@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/webhook-hmac.js

@@ -94,6 +94,7 @@ function _requireNonEmptyString(val, name) {
  *   sigField:     string,          // default: "v1"
  *   alg:          string,          // default: "hmac-sha256" (also "hmac-sha512")
  *   toleranceSec: number,          // default: 300 (5 minutes)
+ *   now:          number,          // epoch ms for the replay window; default: Date.now()
  *
  * @example
  *   var v = b.webhookHmac.verify({
@@ -107,7 +108,8 @@ function verify(opts) {
   opts = validateOpts.requireObject(opts, "webhookHmac.verify",
     WebhookHmacError, "webhook-hmac/bad-opts");
   validateOpts(opts,
-    ["header", "rawBody", "secret", "profile", "tsField", "sigField", "alg", "toleranceSec"],
+    ["header", "rawBody", "secret", "profile", "tsField", "sigField", "alg", "toleranceSec",
+      "now"],
     "webhookHmac.verify");
 
   // Resolve profile → field/alg defaults; explicit opts win.
@@ -141,6 +143,21 @@ function verify(opts) {
     WebhookHmacError, "webhook-hmac/bad-tolerance");
   var tolerance = typeof opts.toleranceSec === "number" ? opts.toleranceSec : DEFAULT_TOLERANCE_SEC;
 
+  // Replay window measured against an injectable clock (epoch milliseconds,
+  // the shape b.cwt.verify already takes), defaulting to wall time. A caller
+  // that owns its own time source -- a receiver built around an injected
+  // clock, a forensic replay of a captured delivery, a deterministic
+  // simulation -- otherwise has to abandon this primitive and rebuild the
+  // scheme by hand, since its window check and this one disagree the moment
+  // the injected clock is not now.
+  //
+  // An injected clock rather than a skip-the-check flag: the replay defense
+  // stays inside the primitive, and omitting the option falls back to wall
+  // time, so forgetting it fails closed instead of silently accepting an
+  // arbitrarily old delivery.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.now, "now",
+    WebhookHmacError, "webhook-hmac/bad-now");
+
   // Parse "t=<ts>,v1=<sig>,v1=<rotated>" — comma-separated k=v. Collect the ts
   // and EVERY sigField value; ignore any other version keys.
   var tsRaw = null;
@@ -169,7 +186,7 @@ function verify(opts) {
     throw new WebhookHmacError("webhook-hmac/bad-timestamp",
       "verify: '" + tsField + "' is not a positive integer");
   }
-  var nowSec = Math.floor(Date.now() / 1000);
+  var nowSec = Math.floor((typeof opts.now === "number" ? opts.now : Date.now()) / 1000);
   var skew = Math.abs(nowSec - ts);
   if (skew > tolerance) {
     throw new WebhookHmacError("webhook-hmac/timestamp-skew",

package/lib/vendor/blamejs/lib/webhook.js

@@ -485,7 +485,7 @@ function signer(opts) {
       }, retryOpts);
       var statusCode = (res && (res.statusCode || res.status)) || 0;
       _emitEvent("webhook.send", 1, {
-        outcome: statusCode >= 200 && statusCode < 300 ? "success" : "failure",
+        outcome: C.HTTP.success(statusCode) ? "success" : "failure",
         status: statusCode,
         host: hostLabel,
       });

package/lib/vendor/blamejs/lib/ws-client.js

@@ -381,7 +381,23 @@ class WsClient extends EventEmitter {
                (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
 
-    function _onError(err) { self._handleSocketError(err); }
+    // Filled in on the wss:// path below with the options the dial actually
+    // used. dialTlsOpts is merged OVER the shared posture, so a caller that
+    // narrowed ecdhCurve or moved minVersion negotiated on something the
+    // shared object does not describe, and diagnosing against the shared one
+    // would answer for a connection that was never made.
+    var effectiveTls = null;
+
+    function _onError(err) {
+      // A wss:// handshake refused by the posture arrives as a bare OpenSSL
+      // alert; name the cause before it reaches the caller's handler.
+      networkTls().annotateOutboundFailure(err, {
+        host:    host,
+        port:    port,
+        tlsOpts: effectiveTls || {},
+      });
+      self._handleSocketError(err);
+    }
 
     // Pin the connect to the SSRF-validated IPs returned by
     // ssrfGuard.checkUrl — closes the DNS-rebinding TOCTOU window where
@@ -413,6 +429,12 @@ class WsClient extends EventEmitter {
         port:         port,
         rejectUnauthorized: true,
       }, networkTls().outboundPosture(), dialTlsOpts || {});
+      // The posture advertises RFC 8879 certificate compression, which is a
+      // TLS 1.3 extension. A caller who capped this dial lower asked for none
+      // of it, and Node refuses the whole options object rather than ignoring
+      // an extension it cannot use.
+      networkTls()._stripUnreachableCertCompression(tlsOpts, dialTlsOpts);
+      effectiveTls = tlsOpts;
       // RFC 6066 §3: the TLS SNI ServerName MUST be a hostname, never an IP
       // literal — Node throws ERR_INVALID_ARG_VALUE when servername is an IP,
       // which made wss:// to any IP-literal target unusable. Send SNI only for
@@ -541,7 +563,7 @@ class WsClient extends EventEmitter {
       return;
     }
     var status = parseInt(match[1], 10);
-    if (status !== 101) {                                                                 // HTTP 101
+    if (status !== C.HTTP.STATUS.SWITCHING_PROTOCOLS) {                                                                 // HTTP 101
       // Body bytes after the header section are the server's
       // explanation. Surface them on the error so callers can branch
       // on the status code and inspect the body without re-parsing

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.17",
+  "version": "0.18.21",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:64b32cc6-e5c4-4968-a1b3-33ca68975bed",
+  "serialNumber": "urn:uuid:885de67e-71f9-4512-83e7-3538ecfd9d88",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-08T17:14:55.062Z",
+    "timestamp": "2026-08-10T21:28:58.997Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.17",
+      "bom-ref": "@blamejs/core@0.18.21",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.17",
+      "version": "0.18.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.17",
+      "purl": "pkg:npm/%40blamejs/core@0.18.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.17",
+      "ref": "@blamejs/core@0.18.21",
       "dependsOn": []
     }
   ]

package/lib/vendor-invoices.js

@@ -95,10 +95,6 @@ var CURRENCY_RE            = /^[A-Z]{3}$/;
 // as the sibling accounts-payable primitives — operator-rendered text
 // fields refuse these to keep the dashboard + printout safe from
 // header-injection + visual-spoofing attacks.
-var CONTROL_BYTE_RE        = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var INVOICE_STATUSES = Object.freeze([
   "received", "approved", "paid", "disputed", "voided",
@@ -107,6 +103,7 @@ var INVOICE_STATUSES = Object.freeze([
 var MAX_DUE_WITHIN_DAYS     = 3650;    // ~10 years — bound the predicate
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MS_PER_DAY              = b.constants.TIME.days(1);
 
@@ -219,10 +216,10 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("vendor-invoices: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("vendor-invoices: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("vendor-invoices: " + label + " contains zero-width / direction-override bytes");
   }
   return s;

package/lib/vendors.js

@@ -97,10 +97,6 @@ var PHONE_RE                = /^\+?[1-9]\d{1,14}$/;
 // direction-override bytes are a slipping-class for header injection
 // + visual-spoofing attacks downstream. Spelled with \u-escapes so
 // ESLint's no-irregular-whitespace stays happy.
-var CONTROL_BYTE_STRICT_RE  = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Mutable columns for `updateVendor(slug, patch)`. Slug is immutable
 // — it's the public handle + the join-table key; mutating it would
@@ -119,6 +115,7 @@ var ALLOWED_UPDATE_COLUMNS = Object.freeze([
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -159,12 +156,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("vendors: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("vendors: name contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: name contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "vendors: name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -186,9 +178,7 @@ function _payoutAddress(s) {
   if (s.length > MAX_PAYOUT_ADDRESS_LEN) {
     throw new TypeError("vendors: payout_address must be <= " + MAX_PAYOUT_ADDRESS_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: payout_address contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "vendors: payout_address", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -221,9 +211,7 @@ function _addressJson(value) {
   if (encoded.length > MAX_ADDRESS_JSON_LEN) {
     throw new TypeError("vendors: address JSON must be <= " + MAX_ADDRESS_JSON_LEN + " characters serialised");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(encoded) || ZERO_WIDTH_RE.test(encoded)) {
-    throw new TypeError("vendors: address contains control / zero-width bytes");
-  }
+  textGuard.freeText(encoded, "vendors: address", { singleLine: "reject", zeroWidth: "reject" });
   return encoded;
 }
 
@@ -265,9 +253,7 @@ function _orderId(s) {
   if (s.length > 256) {
     throw new TypeError("vendors: order_id must be <= 256 characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: order_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "vendors: order_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/webhook-receiver.js

@@ -44,12 +44,14 @@
  *     - `b.crypto.namespaceHash`   — secret-at-rest fingerprint.
  *     - `b.crypto.sha3Hash`        — body fingerprint for audit.
  *     - `b.crypto.generateBytes`   — secret plaintext draw.
- *     - `b.crypto.timingSafeEqual` — constant-time hex compare on
- *                                    secret-hash + signature match.
- *     - `b.webhook.sign`           — HMAC-SHA-256 computation under
- *                                    the Stripe-shape algorithm
- *                                    (`t=<ts>,v1=<hex>`); we extract
- *                                    the hex portion.
+ *     - `b.crypto.timingSafeEqual` — constant-time hex compare on the
+ *                                    secret-hash match.
+ *     - `b.webhookHmac.verify`     — the whole `t=<ts>,v1=<hex>` scheme:
+ *                                    HMAC-SHA-256 over `<timestamp>.<raw-body>`,
+ *                                    the replay window (on this receiver's
+ *                                    injected clock and the source row's
+ *                                    tolerance), and a constant-time compare
+ *                                    across every signature the header carries.
  *     - `b.uuid.v7`                — row ids.
  *
  *   Surface:
@@ -77,6 +79,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 var SECRET_NAMESPACE   = "webhook-receiver-secret";
@@ -116,10 +119,6 @@ var MAX_REASON_LEN  = 1024;
 
 var SIGNATURE_HEX_RE = /^[0-9a-f]{64}$/i;     // 32 bytes of HMAC-SHA-256 = 64 hex chars
 
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE          = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var STATUSES = ["received", "processed", "failed"];
 
@@ -196,9 +195,7 @@ function _outcome(s) {
   if (s.length > MAX_OUTCOME_LEN) {
     throw new TypeError("webhookReceiver: outcome must be <= " + MAX_OUTCOME_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookReceiver: outcome contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookReceiver: outcome", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -213,9 +210,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("webhookReceiver: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookReceiver: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookReceiver: reason", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -305,34 +300,6 @@ function _hashSecret(canonical) {
   return b.crypto.namespaceHash(SECRET_NAMESPACE, canonical);
 }
 
-// Extract the v1 hex tag from a `t=<ts>,v1=<hex>` Stripe-shape header
-// produced by b.webhook.sign. We pin to this composition rather than
-// reach for node:crypto so the receiver inherits whatever HMAC-SHA-256
-// hardening lives in the vendored blamejs surface.
-function _hmacSha256Hex(secretPlaintext, timestampSeconds, bodyString) {
-  var header = b.webhook.sign({
-    alg:       "hmac-sha256-stripe",
-    secret:    secretPlaintext,
-    body:      bodyString,
-    timestamp: timestampSeconds,
-  });
-  // Header shape is `t=<ts>,v1=<hex>` — the marker is the only place
-  // ",v1=" appears so a literal indexOf is the canonical parse.
-  var marker = ",v1=";
-  var i = header.indexOf(marker);
-  if (i < 0) {
-    // Defensive: a future blamejs version that changes the shape
-    // would slip past silently if we returned an empty string. Throw
-    // loudly so the operator notices at deploy time, not at the
-    // first inbound webhook.
-    throw new Error(
-      "webhookReceiver: b.webhook.sign returned an unexpected header shape " +
-      "(no ',v1=' marker) — vendored blamejs may need a refresh"
-    );
-  }
-  return header.slice(i + marker.length);
-}
-
 // ---- factory ------------------------------------------------------------
 
 function create(opts) {
@@ -610,40 +577,9 @@ function create(opts) {
           timestamp_out_of_window:  false,
         };
       }
-      var timestampSeconds = parseInt(tsStr, 10);
-      if (!Number.isFinite(timestampSeconds) || timestampSeconds < 0) {
-        return {
-          ok:                       false,
-          event_id:                 null,
-          replay:                   false,
-          signature_invalid:        true,
-          timestamp_out_of_window:  false,
-        };
-      }
-
-      // Replay-window check. The third-party's timestamp must land
-      // within ±replay_window_seconds of the receiver's current
-      // wall-clock. We accept future-skewed timestamps inside the
-      // window (a peer with a slightly fast clock shouldn't reject)
-      // but not arbitrarily-future timestamps that would let an
-      // attacker bypass replay protection by stamping a fresh ts.
-      var windowSec = Number(sourceRow.replay_window_seconds);
-      var nowSec    = Math.floor(nowMs / 1000);
-      var ageSec    = Math.abs(nowSec - timestampSeconds);
-      if (ageSec > windowSec) {
-        return {
-          ok:                       false,
-          event_id:                 null,
-          replay:                   false,
-          signature_invalid:        false,
-          timestamp_out_of_window:  true,
-        };
-      }
-
-      // Signature validation. The third-party signs the literal
-      // `<timestamp>.<body>` string with HMAC-SHA-256 under the
-      // secret. We recompute via b.webhook.sign and constant-time-
-      // compare the supplied hex against the expected hex.
+      // The signature must be exactly the hex digest before it is composed
+      // into the header below — a value carrying a comma or an `=` would
+      // otherwise add fields the parser reads as its own.
       var supplied = input.signature_header.trim().toLowerCase();
       if (!SIGNATURE_HEX_RE.test(supplied)) {
         return {
@@ -654,15 +590,42 @@ function create(opts) {
           timestamp_out_of_window:  false,
         };
       }
-      var expected = _hmacSha256Hex(matched.plaintext, timestampSeconds, bodyBytes.toString("utf8"));
-      var sigOk = b.crypto.timingSafeEqual(supplied, expected);
-      if (!sigOk) {
+
+      // Signature + replay window, both from b.webhookHmac. It owns this exact
+      // scheme — `t=<ts>,v1=<hex>` over `<timestamp>.<raw-body>` — including
+      // the strict-integer timestamp, the skew window, a constant-time compare
+      // and multi-signature support for a rotated secret. This receiver takes
+      // its clock from the operator (opts.now) and its window from the source
+      // row, so both are passed in; the primitive gained the clock argument in
+      // 0.18.18, which is what made composing it possible at all.
+      //
+      // The body goes in as BYTES. Signing a UTF-8 string rebuild of it
+      // replaces anything that is not valid UTF-8 with U+FFFD, taking the
+      // digest over different bytes than the sender signed and rejecting a
+      // correctly-signed delivery. The timestamp goes in as the raw header
+      // text rather than a reparsed integer for the same reason.
+      var windowSec = Number(sourceRow.replay_window_seconds);
+      try {
+        b.webhookHmac.verify({
+          header:       "t=" + tsStr + ",v1=" + supplied,
+          rawBody:      bodyBytes,
+          secret:       matched.plaintext,
+          profile:      "stripe",
+          toleranceSec: windowSec,
+          now:          nowMs,
+        });
+      } catch (e) {
+        // Out-of-window and bad-signature are distinct outcomes to an operator
+        // reading the delivery log: one is a clock or a replay, the other is a
+        // wrong secret. Every other refusal is a malformed header, which is
+        // not a signature the receiver can accept.
+        var skew = e && e.code === "webhook-hmac/timestamp-skew";
         return {
           ok:                       false,
           event_id:                 null,
           replay:                   false,
-          signature_invalid:        true,
-          timestamp_out_of_window:  false,
+          signature_invalid:        !skew,
+          timestamp_out_of_window:  skew,
         };
       }
 

package/lib/webhook-subscriptions.js

@@ -68,10 +68,6 @@ var WILDCARD_EVENT = "*";
 // control bytes are a slipping-class for header injection + visual
 // spoofing downstream. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Event-type identifier shape — `domain.action[.qualifier]` segments
 // of ASCII letters / digits / underscore, joined by `.`. The wildcard
@@ -111,9 +107,7 @@ function _ownerId(s) {
   if (s.length > MAX_OWNER_ID_LEN) {
     throw new TypeError("webhookSubscriptions: owner_id must be <= " + MAX_OWNER_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookSubscriptions: owner_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookSubscriptions: owner_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -191,9 +185,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("webhookSubscriptions: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookSubscriptions: name contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookSubscriptions: name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -219,9 +211,7 @@ function _signingSecret(s) {
   if (s.length > 512) {
     throw new TypeError("webhookSubscriptions: signing_secret must be <= 512 characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookSubscriptions: signing_secret contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookSubscriptions: signing_secret", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/wishlist-sharing.js

@@ -63,6 +63,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var wishlistModule = require("./wishlist");
 
 // ---- constants ----------------------------------------------------------
@@ -82,8 +83,6 @@ var MAX_REASON_LEN             = 500;
 var MAX_EMAIL_LEN              = 254;
 var MAX_MEMBER_EMAILS          = 50;
 
-var CONTROL_BYTE_RE            = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE     = /[\x00-\x1f\x7f]/;
 
 // Conservative single-line email shape — defence in depth against
 // header-injection / control-byte smuggling when the operator
@@ -127,7 +126,7 @@ function _title(s, label) {
   if (typeof s !== "string" || s.length > MAX_TITLE_LEN) {
     throw new TypeError("wishlistSharing: " + label + " must be a string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("wishlistSharing: " + label + " must not contain control bytes");
   }
   return s;
@@ -137,7 +136,7 @@ function _requiredTitle(s, label) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("wishlistSharing: " + label + " must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("wishlistSharing: " + label + " must not contain control bytes");
   }
   return s;
@@ -162,9 +161,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("wishlistSharing: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("wishlistSharing: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "wishlistSharing: reason");
   return s;
 }
 
@@ -205,9 +202,7 @@ function _viewerSessionId(s) {
   // Session ids are opaque to this primitive; refuse control bytes
   // so the hashed breadcrumb has no log-injection vector even if a
   // downstream tool ever rendered the raw value.
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("wishlistSharing: viewer_session_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "wishlistSharing: viewer_session_id", { singleLine: "reject" });
   return s;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.19",
+  "version": "0.5.21",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {