@aglyn/tenant-data-admin 1.0.0-beta.261 → 1.0.0-beta.263

package/src/lib/server/weekly-summary.js

@@ -0,0 +1,568 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { buildRoute, Route } from "@aglyn/aglyn/app-utils/console-routes";
+import { writeCronBeat } from "@aglyn/aglyn/app-utils/health-report";
+import { DIGEST_PREFS_FIELD, digestEnabled, INSIGHT_DIGESTS_FIELD, insightDigestSubscribed } from "@aglyn/aglyn/app-utils/notifications";
+import { liveCustomDomain, TENANT_APEX } from "@aglyn/aglyn/app-utils/host-naming";
+import { hostRoleFor } from "@aglyn/aglyn/app-utils/organizations";
+import { checkEntitlement, resolveBrandingProfile, resolveEffectivePlan } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { platformConsoleOrigin } from "@aglyn/aglyn/app-utils/platform-brand";
+import { isReleaseFlagOnForOrg, parseOrgReleaseFlagOverrides } from "@aglyn/aglyn/app-utils/release-flags";
+import { composeWeeklySummaryOverviewEmail, composeWeeklySummarySiteEmail, WEEKLY_SUMMARY_DAYS, WEEKLY_SUMMARY_DIGEST_KEY, weeklySummaryHasNews, weeklySummaryPeriod } from "@aglyn/aglyn/app-utils/weekly-summary";
+import { normalizePluginFigureTable, pluginFigureSummarySection } from "@aglyn/aglyn/plugin-manager/plugin-figures";
+import { emailAccent, PLATFORM_EMAIL_PALETTE, rateLimitedRetryAtMs, resolveEmailColor, sendEmail } from "@aglyn/shared-util-email";
+import { withoutMailWithheldAccounts } from "./account-mail.js";
+import { findUserByUidAcrossPools } from "./auth-pools.js";
+import { isCronAuthorized, isCronDryRun } from "./cron-auth.js";
+import { meterPlatformEmail } from "./email-metering.js";
+import { filterSuppressedEmails } from "./email-suppression.js";
+import { eligibleFigureReaders } from "./figure-readers.js";
+import firebaseAdmin from "./firebase-admin.js";
+import { listOrgMembers } from "./organizations.js";
+import { getServerReleaseFlagValues } from "./release-flags.js";
+import { loadSystemEmail, renderLoadedSystemEmail, systemEmailBrand, systemEmailContent, systemEmailTheme } from "./render-system-email.js";
+/** The beat `/api/health/crons` reads, once this job joins its inventory. */ export const WEEKLY_SUMMARY_JOB_ID = 'weekly-summary';
+/** `orgs/{orgId}/weeklySummaries/{week}` — server-written, matched by no rule. */ export const WEEKLY_SUMMARY_MARKERS = 'weeklySummaries';
+/** The marker key of the overview; a site's email is keyed by the site's id. */ export const WEEKLY_SUMMARY_OVERVIEW = 'overview';
+/** The system emails: the overview, and one site's. */ export const WEEKLY_SUMMARY_TEMPLATE = 'weekly-summary';
+export const WEEKLY_SUMMARY_SITE_TEMPLATE = 'weekly-summary-site';
+/** Workspaces per invocation; a chunk that times out never advances its cursor. */ export const WEEKLY_SUMMARY_ORG_CHUNK = 20;
+/** Sites a workspace's sweep ranks, by document id. */ export const WEEKLY_SUMMARY_HOST_READ_LIMIT = 50;
+/** Sites a week's summary reports on: the busiest by last week's page views. */ export const WEEKLY_SUMMARY_MAX_SITES = 5;
+/** Members per workspace whose address is chased through the auth pools when their member document has none. */ export const WEEKLY_SUMMARY_MAX_UID_LOOKUPS = 5;
+/** How long one call works before it stops and leaves the rest to the next. */ export const WEEKLY_SUMMARY_RUN_BUDGET_MS = 45000;
+/** The theme tokens each color of the layout is drawn from. */ const COLOR_TOKENS = {
+    text: 'text.primary',
+    muted: 'text.secondary',
+    border: 'divider',
+    surface: 'grey.50',
+    accent: 'primary.main',
+    link: 'primary.main',
+    up: 'success.dark',
+    down: 'error.dark'
+};
+const str = (value)=>typeof value === 'string' ? value.trim() : '';
+function siteName(data, id) {
+    return str(data['displayName']) || str(data['name']) || str(data['subdomain']) || id;
+}
+/** Last week's page views for each site, read from the daily analytics documents. */ async function weekViews(firestore, hosts, days) {
+    const views = new Map();
+    if (!hosts.length) return views;
+    const refs = hosts.flatMap((host)=>days.map((day)=>host.ref.collection('analytics').doc(day)));
+    const docs = await firestore.getAll(...refs);
+    for (const doc of docs){
+        var _ref, _views_get, _doc_get;
+        var _doc_ref_parent_parent;
+        const hostId = (_ref = (_doc_ref_parent_parent = doc.ref.parent.parent) == null ? void 0 : _doc_ref_parent_parent.id) != null ? _ref : '';
+        views.set(hostId, ((_views_get = views.get(hostId)) != null ? _views_get : 0) + (Number((_doc_get = doc.get('total')) != null ? _doc_get : 0) || 0));
+    }
+    return views;
+}
+function weekDays(from) {
+    const start = Date.parse(`${from}T00:00:00Z`);
+    return Array.from({
+        length: WEEKLY_SUMMARY_DAYS
+    }, (_, index)=>new Date(start + index * 86400000).toISOString().slice(0, 10));
+}
+/**
+ * Each reader's part, in its declared order: read over the week, then
+ * summarized by its owner. A reader that fails, answers no table, has nothing
+ * to say or cannot be read over seven days is left out.
+ */ async function readParts(readers, base) {
+    const ordered = readers.filter(({ reader })=>reader.weeklySummary).sort((a, b)=>{
+        var _ref, _ref1;
+        var _a_reader_weeklySummary, _b_reader_weeklySummary;
+        return ((_ref = (_a_reader_weeklySummary = a.reader.weeklySummary) == null ? void 0 : _a_reader_weeklySummary.order) != null ? _ref : 0) - ((_ref1 = (_b_reader_weeklySummary = b.reader.weeklySummary) == null ? void 0 : _b_reader_weeklySummary.order) != null ? _ref1 : 0) || a.reader.id.localeCompare(b.reader.id);
+    });
+    const parts = [];
+    for (const { reader } of ordered){
+        const summary = reader.weeklySummary;
+        if (!summary) continue;
+        const days = reader.windows.length ? reader.windows.includes(WEEKLY_SUMMARY_DAYS) ? WEEKLY_SUMMARY_DAYS : null : 0;
+        if (days === null) continue;
+        try {
+            var _part_stats, _part_rows;
+            const read = await reader.read(_extends({}, base, {
+                days,
+                uid: null,
+                params: {}
+            }));
+            if (read.ok === false) continue;
+            const table = normalizePluginFigureTable(read.table);
+            if (!table) continue;
+            const part = summary.summarize(table);
+            if (part && (((_part_stats = part.stats) == null ? void 0 : _part_stats.length) || ((_part_rows = part.rows) == null ? void 0 : _part_rows.length))) parts.push(part);
+        } catch (error) {
+            console.error('[weekly-summary] reader failed', {
+                reader: reader.id,
+                orgId: base.orgId,
+                error
+            });
+        }
+    }
+    return parts;
+}
+/** The emails one person is owed this week, by marker key, in the order they are sent. */ function emailsFor(member, manager, sites, workspace) {
+    const active = sites.filter(({ site })=>weeklySummaryHasNews(site));
+    if (!manager) {
+        return active.filter(({ hostId })=>hostRoleFor(member, hostId) === 'admin').map(({ hostId })=>({
+                key: hostId,
+                hostId,
+                withWorkspace: false
+            }));
+    }
+    // One active site: its email carries the workspace's figures, and an
+    // overview would only say it again.
+    if (active.length === 1) {
+        return [
+            {
+                key: active[0].hostId,
+                hostId: active[0].hostId,
+                withWorkspace: true
+            }
+        ];
+    }
+    return [
+        ...active.length || workspace.length ? [
+            {
+                key: WEEKLY_SUMMARY_OVERVIEW,
+                hostId: null,
+                withWorkspace: false
+            }
+        ] : [],
+        ...active.map(({ hostId })=>({
+                key: hostId,
+                hostId,
+                withWorkspace: false
+            }))
+    ];
+}
+async function summarizeOrg(deps, orgDoc, period, overBudget) {
+    var _orgDoc_data, _get, _sites_find;
+    const { firestore } = deps;
+    const orgId = orgDoc.id;
+    const org = (_orgDoc_data = orgDoc.data()) != null ? _orgDoc_data : {};
+    const report = {
+        sites: 0,
+        recipients: 0,
+        sent: 0
+    };
+    const markerRef = orgDoc.ref.collection(WEEKLY_SUMMARY_MARKERS).doc(period.week);
+    const sentAlready = (_get = (await markerRef.get()).get('sent')) != null ? _get : {};
+    // Who could be told: owners and admins, and each site's own admins. Not
+    // suspended, an account that may be mailed, the switch kept on.
+    const members = (await deps.orgMembers(orgId)).filter((member)=>member.orgSuspended !== true);
+    const isManager = (member)=>member.role === 'owner' || member.role === 'admin';
+    const candidates = members.filter((member)=>{
+        var _member_hostAccess;
+        return isManager(member) || Object.values((_member_hostAccess = member.hostAccess) != null ? _member_hostAccess : {}).includes('admin');
+    });
+    const reachable = new Set(await deps.reachable(candidates.map((member)=>member.$id)));
+    const reached = candidates.filter((member)=>reachable.has(member.$id)).sort((a, b)=>a.$id.localeCompare(b.$id));
+    if (!reached.length) return _extends({}, report, {
+        skipped: candidates.length ? 'nobody-reachable' : 'no-managers'
+    });
+    const userDocs = await firestore.getAll(...reached.map((member)=>firestore.collection('users').doc(member.$id)));
+    const users = new Map(userDocs.map((doc)=>[
+            doc.id,
+            doc
+        ]));
+    const recipients = reached.filter((member)=>{
+        var _users_get;
+        return digestEnabled((_users_get = users.get(member.$id)) == null ? void 0 : _users_get.get(DIGEST_PREFS_FIELD), WEEKLY_SUMMARY_DIGEST_KEY);
+    });
+    report.recipients = recipients.length;
+    if (!recipients.length) return _extends({}, report, {
+        skipped: 'summary-off'
+    });
+    // The busiest sites by last week's page views, ties by id.
+    const hostPage = await firestore.collection('hosts').where('orgId', '==', orgId).orderBy(firebaseAdmin.firestore.FieldPath.documentId()).limit(WEEKLY_SUMMARY_HOST_READ_LIMIT).get();
+    const hosts = hostPage.docs.filter((doc)=>!doc.get('deletedAt'));
+    const views = await weekViews(firestore, hosts, weekDays(period.from));
+    const chosen = [
+        ...hosts
+    ].sort((a, b)=>{
+        var _views_get, _views_get1;
+        return ((_views_get = views.get(b.id)) != null ? _views_get : 0) - ((_views_get1 = views.get(a.id)) != null ? _views_get1 : 0) || a.id.localeCompare(b.id);
+    }).slice(0, WEEKLY_SUMMARY_MAX_SITES);
+    const orgSlug = str(org['slug']);
+    const sites = [];
+    for (const host of chosen){
+        var _host_data, _liveCustomDomain;
+        const data = (_host_data = host.data()) != null ? _host_data : {};
+        const readers = (await deps.readers({
+            orgId,
+            hostId: host.id,
+            org,
+            host: data
+        })).filter(({ reader })=>pluginFigureSummarySection(reader) === 'site');
+        const parts = await readParts(readers, {
+            orgId,
+            hostId: host.id,
+            now: period.now
+        });
+        const subdomain = str(data['subdomain']);
+        const domain = (_liveCustomDomain = liveCustomDomain(data)) != null ? _liveCustomDomain : subdomain ? `${subdomain}.${TENANT_APEX}` : '';
+        sites.push({
+            hostId: host.id,
+            subdomain,
+            site: {
+                name: siteName(data, host.id),
+                address: domain ? {
+                    label: domain,
+                    url: `https://${domain}`
+                } : null,
+                url: deps.origin && orgSlug && subdomain ? `${deps.origin}${buildRoute(Route.HOST_DASHBOARD, {
+                    orgSlug,
+                    host: subdomain
+                })}` : null,
+                parts
+            }
+        });
+    }
+    const orgReaders = await deps.readers({
+        orgId,
+        hostId: null,
+        org,
+        host: null
+    });
+    const workspace = await readParts(orgReaders.filter(({ reader })=>pluginFigureSummarySection(reader) === 'workspace'), {
+        orgId,
+        hostId: null,
+        now: period.now
+    });
+    report.sites = sites.filter(({ site })=>weeklySummaryHasNews(site)).length;
+    if (!report.sites && !workspace.length) return _extends({}, report, {
+        skipped: 'nothing-to-report'
+    });
+    const branding = resolveBrandingProfile(org);
+    const workspaceName = str(org['name']) || orgSlug || 'your workspace';
+    const settingsUrl = `${deps.origin}${buildRoute(Route.MANAGE_NOTIFICATION_SETTINGS)}`;
+    const colors = deps.colors(org);
+    // AI weekly insights, pointed to only where the plan includes them and they are released.
+    const offersInsights = checkEntitlement(org, 'aiGenerative') && deps.flagOn('release_ai_generative', orgId, org);
+    const analyticsUrl = (subdomain)=>offersInsights && deps.origin && orgSlug && subdomain ? `${deps.origin}${buildRoute(Route.HOST_ANALYTICS, {
+            orgSlug,
+            host: subdomain
+        })}` : null;
+    const common = {
+        workspaceName,
+        productName: branding.productName,
+        periodLabel: period.label,
+        colors,
+        settingsUrl
+    };
+    const lookups = {
+        left: WEEKLY_SUMMARY_MAX_UID_LOOKUPS
+    };
+    const busiest = (_sites_find = sites.find(({ site })=>weeklySummaryHasNews(site))) != null ? _sites_find : sites[0];
+    for (const member of recipients){
+        var _users_get;
+        const owed = emailsFor(member, isManager(member), sites, workspace).filter(({ key })=>{
+            var _sentAlready_member_$id;
+            return !((_sentAlready_member_$id = sentAlready[member.$id]) == null ? void 0 : _sentAlready_member_$id[key]);
+        });
+        if (!owed.length) continue;
+        const subscribed = insightDigestSubscribed((_users_get = users.get(member.$id)) == null ? void 0 : _users_get.get(INSIGHT_DIGESTS_FIELD), orgId);
+        const to = deps.dryRun ? '' : await deps.address(member, lookups);
+        if (!deps.dryRun && !to) continue;
+        for (const { key, hostId, withWorkspace } of owed){
+            var _ref, _ref1;
+            if (overBudget()) return _extends({}, report, {
+                deferred: 'time'
+            });
+            const entry = hostId ? sites.find((site)=>site.hostId === hostId) : null;
+            const aiInsightsUrl = subscribed ? null : analyticsUrl((_ref = (_ref1 = entry == null ? void 0 : entry.subdomain) != null ? _ref1 : busiest == null ? void 0 : busiest.subdomain) != null ? _ref : '');
+            const email = entry ? composeWeeklySummarySiteEmail(_extends({}, common, {
+                aiInsightsUrl,
+                site: entry.site
+            }, withWorkspace ? {
+                workspace
+            } : {})) : composeWeeklySummaryOverviewEmail(_extends({}, common, {
+                aiInsightsUrl,
+                sites: sites.map(({ site })=>site),
+                workspace,
+                url: deps.origin && orgSlug ? `${deps.origin}${buildRoute(Route.ORG_HOME, {
+                    orgSlug
+                })}` : ''
+            }));
+            if (!email) continue;
+            if (deps.dryRun) {
+                report.sent += 1;
+                continue;
+            }
+            const result = await deps.send({
+                to: to,
+                template: entry ? WEEKLY_SUMMARY_SITE_TEMPLATE : WEEKLY_SUMMARY_TEMPLATE,
+                email,
+                org,
+                merge: {
+                    'summary.subject': email.subject,
+                    'summary.title': email.title,
+                    'summary.period': email.period,
+                    'summary.html': email.html,
+                    'summary.buttonLabel': email.buttonLabel,
+                    'summary.url': email.url,
+                    'org.name': workspaceName,
+                    settingsUrl
+                }
+            });
+            if (result.sent) {
+                report.sent += 1;
+                await markerRef.set({
+                    week: period.week,
+                    sent: {
+                        [member.$id]: {
+                            [key]: true
+                        }
+                    },
+                    updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+                }, {
+                    merge: true
+                });
+            } else if (result.rateLimited) {
+                return _extends({}, report, {
+                    deferred: 'rate'
+                });
+            } else {
+                var _report_failed;
+                report.failed = ((_report_failed = report.failed) != null ? _report_failed : 0) + 1;
+            }
+        }
+    }
+    return report;
+}
+/** One chunk of the sweep: workspaces in id order after `cursor`. */ export async function runWeeklySummarySweep(deps, options = {}) {
+    var _deps_budgetMs, _options_limit;
+    const { firestore } = deps;
+    const startedAt = Date.now();
+    const budget = (_deps_budgetMs = deps.budgetMs) != null ? _deps_budgetMs : WEEKLY_SUMMARY_RUN_BUDGET_MS;
+    const overBudget = ()=>Date.now() - startedAt > budget;
+    const period = weeklySummaryPeriod(deps.runAt);
+    const pageSize = Math.max(1, Math.min(Math.floor((_options_limit = options.limit) != null ? _options_limit : WEEKLY_SUMMARY_ORG_CHUNK), WEEKLY_SUMMARY_ORG_CHUNK));
+    let query = firestore.collection('orgs').orderBy(firebaseAdmin.firestore.FieldPath.documentId()).limit(pageSize + 1);
+    if (options.cursor) query = query.startAfter(firestore.collection('orgs').doc(options.cursor));
+    const page = await query.get();
+    const hasMore = page.docs.length > pageSize;
+    const orgDocs = hasMore ? page.docs.slice(0, pageSize) : page.docs;
+    const report = {
+        week: period.week,
+        dryRun: deps.dryRun,
+        swept: 0,
+        sent: 0,
+        orgs: {},
+        deferred: false,
+        nextCursor: null,
+        done: true
+    };
+    let last = null;
+    for (const orgDoc of orgDocs){
+        if (overBudget()) {
+            report.deferred = 'time';
+            break;
+        }
+        try {
+            const orgReport = await summarizeOrg(deps, orgDoc, period, overBudget);
+            report.orgs[orgDoc.id] = orgReport;
+            report.sent += orgReport.sent;
+            if (orgReport.deferred) {
+                report.deferred = orgReport.deferred;
+                break;
+            }
+        } catch (error) {
+            console.error('[weekly-summary] workspace failed', orgDoc.id, error);
+            report.orgs[orgDoc.id] = {
+                skipped: 'failed',
+                sites: 0,
+                recipients: 0,
+                sent: 0
+            };
+        }
+        report.swept += 1;
+        last = orgDoc.id;
+    }
+    /*
+   * Out of time: the next call starts after the last workspace that finished,
+   * and the marker skips whoever the unfinished one already reached. Refused
+   * by the send rate: the window is full, so the run stops (`done: true`)
+   * rather than re-POSTing into it; a re-run in the same week reaches the rest.
+   */ if (report.deferred === 'time') {
+        var _ref;
+        report.nextCursor = (_ref = last != null ? last : options.cursor) != null ? _ref : null;
+        report.done = false;
+    } else if (report.deferred === 'rate') {
+        report.done = true;
+    } else {
+        report.nextCursor = hasMore ? last : null;
+        report.done = report.nextCursor === null;
+    }
+    return report;
+}
+/** The sweep's reach into the real platform: Firestore, the flags, the roster, the mail. */ /** The sweep's reach into the real platform: Firestore, the flags, the roster, the mail. */ export async function weeklySummaryDeps(options) {
+    const firestore = firebaseAdmin.app().firestore();
+    const flags = await getServerReleaseFlagValues();
+    // Each designed email is read once per call and rendered per recipient.
+    const loaded = new Map();
+    return {
+        firestore,
+        runAt: options.runAt,
+        dryRun: options.dryRun,
+        origin: platformConsoleOrigin(),
+        flagOn: (flag, orgId, org)=>isReleaseFlagOnForOrg(flag, flags[flag], orgId, parseOrgReleaseFlagOverrides(org['releaseFlags']), resolveEffectivePlan(org)),
+        orgMembers: (orgId)=>listOrgMembers(orgId),
+        reachable: (uids)=>withoutMailWithheldAccounts(uids),
+        readers: (context)=>eligibleFigureReaders(_extends({}, context, {
+                accept: (reader)=>Boolean(reader.weeklySummary)
+            })),
+        colors: (org)=>{
+            const { palette } = systemEmailTheme(systemEmailBrand(org).options);
+            const colors = {};
+            for (const key of Object.keys(COLOR_TOKENS)){
+                var _ref, _resolveEmailColor;
+                // A brand palette that cannot resolve a token falls back to the
+                // platform's, which resolves every one of them.
+                colors[key] = (_ref = (_resolveEmailColor = resolveEmailColor(COLOR_TOKENS[key], palette)) != null ? _resolveEmailColor : resolveEmailColor(COLOR_TOKENS[key], PLATFORM_EMAIL_PALETTE)) != null ? _ref : 'inherit';
+            }
+            // Links take the color the renderer gives every other link in the
+            // email, not the raw primary, which is too light to read as text.
+            colors.link = emailAccent(palette).link;
+            return colors;
+        },
+        address: async (member, lookups)=>{
+            let address = str(member.email).toLowerCase();
+            if (!address.includes('@') && lookups.left > 0) {
+                var _pooled_record;
+                lookups.left -= 1;
+                const pooled = await findUserByUidAcrossPools(member.$id).catch(()=>null);
+                address = str(pooled == null ? void 0 : (_pooled_record = pooled.record) == null ? void 0 : _pooled_record.email).toLowerCase();
+            }
+            if (!address.includes('@')) return null;
+            const [kept] = await filterSuppressedEmails([
+                address
+            ], firestore);
+            return kept != null ? kept : null;
+        },
+        send: async ({ to, template, email, org, merge })=>{
+            var _result_reason;
+            if (!loaded.has(template)) loaded.set(template, loadSystemEmail(template).catch(()=>null));
+            const design = await loaded.get(template);
+            const brand = systemEmailBrand(org);
+            const rendered = design ? renderLoadedSystemEmail(design, _extends({}, brand.merge, merge), brand.options) : null;
+            const content = systemEmailContent(rendered, {
+                subject: email.subject,
+                text: email.text
+            });
+            const result = await sendEmail(_extends({
+                to: [
+                    to
+                ]
+            }, content, {
+                // The figures' plain text, rather than the drawn block with its tags stripped.
+                text: email.text,
+                fromName: resolveBrandingProfile(org).fromName,
+                context: template,
+                priority: 'bulk'
+            }));
+            if (result.sent) {
+                await meterPlatformEmail().catch(()=>undefined);
+                return {
+                    sent: true,
+                    rateLimited: false
+                };
+            }
+            return {
+                sent: false,
+                rateLimited: rateLimitedRetryAtMs(result) !== null,
+                reason: (_result_reason = result.reason) != null ? _result_reason : 'failed'
+            };
+        }
+    };
+}
+// lockdown-423: exempt — server-internal cron (x-cron-secret), no user caller; it reads each workspace's figures to report them to its owners and admins and writes nothing a locked org could lose.
+/**
+ * `POST /api/admin/weekly-summary` sends; a GET, or `{"dryRun": true}`,
+ * reports who would be sent what and sends nothing. The body may carry the
+ * `cursor` a previous chunk answered and a smaller `limit`.
+ */ export async function weeklySummaryRoute(request) {
+    const method = request.method.toUpperCase();
+    if (method !== 'POST' && method !== 'GET') {
+        return Response.json({
+            error: 'Method not allowed'
+        }, {
+            status: 405,
+            headers: {
+                Allow: 'GET, POST'
+            }
+        });
+    }
+    if (!process.env['CRON_SECRET']) {
+        return Response.json({
+            error: 'The weekly summary is not configured (CRON_SECRET).'
+        }, {
+            status: 501
+        });
+    }
+    const headers = Object.fromEntries(request.headers.entries());
+    if (!isCronAuthorized(headers)) return Response.json({
+        error: 'Unauthenticated'
+    }, {
+        status: 401
+    });
+    const body = method === 'POST' ? await request.json().catch(()=>null) : null;
+    const query = Object.fromEntries(new URL(request.url).searchParams.entries());
+    const dryRun = isCronDryRun({
+        method,
+        body: body != null ? body : undefined,
+        query
+    });
+    // Stamped on the invocation, not on the work (AGL-1955), so the beat is
+    // already there the day this job joins `SCHEDULED_JOBS`.
+    if (method === 'POST') {
+        try {
+            await writeCronBeat(firebaseAdmin.app().firestore(), WEEKLY_SUMMARY_JOB_ID);
+        } catch (unused) {
+        // A job that stops stamping reds its own row; it never fails the run.
+        }
+    }
+    try {
+        const rawCursor = body == null ? void 0 : body['cursor'];
+        const cursor = typeof rawCursor === 'string' && rawCursor.length > 0 && !rawCursor.includes('/') ? rawCursor : null;
+        const limit = Number(body == null ? void 0 : body['limit']);
+        const report = await runWeeklySummarySweep(await weeklySummaryDeps({
+            runAt: new Date(),
+            dryRun
+        }), _extends({
+            cursor
+        }, Number.isFinite(limit) && limit > 0 ? {
+            limit
+        } : {}));
+        return Response.json(report, {
+            headers: {
+                'Cache-Control': 'no-store'
+            }
+        });
+    } catch (error) {
+        console.error('[weekly-summary] run failed', error);
+        return Response.json({
+            error: 'Weekly summary run failed'
+        }, {
+            status: 500
+        });
+    }
+}
+
+//# sourceMappingURL=weekly-summary.js.map