@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/seller-signup.js

@@ -129,12 +129,9 @@ var MIME_RE                   = /^[A-Za-z0-9!#$&^_.+\-]{1,127}\/[A-Za-z0-9!#$&^_
 // the shape vendors / purchase-orders use. Operator-rendered fields
 // refuse these to keep downstream dashboards / KYC printouts safe
 // from header-injection + visual-spoofing attacks.
-var CONTROL_BYTE_RE           = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -157,12 +154,7 @@ function _businessName(s) {
   if (s.length > MAX_BUSINESS_NAME_LEN) {
     throw new TypeError("seller-signup: business_name must be <= " + MAX_BUSINESS_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("seller-signup: business_name contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("seller-signup: business_name contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "seller-signup: business_name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -219,9 +211,7 @@ function _businessAddress(value) {
   if (encoded.length > MAX_ADDRESS_JSON_LEN) {
     throw new TypeError("seller-signup: business_address JSON must be <= " + MAX_ADDRESS_JSON_LEN + " characters serialised");
   }
-  if (CONTROL_BYTE_RE.test(encoded) || ZERO_WIDTH_RE.test(encoded)) {
-    throw new TypeError("seller-signup: business_address contains control / zero-width bytes");
-  }
+  textGuard.freeText(encoded, "seller-signup: business_address", { singleLine: "reject", zeroWidth: "reject" });
   return encoded;
 }
 
@@ -260,7 +250,7 @@ function _categoryFocus(value) {
     if (typeof value[i] !== "string" || !value[i].length) {
       throw new TypeError("seller-signup: category_focus[" + i + "] must be a non-empty string");
     }
-    if (CONTROL_BYTE_RE.test(value[i]) || ZERO_WIDTH_RE.test(value[i])) {
+    if (textGuard.hasCodepointThreat(value[i], { singleLine: "reject", zeroWidth: "reject" })) {
       throw new TypeError("seller-signup: category_focus[" + i + "] contains control / zero-width bytes");
     }
   }
@@ -305,9 +295,7 @@ function _referencesJson(value) {
   if (encoded.length > MAX_REFERENCES_JSON_LEN) {
     throw new TypeError("seller-signup: references_json must be <= " + MAX_REFERENCES_JSON_LEN + " characters serialised");
   }
-  if (CONTROL_BYTE_RE.test(encoded) || ZERO_WIDTH_RE.test(encoded)) {
-    throw new TypeError("seller-signup: references_json contains control / zero-width bytes");
-  }
+  textGuard.freeText(encoded, "seller-signup: references_json", { singleLine: "reject", zeroWidth: "reject" });
   return encoded;
 }
 
@@ -325,12 +313,10 @@ function _instructions(s) {
   if (s.length > MAX_INSTRUCTIONS_LEN) {
     throw new TypeError("seller-signup: instructions must be <= " + MAX_INSTRUCTIONS_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\n\r]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("seller-signup: instructions contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("seller-signup: instructions contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "seller-signup: instructions", { zeroWidth: "reject" });
   return s;
 }
 
@@ -341,12 +327,10 @@ function _rejectReason(s) {
   if (s.length > MAX_REJECT_REASON_LEN) {
     throw new TypeError("seller-signup: reason must be <= " + MAX_REJECT_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\n\r]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("seller-signup: reason contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("seller-signup: reason contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "seller-signup: reason", { zeroWidth: "reject" });
   return s;
 }
 
@@ -357,7 +341,7 @@ function _operatorId(s, label) {
   if (s.length > MAX_OPERATOR_ID_LEN) {
     throw new TypeError("seller-signup: " + label + " must be <= " + MAX_OPERATOR_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError("seller-signup: " + label + " contains control / zero-width bytes");
   }
   return s;

package/lib/sidebar-widgets.js

@@ -75,6 +75,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -125,11 +126,6 @@ var PAGE_KEY_RE   = /^[A-Za-z0-9][A-Za-z0-9:._\/-]{0,119}$/;
 var BADGE_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var SEGMENT_RE    = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 
-var CONTROL_BYTE_LINE_RE  = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "title",
@@ -176,12 +172,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("sidebarWidgets: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("sidebarWidgets: title must not contain control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("sidebarWidgets: title must not contain zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "sidebarWidgets: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -260,10 +251,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("sidebarWidgets: " + label + " must be a non-empty string <= " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain zero-width / direction-override characters");
   }
   return s;
@@ -273,10 +264,10 @@ function _block(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("sidebarWidgets: " + label + " must be a non-empty string <= " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain zero-width / direction-override characters");
   }
   return s;

package/lib/site-redirects.js

@@ -101,18 +101,15 @@ var MAX_REGEX_SOURCE_LEN  = 512;
 var MAX_LIMIT             = 1000;
 var DEFAULT_LIMIT         = 100;
 
-var CONTROL_BYTE_RE       = /[\x00-\x1f\x7f]/;
 // Zero-width + invisible bytes: U+200B (zero-width space),
 // U+200C (zero-width non-joiner), U+200D (zero-width joiner),
 // U+2060 (word joiner), U+FEFF (zero-width no-break space / BOM).
 // Source code uses escape sequences so the file itself stays
 // linter-clean (raw zero-width bytes in source trip both
 // no-irregular-whitespace and no-misleading-character-class).
-var ZERO_WIDTH_RE         = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // Monotonic clock — ensures consecutive _now() calls from the same
 // process never collide in the same millisecond, so updated_at /
@@ -153,9 +150,7 @@ function _sourcePath(s) {
       "siteRedirects: source_path must be <= " + MAX_SOURCE_PATH_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("siteRedirects: source_path contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "siteRedirects: source_path", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) !== 47 /* "/" */) {
     throw new TypeError("siteRedirects: source_path must be /-rooted (start with '/')");
   }
@@ -179,9 +174,7 @@ function _targetUrl(s) {
       "siteRedirects: target_url must be <= " + MAX_TARGET_URL_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("siteRedirects: target_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "siteRedirects: target_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError(
@@ -240,18 +233,29 @@ function _epochMs(n, label) {
   return n;
 }
 
-// Refuse regex patterns that carry backreferences (`\1`..`\9`) or
-// lookahead/lookbehind (`(?=...)`, `(?!...)`, `(?<=...)`, `(?<!...)`).
-// These are the two regex-shape categories that drive catastrophic
-// backtracking under adversarial input. Operators wanting these
-// shapes register multiple `prefix` / `exact` rules instead — the
-// regex match_kind is for cheap path-translation, not arbitrary
-// pattern matching.
+// Compile an operator's redirect pattern, anchored with `^` and `$` so
+// `resolveForPath` answers an exact-path match rather than a substring one
+// (`/foo` must not find `/foo/bar`).
+//
+// The pattern is matched by b.regexLinear, which simulates every path through
+// it one character at a time, so the work cannot grow faster than the subject
+// times the pattern no matter what the operator wrote. That replaces the
+// screen this used to run — a walker for backreferences and lookaround, then
+// b.guardRegex for backtracking shapes.
 //
-// `_compileRegex` walks the source for the forbidden tokens BEFORE
-// handing it to RegExp(), then anchors the compiled pattern with `^`
-// and `$` so `resolveForPath` answers an exact-path match (not a
-// substring match a la `/foo` finding `/foo/bar`).
+// Screening was always an approximation in both directions: it refused
+// patterns that were perfectly linear, and it could not promise to catch every
+// shape that was not, so each shape it missed became another case to add. The
+// patterns it existed to stop — `(a+)+`, `(a|a)*` — are now simply run: on two
+// thousand characters they finish in about two milliseconds where the platform
+// engine takes the better part of a minute. An operator gets their pattern
+// accepted and the request path stays bounded, which is what the screen was
+// trying and failing to deliver.
+//
+// Three constructs still cannot be simulated this way and are refused by name:
+// a backreference, a lookaround, and a repetition whose body can match nothing.
+// Each is mapped below into this module's TypeError envelope so a caller sees
+// one error shape.
 function _compileRegex(source) {
   if (typeof source !== "string" || !source.length) {
     throw new TypeError("siteRedirects: source_path (regex) must be a non-empty string");
@@ -261,127 +265,37 @@ function _compileRegex(source) {
       "siteRedirects: regex source must be <= " + MAX_REGEX_SOURCE_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(source) || ZERO_WIDTH_RE.test(source)) {
-    throw new TypeError("siteRedirects: regex source contains control / zero-width bytes");
-  }
-  // Backreferences: \1 .. \9 outside a character class. The walker
-  // tracks character-class depth so `[\1]` (literal byte) doesn't
-  // trip the gate, but `(.)\1` (a real backreference) does.
-  var inClass = 0;
-  for (var i = 0; i < source.length; i += 1) {
-    var ch = source.charAt(i);
-    if (ch === "\\" && i + 1 < source.length) {
-      var nxt = source.charAt(i + 1);
-      if (inClass === 0 && nxt >= "1" && nxt <= "9") {
-        throw new TypeError(
-          "siteRedirects: regex backreferences (\\1..\\9) refused — operators register " +
-          "separate redirect rows for each variant instead"
-        );
-      }
-      i += 1;                                                          // skip escaped char
-      continue;
-    }
-    if (ch === "[") { inClass += 1; continue; }
-    if (ch === "]" && inClass > 0) { inClass -= 1; continue; }
-    if (inClass > 0) continue;
-    if (ch === "(" && i + 2 < source.length && source.charAt(i + 1) === "?") {
-      var third = source.charAt(i + 2);
-      if (third === "=" || third === "!" || third === "<") {
-        throw new TypeError(
-          "siteRedirects: regex lookahead / lookbehind (`(?=`, `(?!`, `(?<=`, `(?<!`) refused " +
-          "— catastrophic-backtracking surface; rewrite as `prefix` or split into multiple rows"
-        );
-      }
-    }
-  }
-  // Build the anchored form. RegExp() throws SyntaxError on a
-  // malformed source — re-shape that into the primitive's TypeError
-  // envelope so callers can match on the consistent error shape.
+  textGuard.freeText(source, "siteRedirects: regex source", { singleLine: "reject", zeroWidth: "reject" });
   var anchored = "^(?:" + source + ")$";
-  var compiled;
   try {
-    compiled = new RegExp(anchored);
+    return b.regexLinear.compile(anchored);
   } catch (e) {
+    var code = (e && e.code) || "";
+    if (code === "regex/unsupported-backreference") {
+      throw new TypeError(
+        "siteRedirects: regex backreferences (\\1..\\9) refused — a backreference " +
+        "cannot be matched in linear time; register a separate redirect row for " +
+        "each variant instead"
+      );
+    }
+    if (code === "regex/unsupported-lookaround") {
+      throw new TypeError(
+        "siteRedirects: regex lookahead / lookbehind (`(?=`, `(?!`, `(?<=`, `(?<!`) " +
+        "refused — lookaround cannot be matched in linear time; rewrite as `prefix` " +
+        "or split into multiple rows"
+      );
+    }
+    if (code === "regex/nullable-repetition") {
+      throw new TypeError(
+        "siteRedirects: a repetition whose body can match nothing (`(a*)*`) is " +
+        "refused — it matches exactly what its body matches, so write that instead"
+      );
+    }
     throw new TypeError(
       "siteRedirects: regex source did not compile — " +
       (e && e.message ? e.message : "invalid pattern")
     );
   }
-  // Extend the backreference / lookaround screen above with the last
-  // catastrophic-backtracking class it doesn't cover: a nested unbounded
-  // quantifier ((a+)+, (a*)*, (?:a+)+, (.+)+ …). This regex runs against the
-  // request path in `resolveForPath`, so a super-linear pattern is a DoS on
-  // every matching request. (The framework's b.guardRegex screen is not used
-  // here because its text scan misreads the `?` in a `(?:…)` group prefix and
-  // a bounded trailing `?` as quantifiers, rejecting linear patterns like
-  // `/blog(?:/page/\d+)?` — filed upstream; this walker allows them.)
-  if (_hasNestedUnboundedQuantifier(source)) {
-    throw new TypeError(
-      "siteRedirects: regex source rejected — nested unbounded quantifier " +
-      "(catastrophic-backtracking / ReDoS) surface; rewrite as `prefix` / " +
-      "`exact`, or split into multiple rows"
-    );
-  }
-  return compiled;
-}
-
-// Detect the nested-unbounded-quantifier ReDoS class: a group whose body
-// contains an unbounded quantifier (`+`, `*`, `{n,}`) and is itself repeated
-// by an unbounded quantifier — `(a+)+`, `(a*)*`, `(?:a+)+`, `(.+)+`,
-// `((ab)+)+` at any depth. A single optional / linearly-repeated group
-// (`(?:foo)?`, `(?:bar)*`, `/products/.+`) is safe and MUST be allowed. The
-// walk mirrors the backreference/lookaround walk: char-by-char, honoring
-// escapes, character classes, and the `(?:` / `(?<name>` group prefixes whose
-// `?` is group syntax, not a quantifier. Lookaround is already refused before
-// this runs, so only `(?:` reaches here.
-function _hasNestedUnboundedQuantifier(source) {
-  var stack = [];            // open groups: { bodyUnbounded: bool }
-  var inClass = false;
-  var i = 0;
-  var n = source.length;
-  function outerUnboundedAt(idx) {
-    var c = source.charAt(idx);
-    if (c === "*" || c === "+") return true;
-    if (c === "{") { return /^\{\d*,\}/.test(source.slice(idx)); }   // {n,} — no upper bound
-    return false;
-  }
-  while (i < n) {
-    var ch = source.charAt(i);
-    if (ch === "\\") { i += 2; continue; }                            // escaped atom
-    if (inClass) { if (ch === "]") { inClass = false; } i += 1; continue; }
-    if (ch === "[") { inClass = true; i += 1; continue; }
-    if (ch === "(") {
-      if (source.charAt(i + 1) === "?") {                             // group prefix — not a quantifier
-        i += 2;
-        if (source.charAt(i) === ":") { i += 1; }
-        else if (source.charAt(i) === "<") { while (i < n && source.charAt(i) !== ">") { i += 1; } if (i < n) { i += 1; } }
-      } else { i += 1; }
-      stack.push({ bodyUnbounded: false });
-      continue;
-    }
-    if (ch === ")") {
-      var g = stack.pop() || { bodyUnbounded: false };
-      var outer = outerUnboundedAt(i + 1);
-      if (g.bodyUnbounded && outer) { return true; }                 // nested unbounded quantifier
-      // A group repeated by an unbounded quantifier is itself an unbounded
-      // atom for its parent.
-      if (outer && stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
-      i += 1;
-      continue;
-    }
-    if (ch === "*" || ch === "+") {
-      if (stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
-      i += 1;
-      continue;
-    }
-    if (ch === "{" && /^\{\d*,\}/.test(source.slice(i))) {
-      if (stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
-      i += 1;
-      continue;
-    }
-    i += 1;
-  }
-  return false;
 }
 
 // ---- row hydration ------------------------------------------------------
@@ -577,9 +491,7 @@ function create(opts) {
     if (typeof path !== "string" || !path.length) {
       throw new TypeError("siteRedirects.resolveForPath: path must be a non-empty string");
     }
-    if (CONTROL_BYTE_RE.test(path)) {
-      throw new TypeError("siteRedirects.resolveForPath: path contains control bytes");
-    }
+    textGuard.freeText(path, "siteRedirects.resolveForPath: path", { singleLine: "reject" });
     var now = _now();
 
     // -- exact ----------------------------------------------------------

package/lib/sitemap-generator.js

@@ -107,9 +107,9 @@ var ALLOWED_CHANGEFREQS = Object.freeze([
   "never",
 ]);
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -134,9 +134,7 @@ function _basePath(s) {
   if (typeof s !== "string" || s.length < 1 || s.length > MAX_BASE_PATH_LEN) {
     throw new TypeError("sitemapGenerator: base_path must be a string 1.." + MAX_BASE_PATH_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("sitemapGenerator: base_path contains control bytes");
-  }
+  textGuard.freeText(s, "sitemapGenerator: base_path", { singleLine: "reject" });
   if (s.charCodeAt(0) !== 47 /* "/" */) {
     throw new TypeError("sitemapGenerator: base_path must start with '/'");
   }
@@ -177,9 +175,7 @@ function _originUrl(u) {
   if (typeof u !== "string" || u.length < 1 || u.length > MAX_ORIGIN_URL_LEN) {
     throw new TypeError("sitemapGenerator: origin_url must be a string 1.." + MAX_ORIGIN_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(u)) {
-    throw new TypeError("sitemapGenerator: origin_url contains control bytes");
-  }
+  textGuard.freeText(u, "sitemapGenerator: origin_url", { singleLine: "reject" });
   try {
     b.safeUrl.parse(u, { allowedProtocols: ["https:"] });
   } catch (e) {

package/lib/sms-dispatcher.js

@@ -62,6 +62,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -103,10 +104,6 @@ var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var COUNTRY_RE       = /^[A-Z]{2}$/;
 var PHONE_HASH_RE    = /^[0-9a-f]{128}$/;
 var PHONE_NORM_RE    = /^\+[1-9][0-9]{6,14}$/;   // E.164: +<country><subscriber>, 7-15 digits total
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Inbound STOP-keyword detection. Operators in the US/UK/AU regulatory
 // envelope have all converged on this short list; the primitive
@@ -150,9 +147,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("smsDispatcher: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: name contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: name", { zeroWidth: "reject" });
   return s;
 }
 
@@ -163,9 +158,7 @@ function _endpointUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("smsDispatcher: endpoint_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: endpoint_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: endpoint_url", { zeroWidth: "reject" });
   // Shape gate — refuse anything that isn't an absolute https URL.
   // Provider endpoints are public APIs; operators using a non-https
   // egress are leaking the message body across the wire.
@@ -260,7 +253,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("smsDispatcher: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("smsDispatcher: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -274,9 +267,7 @@ function _optInText(s) {
   if (s.length > MAX_OPT_IN_TEXT_LEN) {
     throw new TypeError("smsDispatcher: opt_in_text must be <= " + MAX_OPT_IN_TEXT_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: opt_in_text contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: opt_in_text", { zeroWidth: "reject" });
   return s;
 }
 
@@ -287,9 +278,7 @@ function _providerRef(s) {
   if (s.length > MAX_PROVIDER_REF_LEN) {
     throw new TypeError("smsDispatcher: provider_ref must be <= " + MAX_PROVIDER_REF_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: provider_ref contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: provider_ref", { zeroWidth: "reject" });
   return s;
 }
 
@@ -333,12 +322,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("smsDispatcher: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("smsDispatcher: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: body contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "smsDispatcher: body", { zeroWidth: "reject" });
   // Refuse the degenerate emoji-only shape. Walk the string by code
   // point so surrogate pairs in the SMP emoji blocks count as one
   // character.

package/lib/stock-receipts.js

@@ -70,6 +70,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -100,7 +101,6 @@ var LINE_STATES             = Object.freeze([
   "pending", "received", "damaged", "partial",
 ]);
 
-var CONTROL_BYTE_RE         = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -171,9 +171,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("stockReceipts: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: reason");
   return s;
 }
 
@@ -192,9 +190,7 @@ function _uaOpt(s) {
   if (typeof s !== "string" || s.length > MAX_UA_LEN) {
     throw new TypeError("stockReceipts: user_agent must be a string <= " + MAX_UA_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: user_agent must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: user_agent");
   return s;
 }
 
@@ -203,9 +199,7 @@ function _ipOpt(s) {
   if (typeof s !== "string" || s.length > MAX_IP_LEN) {
     throw new TypeError("stockReceipts: client_ip must be a string <= " + MAX_IP_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: client_ip must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: client_ip");
   return s;
 }
 

package/lib/storefront-dashboards.js

@@ -89,6 +89,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN     = 80;
 var MAX_TITLE_LEN    = 200;
@@ -140,14 +141,10 @@ var WIDGET_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var LOCALE_RE = /^[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/;
 
 // Refuse C0 control bytes + DEL in operator-authored text fields.
-var CONTROL_BYTE_LINE_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the rest of the
 // shop primitives. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -166,12 +163,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("storefrontDashboards: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("storefrontDashboards: title contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("storefrontDashboards: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "storefrontDashboards: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }