@oxyhq/core 10.0.0 → 10.1.0

package/dist/types/index.d.ts

@@ -75,6 +75,7 @@ export type { PaginationParams, ApiResponse, ErrorResponse, } from './utils/apiU
 export { ErrorCodes, createApiError, handleHttpError, validateRequiredFields, } from './utils/errorUtils';
 export { retryAsync } from './utils/asyncUtils';
 export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization';
 export { logger, LogLevel, logAuth, logApi, logSession, logUser, logDevice, logPayment, logPerformance, } from './utils/loggerUtils';
 export type { LogContext } from './utils/loggerUtils';
 export { updateAvatarVisibility } from './utils/avatarUtils';

package/dist/types/models/interfaces.d.ts

@@ -93,6 +93,12 @@ export interface User {
      */
     name: UserNameResponse;
     bio?: string;
+    /**
+     * Longer public profile text. Emitted alongside `bio` by every user DTO the
+     * API produces (single profile, `getUsersByIds`, follower/following/mutual
+     * lists, profile search) — the two are separate fields on the User document.
+     */
+    description?: string;
     phone?: string;
     address?: string;
     birthday?: string;

package/dist/types/utils/textNormalization.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Canonical text normalization for the Oxy ecosystem.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Third-party text (federated actor display names, spoiler/CW text, image alt
+ * text, bios, `<title>` / `og:site_name` of scraped remote pages, …) arrives
+ * with the whitespace the remote author's markup happened to contain. A real
+ * bug: a remote page served
+ *
+ *     <title>
+ *       Mi título
+ *     </title>
+ *
+ * and the extracted string — newlines and indentation included — was stored
+ * verbatim. Clients render text with React Native Web `Text`, which maps to
+ * CSS `white-space: pre-wrap`: unlike HTML, newlines and repeated spaces are
+ * NOT collapsed at render time, so the user saw a blank line and a six-space
+ * indent inside the link preview.
+ *
+ * Storage-time normalization is therefore the ONLY place this can be fixed:
+ * every renderer downstream is faithful by design.
+ *
+ * WHICH HELPER DO I USE?
+ * ----------------------
+ *  - {@link normalizeInlineText} — the value is conceptually ONE LINE, and a
+ *    line break in it is always an accident of the source markup: page titles,
+ *    `siteName`, display names, image `alt`, handles, profile field labels.
+ *    Every line break becomes a space.
+ *
+ *  - {@link normalizeMultilineText} — the value is a BODY whose line breaks are
+ *    the author's own paragraphs and must survive: post text, bios/summaries.
+ *    Line breaks are preserved (capped at one blank line); only the surrounding
+ *    whitespace noise is cleaned.
+ *
+ * Using the multiline helper on a title would keep the newlines and reproduce
+ * the original bug; using the inline helper on a post body would flatten the
+ * author's paragraphs into a single run-on line. Pick deliberately.
+ *
+ * Neither helper truncates, strips markup, or enforces a character policy —
+ * those are separate, product-specific concerns (see `isValidDisplayName` for
+ * the display-name character policy). These functions do exactly one thing:
+ * normalize whitespace and Unicode form.
+ */
+/**
+ * Normalize a SINGLE-LINE text value: page/link-preview titles, `siteName`,
+ * display names, image alt text, handles, profile field labels.
+ *
+ * A line break in such a value is never meaningful — it is an artifact of the
+ * markup the value was extracted from (`<title>\n  Título\n</title>`) — and it
+ * survives into the UI because RN Web renders `Text` with `white-space:
+ * pre-wrap`. So ALL whitespace, line breaks included, collapses to one space.
+ *
+ *   1. NFC-normalize, so visually identical strings store and compare
+ *      identically (a decomposed `e`+◌́ recomposes into `é`).
+ *   2. Collapse every run of whitespace — spaces, tabs, `\n`, `\r`, and Unicode
+ *      spaces such as NBSP — to a single plain space.
+ *   3. Trim both ends.
+ *
+ * Length is NOT capped: a maximum length is a product rule of the specific
+ * field (see `MAX_DISPLAY_NAME_LENGTH`), not a property of text normalization.
+ * Markup is NOT stripped: run the caller's sanitizer first if the source can
+ * contain HTML.
+ *
+ * A value that is empty or whitespace-only returns `''`. Callers decide whether
+ * that means "omit the field" (`|| undefined`) or "store an empty string".
+ *
+ * Idempotent: `f(f(x)) === f(x)`.
+ */
+export declare function normalizeInlineText(value: string): string;
+/**
+ * Normalize a MULTILINE text BODY: post text, bios, summaries — anywhere the
+ * line breaks are the author's paragraphs and must be preserved.
+ *
+ * Cleans the whitespace noise around those paragraphs without destroying them:
+ *
+ *   1. NFC-normalize (same rationale as {@link normalizeInlineText}).
+ *   2. Unify every line-break form (CRLF, lone CR, U+2028, U+2029) to `\n`.
+ *   3. Collapse runs of HORIZONTAL whitespace (spaces, tabs, NBSP and friends)
+ *      to a single space. Line breaks are untouched.
+ *   4. Strip the horizontal whitespace at the END of each line.
+ *   5. Collapse three or more line breaks to exactly one blank line (`\n\n`).
+ *   6. Trim both ends.
+ *
+ * STEP 4 MUST PRECEDE STEP 5 — this is the whole point of the function. A
+ * "blank" line that actually contains spaces (`"a\n   \n   \nb"`) breaks the
+ * run of `\n` characters, so a bare `\n{3,}` collapse (step 5 alone) never sees
+ * it and the extra blank lines survive into the UI. That is exactly the bug in
+ * federated post bodies. Removing the trailing horizontal whitespace first
+ * turns those lines into real, empty lines, which step 5 then collapses.
+ *
+ * A single space at the START of a line is preserved: only RUNS of horizontal
+ * whitespace collapse, and an indent is not trailing whitespace, so a one-space
+ * indent is treated as the author's and left alone.
+ *
+ * A value that is empty or whitespace-only returns `''`.
+ *
+ * Idempotent: `f(f(x)) === f(x)`.
+ */
+export declare function normalizeMultilineText(value: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -94,8 +94,8 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "^0.14.0",
-    "@oxyhq/protocol": "^0.1.5",
+    "@oxyhq/contracts": "workspace:^",
+    "@oxyhq/protocol": "workspace:^",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",
     "elliptic": "^6.6.1",

package/src/index.ts

@@ -466,6 +466,14 @@ export {
     validateAndSanitizeUserInput,
 } from './utils/validationUtils';
 
+// ---------------------------------------------------------------------------
+// Text normalization
+// ---------------------------------------------------------------------------
+export {
+    normalizeInlineText,
+    normalizeMultilineText,
+} from './utils/textNormalization';
+
 // ---------------------------------------------------------------------------
 // Logging
 // ---------------------------------------------------------------------------

package/src/models/interfaces.ts

@@ -103,6 +103,12 @@ export interface User {
    */
   name: UserNameResponse;
   bio?: string;
+  /**
+   * Longer public profile text. Emitted alongside `bio` by every user DTO the
+   * API produces (single profile, `getUsersByIds`, follower/following/mutual
+   * lists, profile search) — the two are separate fields on the User document.
+   */
+  description?: string;
   phone?: string;
   address?: string;
   birthday?: string;

package/src/utils/__tests__/textNormalization.test.ts

@@ -0,0 +1,196 @@
+import { normalizeInlineText, normalizeMultilineText } from '../textNormalization';
+
+/**
+ * Whitespace characters are built from their code points rather than pasted as
+ * literals: an NBSP or a U+2028 in the source would be invisible to a reviewer
+ * and trivially "fixed" by an editor, silently gutting the test it anchors.
+ */
+const NBSP = String.fromCharCode(0x00a0); // no-break space
+const EN_QUAD = String.fromCharCode(0x2000); // U+2000 space block
+const IDEOGRAPHIC_SPACE = String.fromCharCode(0x3000); // CJK full-width space
+const NARROW_NBSP = String.fromCharCode(0x202f);
+const ZWNBSP = String.fromCharCode(0xfeff); // BOM when leading
+const LINE_SEPARATOR = String.fromCharCode(0x2028);
+const PARAGRAPH_SEPARATOR = String.fromCharCode(0x2029);
+
+/** "é" as a base letter plus a combining acute accent (NFD form). */
+const DECOMPOSED_E_ACUTE = `e${String.fromCharCode(0x0301)}`;
+/** The precomposed "é" (NFC form) the two above must normalize into. */
+const COMPOSED_E_ACUTE = String.fromCharCode(0x00e9);
+
+describe('normalizeInlineText', () => {
+  it('flattens the indented multi-line <title> that caused the original bug', () => {
+    expect(normalizeInlineText('\n      Mi título\n    ')).toBe('Mi título');
+  });
+
+  it('collapses every whitespace form to a single space', () => {
+    expect(normalizeInlineText('a\tb\nc\r\nd  e')).toBe('a b c d e');
+  });
+
+  it('collapses Unicode spaces (NBSP, U+2000 block, ideographic, narrow NBSP)', () => {
+    expect(
+      normalizeInlineText(`a${NBSP}b${EN_QUAD}c${IDEOGRAPHIC_SPACE}d${NARROW_NBSP}e`)
+    ).toBe('a b c d e');
+  });
+
+  it('collapses the Unicode line and paragraph separators', () => {
+    expect(normalizeInlineText(`a${LINE_SEPARATOR}b${PARAGRAPH_SEPARATOR}c`)).toBe('a b c');
+  });
+
+  it('strips a leading BOM / zero-width no-break space', () => {
+    expect(normalizeInlineText(`${ZWNBSP}Título`)).toBe('Título');
+  });
+
+  it('handles CRLF line endings', () => {
+    expect(normalizeInlineText('News\r\n\r\nToday')).toBe('News Today');
+  });
+
+  it('returns an empty string for empty and whitespace-only input', () => {
+    expect(normalizeInlineText('')).toBe('');
+    expect(normalizeInlineText('   ')).toBe('');
+    expect(normalizeInlineText(`\n\t ${NBSP}\r\n`)).toBe('');
+  });
+
+  it('NFC-normalizes so decomposed accents are stored composed', () => {
+    const normalized = normalizeInlineText(`Ren${DECOMPOSED_E_ACUTE}e`);
+    expect(normalized).toBe(`Ren${COMPOSED_E_ACUTE}e`);
+    expect(normalized).toHaveLength(5);
+  });
+
+  it('leaves already-clean text untouched', () => {
+    expect(normalizeInlineText('Hacker News')).toBe('Hacker News');
+    expect(normalizeInlineText('Título en español — con guion')).toBe(
+      'Título en español — con guion'
+    );
+  });
+
+  it('does not truncate long values (length caps are a product rule)', () => {
+    const long = 'a'.repeat(500);
+    expect(normalizeInlineText(long)).toHaveLength(500);
+  });
+
+  it('does not strip markup or punctuation (that is the sanitizer\'s job)', () => {
+    expect(normalizeInlineText('  <b>Bold</b> & "quoted"  ')).toBe('<b>Bold</b> & "quoted"');
+  });
+
+  it('is idempotent', () => {
+    const inputs = [
+      '\n      Mi título\n    ',
+      `a${NBSP}${NBSP}b`,
+      'Hacker News',
+      '',
+      '   ',
+      `Ren${DECOMPOSED_E_ACUTE}e`,
+    ];
+    for (const input of inputs) {
+      const once = normalizeInlineText(input);
+      expect(normalizeInlineText(once)).toBe(once);
+    }
+  });
+});
+
+describe('normalizeMultilineText', () => {
+  it('preserves the author\'s paragraphs', () => {
+    const body = 'First paragraph.\n\nSecond paragraph.\nSame paragraph, next line.';
+    expect(normalizeMultilineText(body)).toBe(body);
+  });
+
+  it('collapses a blank line that contains spaces — the ordering bug', () => {
+    // The "blank" lines hold spaces, so they break the run of \n characters: a
+    // bare /\n{3,}/ collapse never sees them. Trailing horizontal whitespace
+    // must be stripped FIRST.
+    expect(normalizeMultilineText('a\n    \n    \nb')).toBe('a\n\nb');
+  });
+
+  it('collapses a blank line that contains tabs and NBSP', () => {
+    expect(normalizeMultilineText(`a\n\t\n${NBSP}${NBSP}\nb`)).toBe('a\n\nb');
+  });
+
+  it('strips trailing horizontal whitespace from every line', () => {
+    expect(normalizeMultilineText('one   \ntwo\t\nthree ')).toBe('one\ntwo\nthree');
+  });
+
+  it('collapses three or more newlines to a single blank line', () => {
+    expect(normalizeMultilineText('a\n\n\n\n\nb')).toBe('a\n\nb');
+  });
+
+  it('keeps exactly one blank line as-is', () => {
+    expect(normalizeMultilineText('a\n\nb')).toBe('a\n\nb');
+  });
+
+  it('collapses runs of horizontal whitespace to one space, keeping newlines', () => {
+    expect(normalizeMultilineText('hello    world\nsecond\t\tline')).toBe(
+      'hello world\nsecond line'
+    );
+  });
+
+  it('preserves a single-space indent (it is the author\'s, not markup noise)', () => {
+    expect(normalizeMultilineText('a\n b')).toBe('a\n b');
+  });
+
+  it('normalizes CRLF and lone CR to \\n', () => {
+    expect(normalizeMultilineText('a\r\nb\rc')).toBe('a\nb\nc');
+    expect(normalizeMultilineText('a\r\n\r\n\r\n\r\nb')).toBe('a\n\nb');
+  });
+
+  it('normalizes the Unicode line and paragraph separators to \\n', () => {
+    expect(normalizeMultilineText(`a${LINE_SEPARATOR}b${PARAGRAPH_SEPARATOR}c`)).toBe('a\nb\nc');
+  });
+
+  it('collapses Unicode spaces without touching line structure', () => {
+    expect(normalizeMultilineText(`a${NBSP}${NBSP}b\nc${IDEOGRAPHIC_SPACE}d`)).toBe('a b\nc d');
+  });
+
+  it('trims both ends, including leading and trailing blank lines', () => {
+    expect(normalizeMultilineText('\n\n  Hello\n\nWorld  \n\n  ')).toBe('Hello\n\nWorld');
+  });
+
+  it('returns an empty string for empty and whitespace-only input', () => {
+    expect(normalizeMultilineText('')).toBe('');
+    expect(normalizeMultilineText('   ')).toBe('');
+    expect(normalizeMultilineText(`\n\n \t${NBSP}\r\n  \n`)).toBe('');
+  });
+
+  it('NFC-normalizes so decomposed accents are stored composed', () => {
+    expect(normalizeMultilineText(`Caf${DECOMPOSED_E_ACUTE}\n\nabierto`)).toBe(
+      `Caf${COMPOSED_E_ACUTE}\n\nabierto`
+    );
+  });
+
+  it('leaves an already-clean body untouched', () => {
+    const body = 'Line one\nLine two\n\nNew paragraph.';
+    expect(normalizeMultilineText(body)).toBe(body);
+  });
+
+  it('cleans a realistic federated post body without losing its paragraphs', () => {
+    const federated = '  Hola a todos.\r\n   \r\n\r\nEsto  es  una   prueba.\t\r\nFin.   ';
+    expect(normalizeMultilineText(federated)).toBe(
+      'Hola a todos.\n\nEsto es una prueba.\nFin.'
+    );
+  });
+
+  it('is idempotent', () => {
+    const inputs = [
+      'a\n    \n    \nb',
+      'a\r\n\r\n\r\nb',
+      'First paragraph.\n\nSecond paragraph.',
+      `a${NBSP}b`,
+      'a\n b',
+      '',
+      '   ',
+      `Caf${DECOMPOSED_E_ACUTE}`,
+    ];
+    for (const input of inputs) {
+      const once = normalizeMultilineText(input);
+      expect(normalizeMultilineText(once)).toBe(once);
+    }
+  });
+});
+
+describe('choosing between the two helpers', () => {
+  it('inline flattens what multiline preserves', () => {
+    const body = 'Title\n\nSubtitle';
+    expect(normalizeInlineText(body)).toBe('Title Subtitle');
+    expect(normalizeMultilineText(body)).toBe('Title\n\nSubtitle');
+  });
+});

package/src/utils/textNormalization.ts

@@ -0,0 +1,173 @@
+/**
+ * Canonical text normalization for the Oxy ecosystem.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Third-party text (federated actor display names, spoiler/CW text, image alt
+ * text, bios, `<title>` / `og:site_name` of scraped remote pages, …) arrives
+ * with the whitespace the remote author's markup happened to contain. A real
+ * bug: a remote page served
+ *
+ *     <title>
+ *       Mi título
+ *     </title>
+ *
+ * and the extracted string — newlines and indentation included — was stored
+ * verbatim. Clients render text with React Native Web `Text`, which maps to
+ * CSS `white-space: pre-wrap`: unlike HTML, newlines and repeated spaces are
+ * NOT collapsed at render time, so the user saw a blank line and a six-space
+ * indent inside the link preview.
+ *
+ * Storage-time normalization is therefore the ONLY place this can be fixed:
+ * every renderer downstream is faithful by design.
+ *
+ * WHICH HELPER DO I USE?
+ * ----------------------
+ *  - {@link normalizeInlineText} — the value is conceptually ONE LINE, and a
+ *    line break in it is always an accident of the source markup: page titles,
+ *    `siteName`, display names, image `alt`, handles, profile field labels.
+ *    Every line break becomes a space.
+ *
+ *  - {@link normalizeMultilineText} — the value is a BODY whose line breaks are
+ *    the author's own paragraphs and must survive: post text, bios/summaries.
+ *    Line breaks are preserved (capped at one blank line); only the surrounding
+ *    whitespace noise is cleaned.
+ *
+ * Using the multiline helper on a title would keep the newlines and reproduce
+ * the original bug; using the inline helper on a post body would flatten the
+ * author's paragraphs into a single run-on line. Pick deliberately.
+ *
+ * Neither helper truncates, strips markup, or enforces a character policy —
+ * those are separate, product-specific concerns (see `isValidDisplayName` for
+ * the display-name character policy). These functions do exactly one thing:
+ * normalize whitespace and Unicode form.
+ */
+
+/**
+ * Characters that make a value ineligible for the zero-work fast path, and the
+ * whitespace shapes that a normalized INLINE value can never contain.
+ *
+ * A value that matches nothing here is, by construction, already normalized:
+ * it holds only printable ASCII (which is NFC-stable, so `normalize('NFC')`
+ * would be a no-op), its only whitespace is the plain space, it has no leading
+ * or trailing space, and no run of two spaces. Returning it untouched skips
+ * three string allocations — worth it because the common case in the feed
+ * hydration hot path is text that is already clean.
+ *
+ * Non-global (safe for repeated `.test()`; a global regex is stateful).
+ */
+const INLINE_NEEDS_NORMALIZATION = /[^\x20-\x7E]|^ | $| {2}/;
+
+/**
+ * Same idea as {@link INLINE_NEEDS_NORMALIZATION}, for MULTILINE values: `\n`
+ * joins the printable-ASCII fast-path alphabet, and the additional shapes a
+ * normalized body can never contain are a space before a line break (trailing
+ * horizontal whitespace) and a run of three line breaks (more than one blank
+ * line). A single space AFTER a line break is legal — a one-space indent is
+ * the author's, and normalization deliberately preserves it.
+ */
+const MULTILINE_NEEDS_NORMALIZATION = /[^\x20-\x7E\n]|^[ \n]|[ \n]$| {2}| \n|\n{3}/;
+
+/** Any run of whitespace, including tabs, line breaks and Unicode spaces. */
+const ANY_WHITESPACE_RUN = /\s+/g;
+
+/**
+ * Every line-break form, unified to `\n` before the multiline passes run:
+ * CRLF (Windows), a lone CR (classic Mac / stray `\r`), and the Unicode LINE
+ * SEPARATOR (U+2028) / PARAGRAPH SEPARATOR (U+2029), which are mandatory breaks
+ * in Unicode and a well-known hazard in JSON/JS payloads. CRLF must be matched
+ * before the lone `\r` alternative or it would yield two breaks. The separators
+ * are matched by Unicode property (`\p{Zl}` = U+2028, `\p{Zp}` = U+2029) rather
+ * than as literals: a literal U+2028/U+2029 is a LineTerminator and cannot appear
+ * inside a regex literal at all.
+ */
+const LINE_BREAK_FORMS = /\r\n|\r|\p{Zl}|\p{Zp}/gu;
+
+/**
+ * A run of HORIZONTAL whitespace: any whitespace that is not a line break.
+ * `[^\S\n]` is "whitespace, minus `\n`" — it covers the tab, the vertical tab,
+ * the form feed and every Unicode space separator (NBSP U+00A0, the U+2000
+ * block, the ideographic space U+3000, the zero-width no-break space U+FEFF).
+ * Applied AFTER {@link LINE_BREAK_FORMS}, so no line break can hide in it.
+ */
+const HORIZONTAL_WHITESPACE_RUN = /[^\S\n]+/g;
+
+/** Horizontal whitespace at the end of a line — the blank-line spoiler. */
+const TRAILING_HORIZONTAL_WHITESPACE = / +\n/g;
+
+/** Three or more line breaks: more than one blank line between paragraphs. */
+const EXCESS_BLANK_LINES = /\n{3,}/g;
+
+/**
+ * Normalize a SINGLE-LINE text value: page/link-preview titles, `siteName`,
+ * display names, image alt text, handles, profile field labels.
+ *
+ * A line break in such a value is never meaningful — it is an artifact of the
+ * markup the value was extracted from (`<title>\n  Título\n</title>`) — and it
+ * survives into the UI because RN Web renders `Text` with `white-space:
+ * pre-wrap`. So ALL whitespace, line breaks included, collapses to one space.
+ *
+ *   1. NFC-normalize, so visually identical strings store and compare
+ *      identically (a decomposed `e`+◌́ recomposes into `é`).
+ *   2. Collapse every run of whitespace — spaces, tabs, `\n`, `\r`, and Unicode
+ *      spaces such as NBSP — to a single plain space.
+ *   3. Trim both ends.
+ *
+ * Length is NOT capped: a maximum length is a product rule of the specific
+ * field (see `MAX_DISPLAY_NAME_LENGTH`), not a property of text normalization.
+ * Markup is NOT stripped: run the caller's sanitizer first if the source can
+ * contain HTML.
+ *
+ * A value that is empty or whitespace-only returns `''`. Callers decide whether
+ * that means "omit the field" (`|| undefined`) or "store an empty string".
+ *
+ * Idempotent: `f(f(x)) === f(x)`.
+ */
+export function normalizeInlineText(value: string): string {
+  if (!INLINE_NEEDS_NORMALIZATION.test(value)) {
+    return value;
+  }
+  return value.normalize('NFC').replace(ANY_WHITESPACE_RUN, ' ').trim();
+}
+
+/**
+ * Normalize a MULTILINE text BODY: post text, bios, summaries — anywhere the
+ * line breaks are the author's paragraphs and must be preserved.
+ *
+ * Cleans the whitespace noise around those paragraphs without destroying them:
+ *
+ *   1. NFC-normalize (same rationale as {@link normalizeInlineText}).
+ *   2. Unify every line-break form (CRLF, lone CR, U+2028, U+2029) to `\n`.
+ *   3. Collapse runs of HORIZONTAL whitespace (spaces, tabs, NBSP and friends)
+ *      to a single space. Line breaks are untouched.
+ *   4. Strip the horizontal whitespace at the END of each line.
+ *   5. Collapse three or more line breaks to exactly one blank line (`\n\n`).
+ *   6. Trim both ends.
+ *
+ * STEP 4 MUST PRECEDE STEP 5 — this is the whole point of the function. A
+ * "blank" line that actually contains spaces (`"a\n   \n   \nb"`) breaks the
+ * run of `\n` characters, so a bare `\n{3,}` collapse (step 5 alone) never sees
+ * it and the extra blank lines survive into the UI. That is exactly the bug in
+ * federated post bodies. Removing the trailing horizontal whitespace first
+ * turns those lines into real, empty lines, which step 5 then collapses.
+ *
+ * A single space at the START of a line is preserved: only RUNS of horizontal
+ * whitespace collapse, and an indent is not trailing whitespace, so a one-space
+ * indent is treated as the author's and left alone.
+ *
+ * A value that is empty or whitespace-only returns `''`.
+ *
+ * Idempotent: `f(f(x)) === f(x)`.
+ */
+export function normalizeMultilineText(value: string): string {
+  if (!MULTILINE_NEEDS_NORMALIZATION.test(value)) {
+    return value;
+  }
+  return value
+    .normalize('NFC')
+    .replace(LINE_BREAK_FORMS, '\n')
+    .replace(HORIZONTAL_WHITESPACE_RUN, ' ')
+    .replace(TRAILING_HORIZONTAL_WHITESPACE, '\n')
+    .replace(EXCESS_BLANK_LINES, '\n\n')
+    .trim();
+}