@defra/fcp-sfd-frontend-engine 0.6.1 → 0.8.0

package/dist/index.cjs

@@ -29,6 +29,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.js
 var index_exports = {};
 __export(index_exports, {
+  constants: () => constants,
   mappers: () => mappers,
   presenters: () => presenters,
   schemas: () => schemas,
@@ -129,17 +130,36 @@ var mappers = {
   businessDetails: mapBusinessDetails
 };
 
-// src/schemas/business/business-sbi-schema.js
+// src/utils/joi.js
 var import_joi = __toESM(require("joi"), 1);
-var businessSbiSchema = import_joi.default.object({
-  sbi: import_joi.default.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full SBI"
+
+// src/constants/patterns.js
+var PHONE_NUMBER_PATTERN = /^\+?(?=[\d ()]*\d)[\d ()]*$/;
+var NO_CONTROL_CHARS_PATTERN = /^[^\x00-\x1f\x7f-\x9f]*$/;
+
+// src/utils/joi.js
+var Joi = import_joi.default.extend((joi) => ({
+  type: "string",
+  base: joi.string(),
+  messages: {
+    "string.noControlChars": "Field must not contain invalid characters"
+  },
+  validate(value, helpers) {
+    if (typeof value === "string" && !NO_CONTROL_CHARS_PATTERN.test(value)) {
+      return { value, errors: helpers.error("string.noControlChars") };
+    }
+    return { value };
+  }
+}));
+
+// src/schemas/business/business-sbi-schema.js
+var businessSbiSchema = Joi.object({
+  sbi: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter the full SBI",
+    "string.noControlChars": "SBI must not contain invalid characters"
   })
 });
 
-// src/schemas/address-schema.js
-var import_joi2 = __toESM(require("joi"), 1);
-
 // src/constants/validation-fields.js
 var FIRST_NAME_MAX = 100;
 var LAST_NAME_MAX = 100;
@@ -155,53 +175,59 @@ var COUNTY_MAX = 60;
 var COUNTRY_MAX = 60;
 var POSTCODE_MAX = 8;
 
-// src/schemas/address-schema.js
-var addressSchema = import_joi2.default.object({
-  address1: import_joi2.default.string().required().max(ADDRESS_LINE_MAX).messages({
+// src/schemas/shared/address-schema.js
+var addressSchema = Joi.object({
+  address1: Joi.string().trim().required().max(ADDRESS_LINE_MAX).messages({
     "string.empty": "Enter address line 1, typically the building and street",
     "string.max": `Address line 1 must be ${ADDRESS_LINE_MAX} characters or less`,
-    "any.required": "Enter address line 1, typically the building and street"
+    "any.required": "Enter address line 1, typically the building and street",
+    "string.noControlChars": "Address line 1 must not contain invalid characters"
   }),
-  address2: import_joi2.default.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`
+  address2: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 2 must not contain invalid characters"
   }),
-  address3: import_joi2.default.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`
+  address3: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 3 must not contain invalid characters"
   }),
-  city: import_joi2.default.string().required().max(TOWN_CITY_MAX).messages({
+  city: Joi.string().trim().required().max(TOWN_CITY_MAX).messages({
     "string.empty": "Enter town or city",
     "string.max": `Town or city must be ${TOWN_CITY_MAX} characters or less`,
-    "any.required": "Enter town or city"
+    "any.required": "Enter town or city",
+    "string.noControlChars": "Town or city must not contain invalid characters"
   }),
-  county: import_joi2.default.string().allow("").max(COUNTY_MAX).messages({
-    "string.max": `County must be ${COUNTY_MAX} characters or less`
+  county: Joi.string().trim().allow("").max(COUNTY_MAX).messages({
+    "string.max": `County must be ${COUNTY_MAX} characters or less`,
+    "string.noControlChars": "County must not contain invalid characters"
   }),
-  postcode: import_joi2.default.string().required().max(POSTCODE_MAX).messages({
+  postcode: Joi.string().trim().required().max(POSTCODE_MAX).messages({
     "any.required": "Enter a postal code or zip code",
     "string.empty": "Enter a postal code or zip code",
-    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`
+    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`,
+    "string.noControlChars": "Postal code or zip code must not contain invalid characters"
   }),
-  country: import_joi2.default.string().required().max(COUNTRY_MAX).messages({
+  country: Joi.string().trim().required().max(COUNTRY_MAX).messages({
     "string.empty": "Enter a country",
     "string.max": `Country must be ${COUNTRY_MAX} characters or less`,
-    "any.required": "Enter a country"
+    "any.required": "Enter a country",
+    "string.noControlChars": "Country must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-name-schema.js
-var import_joi3 = __toESM(require("joi"), 1);
-var businessNameSchema = import_joi3.default.object({
-  businessName: import_joi3.default.string().required().max(BUSINESS_NAME_MAX).messages({
+var businessNameSchema = Joi.object({
+  businessName: Joi.string().trim().required().max(BUSINESS_NAME_MAX).messages({
     "string.empty": "Enter business name",
     "string.max": `Business name must be ${BUSINESS_NAME_MAX} characters or less`,
-    "any.required": "Enter business name"
+    "any.required": "Enter business name",
+    "string.noControlChars": "Business name must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-email-schema.js
-var import_joi4 = __toESM(require("joi"), 1);
-var businessEmailSchema = import_joi4.default.object({
-  businessEmail: import_joi4.default.string().required().max(EMAIL_MAX).email({
+var businessEmailSchema = Joi.object({
+  businessEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true
@@ -209,37 +235,34 @@ var businessEmailSchema = import_joi4.default.object({
   }).messages({
     "string.max": `Business email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter business email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Business email address must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-phone-schema.js
-var import_joi5 = __toESM(require("joi"), 1);
-
-// src/constants/patterns.js
-var PHONE_NUMBER_PATTERN = /^\+?[0-9 ()]+$/;
-
-// src/schemas/business/business-phone-schema.js
-var businessPhoneSchema = import_joi5.default.object({
-  businessTelephone: import_joi5.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var businessPhoneSchema = Joi.object({
+  businessTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business telephone number must not contain invalid characters"
   }),
-  businessMobile: import_joi5.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  businessMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business mobile phone number must not contain invalid characters"
   })
 }).or("businessTelephone", "businessMobile").messages({
   "object.missing": "Enter at least one phone number"
 });
 
 // src/schemas/business/business-vat-schema.js
-var import_joi6 = __toESM(require("joi"), 1);
-var businessVatSchema = import_joi6.default.object({
-  vatNumber: import_joi6.default.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter a VAT registration number, like 123456789"
+var businessVatSchema = Joi.object({
+  vatNumber: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter a VAT registration number, like 123456789",
+    "string.noControlChars": "VAT registration number must not contain invalid characters"
   })
 });
 
@@ -256,10 +279,10 @@ var businessSchemas = {
 };
 
 // src/schemas/customer/customer-crn-schema.js
-var import_joi7 = __toESM(require("joi"), 1);
-var customerCrnSchema = import_joi7.default.object({
-  crn: import_joi7.default.string().pattern(/^\d{10}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full CRN"
+var customerCrnSchema = Joi.object({
+  crn: Joi.string().pattern(/^\d{10}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter the full CRN",
+    "string.noControlChars": "CRN must not contain invalid characters"
   })
 });
 
@@ -269,26 +292,25 @@ var customerSchemas = {
 };
 
 // src/schemas/personal/personal-name-schema.js
-var import_joi8 = __toESM(require("joi"), 1);
-var personalNameSchema = import_joi8.default.object({
-  first: import_joi8.default.string().required().max(FIRST_NAME_MAX).messages({
+var personalNameSchema = Joi.object({
+  first: Joi.string().trim().required().max(FIRST_NAME_MAX).messages({
     "string.empty": "Enter first name",
     "string.max": `First name must be ${FIRST_NAME_MAX} characters or less`,
-    "any.required": "Enter first name"
+    "any.required": "Enter first name",
+    "string.noControlChars": "First name must not contain invalid characters"
   }),
-  last: import_joi8.default.string().required().max(LAST_NAME_MAX).messages({
+  last: Joi.string().trim().required().max(LAST_NAME_MAX).messages({
     "string.empty": "Enter last name",
     "string.max": `Last name must be ${LAST_NAME_MAX} characters or less`,
-    "any.required": "Enter last name"
+    "any.required": "Enter last name",
+    "string.noControlChars": "Last name must not contain invalid characters"
   }),
-  middle: import_joi8.default.string().allow("").max(MIDDLE_NAMES_MAX).messages({
-    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`
+  middle: Joi.string().trim().allow("").max(MIDDLE_NAMES_MAX).messages({
+    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`,
+    "string.noControlChars": "Middle names must not contain invalid characters"
   })
 });
 
-// src/schemas/personal/personal-dob-schema.js
-var import_joi9 = __toESM(require("joi"), 1);
-
 // src/constants/month-map.js
 var MONTH_MAP = {
   january: 1,
@@ -318,10 +340,10 @@ var MONTH_MAP = {
 };
 
 // src/schemas/personal/personal-dob-schema.js
-var personalDobSchema = import_joi9.default.object({
-  day: import_joi9.default.string().allow(""),
-  month: import_joi9.default.string().allow(""),
-  year: import_joi9.default.string().allow("")
+var personalDobSchema = Joi.object({
+  day: Joi.string().allow(""),
+  month: Joi.string().allow(""),
+  year: Joi.string().allow("")
 }).custom((value, helpers) => {
   const { day, month, year } = value;
   const missingFieldsError = checkMissingFields(day, month, year, helpers);
@@ -339,7 +361,9 @@ var personalDobSchema = import_joi9.default.object({
   if (fullDate.isJoiError) {
     return fullDate;
   }
-  if (fullDate > /* @__PURE__ */ new Date()) {
+  const today = /* @__PURE__ */ new Date();
+  today.setUTCHours(0, 0, 0, 0);
+  if (fullDate >= today) {
     return makeError(helpers, "dob.future", ["day", "month", "year"]);
   }
   const tooOldError = checkNotTooOld(fullDate, helpers);
@@ -358,7 +382,8 @@ var personalDobSchema = import_joi9.default.object({
   "dob.yearLength": "Enter a year with 4 numbers, like 1975",
   "dob.invalid": "Date of birth must be a real date",
   "dob.future": "Date of birth must be in the past",
-  "dob.tooOld": "Date of birth must be on or after {{#oldest}}"
+  "dob.tooOld": "Date of birth must be on or after {{#oldest}}",
+  "string.noControlChars": "Date of birth must not contain invalid characters"
 });
 var checkNotTooOld = (fullDate, helpers) => {
   const oldestDateAllowed = getOldestAllowedDate();
@@ -398,7 +423,11 @@ var getMonthNumber = (month, helpers) => {
     }
     return mapped;
   }
-  return Number.parseInt(month, 10);
+  const parsedMonth = Number.parseInt(month, 10);
+  if (parsedMonth < 1 || parsedMonth > 12) {
+    return makeError(helpers, "dob.invalid", ["month"]);
+  }
+  return parsedMonth;
 };
 var checkMissingFields = (day, month, year, helpers) => {
   if (!day && !month && !year) {
@@ -432,9 +461,8 @@ var makeError = (helpers, code, fields) => {
 };
 
 // src/schemas/personal/personal-email-schema.js
-var import_joi10 = __toESM(require("joi"), 1);
-var personalEmailSchema = import_joi10.default.object({
-  personalEmail: import_joi10.default.string().required().max(EMAIL_MAX).email({
+var personalEmailSchema = Joi.object({
+  personalEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true,
@@ -443,22 +471,24 @@ var personalEmailSchema = import_joi10.default.object({
   }).messages({
     "string.max": `Email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter a personal email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Personal email address must not contain invalid characters"
   })
 });
 
 // src/schemas/personal/personal-phone-schema.js
-var import_joi11 = __toESM(require("joi"), 1);
-var personalPhoneSchema = import_joi11.default.object({
-  personalTelephone: import_joi11.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var personalPhoneSchema = Joi.object({
+  personalTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal telephone number must not contain invalid characters"
   }),
-  personalMobile: import_joi11.default.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  personalMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal mobile phone number must not contain invalid characters"
   })
 }).or("personalTelephone", "personalMobile").messages({
   "object.missing": "Enter at least one phone number"
@@ -681,8 +711,55 @@ var presenters = {
   formatCphText,
   formatBusinessAddress
 };
+
+// src/constants/status-codes.js
+var OK = 200;
+var BAD_REQUEST = 400;
+var UNAUTHORIZED = 401;
+var FORBIDDEN = 403;
+var NOT_FOUND = 404;
+var NO_CONTENT = 204;
+var FOUND = 302;
+var INTERNAL_SERVER_ERROR = 500;
+var SERVICE_UNAVAILABLE = 503;
+
+// src/constants/index.js
+var constants = {
+  statusCodes: {
+    BAD_REQUEST,
+    UNAUTHORIZED,
+    FORBIDDEN,
+    NOT_FOUND,
+    OK,
+    NO_CONTENT,
+    FOUND,
+    INTERNAL_SERVER_ERROR,
+    SERVICE_UNAVAILABLE
+  },
+  validationFields: {
+    FIRST_NAME_MAX,
+    LAST_NAME_MAX,
+    MIDDLE_NAMES_MAX,
+    BUSINESS_NAME_MAX,
+    EMAIL_MAX,
+    PHONE_NUMBER_MIN,
+    PHONE_NUMBER_MAX,
+    MAX_AGE_YEARS,
+    ADDRESS_LINE_MAX,
+    TOWN_CITY_MAX,
+    COUNTY_MAX,
+    COUNTRY_MAX,
+    POSTCODE_MAX
+  },
+  patterns: {
+    PHONE_NUMBER_PATTERN,
+    NO_CONTROL_CHARS_PATTERN
+  },
+  monthMap: MONTH_MAP
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  constants,
   mappers,
   presenters,
   schemas,

package/dist/index.js

@@ -91,17 +91,36 @@ var mappers = {
   businessDetails: mapBusinessDetails
 };
 
+// src/utils/joi.js
+import BaseJoi from "joi";
+
+// src/constants/patterns.js
+var PHONE_NUMBER_PATTERN = /^\+?(?=[\d ()]*\d)[\d ()]*$/;
+var NO_CONTROL_CHARS_PATTERN = /^[^\x00-\x1f\x7f-\x9f]*$/;
+
+// src/utils/joi.js
+var Joi = BaseJoi.extend((joi) => ({
+  type: "string",
+  base: joi.string(),
+  messages: {
+    "string.noControlChars": "Field must not contain invalid characters"
+  },
+  validate(value, helpers) {
+    if (typeof value === "string" && !NO_CONTROL_CHARS_PATTERN.test(value)) {
+      return { value, errors: helpers.error("string.noControlChars") };
+    }
+    return { value };
+  }
+}));
+
 // src/schemas/business/business-sbi-schema.js
-import Joi from "joi";
 var businessSbiSchema = Joi.object({
   sbi: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full SBI"
+    "string.pattern.base": "Enter the full SBI",
+    "string.noControlChars": "SBI must not contain invalid characters"
   })
 });
 
-// src/schemas/address-schema.js
-import Joi2 from "joi";
-
 // src/constants/validation-fields.js
 var FIRST_NAME_MAX = 100;
 var LAST_NAME_MAX = 100;
@@ -117,53 +136,59 @@ var COUNTY_MAX = 60;
 var COUNTRY_MAX = 60;
 var POSTCODE_MAX = 8;
 
-// src/schemas/address-schema.js
-var addressSchema = Joi2.object({
-  address1: Joi2.string().required().max(ADDRESS_LINE_MAX).messages({
+// src/schemas/shared/address-schema.js
+var addressSchema = Joi.object({
+  address1: Joi.string().trim().required().max(ADDRESS_LINE_MAX).messages({
     "string.empty": "Enter address line 1, typically the building and street",
     "string.max": `Address line 1 must be ${ADDRESS_LINE_MAX} characters or less`,
-    "any.required": "Enter address line 1, typically the building and street"
+    "any.required": "Enter address line 1, typically the building and street",
+    "string.noControlChars": "Address line 1 must not contain invalid characters"
   }),
-  address2: Joi2.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`
+  address2: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 2 must not contain invalid characters"
   }),
-  address3: Joi2.string().allow("").max(ADDRESS_LINE_MAX).messages({
-    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`
+  address3: Joi.string().trim().allow("").max(ADDRESS_LINE_MAX).messages({
+    "string.max": `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`,
+    "string.noControlChars": "Address line 3 must not contain invalid characters"
   }),
-  city: Joi2.string().required().max(TOWN_CITY_MAX).messages({
+  city: Joi.string().trim().required().max(TOWN_CITY_MAX).messages({
     "string.empty": "Enter town or city",
     "string.max": `Town or city must be ${TOWN_CITY_MAX} characters or less`,
-    "any.required": "Enter town or city"
+    "any.required": "Enter town or city",
+    "string.noControlChars": "Town or city must not contain invalid characters"
   }),
-  county: Joi2.string().allow("").max(COUNTY_MAX).messages({
-    "string.max": `County must be ${COUNTY_MAX} characters or less`
+  county: Joi.string().trim().allow("").max(COUNTY_MAX).messages({
+    "string.max": `County must be ${COUNTY_MAX} characters or less`,
+    "string.noControlChars": "County must not contain invalid characters"
   }),
-  postcode: Joi2.string().required().max(POSTCODE_MAX).messages({
+  postcode: Joi.string().trim().required().max(POSTCODE_MAX).messages({
     "any.required": "Enter a postal code or zip code",
     "string.empty": "Enter a postal code or zip code",
-    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`
+    "string.max": `Postal code or zip code must be ${POSTCODE_MAX} characters or less`,
+    "string.noControlChars": "Postal code or zip code must not contain invalid characters"
   }),
-  country: Joi2.string().required().max(COUNTRY_MAX).messages({
+  country: Joi.string().trim().required().max(COUNTRY_MAX).messages({
     "string.empty": "Enter a country",
     "string.max": `Country must be ${COUNTRY_MAX} characters or less`,
-    "any.required": "Enter a country"
+    "any.required": "Enter a country",
+    "string.noControlChars": "Country must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-name-schema.js
-import Joi3 from "joi";
-var businessNameSchema = Joi3.object({
-  businessName: Joi3.string().required().max(BUSINESS_NAME_MAX).messages({
+var businessNameSchema = Joi.object({
+  businessName: Joi.string().trim().required().max(BUSINESS_NAME_MAX).messages({
     "string.empty": "Enter business name",
     "string.max": `Business name must be ${BUSINESS_NAME_MAX} characters or less`,
-    "any.required": "Enter business name"
+    "any.required": "Enter business name",
+    "string.noControlChars": "Business name must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-email-schema.js
-import Joi4 from "joi";
-var businessEmailSchema = Joi4.object({
-  businessEmail: Joi4.string().required().max(EMAIL_MAX).email({
+var businessEmailSchema = Joi.object({
+  businessEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true
@@ -171,37 +196,34 @@ var businessEmailSchema = Joi4.object({
   }).messages({
     "string.max": `Business email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter business email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Business email address must not contain invalid characters"
   })
 });
 
 // src/schemas/business/business-phone-schema.js
-import Joi5 from "joi";
-
-// src/constants/patterns.js
-var PHONE_NUMBER_PATTERN = /^\+?[0-9 ()]+$/;
-
-// src/schemas/business/business-phone-schema.js
-var businessPhoneSchema = Joi5.object({
-  businessTelephone: Joi5.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var businessPhoneSchema = Joi.object({
+  businessTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business telephone number must not contain invalid characters"
   }),
-  businessMobile: Joi5.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  businessMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Business mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Business mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Business mobile phone number must not contain invalid characters"
   })
 }).or("businessTelephone", "businessMobile").messages({
   "object.missing": "Enter at least one phone number"
 });
 
 // src/schemas/business/business-vat-schema.js
-import Joi6 from "joi";
-var businessVatSchema = Joi6.object({
-  vatNumber: Joi6.string().pattern(/^\d{9}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter a VAT registration number, like 123456789"
+var businessVatSchema = Joi.object({
+  vatNumber: Joi.string().pattern(/^\d{9}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter a VAT registration number, like 123456789",
+    "string.noControlChars": "VAT registration number must not contain invalid characters"
   })
 });
 
@@ -218,10 +240,10 @@ var businessSchemas = {
 };
 
 // src/schemas/customer/customer-crn-schema.js
-import Joi7 from "joi";
-var customerCrnSchema = Joi7.object({
-  crn: Joi7.string().pattern(/^\d{10}$/).allow("").optional().messages({
-    "string.pattern.base": "Enter the full CRN"
+var customerCrnSchema = Joi.object({
+  crn: Joi.string().pattern(/^\d{10}$/).allow("").optional().messages({
+    "string.pattern.base": "Enter the full CRN",
+    "string.noControlChars": "CRN must not contain invalid characters"
   })
 });
 
@@ -231,26 +253,25 @@ var customerSchemas = {
 };
 
 // src/schemas/personal/personal-name-schema.js
-import Joi8 from "joi";
-var personalNameSchema = Joi8.object({
-  first: Joi8.string().required().max(FIRST_NAME_MAX).messages({
+var personalNameSchema = Joi.object({
+  first: Joi.string().trim().required().max(FIRST_NAME_MAX).messages({
     "string.empty": "Enter first name",
     "string.max": `First name must be ${FIRST_NAME_MAX} characters or less`,
-    "any.required": "Enter first name"
+    "any.required": "Enter first name",
+    "string.noControlChars": "First name must not contain invalid characters"
   }),
-  last: Joi8.string().required().max(LAST_NAME_MAX).messages({
+  last: Joi.string().trim().required().max(LAST_NAME_MAX).messages({
     "string.empty": "Enter last name",
     "string.max": `Last name must be ${LAST_NAME_MAX} characters or less`,
-    "any.required": "Enter last name"
+    "any.required": "Enter last name",
+    "string.noControlChars": "Last name must not contain invalid characters"
   }),
-  middle: Joi8.string().allow("").max(MIDDLE_NAMES_MAX).messages({
-    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`
+  middle: Joi.string().trim().allow("").max(MIDDLE_NAMES_MAX).messages({
+    "string.max": `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`,
+    "string.noControlChars": "Middle names must not contain invalid characters"
   })
 });
 
-// src/schemas/personal/personal-dob-schema.js
-import Joi9 from "joi";
-
 // src/constants/month-map.js
 var MONTH_MAP = {
   january: 1,
@@ -280,10 +301,10 @@ var MONTH_MAP = {
 };
 
 // src/schemas/personal/personal-dob-schema.js
-var personalDobSchema = Joi9.object({
-  day: Joi9.string().allow(""),
-  month: Joi9.string().allow(""),
-  year: Joi9.string().allow("")
+var personalDobSchema = Joi.object({
+  day: Joi.string().allow(""),
+  month: Joi.string().allow(""),
+  year: Joi.string().allow("")
 }).custom((value, helpers) => {
   const { day, month, year } = value;
   const missingFieldsError = checkMissingFields(day, month, year, helpers);
@@ -301,7 +322,9 @@ var personalDobSchema = Joi9.object({
   if (fullDate.isJoiError) {
     return fullDate;
   }
-  if (fullDate > /* @__PURE__ */ new Date()) {
+  const today = /* @__PURE__ */ new Date();
+  today.setUTCHours(0, 0, 0, 0);
+  if (fullDate >= today) {
     return makeError(helpers, "dob.future", ["day", "month", "year"]);
   }
   const tooOldError = checkNotTooOld(fullDate, helpers);
@@ -320,7 +343,8 @@ var personalDobSchema = Joi9.object({
   "dob.yearLength": "Enter a year with 4 numbers, like 1975",
   "dob.invalid": "Date of birth must be a real date",
   "dob.future": "Date of birth must be in the past",
-  "dob.tooOld": "Date of birth must be on or after {{#oldest}}"
+  "dob.tooOld": "Date of birth must be on or after {{#oldest}}",
+  "string.noControlChars": "Date of birth must not contain invalid characters"
 });
 var checkNotTooOld = (fullDate, helpers) => {
   const oldestDateAllowed = getOldestAllowedDate();
@@ -360,7 +384,11 @@ var getMonthNumber = (month, helpers) => {
     }
     return mapped;
   }
-  return Number.parseInt(month, 10);
+  const parsedMonth = Number.parseInt(month, 10);
+  if (parsedMonth < 1 || parsedMonth > 12) {
+    return makeError(helpers, "dob.invalid", ["month"]);
+  }
+  return parsedMonth;
 };
 var checkMissingFields = (day, month, year, helpers) => {
   if (!day && !month && !year) {
@@ -394,9 +422,8 @@ var makeError = (helpers, code, fields) => {
 };
 
 // src/schemas/personal/personal-email-schema.js
-import Joi10 from "joi";
-var personalEmailSchema = Joi10.object({
-  personalEmail: Joi10.string().required().max(EMAIL_MAX).email({
+var personalEmailSchema = Joi.object({
+  personalEmail: Joi.string().required().max(EMAIL_MAX).email({
     minDomainSegments: 2,
     tlds: {
       allow: true,
@@ -405,22 +432,24 @@ var personalEmailSchema = Joi10.object({
   }).messages({
     "string.max": `Email address must be ${EMAIL_MAX} characters or less`,
     "string.empty": "Enter a personal email address",
-    "string.email": "Enter an email address, like name@example.com"
+    "string.email": "Enter an email address, like name@example.com",
+    "string.noControlChars": "Personal email address must not contain invalid characters"
   })
 });
 
 // src/schemas/personal/personal-phone-schema.js
-import Joi11 from "joi";
-var personalPhoneSchema = Joi11.object({
-  personalTelephone: Joi11.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+var personalPhoneSchema = Joi.object({
+  personalTelephone: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal telephone number must not contain invalid characters"
   }),
-  personalMobile: Joi11.string().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
+  personalMobile: Joi.string().trim().empty("").min(PHONE_NUMBER_MIN).max(PHONE_NUMBER_MAX).pattern(PHONE_NUMBER_PATTERN).messages({
     "string.min": `Personal mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
     "string.max": `Personal mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +"
+    "string.pattern.base": "Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +",
+    "string.noControlChars": "Personal mobile phone number must not contain invalid characters"
   })
 }).or("personalTelephone", "personalMobile").messages({
   "object.missing": "Enter at least one phone number"
@@ -643,7 +672,54 @@ var presenters = {
   formatCphText,
   formatBusinessAddress
 };
+
+// src/constants/status-codes.js
+var OK = 200;
+var BAD_REQUEST = 400;
+var UNAUTHORIZED = 401;
+var FORBIDDEN = 403;
+var NOT_FOUND = 404;
+var NO_CONTENT = 204;
+var FOUND = 302;
+var INTERNAL_SERVER_ERROR = 500;
+var SERVICE_UNAVAILABLE = 503;
+
+// src/constants/index.js
+var constants = {
+  statusCodes: {
+    BAD_REQUEST,
+    UNAUTHORIZED,
+    FORBIDDEN,
+    NOT_FOUND,
+    OK,
+    NO_CONTENT,
+    FOUND,
+    INTERNAL_SERVER_ERROR,
+    SERVICE_UNAVAILABLE
+  },
+  validationFields: {
+    FIRST_NAME_MAX,
+    LAST_NAME_MAX,
+    MIDDLE_NAMES_MAX,
+    BUSINESS_NAME_MAX,
+    EMAIL_MAX,
+    PHONE_NUMBER_MIN,
+    PHONE_NUMBER_MAX,
+    MAX_AGE_YEARS,
+    ADDRESS_LINE_MAX,
+    TOWN_CITY_MAX,
+    COUNTY_MAX,
+    COUNTRY_MAX,
+    POSTCODE_MAX
+  },
+  patterns: {
+    PHONE_NUMBER_PATTERN,
+    NO_CONTROL_CHARS_PATTERN
+  },
+  monthMap: MONTH_MAP
+};
 export {
+  constants,
   mappers,
   presenters,
   schemas,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defra/fcp-sfd-frontend-engine",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Shared frontend engine used by both the internal and external frontend applications.",
   "main": "./dist/index.cjs",
   "exports": {

package/src/constants/index.js

@@ -1,7 +1,9 @@
-export {
+// Validation constraints
+import {
   FIRST_NAME_MAX,
   LAST_NAME_MAX,
   MIDDLE_NAMES_MAX,
+  BUSINESS_NAME_MAX,
   EMAIL_MAX,
   PHONE_NUMBER_MIN,
   PHONE_NUMBER_MAX,
@@ -10,7 +12,56 @@ export {
   TOWN_CITY_MAX,
   COUNTY_MAX,
   COUNTRY_MAX,
-  POSTCODE_MAX,
-  PHONE_NUMBER_PATTERN,
-  MONTH_MAP
-} from './validation-fields-export.js'
+  POSTCODE_MAX
+} from './validation-fields.js'
+
+// HTTP status codes
+import {
+  BAD_REQUEST,
+  UNAUTHORIZED,
+  FORBIDDEN,
+  NOT_FOUND,
+  OK,
+  NO_CONTENT,
+  FOUND,
+  INTERNAL_SERVER_ERROR,
+  SERVICE_UNAVAILABLE
+} from './status-codes.js'
+
+// Format patterns and mappings
+import { PHONE_NUMBER_PATTERN, NO_CONTROL_CHARS_PATTERN } from './patterns.js'
+import { MONTH_MAP } from './month-map.js'
+
+export const constants = {
+  statusCodes: {
+    BAD_REQUEST,
+    UNAUTHORIZED,
+    FORBIDDEN,
+    NOT_FOUND,
+    OK,
+    NO_CONTENT,
+    FOUND,
+    INTERNAL_SERVER_ERROR,
+    SERVICE_UNAVAILABLE
+  },
+  validationFields: {
+    FIRST_NAME_MAX,
+    LAST_NAME_MAX,
+    MIDDLE_NAMES_MAX,
+    BUSINESS_NAME_MAX,
+    EMAIL_MAX,
+    PHONE_NUMBER_MIN,
+    PHONE_NUMBER_MAX,
+    MAX_AGE_YEARS,
+    ADDRESS_LINE_MAX,
+    TOWN_CITY_MAX,
+    COUNTY_MAX,
+    COUNTRY_MAX,
+    POSTCODE_MAX
+  },
+  patterns: {
+    PHONE_NUMBER_PATTERN,
+    NO_CONTROL_CHARS_PATTERN
+  },
+  monthMap: MONTH_MAP
+}

package/src/constants/patterns.js

@@ -1 +1,9 @@
-export const PHONE_NUMBER_PATTERN = /^\+?[0-9 ()]+$/
+// Allows digits, spaces, brackets, and an optional leading +, but requires at least one digit.
+// The (?=...) part checks a digit exists first for efficiency and time complexity.
+export const PHONE_NUMBER_PATTERN = /^\+?(?=[\d ()]*\d)[\d ()]*$/
+
+// Rejects control characters — C0 (0x00–0x1f), DEL (0x7f) and C1 (0x80–0x9f) — which have no valid
+// use in text input fields. The Unicode C1 block contains only control characters, so this does not
+// reject legitimate input — accented letters, symbols and NBSP all sit at U+00A0 and above.
+// eslint-disable-next-line no-control-regex
+export const NO_CONTROL_CHARS_PATTERN = /^[^\x00-\x1f\x7f-\x9f]*$/

package/src/constants/status-codes.js

@@ -0,0 +1,9 @@
+export const OK = 200
+export const BAD_REQUEST = 400
+export const UNAUTHORIZED = 401
+export const FORBIDDEN = 403
+export const NOT_FOUND = 404
+export const NO_CONTENT = 204
+export const FOUND = 302
+export const INTERNAL_SERVER_ERROR = 500
+export const SERVICE_UNAVAILABLE = 503

package/src/index.js

@@ -2,3 +2,4 @@ export { mappers } from './mappers/mappers.js'
 export { schemas } from './schemas/schemas.js'
 export { utils } from './utils/utils.js'
 export { presenters } from './presenters/presenters.js'
+export { constants } from './constants/index.js'

package/src/schemas/business/business-email-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import { EMAIL_MAX } from '../../constants/validation-fields.js'
 
 export const businessEmailSchema = Joi.object({
@@ -14,6 +14,7 @@ export const businessEmailSchema = Joi.object({
     .messages({
       'string.max': `Business email address must be ${EMAIL_MAX} characters or less`,
       'string.empty': 'Enter business email address',
-      'string.email': 'Enter an email address, like name@example.com'
+      'string.email': 'Enter an email address, like name@example.com',
+      'string.noControlChars': 'Business email address must not contain invalid characters'
     })
 })

package/src/schemas/business/business-name-schema.js

@@ -1,13 +1,15 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import { BUSINESS_NAME_MAX } from '../../constants/validation-fields.js'
 
 export const businessNameSchema = Joi.object({
   businessName: Joi.string()
+    .trim()
     .required()
     .max(BUSINESS_NAME_MAX)
     .messages({
       'string.empty': 'Enter business name',
       'string.max': `Business name must be ${BUSINESS_NAME_MAX} characters or less`,
-      'any.required': 'Enter business name'
+      'any.required': 'Enter business name',
+      'string.noControlChars': 'Business name must not contain invalid characters'
     })
 })

package/src/schemas/business/business-phone-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import {
   PHONE_NUMBER_MIN,
   PHONE_NUMBER_MAX
@@ -7,6 +7,7 @@ import { PHONE_NUMBER_PATTERN } from '../../constants/patterns.js'
 
 export const businessPhoneSchema = Joi.object({
   businessTelephone: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -14,9 +15,11 @@ export const businessPhoneSchema = Joi.object({
     .messages({
       'string.min': `Business telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Business telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Business telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Business telephone number must not contain invalid characters'
     }),
   businessMobile: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -24,7 +27,8 @@ export const businessPhoneSchema = Joi.object({
     .messages({
       'string.min': `Business mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Business mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Business mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Business mobile phone number must not contain invalid characters'
     })
 })
   .or('businessTelephone', 'businessMobile')

package/src/schemas/business/business-sbi-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 
 export const businessSbiSchema = Joi.object({
   sbi: Joi.string()
@@ -6,6 +6,7 @@ export const businessSbiSchema = Joi.object({
     .allow('')
     .optional()
     .messages({
-      'string.pattern.base': 'Enter the full SBI'
+      'string.pattern.base': 'Enter the full SBI',
+      'string.noControlChars': 'SBI must not contain invalid characters'
     })
 })

package/src/schemas/business/business-schemas.js

@@ -1,5 +1,5 @@
 import { businessSbiSchema } from './business-sbi-schema.js'
-import { addressSchema } from '../address-schema.js'
+import { addressSchema } from '../shared/address-schema.js'
 import { businessNameSchema } from './business-name-schema.js'
 import { businessEmailSchema } from './business-email-schema.js'
 import { businessPhoneSchema } from './business-phone-schema.js'

package/src/schemas/business/business-vat-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 
 export const businessVatSchema = Joi.object({
   vatNumber: Joi.string()
@@ -6,6 +6,7 @@ export const businessVatSchema = Joi.object({
     .allow('')
     .optional()
     .messages({
-      'string.pattern.base': 'Enter a VAT registration number, like 123456789'
+      'string.pattern.base': 'Enter a VAT registration number, like 123456789',
+      'string.noControlChars': 'VAT registration number must not contain invalid characters'
     })
 })

package/src/schemas/customer/customer-crn-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 
 export const customerCrnSchema = Joi.object({
   crn: Joi.string()
@@ -6,6 +6,7 @@ export const customerCrnSchema = Joi.object({
     .allow('')
     .optional()
     .messages({
-      'string.pattern.base': 'Enter the full CRN'
+      'string.pattern.base': 'Enter the full CRN',
+      'string.noControlChars': 'CRN must not contain invalid characters'
     })
 })

package/src/schemas/personal/personal-dob-schema.js

@@ -1,5 +1,6 @@
-import Joi from 'joi'
-import { MONTH_MAP, MAX_AGE_YEARS } from '../../constants/validation-fields-export.js'
+import { Joi } from '../../utils/joi.js'
+import { MAX_AGE_YEARS } from '../../constants/validation-fields.js'
+import { MONTH_MAP } from '../../constants/month-map.js'
 
 export const personalDobSchema = Joi.object({
   day: Joi.string().allow(''),
@@ -32,7 +33,9 @@ export const personalDobSchema = Joi.object({
   }
 
   // Date must be in the past
-  if (fullDate > new Date()) {
+  const today = new Date()
+  today.setUTCHours(0, 0, 0, 0)
+  if (fullDate >= today) {
     return makeError(helpers, 'dob.future', ['day', 'month', 'year'])
   }
 
@@ -54,7 +57,8 @@ export const personalDobSchema = Joi.object({
   'dob.yearLength': 'Enter a year with 4 numbers, like 1975',
   'dob.invalid': 'Date of birth must be a real date',
   'dob.future': 'Date of birth must be in the past',
-  'dob.tooOld': 'Date of birth must be on or after {{#oldest}}'
+  'dob.tooOld': 'Date of birth must be on or after {{#oldest}}',
+  'string.noControlChars': 'Date of birth must not contain invalid characters'
 })
 
 const checkNotTooOld = (fullDate, helpers) => {
@@ -119,7 +123,7 @@ const getFullDate = (day, monthValue, year, helpers) => {
  *
  * If a valid mapping is found, the mapped number is returned.
  * If no mapping exists, an error is returned via `makeError`, as the input is likely invalid.
- * If the month is already numeric, it is simply parsed and returned as a number.
+ * If the month is already numeric, it is parsed and validated to be within the range 1–12.
  */
 const getMonthNumber = (month, helpers) => {
   if (Number.isNaN(Number(month))) {
@@ -133,7 +137,13 @@ const getMonthNumber = (month, helpers) => {
     return mapped
   }
 
-  return Number.parseInt(month, 10)
+  const parsedMonth = Number.parseInt(month, 10)
+
+  if (parsedMonth < 1 || parsedMonth > 12) {
+    return makeError(helpers, 'dob.invalid', ['month'])
+  }
+
+  return parsedMonth
 }
 
 /**

package/src/schemas/personal/personal-email-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import { EMAIL_MAX } from '../../constants/validation-fields.js'
 
 export const personalEmailSchema = Joi.object({
@@ -15,6 +15,7 @@ export const personalEmailSchema = Joi.object({
     .messages({
       'string.max': `Email address must be ${EMAIL_MAX} characters or less`,
       'string.empty': 'Enter a personal email address',
-      'string.email': 'Enter an email address, like name@example.com'
+      'string.email': 'Enter an email address, like name@example.com',
+      'string.noControlChars': 'Personal email address must not contain invalid characters'
     })
 })

package/src/schemas/personal/personal-name-schema.js

@@ -1,4 +1,4 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import {
   FIRST_NAME_MAX,
   LAST_NAME_MAX,
@@ -7,25 +7,31 @@ import {
 
 export const personalNameSchema = Joi.object({
   first: Joi.string()
+    .trim()
     .required()
     .max(FIRST_NAME_MAX)
     .messages({
       'string.empty': 'Enter first name',
       'string.max': `First name must be ${FIRST_NAME_MAX} characters or less`,
-      'any.required': 'Enter first name'
+      'any.required': 'Enter first name',
+      'string.noControlChars': 'First name must not contain invalid characters'
     }),
   last: Joi.string()
+    .trim()
     .required()
     .max(LAST_NAME_MAX)
     .messages({
       'string.empty': 'Enter last name',
       'string.max': `Last name must be ${LAST_NAME_MAX} characters or less`,
-      'any.required': 'Enter last name'
+      'any.required': 'Enter last name',
+      'string.noControlChars': 'Last name must not contain invalid characters'
     }),
   middle: Joi.string()
+    .trim()
     .allow('')
     .max(MIDDLE_NAMES_MAX)
     .messages({
-      'string.max': `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`
+      'string.max': `Middle names must be ${MIDDLE_NAMES_MAX} characters or less`,
+      'string.noControlChars': 'Middle names must not contain invalid characters'
     })
 })

package/src/schemas/personal/personal-phone-schema.js

@@ -1,12 +1,10 @@
-import Joi from 'joi'
-import {
-  PHONE_NUMBER_MIN,
-  PHONE_NUMBER_MAX,
-  PHONE_NUMBER_PATTERN
-} from '../../constants/validation-fields-export.js'
+import { Joi } from '../../utils/joi.js'
+import { PHONE_NUMBER_MIN, PHONE_NUMBER_MAX } from '../../constants/validation-fields.js'
+import { PHONE_NUMBER_PATTERN } from '../../constants/patterns.js'
 
 export const personalPhoneSchema = Joi.object({
   personalTelephone: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -14,9 +12,11 @@ export const personalPhoneSchema = Joi.object({
     .messages({
       'string.min': `Personal telephone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Personal telephone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Personal telephone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Personal telephone number must not contain invalid characters'
     }),
   personalMobile: Joi.string()
+    .trim()
     .empty('')
     .min(PHONE_NUMBER_MIN)
     .max(PHONE_NUMBER_MAX)
@@ -24,7 +24,8 @@ export const personalPhoneSchema = Joi.object({
     .messages({
       'string.min': `Personal mobile phone number must be ${PHONE_NUMBER_MIN} characters or more`,
       'string.max': `Personal mobile phone number must be ${PHONE_NUMBER_MAX} characters or less`,
-      'string.pattern.base': 'Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +'
+      'string.pattern.base': 'Personal mobile phone number must only include numbers 0 to 9 and special characters such as spaces, brackets and +',
+      'string.noControlChars': 'Personal mobile phone number must not contain invalid characters'
     })
 })
   .or('personalTelephone', 'personalMobile')

package/src/schemas/personal/personal-schemas.js

@@ -1,6 +1,6 @@
 import { personalNameSchema } from './personal-name-schema.js'
 import { personalDobSchema } from './personal-dob-schema.js'
-import { addressSchema } from '../address-schema.js'
+import { addressSchema } from '../shared/address-schema.js'
 import { personalEmailSchema } from './personal-email-schema.js'
 import { personalPhoneSchema } from './personal-phone-schema.js'
 

package/src/schemas/{address-schema.js → shared/address-schema.js}

@@ -1,61 +1,75 @@
-import Joi from 'joi'
+import { Joi } from '../../utils/joi.js'
 import {
   ADDRESS_LINE_MAX,
   TOWN_CITY_MAX,
   COUNTY_MAX,
   POSTCODE_MAX,
   COUNTRY_MAX
-} from '../constants/validation-fields.js'
+} from '../../constants/validation-fields.js'
 
 export const addressSchema = Joi.object({
   address1: Joi.string()
+    .trim()
     .required()
     .max(ADDRESS_LINE_MAX)
     .messages({
       'string.empty': 'Enter address line 1, typically the building and street',
       'string.max': `Address line 1 must be ${ADDRESS_LINE_MAX} characters or less`,
-      'any.required': 'Enter address line 1, typically the building and street'
+      'any.required': 'Enter address line 1, typically the building and street',
+      'string.noControlChars': 'Address line 1 must not contain invalid characters'
     }),
   address2: Joi.string()
+    .trim()
     .allow('')
     .max(ADDRESS_LINE_MAX)
     .messages({
-      'string.max': `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`
+      'string.max': `Address line 2 must be ${ADDRESS_LINE_MAX} characters or less`,
+      'string.noControlChars': 'Address line 2 must not contain invalid characters'
     }),
   address3: Joi.string()
+    .trim()
     .allow('')
     .max(ADDRESS_LINE_MAX)
     .messages({
-      'string.max': `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`
+      'string.max': `Address line 3 must be ${ADDRESS_LINE_MAX} characters or less`,
+      'string.noControlChars': 'Address line 3 must not contain invalid characters'
     }),
   city: Joi.string()
+    .trim()
     .required()
     .max(TOWN_CITY_MAX)
     .messages({
       'string.empty': 'Enter town or city',
       'string.max': `Town or city must be ${TOWN_CITY_MAX} characters or less`,
-      'any.required': 'Enter town or city'
+      'any.required': 'Enter town or city',
+      'string.noControlChars': 'Town or city must not contain invalid characters'
     }),
   county: Joi.string()
+    .trim()
     .allow('')
     .max(COUNTY_MAX)
     .messages({
-      'string.max': `County must be ${COUNTY_MAX} characters or less`
+      'string.max': `County must be ${COUNTY_MAX} characters or less`,
+      'string.noControlChars': 'County must not contain invalid characters'
     }),
   postcode: Joi.string()
+    .trim()
     .required()
     .max(POSTCODE_MAX)
     .messages({
       'any.required': 'Enter a postal code or zip code',
       'string.empty': 'Enter a postal code or zip code',
-      'string.max': `Postal code or zip code must be ${POSTCODE_MAX} characters or less`
+      'string.max': `Postal code or zip code must be ${POSTCODE_MAX} characters or less`,
+      'string.noControlChars': 'Postal code or zip code must not contain invalid characters'
     }),
   country: Joi.string()
+    .trim()
     .required()
     .max(COUNTRY_MAX)
     .messages({
       'string.empty': 'Enter a country',
       'string.max': `Country must be ${COUNTRY_MAX} characters or less`,
-      'any.required': 'Enter a country'
+      'any.required': 'Enter a country',
+      'string.noControlChars': 'Country must not contain invalid characters'
     })
 })

package/src/utils/joi.js

@@ -0,0 +1,21 @@
+import BaseJoi from 'joi'
+import { NO_CONTROL_CHARS_PATTERN } from '../constants/patterns.js'
+
+// Extends Joi's string type so every Joi.string() automatically rejects ASCII control
+// characters (0x00–0x1f and 0x7f), which have no valid use in text input fields. Using a
+// dedicated 'string.noControlChars' error keeps it distinct from the generic pattern rule
+// used by numeric and phone fields. Fields may override the message via their own .messages().
+export const Joi = BaseJoi.extend((joi) => ({
+  type: 'string',
+  base: joi.string(),
+  messages: {
+    'string.noControlChars': 'Field must not contain invalid characters'
+  },
+  validate (value, helpers) {
+    if (typeof value === 'string' && !NO_CONTROL_CHARS_PATTERN.test(value)) {
+      return { value, errors: helpers.error('string.noControlChars') }
+    }
+
+    return { value }
+  }
+}))

package/src/constants/validation-fields-export.js

@@ -1,17 +0,0 @@
-export {
-  FIRST_NAME_MAX,
-  LAST_NAME_MAX,
-  MIDDLE_NAMES_MAX,
-  EMAIL_MAX,
-  PHONE_NUMBER_MIN,
-  PHONE_NUMBER_MAX,
-  MAX_AGE_YEARS,
-  ADDRESS_LINE_MAX,
-  TOWN_CITY_MAX,
-  COUNTY_MAX,
-  COUNTRY_MAX,
-  POSTCODE_MAX
-} from './validation-fields.js'
-
-export { PHONE_NUMBER_PATTERN } from './patterns.js'
-export { MONTH_MAP } from './month-map.js'