@blamejs/blamejs-shop 0.5.20 → 0.5.22

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.21",
+  "version": "0.18.24",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:885de67e-71f9-4512-83e7-3538ecfd9d88",
+  "serialNumber": "urn:uuid:6fba0fbc-d16f-4c2c-864f-99f1c662d2af",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-10T21:28:58.997Z",
+    "timestamp": "2026-08-11T01:57:40.816Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.21",
+      "bom-ref": "@blamejs/core@0.18.24",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.21",
+      "version": "0.18.24",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.21",
+      "purl": "pkg:npm/%40blamejs/core@0.18.24",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.21",
+      "ref": "@blamejs/core@0.18.24",
       "dependsOn": []
     }
   ]

package/lib/vendor-invoices.js

@@ -95,10 +95,6 @@ var CURRENCY_RE            = /^[A-Z]{3}$/;
 // as the sibling accounts-payable primitives — operator-rendered text
 // fields refuse these to keep the dashboard + printout safe from
 // header-injection + visual-spoofing attacks.
-var CONTROL_BYTE_RE        = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var INVOICE_STATUSES = Object.freeze([
   "received", "approved", "paid", "disputed", "voided",
@@ -107,6 +103,7 @@ var INVOICE_STATUSES = Object.freeze([
 var MAX_DUE_WITHIN_DAYS     = 3650;    // ~10 years — bound the predicate
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MS_PER_DAY              = b.constants.TIME.days(1);
 
@@ -219,10 +216,10 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("vendor-invoices: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("vendor-invoices: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("vendor-invoices: " + label + " contains zero-width / direction-override bytes");
   }
   return s;

package/lib/vendors.js

@@ -97,10 +97,6 @@ var PHONE_RE                = /^\+?[1-9]\d{1,14}$/;
 // direction-override bytes are a slipping-class for header injection
 // + visual-spoofing attacks downstream. Spelled with \u-escapes so
 // ESLint's no-irregular-whitespace stays happy.
-var CONTROL_BYTE_STRICT_RE  = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Mutable columns for `updateVendor(slug, patch)`. Slug is immutable
 // — it's the public handle + the join-table key; mutating it would
@@ -119,6 +115,7 @@ var ALLOWED_UPDATE_COLUMNS = Object.freeze([
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -159,12 +156,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("vendors: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("vendors: name contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: name contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "vendors: name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -186,9 +178,7 @@ function _payoutAddress(s) {
   if (s.length > MAX_PAYOUT_ADDRESS_LEN) {
     throw new TypeError("vendors: payout_address must be <= " + MAX_PAYOUT_ADDRESS_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: payout_address contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "vendors: payout_address", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -221,9 +211,7 @@ function _addressJson(value) {
   if (encoded.length > MAX_ADDRESS_JSON_LEN) {
     throw new TypeError("vendors: address JSON must be <= " + MAX_ADDRESS_JSON_LEN + " characters serialised");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(encoded) || ZERO_WIDTH_RE.test(encoded)) {
-    throw new TypeError("vendors: address contains control / zero-width bytes");
-  }
+  textGuard.freeText(encoded, "vendors: address", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return encoded;
 }
 
@@ -265,9 +253,7 @@ function _orderId(s) {
   if (s.length > 256) {
     throw new TypeError("vendors: order_id must be <= 256 characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: order_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "vendors: order_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/webhook-receiver.js

@@ -79,6 +79,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 var SECRET_NAMESPACE   = "webhook-receiver-secret";
@@ -118,10 +119,6 @@ var MAX_REASON_LEN  = 1024;
 
 var SIGNATURE_HEX_RE = /^[0-9a-f]{64}$/i;     // 32 bytes of HMAC-SHA-256 = 64 hex chars
 
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE          = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var STATUSES = ["received", "processed", "failed"];
 
@@ -198,9 +195,7 @@ function _outcome(s) {
   if (s.length > MAX_OUTCOME_LEN) {
     throw new TypeError("webhookReceiver: outcome must be <= " + MAX_OUTCOME_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookReceiver: outcome contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookReceiver: outcome", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -215,9 +210,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("webhookReceiver: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookReceiver: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookReceiver: reason", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/webhook-subscriptions.js

@@ -68,10 +68,6 @@ var WILDCARD_EVENT = "*";
 // control bytes are a slipping-class for header injection + visual
 // spoofing downstream. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Event-type identifier shape — `domain.action[.qualifier]` segments
 // of ASCII letters / digits / underscore, joined by `.`. The wildcard
@@ -111,9 +107,7 @@ function _ownerId(s) {
   if (s.length > MAX_OWNER_ID_LEN) {
     throw new TypeError("webhookSubscriptions: owner_id must be <= " + MAX_OWNER_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookSubscriptions: owner_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookSubscriptions: owner_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -191,9 +185,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("webhookSubscriptions: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookSubscriptions: name contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookSubscriptions: name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -219,9 +211,7 @@ function _signingSecret(s) {
   if (s.length > 512) {
     throw new TypeError("webhookSubscriptions: signing_secret must be <= 512 characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookSubscriptions: signing_secret contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookSubscriptions: signing_secret", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/wishlist-sharing.js

@@ -63,6 +63,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var wishlistModule = require("./wishlist");
 
 // ---- constants ----------------------------------------------------------
@@ -82,8 +83,6 @@ var MAX_REASON_LEN             = 500;
 var MAX_EMAIL_LEN              = 254;
 var MAX_MEMBER_EMAILS          = 50;
 
-var CONTROL_BYTE_RE            = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE     = /[\x00-\x1f\x7f]/;
 
 // Conservative single-line email shape — defence in depth against
 // header-injection / control-byte smuggling when the operator
@@ -127,7 +126,7 @@ function _title(s, label) {
   if (typeof s !== "string" || s.length > MAX_TITLE_LEN) {
     throw new TypeError("wishlistSharing: " + label + " must be a string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("wishlistSharing: " + label + " must not contain control bytes");
   }
   return s;
@@ -137,7 +136,7 @@ function _requiredTitle(s, label) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("wishlistSharing: " + label + " must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("wishlistSharing: " + label + " must not contain control bytes");
   }
   return s;
@@ -162,9 +161,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("wishlistSharing: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("wishlistSharing: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "wishlistSharing: reason", { bidiMarks: "allow" });
   return s;
 }
 
@@ -205,9 +202,7 @@ function _viewerSessionId(s) {
   // Session ids are opaque to this primitive; refuse control bytes
   // so the hashed breadcrumb has no log-injection vector even if a
   // downstream tool ever rendered the raw value.
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("wishlistSharing: viewer_session_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "wishlistSharing: viewer_session_id", { singleLine: "reject" });
   return s;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.20",
+  "version": "0.5.22",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {