@ai-matrx/records 0.76.12 → 0.76.13

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog — @ai-matrx/records
 
+## 0.76.13
+
+- `exportCsv` writes through THE one writer, `@ai-matrx/kit/delimited` (AP-2): formula-looking text gets a leading `'` (OWASP CSV injection); it had no formula guard before. Same header row, quoting and order.
+
+**Consumer action:** none.
+
 ## 0.76.11
 
 Automatic changed-only republish (docs/metadata drift since the last tag — see

package/dist/core/index.cjs

@@ -9820,6 +9820,9 @@ function predictWriteRefusals(args) {
   return found;
 }
 
+// src/core/io.ts
+var import_delimited = require("@ai-matrx/kit/delimited");
+
 // src/core/wholeValue.ts
 var import_format = require("@ai-matrx/kit/format");
 var WHOLE_VALUE_SOURCE_KIND = "whole_value_in_file";
@@ -9872,7 +9875,6 @@ async function withWholeValues(rows2, read) {
 }
 
 // src/core/io.ts
-var escape = (value) => /[",\n\r]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
 function cellText(value) {
   if (!value) return "";
   if (value.absent_reason) return `(${value.absent_reason})`;
@@ -9894,11 +9896,7 @@ function headerFor(field) {
   return field.label && field.label.length > 0 ? field.label : field.key;
 }
 function exportCsv(fields, rows2) {
-  const lines = [fields.map((f) => escape(headerFor(f))).join(",")];
-  for (const row of rows2) {
-    lines.push(fields.map((f) => escape(exportCellText2(f, row[f.key]))).join(","));
-  }
-  return lines.join("\n");
+  return (0, import_delimited.toDelimited)(toAoa(fields, rows2));
 }
 function toAoa(fields, rows2) {
   return [fields.map(headerFor), ...rows2.map((row) => fields.map((f) => exportCellText2(f, row[f.key])))];