activator: word-boundary leak matching — fixes 'versa' false-positive on legit Versace brand

3f4f5aed46f8f1342540d31269c97ac214b01894 · 2026-07-21 15:41:52 -0700 · steve@designerwallcoverings.com

Files touched

M rotate-activate.js

Diff

commit 3f4f5aed46f8f1342540d31269c97ac214b01894
Author: steve@designerwallcoverings.com <steve@designerwallcoverings.com>
Date:   Tue Jul 21 15:41:52 2026 -0700

    activator: word-boundary leak matching — fixes 'versa' false-positive on legit Versace brand
---
 rotate-activate.js | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/rotate-activate.js b/rotate-activate.js
index fdffded..cfdfcbd 100644
--- a/rotate-activate.js
+++ b/rotate-activate.js
@@ -241,13 +241,20 @@ function fiveFieldExtra(n) {
 // pattern or a "York"/"Seabrook" motif) → blocked only when they are the VENDOR
 // (the source), never merely a word in the title. ('schumacher' is intentionally
 // omitted — the denylist treats it as a legitimately-shown repped brand, not a leak.)
+// WORD-BOUNDARY matched (\btoken\b), NOT substring — critical so 'versa' matches
+// "Versa Designed Surfaces" (a Momentum leak) but NOT "Versace" (a legit luxury
+// brand DW sells), and 'york' matches the York source but not "Yorkshire".
 const PL_LEAK_HARD = ['wallquest', 'nextwall', 'command54', 'command 54', 'desima', 'carlsten',
   'greenland', 'yorkwall', 'lillian august', 'nicolette mayer', 'versa designed surfaces'];
-const PL_LEAK_VENDOR = [...PL_LEAK_HARD, 'chesapeake', 'seabrook', 'brewster', 'york', 'momentum', 'versa'];
+const PL_LEAK_VENDOR_ONLY = ['chesapeake', 'seabrook', 'brewster', 'york', 'momentum', 'versa'];
+const _wb = (tok) => new RegExp('\\b' + tok.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\b', 'i');
+const _HARD_RE = PL_LEAK_HARD.map((t) => [t, _wb(t)]);
+const _VENDOR_RE = PL_LEAK_VENDOR_ONLY.map((t) => [t, _wb(t)]);
 function leakGuard(title, vendor) {
-  const t = (title || '').toLowerCase(), v = (vendor || '').toLowerCase();
-  const hit = PL_LEAK_HARD.find((x) => t.includes(x)) || PL_LEAK_VENDOR.find((x) => v.includes(x));
-  return hit ? { ok: false, reason: `private-label-leak:${hit}` } : { ok: true };
+  const t = title || '', v = vendor || '';
+  for (const [tok, re] of _HARD_RE) if (re.test(t) || re.test(v)) return { ok: false, reason: `private-label-leak:${tok}` };
+  for (const [tok, re] of _VENDOR_RE) if (re.test(v)) return { ok: false, reason: `private-label-leak:${tok}` };
+  return { ok: true };
 }
 
 (async () => {

← eb84eed activator: align leak guard to canonical dw-leak-scanner den · back to Dw Rotation Activator · chore: clarify _HARD_RE/_VENDOR_RE are [token,RegExp] pairs 3466936 →