@defra/fcp-sfd-frontend-engine 0.6.0 → 0.7.0

package/dist/index.cjs

@@ -129,17 +129,36 @@ var mappers = {
   businessDetails: mapBusinessDetails
 };
 
-// src/schemas/business/business-sbi-schema.js
+// src/utils/joi.js
 var import_joi = __toESM(require("joi"), 1);
-var businessSbiSchema = import_joi.default.object({
-  sbi: import_joi.default.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full SBI"
+
+// src/constants/patterns.js
+var PHONE_NUMBER_PATTERN = /^\+?(?=[\d ()]*\d)[\d ()]*$/;
+var NO_CONTROL_CHARS_PATTERN = /^[^\x00-\x1f\x7f-\x9f]*$/;
+
+// src/utils/joi.js
+var Joi = import_joi.default.extend((joi) => ({
+  type: "string",
+  base: joi.string(),
+  messages: {
+    "string.noControlChars": "Field must not contain invalid characters"
+  },
+  validate(value, helpers) {
+    if (typeof value === "string" && !NO_CONTROL_CHARS_PATTERN.test(value)) {
+      return { value, errors: helpers.error("string.noControlChars") };
+    }
+    return { value };
+  }
+}));
+
+// src/schemas/business/business-sbi-schema.js
+var businessSbiSchema = Joi.object({
+  sbi: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter the full SBI",
+    "string.noControlChars": "SBI must not contain invalid characters"
   })
 });
 
-// src/schemas/address-schema.js
-var import_joi2 = __toESM(require("joi"), 1);
-
 // src/constants/validation-fields.js
 var FIRST_NAME_MAX = 100;
 var LAST_NAME_MAX = 100;
@@ -155,53 +174,59 @@ var COUNTY_MAX = 60;
 var COUNTRY_MAX = 60;
 var POSTCODE_MAX = 8;
 
-// src/schemas/address-schema.js
-var addressSchema = import_joi2.default.object({
-  address1: import_joi2.default.string().required().max(ADDRESS_LINE_MAX).messages({
+// src/schemas/shared/address-schema.js
+var addressSchema = Joi.object({
+  address1: Joi.string().trim().required().max(ADDRESS_LINE_MAX).messages({
     "string.empty": "Enter address line 1, typically the building and street",
     "string.max": `Address line 1 must be ${ADDRESS_LINE_MAX} characters or less`,
-    "any.required": "Enter address line 1, typically the building and street"
+    "any.required": "Enter address line 1, typically the building and street",
+    "string.noControlChars": "Address line 1 must not contain invalid characters"
   }),
-  address2: import_joi2.default.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`
+  address2: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 2 must not contain invalid characters"
   }),
-  address3: import_joi2.default.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`
+  address3: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 3 must not contain invalid characters"
   }),
-  city: import_joi2.default.string().required().max(TOWN_CITY_MAX).messages({
+  city: Joi.string().trim().required().max(TOWN_CITY_MAX).messages({
     "string.empty": "Enter town or city",
     "string.max": `Town or city must be ${TOWN_CITY_MAX} characters or less`,
-    "any.required": "Enter town or city"
+    "any.required": "Enter town or city",
+    "string.noControlChars": "Town or city must not contain invalid characters"
   }),
-  county: import_joi2.default.string().allow("").max(COUNTY_MAX).messages({
-    "string.max": `County must be ${COUNTY_MAX} characters or less`
+  county: Joi.string().trim().allow("").max(COUNTY_MAX).messages({
+    "string.max": `County must be ${COUNTY_MAX} characters or less`,
+    "string.noControlChars": "County must not contain invalid characters"
   }),
-  postcode: import_joi2.default.string().required().max(POSTCODE_MAX).messages({
+  postcode: Joi.string().trim().required().max(POSTCODE_MAX).messages({
     "any.required": "Enter a postal code or zip code",
     "string.empty": "Enter a postal code or zip code",
-    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`
+    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`,
+    "string.noControlChars": "Postal code or zip code must not contain invalid characters"
   }),
-  country: import_joi2.default.string().required().max(COUNTRY_MAX).messages({
+  country: Joi.string().trim().required().max(COUNTRY_MAX).messages({
     "string.empty": "Enter a country",
     "string.max": `Country must be ${COUNTRY_MAX} characters or less`,
-    "any.required": "Enter a country"
+    "any.required": "Enter a country",
+    "string.noControlChars": "Country must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-name-schema.js
-var import_joi3 = __toESM(require("joi"), 1);
-var businessNameSchema = import_joi3.default.object({
-  businessName: import_joi3.default.string().required().max(BUSINESS_NAME_MAX).messages({
+var businessNameSchema = Joi.object({
+  businessName: Joi.string().trim().required().max(BUSINESS_NAME_MAX).messages({
     "string.empty": "Enter business name",
     "string.max": `Business name must be ${BUSINESS_NAME_MAX} characters or less`,
-    "any.required": "Enter business name"
+    "any.required": "Enter business name",
+    "string.noControlChars": "Business name must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-email-schema.js
-var import_joi4 = __toESM(require("joi"), 1);
-var businessEmailSchema = import_joi4.default.object({
-  businessEmail: import_joi4.default.string().required().max(EMAIL_MAX).email({
+var businessEmailSchema = Joi.object({
+  businessEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true
@@ -209,37 +234,34 @@ var businessEmailSchema = import_joi4.default.object({
   }).messages({
     "string.max": `Business email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter business email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Business email address must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-phone-schema.js
-var import_joi5 = __toESM(require("joi"), 1);
-
-// src/constants/patterns.js
-var PHONE_NUMBER_PATTERN = /^\+?[0-9 ()]+$/;
-
-// src/schemas/business/business-phone-schema.js
-var businessPhoneSchema = import_joi5.default.object({
-  businessTelephone: import_joi5.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var businessPhoneSchema = Joi.object({
+  businessTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business telephone number must not contain invalid characters"
   }),
-  businessMobile: import_joi5.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  businessMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business mobile phone number must not contain invalid characters"
   })
 }).or("businessTelephone", "businessMobile").messages({
   "object.missing": "Enter at least one phone number"
 });
 
 // src/schemas/business/business-vat-schema.js
-var import_joi6 = __toESM(require("joi"), 1);
-var businessVatSchema = import_joi6.default.object({
-  vatNumber: import_joi6.default.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter a VAT registration number, like 123456789"
+var businessVatSchema = Joi.object({
+  vatNumber: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter a VAT registration number, like 123456789",
+    "string.noControlChars": "VAT registration number must not contain invalid characters"
   })
 });
 
@@ -256,10 +278,10 @@ var businessSchemas = {
 };
 
 // src/schemas/customer/customer-crn-schema.js
-var import_joi7 = __toESM(require("joi"), 1);
-var customerCrnSchema = import_joi7.default.object({
-  crn: import_joi7.default.string().pattern(/^\d{10}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full CRN"
+var customerCrnSchema = Joi.object({
+  crn: Joi.string().pattern(/^\d{10}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter the full CRN",
+    "string.noControlChars": "CRN must not contain invalid characters"
   })
 });
 
@@ -269,26 +291,25 @@ var customerSchemas = {
 };
 
 // src/schemas/personal/personal-name-schema.js
-var import_joi8 = __toESM(require("joi"), 1);
-var personalNameSchema = import_joi8.default.object({
-  first: import_joi8.default.string().required().max(FIRST_NAME_MAX).messages({
+var personalNameSchema = Joi.object({
+  first: Joi.string().trim().required().max(FIRST_NAME_MAX).messages({
     "string.empty": "Enter first name",
     "string.max": `First name must be ${FIRST_NAME_MAX} characters or less`,
-    "any.required": "Enter first name"
+    "any.required": "Enter first name",
+    "string.noControlChars": "First name must not contain invalid characters"
   }),
-  last: import_joi8.default.string().required().max(LAST_NAME_MAX).messages({
+  last: Joi.string().trim().required().max(LAST_NAME_MAX).messages({
     "string.empty": "Enter last name",
     "string.max": `Last name must be ${LAST_NAME_MAX} characters or less`,
-    "any.required": "Enter last name"
+    "any.required": "Enter last name",
+    "string.noControlChars": "Last name must not contain invalid characters"
   }),
-  middle: import_joi8.default.string().allow("").max(MIDDLE_NAMES_MAX).messages({
-    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`
+  middle: Joi.string().trim().allow("").max(MIDDLE_NAMES_MAX).messages({
+    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`,
+    "string.noControlChars": "Middle names must not contain invalid characters"
   })
 });
 
-// src/schemas/personal/personal-dob-schema.js
-var import_joi9 = __toESM(require("joi"), 1);
-
 // src/constants/month-map.js
 var MONTH_MAP = {
   january: 1,
@@ -318,10 +339,10 @@ var MONTH_MAP = {
 };
 
 // src/schemas/personal/personal-dob-schema.js
-var personalDobSchema = import_joi9.default.object({
-  day: import_joi9.default.string().allow(""),
-  month: import_joi9.default.string().allow(""),
-  year: import_joi9.default.string().allow("")
+var personalDobSchema = Joi.object({
+  day: Joi.string().allow(""),
+  month: Joi.string().allow(""),
+  year: Joi.string().allow("")
 }).custom((value, helpers) => {
   const { day, month, year } = value;
   const missingFieldsError = checkMissingFields(day, month, year, helpers);
@@ -339,7 +360,9 @@ var personalDobSchema = import_joi9.default.object({
   if (fullDate.isJoiError) {
     return fullDate;
   }
-  if (fullDate > /* @__PURE__ */ new Date()) {
+  const today = /* @__PURE__ */ new Date();
+  today.setUTCHours(0, 0, 0, 0);
+  if (fullDate >= today) {
     return makeError(helpers, "dob.future", ["day", "month", "year"]);
   }
   const tooOldError = checkNotTooOld(fullDate, helpers);
@@ -358,7 +381,8 @@ var personalDobSchema = import_joi9.default.object({
   "dob.yearLength": "Enter a year with 4 numbers, like 1975",
   "dob.invalid": "Date of birth must be a real date",
   "dob.future": "Date of birth must be in the past",
-  "dob.tooOld": "Date of birth must be on or after {{#oldest}}"
+  "dob.tooOld": "Date of birth must be on or after {{#oldest}}",
+  "string.noControlChars": "Date of birth must not contain invalid characters"
 });
 var checkNotTooOld = (fullDate, helpers) => {
   const oldestDateAllowed = getOldestAllowedDate();
@@ -398,7 +422,11 @@ var getMonthNumber = (month, helpers) => {
     }
     return mapped;
   }
-  return Number.parseInt(month, 10);
+  const parsedMonth = Number.parseInt(month, 10);
+  if (parsedMonth < 1 || parsedMonth > 12) {
+    return makeError(helpers, "dob.invalid", ["month"]);
+  }
+  return parsedMonth;
 };
 var checkMissingFields = (day, month, year, helpers) => {
   if (!day && !month && !year) {
@@ -432,9 +460,8 @@ var makeError = (helpers, code, fields) => {
 };
 
 // src/schemas/personal/personal-email-schema.js
-var import_joi10 = __toESM(require("joi"), 1);
-var personalEmailSchema = import_joi10.default.object({
-  personalEmail: import_joi10.default.string().required().max(EMAIL_MAX).email({
+var personalEmailSchema = Joi.object({
+  personalEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true,
@@ -443,22 +470,24 @@ var personalEmailSchema = import_joi10.default.object({
   }).messages({
     "string.max": `Email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter a personal email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Personal email address must not contain invalid characters"
   })
 });
 
 // src/schemas/personal/personal-phone-schema.js
-var import_joi11 = __toESM(require("joi"), 1);
-var personalPhoneSchema = import_joi11.default.object({
-  personalTelephone: import_joi11.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var personalPhoneSchema = Joi.object({
+  personalTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal telephone number must not contain invalid characters"
   }),
-  personalMobile: import_joi11.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  personalMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal mobile phone number must not contain invalid characters"
   })
 }).or("personalTelephone", "personalMobile").messages({
   "object.missing": "Enter at least one phone number"

package/dist/index.js

@@ -91,17 +91,36 @@ var mappers = {
   businessDetails: mapBusinessDetails
 };
 
+// src/utils/joi.js
+import BaseJoi from "joi";
+
+// src/constants/patterns.js
+var PHONE_NUMBER_PATTERN = /^\+?(?=[\d ()]*\d)[\d ()]*$/;
+var NO_CONTROL_CHARS_PATTERN = /^[^\x00-\x1f\x7f-\x9f]*$/;
+
+// src/utils/joi.js
+var Joi = BaseJoi.extend((joi) => ({
+  type: "string",
+  base: joi.string(),
+  messages: {
+    "string.noControlChars": "Field must not contain invalid characters"
+  },
+  validate(value, helpers) {
+    if (typeof value === "string" && !NO_CONTROL_CHARS_PATTERN.test(value)) {
+      return { value, errors: helpers.error("string.noControlChars") };
+    }
+    return { value };
+  }
+}));
+
 // src/schemas/business/business-sbi-schema.js
-import Joi from "joi";
 var businessSbiSchema = Joi.object({
   sbi: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full SBI"
+    "string.pattern.base": "Enter the full SBI",
+    "string.noControlChars": "SBI must not contain invalid characters"
   })
 });
 
-// src/schemas/address-schema.js
-import Joi2 from "joi";
-
 // src/constants/validation-fields.js
 var FIRST_NAME_MAX = 100;
 var LAST_NAME_MAX = 100;
@@ -117,53 +136,59 @@ var COUNTY_MAX = 60;
 var COUNTRY_MAX = 60;
 var POSTCODE_MAX = 8;
 
-// src/schemas/address-schema.js
-var addressSchema = Joi2.object({
-  address1: Joi2.string().required().max(ADDRESS_LINE_MAX).messages({
+// src/schemas/shared/address-schema.js
+var addressSchema = Joi.object({
+  address1: Joi.string().trim().required().max(ADDRESS_LINE_MAX).messages({
     "string.empty": "Enter address line 1, typically the building and street",
     "string.max": `Address line 1 must be ${ADDRESS_LINE_MAX} characters or less`,
-    "any.required": "Enter address line 1, typically the building and street"
+    "any.required": "Enter address line 1, typically the building and street",
+    "string.noControlChars": "Address line 1 must not contain invalid characters"
   }),
-  address2: Joi2.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`
+  address2: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 2 must not contain invalid characters"
   }),
-  address3: Joi2.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`
+  address3: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 3 must not contain invalid characters"
   }),
-  city: Joi2.string().required().max(TOWN_CITY_MAX).messages({
+  city: Joi.string().trim().required().max(TOWN_CITY_MAX).messages({
     "string.empty": "Enter town or city",
     "string.max": `Town or city must be ${TOWN_CITY_MAX} characters or less`,
-    "any.required": "Enter town or city"
+    "any.required": "Enter town or city",
+    "string.noControlChars": "Town or city must not contain invalid characters"
   }),
-  county: Joi2.string().allow("").max(COUNTY_MAX).messages({
-    "string.max": `County must be ${COUNTY_MAX} characters or less`
+  county: Joi.string().trim().allow("").max(COUNTY_MAX).messages({
+    "string.max": `County must be ${COUNTY_MAX} characters or less`,
+    "string.noControlChars": "County must not contain invalid characters"
   }),
-  postcode: Joi2.string().required().max(POSTCODE_MAX).messages({
+  postcode: Joi.string().trim().required().max(POSTCODE_MAX).messages({
     "any.required": "Enter a postal code or zip code",
     "string.empty": "Enter a postal code or zip code",
-    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`
+    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`,
+    "string.noControlChars": "Postal code or zip code must not contain invalid characters"
   }),
-  country: Joi2.string().required().max(COUNTRY_MAX).messages({
+  country: Joi.string().trim().required().max(COUNTRY_MAX).messages({
     "string.empty": "Enter a country",
     "string.max": `Country must be ${COUNTRY_MAX} characters or less`,
-    "any.required": "Enter a country"
+    "any.required": "Enter a country",
+    "string.noControlChars": "Country must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-name-schema.js
-import Joi3 from "joi";
-var businessNameSchema = Joi3.object({
-  businessName: Joi3.string().required().max(BUSINESS_NAME_MAX).messages({
+var businessNameSchema = Joi.object({
+  businessName: Joi.string().trim().required().max(BUSINESS_NAME_MAX).messages({
     "string.empty": "Enter business name",
     "string.max": `Business name must be ${BUSINESS_NAME_MAX} characters or less`,
-    "any.required": "Enter business name"
+    "any.required": "Enter business name",
+    "string.noControlChars": "Business name must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-email-schema.js
-import Joi4 from "joi";
-var businessEmailSchema = Joi4.object({
-  businessEmail: Joi4.string().required().max(EMAIL_MAX).email({
+var businessEmailSchema = Joi.object({
+  businessEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true
@@ -171,37 +196,34 @@ var businessEmailSchema = Joi4.object({
   }).messages({
     "string.max": `Business email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter business email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Business email address must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-phone-schema.js
-import Joi5 from "joi";
-
-// src/constants/patterns.js
-var PHONE_NUMBER_PATTERN = /^\+?[0-9 ()]+$/;
-
-// src/schemas/business/business-phone-schema.js
-var businessPhoneSchema = Joi5.object({
-  businessTelephone: Joi5.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var businessPhoneSchema = Joi.object({
+  businessTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business telephone number must not contain invalid characters"
   }),
-  businessMobile: Joi5.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  businessMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business mobile phone number must not contain invalid characters"
   })
 }).or("businessTelephone", "businessMobile").messages({
   "object.missing": "Enter at least one phone number"
 });
 
 // src/schemas/business/business-vat-schema.js
-import Joi6 from "joi";
-var businessVatSchema = Joi6.object({
-  vatNumber: Joi6.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter a VAT registration number, like 123456789"
+var businessVatSchema = Joi.object({
+  vatNumber: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter a VAT registration number, like 123456789",
+    "string.noControlChars": "VAT registration number must not contain invalid characters"
   })
 });
 
@@ -218,10 +240,10 @@ var businessSchemas = {
 };
 
 // src/schemas/customer/customer-crn-schema.js
-import Joi7 from "joi";
-var customerCrnSchema = Joi7.object({
-  crn: Joi7.string().pattern(/^\d{10}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full CRN"
+var customerCrnSchema = Joi.object({
+  crn: Joi.string().pattern(/^\d{10}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter the full CRN",
+    "string.noControlChars": "CRN must not contain invalid characters"
   })
 });
 
@@ -231,26 +253,25 @@ var customerSchemas = {
 };
 
 // src/schemas/personal/personal-name-schema.js
-import Joi8 from "joi";
-var personalNameSchema = Joi8.object({
-  first: Joi8.string().required().max(FIRST_NAME_MAX).messages({
+var personalNameSchema = Joi.object({
+  first: Joi.string().trim().required().max(FIRST_NAME_MAX).messages({
     "string.empty": "Enter first name",
     "string.max": `First name must be ${FIRST_NAME_MAX} characters or less`,
-    "any.required": "Enter first name"
+    "any.required": "Enter first name",
+    "string.noControlChars": "First name must not contain invalid characters"
   }),
-  last: Joi8.string().required().max(LAST_NAME_MAX).messages({
+  last: Joi.string().trim().required().max(LAST_NAME_MAX).messages({
     "string.empty": "Enter last name",
     "string.max": `Last name must be ${LAST_NAME_MAX} characters or less`,
-    "any.required": "Enter last name"
+    "any.required": "Enter last name",
+    "string.noControlChars": "Last name must not contain invalid characters"
   }),
-  middle: Joi8.string().allow("").max(MIDDLE_NAMES_MAX).messages({
-    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`
+  middle: Joi.string().trim().allow("").max(MIDDLE_NAMES_MAX).messages({
+    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`,
+    "string.noControlChars": "Middle names must not contain invalid characters"
   })
 });
 
-// src/schemas/personal/personal-dob-schema.js
-import Joi9 from "joi";
-
 // src/constants/month-map.js
 var MONTH_MAP = {
   january: 1,
@@ -280,10 +301,10 @@ var MONTH_MAP = {
 };
 
 // src/schemas/personal/personal-dob-schema.js
-var personalDobSchema = Joi9.object({
-  day: Joi9.string().allow(""),
-  month: Joi9.string().allow(""),
-  year: Joi9.string().allow("")
+var personalDobSchema = Joi.object({
+  day: Joi.string().allow(""),
+  month: Joi.string().allow(""),
+  year: Joi.string().allow("")
 }).custom((value, helpers) => {
   const { day, month, year } = value;
   const missingFieldsError = checkMissingFields(day, month, year, helpers);
@@ -301,7 +322,9 @@ var personalDobSchema = Joi9.object({
   if (fullDate.isJoiError) {
     return fullDate;
   }
-  if (fullDate > /* @__PURE__ */ new Date()) {
+  const today = /* @__PURE__ */ new Date();
+  today.setUTCHours(0, 0, 0, 0);
+  if (fullDate >= today) {
     return makeError(helpers, "dob.future", ["day", "month", "year"]);
   }
   const tooOldError = checkNotTooOld(fullDate, helpers);
@@ -320,7 +343,8 @@ var personalDobSchema = Joi9.object({
   "dob.yearLength": "Enter a year with 4 numbers, like 1975",
   "dob.invalid": "Date of birth must be a real date",
   "dob.future": "Date of birth must be in the past",
-  "dob.tooOld": "Date of birth must be on or after {{#oldest}}"
+  "dob.tooOld": "Date of birth must be on or after {{#oldest}}",
+  "string.noControlChars": "Date of birth must not contain invalid characters"
 });
 var checkNotTooOld = (fullDate, helpers) => {
   const oldestDateAllowed = getOldestAllowedDate();
@@ -360,7 +384,11 @@ var getMonthNumber = (month, helpers) => {
     }
     return mapped;
   }
-  return Number.parseInt(month, 10);
+  const parsedMonth = Number.parseInt(month, 10);
+  if (parsedMonth < 1 || parsedMonth > 12) {
+    return makeError(helpers, "dob.invalid", ["month"]);
+  }
+  return parsedMonth;
 };
 var checkMissingFields = (day, month, year, helpers) => {
   if (!day && !month && !year) {
@@ -394,9 +422,8 @@ var makeError = (helpers, code, fields) => {
 };
 
 // src/schemas/personal/personal-email-schema.js
-import Joi10 from "joi";
-var personalEmailSchema = Joi10.object({
-  personalEmail: Joi10.string().required().max(EMAIL_MAX).email({
+var personalEmailSchema = Joi.object({
+  personalEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true,
@@ -405,22 +432,24 @@ var personalEmailSchema = Joi10.object({
   }).messages({
     "string.max": `Email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter a personal email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Personal email address must not contain invalid characters"
   })
 });
 
 // src/schemas/personal/personal-phone-schema.js
-import Joi11 from "joi";
-var personalPhoneSchema = Joi11.object({
-  personalTelephone: Joi11.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var personalPhoneSchema = Joi.object({
+  personalTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal telephone number must not contain invalid characters"
   }),
-  personalMobile: Joi11.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  personalMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal mobile phone number must not contain invalid characters"
   })
 }).or("personalTelephone", "personalMobile").messages({
   "object.missing": "Enter at least one phone number"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defra/fcp-sfd-frontend-engine",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Shared frontend engine used by both the internal and external frontend applications.",
   "main": "./dist/index.cjs",
   "exports": {
@@ -38,11 +38,11 @@
   },
   "homepage": "https://github.com/DEFRA/fcp-sfd-frontend-engine#readme",
   "devDependencies": {
-    "@vitest/coverage-v8": "4.1.8",
+    "@vitest/coverage-v8": "4.1.10",
     "eslint": "9.39.2",
     "neostandard": "0.13.0",
     "tsup": "8.5.1",
-    "vitest": "4.1.8"
+    "vitest": "4.1.10"
   },
   "dependencies": {
     "joi": "18.2.1"

package/src/constants/index.js

@@ -10,7 +10,8 @@ export {
   TOWN_CITY_MAX,
   COUNTY_MAX,
   COUNTRY_MAX,
-  POSTCODE_MAX,
-  PHONE_NUMBER_PATTERN,
-  MONTH_MAP
-} from './validation-fields-export.js'
+  POSTCODE_MAX
+} from './validation-fields.js'
+
+export { PHONE_NUMBER_PATTERN } from './patterns.js'
+export { MONTH_MAP } from './month-map.js'

package/src/constants/patterns.js

@@ -1 +1,9 @@
-export const PHONE_NUMBER_PATTERN = /^\+?[0-9 ()]+$/
+// Allows digits, spaces, brackets, and an optional leading +, but requires at least one digit.
+// The (?=...) part checks a digit exists first for efficiency and time complexity.
+export const PHONE_NUMBER_PATTERN = /^\+?(?=[\d ()]*\d)[\d ()]*$/
+
+// Rejects control characters — C0 (0x00–0x1f), DEL (0x7f) and C1 (0x80–0x9f) — which have no valid
+// use in text input fields. The Unicode C1 block contains only control characters, so this does not
+// reject legitimate input — accented letters, symbols and NBSP all sit at U+00A0 and above.
+// eslint-disable-next-line no-control-regex
+export const NO_CONTROL_CHARS_PATTERN = /^[^\x00-\x1f\x7f-\x9f]*$/

package/src/schemas/business/business-email-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import { EMAIL_MAX } from '../../constants/validation-fields.js'
 
 export const businessEmailSchema = Joi.object({
@@ -14,6 +14,7 @@ export const businessEmailSchema = Joi.object({
     .messages({
       'string.max': `Business email address must be ${EMAIL_MAX} characters or less`,
       'string.empty': 'Enter business email address',
-      'string.email': 'Enter an email address, like name@example.com'
+      'string.email': 'Enter an email address, like name@example.com',
+      'string.noControlChars': 'Business email address must not contain invalid characters'
     })
 })

package/src/schemas/business/business-name-schema.js

@@ -1,13 +1,15 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import { BUSINESS_NAME_MAX } from '../../constants/validation-fields.js'
 
 export const businessNameSchema = Joi.object({
   businessName: Joi.string()
+    .trim()
     .required()
     .max(BUSINESS_NAME_MAX)
     .messages({
       'string.empty': 'Enter business name',
       'string.max': `Business name must be ${BUSINESS_NAME_MAX} characters or less`,
-      'any.required': 'Enter business name'
+      'any.required': 'Enter business name',
+      'string.noControlChars': 'Business name must not contain invalid characters'
     })
 })

package/src/schemas/business/business-phone-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import {
   PHONE_NUMBER_MIN,
   PHONE_NUMBER_MAX
@@ -7,6 +7,7 @@ import { PHONE_NUMBER_PATTERN } from '../../constants/patterns.js'
 
 export const businessPhoneSchema = Joi.object({
   businessTelephone: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -14,9 +15,11 @@ export const businessPhoneSchema = Joi.object({
     .messages({
       'string.min': `Business telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Business telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Business telephone number must not contain invalid characters'
     }),
   businessMobile: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -24,7 +27,8 @@ export const businessPhoneSchema = Joi.object({
     .messages({
       'string.min': `Business mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Business mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Business mobile phone number must not contain invalid characters'
     })
 })
   .or('businessTelephone', 'businessMobile')

package/src/schemas/business/business-sbi-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 
 export const businessSbiSchema = Joi.object({
   sbi: Joi.string()
@@ -6,6 +6,7 @@ export const businessSbiSchema = Joi.object({
     .allow('')
     .optional()
     .messages({
-      'string.pattern.base': 'Enter the full SBI'
+      'string.pattern.base': 'Enter the full SBI',
+      'string.noControlChars': 'SBI must not contain invalid characters'
     })
 })

package/src/schemas/business/business-schemas.js

@@ -1,5 +1,5 @@
 import { businessSbiSchema } from './business-sbi-schema.js'
-import { addressSchema } from '../address-schema.js'
+import { addressSchema } from '../shared/address-schema.js'
 import { businessNameSchema } from './business-name-schema.js'
 import { businessEmailSchema } from './business-email-schema.js'
 import { businessPhoneSchema } from './business-phone-schema.js'

package/src/schemas/business/business-vat-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 
 export const businessVatSchema = Joi.object({
   vatNumber: Joi.string()
@@ -6,6 +6,7 @@ export const businessVatSchema = Joi.object({
     .allow('')
     .optional()
     .messages({
-      'string.pattern.base': 'Enter a VAT registration number, like 123456789'
+      'string.pattern.base': 'Enter a VAT registration number, like 123456789',
+      'string.noControlChars': 'VAT registration number must not contain invalid characters'
     })
 })

package/src/schemas/customer/customer-crn-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 
 export const customerCrnSchema = Joi.object({
   crn: Joi.string()
@@ -6,6 +6,7 @@ export const customerCrnSchema = Joi.object({
     .allow('')
     .optional()
     .messages({
-      'string.pattern.base': 'Enter the full CRN'
+      'string.pattern.base': 'Enter the full CRN',
+      'string.noControlChars': 'CRN must not contain invalid characters'
     })
 })

package/src/schemas/personal/personal-dob-schema.js

@@ -1,5 +1,6 @@
-import Joi from 'joi'
-import { MONTH_MAP, MAX_AGE_YEARS } from '../../constants/validation-fields-export.js'
+import { Joi } from '../../utils/joi.js'
+import { MAX_AGE_YEARS } from '../../constants/validation-fields.js'
+import { MONTH_MAP } from '../../constants/month-map.js'
 
 export const personalDobSchema = Joi.object({
   day: Joi.string().allow(''),
@@ -32,7 +33,9 @@ export const personalDobSchema = Joi.object({
   }
 
   // Date must be in the past
-  if (fullDate > new Date()) {
+  const today = new Date()
+  today.setUTCHours(0, 0, 0, 0)
+  if (fullDate >= today) {
     return makeError(helpers, 'dob.future', ['day', 'month', 'year'])
   }
 
@@ -54,7 +57,8 @@ export const personalDobSchema = Joi.object({
   'dob.yearLength': 'Enter a year with 4 numbers, like 1975',
   'dob.invalid': 'Date of birth must be a real date',
   'dob.future': 'Date of birth must be in the past',
-  'dob.tooOld': 'Date of birth must be on or after {{#oldest}}'
+  'dob.tooOld': 'Date of birth must be on or after {{#oldest}}',
+  'string.noControlChars': 'Date of birth must not contain invalid characters'
 })
 
 const checkNotTooOld = (fullDate, helpers) => {
@@ -119,7 +123,7 @@ const getFullDate = (day, monthValue, year, helpers) => {
  *
  * If a valid mapping is found, the mapped number is returned.
  * If no mapping exists, an error is returned via `makeError`, as the input is likely invalid.
- * If the month is already numeric, it is simply parsed and returned as a number.
+ * If the month is already numeric, it is parsed and validated to be within the range 1–12.
  */
 const getMonthNumber = (month, helpers) => {
   if (Number.isNaN(Number(month))) {
@@ -133,7 +137,13 @@ const getMonthNumber = (month, helpers) => {
     return mapped
   }
 
-  return Number.parseInt(month, 10)
+  const parsedMonth = Number.parseInt(month, 10)
+
+  if (parsedMonth < 1 || parsedMonth > 12) {
+    return makeError(helpers, 'dob.invalid', ['month'])
+  }
+
+  return parsedMonth
 }
 
 /**

package/src/schemas/personal/personal-email-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import { EMAIL_MAX } from '../../constants/validation-fields.js'
 
 export const personalEmailSchema = Joi.object({
@@ -15,6 +15,7 @@ export const personalEmailSchema = Joi.object({
     .messages({
       'string.max': `Email address must be ${EMAIL_MAX} characters or less`,
       'string.empty': 'Enter a personal email address',
-      'string.email': 'Enter an email address, like name@example.com'
+      'string.email': 'Enter an email address, like name@example.com',
+      'string.noControlChars': 'Personal email address must not contain invalid characters'
     })
 })

package/src/schemas/personal/personal-name-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import {
   FIRST_NAME_MAX,
   LAST_NAME_MAX,
@@ -7,25 +7,31 @@ import {
 
 export const personalNameSchema = Joi.object({
   first: Joi.string()
+    .trim()
     .required()
     .max(FIRST_NAME_MAX)
     .messages({
       'string.empty': 'Enter first name',
       'string.max': `First name must be ${FIRST_NAME_MAX} characters or less`,
-      'any.required': 'Enter first name'
+      'any.required': 'Enter first name',
+      'string.noControlChars': 'First name must not contain invalid characters'
     }),
   last: Joi.string()
+    .trim()
     .required()
     .max(LAST_NAME_MAX)
     .messages({
       'string.empty': 'Enter last name',
       'string.max': `Last name must be ${LAST_NAME_MAX} characters or less`,
-      'any.required': 'Enter last name'
+      'any.required': 'Enter last name',
+      'string.noControlChars': 'Last name must not contain invalid characters'
     }),
   middle: Joi.string()
+    .trim()
     .allow('')
     .max(MIDDLE_NAMES_MAX)
     .messages({
-      'string.max': `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`
+      'string.max': `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`,
+      'string.noControlChars': 'Middle names must not contain invalid characters'
     })
 })

package/src/schemas/personal/personal-phone-schema.js

@@ -1,12 +1,10 @@
-import Joi from 'joi'
-import {
-  PHONE_NUMBER_MIN,
-  PHONE_NUMBER_MAX,
-  PHONE_NUMBER_PATTERN
-} from '../../constants/validation-fields-export.js'
+import { Joi } from '../../utils/joi.js'
+import { PHONE_NUMBER_MIN, PHONE_NUMBER_MAX } from '../../constants/validation-fields.js'
+import { PHONE_NUMBER_PATTERN } from '../../constants/patterns.js'
 
 export const personalPhoneSchema = Joi.object({
   personalTelephone: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -14,9 +12,11 @@ export const personalPhoneSchema = Joi.object({
     .messages({
       'string.min': `Personal telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Personal telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Personal telephone number must not contain invalid characters'
     }),
   personalMobile: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -24,7 +24,8 @@ export const personalPhoneSchema = Joi.object({
     .messages({
       'string.min': `Personal mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Personal mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Personal mobile phone number must not contain invalid characters'
     })
 })
   .or('personalTelephone', 'personalMobile')

package/src/schemas/personal/personal-schemas.js

@@ -1,6 +1,6 @@
 import { personalNameSchema } from './personal-name-schema.js'
 import { personalDobSchema } from './personal-dob-schema.js'
-import { addressSchema } from '../address-schema.js'
+import { addressSchema } from '../shared/address-schema.js'
 import { personalEmailSchema } from './personal-email-schema.js'
 import { personalPhoneSchema } from './personal-phone-schema.js'
 

package/src/schemas/{address-schema.js → shared/address-schema.js}

@@ -1,61 +1,75 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import {
   ADDRESS_LINE_MAX,
   TOWN_CITY_MAX,
   COUNTY_MAX,
   POSTCODE_MAX,
   COUNTRY_MAX
-} from '../constants/validation-fields.js'
+} from '../../constants/validation-fields.js'
 
 export const addressSchema = Joi.object({
   address1: Joi.string()
+    .trim()
     .required()
     .max(ADDRESS_LINE_MAX)
     .messages({
       'string.empty': 'Enter address line 1, typically the building and street',
       'string.max': `Address line 1 must be ${ADDRESS_LINE_MAX} characters or less`,
-      'any.required': 'Enter address line 1, typically the building and street'
+      'any.required': 'Enter address line 1, typically the building and street',
+      'string.noControlChars': 'Address line 1 must not contain invalid characters'
     }),
   address2: Joi.string()
+    .trim()
     .allow('')
     .max(ADDRESS_LINE_MAX)
     .messages({
-      'string.max': `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`
+      'string.max': `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`,
+      'string.noControlChars': 'Address line 2 must not contain invalid characters'
     }),
   address3: Joi.string()
+    .trim()
     .allow('')
     .max(ADDRESS_LINE_MAX)
     .messages({
-      'string.max': `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`
+      'string.max': `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`,
+      'string.noControlChars': 'Address line 3 must not contain invalid characters'
     }),
   city: Joi.string()
+    .trim()
     .required()
     .max(TOWN_CITY_MAX)
     .messages({
       'string.empty': 'Enter town or city',
       'string.max': `Town or city must be ${TOWN_CITY_MAX} characters or less`,
-      'any.required': 'Enter town or city'
+      'any.required': 'Enter town or city',
+      'string.noControlChars': 'Town or city must not contain invalid characters'
     }),
   county: Joi.string()
+    .trim()
     .allow('')
     .max(COUNTY_MAX)
     .messages({
-      'string.max': `County must be ${COUNTY_MAX} characters or less`
+      'string.max': `County must be ${COUNTY_MAX} characters or less`,
+      'string.noControlChars': 'County must not contain invalid characters'
     }),
   postcode: Joi.string()
+    .trim()
     .required()
     .max(POSTCODE_MAX)
     .messages({
       'any.required': 'Enter a postal code or zip code',
       'string.empty': 'Enter a postal code or zip code',
-      'string.max': `Postal code or zip code must be ${POSTCODE_MAX} characters or less`
+      'string.max': `Postal code or zip code must be ${POSTCODE_MAX} characters or less`,
+      'string.noControlChars': 'Postal code or zip code must not contain invalid characters'
     }),
   country: Joi.string()
+    .trim()
     .required()
     .max(COUNTRY_MAX)
     .messages({
       'string.empty': 'Enter a country',
       'string.max': `Country must be ${COUNTRY_MAX} characters or less`,
-      'any.required': 'Enter a country'
+      'any.required': 'Enter a country',
+      'string.noControlChars': 'Country must not contain invalid characters'
     })
 })

package/src/utils/joi.js

@@ -0,0 +1,21 @@
+import BaseJoi from 'joi'
+import { NO_CONTROL_CHARS_PATTERN } from '../constants/patterns.js'
+
+// Extends Joi's string type so every Joi.string() automatically rejects ASCII control
+// characters (0x00–0x1f and 0x7f), which have no valid use in text input fields. Using a
+// dedicated 'string.noControlChars' error keeps it distinct from the generic pattern rule
+// used by numeric and phone fields. Fields may override the message via their own .messages().
+export const Joi = BaseJoi.extend((joi) => ({
+  type: 'string',
+  base: joi.string(),
+  messages: {
+    'string.noControlChars': 'Field must not contain invalid characters'
+  },
+  validate (value, helpers) {
+    if (typeof value === 'string' && !NO_CONTROL_CHARS_PATTERN.test(value)) {
+      return { value, errors: helpers.error('string.noControlChars') }
+    }
+
+    return { value }
+  }
+}))

package/src/constants/validation-fields-export.js

@@ -1,17 +0,0 @@
-export {
-  FIRST_NAME_MAX,
-  LAST_NAME_MAX,
-  MIDDLE_NAMES_MAX,
-  EMAIL_MAX,
-  PHONE_NUMBER_MIN,
-  PHONE_NUMBER_MAX,
-  MAX_AGE_YEARS,
-  ADDRESS_LINE_MAX,
-  TOWN_CITY_MAX,
-  COUNTY_MAX,
-  COUNTRY_MAX,
-  POSTCODE_MAX
-} from './validation-fields.js'
-
-export { PHONE_NUMBER_PATTERN } from './patterns.js'
-export { MONTH_MAP } from './month-map.js'