@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/quotes.js

@@ -145,11 +145,6 @@ var VIEW_TOKEN_RE        = /^[A-Za-z0-9_-]{43}$/;
 // are allowed inside multi-line free-text fields (message,
 // operator_notes, line.notes); single-line fields (terms, reject /
 // cancel reason, accepted_by) refuse them too.
-var CONTROL_BYTE_RE             = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_MULTILINE_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var QUOTE_STATUSES = Object.freeze([
   "requested", "responded", "accepted", "rejected",
@@ -160,6 +155,7 @@ var TERMINAL_STATUSES = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // The quote lifecycle, modelled on b.fsm — the same composition the order
 // primitive uses (lib/order.js#_getOrderFsm). The FSM is the single source of
@@ -316,10 +312,10 @@ function _optShortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("quotes: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("quotes: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("quotes: " + label + " contains zero-width / direction-override bytes");
   }
   return s;
@@ -336,10 +332,10 @@ function _optLongText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("quotes: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_MULTILINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("quotes: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("quotes: " + label + " contains zero-width / direction-override bytes");
   }
   return s;

package/lib/referrals.js

@@ -161,13 +161,17 @@ function _alphabetRe(alphabet) {
   // default alphabet has none, but an operator-supplied 32-char set
   // could legally include `]` or `-`.
   var escaped = alphabet.replace(/[\\\]^-]/g, "\\$&");
-  // A single anchored character class (`^[…]+$`) is structurally incapable of
+  var source  = "^[" + escaped + "]+$";
+  // A single anchored character class is structurally incapable of
   // catastrophic backtracking — one unbounded quantifier over a class, no
-  // grouped repetition — so it needs no ReDoS screen. (The framework's
-  // b.guardRegex screen is deliberately not composed here: it accepts this
-  // shape, but its text scan false-positives on `(?:…)?` group forms, so
-  // relying on it is avoided until the upstream fix lands.)
-  return new RegExp("^[" + escaped + "]+$");
+  // grouped repetition. The screen still runs: the class body is built from an
+  // operator-supplied alphabet, so it is the escaping above, not the shape,
+  // that keeps this pattern to one class. If a character ever escapes that
+  // replace and closes the class early, the result stops being the safe shape
+  // this reasoning depends on, and the screen catches it at config time rather
+  // than at match time.
+  b.guardRegex.assertSafe(source);
+  return new RegExp(source);
 }
 
 // ---- factory ------------------------------------------------------------

package/lib/reviews.js

@@ -50,9 +50,9 @@ var REVIEW_ORDER_KEY   = ["created_at:desc", "id:desc"];
 var CUSTOMER_ORDER_KEY = ["created_at:desc", "id:desc"];
 
 var ALLOWED_STATUSES   = ["pending", "published", "rejected"];
-var CONTROL_BYTE_RE    = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -75,9 +75,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("reviews: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("reviews: title contains control bytes");
-  }
+  textGuard.freeText(s, "reviews: title");
   return s;
 }
 
@@ -89,9 +87,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("reviews: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("reviews: body contains control bytes");
-  }
+  textGuard.freeText(s, "reviews: body");
   return s;
 }
 
@@ -288,9 +284,7 @@ function create(opts) {
         if (reason.length > MAX_REJECT_REASON_LEN) {
           throw new TypeError("reviews.reject: reason must be <= " + MAX_REJECT_REASON_LEN + " characters");
         }
-        if (CONTROL_BYTE_RE.test(reason)) {
-          throw new TypeError("reviews.reject: reason contains control bytes");
-        }
+        textGuard.freeText(reason, "reviews.reject: reason");
       }
       var ts = _now();
       var existing = (await query("SELECT id, status FROM reviews WHERE id = ?1", [id])).rows[0];

package/lib/robots-config.js

@@ -96,9 +96,9 @@ var MAX_CRAWL_DELAY     = 86400;     // 24 h — anything larger is a typo
 var MAX_PRIORITY        = 1000000;
 var MAX_RULE_ID_LEN     = 80;
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- predefined templates ---------------------------------------------
 //
@@ -183,9 +183,7 @@ function _userAgent(s) {
       "robotsConfig: user_agent must be a string 1.." + MAX_USER_AGENT_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("robotsConfig: user_agent must not contain control bytes");
-  }
+  textGuard.freeText(s, "robotsConfig: user_agent", { singleLine: "reject" });
   // robots.txt is a colon-delimited key/value format — a colon in the
   // user-agent value would shift the parser onto a different key.
   if (s.indexOf(":") !== -1) {
@@ -200,7 +198,7 @@ function _pathEntry(s, label) {
       "robotsConfig: " + label + " entry must be a string 1.." + MAX_PATH_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("robotsConfig: " + label + " entry must not contain control bytes");
   }
   // robots.txt path entries are /-rooted absolute paths. Wildcards
@@ -258,9 +256,7 @@ function _ruleId(s) {
       "robotsConfig: rule_id must be a string 1.." + MAX_RULE_ID_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("robotsConfig: rule_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "robotsConfig: rule_id", { singleLine: "reject" });
   return s;
 }
 
@@ -270,9 +266,7 @@ function _sitemapUrl(u) {
       "robotsConfig: sitemap url must be a string 1.." + MAX_SITEMAP_URL_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_RE.test(u)) {
-    throw new TypeError("robotsConfig: sitemap url must not contain control bytes");
-  }
+  textGuard.freeText(u, "robotsConfig: sitemap url", { singleLine: "reject" });
   // robots.txt only carries the URL itself, so the path-rooted form
   // promo-banners accepts isn't meaningful here — every crawler treats
   // the Sitemap: value as an absolute URL. https-only protects against
@@ -293,9 +287,7 @@ function _hostDirective(s) {
       "robotsConfig: host must be a string 1.." + MAX_HOST_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("robotsConfig: host must not contain control bytes");
-  }
+  textGuard.freeText(s, "robotsConfig: host", { singleLine: "reject" });
   // The host directive is a bare hostname (optionally with :port) —
   // no scheme, no path. Refuse anything that looks like a URL so an
   // operator can't accidentally paste the full origin URL in.

package/lib/sales-tax-filings.js

@@ -104,6 +104,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -122,7 +123,6 @@ var DEFAULT_LIMIT          = 50;
 var MAX_LIMIT              = 500;
 var MAX_DAYS_AHEAD         = 365;
 
-var CONTROL_BYTE_RE        = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // FSM transition map. The keys are (from_status, action) → to_status.
 // Defined as a table so a misuse surfaces with the actual current
@@ -211,7 +211,7 @@ function _shortText(s, label, max) {
     throw new TypeError("salesTaxFilings: " + label +
                         " must be a non-empty string <= " + max + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("salesTaxFilings: " + label + " must not contain control bytes");
   }
   return s;

package/lib/search-facets.js

@@ -106,7 +106,6 @@ var ALLOWED_KINDS  = ["categorical", "numeric_range", "boolean"];
 var ALLOWED_COLS   = ["field", "kind", "buckets_json", "display_limit", "active"];
 
 // Refuse C0 control bytes + DEL on every operator-supplied string.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // Operator-chosen identifier shape — lowercase alnum + hyphen +
 // underscore, must start with a letter. Same shape the rest of the
@@ -118,6 +117,7 @@ var KEY_RE   = /^[a-z][a-z0-9_-]*$/;
 var FIELD_RE = /^[a-z][a-z0-9_-]*$/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -175,7 +175,7 @@ function _label(s, fnLabel) {
   if (s.length > MAX_LABEL_LEN) {
     throw new TypeError(fnLabel + ": bucket label must be <= " + MAX_LABEL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError(fnLabel + ": bucket label must not contain control bytes");
   }
   return s;
@@ -291,7 +291,7 @@ function _appliedFilters(input, fnLabel) {
       if (s.length > MAX_VALUE_LEN) {
         throw new TypeError(fnLabel + ": applied_filters['" + k + "'][" + j + "] must be <= " + MAX_VALUE_LEN + " characters");
       }
-      if (CONTROL_BYTE_RE.test(s)) {
+      if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
         throw new TypeError(fnLabel + ": applied_filters['" + k + "'][" + j + "] must not contain control bytes");
       }
       values.push(s);
@@ -318,7 +318,7 @@ function _value(raw, fnLabel) {
   if (s.length > MAX_VALUE_LEN) {
     throw new TypeError(fnLabel + ": value must be <= " + MAX_VALUE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError(fnLabel + ": value must not contain control bytes");
   }
   return s;
@@ -331,7 +331,7 @@ function _sessionId(s, fnLabel) {
   if (s.length > 256) {
     throw new TypeError(fnLabel + ": session_id must be <= 256 characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError(fnLabel + ": session_id must not contain control bytes");
   }
   return s;

package/lib/search-ranking.js

@@ -121,12 +121,9 @@ var SIGNAL_RE             = /^[a-z][a-z0-9_-]*$/;
 // which covers SKU notation across every common upstream system
 // without opening the door to control bytes or whitespace.
 var PRODUCT_ID_RE         = /^[A-Za-z0-9._:/-]+$/;
-var CONTROL_BYTE_RE       = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE         = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -175,7 +172,7 @@ function _name(s, fnLabel) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError(fnLabel + ": name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError(fnLabel + ": name contains control / zero-width bytes");
   }
   return s;
@@ -226,7 +223,7 @@ function _normalizeQuery(s, fnLabel) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError(fnLabel + ": query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError(fnLabel + ": query contains control / zero-width bytes");
   }
   var normalized = s.toLowerCase().replace(/\s+/g, " ").trim();
@@ -270,7 +267,7 @@ function _sessionIdRaw(s, fnLabel) {
   if (s.length > MAX_SESSION_ID_LEN) {
     throw new TypeError(fnLabel + ": session_id must be <= " + MAX_SESSION_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError(fnLabel + ": session_id contains control / zero-width bytes");
   }
   return s;

package/lib/search-synonyms.js

@@ -102,18 +102,6 @@ var MAX_QUERY_LEN            = 500;
 var ALLOWED_KINDS         = ["bidirectional", "directional"];
 var ALLOWED_GROUP_COLS    = ["kind", "terms_json"];
 
-// Refuse C0 control bytes + DEL. Tokens are single-line search terms;
-// any newline / tab in a synonym entry would either be malformed
-// operator input or an attempt to smuggle separator-confusion payload
-// into the search log.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
-// Zero-width + direction-override family — same defense as
-// `supportTickets`. Spelled with \u escapes so the file stays
-// ESLint no-irregular-whitespace clean.
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
-
 // Slug shape — operator-chosen identifier on synonym groups. Same
 // shape the rest of the shop uses: lowercase alnum + hyphen, must
 // start with a letter, 1..MAX_SLUG_LEN.
@@ -126,6 +114,7 @@ var TOKEN_SPLIT_RE = /[^a-z0-9-]+/g;
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -166,10 +155,10 @@ function _term(s, label, fnLabel) {
   if (trimmed.length > MAX_TERM_LEN) {
     throw new TypeError(fnLabel + ": " + label + " must be <= " + MAX_TERM_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(trimmed)) {
+  if (textGuard.hasCodepointThreat(trimmed, { singleLine: "reject" })) {
     throw new TypeError(fnLabel + ": " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(trimmed)) {
+  if (textGuard.hasCodepointThreat(trimmed, { zeroWidth: "reject" })) {
     throw new TypeError(fnLabel + ": " + label + " contains zero-width / direction-override characters");
   }
   return trimmed;
@@ -247,13 +236,10 @@ function _queryString(s, fnLabel) {
 // give attackers a denial-of-search vector against legitimate
 // shoppers who happened to paste a stray BOM.
 function _sanitiseQuery(s) {
-  return s
-    .replace(/[\x00-\x1f\x7f]/g, " ")
-    .replace(
-      // Zero-width + direction-override family — see ZERO_WIDTH_RE.
-      new RegExp("[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]", "g"),
-      ""
-    );
+  // Controls become a SPACE, not nothing: deleting them outright would weld
+  // the words on either side into one token. The invisible characters do get
+  // deleted — they sit inside a word rather than between two.
+  return textGuard.scrubInvisible(s.replace(/[\x00-\x1f\x7f]/g, " "));
 }
 
 function _tokenise(s) {

package/lib/security-middleware.js

@@ -38,6 +38,10 @@
  * visitor in ONE bucket behind the fabric and let a single global limit
  * throttle the whole store.
  *
+ * That read goes through `b.requestHelpers.trustedClientIp`, which honours
+ * the forwarded header only when the socket peer sits inside the trusted
+ * range (see TRUSTED_PROXY_CIDRS) — a header alone never speaks for a client.
+ *
  * The container runs as a single instance (max_instances=1), so the
  * default in-memory rate-limit backend is correct — there is no second
  * replica to coordinate a shared counter with, and the in-memory token
@@ -274,12 +278,35 @@ function isEdgeExemptPath(pathname) {
 var PUBLIC_ORIGINS = (process.env.SHOP_PUBLIC_ORIGINS || "https://blamejs.shop")
   .split(",").map(function (s) { return s.trim(); }).filter(Boolean);
 
+// Which socket peers may speak for a client other than themselves.
+//
+// Same topology as resolveProtocol below: the container has no public ingress
+// and is reachable only through the Cloudflare Worker over the service
+// binding, so every peer that can open a socket here IS the edge — which is
+// what the all-addresses default states. It is written as a CIDR list rather
+// than an unconditional "believe the header" so that a deployment which does
+// expose the container directly has one value to narrow, and so the gate is
+// the framework's rather than a second trust model living here.
+//
+// Narrowing it is the right move the moment the container is reachable any
+// other way: an unlisted peer's forwarded headers are ignored and keying falls
+// back to that peer's own address.
+var TRUSTED_PROXY_CIDRS = (process.env.SHOP_TRUSTED_PROXIES || "0.0.0.0/0,::/0")
+  .split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+
+// The edge publishes the client address as `cf-connecting-ip` and overwrites
+// any value a client sent under that name. `x-real-ip` is the usual nginx
+// spelling and `x-forwarded-for` the multi-hop standard, kept for a
+// self-hosted deployment behind either. First header PRESENT wins, so an empty
+// leading header means "this request carries no forwarded address" rather than
+// deferring to one further down the list that a client may have set.
+var _trustedClientIp = b.requestHelpers.trustedClientIp({
+  trustedProxies:   TRUSTED_PROXY_CIDRS,
+  forwardedHeaders: ["cf-connecting-ip", "x-real-ip", "x-forwarded-for"],
+});
+
 /**
- * Resolve the real client IP for rate-limit keying. Reads the
- * Cloudflare-injected `cf-connecting-ip` first (the canonical single
- * client address behind the fabric), then `x-real-ip` (its mirror),
- * then falls back to the socket address via `b.requestHelpers.clientIp`
- * for direct connections (e2e harness, local dev). Always returns a
+ * Resolve the real client IP for rate-limit keying. Always returns a
  * non-empty string so two un-identifiable clients never collapse into
  * the same bucket as a real IP — request-shape reader, returns a
  * default, never throws.
@@ -292,15 +319,15 @@ var PUBLIC_ORIGINS = (process.env.SHOP_PUBLIC_ORIGINS || "https://blamejs.shop")
  * source on every request and mint unlimited buckets — walking every
  * per-IP limiter (and the captcha-IP budget) that keys off this value.
  * Keying on the /64 closes that while still distinguishing real end-sites.
+ *
+ * Resolution itself is `b.requestHelpers.trustedClientIp`, which reads the
+ * header family named below, folds an IPv4-mapped IPv6 peer, walks a multi-hop
+ * value right-to-left, and falls back to the socket address — one implementation
+ * shared with every other gate rather than a second, looser one here.
  */
 function clientKey(req) {
-  var headers = (req && req.headers) || {};
-  var cf = headers["cf-connecting-ip"];
-  if (typeof cf === "string" && cf.length > 0) return _ipBucket(cf.trim());
-  var real = headers["x-real-ip"];
-  if (typeof real === "string" && real.length > 0) return _ipBucket(real.trim());
-  var sock = b.requestHelpers.clientIp(req);
-  return sock ? _ipBucket(sock) : "unknown";
+  var ip = _trustedClientIp.resolve(req);
+  return ip ? _ipBucket(ip) : "unknown";
 }
 
 // Collapse one resolved client IP to its per-IP bucket key. ipKey returns
@@ -500,26 +527,6 @@ var _SCOPED_DIRECTIVES = {
 //   default-src 'self', object-src 'none',
 //   require-trusted-types-for 'script', frame-ancestors 'none', base-uri 'self'
 
-// Parse the vendored default CSP into an ordered directive map ONCE at
-// module load. The default is a `name a b; name c;` string; split on `;`,
-// the first token of each clause is the directive name, the rest its
-// source list.
-function _parseCsp(cspString) {
-  var order = [];
-  var map = {};
-  String(cspString).split(";").forEach(function (clause) {
-    var trimmed = clause.trim();
-    if (!trimmed) return;
-    var parts = trimmed.split(/\s+/);
-    var name = parts[0];
-    order.push(name);
-    map[name] = parts.slice(1);
-  });
-  return { order: order, map: map };
-}
-
-var _DEFAULT_CSP_PARSED = _parseCsp(_vendoredSecurityHeaders.DEFAULT_CSP);
-
 /**
  * Build a route-scoped CSP string from the vendored strict default plus the
  * named providers' hosts. `keys` is an array of CSP_HOSTS keys
@@ -538,40 +545,51 @@ var _DEFAULT_CSP_PARSED = _parseCsp(_vendoredSecurityHeaders.DEFAULT_CSP);
  * which fails safe (the SDK is refused, not admitted too broadly).
  */
 function scopedCsp(keys) {
-  // Clone the parsed default so the per-call mutation never leaks into the
-  // module-level snapshot.
-  var order = _DEFAULT_CSP_PARSED.order.slice();
-  var map = {};
-  _DEFAULT_CSP_PARSED.order.forEach(function (name) {
-    map[name] = _DEFAULT_CSP_PARSED.map[name].slice();
-  });
-
+  // Collect the hosts each named provider needs, per directive. Unknown keys
+  // fall out here, which is what keeps a mistyped key on the strict default
+  // rather than throwing mid-render.
+  var additions = {};
   if (Array.isArray(keys)) {
     keys.forEach(function (key) {
       var hostSet = CSP_HOSTS[key];
       if (!hostSet) return;
       Object.keys(_SCOPED_DIRECTIVES).forEach(function (directive) {
-        var subKey = _SCOPED_DIRECTIVES[directive];
-        var hosts = hostSet[subKey];
+        var hosts = hostSet[_SCOPED_DIRECTIVES[directive]];
         if (!hosts || !hosts.length) return;
-        if (!map[directive]) {
-          // The default omits frame-src (it relies on the default-src /
-          // fenced-frame-src pair); create it from 'self' so admitting a
-          // provider frame doesn't accidentally open it to everything.
-          map[directive] = ["'self'"];
-          order.push(directive);
-        }
-        hosts.forEach(function (h) {
-          if (map[directive].indexOf(h) === -1) map[directive].push(h);
-        });
+        additions[directive] = (additions[directive] || []).concat(hosts);
       });
     });
   }
 
-  return order.map(function (name) {
-    var srcs = map[name];
-    return srcs.length ? (name + " " + srcs.join(" ")) : name;
-  }).join("; ") + ";";
+  // b.csp.mergeDirectives owns the merge: append-and-dedupe per directive,
+  // seed a directive the base omits rather than leaving it wide open, and
+  // validate only what was added so the trusted default round-trips
+  // untouched. It replaces a CSP parser written here, which had to be kept
+  // in step with whatever shape the vendored default took.
+  //
+  // The primitive throws on a directive or source it will not accept. This
+  // runs per response while rendering a payment page, and the documented
+  // contract is that a bad input degrades to the strict default rather than
+  // failing the render — so a refusal is caught and answered with exactly
+  // that. Failing closed here means the provider is refused, never admitted
+  // more broadly than asked.
+  // The refusal is recorded rather than swallowed: it means a host in
+  // CSP_HOSTS is one the primitive will not accept, which is an operator
+  // configuration problem that would otherwise show up only as a payment SDK
+  // silently failing to load.
+  try {
+    return b.csp.mergeDirectives(undefined, additions);
+  } catch (e) {
+    b.audit.safeEmit({
+      action:   "shop.security.scopedCsp.refused",
+      outcome:  "failure",
+      metadata: {
+        keys:   Array.isArray(keys) ? keys.join(",") : String(keys),
+        reason: (e && e.message) || "unknown",
+      },
+    });
+    return _vendoredSecurityHeaders.DEFAULT_CSP;
+  }
 }
 
 // ---- route-scoped Permissions-Policy (payment + passkey surfaces) --------
@@ -618,7 +636,10 @@ function scopedCsp(keys) {
 // top-level same-origin document). Quote-wrapped per RFC 9651 structured
 // fields. Single source — every page that enables the payment feature names
 // it here.
-var _PAYMENT_ALLOWLIST = 'payment=(self "https://js.stripe.com" "https://pay.google.com")';
+// Allowlist VALUES, without the `feature=` prefix — that is the shape
+// b.csp.mergePermissionsPolicy takes, and it keeps the feature name in exactly
+// one place (the registry key) rather than repeated inside its own value.
+var _PAYMENT_ALLOWLIST = '(self "https://js.stripe.com" "https://pay.google.com")';
 
 // WebAuthn assertion / attestation run in the page's OWN top-level document
 // (the islands call navigator.credentials.get / .create directly, never from
@@ -628,8 +649,8 @@ var _PAYMENT_ALLOWLIST = 'payment=(self "https://js.stripe.com" "https://pay.goo
 // still cannot drive WebAuthn. Single source — every passkey page names the
 // feature → allowlist mapping here.
 var _PASSKEY_FEATURE_ALLOWLIST = {
-  "publickey-credentials-get":    "publickey-credentials-get=(self)",
-  "publickey-credentials-create": "publickey-credentials-create=(self)",
+  "publickey-credentials-get":    "(self)",
+  "publickey-credentials-create": "(self)",
 };
 
 // Feature name → its scoped allowlist token. The pay surface relaxes
@@ -670,12 +691,25 @@ function scopedPermissionsPolicy(opts) {
       overrides[name] = _SCOPED_FEATURE_OVERRIDES[name];
     }
   });
-  return _vendoredSecurityHeaders.DEFAULT_PERMISSIONS.map(function (entry) {
-    var feature = entry.split("=")[0];
-    return Object.prototype.hasOwnProperty.call(overrides, feature)
-      ? overrides[feature]
-      : entry;
-  }).join(", ");
+
+  // b.csp.mergePermissionsPolicy applies the overrides onto the vendored
+  // denylist, replacing a map-and-rejoin over that list here. The registry
+  // filter above still runs first, so an unnamed feature cannot be relaxed and
+  // an unknown one is dropped rather than passed to a primitive that refuses
+  // it — which preserves the documented never-throw behaviour on a render
+  // path. A refusal is still possible if a registry VALUE is malformed, and
+  // that is an operator configuration error worth surfacing rather than
+  // hiding behind a silently strict header.
+  try {
+    return b.csp.mergePermissionsPolicy(undefined, overrides);
+  } catch (e) {
+    b.audit.safeEmit({
+      action:   "shop.security.scopedPermissionsPolicy.refused",
+      outcome:  "failure",
+      metadata: { features: features.join(","), reason: (e && e.message) || "unknown" },
+    });
+    return _vendoredSecurityHeaders.DEFAULT_PERMISSIONS.join(", ");
+  }
 }
 
 /**
@@ -732,7 +766,7 @@ function botGuardOpts() {
       // directory (e.g. /.well-known/apple-...-association/anything), re-opening
       // the guard on routes that aren't the single static association file.
       .concat(PUBLIC_WELL_KNOWN_PATHS.map(function (p) {
-        return new RegExp("^" + p.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&") + "$");
+        return new RegExp("^" + b.codepointClass.escapeRegExp(p) + "$");
       }))
       .concat([/^\/admin(\/|$)/]),
   };
@@ -745,6 +779,28 @@ function _hasPrefix(pathname, prefixes) {
   return false;
 }
 
+// Skip matchers for the request-lifecycle guards, built once.
+//
+// b.requestHelpers.makeSkipMatcher takes the REQUEST rather than a pathname
+// the caller derived, which removes three copies of `req.pathname || req.url
+// || "/"` and keeps the exemption correct if a guard is ever mounted somewhere
+// the router has not already set `req.pathname` — the matcher strips the query
+// string itself rather than trusting the caller to have done it.
+//
+// Two matchers because the semantics differ: a webhook path is a PREFIX (the
+// processor may append to it) while the health path is EXACT (`/_/healthz`
+// must not inherit the exemption).
+var _skipWebhookPath = b.requestHelpers.makeSkipMatcher(
+  { skipPaths: WEBHOOK_PATHS.slice() }, "securityMiddleware.webhookSkip");
+var _skipHealthPath = b.requestHelpers.makeSkipMatcher(
+  { skipPaths: [HEALTH_PATH], exact: true }, "securityMiddleware.healthSkip");
+
+// Both guards exempt the same set: a server-to-server webhook authenticated by
+// its own signature, and the liveness probe.
+function _isUnguardedPath(req) {
+  return _skipWebhookPath(req) || _skipHealthPath(req);
+}
+
 /**
  * Mount the per-route tight rate limiters + the fetch-metadata gate on
  * the router inside the operator's `routes(r)` chain. Call AFTER the
@@ -803,7 +859,7 @@ function mountRouteGuards(r) {
   });
   r.use(function csrfGuard(req, res, next) {
     var pathname = req.pathname || req.url || "/";
-    if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();
+    if (_isUnguardedPath(req)) return next();
     if (isEdgeExemptPath(pathname)) return next();
     return csrfGate(req, res, next);
   });
@@ -825,8 +881,7 @@ function mountRouteGuards(r) {
     allowedNavigate: true,
   });
   r.use(function fetchMetadataGuard(req, res, next) {
-    var pathname = req.pathname || req.url || "/";
-    if (_hasPrefix(pathname, WEBHOOK_PATHS)) return next();
+    if (_skipWebhookPath(req)) return next();
     return fmGate(req, res, next);
   });
 
@@ -880,7 +935,7 @@ function mountRouteGuards(r) {
   r.use(function tightRateGuard(req, res, next) {
     var pathname = req.pathname || req.url || "/";
     // Never throttle the webhook or health paths.
-    if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();
+    if (_isUnguardedPath(req)) return next();
     if (!_hasPrefix(pathname, TIGHT_PREFIXES)) return next();
     // `/products/`, `/gift-cards`, and `/orders/` carry GET reads (PDP,
     // balance page render, order confirmation page) that a shopper hits