@blamejs/blamejs-shop 0.5.20 → 0.5.22

package/lib/order-escalation.js

@@ -61,7 +61,6 @@ var COUNTRY_RE          = /^[A-Z]{2}$/;
 var PAYMENT_KIND_RE     = /^[a-z0-9][a-z0-9_-]{0,31}$/;
 var TAG_RE              = /^[A-Za-z0-9][A-Za-z0-9._:\-]{0,63}$/;
 var TEMPLATE_RE         = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var SEVERITIES          = Object.freeze(["info", "warning", "critical"]);
 var SEVERITY_RANK       = Object.freeze({ info: 0, warning: 1, critical: 2 });
@@ -85,6 +84,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -322,7 +322,7 @@ function _freeText(v, label, max) {
   if (v.length > max) {
     throw new TypeError("orderEscalation: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(v)) {
+  if (textGuard.hasCodepointThreat(v)) {
     throw new TypeError("orderEscalation: " + label + " must not contain control bytes");
   }
   return v;

package/lib/order-export.js

@@ -117,6 +117,7 @@ var DEFAULT_BATCH_SIZE = 500;
 var MAX_BATCH_SIZE     = 5000;
 var MAX_LIST_LIMIT     = 200;
 var EMAIL_HASH_PREFIX  = "order-export-email";
+var CSV_LINE_ENDING    = "\r\n";   // RFC 4180
 var FORMATS            = Object.freeze(["csv", "ndjson"]);
 var EXPORT_STATUSES    = Object.freeze(["queued", "running", "complete", "failed", "cancelled"]);
 
@@ -209,17 +210,6 @@ function _limit(n) {
 
 // ---- CSV helpers --------------------------------------------------------
 
-// RFC-4180 quoting: every cell wrapped in `"`, embedded `"` doubled.
-// We quote unconditionally — the cost is a few extra bytes per cell;
-// the win is that a downstream parser never has to track quote-vs-
-// bare-cell state for a column with mixed shapes. The injection
-// neutralization runs first via the shared vendored primitive.
-function _csvCell(value) {
-  var s = _coerceCell(value);
-  s = _neutralizeInjection(s);
-  return '"' + s.replace(/"/g, '""') + '"';
-}
-
 function _coerceCell(value) {
   if (value == null) return "";
   if (typeof value === "string") return value;
@@ -239,14 +229,29 @@ function _coerceCell(value) {
 // numerics (`+15.00`); the shared primitive prefixes those too (the safe
 // OWASP posture — `-2+3+cmd|…` is a real injection that begins like an
 // amount), which is the more complete behavior this consolidation buys.
-function _neutralizeInjection(s) {
-  return b.guardCsv.escapeCell(s);
-}
-
+// One export row, RFC 4180.
+//
+// b.guardCsv.serialize does the whole line: the formula-injection prefix on
+// every cell, the unconditional quoting, doubling an embedded quote, the
+// delimiter and the CRLF. Only the injection step was composed before; the
+// quoting rules were written here and again in customer-segments.js.
+//
+// Cells are quoted unconditionally. It costs a few bytes and means a
+// downstream parser never has to track quote-versus-bare state on a column
+// with mixed shapes.
+//
+// serialize emits the rows it is given WITHOUT a trailing terminator, which is
+// right for a whole document and wrong for a generator yielding one row at a
+// time — so the line ending is appended here. Verified byte-identical to the
+// previous builder across formula-injection, embedded-quote, embedded-comma,
+// newline, tab and empty cells.
 function _csvRow(cells) {
-  var parts = [];
-  for (var i = 0; i < cells.length; i += 1) parts.push(_csvCell(cells[i]));
-  return parts.join(",") + "\r\n";
+  return b.guardCsv.serialize([cells.map(_coerceCell)], {
+    profile:     "strict",
+    alwaysQuote: true,
+    headers:     false,
+    lineEnding:  CSV_LINE_ENDING,
+  }) + CSV_LINE_ENDING;
 }
 
 // ---- row projection -----------------------------------------------------
@@ -758,8 +763,7 @@ function create(opts) {
     // Exposed for the test suite so it can assert column semantics
     // without having to thread orders through a full DB round-trip.
     _projectOrder:      _projectOrder,
-    _csvCell:           _csvCell,
-    _neutralizeInjection: _neutralizeInjection,
+    _csvRow:            _csvRow,
     // Exposed only to keep the linter quiet about the unused `order`
     // binding when an integrator wires it later — the export reads
     // directly today, but the indirection is preserved.

package/lib/order-notes.js

@@ -46,7 +46,6 @@ var ALLOWED_VISIBILITY  = ["internal", "customer_visible"];
 // Refuse C0 control bytes + DEL + the LRM/RLM/ZWJ/ZWNJ family of
 // zero-width / direction-override characters. Newlines (LF, CR) +
 // tab are tolerated because operator notes legitimately wrap.
-var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 // Zero-width + direction-override family: ZWSP/ZWNJ/ZWJ (U+200B-200D),
 // LRM/RLM (U+200E/U+200F), the bidi-formatting block
 // (U+202A-U+202E), the invisible-math block (U+2060-U+2064), the
@@ -54,9 +53,6 @@ var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 // Arabic letter mark (U+061C). Spelled with \u-escapes so the
 // detector pattern stays grep-able and ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE       = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // (pinned DESC, created_at DESC, id DESC) — pinned notes float to
 // the top; the id tie-break keeps cursor pagination deterministic
@@ -65,6 +61,7 @@ var LIST_ORDER_KEY = ["pinned:desc", "created_at:desc", "id:desc"];
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -98,12 +95,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("orderNotes: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderNotes: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("orderNotes: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "orderNotes: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -124,7 +116,7 @@ function _tags(input) {
     if (t.length > MAX_TAG_LEN) {
       throw new TypeError("orderNotes: tags[" + i + "] must be <= " + MAX_TAG_LEN + " characters");
     }
-    if (CONTROL_BYTE_RE.test(t) || ZERO_WIDTH_RE.test(t)) {
+    if (textGuard.hasCodepointThreat(t, { zeroWidth: "reject" })) {
       throw new TypeError("orderNotes: tags[" + i + "] contains control / zero-width bytes");
     }
     out.push(t);
@@ -139,9 +131,7 @@ function _resolution(s) {
   if (s.length > MAX_RESOLUTION_LEN) {
     throw new TypeError("orderNotes: resolution must be <= " + MAX_RESOLUTION_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("orderNotes: resolution contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "orderNotes: resolution", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/order-ratings.js

@@ -74,6 +74,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -88,7 +89,6 @@ var MAX_LIST_LIMIT        = 500;
 var DEFAULT_TOP_LIMIT     = 10;
 var MAX_TOP_LIMIT         = 100;
 
-var CONTROL_BYTE_RE       = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -130,9 +130,7 @@ function _comment(s) {
   if (s.length > MAX_COMMENT_LEN) {
     throw new TypeError("orderRatings: comment must be <= " + MAX_COMMENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: comment must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: comment", { bidiMarks: "allow" });
   return s;
 }
 
@@ -140,9 +138,7 @@ function _flagReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_FLAG_REASON_LEN) {
     throw new TypeError("orderRatings: reason must be a non-empty string <= " + MAX_FLAG_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: reason", { bidiMarks: "allow" });
   return s;
 }
 
@@ -150,9 +146,7 @@ function _responseText(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RESPONSE_LEN) {
     throw new TypeError("orderRatings: response must be a non-empty string <= " + MAX_RESPONSE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("orderRatings: response must not contain control bytes");
-  }
+  textGuard.freeText(s, "orderRatings: response", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/payment-methods.js

@@ -49,6 +49,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var PROCESSORS = ["stripe", "paypal", "square", "braintree", "authorize_net"];
 var ARCHIVE_REASONS = ["customer_request", "expired", "replaced", "fraud", "operator"];
@@ -65,7 +66,6 @@ var MAX_ACTOR_LEN = 128;
 // branch-on-this dispatch key.
 var BRAND_RE = /^[A-Za-z0-9 _.\-]{1,32}$/;
 var LAST4_RE = /^[0-9]{4}$/;
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // PAN screen: any field whose value is a string carrying 13-19
 // consecutive ASCII digits (with or without space/dash separators
@@ -125,9 +125,7 @@ function _brand(s) {
   if (s.length > MAX_BRAND_LEN) {
     throw new TypeError("paymentMethods: brand must be <= " + MAX_BRAND_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: brand contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: brand", { singleLine: "reject" });
   if (!BRAND_RE.test(s)) {
     throw new TypeError("paymentMethods: brand contains characters outside [A-Za-z0-9 _.-]");
   }
@@ -142,9 +140,7 @@ function _label(s) {
   if (s.length > MAX_LABEL_LEN) {
     throw new TypeError("paymentMethods: label must be <= " + MAX_LABEL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: label contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: label", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -155,9 +151,7 @@ function _token(s) {
   if (s.length > MAX_TOKEN_LEN) {
     throw new TypeError("paymentMethods: processor_token must be <= " + MAX_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: processor_token contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: processor_token", { singleLine: "reject" });
   return s;
 }
 
@@ -187,9 +181,7 @@ function _actor(s) {
   if (s.length > MAX_ACTOR_LEN) {
     throw new TypeError("paymentMethods: actor must be <= " + MAX_ACTOR_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("paymentMethods: actor contains control bytes");
-  }
+  textGuard.freeText(s, "paymentMethods: actor", { singleLine: "reject" });
   return s;
 }
 

package/lib/payment-retries.js

@@ -129,6 +129,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -147,10 +148,6 @@ var MS_PER_HOUR           = C.TIME.hours(1);
 
 var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var FAILURE_CODE_RE  = /^[a-z](?:[a-z0-9_]*[a-z0-9])?$/;
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -232,9 +229,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("paymentRetries: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("paymentRetries: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "paymentRetries: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/pixel-events.js

@@ -99,6 +99,7 @@
 var nodeCrypto = require("node:crypto");                                  // allow:non-shop-require allow:weak-hash-sha2 — Provider spec (Meta CAPI, Google EC, TikTok Events, Pinterest CAPI, Snap CAPI) mandates SHA-256 of the normalised identifier; blamejs.crypto exposes SHA3-512 / SHAKE256 / namespaceHash, none of which match the wire format ad platforms accept. Node's stdlib SHA-256 hash is the minimum-surface route.
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -132,10 +133,6 @@ var CURRENCY_RE     = /^[A-Z]{3}$/;
 var UA_CLASS_RE     = /^[a-z0-9._-]+$/;
 var IP_HASH_RE      = /^[0-9a-f]+$/;
 var SHA256_HEX_RE   = /^[0-9a-f]{64}$/;
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 // Conservative email shape — operator-facing storefronts already
 // validated this via the framework's address-input primitive; the
 // gate here is a defensive last-line check before we normalise +
@@ -218,9 +215,7 @@ function _pixelId(s) {
   if (s.length > MAX_PIXEL_ID_LEN) {
     throw new TypeError("pixelEvents: pixel_id must be <= " + MAX_PIXEL_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: pixel_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: pixel_id", { zeroWidth: "reject" });
   return s;
 }
 
@@ -231,9 +226,7 @@ function _accessToken(s) {
   if (s.length > MAX_ACCESS_TOKEN_LEN) {
     throw new TypeError("pixelEvents: access_token must be <= " + MAX_ACCESS_TOKEN_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: access_token contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: access_token", { zeroWidth: "reject" });
   return s;
 }
 
@@ -244,9 +237,7 @@ function _conversionUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pixelEvents: conversion_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: conversion_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: conversion_url", { zeroWidth: "reject" });
   // Every supported provider's conversion API is public HTTPS — refuse
   // anything else so an operator typo can't egress conversion data in
   // plaintext.
@@ -276,9 +267,7 @@ function _eventSourceUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("pixelEvents: event_source_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: event_source_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: event_source_url", { zeroWidth: "reject" });
   if (!/^https?:\/\//i.test(s)) {
     throw new TypeError("pixelEvents: event_source_url must be an absolute http(s):// URL");
   }
@@ -293,9 +282,7 @@ function _email(s) {
   if (s.length > MAX_EMAIL_LEN) {
     throw new TypeError("pixelEvents: customer_email must be <= " + MAX_EMAIL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: customer_email contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "pixelEvents: customer_email", { zeroWidth: "reject" });
   // Validate the trimmed form — normalisation strips leading /
   // trailing whitespace before hashing, so a "  alice@example.com  "
   // input still hashes to the canonical address. Reject only when
@@ -402,7 +389,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("pixelEvents: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("pixelEvents: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -416,14 +403,20 @@ function _responseBody(s) {
   if (s.length > MAX_RESPONSE_BODY_LEN) {
     throw new TypeError("pixelEvents: response_body must be <= " + MAX_RESPONSE_BODY_LEN + " characters");
   }
-  // Response bodies from upstream providers are operator-observed
-  // already (the dispatch hook captured them); allow the full ASCII
-  // range minus the zero-width / bidi block so a malicious provider
-  // can't smuggle invisible bytes through the audit trail.
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("pixelEvents: response_body contains zero-width / bidi-override bytes");
-  }
-  return s;
+  // SCRUBBED, never refused. This string is whatever an upstream provider sent
+  // back, and `markDispatched` runs this validator BEFORE it transitions the
+  // event — so any refusal here leaves the row in `queued` and the scheduler
+  // re-sends the identical pixel on every tick, forever, because we disliked a
+  // byte in the reply. A provider must never be able to hold an event open by
+  // choosing its response body.
+  //
+  // The interest in this field is only that an operator reading the audit
+  // trail is not shown invisible characters. Removing them satisfies that
+  // without ever failing: the bidi overrides, the direction marks, the
+  // zero-width family and the Unicode Tags block all come out, and everything
+  // legible — including the tabs and newlines a real response is full of —
+  // stays exactly as the provider sent it.
+  return textGuard.scrubInvisible(s);
 }
 
 function _responseStatus(n) {

package/lib/plan-changes.js

@@ -61,6 +61,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // Observability sink for batch-path settlement failures: the scheduler
 // reverts a due row to 'pending' and carries on when a Stripe push or a
@@ -79,10 +80,6 @@ var MAX_REASON_LEN = 280;
 // can land in cancel_reason and replay into the customer profile
 // screen, so the same "no direction-override / no invisible glyph"
 // floor applies.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -118,9 +115,7 @@ function _optReason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("planChanges: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("planChanges: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "planChanges: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/product-qa.js

@@ -81,9 +81,9 @@ var MIN_CLEANUP_DAYS      = 1;
 var STATUSES              = Object.freeze(["pending", "approved", "rejected"]);
 var AUTHORS               = Object.freeze(["operator", "customer", "system"]);
 
-var CONTROL_BYTE_RE       = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- monotonic clock ---------------------------------------------------
@@ -116,7 +116,7 @@ function _body(s, label) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("productQA: " + label + " must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("productQA: " + label + " must not contain control bytes");
   }
   return s;
@@ -131,9 +131,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("productQA: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("productQA: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "productQA: reason", { bidiMarks: "allow" });
   return s;
 }
 
@@ -167,9 +165,7 @@ function _sessionId(s) {
   if (s.length > MAX_SESSION_ID_LEN) {
     throw new TypeError("productQA: session_id must be <= " + MAX_SESSION_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("productQA: session_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "productQA: session_id");
   return s;
 }
 

package/lib/promo-banners.js

@@ -102,15 +102,10 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // operator dashboards. Newlines are allowed in `body` (multi-line
 // marketing copy is common); `headline` / `cta_label` refuse LF / CR
 // so a single-line presentation slot can't be smuggled into.
-var CONTROL_BYTE_LINE_RE   = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the gift-options
 // + order-notes catalogues. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "placement",
@@ -128,6 +123,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -164,10 +160,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("promoBanners: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -181,10 +177,10 @@ function _block(s, label, maxLen) {
   if (s.length > maxLen) {
     throw new TypeError("promoBanners: " + label + " must be ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("promoBanners: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("promoBanners: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -200,9 +196,7 @@ function _ctaUrl(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CTA_URL_LEN) {
     throw new TypeError("promoBanners: cta_url must be a non-empty string ≤ " + MAX_CTA_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("promoBanners: cta_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "promoBanners: cta_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     // /-rooted absolute path — refuse protocol-relative `//host`
     // (the second char being "/" turns the link into an off-site
@@ -230,9 +224,7 @@ function _imageUrl(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_IMAGE_URL_LEN) {
     throw new TypeError("promoBanners: image_url must be a non-empty string ≤ " + MAX_IMAGE_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("promoBanners: image_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "promoBanners: image_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError("promoBanners: image_url protocol-relative `//host/...` refused — use absolute https://");

package/lib/purchase-orders.js

@@ -96,10 +96,6 @@ var REFERENCE_RE           = /^[A-Za-z0-9][A-Za-z0-9._\/ -]{0,127}$/;
 // as vendors. Operator-rendered text fields refuse these to keep the
 // downstream dashboard / printout safe from header-injection +
 // visual-spoofing attacks.
-var CONTROL_BYTE_RE        = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var PO_STATUSES = Object.freeze([
   "draft", "submitted", "confirmed", "partially_received",
@@ -117,6 +113,7 @@ var ALLOWED_UPDATE_COLUMNS = Object.freeze([
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -212,10 +209,10 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("purchase-orders: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("purchase-orders: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("purchase-orders: " + label + " contains zero-width / direction-override bytes");
   }
   return s;