@blamejs/blamejs-shop 0.5.20 → 0.5.22

package/lib/security-middleware.js

@@ -527,26 +527,6 @@ var _SCOPED_DIRECTIVES = {
 //   default-src 'self', object-src 'none',
 //   require-trusted-types-for 'script', frame-ancestors 'none', base-uri 'self'
 
-// Parse the vendored default CSP into an ordered directive map ONCE at
-// module load. The default is a `name a b; name c;` string; split on `;`,
-// the first token of each clause is the directive name, the rest its
-// source list.
-function _parseCsp(cspString) {
-  var order = [];
-  var map = {};
-  String(cspString).split(";").forEach(function (clause) {
-    var trimmed = clause.trim();
-    if (!trimmed) return;
-    var parts = trimmed.split(/\s+/);
-    var name = parts[0];
-    order.push(name);
-    map[name] = parts.slice(1);
-  });
-  return { order: order, map: map };
-}
-
-var _DEFAULT_CSP_PARSED = _parseCsp(_vendoredSecurityHeaders.DEFAULT_CSP);
-
 /**
  * Build a route-scoped CSP string from the vendored strict default plus the
  * named providers' hosts. `keys` is an array of CSP_HOSTS keys
@@ -565,40 +545,51 @@ var _DEFAULT_CSP_PARSED = _parseCsp(_vendoredSecurityHeaders.DEFAULT_CSP);
  * which fails safe (the SDK is refused, not admitted too broadly).
  */
 function scopedCsp(keys) {
-  // Clone the parsed default so the per-call mutation never leaks into the
-  // module-level snapshot.
-  var order = _DEFAULT_CSP_PARSED.order.slice();
-  var map = {};
-  _DEFAULT_CSP_PARSED.order.forEach(function (name) {
-    map[name] = _DEFAULT_CSP_PARSED.map[name].slice();
-  });
-
+  // Collect the hosts each named provider needs, per directive. Unknown keys
+  // fall out here, which is what keeps a mistyped key on the strict default
+  // rather than throwing mid-render.
+  var additions = {};
   if (Array.isArray(keys)) {
     keys.forEach(function (key) {
       var hostSet = CSP_HOSTS[key];
       if (!hostSet) return;
       Object.keys(_SCOPED_DIRECTIVES).forEach(function (directive) {
-        var subKey = _SCOPED_DIRECTIVES[directive];
-        var hosts = hostSet[subKey];
+        var hosts = hostSet[_SCOPED_DIRECTIVES[directive]];
         if (!hosts || !hosts.length) return;
-        if (!map[directive]) {
-          // The default omits frame-src (it relies on the default-src /
-          // fenced-frame-src pair); create it from 'self' so admitting a
-          // provider frame doesn't accidentally open it to everything.
-          map[directive] = ["'self'"];
-          order.push(directive);
-        }
-        hosts.forEach(function (h) {
-          if (map[directive].indexOf(h) === -1) map[directive].push(h);
-        });
+        additions[directive] = (additions[directive] || []).concat(hosts);
       });
     });
   }
 
-  return order.map(function (name) {
-    var srcs = map[name];
-    return srcs.length ? (name + " " + srcs.join(" ")) : name;
-  }).join("; ") + ";";
+  // b.csp.mergeDirectives owns the merge: append-and-dedupe per directive,
+  // seed a directive the base omits rather than leaving it wide open, and
+  // validate only what was added so the trusted default round-trips
+  // untouched. It replaces a CSP parser written here, which had to be kept
+  // in step with whatever shape the vendored default took.
+  //
+  // The primitive throws on a directive or source it will not accept. This
+  // runs per response while rendering a payment page, and the documented
+  // contract is that a bad input degrades to the strict default rather than
+  // failing the render — so a refusal is caught and answered with exactly
+  // that. Failing closed here means the provider is refused, never admitted
+  // more broadly than asked.
+  // The refusal is recorded rather than swallowed: it means a host in
+  // CSP_HOSTS is one the primitive will not accept, which is an operator
+  // configuration problem that would otherwise show up only as a payment SDK
+  // silently failing to load.
+  try {
+    return b.csp.mergeDirectives(undefined, additions);
+  } catch (e) {
+    b.audit.safeEmit({
+      action:   "shop.security.scopedCsp.refused",
+      outcome:  "failure",
+      metadata: {
+        keys:   Array.isArray(keys) ? keys.join(",") : String(keys),
+        reason: (e && e.message) || "unknown",
+      },
+    });
+    return _vendoredSecurityHeaders.DEFAULT_CSP;
+  }
 }
 
 // ---- route-scoped Permissions-Policy (payment + passkey surfaces) --------
@@ -645,7 +636,10 @@ function scopedCsp(keys) {
 // top-level same-origin document). Quote-wrapped per RFC 9651 structured
 // fields. Single source — every page that enables the payment feature names
 // it here.
-var _PAYMENT_ALLOWLIST = 'payment=(self "https://js.stripe.com" "https://pay.google.com")';
+// Allowlist VALUES, without the `feature=` prefix — that is the shape
+// b.csp.mergePermissionsPolicy takes, and it keeps the feature name in exactly
+// one place (the registry key) rather than repeated inside its own value.
+var _PAYMENT_ALLOWLIST = '(self "https://js.stripe.com" "https://pay.google.com")';
 
 // WebAuthn assertion / attestation run in the page's OWN top-level document
 // (the islands call navigator.credentials.get / .create directly, never from
@@ -655,8 +649,8 @@ var _PAYMENT_ALLOWLIST = 'payment=(self "https://js.stripe.com" "https://pay.goo
 // still cannot drive WebAuthn. Single source — every passkey page names the
 // feature → allowlist mapping here.
 var _PASSKEY_FEATURE_ALLOWLIST = {
-  "publickey-credentials-get":    "publickey-credentials-get=(self)",
-  "publickey-credentials-create": "publickey-credentials-create=(self)",
+  "publickey-credentials-get":    "(self)",
+  "publickey-credentials-create": "(self)",
 };
 
 // Feature name → its scoped allowlist token. The pay surface relaxes
@@ -697,12 +691,25 @@ function scopedPermissionsPolicy(opts) {
       overrides[name] = _SCOPED_FEATURE_OVERRIDES[name];
     }
   });
-  return _vendoredSecurityHeaders.DEFAULT_PERMISSIONS.map(function (entry) {
-    var feature = entry.split("=")[0];
-    return Object.prototype.hasOwnProperty.call(overrides, feature)
-      ? overrides[feature]
-      : entry;
-  }).join(", ");
+
+  // b.csp.mergePermissionsPolicy applies the overrides onto the vendored
+  // denylist, replacing a map-and-rejoin over that list here. The registry
+  // filter above still runs first, so an unnamed feature cannot be relaxed and
+  // an unknown one is dropped rather than passed to a primitive that refuses
+  // it — which preserves the documented never-throw behaviour on a render
+  // path. A refusal is still possible if a registry VALUE is malformed, and
+  // that is an operator configuration error worth surfacing rather than
+  // hiding behind a silently strict header.
+  try {
+    return b.csp.mergePermissionsPolicy(undefined, overrides);
+  } catch (e) {
+    b.audit.safeEmit({
+      action:   "shop.security.scopedPermissionsPolicy.refused",
+      outcome:  "failure",
+      metadata: { features: features.join(","), reason: (e && e.message) || "unknown" },
+    });
+    return _vendoredSecurityHeaders.DEFAULT_PERMISSIONS.join(", ");
+  }
 }
 
 /**
@@ -759,7 +766,7 @@ function botGuardOpts() {
       // directory (e.g. /.well-known/apple-...-association/anything), re-opening
       // the guard on routes that aren't the single static association file.
       .concat(PUBLIC_WELL_KNOWN_PATHS.map(function (p) {
-        return new RegExp("^" + p.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&") + "$");
+        return new RegExp("^" + b.codepointClass.escapeRegExp(p) + "$");
       }))
       .concat([/^\/admin(\/|$)/]),
   };
@@ -772,6 +779,28 @@ function _hasPrefix(pathname, prefixes) {
   return false;
 }
 
+// Skip matchers for the request-lifecycle guards, built once.
+//
+// b.requestHelpers.makeSkipMatcher takes the REQUEST rather than a pathname
+// the caller derived, which removes three copies of `req.pathname || req.url
+// || "/"` and keeps the exemption correct if a guard is ever mounted somewhere
+// the router has not already set `req.pathname` — the matcher strips the query
+// string itself rather than trusting the caller to have done it.
+//
+// Two matchers because the semantics differ: a webhook path is a PREFIX (the
+// processor may append to it) while the health path is EXACT (`/_/healthz`
+// must not inherit the exemption).
+var _skipWebhookPath = b.requestHelpers.makeSkipMatcher(
+  { skipPaths: WEBHOOK_PATHS.slice() }, "securityMiddleware.webhookSkip");
+var _skipHealthPath = b.requestHelpers.makeSkipMatcher(
+  { skipPaths: [HEALTH_PATH], exact: true }, "securityMiddleware.healthSkip");
+
+// Both guards exempt the same set: a server-to-server webhook authenticated by
+// its own signature, and the liveness probe.
+function _isUnguardedPath(req) {
+  return _skipWebhookPath(req) || _skipHealthPath(req);
+}
+
 /**
  * Mount the per-route tight rate limiters + the fetch-metadata gate on
  * the router inside the operator's `routes(r)` chain. Call AFTER the
@@ -830,7 +859,7 @@ function mountRouteGuards(r) {
   });
   r.use(function csrfGuard(req, res, next) {
     var pathname = req.pathname || req.url || "/";
-    if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();
+    if (_isUnguardedPath(req)) return next();
     if (isEdgeExemptPath(pathname)) return next();
     return csrfGate(req, res, next);
   });
@@ -852,8 +881,7 @@ function mountRouteGuards(r) {
     allowedNavigate: true,
   });
   r.use(function fetchMetadataGuard(req, res, next) {
-    var pathname = req.pathname || req.url || "/";
-    if (_hasPrefix(pathname, WEBHOOK_PATHS)) return next();
+    if (_skipWebhookPath(req)) return next();
     return fmGate(req, res, next);
   });
 
@@ -907,7 +935,7 @@ function mountRouteGuards(r) {
   r.use(function tightRateGuard(req, res, next) {
     var pathname = req.pathname || req.url || "/";
     // Never throttle the webhook or health paths.
-    if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();
+    if (_isUnguardedPath(req)) return next();
     if (!_hasPrefix(pathname, TIGHT_PREFIXES)) return next();
     // `/products/`, `/gift-cards`, and `/orders/` carry GET reads (PDP,
     // balance page render, order confirmation page) that a shopper hits

package/lib/seller-signup.js

@@ -129,12 +129,9 @@ var MIME_RE                   = /^[A-Za-z0-9!#$&^_.+\-]{1,127}\/[A-Za-z0-9!#$&^_
 // the shape vendors / purchase-orders use. Operator-rendered fields
 // refuse these to keep downstream dashboards / KYC printouts safe
 // from header-injection + visual-spoofing attacks.
-var CONTROL_BYTE_RE           = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -157,12 +154,7 @@ function _businessName(s) {
   if (s.length > MAX_BUSINESS_NAME_LEN) {
     throw new TypeError("seller-signup: business_name must be <= " + MAX_BUSINESS_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("seller-signup: business_name contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("seller-signup: business_name contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "seller-signup: business_name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -219,9 +211,7 @@ function _businessAddress(value) {
   if (encoded.length > MAX_ADDRESS_JSON_LEN) {
     throw new TypeError("seller-signup: business_address JSON must be <= " + MAX_ADDRESS_JSON_LEN + " characters serialised");
   }
-  if (CONTROL_BYTE_RE.test(encoded) || ZERO_WIDTH_RE.test(encoded)) {
-    throw new TypeError("seller-signup: business_address contains control / zero-width bytes");
-  }
+  textGuard.freeText(encoded, "seller-signup: business_address", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return encoded;
 }
 
@@ -260,7 +250,7 @@ function _categoryFocus(value) {
     if (typeof value[i] !== "string" || !value[i].length) {
       throw new TypeError("seller-signup: category_focus[" + i + "] must be a non-empty string");
     }
-    if (CONTROL_BYTE_RE.test(value[i]) || ZERO_WIDTH_RE.test(value[i])) {
+    if (textGuard.hasCodepointThreat(value[i], { singleLine: "reject", zeroWidth: "reject" })) {
       throw new TypeError("seller-signup: category_focus[" + i + "] contains control / zero-width bytes");
     }
   }
@@ -305,9 +295,7 @@ function _referencesJson(value) {
   if (encoded.length > MAX_REFERENCES_JSON_LEN) {
     throw new TypeError("seller-signup: references_json must be <= " + MAX_REFERENCES_JSON_LEN + " characters serialised");
   }
-  if (CONTROL_BYTE_RE.test(encoded) || ZERO_WIDTH_RE.test(encoded)) {
-    throw new TypeError("seller-signup: references_json contains control / zero-width bytes");
-  }
+  textGuard.freeText(encoded, "seller-signup: references_json", { singleLine: "reject", zeroWidth: "reject" });
   return encoded;
 }
 
@@ -325,12 +313,10 @@ function _instructions(s) {
   if (s.length > MAX_INSTRUCTIONS_LEN) {
     throw new TypeError("seller-signup: instructions must be <= " + MAX_INSTRUCTIONS_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\n\r]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("seller-signup: instructions contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("seller-signup: instructions contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "seller-signup: instructions", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -341,12 +327,10 @@ function _rejectReason(s) {
   if (s.length > MAX_REJECT_REASON_LEN) {
     throw new TypeError("seller-signup: reason must be <= " + MAX_REJECT_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\n\r]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("seller-signup: reason contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("seller-signup: reason contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "seller-signup: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -357,7 +341,7 @@ function _operatorId(s, label) {
   if (s.length > MAX_OPERATOR_ID_LEN) {
     throw new TypeError("seller-signup: " + label + " must be <= " + MAX_OPERATOR_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError("seller-signup: " + label + " contains control / zero-width bytes");
   }
   return s;

package/lib/sidebar-widgets.js

@@ -75,6 +75,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -125,11 +126,6 @@ var PAGE_KEY_RE   = /^[A-Za-z0-9][A-Za-z0-9:._\/-]{0,119}$/;
 var BADGE_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var SEGMENT_RE    = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 
-var CONTROL_BYTE_LINE_RE  = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "title",
@@ -176,12 +172,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("sidebarWidgets: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("sidebarWidgets: title must not contain control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("sidebarWidgets: title must not contain zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "sidebarWidgets: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -260,10 +251,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("sidebarWidgets: " + label + " must be a non-empty string <= " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain zero-width / direction-override characters");
   }
   return s;
@@ -273,10 +264,10 @@ function _block(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("sidebarWidgets: " + label + " must be a non-empty string <= " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("sidebarWidgets: " + label + " must not contain zero-width / direction-override characters");
   }
   return s;

package/lib/site-redirects.js

@@ -101,18 +101,15 @@ var MAX_REGEX_SOURCE_LEN  = 512;
 var MAX_LIMIT             = 1000;
 var DEFAULT_LIMIT         = 100;
 
-var CONTROL_BYTE_RE       = /[\x00-\x1f\x7f]/;
 // Zero-width + invisible bytes: U+200B (zero-width space),
 // U+200C (zero-width non-joiner), U+200D (zero-width joiner),
 // U+2060 (word joiner), U+FEFF (zero-width no-break space / BOM).
 // Source code uses escape sequences so the file itself stays
 // linter-clean (raw zero-width bytes in source trip both
 // no-irregular-whitespace and no-misleading-character-class).
-var ZERO_WIDTH_RE         = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // Monotonic clock — ensures consecutive _now() calls from the same
 // process never collide in the same millisecond, so updated_at /
@@ -153,9 +150,7 @@ function _sourcePath(s) {
       "siteRedirects: source_path must be <= " + MAX_SOURCE_PATH_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("siteRedirects: source_path contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "siteRedirects: source_path", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) !== 47 /* "/" */) {
     throw new TypeError("siteRedirects: source_path must be /-rooted (start with '/')");
   }
@@ -179,9 +174,7 @@ function _targetUrl(s) {
       "siteRedirects: target_url must be <= " + MAX_TARGET_URL_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("siteRedirects: target_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "siteRedirects: target_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError(
@@ -272,9 +265,7 @@ function _compileRegex(source) {
       "siteRedirects: regex source must be <= " + MAX_REGEX_SOURCE_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(source) || ZERO_WIDTH_RE.test(source)) {
-    throw new TypeError("siteRedirects: regex source contains control / zero-width bytes");
-  }
+  textGuard.freeText(source, "siteRedirects: regex source", { singleLine: "reject", zeroWidth: "reject" });
   var anchored = "^(?:" + source + ")$";
   try {
     return b.regexLinear.compile(anchored);
@@ -500,9 +491,7 @@ function create(opts) {
     if (typeof path !== "string" || !path.length) {
       throw new TypeError("siteRedirects.resolveForPath: path must be a non-empty string");
     }
-    if (CONTROL_BYTE_RE.test(path)) {
-      throw new TypeError("siteRedirects.resolveForPath: path contains control bytes");
-    }
+    textGuard.freeText(path, "siteRedirects.resolveForPath: path", { singleLine: "reject" });
     var now = _now();
 
     // -- exact ----------------------------------------------------------

package/lib/sitemap-generator.js

@@ -107,9 +107,9 @@ var ALLOWED_CHANGEFREQS = Object.freeze([
   "never",
 ]);
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -134,9 +134,7 @@ function _basePath(s) {
   if (typeof s !== "string" || s.length < 1 || s.length > MAX_BASE_PATH_LEN) {
     throw new TypeError("sitemapGenerator: base_path must be a string 1.." + MAX_BASE_PATH_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("sitemapGenerator: base_path contains control bytes");
-  }
+  textGuard.freeText(s, "sitemapGenerator: base_path", { singleLine: "reject" });
   if (s.charCodeAt(0) !== 47 /* "/" */) {
     throw new TypeError("sitemapGenerator: base_path must start with '/'");
   }
@@ -177,9 +175,7 @@ function _originUrl(u) {
   if (typeof u !== "string" || u.length < 1 || u.length > MAX_ORIGIN_URL_LEN) {
     throw new TypeError("sitemapGenerator: origin_url must be a string 1.." + MAX_ORIGIN_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(u)) {
-    throw new TypeError("sitemapGenerator: origin_url contains control bytes");
-  }
+  textGuard.freeText(u, "sitemapGenerator: origin_url", { singleLine: "reject" });
   try {
     b.safeUrl.parse(u, { allowedProtocols: ["https:"] });
   } catch (e) {

package/lib/sms-dispatcher.js

@@ -62,6 +62,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -103,10 +104,6 @@ var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var COUNTRY_RE       = /^[A-Z]{2}$/;
 var PHONE_HASH_RE    = /^[0-9a-f]{128}$/;
 var PHONE_NORM_RE    = /^\+[1-9][0-9]{6,14}$/;   // E.164: +<country><subscriber>, 7-15 digits total
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Inbound STOP-keyword detection. Operators in the US/UK/AU regulatory
 // envelope have all converged on this short list; the primitive
@@ -150,9 +147,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("smsDispatcher: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: name contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: name", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -163,9 +158,7 @@ function _endpointUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("smsDispatcher: endpoint_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: endpoint_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: endpoint_url", { zeroWidth: "reject" });
   // Shape gate — refuse anything that isn't an absolute https URL.
   // Provider endpoints are public APIs; operators using a non-https
   // egress are leaking the message body across the wire.
@@ -260,7 +253,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("smsDispatcher: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("smsDispatcher: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -274,9 +267,7 @@ function _optInText(s) {
   if (s.length > MAX_OPT_IN_TEXT_LEN) {
     throw new TypeError("smsDispatcher: opt_in_text must be <= " + MAX_OPT_IN_TEXT_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: opt_in_text contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: opt_in_text", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -287,9 +278,7 @@ function _providerRef(s) {
   if (s.length > MAX_PROVIDER_REF_LEN) {
     throw new TypeError("smsDispatcher: provider_ref must be <= " + MAX_PROVIDER_REF_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: provider_ref contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: provider_ref", { zeroWidth: "reject" });
   return s;
 }
 
@@ -333,12 +322,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("smsDispatcher: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("smsDispatcher: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: body contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "smsDispatcher: body", { zeroWidth: "reject", bidiMarks: "allow" });
   // Refuse the degenerate emoji-only shape. Walk the string by code
   // point so surrogate pairs in the SMP emoji blocks count as one
   // character.

package/lib/stock-receipts.js

@@ -70,6 +70,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -100,7 +101,6 @@ var LINE_STATES             = Object.freeze([
   "pending", "received", "damaged", "partial",
 ]);
 
-var CONTROL_BYTE_RE         = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -171,9 +171,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("stockReceipts: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: reason", { bidiMarks: "allow" });
   return s;
 }
 
@@ -192,9 +190,7 @@ function _uaOpt(s) {
   if (typeof s !== "string" || s.length > MAX_UA_LEN) {
     throw new TypeError("stockReceipts: user_agent must be a string <= " + MAX_UA_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: user_agent must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: user_agent");
   return s;
 }
 
@@ -203,9 +199,7 @@ function _ipOpt(s) {
   if (typeof s !== "string" || s.length > MAX_IP_LEN) {
     throw new TypeError("stockReceipts: client_ip must be a string <= " + MAX_IP_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: client_ip must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: client_ip");
   return s;
 }
 

package/lib/storefront-dashboards.js

@@ -89,6 +89,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN     = 80;
 var MAX_TITLE_LEN    = 200;
@@ -140,14 +141,10 @@ var WIDGET_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var LOCALE_RE = /^[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/;
 
 // Refuse C0 control bytes + DEL in operator-authored text fields.
-var CONTROL_BYTE_LINE_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the rest of the
 // shop primitives. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -166,12 +163,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("storefrontDashboards: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("storefrontDashboards: title contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("storefrontDashboards: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "storefrontDashboards: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }