disarm 0.14.1 → 0.15.0

package/binding.d.ts

@@ -60,8 +60,36 @@ export interface AutoLangInspection {
   discriminatorsHit: Array<string>
 }
 
+/**
+ * Canonicalize text for security-sensitive comparison. Not an output sanitizer —
+ * encode at the sink.
+ *
+ * Two steps introduce ASCII, not one (#719): the leading NFKC, and the confusable fold,
+ * which reaches characters NFKC leaves alone. `U+2236 RATIO` becomes `:`, `U+2044
+ * FRACTION SLASH` becomes `/`, `U+2216 SET MINUS` becomes `\`. A string that carried no
+ * delimiter can leave here carrying one. `inspectAnomalies` reports it as `confusable`
+ * WHEN the word also carries an ASCII letter, which is the gate that keeps ordinary
+ * non-Latin text from firing; a delimiter-only string is not reported.
+ */
 export declare function canonicalize(text: string): string
 
+/**
+ * Strip the non-interchange and invisible classes while KEEPING the script (#698).
+ *
+ * The seven universal `strip*` primitives cannot be composed into this, and the
+ * difference runs in both directions. `strip_format` is *less* destructive where
+ * rendering matters — it preserves the Private Use Area for icon fonts and keeps the
+ * VS15/VS16 presentation selectors after a base (`RENDERING_STRIP`), both of which the
+ * naive chain deletes — and *more* destructive with whitespace, because it ends in
+ * `CollapseWs` and folds TAB/LF to a space where the primitives leave them. The policy
+ * itself is a private constant, so a caller on this binding could not express it at all.
+ *
+ * Unlike `canonicalize` it does NOT fold confusables, so non-Latin text keeps its script
+ * — the point of the preset.
+ * Canonicalize, but fail rather than silently normalize a structural difference away.
+ */
+export declare function canonicalizeStrict(text: string): string
+
 /**
  * Library catalog deduplication key (like `searchKey` plus confusable folding).
  * `lang` selects the transliteration table; `strict_iso9` picks the ISO 9:1995
@@ -71,12 +99,6 @@ export declare function catalogKey(text: string, lang: string | undefined | null
 
 export declare function collapseWhitespace(text: string): string
 
-/**
- * The Unicode `confusables.txt` release the bundled confusable tables were folded
- * from (#560). Deliberately not called a "Unicode version": disarm's other tables
- * track different releases (see docs/provenance.md), so this answers one question —
- * how current is the confusables fold?
- */
 export declare function confusablesVersion(): string
 
 /** Replace emoji with their plain names; `strip_modifiers` drops skin-tone marks. */
@@ -150,6 +172,15 @@ export declare function hasAnomalies(text: string, lexicon: Array<string> | Lexi
  */
 export declare function hasBidiConflict(text: string): boolean
 
+/**
+ * All twelve UAX #9 explicit formatting characters, uncontexted (#778).
+ * The counterpart to `has_bidi_conflict`, which reads strong-direction letters and is
+ * blind to these; the two are disjoint. The anomaly detector's `bidi` kind reports nine
+ * of the twelve, holding back LRM, RLM and ALM because a lone directional mark is
+ * ordinary in right-to-left text.
+ */
+export declare function hasBidiControl(text: string): boolean
+
 /**
  * Findings from a hostname homoglyph analysis (#549). Factual signals only — a
  * `suspicious == false` result is not a safety guarantee.
@@ -186,6 +217,17 @@ export interface HostnameAnalysis {
    * so they never reach `scripts`, `mixedScript` or `canonical`.
    */
   hasInvisible: boolean
+  /**
+   * Whether any label carried a Unicode compatibility form before normalization
+   * (#709) — fullwidth (`ｇoogle`), ligature (`file`), Roman numeral (`Ⅰ`BM),
+   * mathematical alphanumeric (`𝗀𝗈𝗈𝗀𝗅𝖾`). The predicate is RFC 5892 §2.1's, applied
+   * per code point: `toNFKC(c) != c` is DISALLOWED in an IDN label, so IDNA2008
+   * disallows the whole set and this folds into `suspicious`. The threat is a
+   * blocklist bypass, not a lookalike: `ｅvil.com` screens clean and resolves to
+   * `evil.com`. The one field read from the RAW input — the normalization every
+   * other field needs is what erases this evidence.
+   */
+  compatFold: boolean
   /**
    * Whether the labels span more than one script. Broader/noisier than
    * `bidiConflict`; NOT folded into `suspicious`.
@@ -253,6 +295,13 @@ export interface KeyCollision {
   indices: Array<number>
 }
 
+/**
+ * Whether a key stored under an earlier release still compares equal (#645). A
+ * monotonic counter, not a version: two artifacts reporting the same value produce the
+ * same key for the same input. Meaningless in isolation, by design.
+ */
+export declare function keySchemaVersion(): number
+
 /**
  * Look up static facts about a language `code`. An unknown code raises a
  * `DisarmInvalidArgument`-tagged error.
@@ -290,7 +339,7 @@ export declare function mlNormalize(text: string, lang: string | undefined | nul
 /** Apply a normalization form: `"NFC"` | `"NFD"` | `"NFKC"` | `"NFKD"`. */
 export declare function normalize(text: string, form: string): string
 
-/** Fold cross-script confusables toward `target` (`"latin"` | `"cyrillic"`). */
+/** Fold cross-script confusables toward `target` (`"latin"` | `"cyrillic"` | `"arabic"` | `"hebrew"`). */
 export declare function normalizeConfusables(text: string, target: string, digitPolicy: string): string
 
 /** Reverse-transliterate Latin → native script. `lang` is `"el"` | `"ru"` | `"uk"`. */
@@ -299,6 +348,12 @@ export declare function reverseTransliterate(text: string, lang: string): string
 /**
  * Turn arbitrary text into a safe filename. `platform` is `"universal"` |
  * `"windows"` | `"posix"`.
+ *
+ * A safe **filename**, not a safe URL path segment. `%` is legal in a filename, so one
+ * the caller typed is kept — `sanitizeFilename("..%2Fetc")` returns `"%2Fetc"` — and a
+ * consumer that percent-decodes the result must validate *after* decoding. What this
+ * will not do is manufacture one: `%` never appears in the output unless it appeared in
+ * the input (#721).
  */
 export declare function sanitizeFilename(text: string, separator: string, maxLength: number, platform: string, lang: string | undefined | null, preserveExtension: boolean): string
 
@@ -357,6 +412,8 @@ export declare function stripBidi(text: string): string
 
 export declare function stripControlChars(text: string): string
 
+export declare function stripFormat(text: string): string
+
 /** Strip every Unicode noncharacter (#413). */
 export declare function stripNoncharacters(text: string): string
 
@@ -386,6 +443,18 @@ export declare function transliterate(text: string): string
  */
 export declare function transliterateOpts(text: string, scheme: string, lang?: string | undefined | null): string
 
+/**
+ * The Unicode `confusables.txt` release the bundled confusable tables were folded
+ * from (#560). Deliberately not called a "Unicode version": disarm's other tables
+ * track different releases (see docs/provenance.md), so this answers one question —
+ * how current is the confusables fold?
+ * The UCD release disarm's normalizer implements (#645). Not a library-wide Unicode
+ * version — the bundled tables track different releases; this is the one integrators ask
+ * about, because it decides whether disarm's normalization agrees with the host
+ * platform's.
+ */
+export declare function unicodeVersion(): string
+
 /**
  * An upstream confusable source the bundled table does not fold, located in the
  * input (#563). Mirrors `Untranslatable`, its transliteration analogue.

package/binding.js

@@ -77,8 +77,8 @@ function requireNative() {
       try {
         const binding = require('disarm-android-arm64')
         const bindingPackageVersion = require('disarm-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -93,8 +93,8 @@ function requireNative() {
       try {
         const binding = require('disarm-android-arm-eabi')
         const bindingPackageVersion = require('disarm-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -114,8 +114,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-x64-gnu')
         const bindingPackageVersion = require('disarm-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -130,8 +130,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-x64-msvc')
         const bindingPackageVersion = require('disarm-win32-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -147,8 +147,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-ia32-msvc')
         const bindingPackageVersion = require('disarm-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -163,8 +163,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-arm64-msvc')
         const bindingPackageVersion = require('disarm-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -182,8 +182,8 @@ function requireNative() {
     try {
       const binding = require('disarm-darwin-universal')
       const bindingPackageVersion = require('disarm-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -198,8 +198,8 @@ function requireNative() {
       try {
         const binding = require('disarm-darwin-x64')
         const bindingPackageVersion = require('disarm-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -214,8 +214,8 @@ function requireNative() {
       try {
         const binding = require('disarm-darwin-arm64')
         const bindingPackageVersion = require('disarm-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -234,8 +234,8 @@ function requireNative() {
       try {
         const binding = require('disarm-freebsd-x64')
         const bindingPackageVersion = require('disarm-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -250,8 +250,8 @@ function requireNative() {
       try {
         const binding = require('disarm-freebsd-arm64')
         const bindingPackageVersion = require('disarm-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -271,8 +271,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-x64-musl')
           const bindingPackageVersion = require('disarm-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -287,8 +287,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-x64-gnu')
           const bindingPackageVersion = require('disarm-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -305,8 +305,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm64-musl')
           const bindingPackageVersion = require('disarm-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -321,8 +321,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm64-gnu')
           const bindingPackageVersion = require('disarm-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -339,8 +339,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm-musleabihf')
           const bindingPackageVersion = require('disarm-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -355,8 +355,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm-gnueabihf')
           const bindingPackageVersion = require('disarm-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -373,8 +373,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-loong64-musl')
           const bindingPackageVersion = require('disarm-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -389,8 +389,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-loong64-gnu')
           const bindingPackageVersion = require('disarm-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -407,8 +407,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-riscv64-musl')
           const bindingPackageVersion = require('disarm-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -423,8 +423,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-riscv64-gnu')
           const bindingPackageVersion = require('disarm-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -440,8 +440,8 @@ function requireNative() {
       try {
         const binding = require('disarm-linux-ppc64-gnu')
         const bindingPackageVersion = require('disarm-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -456,8 +456,8 @@ function requireNative() {
       try {
         const binding = require('disarm-linux-s390x-gnu')
         const bindingPackageVersion = require('disarm-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -476,8 +476,8 @@ function requireNative() {
       try {
         const binding = require('disarm-openharmony-arm64')
         const bindingPackageVersion = require('disarm-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -492,8 +492,8 @@ function requireNative() {
       try {
         const binding = require('disarm-openharmony-x64')
         const bindingPackageVersion = require('disarm-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -508,8 +508,8 @@ function requireNative() {
       try {
         const binding = require('disarm-openharmony-arm')
         const bindingPackageVersion = require('disarm-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -591,6 +591,7 @@ module.exports.Lexicon = nativeBinding.Lexicon
 module.exports.Pipeline = nativeBinding.Pipeline
 module.exports.analyzeHostname = nativeBinding.analyzeHostname
 module.exports.canonicalize = nativeBinding.canonicalize
+module.exports.canonicalizeStrict = nativeBinding.canonicalizeStrict
 module.exports.catalogKey = nativeBinding.catalogKey
 module.exports.collapseWhitespace = nativeBinding.collapseWhitespace
 module.exports.confusablesVersion = nativeBinding.confusablesVersion
@@ -607,6 +608,7 @@ module.exports.graphemeTruncate = nativeBinding.graphemeTruncate
 module.exports.graphemeWidth = nativeBinding.graphemeWidth
 module.exports.hasAnomalies = nativeBinding.hasAnomalies
 module.exports.hasBidiConflict = nativeBinding.hasBidiConflict
+module.exports.hasBidiControl = nativeBinding.hasBidiControl
 module.exports.inspectAnomalies = nativeBinding.inspectAnomalies
 module.exports.inspectAutoLang = nativeBinding.inspectAutoLang
 module.exports.isCaseFoldStable = nativeBinding.isCaseFoldStable
@@ -615,6 +617,7 @@ module.exports.isMixedScript = nativeBinding.isMixedScript
 module.exports.isNormalized = nativeBinding.isNormalized
 module.exports.isSuspiciousHostname = nativeBinding.isSuspiciousHostname
 module.exports.isZalgo = nativeBinding.isZalgo
+module.exports.keySchemaVersion = nativeBinding.keySchemaVersion
 module.exports.langInfo = nativeBinding.langInfo
 module.exports.listContextLangs = nativeBinding.listContextLangs
 module.exports.listScripts = nativeBinding.listScripts
@@ -630,6 +633,7 @@ module.exports.sortKey = nativeBinding.sortKey
 module.exports.stripAccents = nativeBinding.stripAccents
 module.exports.stripBidi = nativeBinding.stripBidi
 module.exports.stripControlChars = nativeBinding.stripControlChars
+module.exports.stripFormat = nativeBinding.stripFormat
 module.exports.stripNoncharacters = nativeBinding.stripNoncharacters
 module.exports.stripObfuscation = nativeBinding.stripObfuscation
 module.exports.stripPua = nativeBinding.stripPua
@@ -640,4 +644,5 @@ module.exports.stripZeroWidthChars = nativeBinding.stripZeroWidthChars
 module.exports.terminalWidth = nativeBinding.terminalWidth
 module.exports.transliterate = nativeBinding.transliterate
 module.exports.transliterateOpts = nativeBinding.transliterateOpts
+module.exports.unicodeVersion = nativeBinding.unicodeVersion
 module.exports.unmappedConfusables = nativeBinding.unmappedConfusables

package/index.d.ts

@@ -25,7 +25,7 @@ export { Lexicon };
  */
 export { Pipeline };
 /** The anomaly branch that fired for a finding. */
-export type AnomalyKind = 'invisible' | 'bidi' | 'bidi_mixed' | 'zalgo' | 'mixed_script' | 'leet' | 'segmentation' | 'control' | 'compat_fold';
+export type AnomalyKind = 'invisible' | 'bidi' | 'bidi_mixed' | 'zalgo' | 'mixed_script' | 'leet' | 'segmentation' | 'control' | 'compat_fold' | 'confusable' | 'enclosing_mark' | 'mixed_numbers' | 'duplicate_mark';
 /**
  * One reason a token is anomalous. Re-typed over the generated {@link NativeFinding}
  * so `kind` is the {@link AnomalyKind} string-union rather than a bare `string`.
@@ -62,8 +62,12 @@ export type TargetScript = 'latin' | 'cyrillic';
  *
  * Scoped to `target: 'latin'`: the override rows are generated from the Latin table and
  * carry TR39's Latin-script targets, so with `target: 'cyrillic'` the option is a no-op.
+ *
+ * `'preserve'` leaves the digit alone (#648). The other two both rewrite a non-Latin
+ * numeral and neither keeps the script — `२०२४` becomes `२0२४` or `२o२४`, both
+ * mixed-script. This one applies under every target script.
  */
-export type DigitPolicy = 'numeric' | 'tr39';
+export type DigitPolicy = 'numeric' | 'tr39' | 'preserve';
 /** Unicode normalization form. */
 export type NormalizationForm = 'NFC' | 'NFD' | 'NFKC' | 'NFKD';
 /** Filename-safety platform ruleset. */
@@ -210,6 +214,22 @@ export declare function stripZalgo(text: string, options?: {
 export declare function isZalgo(text: string, options?: {
     threshold?: number;
 }): boolean;
+/**
+ * Canonicalize, but throw rather than silently normalize a structural difference away —
+ * the half of the pair that lets a caller reject input instead of comparing a value the
+ * sender never wrote.
+ */
+export declare function canonicalizeStrict(text: string): string;
+/**
+ * Strip the non-interchange and invisible classes while KEEPING the script.
+ *
+ * Unlike {@link canonicalize} it folds no confusables, so non-Latin text survives as
+ * itself. It cannot be rebuilt from the seven universal `strip*` functions, and the
+ * difference runs both ways: this preserves the Private Use Area (icon fonts) and keeps
+ * the VS15/VS16 presentation selectors after a base, which the naive chain deletes, and
+ * it collapses TAB/LF to a space, which the primitives leave alone. Infallible.
+ */
+export declare function stripFormat(text: string): string;
 /** Remove obfuscation (zero-width, bidi, combining-mark abuse, homoglyphs) while keeping legible content. */
 export declare function stripObfuscation(text: string): string;
 /**
@@ -320,6 +340,15 @@ export declare function analyzeHostname(host: string, options?: {
 export declare function detectScripts(text: string): string[];
 /** Whether `text` mixes characters from more than one script. */
 export declare function isMixedScript(text: string): boolean;
+/**
+ * All twelve UAX #9 explicit formatting characters, uncontexted.
+ *
+ * The counterpart to {@link hasBidiConflict}, which reads strong-direction letters and is
+ * blind to these; the two are disjoint. The anomaly detector's `bidi` kind reports nine of
+ * the twelve, holding back LRM, RLM and ALM because a lone directional mark is ordinary in
+ * right-to-left text.
+ */
+export declare function hasBidiControl(text: string): boolean;
 /**
  * Whether `text` mixes strong left-to-right and strong right-to-left characters
  * — the precondition for Bidi display-reordering ("BiDi Swap", #412). Fires on
@@ -341,6 +370,18 @@ export declare function langInfo(code: string): LangMeta;
  * unknown name throws {@link DisarmInvalidArgument}.
  */
 export declare function scriptInfo(name: string): ScriptMeta;
+/**
+ * The UCD release disarm's normalizer implements. Not a library-wide Unicode version —
+ * the bundled tables track different releases. This is the one integrators ask about,
+ * because it decides whether disarm's normalization agrees with the host platform's.
+ */
+export declare function unicodeVersion(): string;
+/**
+ * Whether a key stored under an earlier release still compares equal. A monotonic
+ * counter, not a version — two artifacts reporting the same value produce the same key
+ * for the same input. Meaningless in isolation, by design.
+ */
+export declare function keySchemaVersion(): number;
 /**
  * The Unicode `confusables.txt` release the bundled confusable tables were folded
  * from, e.g. `"17.0.0"`.

package/index.js

@@ -59,6 +59,8 @@ exports.stripNoncharacters = stripNoncharacters;
 exports.stripPua = stripPua;
 exports.stripZalgo = stripZalgo;
 exports.isZalgo = isZalgo;
+exports.canonicalizeStrict = canonicalizeStrict;
+exports.stripFormat = stripFormat;
 exports.stripObfuscation = stripObfuscation;
 exports.canonicalize = canonicalize;
 exports.securityClean = securityClean;
@@ -77,10 +79,13 @@ exports.isSuspiciousHostname = isSuspiciousHostname;
 exports.analyzeHostname = analyzeHostname;
 exports.detectScripts = detectScripts;
 exports.isMixedScript = isMixedScript;
+exports.hasBidiControl = hasBidiControl;
 exports.hasBidiConflict = hasBidiConflict;
 exports.inspectAutoLang = inspectAutoLang;
 exports.langInfo = langInfo;
 exports.scriptInfo = scriptInfo;
+exports.unicodeVersion = unicodeVersion;
+exports.keySchemaVersion = keySchemaVersion;
 exports.confusablesVersion = confusablesVersion;
 exports.listScripts = listScripts;
 exports.listContextLangs = listContextLangs;
@@ -307,6 +312,26 @@ function isZalgo(text, options = {}) {
     return call(() => native.isZalgo(text, options.threshold ?? 3));
 }
 // ── Deobfuscation & security presets ────────────────────────────────────────
+/**
+ * Canonicalize, but throw rather than silently normalize a structural difference away —
+ * the half of the pair that lets a caller reject input instead of comparing a value the
+ * sender never wrote.
+ */
+function canonicalizeStrict(text) {
+    return call(() => native.canonicalizeStrict(text));
+}
+/**
+ * Strip the non-interchange and invisible classes while KEEPING the script.
+ *
+ * Unlike {@link canonicalize} it folds no confusables, so non-Latin text survives as
+ * itself. It cannot be rebuilt from the seven universal `strip*` functions, and the
+ * difference runs both ways: this preserves the Private Use Area (icon fonts) and keeps
+ * the VS15/VS16 presentation selectors after a base, which the naive chain deletes, and
+ * it collapses TAB/LF to a space, which the primitives leave alone. Infallible.
+ */
+function stripFormat(text) {
+    return native.stripFormat(text);
+}
 /** Remove obfuscation (zero-width, bidi, combining-mark abuse, homoglyphs) while keeping legible content. */
 function stripObfuscation(text) {
     return call(() => native.stripObfuscation(text));
@@ -421,6 +446,17 @@ function detectScripts(text) {
 function isMixedScript(text) {
     return native.isMixedScript(text);
 }
+/**
+ * All twelve UAX #9 explicit formatting characters, uncontexted.
+ *
+ * The counterpart to {@link hasBidiConflict}, which reads strong-direction letters and is
+ * blind to these; the two are disjoint. The anomaly detector's `bidi` kind reports nine of
+ * the twelve, holding back LRM, RLM and ALM because a lone directional mark is ordinary in
+ * right-to-left text.
+ */
+function hasBidiControl(text) {
+    return native.hasBidiControl(text);
+}
 /**
  * Whether `text` mixes strong left-to-right and strong right-to-left characters
  * — the precondition for Bidi display-reordering ("BiDi Swap", #412). Fires on
@@ -451,6 +487,22 @@ function langInfo(code) {
 function scriptInfo(name) {
     return call(() => native.scriptInfo(name));
 }
+/**
+ * The UCD release disarm's normalizer implements. Not a library-wide Unicode version —
+ * the bundled tables track different releases. This is the one integrators ask about,
+ * because it decides whether disarm's normalization agrees with the host platform's.
+ */
+function unicodeVersion() {
+    return native.unicodeVersion();
+}
+/**
+ * Whether a key stored under an earlier release still compares equal. A monotonic
+ * counter, not a version — two artifacts reporting the same value produce the same key
+ * for the same input. Meaningless in isolation, by design.
+ */
+function keySchemaVersion() {
+    return native.keySchemaVersion();
+}
 /**
  * The Unicode `confusables.txt` release the bundled confusable tables were folded
  * from, e.g. `"17.0.0"`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "disarm",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Unicode confusable/text-security building blocks, powered by Rust",
   "main": "index.js",
   "types": "index.d.ts",