@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/payment.js

@@ -29,26 +29,21 @@
  *   token can't smuggle unsigned events into the order pipeline.
  */
 
-var nodeHttps = require("node:https");   // allow:non-shop-require — the PSP TLS agent must be a real node https.Agent for the vendored httpClient's caller-agent (h1) path; no b.* primitive constructs one, and the framework's downgrade prescription is an explicitly-built agent in the consumer's diff
-
 var b = require("./vendor/blamejs");
 var C = b.constants;
 
-// External payment processors do not negotiate the framework's PQC-hybrid
-// TLS groups yet: the vendored httpClient offers ONLY ML-KEM hybrid groups
-// (constants.TLS_GROUP_PREFERENCE), and api.stripe.com / api-m.paypal.com
-// answer that ClientHello with handshake_failure (TLS alert 40) — which
-// surfaced as a checkout failure the moment a charge was attempted. The
-// framework's own prescription for a peer that can't meet the PQC list is
-// an explicitly-constructed agent so the downgrade is visible in this
-// diff: TLS 1.3 minimum stays pinned, the key-exchange groups fall back to
-// Node's defaults (classical X25519 / P-256 today). The vendored client
-// honors a caller agent per request (h1 path) while keeping its SSRF-
-// pinned DNS lookup, retries, and response caps. Scoped to the PSP dials
-// only — every other outbound keeps the PQC-first default. Revisit when
-// the processor edges negotiate ML-KEM hybrid groups.
-var _PSP_TLS_AGENT = new nodeHttps.Agent({ keepAlive: true, minVersion: "TLSv1.3" });
-
+// The processor dials carry no caller-supplied TLS agent. They used to: the
+// framework's outbound group list was once hybrid-only, and api.stripe.com
+// answered that ClientHello with handshake_failure (TLS alert 40), so these
+// three dials pinned an explicitly-built agent on Node's default groups to
+// keep checkout working. That list now ends in classical X25519 as a
+// last-resort floor, so the framework's own posture already negotiates with
+// both processors, and the pinned agent had become a downgrade rather than a
+// workaround — it forced classical key exchange on a peer that offers an
+// ML-KEM hybrid, and it bypassed the client's post-handshake downgrade
+// auditing. Without an agent the vendored client builds its own through
+// b.pqcAgent, which locks the key exchange to b.network.tls.outboundPosture()
+// and therefore follows b.network.tls.preferredGroups.set(...) at runtime.
 var STRIPE_API_BASE_DEFAULT  = "https://api.stripe.com/v1";
 var STRIPE_WEBHOOK_TOLERANCE = 300;   // ± 5 minutes (Stripe default)
 var STRIPE_HTTP_TIMEOUT_MS   = 15000;
@@ -330,7 +325,6 @@ async function _stripeCall(opts, method, path, params, idempotencyKey) {
       headers:      headers,
       body:         body || undefined,
       timeoutMs:    opts.timeoutMs || STRIPE_HTTP_TIMEOUT_MS,
-      agent:        _PSP_TLS_AGENT,
       allowedHosts: [opts._allowedHost],
     });
     var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
@@ -832,7 +826,12 @@ function stripe(opts) {
 var PAYPAL_API_BASE_LIVE    = "https://api-m.paypal.com";
 var PAYPAL_API_BASE_SANDBOX = "https://api-m.sandbox.paypal.com";
 var PAYPAL_HTTP_TIMEOUT_MS  = 15000;
-var PAYPAL_TOKEN_SKEW_MS    = C.TIME.minutes(2); // refresh this far before expiry
+// How far before expiry the token manager re-fetches. Two minutes rather than
+// the primitive's default minute, so a token cannot expire mid-checkout on a
+// slow Orders-v2 round trip.
+// allow:raw-time-literal — clientCredentialsManager takes refreshSkewSec in
+// SECONDS; C.TIME returns milliseconds and cannot express this argument.
+var PAYPAL_TOKEN_SKEW_SEC   = 120;
 
 // PayPal rejects decimal places for these currencies; everything else is
 // 2-decimal. Amounts cross the wire as decimal strings in MAJOR units.
@@ -896,43 +895,88 @@ function _headerCI(headers, name) {
   return undefined;
 }
 
-async function _paypalToken(opts, state) {
-  var now = state.now();
-  if (state.token && now < state.tokenExpiresAt) return state.token;
-  var httpClient = opts.httpClient || b.httpClient;
-  var basic = Buffer.from(opts.clientId + ":" + opts.secret).toString("base64");
-  // The client-credentials token exchange is idempotent (re-asking for a
-  // token is always safe), so it rides the breaker AND the bounded retry.
-  var json = await _dial(opts._breaker, true, async function () {
-    var res = await httpClient.request({
-      method:  "POST",
-      url:     _paypalApiBase(opts) + "/v1/oauth2/token",
-      headers: {
-        "authorization":  "Basic " + basic,
-        "accept":         "application/json",
-        "content-type":   "application/x-www-form-urlencoded",
-        "user-agent":     "blamejs-shop (zero-dep)",
-      },
-      body:         "grant_type=client_credentials",
-      timeoutMs:    opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
-      agent:        _PSP_TLS_AGENT,
-      allowedHosts: [_paypalAllowedHost(opts)],
-    });
-    var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
-    var parsed; try { parsed = text.length ? b.safeJson.parse(text) : {}; } catch (_e) { parsed = {}; }
-    if (res.statusCode < 200 || res.statusCode >= 300 || !parsed.access_token) {
-      var err = new Error("paypal: OAuth2 token exchange failed → HTTP " + res.statusCode +
-                          (parsed && parsed.error_description ? " — " + parsed.error_description : ""));
-      err.code = "PAYPAL_AUTH_" + res.statusCode;
-      err.statusCode = res.statusCode;
-      throw err;
-    }
-    return parsed;
+// The PayPal client-credentials bearer token, through b.auth.oauth.
+//
+// The manager owns the whole grant: a cached token, ONE shared in-flight fetch
+// so a burst of checkouts on a cold cache mints one token rather than one
+// each, a re-fetch before expiry, and a backoff window on a 429 during which
+// the still-valid cached token is served instead of hammering the endpoint.
+// PayPal rate-limits the token endpoint well below the rate a checkout burst
+// reaches, so each of those matters.
+//
+// It dials through THIS adapter's client rather than reaching for its own, so
+// the exchange keeps everything the Orders-v2 calls have: the per-upstream
+// circuit breaker, the bounded retry, the SSRF host pin, and the injected
+// opts.httpClient the tests drive. That seam is the reason this composes at
+// all — without it the token endpoint would be the one dial the circuit
+// protecting live checkouts could not see, which is exactly backwards, since
+// its failure is the clearest signal the upstream is unhealthy.
+//
+// PayPal requires HTTP Basic client authentication. client_secret_basic also
+// removes the secret from the request body rather than sending it twice.
+function _paypalTokenManager(opts, state) {
+  if (state.tokenManager) return state.tokenManager;
+  var httpClient  = opts.httpClient || b.httpClient;
+  var apiBase     = _paypalApiBase(opts);
+  var allowedHost = _paypalAllowedHost(opts);
+
+  // Re-asking for a token is always safe, so the exchange takes the retry arm
+  // of the dial alongside the breaker. Request options the caller sets win
+  // over these defaults — the framework's host pin wraps this client and
+  // disables redirect following per request, and that must not be overwritten.
+  //
+  // The two layers want opposite things from a failed exchange, so the dial
+  // gives each what it needs. A breaker only counts what THROWS, and
+  // b.httpClient resolves a 500 as an ordinary response, so a non-2xx has to
+  // be raised inside the dial or the token endpoint becomes invisible to the
+  // circuit. The OAuth client, meanwhile, wants the response itself so it can
+  // build its own typed error and read the reason PayPal gave. So the throw
+  // drives the retry and the breaker, and the response is handed back at the
+  // boundary once they are done with it. `statusCode` on the raised error is
+  // what makes the retry skip a 4xx and ride out a 5xx, while the breaker
+  // counts both — a sustained stream of 4xx is its own kind of unhealthy.
+  var dialer = {
+    request: function (reqOpts) {
+      var received = null;
+      return _dial(opts._breaker, true, async function () {
+        var res = await httpClient.request(Object.assign({
+          timeoutMs:    opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
+          allowedHosts: [allowedHost],
+        }, reqOpts));
+        received = res;
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          var err = new Error("paypal: token endpoint returned HTTP " + res.statusCode);
+          err.statusCode = res.statusCode;
+          throw err;
+        }
+        return res;
+      }).catch(function (e) {
+        // A response we actually received goes back to the OAuth client, which
+        // turns it into auth-oauth/token-error-<status> — the code its own
+        // backoff classifier reads. Anything else (a transport failure, or an
+        // open circuit that never dialled) is a real throw and propagates.
+        if (received && e && e.statusCode === received.statusCode) return received;
+        throw e;
+      });
+    },
+  };
+
+  var oauth = b.auth.oauth.create({
+    issuer:                  apiBase,
+    clientId:                opts.clientId,
+    clientSecret:            opts.secret,
+    tokenEndpoint:           apiBase + "/v1/oauth2/token",
+    tokenEndpointAuthMethod: "client_secret_basic",
+    http:                    { client: dialer, allowedHosts: [allowedHost] },
   });
-  state.token = json.access_token;
-  var ttlMs = (typeof json.expires_in === "number" ? json.expires_in : 0) * 1000; // allow:raw-time-literal — PayPal expires_in is a runtime seconds value; *1000 → ms
-  state.tokenExpiresAt = now + Math.max(0, ttlMs - PAYPAL_TOKEN_SKEW_MS);
-  return state.token;
+  state.tokenManager = oauth.clientCredentialsManager({
+    refreshSkewSec: PAYPAL_TOKEN_SKEW_SEC,
+  });
+  return state.tokenManager;
+}
+
+function _paypalToken(opts, state) {
+  return _paypalTokenManager(opts, state).getToken();
 }
 
 // `breaker` selects which circuit the dial rides — every payment call rides
@@ -970,7 +1014,6 @@ async function _paypalCall(opts, state, method, path, bodyObj, requestId, breake
       headers:      headers,
       body:         body,
       timeoutMs:    opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
-      agent:        _PSP_TLS_AGENT,
       allowedHosts: [allowedHost],
     });
     var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
@@ -1021,8 +1064,10 @@ function paypal(opts) {
   var state = {
     query:          opts.query || null,
     now:            typeof opts.now === "function" ? opts.now : function () { return Date.now(); },
-    token:          null,
-    tokenExpiresAt: 0,
+    // Built on first use and kept for the adapter's lifetime — the token
+    // cache, the shared in-flight fetch and the 429 backoff all live on it,
+    // so a per-call manager would throw every one of them away.
+    tokenManager:   null,
   };
 
   function _maybeIdempotent(operation, idempotencyKey, requestObj, doCall) {

package/lib/pixel-events.js

@@ -99,6 +99,7 @@
 var nodeCrypto = require("node:crypto");                                  // allow:non-shop-require allow:weak-hash-sha2 — Provider spec (Meta CAPI, Google EC, TikTok Events, Pinterest CAPI, Snap CAPI) mandates SHA-256 of the normalised identifier; blamejs.crypto exposes SHA3-512 / SHAKE256 / namespaceHash, none of which match the wire format ad platforms accept. Node's stdlib SHA-256 hash is the minimum-surface route.
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -132,10 +133,6 @@ var CURRENCY_RE     = /^[A-Z]{3}$/;
 var UA_CLASS_RE     = /^[a-z0-9._-]+$/;
 var IP_HASH_RE      = /^[0-9a-f]+$/;
 var SHA256_HEX_RE   = /^[0-9a-f]{64}$/;
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 // Conservative email shape — operator-facing storefronts already
 // validated this via the framework's address-input primitive; the
 // gate here is a defensive last-line check before we normalise +
@@ -218,9 +215,7 @@ function _pixelId(s) {
   if (s.length > MAX_PIXEL_ID_LEN) {
     throw new TypeError("pixelEvents: pixel_id must be <= " + MAX_PIXEL_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: pixel_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: pixel_id", { zeroWidth: "reject" });
   return s;
 }
 
@@ -231,9 +226,7 @@ function _accessToken(s) {
   if (s.length > MAX_ACCESS_TOKEN_LEN) {
     throw new TypeError("pixelEvents: access_token must be <= " + MAX_ACCESS_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: access_token contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: access_token", { zeroWidth: "reject" });
   return s;
 }
 
@@ -244,9 +237,7 @@ function _conversionUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pixelEvents: conversion_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: conversion_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: conversion_url", { zeroWidth: "reject" });
   // Every supported provider's conversion API is public HTTPS — refuse
   // anything else so an operator typo can't egress conversion data in
   // plaintext.
@@ -276,9 +267,7 @@ function _eventSourceUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pixelEvents: event_source_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: event_source_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: event_source_url", { zeroWidth: "reject" });
   if (!/^https?:\/\//i.test(s)) {
     throw new TypeError("pixelEvents: event_source_url must be an absolute http(s):// URL");
   }
@@ -293,9 +282,7 @@ function _email(s) {
   if (s.length > MAX_EMAIL_LEN) {
     throw new TypeError("pixelEvents: customer_email must be <= " + MAX_EMAIL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: customer_email contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: customer_email", { zeroWidth: "reject" });
   // Validate the trimmed form — normalisation strips leading /
   // trailing whitespace before hashing, so a "  alice@example.com  "
   // input still hashes to the canonical address. Reject only when
@@ -402,7 +389,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("pixelEvents: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pixelEvents: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -420,9 +407,7 @@ function _responseBody(s) {
   // already (the dispatch hook captured them); allow the full ASCII
   // range minus the zero-width / bidi block so a malicious provider
   // can't smuggle invisible bytes through the audit trail.
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: response_body contains zero-width / bidi-override bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: response_body", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/plan-changes.js

@@ -61,6 +61,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // Observability sink for batch-path settlement failures: the scheduler
 // reverts a due row to 'pending' and carries on when a Stripe push or a
@@ -79,10 +80,6 @@ var MAX_REASON_LEN = 280;
 // can land in cancel_reason and replay into the customer profile
 // screen, so the same "no direction-override / no invisible glyph"
 // floor applies.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -118,9 +115,7 @@ function _optReason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("planChanges: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("planChanges: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "planChanges: reason", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/product-qa.js

@@ -81,9 +81,9 @@ var MIN_CLEANUP_DAYS      = 1;
 var STATUSES              = Object.freeze(["pending", "approved", "rejected"]);
 var AUTHORS               = Object.freeze(["operator", "customer", "system"]);
 
-var CONTROL_BYTE_RE       = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- monotonic clock ---------------------------------------------------
@@ -116,7 +116,7 @@ function _body(s, label) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("productQA: " + label + " must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("productQA: " + label + " must not contain control bytes");
   }
   return s;
@@ -131,9 +131,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("productQA: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("productQA: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "productQA: reason");
   return s;
 }
 
@@ -167,9 +165,7 @@ function _sessionId(s) {
   if (s.length > MAX_SESSION_ID_LEN) {
     throw new TypeError("productQA: session_id must be <= " + MAX_SESSION_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("productQA: session_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "productQA: session_id");
   return s;
 }
 

package/lib/promo-banners.js

@@ -102,15 +102,10 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // operator dashboards. Newlines are allowed in `body` (multi-line
 // marketing copy is common); `headline` / `cta_label` refuse LF / CR
 // so a single-line presentation slot can't be smuggled into.
-var CONTROL_BYTE_LINE_RE   = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the gift-options
 // + order-notes catalogues. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "placement",
@@ -128,6 +123,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -164,10 +160,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("promoBanners: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -181,10 +177,10 @@ function _block(s, label, maxLen) {
   if (s.length > maxLen) {
     throw new TypeError("promoBanners: " + label + " must be ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("promoBanners: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -200,9 +196,7 @@ function _ctaUrl(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CTA_URL_LEN) {
     throw new TypeError("promoBanners: cta_url must be a non-empty string ≤ " + MAX_CTA_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("promoBanners: cta_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "promoBanners: cta_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     // /-rooted absolute path — refuse protocol-relative `//host`
     // (the second char being "/" turns the link into an off-site
@@ -230,9 +224,7 @@ function _imageUrl(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_IMAGE_URL_LEN) {
     throw new TypeError("promoBanners: image_url must be a non-empty string ≤ " + MAX_IMAGE_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("promoBanners: image_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "promoBanners: image_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError("promoBanners: image_url protocol-relative `//host/...` refused — use absolute https://");

package/lib/purchase-orders.js

@@ -96,10 +96,6 @@ var REFERENCE_RE           = /^[A-Za-z0-9][A-Za-z0-9._\/ -]{0,127}$/;
 // as vendors. Operator-rendered text fields refuse these to keep the
 // downstream dashboard / printout safe from header-injection +
 // visual-spoofing attacks.
-var CONTROL_BYTE_RE        = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var PO_STATUSES = Object.freeze([
   "draft", "submitted", "confirmed", "partially_received",
@@ -117,6 +113,7 @@ var ALLOWED_UPDATE_COLUMNS = Object.freeze([
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -212,10 +209,10 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("purchase-orders: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("purchase-orders: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("purchase-orders: " + label + " contains zero-width / direction-override bytes");
   }
   return s;

package/lib/push-notifications.js

@@ -69,6 +69,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -114,10 +115,6 @@ var RETRY_BACKOFF_MS = [
 
 var SLUG_RE         = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var LOCALE_RE       = /^[A-Za-z]{2,8}(?:[-_][A-Za-z0-9]{2,8}){0,3}$/;
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -162,12 +159,7 @@ function _credentials(s) {
   if (s.length > MAX_CREDENTIALS_LEN) {
     throw new TypeError("pushNotifications: credentials must be <= " + MAX_CREDENTIALS_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: credentials contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: credentials contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: credentials", { zeroWidth: "reject" });
   return s;
 }
 
@@ -178,12 +170,7 @@ function _deviceToken(s) {
   if (s.length > MAX_TOKEN_LEN) {
     throw new TypeError("pushNotifications: device_token must be <= " + MAX_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: device_token contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: device_token contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: device_token", { zeroWidth: "reject" });
   return s;
 }
 
@@ -208,12 +195,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("pushNotifications: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: title contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: title contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: title", { zeroWidth: "reject" });
   return s;
 }
 
@@ -224,12 +206,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("pushNotifications: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: body contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -267,7 +244,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("pushNotifications: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pushNotifications: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -280,9 +257,7 @@ function _providerMessageId(s) {
   if (s.length > MAX_PROV_MSG_ID_LEN) {
     throw new TypeError("pushNotifications: provider_message_id must be <= " + MAX_PROV_MSG_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: provider_message_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pushNotifications: provider_message_id", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/pwa-manifest.js

@@ -168,12 +168,9 @@ var ICON_SIZES_RE = /^(?:any|\d+x\d+)(?:\s+(?:any|\d+x\d+))*$/;
 // spec recommends (image/png / image/svg+xml / image/webp).
 var ICON_TYPE_RE = /^[a-z]+\/[a-z0-9.+-]+$/;
 
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -202,10 +199,10 @@ function _string(s, label, max) {
   if (s.length > max) {
     throw new TypeError("pwaManifest: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("pwaManifest: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pwaManifest: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -270,7 +267,7 @@ function _url(s, label) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pwaManifest: " + label + " must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pwaManifest: " + label + " contains control / zero-width bytes");
   }
   if (s.charCodeAt(0) === 47 /* "/" */) {
@@ -416,10 +413,8 @@ function _validateRuntimeRules(rules) {
         MAX_URL_PATTERN_LEN + " characters"
       );
     }
-    if (CONTROL_BYTE_RE.test(r.url_pattern) || ZERO_WIDTH_RE.test(r.url_pattern)) {
-      throw new TypeError(
-        "pwaManifest: runtime_rules[" + i + "].url_pattern contains control / zero-width bytes"
-      );
+    if (textGuard.hasCodepointThreat(r.url_pattern, { zeroWidth: "reject" })) {
+      throw new TypeError("pwaManifest: runtime_rules[" + i + "].url_pattern contains control / zero-width bytes");
     }
     _enum(r.strategy, ALLOWED_STRATEGIES, "runtime_rules[" + i + "].strategy");
     if (seen[r.url_pattern]) {