@blamejs/blamejs-shop 0.5.20 → 0.5.21

package/lib/order-notes.js

@@ -46,7 +46,6 @@ var ALLOWED_VISIBILITY  = ["internal", "customer_visible"];
 // Refuse C0 control bytes + DEL + the LRM/RLM/ZWJ/ZWNJ family of
 // zero-width / direction-override characters. Newlines (LF, CR) +
 // tab are tolerated because operator notes legitimately wrap.
-var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 // Zero-width + direction-override family: ZWSP/ZWNJ/ZWJ (U+200B-200D),
 // LRM/RLM (U+200E/U+200F), the bidi-formatting block
 // (U+202A-U+202E), the invisible-math block (U+2060-U+2064), the
@@ -54,9 +53,6 @@ var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 // Arabic letter mark (U+061C). Spelled with \u-escapes so the
 // detector pattern stays grep-able and ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE       = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // (pinned DESC, created_at DESC, id DESC) — pinned notes float to
 // the top; the id tie-break keeps cursor pagination deterministic
@@ -65,6 +61,7 @@ var LIST_ORDER_KEY = ["pinned:desc", "created_at:desc", "id:desc"];
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -98,12 +95,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("orderNotes: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderNotes: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("orderNotes: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "orderNotes: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -124,7 +116,7 @@ function _tags(input) {
     if (t.length > MAX_TAG_LEN) {
       throw new TypeError("orderNotes: tags[" + i + "] must be <= " + MAX_TAG_LEN + " characters");
     }
-    if (CONTROL_BYTE_RE.test(t) || ZERO_WIDTH_RE.test(t)) {
+    if (textGuard.hasCodepointThreat(t, { zeroWidth: "reject" })) {
       throw new TypeError("orderNotes: tags[" + i + "] contains control / zero-width bytes");
     }
     out.push(t);
@@ -139,9 +131,7 @@ function _resolution(s) {
   if (s.length > MAX_RESOLUTION_LEN) {
     throw new TypeError("orderNotes: resolution must be <= " + MAX_RESOLUTION_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("orderNotes: resolution contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "orderNotes: resolution", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/order-ratings.js

@@ -74,6 +74,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -88,7 +89,6 @@ var MAX_LIST_LIMIT        = 500;
 var DEFAULT_TOP_LIMIT     = 10;
 var MAX_TOP_LIMIT         = 100;
 
-var CONTROL_BYTE_RE       = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -130,9 +130,7 @@ function _comment(s) {
   if (s.length > MAX_COMMENT_LEN) {
     throw new TypeError("orderRatings: comment must be <= " + MAX_COMMENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: comment must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: comment");
   return s;
 }
 
@@ -140,9 +138,7 @@ function _flagReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_FLAG_REASON_LEN) {
     throw new TypeError("orderRatings: reason must be a non-empty string <= " + MAX_FLAG_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: reason");
   return s;
 }
 
@@ -150,9 +146,7 @@ function _responseText(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RESPONSE_LEN) {
     throw new TypeError("orderRatings: response must be a non-empty string <= " + MAX_RESPONSE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: response must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: response");
   return s;
 }
 

package/lib/payment-methods.js

@@ -49,6 +49,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var PROCESSORS = ["stripe", "paypal", "square", "braintree", "authorize_net"];
 var ARCHIVE_REASONS = ["customer_request", "expired", "replaced", "fraud", "operator"];
@@ -65,7 +66,6 @@ var MAX_ACTOR_LEN = 128;
 // branch-on-this dispatch key.
 var BRAND_RE = /^[A-Za-z0-9 _.\-]{1,32}$/;
 var LAST4_RE = /^[0-9]{4}$/;
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // PAN screen: any field whose value is a string carrying 13-19
 // consecutive ASCII digits (with or without space/dash separators
@@ -125,9 +125,7 @@ function _brand(s) {
   if (s.length > MAX_BRAND_LEN) {
     throw new TypeError("paymentMethods: brand must be <= " + MAX_BRAND_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: brand contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: brand", { singleLine: "reject" });
   if (!BRAND_RE.test(s)) {
     throw new TypeError("paymentMethods: brand contains characters outside [A-Za-z0-9 _.-]");
   }
@@ -142,9 +140,7 @@ function _label(s) {
   if (s.length > MAX_LABEL_LEN) {
     throw new TypeError("paymentMethods: label must be <= " + MAX_LABEL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: label contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: label", { singleLine: "reject" });
   return s;
 }
 
@@ -155,9 +151,7 @@ function _token(s) {
   if (s.length > MAX_TOKEN_LEN) {
     throw new TypeError("paymentMethods: processor_token must be <= " + MAX_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: processor_token contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: processor_token", { singleLine: "reject" });
   return s;
 }
 
@@ -187,9 +181,7 @@ function _actor(s) {
   if (s.length > MAX_ACTOR_LEN) {
     throw new TypeError("paymentMethods: actor must be <= " + MAX_ACTOR_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: actor contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: actor", { singleLine: "reject" });
   return s;
 }
 

package/lib/payment-retries.js

@@ -129,6 +129,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -147,10 +148,6 @@ var MS_PER_HOUR           = C.TIME.hours(1);
 
 var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var FAILURE_CODE_RE  = /^[a-z](?:[a-z0-9_]*[a-z0-9])?$/;
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -232,9 +229,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("paymentRetries: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("paymentRetries: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "paymentRetries: reason", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/pixel-events.js

@@ -99,6 +99,7 @@
 var nodeCrypto = require("node:crypto");                                  // allow:non-shop-require allow:weak-hash-sha2 — Provider spec (Meta CAPI, Google EC, TikTok Events, Pinterest CAPI, Snap CAPI) mandates SHA-256 of the normalised identifier; blamejs.crypto exposes SHA3-512 / SHAKE256 / namespaceHash, none of which match the wire format ad platforms accept. Node's stdlib SHA-256 hash is the minimum-surface route.
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -132,10 +133,6 @@ var CURRENCY_RE     = /^[A-Z]{3}$/;
 var UA_CLASS_RE     = /^[a-z0-9._-]+$/;
 var IP_HASH_RE      = /^[0-9a-f]+$/;
 var SHA256_HEX_RE   = /^[0-9a-f]{64}$/;
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 // Conservative email shape — operator-facing storefronts already
 // validated this via the framework's address-input primitive; the
 // gate here is a defensive last-line check before we normalise +
@@ -218,9 +215,7 @@ function _pixelId(s) {
   if (s.length > MAX_PIXEL_ID_LEN) {
     throw new TypeError("pixelEvents: pixel_id must be <= " + MAX_PIXEL_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: pixel_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: pixel_id", { zeroWidth: "reject" });
   return s;
 }
 
@@ -231,9 +226,7 @@ function _accessToken(s) {
   if (s.length > MAX_ACCESS_TOKEN_LEN) {
     throw new TypeError("pixelEvents: access_token must be <= " + MAX_ACCESS_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: access_token contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: access_token", { zeroWidth: "reject" });
   return s;
 }
 
@@ -244,9 +237,7 @@ function _conversionUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pixelEvents: conversion_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: conversion_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: conversion_url", { zeroWidth: "reject" });
   // Every supported provider's conversion API is public HTTPS — refuse
   // anything else so an operator typo can't egress conversion data in
   // plaintext.
@@ -276,9 +267,7 @@ function _eventSourceUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pixelEvents: event_source_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: event_source_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: event_source_url", { zeroWidth: "reject" });
   if (!/^https?:\/\//i.test(s)) {
     throw new TypeError("pixelEvents: event_source_url must be an absolute http(s):// URL");
   }
@@ -293,9 +282,7 @@ function _email(s) {
   if (s.length > MAX_EMAIL_LEN) {
     throw new TypeError("pixelEvents: customer_email must be <= " + MAX_EMAIL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: customer_email contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: customer_email", { zeroWidth: "reject" });
   // Validate the trimmed form — normalisation strips leading /
   // trailing whitespace before hashing, so a "  alice@example.com  "
   // input still hashes to the canonical address. Reject only when
@@ -402,7 +389,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("pixelEvents: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pixelEvents: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -420,9 +407,7 @@ function _responseBody(s) {
   // already (the dispatch hook captured them); allow the full ASCII
   // range minus the zero-width / bidi block so a malicious provider
   // can't smuggle invisible bytes through the audit trail.
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: response_body contains zero-width / bidi-override bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: response_body", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/plan-changes.js

@@ -61,6 +61,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // Observability sink for batch-path settlement failures: the scheduler
 // reverts a due row to 'pending' and carries on when a Stripe push or a
@@ -79,10 +80,6 @@ var MAX_REASON_LEN = 280;
 // can land in cancel_reason and replay into the customer profile
 // screen, so the same "no direction-override / no invisible glyph"
 // floor applies.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -118,9 +115,7 @@ function _optReason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("planChanges: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("planChanges: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "planChanges: reason", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/product-qa.js

@@ -81,9 +81,9 @@ var MIN_CLEANUP_DAYS      = 1;
 var STATUSES              = Object.freeze(["pending", "approved", "rejected"]);
 var AUTHORS               = Object.freeze(["operator", "customer", "system"]);
 
-var CONTROL_BYTE_RE       = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- monotonic clock ---------------------------------------------------
@@ -116,7 +116,7 @@ function _body(s, label) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("productQA: " + label + " must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("productQA: " + label + " must not contain control bytes");
   }
   return s;
@@ -131,9 +131,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("productQA: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("productQA: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "productQA: reason");
   return s;
 }
 
@@ -167,9 +165,7 @@ function _sessionId(s) {
   if (s.length > MAX_SESSION_ID_LEN) {
     throw new TypeError("productQA: session_id must be <= " + MAX_SESSION_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("productQA: session_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "productQA: session_id");
   return s;
 }
 

package/lib/promo-banners.js

@@ -102,15 +102,10 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // operator dashboards. Newlines are allowed in `body` (multi-line
 // marketing copy is common); `headline` / `cta_label` refuse LF / CR
 // so a single-line presentation slot can't be smuggled into.
-var CONTROL_BYTE_LINE_RE   = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the gift-options
 // + order-notes catalogues. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "placement",
@@ -128,6 +123,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -164,10 +160,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("promoBanners: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -181,10 +177,10 @@ function _block(s, label, maxLen) {
   if (s.length > maxLen) {
     throw new TypeError("promoBanners: " + label + " must be ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("promoBanners: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -200,9 +196,7 @@ function _ctaUrl(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CTA_URL_LEN) {
     throw new TypeError("promoBanners: cta_url must be a non-empty string ≤ " + MAX_CTA_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("promoBanners: cta_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "promoBanners: cta_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     // /-rooted absolute path — refuse protocol-relative `//host`
     // (the second char being "/" turns the link into an off-site
@@ -230,9 +224,7 @@ function _imageUrl(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_IMAGE_URL_LEN) {
     throw new TypeError("promoBanners: image_url must be a non-empty string ≤ " + MAX_IMAGE_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("promoBanners: image_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "promoBanners: image_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError("promoBanners: image_url protocol-relative `//host/...` refused — use absolute https://");

package/lib/purchase-orders.js

@@ -96,10 +96,6 @@ var REFERENCE_RE           = /^[A-Za-z0-9][A-Za-z0-9._\/ -]{0,127}$/;
 // as vendors. Operator-rendered text fields refuse these to keep the
 // downstream dashboard / printout safe from header-injection +
 // visual-spoofing attacks.
-var CONTROL_BYTE_RE        = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var PO_STATUSES = Object.freeze([
   "draft", "submitted", "confirmed", "partially_received",
@@ -117,6 +113,7 @@ var ALLOWED_UPDATE_COLUMNS = Object.freeze([
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -212,10 +209,10 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("purchase-orders: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("purchase-orders: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("purchase-orders: " + label + " contains zero-width / direction-override bytes");
   }
   return s;

package/lib/push-notifications.js

@@ -69,6 +69,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -114,10 +115,6 @@ var RETRY_BACKOFF_MS = [
 
 var SLUG_RE         = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var LOCALE_RE       = /^[A-Za-z]{2,8}(?:[-_][A-Za-z0-9]{2,8}){0,3}$/;
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -162,12 +159,7 @@ function _credentials(s) {
   if (s.length > MAX_CREDENTIALS_LEN) {
     throw new TypeError("pushNotifications: credentials must be <= " + MAX_CREDENTIALS_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: credentials contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: credentials contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: credentials", { zeroWidth: "reject" });
   return s;
 }
 
@@ -178,12 +170,7 @@ function _deviceToken(s) {
   if (s.length > MAX_TOKEN_LEN) {
     throw new TypeError("pushNotifications: device_token must be <= " + MAX_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: device_token contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: device_token contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: device_token", { zeroWidth: "reject" });
   return s;
 }
 
@@ -208,12 +195,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("pushNotifications: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: title contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: title contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: title", { zeroWidth: "reject" });
   return s;
 }
 
@@ -224,12 +206,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("pushNotifications: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("pushNotifications: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: body contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "pushNotifications: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -267,7 +244,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("pushNotifications: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pushNotifications: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -280,9 +257,7 @@ function _providerMessageId(s) {
   if (s.length > MAX_PROV_MSG_ID_LEN) {
     throw new TypeError("pushNotifications: provider_message_id must be <= " + MAX_PROV_MSG_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pushNotifications: provider_message_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pushNotifications: provider_message_id", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/pwa-manifest.js

@@ -168,12 +168,9 @@ var ICON_SIZES_RE = /^(?:any|\d+x\d+)(?:\s+(?:any|\d+x\d+))*$/;
 // spec recommends (image/png / image/svg+xml / image/webp).
 var ICON_TYPE_RE = /^[a-z]+\/[a-z0-9.+-]+$/;
 
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -202,10 +199,10 @@ function _string(s, label, max) {
   if (s.length > max) {
     throw new TypeError("pwaManifest: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("pwaManifest: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pwaManifest: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -270,7 +267,7 @@ function _url(s, label) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pwaManifest: " + label + " must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pwaManifest: " + label + " contains control / zero-width bytes");
   }
   if (s.charCodeAt(0) === 47 /* "/" */) {
@@ -416,10 +413,8 @@ function _validateRuntimeRules(rules) {
         MAX_URL_PATTERN_LEN + " characters"
       );
     }
-    if (CONTROL_BYTE_RE.test(r.url_pattern) || ZERO_WIDTH_RE.test(r.url_pattern)) {
-      throw new TypeError(
-        "pwaManifest: runtime_rules[" + i + "].url_pattern contains control / zero-width bytes"
-      );
+    if (textGuard.hasCodepointThreat(r.url_pattern, { zeroWidth: "reject" })) {
+      throw new TypeError("pwaManifest: runtime_rules[" + i + "].url_pattern contains control / zero-width bytes");
     }
     _enum(r.strategy, ALLOWED_STRATEGIES, "runtime_rules[" + i + "].strategy");
     if (seen[r.url_pattern]) {

package/lib/quotes.js

@@ -145,11 +145,6 @@ var VIEW_TOKEN_RE        = /^[A-Za-z0-9_-]{43}$/;
 // are allowed inside multi-line free-text fields (message,
 // operator_notes, line.notes); single-line fields (terms, reject /
 // cancel reason, accepted_by) refuse them too.
-var CONTROL_BYTE_RE             = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_MULTILINE_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var QUOTE_STATUSES = Object.freeze([
   "requested", "responded", "accepted", "rejected",
@@ -160,6 +155,7 @@ var TERMINAL_STATUSES = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // The quote lifecycle, modelled on b.fsm — the same composition the order
 // primitive uses (lib/order.js#_getOrderFsm). The FSM is the single source of
@@ -316,10 +312,10 @@ function _optShortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("quotes: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("quotes: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("quotes: " + label + " contains zero-width / direction-override bytes");
   }
   return s;
@@ -336,10 +332,10 @@ function _optLongText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("quotes: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_MULTILINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("quotes: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("quotes: " + label + " contains zero-width / direction-override bytes");
   }
   return s;