@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/externaldb-d1.js

@@ -98,51 +98,85 @@ function _isWriteSql(sql) {
   return verb === "INSERT" || verb === "UPDATE" || verb === "DELETE" || verb === "CREATE" || verb === "DROP" || verb === "ALTER" || verb === "REPLACE";
 }
 
-function _withTimeout(promise, ms, label) {
-  var controller = new AbortController();
-  var timer = setTimeout(function () { controller.abort(); }, ms);
-  return {
-    signal: controller.signal,
-    finish: function () {
-      clearTimeout(timer);
-      return promise;
-    },
-    timeoutErr: function () {
-      var e = new Error("externaldbD1: " + label + " timed out after " + ms + "ms");
-      e.code = "D1_TIMEOUT";
-      return e;
-    },
-  };
+// Per-query deadline. b.safeAsync.withTimeoutSignal returns an AbortSignal
+// that fires after `ms`, which is what fetch already takes.
+//
+// This replaced a hand-rolled AbortController whose setTimeout was only
+// cleared by a `finish()` nobody ever called: every query left a pending
+// timer behind, and a pending timer is ref'd, so it kept the event loop
+// awake until it fired. On a query path this busy that is a standing
+// population of live timers and a shutdown that cannot settle until the last
+// one expires. The signal the primitive returns does not hold the loop open.
+function _timeoutSignal(ms) {
+  return b.safeAsync.withTimeoutSignal(null, ms);
+}
+
+// A deadline reached through AbortSignal.timeout rejects with a DOMException
+// named TimeoutError, NOT AbortError — so a handler that recognises only the
+// latter stops producing D1_TIMEOUT and reports a transport failure instead.
+// Both names map here; the only abort wired to these dials is the deadline.
+function _isTimeoutAbort(e) {
+  return !!e && (e.name === "TimeoutError" || e.name === "AbortError");
+}
+
+function _timeoutErr(ms, label) {
+  var e = new Error("externaldbD1: " + label + " timed out after " + ms + "ms");
+  e.code = "D1_TIMEOUT";
+  return e;
 }
 
+// The attempt loop is b.retry.withRetry — exponential backoff, jitter, and
+// the final rethrow — with two things this adapter has to supply.
+//
+// The classifier is ours. The framework's default reads `err.code` and
+// `err.statusCode` off the error itself, and undici does not put them there:
+// a transport failure arrives as TypeError("fetch failed") carrying the real
+// code on `.cause`. Its retryable set also omits EAI_AGAIN and UND_ERR_SOCKET,
+// which are precisely the DNS and socket failures this adapter exists to ride
+// out. Handing it the default classifier would leave the loop in place and
+// silently stop retrying anything that matters.
+//
+// The HTTP arm has to throw to be seen at all. b.httpClient and fetch both
+// resolve a 5xx as an ordinary response, so a retryable status is raised
+// inside the attempt and the response handed back at the boundary once the
+// retries are spent — the caller still inspects `res.status` itself.
 async function _retryingFetch(fetchImpl, url, init, attempts, label) {
-  var lastErr;
-  for (var i = 0; i <= attempts; i += 1) {
-    try {
-      var res = await fetchImpl(url, init);
-      // Retry only on 5xx / 429; 4xx is a permanent client error.
-      if (res.status >= 500 || res.status === 429) {
-        lastErr = _httpErr(res.status, label);
-        if (i < attempts) {
-          await _backoff(i);
-          continue;
-        }
-      }
-      return res;
-    } catch (e) {
-      lastErr = e;
-      if (i < attempts && _isTransient(e)) {
-        await _backoff(i);
-        continue;
-      }
-      throw e;
-    }
-  }
-  throw lastErr;
+  var received = null;
+  return b.retry.withRetry(async function () {
+    var res = await fetchImpl(url, init);
+    received = res;
+    // Retry only on 5xx / 429; a 4xx is the request's own fault.
+    if (res.status >= 500 || res.status === 429) throw _httpErr(res.status, label);
+    return res;
+  }, {
+    maxAttempts: attempts + 1,          // `attempts` counts RETRIES, not tries
+    baseDelayMs: RETRY_BACKOFF_MS,
+    isRetryable: _isTransient,
+  }).catch(function (e) {
+    // Retries exhausted on a status we did receive: give the caller the
+    // response so it reports the upstream's own error, exactly as the previous
+    // loop did. A transport failure has no response and propagates.
+    if (received && e && e.status === received.status) return received;
+    throw e;
+  });
 }
 
+// Which failures are worth another attempt. Both arms matter and neither is
+// what the framework's default classifier looks at.
+//
+// Transport: undici reports a network failure as TypeError("fetch failed")
+// with the real code nested on `.cause`, so the code is read from either
+// place. EAI_AGAIN (transient DNS) and UND_ERR_SOCKET (socket torn down
+// mid-request) are the two this adapter most needs and the two the framework's
+// set leaves out.
+//
+// HTTP: a 5xx or 429 is raised as an error inside the attempt so the loop can
+// see it at all — fetch resolves those as ordinary responses. `_httpErr`
+// records the status on `.status`, so that is what is read here. A 4xx is the
+// request's own fault and is never retried.
 function _isTransient(err) {
   if (!err) return false;
+  if (typeof err.status === "number") return err.status >= 500 || err.status === 429;
   var c = err.code || (err.cause && err.cause.code);
   return c === "ECONNRESET" || c === "ETIMEDOUT" || c === "ENOTFOUND" || c === "EAI_AGAIN" || c === "UND_ERR_SOCKET";
 }
@@ -179,7 +213,7 @@ function _serviceBindingQuery(opts) {
   return async function (_client, sql, params) {
     var mode = _isWriteSql(sql) ? "run" : "all";
     var body = JSON.stringify({ sql: sql, params: params || [], mode: mode });
-    var tcap = _withTimeout(null, timeoutMs, "service-binding query");
+    var tsig = _timeoutSignal(timeoutMs);
     var res;
     try {
       res = await _retryingFetch(fetchImpl, url, {
@@ -190,10 +224,10 @@ function _serviceBindingQuery(opts) {
           "accept":               "application/json",
         },
         body:   body,
-        signal: tcap.signal,
+        signal: tsig,
       }, MAX_RETRY, "service-binding query");
     } catch (e) {
-      if (e && e.name === "AbortError") throw tcap.timeoutErr();
+      if (_isTimeoutAbort(e)) throw _timeoutErr(timeoutMs, "service-binding query");
       throw e;
     }
     if (!res.ok) throw _httpErr(res.status, "service-binding query");
@@ -224,7 +258,7 @@ function _restApiQuery(opts) {
   }
   return async function (_client, sql, params) {
     var body = JSON.stringify({ sql: sql, params: params || [] });
-    var tcap = _withTimeout(null, timeoutMs, "rest-api query");
+    var tsig = _timeoutSignal(timeoutMs);
     var res;
     try {
       res = await _retryingFetch(fetchImpl, url, {
@@ -235,10 +269,10 @@ function _restApiQuery(opts) {
           "accept":         "application/json",
         },
         body:   body,
-        signal: tcap.signal,
+        signal: tsig,
       }, MAX_RETRY, "rest-api query");
     } catch (e) {
-      if (e && e.name === "AbortError") throw tcap.timeoutErr();
+      if (_isTimeoutAbort(e)) throw _timeoutErr(timeoutMs, "rest-api query");
       throw e;
     }
     if (!res.ok) throw _httpErr(res.status, "rest-api query");

package/lib/geolocation.js

@@ -254,34 +254,24 @@ function _now() { return Date.now(); }
 // through to the country's default_locale.
 function _parseAcceptLanguage(raw) {
   if (typeof raw !== "string" || !raw.length) return [];
-  var entries = raw.split(",");
-  var parsed = [];
-  for (var i = 0; i < entries.length; i += 1) {
-    var part = entries[i].trim();
-    if (!part) continue;
-    var semi = part.indexOf(";");
-    var tag = (semi === -1 ? part : part.slice(0, semi)).trim();
-    var q = 1.0;
-    if (semi !== -1) {
-      var attrs = part.slice(semi + 1).split(";");
-      for (var j = 0; j < attrs.length; j += 1) {
-        var a = attrs[j].trim();
-        if (a.slice(0, 2).toLowerCase() === "q=") {
-          var n = parseFloat(a.slice(2));
-          if (isFinite(n) && n >= 0 && n <= 1) q = n;
-        }
-      }
-    }
-    if (tag === "*") continue;
-    if (!LOCALE_RE.test(tag)) continue;
-    parsed.push({ tag: tag, q: q, order: i });
-  }
-  // Stable q-desc sort (preserve original order on ties).
-  parsed.sort(function (a, b) {
-    if (a.q !== b.q) return b.q - a.q;
-    return a.order - b.order;
-  });
-  return parsed;
+  // b.requestHelpers.parseQualityList is the RFC 9110 §12.5 parser, and the
+  // edge bypass check reads the same header through it — which is what keeps
+  // the two agreeing on which tag wins. They had drifted: a header spelling
+  // the parameter `Q=0.9` was read correctly here and ignored at the edge, so
+  // a visitor sending it got one locale decided at the edge and another here.
+  //
+  // `caseSensitive` because these are BCP 47 tags and the chosen one is
+  // returned to the caller — a browser asking for `de-AT` should get `de-AT`
+  // back, not `de-at`. Matching lowercases separately in _primarySubtag.
+  //
+  // A tag carrying `q=0` is dropped rather than ranked last: q=0 means "not
+  // acceptable", and keeping it meant a locale the visitor had explicitly
+  // ruled out could still be selected when nothing else matched.
+  return b.requestHelpers.parseQualityList(raw, { caseSensitive: true })
+    .filter(function (e) {
+      return e.value !== "*" && e.q > 0 && LOCALE_RE.test(e.value);
+    })
+    .map(function (e) { return { tag: e.value, q: e.q }; });
 }
 
 function _primarySubtag(tag) {

package/lib/gift-options.js

@@ -69,8 +69,6 @@ var SKU_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 // in adjacent ecosystems. Newlines are allowed in gift_message
 // (people write multi-line messages); the recipient name is a
 // single line and refuses LF / CR too.
-var CONTROL_BYTE_MSG_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_NAME_RE  = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the order-notes
 // primitive's catalogue: ZWSP/ZWNJ/ZWJ (U+200B-200D), LRM/RLM
@@ -79,15 +77,13 @@ var CONTROL_BYTE_NAME_RE  = /[\x00-\x1f\x7f]/;
 // (U+2066-U+2069), the BOM (U+FEFF), and the Arabic letter mark
 // (U+061C). Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_WRAP_COLUMNS = Object.freeze([
   "title", "fee_minor", "image_url", "max_per_order", "active",
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -107,9 +103,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("giftOptions: title must be a non-empty string ≤ " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_NAME_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("giftOptions: title contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "giftOptions: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -133,9 +127,7 @@ function _imageUrl(s) {
   if (!(/^https:\/\//.test(s) || /^\/\//.test(s) || /^\//.test(s))) {
     throw new TypeError("giftOptions: image_url must be https://, // (protocol-relative), or / (absolute path)");
   }
-  if (CONTROL_BYTE_NAME_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("giftOptions: image_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "giftOptions: image_url", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -162,12 +154,7 @@ function _giftMessage(s) {
   if (s.length > MAX_MESSAGE_LEN) {
     throw new TypeError("giftOptions: gift_message must be ≤ " + MAX_MESSAGE_LEN + " chars");
   }
-  if (CONTROL_BYTE_MSG_RE.test(s)) {
-    throw new TypeError("giftOptions: gift_message contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("giftOptions: gift_message contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "giftOptions: gift_message", { zeroWidth: "reject" });
   return s;
 }
 
@@ -179,12 +166,7 @@ function _recipientName(s) {
   if (s.length > MAX_RECIPIENT_LEN) {
     throw new TypeError("giftOptions: recipient_name must be ≤ " + MAX_RECIPIENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_NAME_RE.test(s)) {
-    throw new TypeError("giftOptions: recipient_name contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("giftOptions: recipient_name contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "giftOptions: recipient_name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/knowledge-base.js

@@ -108,11 +108,6 @@ var LOCALE_RE   = /^[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/;
 var CATEGORY_RE = /^[a-z][a-z0-9_-]*$/;
 var TAG_RE      = /^[a-z][a-z0-9_-]*$/;
 
-var CONTROL_BYTE_BODY_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var SEARCH_WEIGHTS = Object.freeze({
   title: 3,
@@ -121,6 +116,7 @@ var SEARCH_WEIGHTS = Object.freeze({
 });
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -163,12 +159,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("knowledgeBase: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("knowledgeBase: title contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "knowledgeBase: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -183,12 +174,10 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("knowledgeBase: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("knowledgeBase: body contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "knowledgeBase: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -282,9 +271,7 @@ function _queryStr(s) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError("knowledgeBase: query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: query contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "knowledgeBase: query", { zeroWidth: "reject" });
   return s;
 }
 
@@ -303,9 +290,7 @@ function _sessionIdRaw(s) {
   if (s.length > 256) {
     throw new TypeError("knowledgeBase: session_id must be <= 256 characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: session_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "knowledgeBase: session_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -347,7 +332,7 @@ function _esc(s) {
 
 function _safeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_BODY_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, { zeroWidth: "reject" })) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;

package/lib/line-gift-wrap.js

@@ -69,6 +69,7 @@
 // ---- constants ----------------------------------------------------------
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -89,8 +90,6 @@ var SKU_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 // adjacent ecosystems. Newlines are allowed in gift_message (people
 // write multi-line messages); the recipient name is a single line
 // and refuses LF / CR too.
-var CONTROL_BYTE_MSG_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_NAME_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the gift-options
 // primitive's catalogue: ZWSP/ZWNJ/ZWJ (U+200B-200D), LRM/RLM
@@ -99,9 +98,6 @@ var CONTROL_BYTE_NAME_RE = /[\x00-\x1f\x7f]/;
 // (U+2066-U+2069), the BOM (U+FEFF), and the Arabic letter mark
 // (U+061C). Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var BCP47_RE = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/;
 
@@ -155,12 +151,7 @@ function _giftMessage(s) {
   if (s.length > MAX_MESSAGE_LEN) {
     throw new TypeError("lineGiftWrap: gift_message must be ≤ " + MAX_MESSAGE_LEN + " chars");
   }
-  if (CONTROL_BYTE_MSG_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: gift_message contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: gift_message contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "lineGiftWrap: gift_message", { zeroWidth: "reject" });
   return s;
 }
 
@@ -172,12 +163,7 @@ function _recipientName(s) {
   if (s.length > MAX_RECIPIENT_LEN) {
     throw new TypeError("lineGiftWrap: recipient_name must be ≤ " + MAX_RECIPIENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_NAME_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: recipient_name contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: recipient_name contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "lineGiftWrap: recipient_name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/live-chat.js

@@ -98,15 +98,11 @@ var TRANSITIONS = {
   abandoned: {},
 };
 
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
 // Zero-width + direction-override characters. Spelled via \u escapes
 // so the file stays ESLint no-irregular-whitespace clean.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- validators ---------------------------------------------------------
@@ -134,12 +130,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("live-chat: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("live-chat: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("live-chat: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "live-chat: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -152,7 +143,7 @@ function _reason(r, label) {
   if (r.length > MAX_REASON_LEN) {
     throw new TypeError("live-chat: " + (label || "reason") + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(r) || ZERO_WIDTH_RE.test(r)) {
+  if (textGuard.hasCodepointThreat(r, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError("live-chat: " + (label || "reason") + " contains control / zero-width bytes");
   }
   return r;
@@ -165,9 +156,7 @@ function _sourcePage(s) {
   if (s.length > MAX_SOURCE_PAGE) {
     throw new TypeError("live-chat: source_page must be <= " + MAX_SOURCE_PAGE + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("live-chat: source_page contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "live-chat: source_page", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -178,9 +167,7 @@ function _visitorSessionId(s) {
   if (s.length > MAX_SESSION_ID_LEN) {
     throw new TypeError("live-chat: session_id must be <= " + MAX_SESSION_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("live-chat: session_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "live-chat: session_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/metered-usage.js

@@ -90,6 +90,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -111,10 +112,6 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // primitives — operator-authored copy (title, unit) ends up on
 // receipt emails + the operator dashboard, so the same "no direction-
 // override / no invisible glyph" floor applies.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "title",
@@ -146,7 +143,7 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("meteredUsage: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("meteredUsage: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -253,9 +250,7 @@ function _idempotencyKey(s) {
   if (s.length > MAX_IDEM_KEY_LEN) {
     throw new TypeError("meteredUsage: idempotency_key must be <= " + MAX_IDEM_KEY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("meteredUsage: idempotency_key contains control bytes");
-  }
+  textGuard.freeText(s, "meteredUsage: idempotency_key");
   return s;
 }
 

package/lib/notifications.js

@@ -39,6 +39,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var RECIPIENT_NAMESPACE = "notification-recipient";
 
@@ -54,7 +55,6 @@ var MAX_PAYLOAD_BYTES  = 65536;
 var MAX_ERROR_LEN      = 1024;
 
 var EVENT_TYPE_RE     = /^[a-z](?:[a-z0-9._-]*[a-z0-9])?$/;
-var CONTROL_BYTE_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 var DEFAULT_PAGE_SIZE = 50;
 var MAX_PAGE_SIZE     = 500;
 
@@ -67,9 +67,7 @@ function _recipientId(s) {
   if (s.length > MAX_RECIPIENT_LEN) {
     throw new TypeError("notifications: recipient_id must be <= " + MAX_RECIPIENT_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("notifications: recipient_id contains control bytes");
-  }
+  textGuard.freeText(s, "notifications: recipient_id");
   return s;
 }
 
@@ -101,9 +99,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("notifications: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("notifications: title contains control bytes");
-  }
+  textGuard.freeText(s, "notifications: title");
   return s;
 }
 

package/lib/operator-accounts.js

@@ -156,9 +156,9 @@ var MAX_LIST_LIMIT       = 200;
 var ROLES  = Object.freeze(["owner", "manager", "viewer"]);
 var STATUS = Object.freeze(["active", "disabled"]);
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -174,7 +174,7 @@ function _actorId(s, label) {
   if (typeof s !== "string" || !s.length || s.length > 128) {
     throw new TypeError("operatorAccounts: " + (label || "actor_id") + " must be a non-empty string (<= 128 chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("operatorAccounts: " + (label || "actor_id") + " must not contain control bytes");
   }
   return s;
@@ -212,9 +212,7 @@ function _displayName(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_DISPLAY_NAME_LEN) {
     throw new TypeError("operatorAccounts: display_name must be a non-empty string (<= " + MAX_DISPLAY_NAME_LEN + " chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorAccounts: display_name must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorAccounts: display_name", { singleLine: "reject" });
   return s;
 }