@blamejs/blamejs-shop 0.5.21 → 0.5.23

package/lib/customer-impersonation.js

@@ -113,8 +113,14 @@
  *         → `{ notified: boolean, customer_notified_at: <ms> | null }`
  *     - `listForOperator(operator_id, { active_only? })`
  *         → array of session rows, newest-first.
- *     - `listForCustomer(customer_id)`
- *         → array of session rows, newest-first.
+ *     - `listForCustomer(customer_id, { limit?, offset? })`
+ *         → the customer's most recent sessions, newest-first. BOUNDED:
+ *           20 by default, 200 at most. The storefront renders this on
+ *           every account page load and the rows are never pruned, so an
+ *           unbounded read would make a customer's own dashboard slower
+ *           for the rest of the account's life. Nothing becomes unreadable:
+ *           `offset` walks the older pages, so a customer or a regulator
+ *           asking for the whole history can still get it.
  *     - `currentlyImpersonating()`
  *         → array of active session rows.
  *     - `cleanupExpired({ now? })`
@@ -138,6 +144,13 @@
 var TOKEN_NAMESPACE         = "customer-impersonation-token";
 var TOKEN_BYTES             = 32;
 var DEFAULT_TTL_SECONDS     = 60 * 60;                  // allow:raw-time-literal — seconds value; C.TIME returns ms (60-minute default)
+
+// How much of a customer's access history their own account page shows by
+// default, and the ceiling a caller may ask for. Bounded because the rows are
+// an audit trail that is never pruned: an unbounded read would make a
+// customer's dashboard slower every time support helped them.
+var DEFAULT_CUSTOMER_HISTORY = 20;
+var MAX_CUSTOMER_HISTORY     = 200;
 var MIN_TTL_SECONDS         = 60;                       // refuse sub-minute
 var MAX_TTL_SECONDS         = 8 * 60 * 60;              // allow:raw-time-literal — seconds value; C.TIME returns ms (hard ceiling — eight hours)
 var MAX_REASON_LEN          = 280;
@@ -165,6 +178,24 @@ function _uuid(s, label) {
   }
 }
 
+// The admin console has two kinds of operator identity: a staff account, whose
+// id is a v7 UUID, and the bootstrap / break-glass credential, whose id is the
+// reserved literal below. Both are real operators and both must be recordable
+// here — a store running the single-credential console (the common deploy) has
+// no UUID to offer, and refusing it would make the feature unreachable exactly
+// where the audit trail matters most.
+//
+// Only this one literal is admitted; anything else still has to be a UUID, so
+// the column cannot fill up with free-form operator labels. It matches the id
+// the rest of the console records against the same action, which keeps an
+// impersonation row joinable to its audit entries.
+var BOOTSTRAP_OPERATOR_ID = "owner";
+
+function _operatorId(s, label) {
+  if (s === BOOTSTRAP_OPERATOR_ID) return s;
+  return _uuid(s, label);
+}
+
 function _requiredString(s, label, maxLen) {
   if (typeof s !== "string") {
     throw new TypeError("customer-impersonation: " + label + " must be a string");
@@ -308,7 +339,7 @@ function create(opts) {
       if (!input || typeof input !== "object") {
         throw new TypeError("customer-impersonation.startImpersonation: input object required");
       }
-      var operatorId = _uuid(input.operator_id, "operator_id");
+      var operatorId = _operatorId(input.operator_id, "operator_id");
       var customerId = _uuid(input.customer_id, "customer_id");
       var reason     = _requiredString(input.reason, "reason", MAX_REASON_LEN);
       var ttl        = _ttlSeconds(input.ttl_seconds);
@@ -543,7 +574,7 @@ function create(opts) {
     // started, newest-first. `active_only: true` filters to live
     // sessions only.
     listForOperator: async function (operatorId, listOpts) {
-      var oid = _uuid(operatorId, "operator_id");
+      var oid = _operatorId(operatorId, "operator_id");
       listOpts = listOpts || {};
       if (typeof listOpts !== "object") {
         throw new TypeError("customer-impersonation.listForOperator: opts must be an object");
@@ -568,12 +599,33 @@ function create(opts) {
     // Returns every impersonation session ever opened against the
     // customer, newest-first. The customer-side "show me who's looked
     // at my account" page reads this directly.
-    listForCustomer: async function (customerId) {
+    // `limit` is bounded and defaulted because the storefront renders this on
+    // every /account load. These rows are an audit trail and are never
+    // deleted, so an unbounded read would grow the query cost and the page
+    // weight of a customer's own dashboard for the rest of the account's life
+    // — worst for exactly the customers support has helped most often.
+    listForCustomer: async function (customerId, listOpts) {
       var cid = _uuid(customerId, "customer_id");
+      var opts = listOpts || {};
+      var limit = opts.limit == null ? DEFAULT_CUSTOMER_HISTORY : opts.limit;
+      if (typeof limit !== "number" || !Number.isInteger(limit) || limit <= 0 ||
+          limit > MAX_CUSTOMER_HISTORY) {
+        throw new TypeError("customer-impersonation.listForCustomer: limit must be an integer in [1, " +
+          MAX_CUSTOMER_HISTORY + "]");
+      }
+      // Offset paging, so capping the page does not put older rows out of
+      // reach. These are audit records: a bounded default protects the
+      // account page from growing heavier with every support visit, but
+      // nothing may become unreadable — a customer or a regulator asking for
+      // the whole history has to be able to walk it.
+      var offset = opts.offset == null ? 0 : opts.offset;
+      if (typeof offset !== "number" || !Number.isInteger(offset) || offset < 0) {
+        throw new TypeError("customer-impersonation.listForCustomer: offset must be a non-negative integer");
+      }
       var r = await query(
         "SELECT * FROM impersonations WHERE customer_id = ?1 " +
-        "ORDER BY started_at DESC, id DESC",
-        [cid],
+        "ORDER BY started_at DESC, id DESC LIMIT ?2 OFFSET ?3",
+        [cid, limit, offset],
       );
       return r.rows.map(_projectRow);
     },
@@ -703,6 +755,52 @@ function create(opts) {
     // `endImpersonation` because the audit log distinguishes
     // operator-driven completion from operator-side termination.
     // Idempotent on already-terminal rows.
+    // ---- consumeToken -----------------------------------------------------
+    //
+    // Spend the handoff bearer WITHOUT ending the session.
+    //
+    // `startImpersonation` mints a single plaintext token and the operator
+    // follows it once, out of the console and into the storefront. Verifying
+    // it is a read, though, so until the token stops matching, that URL keeps
+    // working: it sits in browser history, in a chat message if it was pasted,
+    // in a proxy log — and anyone holding it can mint their own cookie for
+    // that customer for the rest of the hour. The handoff is meant to be
+    // one-time; this is what makes it so.
+    //
+    // Rotating the hash to a fresh random value is what spends it. The row's
+    // authority now lives entirely in the cookie the redemption sealed, which
+    // is bound to the operator's browser; the session stays `active` and
+    // `end` / `revoke` / the sweep are unaffected. Rotating (rather than
+    // nulling) also keeps the NOT NULL UNIQUE column honest.
+    //
+    // Takes the PLAINTEXT the caller was presented, and spends only that one.
+    //
+    // The match on the current hash is what makes this single-use under
+    // concurrency. Verification is a read, so two requests carrying the same
+    // link can both pass it before either writes; if the update only keyed on
+    // the row id they would both succeed and both mint a cookie, which is the
+    // guarantee this exists to provide, broken. Conditioning the write on the
+    // hash it verified means exactly one request can win — the second finds
+    // the hash already rotated and gets `consumed: false`.
+    //
+    // Deliberately NOT idempotent: a caller that cannot claim the token must
+    // not be handed a session.
+    consumeToken: async function (impersonationId, plaintext) {
+      var impId = _uuid(impersonationId, "impersonation_id");
+      if (typeof plaintext !== "string" || !plaintext.length) {
+        throw new TypeError("customer-impersonation.consumeToken: plaintext token required");
+      }
+      var presented = b.crypto.namespaceHash(TOKEN_NAMESPACE, plaintext);
+      var spent = b.crypto.namespaceHash(
+        TOKEN_NAMESPACE, "spent:" + impId + ":" + b.crypto.toBase64Url(b.crypto.generateBytes(32)));
+      var r = await query(
+        "UPDATE impersonations SET token_hash = ?1 " +
+        "WHERE id = ?2 AND status = 'active' AND token_hash = ?3",
+        [spent, impId, presented],
+      );
+      return { consumed: r.rowCount === 1 };
+    },
+
     revoke: async function (input) {
       if (!input || typeof input !== "object") {
         throw new TypeError("customer-impersonation.revoke: input object required");

package/lib/customer-notes.js

@@ -142,7 +142,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("customerNotes: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "customerNotes: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "customerNotes: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/customer-roles.js

@@ -152,7 +152,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("customerRoles: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "customerRoles: title", { singleLine: "reject" });
+  textGuard.freeText(s, "customerRoles: title", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/customer-surveys.js

@@ -142,7 +142,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("customerSurveys: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "customerSurveys: title");
+  textGuard.freeText(s, "customerSurveys: title", { bidiMarks: "allow" });
   return s;
 }
 
@@ -187,7 +187,7 @@ function _closeReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CLOSE_REASON_LEN) {
     throw new TypeError("customerSurveys: reason must be a non-empty string <= " + MAX_CLOSE_REASON_LEN + " chars");
   }
-  textGuard.freeText(s, "customerSurveys: reason");
+  textGuard.freeText(s, "customerSurveys: reason", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/customers.js

@@ -105,7 +105,7 @@ function _displayName(s) {
   if (s.length > MAX_DISPLAY_NAME_LEN) {
     throw new TypeError("customers: display_name must be <= " + MAX_DISPLAY_NAME_LEN + " characters");
   }
-  textGuard.freeText(s, "customers: display_name", { singleLine: "reject" });
+  textGuard.freeText(s, "customers: display_name", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/dispute-resolution.js

@@ -249,7 +249,7 @@ function _narrative(s) {
       " exceeds cap " + MAX_NARRATIVE_LEN
     );
   }
-  textGuard.freeText(s, "disputeResolution: narrative");
+  textGuard.freeText(s, "disputeResolution: narrative", { bidiMarks: "allow" });
   return s;
 }
 
@@ -277,7 +277,7 @@ function _notesOpt(s) {
       "disputeResolution: notes length " + s.length + " exceeds cap " + MAX_NOTES_LEN
     );
   }
-  textGuard.freeText(s, "disputeResolution: notes");
+  textGuard.freeText(s, "disputeResolution: notes", { bidiMarks: "allow" });
   return s;
 }
 
@@ -301,7 +301,7 @@ function _writeoffReason(s) {
       " exceeds cap " + MAX_WRITEOFF_REASON_LEN
     );
   }
-  textGuard.freeText(s, "disputeResolution: writeoff reason");
+  textGuard.freeText(s, "disputeResolution: writeoff reason", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/dropship-forwarding.js

@@ -183,7 +183,7 @@ function _returnPolicy(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RETURN_POLICY_LEN) {
     throw new TypeError("dropship-forwarding: return_policy must be a non-empty string <= " + MAX_RETURN_POLICY_LEN + " chars");
   }
-  textGuard.freeText(s, "dropship-forwarding: return_policy", { singleLine: "reject" });
+  textGuard.freeText(s, "dropship-forwarding: return_policy", { singleLine: "reject", bidiMarks: "allow" });
 }
 function _positiveInt(n, label) {
   if (!Number.isInteger(n) || n <= 0) {

package/lib/dunning.js

@@ -202,7 +202,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("dunning: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "dunning: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "dunning: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/email-ab-tests.js

@@ -165,7 +165,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("emailABTests: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "emailABTests: title");
+  textGuard.freeText(s, "emailABTests: title", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/email-campaigns.js

@@ -170,12 +170,25 @@ var SEND_OUTCOMES = ["sent", "failed", "skipped_unsubscribed", "skipped_suppress
 // policy rather than a local class. The class this replaced covered the
 // zero-width family but not the bidi overrides, which let a campaign body
 // carry a URL that displays as one host and resolves to another.
-var LINK_URL_POLICY = Object.freeze({ singleLine: "reject", zeroWidth: "reject" });
+// `bidiMarks` too: prose legitimately carries a direction mark (an Arabic
+// street name, a Hebrew review) and the shared screen permits them by default,
+// but a URL is machine-plain — a mark inside one is only ever there to make the
+// host read as something it is not.
+var LINK_URL_POLICY = Object.freeze({
+  singleLine: "reject",
+  zeroWidth:  "reject",
+  bidiMarks:  "reject",
+});
 
 // Free-form text folded into one ledger line. Stripped rather than refused —
 // this runs on an error path that must not itself fail.
 var CONTROL_BYTE_LINE_RE = /[\u0000-\u001f\u007f]/;
 
+// Global twin, derived so the class is written once. `.replace` with an
+// unglobbed regex rewrites only the FIRST match, and a mailer's error message
+// can carry several control bytes — the rest would reach the stored ledger row.
+var CONTROL_BYTE_LINE_RE_G = new RegExp(CONTROL_BYTE_LINE_RE.source, "g");
+
 var STATUSES   = ["draft", "scheduled", "sending", "sent", "paused", "cancelled"];
 var EVENT_TYPES = ["delivered", "opened", "clicked", "bounced", "unsubscribed"];
 var TERMINAL   = ["sent", "cancelled"];
@@ -982,7 +995,7 @@ function create(opts) {
           // strip control bytes (no CRLF / NUL into the stored row) and
           // cap length. The recipient address is never echoed into the
           // reason — only the mailer's own message.
-          var reason = String(sendErr && sendErr.message || sendErr).replace(CONTROL_BYTE_LINE_RE, " ").slice(0, 280);
+          var reason = String(sendErr && sendErr.message || sendErr).replace(CONTROL_BYTE_LINE_RE_G, " ").slice(0, 280);
           await _finalizeSend(row.slug, consentHash || emailHash, "failed", reason);
           continue;
         }

package/lib/email-warmup.js

@@ -231,7 +231,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("emailWarmup: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "emailWarmup: reason", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "emailWarmup: reason", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/externaldb-d1.js

@@ -181,14 +181,6 @@ function _isTransient(err) {
   return c === "ECONNRESET" || c === "ETIMEDOUT" || c === "ENOTFOUND" || c === "EAI_AGAIN" || c === "UND_ERR_SOCKET";
 }
 
-function _backoff(attempt) {
-  // Jittered exponential — 200ms, 400ms, ... with ±25% jitter so
-  // retries from many container replicas don't synchronize.
-  var base = RETRY_BACKOFF_MS * Math.pow(2, attempt);
-  var jitter = base * (0.75 + (b.crypto.randomInt(0, 50) / 100));
-  return new Promise(function (r) { setTimeout(r, jitter); });
-}
-
 function _httpErr(status, label) {
   var e = new Error("externaldbD1: " + label + " failed with HTTP " + status);
   e.code = "D1_HTTP_" + status;

package/lib/gift-options.js

@@ -103,7 +103,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("giftOptions: title must be a non-empty string ≤ " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "giftOptions: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "giftOptions: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -154,7 +154,7 @@ function _giftMessage(s) {
   if (s.length > MAX_MESSAGE_LEN) {
     throw new TypeError("giftOptions: gift_message must be ≤ " + MAX_MESSAGE_LEN + " chars");
   }
-  textGuard.freeText(s, "giftOptions: gift_message", { zeroWidth: "reject" });
+  textGuard.freeText(s, "giftOptions: gift_message", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -166,7 +166,7 @@ function _recipientName(s) {
   if (s.length > MAX_RECIPIENT_LEN) {
     throw new TypeError("giftOptions: recipient_name must be ≤ " + MAX_RECIPIENT_LEN + " chars");
   }
-  textGuard.freeText(s, "giftOptions: recipient_name", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "giftOptions: recipient_name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/knowledge-base.js

@@ -159,7 +159,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("knowledgeBase: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "knowledgeBase: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "knowledgeBase: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -177,7 +177,7 @@ function _body(s) {
   if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("knowledgeBase: body contains control bytes");
   }
-  textGuard.freeText(s, "knowledgeBase: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "knowledgeBase: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -271,7 +271,7 @@ function _queryStr(s) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError("knowledgeBase: query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  textGuard.freeText(s, "knowledgeBase: query", { zeroWidth: "reject" });
+  textGuard.freeText(s, "knowledgeBase: query", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/line-gift-wrap.js

@@ -151,7 +151,10 @@ function _giftMessage(s) {
   if (s.length > MAX_MESSAGE_LEN) {
     throw new TypeError("lineGiftWrap: gift_message must be ≤ " + MAX_MESSAGE_LEN + " chars");
   }
-  textGuard.freeText(s, "lineGiftWrap: gift_message", { zeroWidth: "reject" });
+  // Prose a customer writes for another person to read — a message in Arabic
+  // or Hebrew carries a direction mark wherever a Latin word or number sits
+  // inside the line. The overrides that reverse a run stay refused.
+  textGuard.freeText(s, "lineGiftWrap: gift_message", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -163,7 +166,8 @@ function _recipientName(s) {
   if (s.length > MAX_RECIPIENT_LEN) {
     throw new TypeError("lineGiftWrap: recipient_name must be ≤ " + MAX_RECIPIENT_LEN + " chars");
   }
-  textGuard.freeText(s, "lineGiftWrap: recipient_name", { singleLine: "reject", zeroWidth: "reject" });
+  // A person's name, in whatever script they write it.
+  textGuard.freeText(s, "lineGiftWrap: recipient_name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/live-chat.js

@@ -130,7 +130,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("live-chat: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "live-chat: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "live-chat: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/notifications.js

@@ -99,7 +99,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("notifications: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "notifications: title");
+  textGuard.freeText(s, "notifications: title", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/operator-accounts.js

@@ -212,7 +212,7 @@ function _displayName(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_DISPLAY_NAME_LEN) {
     throw new TypeError("operatorAccounts: display_name must be a non-empty string (<= " + MAX_DISPLAY_NAME_LEN + " chars)");
   }
-  textGuard.freeText(s, "operatorAccounts: display_name", { singleLine: "reject" });
+  textGuard.freeText(s, "operatorAccounts: display_name", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/operator-help-center.js

@@ -164,7 +164,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorHelpCenter: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "operatorHelpCenter: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "operatorHelpCenter: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -179,7 +179,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorHelpCenter: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "operatorHelpCenter: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "operatorHelpCenter: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -290,7 +290,7 @@ function _queryStr(s) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError("operatorHelpCenter: query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  textGuard.freeText(s, "operatorHelpCenter: query", { zeroWidth: "reject" });
+  textGuard.freeText(s, "operatorHelpCenter: query", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/operator-inbox.js

@@ -248,7 +248,7 @@ function _subject(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("operatorInbox: subject must be a non-empty string <= " + MAX_SUBJECT_LEN + " chars");
   }
-  textGuard.freeText(s, "operatorInbox: subject");
+  textGuard.freeText(s, "operatorInbox: subject", { bidiMarks: "allow" });
   return s;
 }
 
@@ -256,7 +256,7 @@ function _body(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorInbox: body must be a non-empty string <= " + MAX_BODY_LEN + " chars");
   }
-  textGuard.freeText(s, "operatorInbox: body");
+  textGuard.freeText(s, "operatorInbox: body", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/operator-roles.js

@@ -185,7 +185,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorRoles: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "operatorRoles: title", { singleLine: "reject" });
+  textGuard.freeText(s, "operatorRoles: title", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/order-notes.js

@@ -95,7 +95,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("orderNotes: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "orderNotes: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "orderNotes: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -131,7 +131,7 @@ function _resolution(s) {
   if (s.length > MAX_RESOLUTION_LEN) {
     throw new TypeError("orderNotes: resolution must be <= " + MAX_RESOLUTION_LEN + " characters");
   }
-  textGuard.freeText(s, "orderNotes: resolution", { zeroWidth: "reject" });
+  textGuard.freeText(s, "orderNotes: resolution", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/order-ratings.js

@@ -130,7 +130,7 @@ function _comment(s) {
   if (s.length > MAX_COMMENT_LEN) {
     throw new TypeError("orderRatings: comment must be <= " + MAX_COMMENT_LEN + " chars");
   }
-  textGuard.freeText(s, "orderRatings: comment");
+  textGuard.freeText(s, "orderRatings: comment", { bidiMarks: "allow" });
   return s;
 }
 
@@ -138,7 +138,7 @@ function _flagReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_FLAG_REASON_LEN) {
     throw new TypeError("orderRatings: reason must be a non-empty string <= " + MAX_FLAG_REASON_LEN + " chars");
   }
-  textGuard.freeText(s, "orderRatings: reason");
+  textGuard.freeText(s, "orderRatings: reason", { bidiMarks: "allow" });
   return s;
 }
 
@@ -146,7 +146,7 @@ function _responseText(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RESPONSE_LEN) {
     throw new TypeError("orderRatings: response must be a non-empty string <= " + MAX_RESPONSE_LEN + " chars");
   }
-  textGuard.freeText(s, "orderRatings: response");
+  textGuard.freeText(s, "orderRatings: response", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/payment-methods.js

@@ -140,7 +140,7 @@ function _label(s) {
   if (s.length > MAX_LABEL_LEN) {
     throw new TypeError("paymentMethods: label must be <= " + MAX_LABEL_LEN + " characters");
   }
-  textGuard.freeText(s, "paymentMethods: label", { singleLine: "reject" });
+  textGuard.freeText(s, "paymentMethods: label", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/payment-retries.js

@@ -229,7 +229,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("paymentRetries: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "paymentRetries: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "paymentRetries: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/pixel-events.js

@@ -403,12 +403,20 @@ function _responseBody(s) {
   if (s.length > MAX_RESPONSE_BODY_LEN) {
     throw new TypeError("pixelEvents: response_body must be <= " + MAX_RESPONSE_BODY_LEN + " characters");
   }
-  // Response bodies from upstream providers are operator-observed
-  // already (the dispatch hook captured them); allow the full ASCII
-  // range minus the zero-width / bidi block so a malicious provider
-  // can't smuggle invisible bytes through the audit trail.
-  textGuard.freeText(s, "pixelEvents: response_body", { zeroWidth: "reject" });
-  return s;
+  // SCRUBBED, never refused. This string is whatever an upstream provider sent
+  // back, and `markDispatched` runs this validator BEFORE it transitions the
+  // event — so any refusal here leaves the row in `queued` and the scheduler
+  // re-sends the identical pixel on every tick, forever, because we disliked a
+  // byte in the reply. A provider must never be able to hold an event open by
+  // choosing its response body.
+  //
+  // The interest in this field is only that an operator reading the audit
+  // trail is not shown invisible characters. Removing them satisfies that
+  // without ever failing: the bidi overrides, the direction marks, the
+  // zero-width family and the Unicode Tags block all come out, and everything
+  // legible — including the tabs and newlines a real response is full of —
+  // stays exactly as the provider sent it.
+  return textGuard.scrubInvisible(s);
 }
 
 function _responseStatus(n) {

package/lib/plan-changes.js

@@ -115,7 +115,7 @@ function _optReason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("planChanges: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "planChanges: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "planChanges: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/product-qa.js

@@ -131,7 +131,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("productQA: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "productQA: reason");
+  textGuard.freeText(s, "productQA: reason", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/push-notifications.js

@@ -195,7 +195,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("pushNotifications: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "pushNotifications: title", { zeroWidth: "reject" });
+  textGuard.freeText(s, "pushNotifications: title", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -206,7 +206,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("pushNotifications: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "pushNotifications: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "pushNotifications: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }