@blamejs/blamejs-shop 0.5.20 → 0.5.21

package/lib/carrier-accounts.js

@@ -101,6 +101,7 @@ var STATUSES = Object.freeze(["active", "disabled", "rotating"]);
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var ROTATION_GRACE_MS = b.constants.TIME.days(1);
 
@@ -124,10 +125,6 @@ var MAX_KEY_LEN       = 512;
 // reason / operation string. These columns surface on operator
 // dashboards and inline into log lines — embedded control bytes are a
 // slipping-class for header injection + visual spoofing.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // account_number alphabet — operators occasionally space-pad or
 // hyphenate the printed form; we accept alnum + dash + space + dot and
@@ -233,9 +230,7 @@ function _label(s) {
   if (s.length === 0 || s.length > MAX_LABEL_LEN) {
     throw new TypeError("carrier-accounts: account_label must be 1.." + MAX_LABEL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("carrier-accounts: account_label contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "carrier-accounts: account_label", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -250,9 +245,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("carrier-accounts: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("carrier-accounts: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "carrier-accounts: reason", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/catalog-drafts.js

@@ -106,6 +106,7 @@ var MAX_CHANGES_PER_DRAFT = 5000;
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var ROLLBACK_WINDOW_MS = b.constants.TIME.days(7);
 
@@ -125,10 +126,6 @@ var PRODUCT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,198}[a-z0-9])?$/;
 // to operator-authored fields — refuse control bytes + zero-width /
 // direction-override codepoints so a rollback_reason / cancel_reason
 // can't smuggle UI-confusing glyphs into the audit dashboard.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 
 // ---- validators ---------------------------------------------------------
@@ -144,7 +141,7 @@ function _title(s, label) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("catalogDrafts: " + label + " must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("catalogDrafts: " + label + " must not contain control bytes");
   }
   return s;
@@ -155,9 +152,7 @@ function _description(s) {
   if (typeof s !== "string" || s.length > MAX_DESC_LEN) {
     throw new TypeError("catalogDrafts: description must be a string <= " + MAX_DESC_LEN + " chars when provided");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("catalogDrafts: description must not contain control bytes");
-  }
+  textGuard.freeText(s, "catalogDrafts: description");
   return s;
 }
 
@@ -169,7 +164,7 @@ function _optReason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("catalogDrafts: " + label + " must be <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("catalogDrafts: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -187,9 +182,7 @@ function _optOwner(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_OWNER_LEN) {
     throw new TypeError("catalogDrafts: owner_id must be a non-empty string <= " + MAX_OWNER_LEN + " chars when provided");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("catalogDrafts: owner_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "catalogDrafts: owner_id");
   return s;
 }
 

package/lib/category-navigation.js

@@ -111,13 +111,9 @@ var MAX_POPULAR_LIMIT      = 100;
 var MAX_REORDER_BATCH      = 500;
 
 var SLUG_RE                = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BODY_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -161,12 +157,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("categoryNavigation: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("categoryNavigation: title contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("categoryNavigation: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "categoryNavigation: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -178,12 +169,7 @@ function _description(s) {
   if (s.length > MAX_DESCRIPTION_LEN) {
     throw new TypeError("categoryNavigation: description must be <= " + MAX_DESCRIPTION_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s)) {
-    throw new TypeError("categoryNavigation: description contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("categoryNavigation: description contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "categoryNavigation: description", { zeroWidth: "reject" });
   return s;
 }
 
@@ -200,9 +186,7 @@ function _heroImageUrl(s) {
   if (s.length > MAX_HERO_URL_LEN) {
     throw new TypeError("categoryNavigation: hero_image_url must be <= " + MAX_HERO_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("categoryNavigation: hero_image_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "categoryNavigation: hero_image_url", { zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError("categoryNavigation: hero_image_url protocol-relative `//host/...` refused — use absolute https://");

package/lib/cms-blocks.js

@@ -116,16 +116,13 @@ var LOCALE_RE = /^[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/;
 
 // Refuse C0 control bytes + DEL in operator-authored bodies. LF / CR
 // / tab are allowed — operators author multi-line Markdown.
-var CONTROL_BYTE_BLOCK_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family. Spelled with \u-escapes
 // so ESLint's no-irregular-whitespace stays happy. Same defence as
 // the rest of the shop primitives.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -141,10 +138,10 @@ function _body(s, label) {
   if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
     throw new TypeError("cmsBlocks: " + label + " must be a non-empty string <= " + MAX_BODY_LEN + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("cmsBlocks: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("cmsBlocks: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -241,7 +238,7 @@ function _esc(s) {
 
 function _safeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_BLOCK_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, { zeroWidth: "reject" })) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;

package/lib/compliance-export.js

@@ -114,6 +114,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -177,10 +178,6 @@ var DEFAULT_LIST_LIMIT      = 50;
 // Operator-authored prose lands in reason / dismiss_reason and
 // replays into compliance review screens. Same control-byte +
 // zero-width refusal posture the sibling primitives carry.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Scope -> which injected readers contribute on export. Keeps the
 // fulfillRequest logic a single lookup instead of nested if-else.
@@ -256,9 +253,7 @@ function _requestedBy(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REQUESTED_BY_LEN) {
     throw new TypeError("complianceExport: requested_by must be a non-empty string <= " + MAX_REQUESTED_BY_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("complianceExport: requested_by must not contain control bytes or zero-width characters");
-  }
+  textGuard.freeText(s, "complianceExport: requested_by", { zeroWidth: "reject" });
   return s;
 }
 
@@ -266,7 +261,7 @@ function _prose(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("complianceExport: " + label + " must be a non-empty string <= " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("complianceExport: " + label + " must not contain control bytes or zero-width characters");
   }
   return s;
@@ -286,9 +281,7 @@ function _deliveryAddress(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_DELIVERY_ADDR_LEN) {
     throw new TypeError("complianceExport: delivery_address must be a non-empty string <= " + MAX_DELIVERY_ADDR_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("complianceExport: delivery_address must not contain control bytes or zero-width characters");
-  }
+  textGuard.freeText(s, "complianceExport: delivery_address", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/consent-ledger.js

@@ -123,7 +123,6 @@ var JURISDICTION_RE       = /^[A-Z]{2}$/;
 var EVIDENCE_REF_MAX_LEN  = 256;
 var EVIDENCE_REF_RE       = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var CSV_COLUMNS = Object.freeze([
   "id",
@@ -138,6 +137,7 @@ var CSV_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // The GDPR Art. 6(1) lawful bases, sourced from the framework's
 // consent primitive so this ledger's vocabulary tracks the
@@ -269,9 +269,7 @@ function _optEvidenceRef(s) {
       "consentLedger: evidence_ref must be <= " + EVIDENCE_REF_MAX_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("consentLedger: evidence_ref must not contain control bytes");
-  }
+  textGuard.freeText(s, "consentLedger: evidence_ref", { singleLine: "reject" });
   if (!EVIDENCE_REF_RE.test(s)) {
     throw new TypeError(
       "consentLedger: evidence_ref must match /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/"

package/lib/cost-layers.js

@@ -108,6 +108,16 @@ var b = require("./vendor/blamejs");
 
 var SKU_RE       = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var CURRENCY_RE  = /^[A-Z]{3}$/;
+
+// Carrier for the largest-remainder split of a line's COGS across the layers
+// it drew from (see consumeForSale). b.money.allocate distributes a count of
+// MINOR UNITS, so the currency is a type tag and not an input to the result —
+// the split of 10040 across 40/40/20 is 4016/4016/2008 whether the money is
+// 2-decimal, 0-decimal or this. It is deliberately NOT the layers' currency:
+// receipts accept any well-formed ISO 4217 code while b.money accepts a
+// narrower catalog, and pricing layers in one outside it would otherwise make
+// them receivable but never sellable.
+var ALLOCATION_CARRIER = "USD";
 var METHODS      = Object.freeze(["fifo", "lifo", "weighted_average"]);
 var RECEIPT_SOURCES = Object.freeze(["receipt", "transfer", "adjustment"]);
 // Internal source value used by `recordReversal` only; operators
@@ -453,11 +463,6 @@ function create(opts) {
         // don't accumulate a fractional debt.
         var lineNumerator = sumValue * quantity;
         var lineCogs = Math.floor(lineNumerator / sumQty);
-        // Residual carried forward to per-layer attribution rows so
-        // the sum of attributions matches lineCogs exactly. The first
-        // layer in the iteration absorbs the residual (smallest
-        // possible deviation, deterministic placement).
-        var residual = lineCogs;
         // Debit every layer proportionally. Use integer division so
         // each layer's debit is an integer; spread any leftover
         // single units across the earliest layers (deterministic).
@@ -491,20 +496,45 @@ function create(opts) {
             remainingToConsume -= 1;
           }
         }
-        // Per-attribution unit cost: weighted-average rounded to the
-        // nearest integer minor unit. Track the residual so the last
-        // attribution carries any rounding adjustment.
-        var avgUnitCost = sumQty > 0 ? Math.round(sumValue / sumQty) : 0;
+        // Split the line's COGS across the debits in proportion to the units
+        // each one contributes. b.money.allocate distributes by largest
+        // remainder: every row lands within a single minor unit of its exact
+        // share, and the parts sum to the total with nothing left over.
+        //
+        // What it replaces priced each debit at the weighted-average unit cost
+        // ROUNDED to an integer, then handed the last debit whatever remained.
+        // Rounding the average absorbed a fraction of a minor unit per unit
+        // debited, and every one of those fractions landed on the final row.
+        // Consuming 40 + 40 + 20 units at an average of 100.4 attributed
+        // 4000 / 4000 / 2040 where the true shares are 4016 / 4016 / 2008 — a
+        // 32-minor-unit misattribution from one sale, growing with the
+        // quantities ahead of the last debit. The line total was always right,
+        // so nothing was over- or under-charged; it was the per-layer COGS the
+        // margin and valuation reports read that was wrong.
+        //
+        // The split is carried out on a Money in ALLOCATION_CARRIER rather than
+        // in the layers' own currency, and the currency genuinely does not
+        // enter the arithmetic: allocate distributes a count of minor units by
+        // largest remainder, so the exponent never participates. The identical
+        // split for a 2-decimal, a 0-decimal and this carrier is asserted in
+        // cost-layers.test.js so the assumption cannot rot silently.
+        //
+        // Using the layers' own currency would read better and is what this
+        // wanted to do. It cannot: b.money accepts a deliberately narrow
+        // catalog of ISO 4217 codes, while recordReceipt accepts any
+        // well-formed one. Pricing layers in a code outside that catalog is
+        // accepted today, and passing it here would throw on every
+        // weighted-average sale — turning a rounding inaccuracy into inventory
+        // that can be received but never sold. Asked upstream for an
+        // integer-level allocation in blamejs/blamejs#578.
+        var attrShares = debits.length
+          ? b.money.fromMinorUnits(BigInt(lineCogs), ALLOCATION_CARRIER)
+              .allocate(debits.map(function (dd) { return dd.qty; }))
+              .map(function (m) { return Number(m.toMinorUnits()); })
+          : [];
         for (var e = 0; e < debits.length; e += 1) {
           var dRow = debits[e];
-          var attrCogs;
-          if (e === debits.length - 1) {
-            attrCogs = residual;
-          } else {
-            attrCogs = dRow.qty * avgUnitCost;
-            if (attrCogs > residual) attrCogs = residual;
-            residual -= attrCogs;
-          }
+          var attrCogs = attrShares[e];
           // Attribute the debit's cost so `qty * unit_cost_minor` summed over
           // its attribution rows reconstructs attrCogs EXACTLY — the COGS
           // reports (cogsForOrder / cogsForPeriod) recover each line's cost
@@ -515,10 +545,15 @@ function create(opts) {
           // (qty - r) units at floor, r units at floor+1, where
           // r = attrCogs - floor*qty. (qty-r)*floor + r*(floor+1) =
           // qty*floor + r = attrCogs — no penny drift between the sale's COGS
-          // and the persisted attributions (the prior single rounded per-unit
-          // drifted by up to qty-1 minor units on the residual-bearing row).
-          var floorUnit = dRow.qty > 0 ? Math.floor(attrCogs / dRow.qty) : avgUnitCost;
-          var rem       = dRow.qty > 0 ? attrCogs - (floorUnit * dRow.qty) : 0;
+          // and the persisted attributions (a single rounded per-unit price
+          // drifts by up to qty-1 minor units on the row that carries the
+          // remainder).
+          //
+          // A debit is only recorded when its share is at least one unit (see
+          // the push above), so the division below always has a positive
+          // divisor.
+          var floorUnit = Math.floor(attrCogs / dRow.qty);
+          var rem       = attrCogs - (floorUnit * dRow.qty);
           var parts = [];
           if (dRow.qty - rem > 0) parts.push({ qty: dRow.qty - rem, unit_cost_minor: floorUnit });
           if (rem > 0)            parts.push({ qty: rem,            unit_cost_minor: floorUnit + 1 });

package/lib/customer-import.js

@@ -50,13 +50,13 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var DEFAULT_MAX_ROWS     = 200000;
 var DEFAULT_MAX_ERRORS   = 1000;
 var SOURCES              = Object.freeze(["csv", "ndjson", "api"]);
 var ON_CONFLICT_MODES    = Object.freeze(["update", "skip", "error"]);
 var CSV_EXPECTED_HEADERS = Object.freeze(["email", "display_name"]);
-var CONTROL_BYTE_RE      = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 var MAX_DISPLAY_NAME_LEN = 128;
 
 // ---- factory ------------------------------------------------------------
@@ -143,7 +143,7 @@ function _normalizeRow(raw, rowIndex) {
   if (displayName.length > MAX_DISPLAY_NAME_LEN) {
     throw new TypeError("row " + rowIndex + ": display_name must be <= " + MAX_DISPLAY_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(displayName)) {
+  if (textGuard.hasCodepointThreat(displayName)) {
     throw new TypeError("row " + rowIndex + ": display_name contains control bytes");
   }
   // guardEmail strict profile — refuses smuggling / header-injection /

package/lib/customer-notes.js

@@ -46,6 +46,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -63,17 +64,9 @@ var MAX_LIMIT        = 200;
 var DEFAULT_TAG_LIMIT = 20;
 var MAX_TAG_FETCH    = 100;
 
-// Refuse C0 control bytes + DEL across the body, tags, and ids. CR/LF
-// + tab survive in `body` so operators can wrap a multi-line note;
-// tags + ids are single-line and refuse CR/LF too via the strict re.
-var CONTROL_BYTE_RE        = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-// Zero-width / direction-override / BOM family. Spelled with
-// \u-escapes so the source file stays free of irregular-whitespace
-// ESLint hits.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
+// Control bytes, bidi overrides and the zero-width family are screened by
+// textGuard.freeText. CR/LF + tab survive in `body` so an operator can wrap a
+// multi-line note; tags + ids are single-line and refuse them.
 
 // Tag shape — lowercase alnum + dash + underscore. The operator UI
 // canonicalises on input (lower-case) so the popularTags aggregate
@@ -110,9 +103,7 @@ function _customerId(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CUSTOMER_ID) {
     throw new TypeError("customerNotes: customer_id must be a non-empty string (<= " + MAX_CUSTOMER_ID + " chars)");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("customerNotes: customer_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerNotes: customer_id", { singleLine: "reject" });
   return s;
 }
 
@@ -128,9 +119,7 @@ function _authorId(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_AUTHOR_ID) {
     throw new TypeError("customerNotes: author_id must be a non-empty string (<= " + MAX_AUTHOR_ID + " chars) when provided");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("customerNotes: author_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerNotes: author_id", { singleLine: "reject" });
   return s;
 }
 
@@ -153,12 +142,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("customerNotes: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerNotes: body must not contain control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("customerNotes: body must not contain zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "customerNotes: body", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/customer-roles.js

@@ -119,7 +119,6 @@ var MAX_LIST_LIMIT = 200;
 // hyphen + underscore + dot, capped length.
 var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // Closed capability enum. Adding a new capability is a code change
 // here + the operator re-defines the affected roles.
@@ -137,6 +136,7 @@ var CAPABILITIES = Object.freeze([
 var ALLOWED_PATCH_COLUMNS = Object.freeze(["title", "capabilities"]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -152,9 +152,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("customerRoles: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerRoles: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerRoles: title", { singleLine: "reject" });
   return s;
 }
 
@@ -192,7 +190,7 @@ function _opaqueId(s, label) {
   if (typeof s !== "string" || !s.length || s.length > 200) {
     throw new TypeError("customerRoles: " + label + " must be a non-empty string (<= 200 chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("customerRoles: " + label + " must not contain control bytes");
   }
   return s;

package/lib/customer-segments.js

@@ -113,6 +113,7 @@ var C = b.constants;
 
 var DEFAULT_LIMIT = 100;
 var MAX_LIMIT     = 1000;
+var CSV_LINE_ENDING = "\r\n";   // RFC 4180
 var EXPORT_BATCH_SIZE = 500;
 
 // CSV column shape for a segment-members export. NO email column —
@@ -347,19 +348,22 @@ function _coerceCell(value) {
   return JSON.stringify(value);
 }
 
-function _neutralizeInjection(s) {
-  return b.guardCsv.escapeCell(s);
-}
-
-function _csvCell(value) {
-  var s = _neutralizeInjection(_coerceCell(value));
-  return '"' + s.replace(/"/g, '""') + '"';
-}
-
+// One member-export row, RFC 4180 — b.guardCsv.serialize writes the whole
+// line: the formula-injection prefix per cell, the unconditional quoting,
+// doubling an embedded quote, the delimiter and the CRLF. Only the injection
+// step was composed before; the quoting rules were written here and again in
+// order-export.js.
+//
+// serialize omits the trailing terminator, which suits a whole document and
+// not a generator yielding a row at a time, so the line ending is appended
+// here.
 function _csvRow(cells) {
-  var parts = [];
-  for (var i = 0; i < cells.length; i += 1) parts.push(_csvCell(cells[i]));
-  return parts.join(",") + "\r\n";
+  return b.guardCsv.serialize([cells.map(_coerceCell)], {
+    profile:     "strict",
+    alwaysQuote: true,
+    headers:     false,
+    lineEnding:  CSV_LINE_ENDING,
+  }) + CSV_LINE_ENDING;
 }
 
 // ---- factory ------------------------------------------------------------
@@ -975,6 +979,5 @@ module.exports = {
   MEMBER_EXPORT_COLUMNS:  MEMBER_EXPORT_COLUMNS,
   // Exposed for the test suite to assert CSV cell semantics without a
   // full DB round-trip.
-  _csvCell:               _csvCell,
-  _neutralizeInjection:   _neutralizeInjection,
+  _csvRow:                _csvRow,
 };

package/lib/customer-surveys.js

@@ -69,6 +69,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -104,8 +105,6 @@ var MAX_EXPIRES_HOURS        = 24 * 365;  // 1 year
 var DEFAULT_LIMIT            = 50;
 var MAX_LIMIT                = 500;
 
-var CONTROL_BYTE_RE          = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE   = /[\x00-\x1f\x7f]/;
 
 // NPS / CSAT / CES enforce a primary-question shape so the rollup
 // math has something well-defined to bucket against. Custom surveys
@@ -143,9 +142,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("customerSurveys: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerSurveys: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: title");
   return s;
 }
 
@@ -173,9 +170,7 @@ function _sourceEventId(s) {
   if (typeof s !== "string" || s.length > MAX_SOURCE_EVENT_LEN) {
     throw new TypeError("customerSurveys: source_event_id must be a string <= " + MAX_SOURCE_EVENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("customerSurveys: source_event_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: source_event_id", { singleLine: "reject" });
   return s;
 }
 
@@ -192,9 +187,7 @@ function _closeReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CLOSE_REASON_LEN) {
     throw new TypeError("customerSurveys: reason must be a non-empty string <= " + MAX_CLOSE_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerSurveys: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: reason");
   return s;
 }
 
@@ -245,7 +238,7 @@ function _questions(arr, kind) {
     if (typeof q.label !== "string" || !q.label.length || q.label.length > MAX_LABEL_LEN) {
       throw new TypeError("customerSurveys: questions[" + i + "].label must be a non-empty string <= " + MAX_LABEL_LEN + " chars");
     }
-    if (CONTROL_BYTE_RE.test(q.label)) {
+    if (textGuard.hasCodepointThreat(q.label)) {
       throw new TypeError("customerSurveys: questions[" + i + "].label must not contain control bytes");
     }
     var required = q.required == null ? true : q.required;
@@ -284,7 +277,7 @@ function _questions(arr, kind) {
           throw new TypeError("customerSurveys: questions[" + i + "].options[" + k +
                               "] must be a non-empty string <= " + MAX_OPTION_LEN + " chars");
         }
-        if (CONTROL_BYTE_RE.test(opt)) {
+        if (textGuard.hasCodepointThreat(opt)) {
           throw new TypeError("customerSurveys: questions[" + i + "].options[" + k +
                               "] must not contain control bytes");
         }
@@ -392,7 +385,7 @@ function _validateAnswers(answers, questions) {
         throw new TypeError("customerSurveys: answer for " + JSON.stringify(q.id) +
                             " must be <= " + q.max + " chars");
       }
-      if (CONTROL_BYTE_RE.test(a)) {
+      if (textGuard.hasCodepointThreat(a)) {
         throw new TypeError("customerSurveys: answer for " + JSON.stringify(q.id) +
                             " must not contain control bytes");
       }