@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/customer-roles.js

@@ -119,7 +119,6 @@ var MAX_LIST_LIMIT = 200;
 // hyphen + underscore + dot, capped length.
 var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // Closed capability enum. Adding a new capability is a code change
 // here + the operator re-defines the affected roles.
@@ -137,6 +136,7 @@ var CAPABILITIES = Object.freeze([
 var ALLOWED_PATCH_COLUMNS = Object.freeze(["title", "capabilities"]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -152,9 +152,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("customerRoles: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerRoles: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerRoles: title", { singleLine: "reject" });
   return s;
 }
 
@@ -192,7 +190,7 @@ function _opaqueId(s, label) {
   if (typeof s !== "string" || !s.length || s.length > 200) {
     throw new TypeError("customerRoles: " + label + " must be a non-empty string (<= 200 chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("customerRoles: " + label + " must not contain control bytes");
   }
   return s;

package/lib/customer-segments.js

@@ -113,6 +113,7 @@ var C = b.constants;
 
 var DEFAULT_LIMIT = 100;
 var MAX_LIMIT     = 1000;
+var CSV_LINE_ENDING = "\r\n";   // RFC 4180
 var EXPORT_BATCH_SIZE = 500;
 
 // CSV column shape for a segment-members export. NO email column —
@@ -347,19 +348,22 @@ function _coerceCell(value) {
   return JSON.stringify(value);
 }
 
-function _neutralizeInjection(s) {
-  return b.guardCsv.escapeCell(s);
-}
-
-function _csvCell(value) {
-  var s = _neutralizeInjection(_coerceCell(value));
-  return '"' + s.replace(/"/g, '""') + '"';
-}
-
+// One member-export row, RFC 4180 — b.guardCsv.serialize writes the whole
+// line: the formula-injection prefix per cell, the unconditional quoting,
+// doubling an embedded quote, the delimiter and the CRLF. Only the injection
+// step was composed before; the quoting rules were written here and again in
+// order-export.js.
+//
+// serialize omits the trailing terminator, which suits a whole document and
+// not a generator yielding a row at a time, so the line ending is appended
+// here.
 function _csvRow(cells) {
-  var parts = [];
-  for (var i = 0; i < cells.length; i += 1) parts.push(_csvCell(cells[i]));
-  return parts.join(",") + "\r\n";
+  return b.guardCsv.serialize([cells.map(_coerceCell)], {
+    profile:     "strict",
+    alwaysQuote: true,
+    headers:     false,
+    lineEnding:  CSV_LINE_ENDING,
+  }) + CSV_LINE_ENDING;
 }
 
 // ---- factory ------------------------------------------------------------
@@ -975,6 +979,5 @@ module.exports = {
   MEMBER_EXPORT_COLUMNS:  MEMBER_EXPORT_COLUMNS,
   // Exposed for the test suite to assert CSV cell semantics without a
   // full DB round-trip.
-  _csvCell:               _csvCell,
-  _neutralizeInjection:   _neutralizeInjection,
+  _csvRow:                _csvRow,
 };

package/lib/customer-surveys.js

@@ -69,6 +69,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -104,8 +105,6 @@ var MAX_EXPIRES_HOURS        = 24 * 365;  // 1 year
 var DEFAULT_LIMIT            = 50;
 var MAX_LIMIT                = 500;
 
-var CONTROL_BYTE_RE          = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE   = /[\x00-\x1f\x7f]/;
 
 // NPS / CSAT / CES enforce a primary-question shape so the rollup
 // math has something well-defined to bucket against. Custom surveys
@@ -143,9 +142,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("customerSurveys: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerSurveys: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: title");
   return s;
 }
 
@@ -173,9 +170,7 @@ function _sourceEventId(s) {
   if (typeof s !== "string" || s.length > MAX_SOURCE_EVENT_LEN) {
     throw new TypeError("customerSurveys: source_event_id must be a string <= " + MAX_SOURCE_EVENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("customerSurveys: source_event_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: source_event_id", { singleLine: "reject" });
   return s;
 }
 
@@ -192,9 +187,7 @@ function _closeReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CLOSE_REASON_LEN) {
     throw new TypeError("customerSurveys: reason must be a non-empty string <= " + MAX_CLOSE_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerSurveys: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: reason");
   return s;
 }
 
@@ -245,7 +238,7 @@ function _questions(arr, kind) {
     if (typeof q.label !== "string" || !q.label.length || q.label.length > MAX_LABEL_LEN) {
       throw new TypeError("customerSurveys: questions[" + i + "].label must be a non-empty string <= " + MAX_LABEL_LEN + " chars");
     }
-    if (CONTROL_BYTE_RE.test(q.label)) {
+    if (textGuard.hasCodepointThreat(q.label)) {
       throw new TypeError("customerSurveys: questions[" + i + "].label must not contain control bytes");
     }
     var required = q.required == null ? true : q.required;
@@ -284,7 +277,7 @@ function _questions(arr, kind) {
           throw new TypeError("customerSurveys: questions[" + i + "].options[" + k +
                               "] must be a non-empty string <= " + MAX_OPTION_LEN + " chars");
         }
-        if (CONTROL_BYTE_RE.test(opt)) {
+        if (textGuard.hasCodepointThreat(opt)) {
           throw new TypeError("customerSurveys: questions[" + i + "].options[" + k +
                               "] must not contain control bytes");
         }
@@ -392,7 +385,7 @@ function _validateAnswers(answers, questions) {
         throw new TypeError("customerSurveys: answer for " + JSON.stringify(q.id) +
                             " must be <= " + q.max + " chars");
       }
-      if (CONTROL_BYTE_RE.test(a)) {
+      if (textGuard.hasCodepointThreat(a)) {
         throw new TypeError("customerSurveys: answer for " + JSON.stringify(q.id) +
                             " must not contain control bytes");
       }

package/lib/customers.js

@@ -36,6 +36,7 @@
 var nodeCrypto = require("node:crypto");                                   // allow:non-shop-require — Apple mandates ES256/P1363; framework has no classical ES256 signer
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var EMAIL_NAMESPACE = "customer-email";
 // Federated identity providers the OIDC sign-in path accepts.
@@ -43,7 +44,6 @@ var OAUTH_PROVIDERS = ["google", "apple"];
 var MAX_DISPLAY_NAME_LEN  = 128;
 var MAX_CRED_FIELD_BYTES  = 4096;
 var TRANSPORTS_RE = /^[a-z]+(?:,[a-z]+)*$/;
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // Pagination cursor for the operator-facing `list` — newest first by
 // (created_at, id), HMAC-tagged via b.pagination so an operator can't
@@ -105,9 +105,7 @@ function _displayName(s) {
   if (s.length > MAX_DISPLAY_NAME_LEN) {
     throw new TypeError("customers: display_name must be <= " + MAX_DISPLAY_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customers: display_name contains control bytes");
-  }
+  textGuard.freeText(s, "customers: display_name", { singleLine: "reject" });
   return s;
 }
 

package/lib/dispute-resolution.js

@@ -114,7 +114,6 @@ var PROCESSOR_RE    = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 var REASON_CODE_RE  = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
 var CURRENCY_RE     = /^[A-Z]{3}$/;
 var OPERATOR_ID_RE  = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var KINDS = Object.freeze([
   "chargeback",
@@ -151,6 +150,7 @@ var STATUSES = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -249,9 +249,7 @@ function _narrative(s) {
       " exceeds cap " + MAX_NARRATIVE_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: narrative must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: narrative");
   return s;
 }
 
@@ -265,9 +263,7 @@ function _blobRef(s) {
       " exceeds cap " + MAX_BLOB_REF_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: blob_ref must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: blob_ref");
   return s;
 }
 
@@ -281,9 +277,7 @@ function _notesOpt(s) {
       "disputeResolution: notes length " + s.length + " exceeds cap " + MAX_NOTES_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: notes must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: notes");
   return s;
 }
 
@@ -307,9 +301,7 @@ function _writeoffReason(s) {
       " exceeds cap " + MAX_WRITEOFF_REASON_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: writeoff reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: writeoff reason");
   return s;
 }
 

package/lib/dropship-forwarding.js

@@ -66,6 +66,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -81,7 +82,6 @@ var FORWARDING_STATUSES = Object.freeze([
 var SKU_RE          = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var SLUG_RE         = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
 var CURRENCY_RE     = /^[A-Z]{3}$/;
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var MAX_RETURN_POLICY_LEN  = 4000;
 var MAX_VENDOR_REF_LEN     = 256;
@@ -183,9 +183,7 @@ function _returnPolicy(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RETURN_POLICY_LEN) {
     throw new TypeError("dropship-forwarding: return_policy must be a non-empty string <= " + MAX_RETURN_POLICY_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("dropship-forwarding: return_policy must not contain control bytes");
-  }
+  textGuard.freeText(s, "dropship-forwarding: return_policy", { singleLine: "reject" });
 }
 function _positiveInt(n, label) {
   if (!Number.isInteger(n) || n <= 0) {
@@ -214,7 +212,7 @@ function _shortText(s, label, max) {
   if (typeof s !== "string" || !s.length || s.length > max) {
     throw new TypeError("dropship-forwarding: " + label + " must be a non-empty string <= " + max + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("dropship-forwarding: " + label + " must not contain control bytes");
   }
 }

package/lib/dunning.js

@@ -105,6 +105,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 // Framework constants (C.TIME duration helpers). Safe at module-eval —
 // the index entry point exposes `framework` before the require cascade.
 var C = b.constants;
@@ -130,10 +131,6 @@ var DEFAULT_LIST_LIMIT    = 100;
 var MS_PER_HOUR           = C.TIME.hours(1);
 
 var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -205,9 +202,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("dunning: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("dunning: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "dunning: reason", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/email-ab-tests.js

@@ -105,6 +105,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -133,7 +134,6 @@ var DEFAULT_LIST_LIMIT       = 50;
 // but 1.96 is the de-facto convention for shipped dashboards.
 var WILSON_Z                 = 1.96;
 
-var CONTROL_BYTE_RE          = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -165,9 +165,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("emailABTests: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("emailABTests: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "emailABTests: title");
   return s;
 }
 
@@ -184,7 +182,7 @@ function _label(s, idx) {
     throw new TypeError("emailABTests: variants[" + idx + "].label must be a non-empty string <= " +
                         MAX_LABEL_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("emailABTests: variants[" + idx + "].label must not contain control bytes");
   }
   return s;
@@ -223,9 +221,7 @@ function _recipientId(s) {
     throw new TypeError("emailABTests: recipient_id must be a non-empty string <= " +
                         MAX_RECIPIENT_ID_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("emailABTests: recipient_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "emailABTests: recipient_id");
   return s;
 }
 

package/lib/email-campaigns.js

@@ -146,6 +146,7 @@ var DEFAULT_BATCH_SIZE   = 100;
 var RESOLVE_PAGE_LIMIT   = 500;          // matches mailingAudiences MAX_LIST_LIMIT
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 // Framework duration constants (C.TIME.minutes(n) etc.). The index entry
 // point exposes `framework` before the require cascade, so resolving this
 // at module-eval is safe — same pattern lib/admin.js / lib/cart.js use.
@@ -164,8 +165,16 @@ var SEND_RATE_WINDOW_MS       = C.TIME.minutes(1);
 // Per-recipient broadcast outcomes recorded in email_campaign_sends.
 var SEND_OUTCOMES = ["sent", "failed", "skipped_unsubscribed", "skipped_suppressed"];
 
+// A link URL is rendered on one line and, in the plain-text part, is shown
+// to the recipient verbatim — so it is screened against the shared codepoint
+// policy rather than a local class. The class this replaced covered the
+// zero-width family but not the bidi overrides, which let a campaign body
+// carry a URL that displays as one host and resolves to another.
+var LINK_URL_POLICY = Object.freeze({ singleLine: "reject", zeroWidth: "reject" });
+
+// Free-form text folded into one ledger line. Stripped rather than refused —
+// this runs on an error path that must not itself fail.
 var CONTROL_BYTE_LINE_RE = /[\u0000-\u001f\u007f]/;
-var ZERO_WIDTH_RE        = /[\u200b-\u200f\u2028\u2029\ufeff]/;
 
 var STATUSES   = ["draft", "scheduled", "sending", "sent", "paused", "cancelled"];
 var EVENT_TYPES = ["delivered", "opened", "clicked", "bounced", "unsubscribed"];
@@ -190,7 +199,7 @@ function _esc(s) {
 
 function _mdSafeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_LINE_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, LINK_URL_POLICY)) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;
@@ -389,10 +398,13 @@ function _validateSubject(s) {
   if (s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("emailCampaigns: subject must be <= " + MAX_SUBJECT_LEN + " characters");
   }
-  if (/[\r\n\0]/.test(s)) {
-    throw new TypeError("emailCampaigns: subject must not contain CR / LF / NUL");
-  }
-  return s;
+  // A subject becomes a `Subject:` header, so a CR or LF in it is a header
+  // injection — the bytes after the break are read as another header. NUL goes
+  // with them: it truncates the field in some agents, which hides whatever
+  // follows. b.safeBuffer.assertHeaderSafe is the framework's check for a
+  // value destined for a `Name: value` field, and it refuses exactly that set.
+  return b.safeBuffer.assertHeaderSafe(
+    s, "subject", TypeError, "emailCampaigns: subject must not contain CR / LF / NUL");
 }
 
 function _validateBody(s, label) {
@@ -433,10 +445,9 @@ function _validateFromName(s) {
   if (s.length > MAX_FROM_NAME_LEN) {
     throw new TypeError("emailCampaigns: from_name must be <= " + MAX_FROM_NAME_LEN + " characters");
   }
-  if (/[\r\n\0]/.test(s)) {
-    throw new TypeError("emailCampaigns: from_name must not contain CR / LF / NUL");
-  }
-  return s;
+  // Lands in the `From:` header — same header-injection surface as the subject.
+  return b.safeBuffer.assertHeaderSafe(
+    s, "from_name", TypeError, "emailCampaigns: from_name must not contain CR / LF / NUL");
 }
 
 function _validateTs(ts, label) {
@@ -481,10 +492,10 @@ function _validateReason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("emailCampaigns: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (/[\r\n\0]/.test(s)) {
-    throw new TypeError("emailCampaigns: reason must not contain CR / LF / NUL");
-  }
-  return s;
+  // Operator-authored and surfaced in logs and the console rather than a mail
+  // header, but held to the same rule: a newline here forges a log line.
+  return b.safeBuffer.assertHeaderSafe(
+    s, "reason", TypeError, "emailCampaigns: reason must not contain CR / LF / NUL");
 }
 
 function _validateStatus(s, label) {

package/lib/email-warmup.js

@@ -93,6 +93,7 @@
 // ---- constants ----------------------------------------------------------
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -118,10 +119,6 @@ var IPV4_RE          = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4
 var IPV6_RE          = /^[0-9a-f:]+$/;
 var ISO_DATE_RE      = /^\d{4}-\d{2}-\d{2}$/;
 
-var CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_STATUSES = Object.freeze(["active", "paused", "archived"]);
 
@@ -234,9 +231,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("emailWarmup: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("emailWarmup: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "emailWarmup: reason", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/experiments.js

@@ -116,15 +116,10 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // title + hypothesis fields land into the operator dashboard, not the
 // storefront, but the discipline is the same — strings reach the
 // operator UI as inert text, never as live markup.
-var CONTROL_BYTE_LINE_RE  = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the promo-banners
 // + gift-options catalogues. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "title",
@@ -134,6 +129,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -149,10 +145,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("experiments: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("experiments: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("experiments: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -162,10 +158,10 @@ function _block(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("experiments: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("experiments: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("experiments: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -437,7 +433,7 @@ function create(opts) {
     if (typeof input.metric !== "string" || !input.metric.length || input.metric.length > MAX_METRIC_LEN) {
       return { recorded: false };
     }
-    if (CONTROL_BYTE_LINE_RE.test(input.metric) || ZERO_WIDTH_RE.test(input.metric)) {
+    if (textGuard.hasCodepointThreat(input.metric, { singleLine: "reject", zeroWidth: "reject" })) {
       return { recorded: false };
     }
     var value = 1;