@drawbridge/drawbridge-utils 0.0.159 → 0.0.161

package/dist/connections/index.cjs

@@ -1450,7 +1450,6 @@ var organization = {
 
 // index.js
 var import_currency_codes = require("currency-codes");
-var import_nanoid = require("nanoid");
 
 // lib/color.js
 var import_tinycolor2 = __toESM(require("tinycolor2"), 1);
@@ -1513,8 +1512,11 @@ var style = {
   }
 };
 
+// lib/nanoid.js
+var import_nanoid = require("nanoid");
+var generate = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+
 // index.js
-var nanoid = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
 var infinite = 1e300;
 var megabyte = 1024 * 1024;
 var gigabyte = megabyte * 1024;
@@ -2664,8 +2666,8 @@ var drawbridge_default2 = {
           // owner is not a member document, so a solo merchant has nothing to
           // pick and could never save the step.
           members: { of: "string", type: "array" },
-          message: { required: true, type: "string" },
-          subject: { required: true, type: "string" }
+          message: { max: 2e3, required: true, type: "string" },
+          subject: { max: 150, required: true, type: "string" }
         },
         triggers: ["schedule.day", "schedule.week", "schedule.month"],
         usage: { actions: 0 }
@@ -2688,8 +2690,8 @@ var drawbridge_default2 = {
         queue: "notification",
         settings: {
           members: { of: "string", type: "array" },
-          message: { type: "string" },
-          subject: { type: "string" }
+          message: { max: 2e3, type: "string" },
+          subject: { max: 150, type: "string" }
         },
         triggers: ["lead.insert"],
         // Zero is a PRICE, and a deliberate one. Declared rather than omitted
@@ -2703,8 +2705,8 @@ var drawbridge_default2 = {
         key: "Email \u2014 Send email",
         queue: "notification",
         settings: {
-          message: { required: true, type: "string" },
-          subject: { required: true, type: "string" }
+          message: { max: 2e3, required: true, type: "string" },
+          subject: { max: 150, required: true, type: "string" }
         },
         triggers: ["lead.insert"],
         // ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
@@ -2733,8 +2735,8 @@ var drawbridge_default2 = {
         key: "Send an SMS",
         queue: "notification",
         settings: {
-          message: { required: true, type: "string" },
-          subject: { required: true, type: "string" }
+          message: { max: 1600, required: true, type: "string" },
+          subject: { max: 150, required: true, type: "string" }
         },
         // Priced per SEGMENT and billed from the first, which the send
         // resolves from the message length. This is the floor.
@@ -3697,7 +3699,7 @@ var mailchimp_default2 = {
 
 // lib/connections/providers/shopify.js
 var import_node_crypto5 = require("crypto");
-var import_nanoid2 = require("nanoid");
+var import_nanoid3 = require("nanoid");
 
 // lib/connections/icons/shopify.js
 var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
@@ -3792,7 +3794,7 @@ var attributeLineItems = (lineItems = []) => lineItems.reduce(
   },
   { attrMap: {}, attributedGross: 0, attributedLines: [] }
 );
-var generateDiscountCode = (0, import_nanoid2.customAlphabet)("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ", 8);
+var generateDiscountCode = (0, import_nanoid3.customAlphabet)("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ", 8);
 var ORDER_EVENT_HANDLE = slugify("drawbridge-orders");
 var REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1e3;
 var OAUTH_ERROR_SOURCE = "oauth";

package/dist/connections/index.d.cts

@@ -20,6 +20,7 @@ import '../index.cjs';
 import 'currency-codes';
 import '../color.cjs';
 import 'tinycolor2';
+import '../nanoid.cjs';
 import 'crypto';
 import '../token.cjs';
 import 'slugify';
@@ -2984,8 +2985,8 @@ var drawbridge = {
 					// owner is not a member document, so a solo merchant has nothing to
 					// pick and could never save the step.
 					members : { of : 'string', type : 'array' },
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
+					message : { max : 2000, required : true, type : 'string' },
+					subject : { max : 150, required : true, type : 'string' }
 				},
 				triggers : [ 'schedule.day', 'schedule.week', 'schedule.month' ],
 				usage : { actions : 0 }
@@ -3009,8 +3010,8 @@ var drawbridge = {
 				queue : 'notification',
 				settings : {
 					members : { of : 'string', type : 'array' },
-					message : { type : 'string' },
-					subject : { type : 'string' }
+					message : { max : 2000, type : 'string' },
+					subject : { max : 150, type : 'string' }
 				},
 				triggers : [ 'lead.insert' ],
 				// Zero is a PRICE, and a deliberate one. Declared rather than omitted
@@ -3025,8 +3026,8 @@ var drawbridge = {
 				key : 'Email — Send email',
 				queue : 'notification',
 				settings : {
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
+					message : { max : 2000, required : true, type : 'string' },
+					subject : { max : 150, required : true, type : 'string' }
 				},
 				triggers : [ 'lead.insert' ],
 				// ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
@@ -3058,8 +3059,8 @@ var drawbridge = {
 				key : 'Send an SMS',
 				queue : 'notification',
 				settings : {
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
+					message : { max : 1600, required : true, type : 'string' },
+					subject : { max : 150, required : true, type : 'string' }
 				},
 				// Priced per SEGMENT and billed from the first, which the send
 				// resolves from the message length. This is the floor.

package/dist/connections/index.d.ts

@@ -20,6 +20,7 @@ import '../index.js';
 import 'currency-codes';
 import '../color.js';
 import 'tinycolor2';
+import '../nanoid.js';
 import 'crypto';
 import '../token.js';
 import 'slugify';
@@ -2984,8 +2985,8 @@ var drawbridge = {
 					// owner is not a member document, so a solo merchant has nothing to
 					// pick and could never save the step.
 					members : { of : 'string', type : 'array' },
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
+					message : { max : 2000, required : true, type : 'string' },
+					subject : { max : 150, required : true, type : 'string' }
 				},
 				triggers : [ 'schedule.day', 'schedule.week', 'schedule.month' ],
 				usage : { actions : 0 }
@@ -3009,8 +3010,8 @@ var drawbridge = {
 				queue : 'notification',
 				settings : {
 					members : { of : 'string', type : 'array' },
-					message : { type : 'string' },
-					subject : { type : 'string' }
+					message : { max : 2000, type : 'string' },
+					subject : { max : 150, type : 'string' }
 				},
 				triggers : [ 'lead.insert' ],
 				// Zero is a PRICE, and a deliberate one. Declared rather than omitted
@@ -3025,8 +3026,8 @@ var drawbridge = {
 				key : 'Email — Send email',
 				queue : 'notification',
 				settings : {
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
+					message : { max : 2000, required : true, type : 'string' },
+					subject : { max : 150, required : true, type : 'string' }
 				},
 				triggers : [ 'lead.insert' ],
 				// ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
@@ -3058,8 +3059,8 @@ var drawbridge = {
 				key : 'Send an SMS',
 				queue : 'notification',
 				settings : {
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
+					message : { max : 1600, required : true, type : 'string' },
+					subject : { max : 150, required : true, type : 'string' }
 				},
 				// Priced per SEGMENT and billed from the first, which the send
 				// resolves from the message length. This is the floor.

package/dist/connections/index.js

@@ -1374,7 +1374,6 @@ var organization = {
 
 // index.js
 import { code, data } from "currency-codes";
-import { customAlphabet } from "nanoid";
 
 // lib/color.js
 import tinycolor from "tinycolor2";
@@ -1437,8 +1436,11 @@ var style = {
   }
 };
 
+// lib/nanoid.js
+import { customAlphabet } from "nanoid";
+var generate = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+
 // index.js
-var nanoid = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 8);
 var infinite = 1e300;
 var megabyte = 1024 * 1024;
 var gigabyte = megabyte * 1024;
@@ -2588,8 +2590,8 @@ var drawbridge_default2 = {
           // owner is not a member document, so a solo merchant has nothing to
           // pick and could never save the step.
           members: { of: "string", type: "array" },
-          message: { required: true, type: "string" },
-          subject: { required: true, type: "string" }
+          message: { max: 2e3, required: true, type: "string" },
+          subject: { max: 150, required: true, type: "string" }
         },
         triggers: ["schedule.day", "schedule.week", "schedule.month"],
         usage: { actions: 0 }
@@ -2612,8 +2614,8 @@ var drawbridge_default2 = {
         queue: "notification",
         settings: {
           members: { of: "string", type: "array" },
-          message: { type: "string" },
-          subject: { type: "string" }
+          message: { max: 2e3, type: "string" },
+          subject: { max: 150, type: "string" }
         },
         triggers: ["lead.insert"],
         // Zero is a PRICE, and a deliberate one. Declared rather than omitted
@@ -2627,8 +2629,8 @@ var drawbridge_default2 = {
         key: "Email \u2014 Send email",
         queue: "notification",
         settings: {
-          message: { required: true, type: "string" },
-          subject: { required: true, type: "string" }
+          message: { max: 2e3, required: true, type: "string" },
+          subject: { max: 150, required: true, type: "string" }
         },
         triggers: ["lead.insert"],
         // ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
@@ -2657,8 +2659,8 @@ var drawbridge_default2 = {
         key: "Send an SMS",
         queue: "notification",
         settings: {
-          message: { required: true, type: "string" },
-          subject: { required: true, type: "string" }
+          message: { max: 1600, required: true, type: "string" },
+          subject: { max: 150, required: true, type: "string" }
         },
         // Priced per SEGMENT and billed from the first, which the send
         // resolves from the message length. This is the floor.

package/dist/html.cjs

@@ -0,0 +1,29 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/html.js
+var html_exports = {};
+__export(html_exports, {
+  escapeHtml: () => escapeHtml
+});
+module.exports = __toCommonJS(html_exports);
+var escapeHtml = (value) => String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  escapeHtml
+});

package/dist/html.d.cts

@@ -0,0 +1,32 @@
+// Escaping for values interpolated into HTML we generate ourselves.
+//
+// ITS OWN MODULE, not part of sanitize.js, because that one imports the
+// ~120K-entry disposable-domain set at load — about 6MB of RSS its own comment
+// flags as a footprint to watch. Every email sync renders would have paid that
+// to escape five characters.
+//
+// Three copies of this existed before it moved here: drawbridge-api's oembed
+// route, drawbridge-sync's email renderer, and drawbridge-emails' signature
+// builder. They had already drifted — the signature builder escapes four
+// characters and omits the apostrophe. Harmless where it sits (its output lands
+// in text content and one double-quoted href, and the input is a config of our
+// own staff), which is exactly why it survived: a divergence with no symptom is
+// the kind that is only found by looking.
+
+// The five characters that change meaning inside markup. `&` FIRST — escaping it
+// after the others would re-escape the ampersands they just introduced and turn
+// `<` into `<`.
+//
+// Escapes for BOTH contexts, text and attribute, rather than asking callers
+// which they are in: `"` and `'` are inert in text content and cost nothing to
+// escape there, while getting it wrong in an attribute is an injection. A single
+// function nobody has to think about beats two that are chosen correctly most of
+// the time.
+const escapeHtml = ( value ) => String( value ?? '' )
+	.replace( /&/g, '&' )
+	.replace( /</g, '&lt;' )
+	.replace( />/g, '&gt;' )
+	.replace( /"/g, '&quot;' )
+	.replace( /'/g, '&#39;' );
+
+export { escapeHtml };

package/dist/html.d.ts

@@ -0,0 +1,32 @@
+// Escaping for values interpolated into HTML we generate ourselves.
+//
+// ITS OWN MODULE, not part of sanitize.js, because that one imports the
+// ~120K-entry disposable-domain set at load — about 6MB of RSS its own comment
+// flags as a footprint to watch. Every email sync renders would have paid that
+// to escape five characters.
+//
+// Three copies of this existed before it moved here: drawbridge-api's oembed
+// route, drawbridge-sync's email renderer, and drawbridge-emails' signature
+// builder. They had already drifted — the signature builder escapes four
+// characters and omits the apostrophe. Harmless where it sits (its output lands
+// in text content and one double-quoted href, and the input is a config of our
+// own staff), which is exactly why it survived: a divergence with no symptom is
+// the kind that is only found by looking.
+
+// The five characters that change meaning inside markup. `&` FIRST — escaping it
+// after the others would re-escape the ampersands they just introduced and turn
+// `<` into `<`.
+//
+// Escapes for BOTH contexts, text and attribute, rather than asking callers
+// which they are in: `"` and `'` are inert in text content and cost nothing to
+// escape there, while getting it wrong in an attribute is an injection. A single
+// function nobody has to think about beats two that are chosen correctly most of
+// the time.
+const escapeHtml = ( value ) => String( value ?? '' )
+	.replace( /&/g, '&' )
+	.replace( /</g, '&lt;' )
+	.replace( />/g, '&gt;' )
+	.replace( /"/g, '&quot;' )
+	.replace( /'/g, '&#39;' );
+
+export { escapeHtml };

package/dist/html.js

@@ -0,0 +1,5 @@
+// lib/html.js
+var escapeHtml = (value) => String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+export {
+  escapeHtml
+};

package/dist/index.cjs

@@ -55,7 +55,6 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 var import_currency_codes = require("currency-codes");
-var import_nanoid = require("nanoid");
 
 // lib/color.js
 var import_tinycolor2 = __toESM(require("tinycolor2"), 1);
@@ -144,10 +143,24 @@ var constants_default = {
       rejection: "You have already submitted",
       email: "You were selected"
     },
+    // THE COPY EVERY DRAW NOTIFICATION SHIPS WITH, and — because no merchant
+    // had ever edited it — the copy every winner email had actually been sent
+    // with. It is seeded onto the campaign at creation, so changing it here
+    // only reaches NEW campaigns; the existing ones are moved by
+    // backfillDrawNotifications in drawbridge-api/scripts.js.
+    //
+    // `message`, not `body`: every other notification in the product names
+    // this field message — the workflow step settings, the notification
+    // document the draw route writes, and sync's render.notification().
+    //
+    // Both strings pass the notificationWarnings rules the form applies to
+    // the merchant's own copy, which would be a poor rule set if the shipped
+    // default failed it. Neither names a brand because a static default
+    // cannot know one; the form's brand rule is what asks for that.
     notifications: {
       draw: {
-        subject: "You have been selected",
-        body: "Thanks for being part of our giveaway"
+        subject: "Your prize is ready to claim",
+        message: "You were selected in our giveaway. Follow the link to confirm your details and claim your prize."
       }
     },
     settings: {
@@ -285,6 +298,20 @@ var constants_default = {
   }
 };
 
+// lib/nanoid.js
+var import_nanoid = require("nanoid");
+var generate = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var NOVOWEL = /[bcdfgjklmnpqrstvwxz]{7}/i;
+var ATTEMPTS = 10;
+var nanoid = () => {
+  let value = generate();
+  for (let attempt = 1; attempt < ATTEMPTS && NOVOWEL.test(value); attempt++) {
+    value = generate();
+  }
+  ;
+  return value;
+};
+
 // lib/usage.js
 var incrementUsageTotals = async ({ controller, usageId, $inc, session }) => {
   if (!usageId || !$inc) return;
@@ -308,7 +335,6 @@ var incrementUsageTotals = async ({ controller, usageId, $inc, session }) => {
 var isDuplicateKey = (error) => (error == null ? void 0 : error.code) === 11e3 || (error == null ? void 0 : error.code) === "11000" || /E11000|duplicate key/i.test((error == null ? void 0 : error.message) || "");
 
 // index.js
-var nanoid = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
 var constants = constants_default;
 var infinite = 1e300;
 var isInfinite = (value) => value === infinite;

package/dist/index.d.cts

@@ -1,8 +1,9 @@
 import { data, code } from 'currency-codes';
-import { customAlphabet } from 'nanoid';
 import { colorFormatted, colorAccessible } from './color.cjs';
+export { nanoid } from './nanoid.cjs';
 export { incrementUsageTotals, isDuplicateKey } from './usage.cjs';
 import 'tinycolor2';
+import 'nanoid';
 
 const font = {
 	family : 'Roboto Flex',
@@ -67,10 +68,24 @@ var constantsData = {
 			rejection : 'You have already submitted',
 			email : 'You were selected'
 		},
+		// THE COPY EVERY DRAW NOTIFICATION SHIPS WITH, and — because no merchant
+		// had ever edited it — the copy every winner email had actually been sent
+		// with. It is seeded onto the campaign at creation, so changing it here
+		// only reaches NEW campaigns; the existing ones are moved by
+		// backfillDrawNotifications in drawbridge-api/scripts.js.
+		//
+		// `message`, not `body`: every other notification in the product names
+		// this field message — the workflow step settings, the notification
+		// document the draw route writes, and sync's render.notification().
+		//
+		// Both strings pass the notificationWarnings rules the form applies to
+		// the merchant's own copy, which would be a poor rule set if the shipped
+		// default failed it. Neither names a brand because a static default
+		// cannot know one; the form's brand rule is what asks for that.
 		notifications : {
 			draw : {
-				subject : 'You have been selected',
-				body : 'Thanks for being part of our giveaway'
+				subject : 'Your prize is ready to claim',
+				message : 'You were selected in our giveaway. Follow the link to confirm your details and claim your prize.'
 			}
 		},
 		settings : {
@@ -208,8 +223,6 @@ var constantsData = {
 	}
 };
 
-const nanoid = customAlphabet( '0123456789abcdefghijklmnopqrstuvwxyz', 8 );
-
 const constants = constantsData;
 
 const infinite = 1e300;
@@ -441,4 +454,4 @@ const currencies = data.map( ( item ) => ({
 
 const currency = ( val ) => code( val );
 
-export { bytesToGB, bytesToMB, capitalize, constants, currencies, currency, expiredPaymentMethod, formatCurrency, formatDateString, formatNumber, getPlanFeature, gigabyte, infinite, isInfinite, megabyte, nanoid, percentage, reducers, regex, shareUrls, urlRoot };
+export { bytesToGB, bytesToMB, capitalize, constants, currencies, currency, expiredPaymentMethod, formatCurrency, formatDateString, formatNumber, getPlanFeature, gigabyte, infinite, isInfinite, megabyte, percentage, reducers, regex, shareUrls, urlRoot };

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 import { data, code } from 'currency-codes';
-import { customAlphabet } from 'nanoid';
 import { colorFormatted, colorAccessible } from './color.js';
+export { nanoid } from './nanoid.js';
 export { incrementUsageTotals, isDuplicateKey } from './usage.js';
 import 'tinycolor2';
+import 'nanoid';
 
 const font = {
 	family : 'Roboto Flex',
@@ -67,10 +68,24 @@ var constantsData = {
 			rejection : 'You have already submitted',
 			email : 'You were selected'
 		},
+		// THE COPY EVERY DRAW NOTIFICATION SHIPS WITH, and — because no merchant
+		// had ever edited it — the copy every winner email had actually been sent
+		// with. It is seeded onto the campaign at creation, so changing it here
+		// only reaches NEW campaigns; the existing ones are moved by
+		// backfillDrawNotifications in drawbridge-api/scripts.js.
+		//
+		// `message`, not `body`: every other notification in the product names
+		// this field message — the workflow step settings, the notification
+		// document the draw route writes, and sync's render.notification().
+		//
+		// Both strings pass the notificationWarnings rules the form applies to
+		// the merchant's own copy, which would be a poor rule set if the shipped
+		// default failed it. Neither names a brand because a static default
+		// cannot know one; the form's brand rule is what asks for that.
 		notifications : {
 			draw : {
-				subject : 'You have been selected',
-				body : 'Thanks for being part of our giveaway'
+				subject : 'Your prize is ready to claim',
+				message : 'You were selected in our giveaway. Follow the link to confirm your details and claim your prize.'
 			}
 		},
 		settings : {
@@ -208,8 +223,6 @@ var constantsData = {
 	}
 };
 
-const nanoid = customAlphabet( '0123456789abcdefghijklmnopqrstuvwxyz', 8 );
-
 const constants = constantsData;
 
 const infinite = 1e300;
@@ -441,4 +454,4 @@ const currencies = data.map( ( item ) => ({
 
 const currency = ( val ) => code( val );
 
-export { bytesToGB, bytesToMB, capitalize, constants, currencies, currency, expiredPaymentMethod, formatCurrency, formatDateString, formatNumber, getPlanFeature, gigabyte, infinite, isInfinite, megabyte, nanoid, percentage, reducers, regex, shareUrls, urlRoot };
+export { bytesToGB, bytesToMB, capitalize, constants, currencies, currency, expiredPaymentMethod, formatCurrency, formatDateString, formatNumber, getPlanFeature, gigabyte, infinite, isInfinite, megabyte, percentage, reducers, regex, shareUrls, urlRoot };

package/dist/index.js

@@ -1,6 +1,5 @@
 // index.js
 import { code, data } from "currency-codes";
-import { customAlphabet } from "nanoid";
 
 // lib/color.js
 import tinycolor from "tinycolor2";
@@ -89,10 +88,24 @@ var constants_default = {
       rejection: "You have already submitted",
       email: "You were selected"
     },
+    // THE COPY EVERY DRAW NOTIFICATION SHIPS WITH, and — because no merchant
+    // had ever edited it — the copy every winner email had actually been sent
+    // with. It is seeded onto the campaign at creation, so changing it here
+    // only reaches NEW campaigns; the existing ones are moved by
+    // backfillDrawNotifications in drawbridge-api/scripts.js.
+    //
+    // `message`, not `body`: every other notification in the product names
+    // this field message — the workflow step settings, the notification
+    // document the draw route writes, and sync's render.notification().
+    //
+    // Both strings pass the notificationWarnings rules the form applies to
+    // the merchant's own copy, which would be a poor rule set if the shipped
+    // default failed it. Neither names a brand because a static default
+    // cannot know one; the form's brand rule is what asks for that.
     notifications: {
       draw: {
-        subject: "You have been selected",
-        body: "Thanks for being part of our giveaway"
+        subject: "Your prize is ready to claim",
+        message: "You were selected in our giveaway. Follow the link to confirm your details and claim your prize."
       }
     },
     settings: {
@@ -230,6 +243,20 @@ var constants_default = {
   }
 };
 
+// lib/nanoid.js
+import { customAlphabet } from "nanoid";
+var generate = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var NOVOWEL = /[bcdfgjklmnpqrstvwxz]{7}/i;
+var ATTEMPTS = 10;
+var nanoid = () => {
+  let value = generate();
+  for (let attempt = 1; attempt < ATTEMPTS && NOVOWEL.test(value); attempt++) {
+    value = generate();
+  }
+  ;
+  return value;
+};
+
 // lib/usage.js
 var incrementUsageTotals = async ({ controller, usageId, $inc, session }) => {
   if (!usageId || !$inc) return;
@@ -253,7 +280,6 @@ var incrementUsageTotals = async ({ controller, usageId, $inc, session }) => {
 var isDuplicateKey = (error) => (error == null ? void 0 : error.code) === 11e3 || (error == null ? void 0 : error.code) === "11000" || /E11000|duplicate key/i.test((error == null ? void 0 : error.message) || "");
 
 // index.js
-var nanoid = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 8);
 var constants = constants_default;
 var infinite = 1e300;
 var isInfinite = (value) => value === infinite;

package/dist/nanoid.cjs

@@ -24,7 +24,17 @@ __export(nanoid_exports, {
 });
 module.exports = __toCommonJS(nanoid_exports);
 var import_nanoid = require("nanoid");
-var nanoid = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var generate = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var NOVOWEL = /[bcdfgjklmnpqrstvwxz]{7}/i;
+var ATTEMPTS = 10;
+var nanoid = () => {
+  let value = generate();
+  for (let attempt = 1; attempt < ATTEMPTS && NOVOWEL.test(value); attempt++) {
+    value = generate();
+  }
+  ;
+  return value;
+};
 var DEFAULT_MAX_RETRIES = 5;
 var retry = async ({
   field,

package/dist/nanoid.d.cts

@@ -11,7 +11,47 @@ import { customAlphabet } from 'nanoid';
 // New code should prefer this subpath, which also exposes `retry`:
 //   const { nanoid, retry } = require( '@drawbridge/drawbridge-utils/nanoid' );
 
-const nanoid = customAlphabet( '0123456789abcdefghijklmnopqrstuvwxyz', 8 );
+const generate = customAlphabet( '0123456789abcdefghijklmnopqrstuvwxyz', 8 );
+
+// SpamAssassin's FROM_LOCAL_NOVOWEL scores any From address whose LOCAL PART
+// carries seven consecutive letters from this class:
+//
+//   header FROM_LOCAL_NOVOWEL  From =~ /[bcdfgjklmnpqrstvwxz]{7}\S*\@/i
+//
+// organization.shortId becomes exactly that: lead mail sends from
+// org+<shortId>@<sending domain> (lib/email.js subAddress). Nineteen of the
+// thirty-six characters in the alphabet above are in the class, so a run of
+// seven inside eight characters is not rare — measured at 1.67% of generated
+// ids, which is roughly one organization in sixty penalised on every lead email
+// it will ever send, decided by nothing but the draw.
+//
+// Rejecting those costs a re-roll on 1.7% of calls and a slice of the keyspace
+// far too small to matter against 36⁸. Applied to EVERY nanoid rather than only
+// the organization's: the rest become slugs in urls where the rule is
+// irrelevant and the cost is nil, and doing it here means no future caller can
+// put an id in an address and quietly reintroduce this.
+//
+// Existing ids are untouched — this only shapes new ones.
+const NOVOWEL = /[bcdfgjklmnpqrstvwxz]{7}/i;
+
+// Bounded rather than looping until clean. At a 1.67% rejection rate the odds
+// of ten consecutive rejections are about 1 in 10^18, so the cap is never
+// reached — but a generator that CANNOT hang is worth more than one that is
+// merely very unlikely to, and returning a slightly penalised id beats spinning.
+const ATTEMPTS = 10;
+
+const nanoid = () => {
+
+	let value = generate();
+
+	for( let attempt = 1; attempt < ATTEMPTS && NOVOWEL.test( value ); attempt++ ){
+
+		value = generate();
+
+	}
+	return value;
+
+};
 
 // Retry an async operation when Mongo rejects an insert because of a
 // duplicate-key error on a specific field. The operation receives a fresh