@blamejs/blamejs-shop 0.5.21 → 0.5.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. package/CHANGELOG.md +4 -0
  2. package/README.md +2 -1
  3. package/SECURITY.md +25 -1
  4. package/lib/addresses.js +16 -2
  5. package/lib/admin.js +116 -1
  6. package/lib/affiliates.js +3 -3
  7. package/lib/announcement-bar.js +2 -2
  8. package/lib/api-keys.js +2 -2
  9. package/lib/asset-manifest.json +5 -5
  10. package/lib/blog-articles.js +2 -2
  11. package/lib/carrier-accounts.js +2 -2
  12. package/lib/catalog-drafts.js +1 -1
  13. package/lib/category-navigation.js +6 -3
  14. package/lib/compliance-export.js +40 -3
  15. package/lib/customer-impersonation.js +105 -7
  16. package/lib/customer-notes.js +1 -1
  17. package/lib/customer-roles.js +1 -1
  18. package/lib/customer-surveys.js +2 -2
  19. package/lib/customers.js +1 -1
  20. package/lib/dispute-resolution.js +3 -3
  21. package/lib/dropship-forwarding.js +1 -1
  22. package/lib/dunning.js +1 -1
  23. package/lib/email-ab-tests.js +1 -1
  24. package/lib/email-campaigns.js +15 -2
  25. package/lib/email-warmup.js +1 -1
  26. package/lib/externaldb-d1.js +0 -8
  27. package/lib/gift-options.js +3 -3
  28. package/lib/knowledge-base.js +3 -3
  29. package/lib/line-gift-wrap.js +6 -2
  30. package/lib/live-chat.js +1 -1
  31. package/lib/notifications.js +1 -1
  32. package/lib/operator-accounts.js +1 -1
  33. package/lib/operator-help-center.js +3 -3
  34. package/lib/operator-inbox.js +2 -2
  35. package/lib/operator-roles.js +1 -1
  36. package/lib/order-notes.js +2 -2
  37. package/lib/order-ratings.js +3 -3
  38. package/lib/payment-methods.js +1 -1
  39. package/lib/payment-retries.js +1 -1
  40. package/lib/pixel-events.js +14 -6
  41. package/lib/plan-changes.js +1 -1
  42. package/lib/product-qa.js +1 -1
  43. package/lib/push-notifications.js +2 -2
  44. package/lib/reviews.js +3 -3
  45. package/lib/seller-signup.js +4 -4
  46. package/lib/sidebar-widgets.js +1 -1
  47. package/lib/sms-dispatcher.js +3 -3
  48. package/lib/stock-receipts.js +1 -1
  49. package/lib/storefront-dashboards.js +1 -1
  50. package/lib/storefront-forms.js +1 -1
  51. package/lib/storefront-pages.js +2 -2
  52. package/lib/storefront.js +569 -1
  53. package/lib/subscription-billing.js +1 -1
  54. package/lib/subscription-controls.js +1 -1
  55. package/lib/suggestion-box.js +4 -4
  56. package/lib/support-tickets.js +3 -3
  57. package/lib/tenants.js +1 -1
  58. package/lib/text-guard.js +44 -2
  59. package/lib/theme-assets.js +1 -1
  60. package/lib/vendor/MANIFEST.json +12 -12
  61. package/lib/vendor/blamejs/CHANGELOG.md +32 -0
  62. package/lib/vendor/blamejs/NOTICE +1 -1
  63. package/lib/vendor/blamejs/README.md +1 -1
  64. package/lib/vendor/blamejs/lib/network-tls.js +98 -13
  65. package/lib/vendor/blamejs/lib/vendor/MANIFEST.json +12 -12
  66. package/lib/vendor/blamejs/lib/vendor/blamejs-pki.cjs +568 -304
  67. package/lib/vendor/blamejs/package.json +1 -1
  68. package/lib/vendor/blamejs/sbom.cdx.json +6 -6
  69. package/lib/vendors.js +3 -3
  70. package/lib/webhook-receiver.js +1 -1
  71. package/lib/webhook-subscriptions.js +1 -1
  72. package/lib/wishlist-sharing.js +1 -1
  73. package/package.json +1 -1
package/lib/reviews.js CHANGED
@@ -75,7 +75,7 @@ function _title(s) {
75
75
  if (s.length > MAX_TITLE_LEN) {
76
76
  throw new TypeError("reviews: title must be <= " + MAX_TITLE_LEN + " characters");
77
77
  }
78
- textGuard.freeText(s, "reviews: title");
78
+ textGuard.freeText(s, "reviews: title", { bidiMarks: "allow" });
79
79
  return s;
80
80
  }
81
81
 
@@ -87,7 +87,7 @@ function _body(s) {
87
87
  if (s.length > MAX_BODY_LEN) {
88
88
  throw new TypeError("reviews: body must be <= " + MAX_BODY_LEN + " characters");
89
89
  }
90
- textGuard.freeText(s, "reviews: body");
90
+ textGuard.freeText(s, "reviews: body", { bidiMarks: "allow" });
91
91
  return s;
92
92
  }
93
93
 
@@ -284,7 +284,7 @@ function create(opts) {
284
284
  if (reason.length > MAX_REJECT_REASON_LEN) {
285
285
  throw new TypeError("reviews.reject: reason must be <= " + MAX_REJECT_REASON_LEN + " characters");
286
286
  }
287
- textGuard.freeText(reason, "reviews.reject: reason");
287
+ textGuard.freeText(reason, "reviews.reject: reason", { bidiMarks: "allow" });
288
288
  }
289
289
  var ts = _now();
290
290
  var existing = (await query("SELECT id, status FROM reviews WHERE id = ?1", [id])).rows[0];
package/lib/seller-signup.js CHANGED
@@ -154,7 +154,7 @@ function _businessName(s) {
154
154
  if (s.length > MAX_BUSINESS_NAME_LEN) {
155
155
  throw new TypeError("seller-signup: business_name must be <= " + MAX_BUSINESS_NAME_LEN + " characters");
156
156
  }
157
- textGuard.freeText(s, "seller-signup: business_name", { singleLine: "reject", zeroWidth: "reject" });
157
+ textGuard.freeText(s, "seller-signup: business_name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
158
158
  return s;
159
159
  }
160
160
 
@@ -211,7 +211,7 @@ function _businessAddress(value) {
211
211
  if (encoded.length > MAX_ADDRESS_JSON_LEN) {
212
212
  throw new TypeError("seller-signup: business_address JSON must be <= " + MAX_ADDRESS_JSON_LEN + " characters serialised");
213
213
  }
214
- textGuard.freeText(encoded, "seller-signup: business_address", { singleLine: "reject", zeroWidth: "reject" });
214
+ textGuard.freeText(encoded, "seller-signup: business_address", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
215
215
  return encoded;
216
216
  }
217
217
 
@@ -316,7 +316,7 @@ function _instructions(s) {
316
316
  if (textGuard.hasCodepointThreat(s)) {
317
317
  throw new TypeError("seller-signup: instructions contains control bytes");
318
318
  }
319
- textGuard.freeText(s, "seller-signup: instructions", { zeroWidth: "reject" });
319
+ textGuard.freeText(s, "seller-signup: instructions", { zeroWidth: "reject", bidiMarks: "allow" });
320
320
  return s;
321
321
  }
322
322
 
@@ -330,7 +330,7 @@ function _rejectReason(s) {
330
330
  if (textGuard.hasCodepointThreat(s)) {
331
331
  throw new TypeError("seller-signup: reason contains control bytes");
332
332
  }
333
- textGuard.freeText(s, "seller-signup: reason", { zeroWidth: "reject" });
333
+ textGuard.freeText(s, "seller-signup: reason", { zeroWidth: "reject", bidiMarks: "allow" });
334
334
  return s;
335
335
  }
336
336
 
package/lib/sidebar-widgets.js CHANGED
@@ -172,7 +172,7 @@ function _title(s) {
172
172
  if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
173
173
  throw new TypeError("sidebarWidgets: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
174
174
  }
175
- textGuard.freeText(s, "sidebarWidgets: title", { singleLine: "reject", zeroWidth: "reject" });
175
+ textGuard.freeText(s, "sidebarWidgets: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
176
176
  return s;
177
177
  }
178
178
 
package/lib/sms-dispatcher.js CHANGED
@@ -147,7 +147,7 @@ function _name(s) {
147
147
  if (s.length > MAX_NAME_LEN) {
148
148
  throw new TypeError("smsDispatcher: name must be <= " + MAX_NAME_LEN + " characters");
149
149
  }
150
- textGuard.freeText(s, "smsDispatcher: name", { zeroWidth: "reject" });
150
+ textGuard.freeText(s, "smsDispatcher: name", { zeroWidth: "reject", bidiMarks: "allow" });
151
151
  return s;
152
152
  }
153
153
 
@@ -267,7 +267,7 @@ function _optInText(s) {
267
267
  if (s.length > MAX_OPT_IN_TEXT_LEN) {
268
268
  throw new TypeError("smsDispatcher: opt_in_text must be <= " + MAX_OPT_IN_TEXT_LEN + " characters");
269
269
  }
270
- textGuard.freeText(s, "smsDispatcher: opt_in_text", { zeroWidth: "reject" });
270
+ textGuard.freeText(s, "smsDispatcher: opt_in_text", { zeroWidth: "reject", bidiMarks: "allow" });
271
271
  return s;
272
272
  }
273
273
 
@@ -322,7 +322,7 @@ function _body(s) {
322
322
  if (s.length > MAX_BODY_LEN) {
323
323
  throw new TypeError("smsDispatcher: body must be <= " + MAX_BODY_LEN + " characters");
324
324
  }
325
- textGuard.freeText(s, "smsDispatcher: body", { zeroWidth: "reject" });
325
+ textGuard.freeText(s, "smsDispatcher: body", { zeroWidth: "reject", bidiMarks: "allow" });
326
326
  // Refuse the degenerate emoji-only shape. Walk the string by code
327
327
  // point so surrogate pairs in the SMP emoji blocks count as one
328
328
  // character.
package/lib/stock-receipts.js CHANGED
@@ -171,7 +171,7 @@ function _reason(s) {
171
171
  if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
172
172
  throw new TypeError("stockReceipts: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
173
173
  }
174
- textGuard.freeText(s, "stockReceipts: reason");
174
+ textGuard.freeText(s, "stockReceipts: reason", { bidiMarks: "allow" });
175
175
  return s;
176
176
  }
177
177
 
package/lib/storefront-dashboards.js CHANGED
@@ -163,7 +163,7 @@ function _title(s) {
163
163
  if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
164
164
  throw new TypeError("storefrontDashboards: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
165
165
  }
166
- textGuard.freeText(s, "storefrontDashboards: title", { singleLine: "reject", zeroWidth: "reject" });
166
+ textGuard.freeText(s, "storefrontDashboards: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
167
167
  return s;
168
168
  }
169
169
 
package/lib/storefront-forms.js CHANGED
@@ -180,7 +180,7 @@ function _description(s) {
180
180
  if (typeof s !== "string" || s.length > MAX_DESCRIPTION_LEN) {
181
181
  throw new TypeError("storefrontForms: description must be a string ≤ " + MAX_DESCRIPTION_LEN + " chars");
182
182
  }
183
- textGuard.freeText(s, "storefrontForms: description", { zeroWidth: "reject" });
183
+ textGuard.freeText(s, "storefrontForms: description", { zeroWidth: "reject", bidiMarks: "allow" });
184
184
  return s;
185
185
  }
186
186
 
package/lib/storefront-pages.js CHANGED
@@ -131,7 +131,7 @@ function _title(s) {
131
131
  if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
132
132
  throw new TypeError("storefrontPages: title must be a non-empty string ≤ " + MAX_TITLE_LEN + " chars");
133
133
  }
134
- textGuard.freeText(s, "storefrontPages: title", { singleLine: "reject", zeroWidth: "reject" });
134
+ textGuard.freeText(s, "storefrontPages: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
135
135
  return s;
136
136
  }
137
137
 
@@ -139,7 +139,7 @@ function _body(s) {
139
139
  if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
140
140
  throw new TypeError("storefrontPages: body must be a non-empty string ≤ " + MAX_BODY_LEN + " chars");
141
141
  }
142
- textGuard.freeText(s, "storefrontPages: body", { zeroWidth: "reject" });
142
+ textGuard.freeText(s, "storefrontPages: body", { zeroWidth: "reject", bidiMarks: "allow" });
143
143
  return s;
144
144
  }
145
145