@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/operator-approvals.js

@@ -164,13 +164,13 @@ var MAX_HOURS              = 24 * 365;       // one-year cap
 
 var SLUG_RE          = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var ACTION_KIND_RE   = /^[a-z][a-z0-9_.\-]{0,79}$/;
-var CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
 
 var DECISIONS = Object.freeze(["approve", "reject", "abstain"]);
 var STATUSES  = Object.freeze(["pending", "approved", "rejected",
                                "executed", "cancelled", "escalated"]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -195,7 +195,7 @@ function _operatorId(s, label) {
     throw new TypeError("operatorApprovals: " + label +
       " must be a non-empty string (<= " + MAX_OPERATOR_ID_LEN + " chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("operatorApprovals: " + label + " must not contain control bytes");
   }
   return s;
@@ -206,7 +206,7 @@ function _reason(s) {
     throw new TypeError("operatorApprovals: reason must be a non-empty string <= " +
       MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorApprovals: reason must not contain control bytes (except whitespace)");
   }
   return s;
@@ -217,7 +217,7 @@ function _justification(s) {
     throw new TypeError("operatorApprovals: justification must be a non-empty string <= " +
       MAX_JUSTIFICATION_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorApprovals: justification must not contain control bytes (except whitespace)");
   }
   return s;
@@ -229,7 +229,7 @@ function _comment(s) {
     throw new TypeError("operatorApprovals: comment must be a string <= " +
       MAX_COMMENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorApprovals: comment must not contain control bytes (except whitespace)");
   }
   return s;
@@ -317,9 +317,7 @@ function _capability(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_ACTION_KIND_LEN) {
     throw new TypeError("operatorApprovals: required_capability must be a non-empty string or null");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorApprovals: required_capability must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorApprovals: required_capability", { singleLine: "reject" });
   return s;
 }
 

package/lib/operator-audit-log.js

@@ -104,16 +104,13 @@ var ALLOWED_UA_CLASSES  = Object.freeze([
 // discipline matches every other operator-facing primitive (catalog,
 // experiments, promo-banners) — strings reach the dashboard as inert
 // text, never as live markup.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var IDENT_RE = /^[A-Za-z0-9][A-Za-z0-9._:\-]{0,127}$/;
 var ACTION_RE = /^[A-Za-z0-9][A-Za-z0-9._:\-]{0,127}$/;
 var KIND_RE   = /^[A-Za-z0-9][A-Za-z0-9._\-]{0,63}$/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -148,9 +145,7 @@ function _ipHash(s) {
     throw new TypeError("operatorAuditLog: ip_hash must be a non-empty string ≤ " +
       MAX_IP_HASH_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorAuditLog: ip_hash contains control / zero-width characters");
-  }
+  textGuard.freeText(s, "operatorAuditLog: ip_hash", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/operator-help-center.js

@@ -109,11 +109,6 @@ var SLUG_RE    = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SECTION_RE = /^[a-z][a-z0-9_-]*$/;
 var ACTION_RE  = /^[a-z0-9](?:[a-z0-9._/:-]*[a-z0-9])?$/;
 
-var CONTROL_BYTE_BODY_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var SEARCH_WEIGHTS = Object.freeze({
   title:   3,
@@ -126,6 +121,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -168,12 +164,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorHelpCenter: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: title contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "operatorHelpCenter: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -188,12 +179,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorHelpCenter: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "operatorHelpCenter: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -304,9 +290,7 @@ function _queryStr(s) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError("operatorHelpCenter: query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: query contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "operatorHelpCenter: query", { zeroWidth: "reject" });
   return s;
 }
 
@@ -346,7 +330,7 @@ function _esc(s) {
 
 function _safeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_BODY_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, { zeroWidth: "reject" })) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;

package/lib/operator-inbox.js

@@ -165,6 +165,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -183,8 +184,6 @@ var MAX_BULK_IDS      = 200;
 var DEFAULT_LIMIT     = 50;
 var MAX_LIMIT         = 500;
 
-var CONTROL_BYTE_RE        = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
 
 var CURSOR_ORDER_KEY = Object.freeze(["created_at", "id"]);
 
@@ -249,9 +248,7 @@ function _subject(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("operatorInbox: subject must be a non-empty string <= " + MAX_SUBJECT_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorInbox: subject must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorInbox: subject");
   return s;
 }
 
@@ -259,9 +256,7 @@ function _body(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorInbox: body must be a non-empty string <= " + MAX_BODY_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorInbox: body must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorInbox: body");
   return s;
 }
 
@@ -284,9 +279,7 @@ function _sourceEventId(s) {
   if (typeof s !== "string" || s.length > MAX_SOURCE_LEN) {
     throw new TypeError("operatorInbox: source_event_id must be a string <= " + MAX_SOURCE_LEN + " chars");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("operatorInbox: source_event_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorInbox: source_event_id", { singleLine: "reject" });
   return s;
 }
 

package/lib/operator-roles.js

@@ -144,7 +144,6 @@ var MAX_LIST_LIMIT      = 500;
 // Slug shape matches the rest of the codebase — alnum-leading, alnum
 // + hyphen + underscore + dot, capped length.
 var SLUG_RE          = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
-var CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
 
 // Closed permission allow-list. Adding a new permission is a code
 // change here AND the operator re-defining the affected roles.
@@ -170,6 +169,7 @@ var PERMISSIONS = Object.freeze([
 var ALLOWED_PATCH_COLUMNS = Object.freeze(["title", "permissions", "description"]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -185,9 +185,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorRoles: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorRoles: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorRoles: title", { singleLine: "reject" });
   return s;
 }
 
@@ -196,7 +194,7 @@ function _description(s) {
   if (typeof s !== "string" || s.length > MAX_DESC_LEN) {
     throw new TypeError("operatorRoles: description must be a string <= " + MAX_DESC_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorRoles: description must not contain control bytes (except whitespace)");
   }
   return s;
@@ -231,7 +229,7 @@ function _operatorId(s, label) {
   if (typeof s !== "string" || !s.length || s.length > MAX_OPERATOR_ID_LEN) {
     throw new TypeError("operatorRoles: " + label + " must be a non-empty string (<= " + MAX_OPERATOR_ID_LEN + " chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("operatorRoles: " + label + " must not contain control bytes");
   }
   return s;
@@ -241,7 +239,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("operatorRoles: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorRoles: reason must not contain control bytes (except whitespace)");
   }
   return s;

package/lib/order-escalation.js

@@ -61,7 +61,6 @@ var COUNTRY_RE          = /^[A-Z]{2}$/;
 var PAYMENT_KIND_RE     = /^[a-z0-9][a-z0-9_-]{0,31}$/;
 var TAG_RE              = /^[A-Za-z0-9][A-Za-z0-9._:\-]{0,63}$/;
 var TEMPLATE_RE         = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var SEVERITIES          = Object.freeze(["info", "warning", "critical"]);
 var SEVERITY_RANK       = Object.freeze({ info: 0, warning: 1, critical: 2 });
@@ -85,6 +84,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -322,7 +322,7 @@ function _freeText(v, label, max) {
   if (v.length > max) {
     throw new TypeError("orderEscalation: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(v)) {
+  if (textGuard.hasCodepointThreat(v)) {
     throw new TypeError("orderEscalation: " + label + " must not contain control bytes");
   }
   return v;

package/lib/order-export.js

@@ -117,6 +117,7 @@ var DEFAULT_BATCH_SIZE = 500;
 var MAX_BATCH_SIZE     = 5000;
 var MAX_LIST_LIMIT     = 200;
 var EMAIL_HASH_PREFIX  = "order-export-email";
+var CSV_LINE_ENDING    = "\r\n";   // RFC 4180
 var FORMATS            = Object.freeze(["csv", "ndjson"]);
 var EXPORT_STATUSES    = Object.freeze(["queued", "running", "complete", "failed", "cancelled"]);
 
@@ -209,17 +210,6 @@ function _limit(n) {
 
 // ---- CSV helpers --------------------------------------------------------
 
-// RFC-4180 quoting: every cell wrapped in `"`, embedded `"` doubled.
-// We quote unconditionally — the cost is a few extra bytes per cell;
-// the win is that a downstream parser never has to track quote-vs-
-// bare-cell state for a column with mixed shapes. The injection
-// neutralization runs first via the shared vendored primitive.
-function _csvCell(value) {
-  var s = _coerceCell(value);
-  s = _neutralizeInjection(s);
-  return '"' + s.replace(/"/g, '""') + '"';
-}
-
 function _coerceCell(value) {
   if (value == null) return "";
   if (typeof value === "string") return value;
@@ -239,14 +229,29 @@ function _coerceCell(value) {
 // numerics (`+15.00`); the shared primitive prefixes those too (the safe
 // OWASP posture — `-2+3+cmd|…` is a real injection that begins like an
 // amount), which is the more complete behavior this consolidation buys.
-function _neutralizeInjection(s) {
-  return b.guardCsv.escapeCell(s);
-}
-
+// One export row, RFC 4180.
+//
+// b.guardCsv.serialize does the whole line: the formula-injection prefix on
+// every cell, the unconditional quoting, doubling an embedded quote, the
+// delimiter and the CRLF. Only the injection step was composed before; the
+// quoting rules were written here and again in customer-segments.js.
+//
+// Cells are quoted unconditionally. It costs a few bytes and means a
+// downstream parser never has to track quote-versus-bare state on a column
+// with mixed shapes.
+//
+// serialize emits the rows it is given WITHOUT a trailing terminator, which is
+// right for a whole document and wrong for a generator yielding one row at a
+// time — so the line ending is appended here. Verified byte-identical to the
+// previous builder across formula-injection, embedded-quote, embedded-comma,
+// newline, tab and empty cells.
 function _csvRow(cells) {
-  var parts = [];
-  for (var i = 0; i < cells.length; i += 1) parts.push(_csvCell(cells[i]));
-  return parts.join(",") + "\r\n";
+  return b.guardCsv.serialize([cells.map(_coerceCell)], {
+    profile:     "strict",
+    alwaysQuote: true,
+    headers:     false,
+    lineEnding:  CSV_LINE_ENDING,
+  }) + CSV_LINE_ENDING;
 }
 
 // ---- row projection -----------------------------------------------------
@@ -758,8 +763,7 @@ function create(opts) {
     // Exposed for the test suite so it can assert column semantics
     // without having to thread orders through a full DB round-trip.
     _projectOrder:      _projectOrder,
-    _csvCell:           _csvCell,
-    _neutralizeInjection: _neutralizeInjection,
+    _csvRow:            _csvRow,
     // Exposed only to keep the linter quiet about the unused `order`
     // binding when an integrator wires it later — the export reads
     // directly today, but the indirection is preserved.

package/lib/order-notes.js

@@ -46,7 +46,6 @@ var ALLOWED_VISIBILITY  = ["internal", "customer_visible"];
 // Refuse C0 control bytes + DEL + the LRM/RLM/ZWJ/ZWNJ family of
 // zero-width / direction-override characters. Newlines (LF, CR) +
 // tab are tolerated because operator notes legitimately wrap.
-var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 // Zero-width + direction-override family: ZWSP/ZWNJ/ZWJ (U+200B-200D),
 // LRM/RLM (U+200E/U+200F), the bidi-formatting block
 // (U+202A-U+202E), the invisible-math block (U+2060-U+2064), the
@@ -54,9 +53,6 @@ var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 // Arabic letter mark (U+061C). Spelled with \u-escapes so the
 // detector pattern stays grep-able and ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE       = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // (pinned DESC, created_at DESC, id DESC) — pinned notes float to
 // the top; the id tie-break keeps cursor pagination deterministic
@@ -65,6 +61,7 @@ var LIST_ORDER_KEY = ["pinned:desc", "created_at:desc", "id:desc"];
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -98,12 +95,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("orderNotes: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderNotes: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("orderNotes: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "orderNotes: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -124,7 +116,7 @@ function _tags(input) {
     if (t.length > MAX_TAG_LEN) {
       throw new TypeError("orderNotes: tags[" + i + "] must be <= " + MAX_TAG_LEN + " characters");
     }
-    if (CONTROL_BYTE_RE.test(t) || ZERO_WIDTH_RE.test(t)) {
+    if (textGuard.hasCodepointThreat(t, { zeroWidth: "reject" })) {
       throw new TypeError("orderNotes: tags[" + i + "] contains control / zero-width bytes");
     }
     out.push(t);
@@ -139,9 +131,7 @@ function _resolution(s) {
   if (s.length > MAX_RESOLUTION_LEN) {
     throw new TypeError("orderNotes: resolution must be <= " + MAX_RESOLUTION_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("orderNotes: resolution contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "orderNotes: resolution", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/order-ratings.js

@@ -74,6 +74,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -88,7 +89,6 @@ var MAX_LIST_LIMIT        = 500;
 var DEFAULT_TOP_LIMIT     = 10;
 var MAX_TOP_LIMIT         = 100;
 
-var CONTROL_BYTE_RE       = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -130,9 +130,7 @@ function _comment(s) {
   if (s.length > MAX_COMMENT_LEN) {
     throw new TypeError("orderRatings: comment must be <= " + MAX_COMMENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: comment must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: comment");
   return s;
 }
 
@@ -140,9 +138,7 @@ function _flagReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_FLAG_REASON_LEN) {
     throw new TypeError("orderRatings: reason must be a non-empty string <= " + MAX_FLAG_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: reason");
   return s;
 }
 
@@ -150,9 +146,7 @@ function _responseText(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RESPONSE_LEN) {
     throw new TypeError("orderRatings: response must be a non-empty string <= " + MAX_RESPONSE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: response must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: response");
   return s;
 }
 

package/lib/payment-methods.js

@@ -49,6 +49,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var PROCESSORS = ["stripe", "paypal", "square", "braintree", "authorize_net"];
 var ARCHIVE_REASONS = ["customer_request", "expired", "replaced", "fraud", "operator"];
@@ -65,7 +66,6 @@ var MAX_ACTOR_LEN = 128;
 // branch-on-this dispatch key.
 var BRAND_RE = /^[A-Za-z0-9 _.\-]{1,32}$/;
 var LAST4_RE = /^[0-9]{4}$/;
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // PAN screen: any field whose value is a string carrying 13-19
 // consecutive ASCII digits (with or without space/dash separators
@@ -125,9 +125,7 @@ function _brand(s) {
   if (s.length > MAX_BRAND_LEN) {
     throw new TypeError("paymentMethods: brand must be <= " + MAX_BRAND_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: brand contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: brand", { singleLine: "reject" });
   if (!BRAND_RE.test(s)) {
     throw new TypeError("paymentMethods: brand contains characters outside [A-Za-z0-9 _.-]");
   }
@@ -142,9 +140,7 @@ function _label(s) {
   if (s.length > MAX_LABEL_LEN) {
     throw new TypeError("paymentMethods: label must be <= " + MAX_LABEL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: label contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: label", { singleLine: "reject" });
   return s;
 }
 
@@ -155,9 +151,7 @@ function _token(s) {
   if (s.length > MAX_TOKEN_LEN) {
     throw new TypeError("paymentMethods: processor_token must be <= " + MAX_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: processor_token contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: processor_token", { singleLine: "reject" });
   return s;
 }
 
@@ -187,9 +181,7 @@ function _actor(s) {
   if (s.length > MAX_ACTOR_LEN) {
     throw new TypeError("paymentMethods: actor must be <= " + MAX_ACTOR_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: actor contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: actor", { singleLine: "reject" });
   return s;
 }
 

package/lib/payment-retries.js

@@ -129,6 +129,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -147,10 +148,6 @@ var MS_PER_HOUR           = C.TIME.hours(1);
 
 var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var FAILURE_CODE_RE  = /^[a-z](?:[a-z0-9_]*[a-z0-9])?$/;
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -232,9 +229,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("paymentRetries: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("paymentRetries: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "paymentRetries: reason", { zeroWidth: "reject" });
   return s;
 }