lib/safe-buffer.js

@@ -872,6 +872,41 @@ function assertHeaderSafe(value, label, ErrorClass, code) {
   return value;
 }
 
+/**
+ * @primitive b.safeBuffer.quoteString
+ * @signature b.safeBuffer.quoteString(s)
+ * @since     0.16.9
+ * @status    stable
+ * @related   b.safeBuffer.assertHeaderSafe, b.safeBuffer.foldHeaderText
+ *
+ * Serialize a value as an RFC quoted-string: coerce to string, escape
+ * every backslash and DQUOTE with a leading backslash, and wrap the
+ * result in DQUOTEs. One serializer for the quoted-string grammars the
+ * framework emits — RFC 8941 §3.3.3 Structured Fields sf-string
+ * (Cache-Status, Signature-Input, Server-Timing desc), RFC 8288 Link
+ * header parameters, RFC 8601 §2.2 Authentication-Results reason,
+ * RFC 3501 §4.3 IMAP quoted strings, and RFC 5804 §1.2 ManageSieve
+ * strings — so an unescaped quote can never terminate the string early
+ * and smuggle extra parameters into the protocol line.
+ *
+ * Escaping only — it does not validate a grammar's character range. A
+ * grammar that forbids bytes a quoted-string cannot carry (sf-string is
+ * printable-ASCII only; IMAP quoted strings cannot carry CR / LF)
+ * enforces its range check before calling this.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeBuffer.quoteString("cache miss");
+ *   // → "\"cache miss\""
+ *
+ *   // A quote or backslash in the value cannot break out of the string.
+ *   b.safeBuffer.quoteString('say "hi"');
+ *   // → "\"say \\\"hi\\\"\""
+ */
+function quoteString(s) {
+  return "\"" + String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";                       // allow:regex-no-length-cap — fixed-char-set escape on caller-bounded input
+}
+
 module.exports = {
   normalizeText:         normalizeText,
   toBuffer:              toBuffer,
@@ -885,6 +920,7 @@ module.exports = {
   stripCrlf:             stripCrlf,
   foldHeaderText:        foldHeaderText,
   assertHeaderSafe:      assertHeaderSafe,
+  quoteString:           quoteString,
   stripTrailingHspace:   stripTrailingHspace,
   indexAfterOpenTag:     indexAfterOpenTag,
   HEX_RE:                HEX_RE,

package/lib/server-timing.js

@@ -37,6 +37,7 @@
  *   W3C Server-Timing response header builder — per-request timing-metric collector that surfaces server-side latency in the browser's Performance API.
  */
 
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -46,9 +47,6 @@ var ServerTimingError = defineClass("ServerTimingError", { alwaysPermanent: true
 // at 128 chars for sanity; operator-supplied desc is sf-string.
 var METRIC_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;                                       // RFC 7230 token shape + length cap
 
-function _quoteDesc(s) {
-  return "\"" + String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";
-}
 
 /**
  * @primitive b.serverTiming.create
@@ -120,7 +118,7 @@ function create() {
     return entries.map(function (e) {
       var parts = [e.name];
       if (e.dur !== null) parts.push("dur=" + _formatDur(e.dur));
-      if (e.desc !== null) parts.push("desc=" + _quoteDesc(e.desc));
+      if (e.desc !== null) parts.push("desc=" + safeBuffer.quoteString(e.desc));
       return parts.join("; ");
     }).join(", ");
   }

package/lib/tls-exporter.js

@@ -106,7 +106,7 @@ function _resolveTlsSocket(socketOrReq) {
  *   }
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var server = b.https.createServer({ key: KEY, cert: CERT }, function (req, res) {
  *     var exporter = b.tlsExporter.fromSocket(req, { length: 32 });
  *     res.end("exporter bytes: " + exporter.length);
@@ -175,7 +175,7 @@ function fromSocket(socketOrReq, opts) {
  * compare via `verifyTokenBinding` on the next request.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   b.https.createServer({ key: KEY, cert: CERT }, function (req, res) {
  *     var binding = b.tlsExporter.bindToken(req, "session-token-abc123");
  *     binding.length;
@@ -214,7 +214,7 @@ function bindToken(socketOrReq, token) {
  * the input shape is wrong.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   b.https.createServer({ key: KEY, cert: CERT }, function (req, res) {
  *     var stored = b.tlsExporter.bindToken(req, "session-token-abc123");
  *     var ok = b.tlsExporter.verifyTokenBinding(req, "session-token-abc123", stored);

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -154,12 +154,12 @@
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
       "bundledAt": "2026-06-24T00:00:00Z",
       "hashes": {
-        "server": "sha256:5afbeea28737514a69a0bdca7cd3818979e67c443444de4d19f2f8713cf5372e",
-        "data_js": "sha256:6ed61937db12f148494db7c336498740bf4458cd9f49ec73d887eda83529f207"
+        "server": "sha256:b86d21bda9c627f0fdbb0182a16a441992e53dc74eb3e866e7885660df863dbd",
+        "data_js": "sha256:72fb435e03a25bece67f744601e75e3fb7972f264336ddf7cfcb13ddccedb73e"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-10T14:22:17.414Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-07-02_09-58-14_UTC
-// COMMIT: d67b6cb8e70e9c76b0803809b66e7ffdd09484bd
+// VERSION: 2026-07-09_11-59-23_UTC
+// COMMIT: b9a86cf0cd115f1e60b5815533f3fcfd2f9e8f4b
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -12751,6 +12751,12 @@ co.ca
 // Submitted by Gavin Brown <gavin.brown@centralnic.com>
 co.com
 
+// Code For Host Inc Ltd : https://codeforhost.com
+// Submitted by Mehedi Hasan <support@codeforhost.com>
+sch.ac
+dev.cv
+store.cv
+
 // Codeberg e. V. : https://codeberg.org
 // Submitted by Moritz Marquardt <git@momar.de>
 codeberg.page
@@ -14150,10 +14156,6 @@ in-vpn.org
 // Submitted by Connor McFarlane <noc@inferno.co.uk>
 oninferno.net
 
-// info.at : http://www.info.at/
-biz.at
-info.at
-
 // info.cx : http://info.cx
 // Submitted by June Slater <whois@igloo.to>
 info.cx
@@ -16328,6 +16330,10 @@ weeklylottery.org.uk
 wpenginepowered.com
 js.wpenginepowered.com
 
+// xAI : https://x.ai/
+// Submitted by Asim Shrestha <security@x.ai>
+grok.me
+
 // XenonCloud GbR : https://xenoncloud.net
 // Submitted by Julian Uphoff <publicsuffixlist@xenoncloud.net>
 *.xenonconnect.de