@iann29/rastro 0.10.9 → 0.11.0

package/dist/component/metaLeads.js

@@ -0,0 +1,2634 @@
+import { ConvexError, v } from "convex/values";
+import { internal } from "./_generated/api.js";
+import { action, env, internalAction, internalMutation, internalQuery, mutation, query, } from "./_generated/server.js";
+import { DAY_MS, MAX_LEAD_REPORT_ROWS, MAX_REPORT_RANGE_DAYS, MAX_REPORT_SITES, } from "./constants.js";
+import { fail } from "./errors.js";
+import { isPlainRecord } from "./guards.js";
+import { firstContactValidator, formChoiceAnswerValidator, formRuleValidator, formRulesSimulationValidator, formRulesValidator, formsReportValidator, metaFormQuestionValidator, metaFormsValidator, linkedPagesValidator, META_PAGE_ERROR_CODES, metaPageValidator, } from "./leadAdsValidators.js";
+import { choiceOptions, evaluateRules, labelChoices, optionKeyOf, ruleSignature, splitLeadFields, } from "./leadFormRules.js";
+import { formLeadOrigin, isForgottenFormLead } from "./leadFormStore.js";
+import { LEAD_FORM_ORIGIN, recordLeadCore } from "./leads.js";
+import { ownerKeyOf } from "./meta.js";
+import { metaGraph, MetaGraphError, } from "./metaGraph.js";
+import { sha256Hex } from "./metaCapi.js";
+import { leadgenTrust } from "./leadgenToken.js";
+import { PAUSED_AT, retryDelay, USAGE_BACKOFF_PCT } from "./metaSync.js";
+import { cleanString } from "./sanitize.js";
+import { decryptSecret, encryptSecret, hasSecretsKey } from "./secrets.js";
+/** Leads, forms and Pages one call or one read handles at most. */
+export const MAX_PAGES_PER_CONNECTION = 200;
+export const MAX_SITE_PAGES = 20;
+const MAX_LINKS_PER_CONNECTION = 500;
+const MAX_FORMS_PER_PAGE = 500;
+/** Forms the forms screen lists for a site, every Page together. */
+export const MAX_SITE_FORMS = 500;
+const MAX_RULES = 20;
+const MAX_RULE_ANSWERS = 30;
+const MAX_REASON = 80;
+const MAX_FIRST_CONTACT_TEXT = 600;
+const MAX_QUESTIONS = 60;
+const MAX_MONTH_LEADS = 5_000;
+const MAX_BACKFILL_DAYS = 30;
+const MONTH_DAYS = 30;
+const RECONCILE_INTERVAL_MS = 15 * 60_000;
+const RECONCILE_LEASE_MS = 10 * 60_000;
+const THROTTLE_BACKOFF_MS = 60 * 60_000;
+const PERMISSION_RETRY_MS = 6 * 60 * 60_000;
+/**
+ * How often the reconciliation makes sure the app is still subscribed to a
+ * linked Page: the subscription is the Page's and the app's, shared by every
+ * host, so another host unlinking the Page (releases before this one did
+ * unsubscribe) or a Page admin may have taken it off.
+ */
+export const SUBSCRIPTION_CHECK_MS = 6 * 60 * 60_000;
+const LOOP_BATCH = 4;
+/**
+ * A lead whose commit failed this many times, while later leads of its form
+ * came in, is skipped by the reconciliation (kept in `formLeadFailures`).
+ */
+export const MAX_LEAD_ATTEMPTS = 5;
+const MAX_SKIPPED_PER_RUN = 50;
+/** Graph listings one run makes per form, halving windows included. */
+const MAX_FORM_FETCHES = 12;
+const LOOP_STAGGER_MS = 20_000;
+const MAX_ERROR = 300;
+const GRAPH_ID = /^\d{1,32}$/u;
+const HANDLE = /^function:\/\/./u;
+/** The tasks that let a Page's token read its leads (with the permission). */
+const LEAD_TASKS = new Set(["ADVERTISE", "MANAGE"]);
+const PAGE_NOT_GRANTED = "PAGE_NOT_GRANTED: the Meta login no longer lists this Page; grant it in Meta and connect again";
+const LEADS_NOT_ALLOWED = "META_PERMISSION_MISSING: Meta did not grant leads_retrieval for this Page; reconnect Meta and pick the Page";
+const HANDLER_MISSING = "HANDLER_MISSING: the host has not registered its form lead handler (setFormLeadHandler)";
+const PAGE_ERROR_CODES = new Set(META_PAGE_ERROR_CODES);
+/** Codes stored before they were settled, read as today's. */
+const LEGACY_PAGE_ERROR_CODES = {
+    PAGE_NOT_GRANTED: "META_PERMISSION_MISSING",
+    RATE_LIMITED: "META_RATE_LIMITED",
+};
+/**
+ * A link's stored `lastError` (`CODE: message`) as the code a screen reads;
+ * the message stays in the component. Anything unknown reads as Meta being
+ * unavailable, which passes by itself.
+ */
+export function pageErrorCode(lastError) {
+    if (!lastError)
+        return null;
+    const prefix = /^([A-Z][A-Z_]*)(?::|$)/u.exec(lastError)?.[1] ?? "";
+    if (PAGE_ERROR_CODES.has(prefix))
+        return prefix;
+    return LEGACY_PAGE_ERROR_CODES[prefix] ?? "META_UNAVAILABLE";
+}
+const graph = () => metaGraph({ fake: env.RASTRO_META_FAKE === "true" });
+function optionalLoginApp() {
+    const appId = env.RASTRO_META_APP_ID?.trim() ?? "";
+    const appSecret = env.RASTRO_META_APP_SECRET?.trim() ?? "";
+    return /^\d{5,20}$/.test(appId) && appSecret ? { appId, appSecret } : null;
+}
+function graphIdOf(value, field) {
+    const id = value.trim();
+    if (!GRAPH_ID.test(id))
+        fail("INVALID_ARGUMENT", `${field} must be Meta's id`);
+    return id;
+}
+const dayOf = (at) => Math.floor(at / DAY_MS) * DAY_MS;
+function nowOf(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(value) || value < 0) {
+        fail("INVALID_ARGUMENT", "now must be a Unix time in milliseconds");
+    }
+    return value;
+}
+async function requireSite(ctx, siteId) {
+    if (!(await ctx.db.get("sites", siteId)))
+        fail("NOT_FOUND", "site not found");
+}
+function requireKey() {
+    if (!hasSecretsKey(env.RASTRO_SECRETS_KEY)) {
+        fail("SECRETS_KEY_MISSING", "set RASTRO_SECRETS_KEY (32 random bytes, base64) and pass it to the component");
+    }
+}
+/**
+ * A Page linked here is routed here: refused while the leadgen route would
+ * answer every forward `503`, so no lead waits 24 hours on a host that cannot
+ * take it (decision D1).
+ */
+function requireLeadgenRoute() {
+    if (leadgenTrust(env).audience === null) {
+        fail("FEDERATION_NOT_CONFIGURED", "set RASTRO_FEDERATION_AUDIENCE (this host's functions URL) and pass it to the component before linking a Page");
+    }
+}
+/** Meta's failure on a Page call as the component's own error. */
+function pageFailure(error) {
+    if (error instanceof MetaGraphError) {
+        if (error.kind === "token") {
+            fail("META_TOKEN_INVALID", `Meta refused the Page token: ${error.message}`);
+        }
+        if (error.kind === "permission") {
+            fail("META_PERMISSION_MISSING", `Meta refused: ${error.message}`);
+        }
+        fail("META_UNAVAILABLE", `Meta answered: ${error.message}`, {
+            kind: error.kind,
+        });
+    }
+    throw error;
+}
+// ---------------------------------------------------------------------------
+// Pages, as the Meta login lists them.
+const sealedPageValidator = v.object({
+    pageId: v.string(),
+    name: v.string(),
+    tasks: v.array(v.string()),
+    leadsAllowed: v.boolean(),
+    tokenCipher: v.string(),
+    tokenIv: v.string(),
+});
+/**
+ * The Pages a token acts for, each with its token sealed, for `savePages`.
+ * Never fails a login: a token without the Page permissions (a login with the
+ * old configuration) lists none, and anything Meta refuses here leaves the
+ * Pages already known (`complete: false`).
+ */
+export async function readPages(client, token) {
+    let listed;
+    try {
+        listed = await client.pages(token);
+    }
+    catch (error) {
+        if (error instanceof MetaGraphError) {
+            console.warn(`[rastro] Meta refused the Pages read: ${error.message}`);
+            return { pages: [], complete: false };
+        }
+        throw error;
+    }
+    let access = null;
+    try {
+        access = await client.leadAccess(token, optionalLoginApp());
+    }
+    catch (error) {
+        if (!(error instanceof MetaGraphError))
+            throw error;
+    }
+    const pages = [];
+    for (const page of listed.pages.slice(0, MAX_PAGES_PER_CONNECTION)) {
+        if (!page.accessToken || !GRAPH_ID.test(page.pageId))
+            continue;
+        const tasks = page.tasks.slice(0, 20).map((task) => task.slice(0, 40));
+        // The permission (from the login's scopes when Meta says) and a task
+        // that reaches the Page's leads.
+        const granted = access === null
+            ? true
+            : access.all || access.pageIds.includes(page.pageId);
+        const leadsAllowed = granted &&
+            (tasks.length === 0 || tasks.some((task) => LEAD_TASKS.has(task)));
+        const sealed = await encryptSecret(env.RASTRO_SECRETS_KEY, page.accessToken);
+        pages.push({
+            pageId: page.pageId,
+            name: page.name.slice(0, 200),
+            tasks,
+            leadsAllowed,
+            tokenCipher: sealed.cipher,
+            tokenIv: sealed.iv,
+        });
+    }
+    return { pages, complete: listed.complete };
+}
+/**
+ * Stores the Pages a connection's token listed, with their sealed tokens. A
+ * linked Page the listing leaves out (with `complete`) stops, saying why; a
+ * linked Page listed again (or with a fresh token) resumes. Ignored when the
+ * connection has another token by now (`tokenIv`).
+ */
+export const savePages = internalMutation({
+    args: {
+        connectionId: v.id("metaConnections"),
+        connectionTokenIv: v.string(),
+        pages: v.array(sealedPageValidator),
+        complete: v.boolean(),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const connection = await ctx.db.get("metaConnections", args.connectionId);
+        if (connection?.tokenIv !== args.connectionTokenIv)
+            return null;
+        const now = Date.now();
+        const rows = await ctx.db
+            .query("metaPages")
+            .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", args.connectionId))
+            .take(MAX_PAGES_PER_CONNECTION * 2);
+        const byPage = new Map(rows.map((row) => [row.pageId, row]));
+        const listed = new Set();
+        for (const page of args.pages.slice(0, MAX_PAGES_PER_CONNECTION)) {
+            listed.add(page.pageId);
+            const fields = {
+                ownerKey: connection.ownerKey,
+                name: page.name,
+                tasks: page.tasks,
+                leadsAllowed: page.leadsAllowed,
+                tokenCipher: page.tokenCipher,
+                tokenIv: page.tokenIv,
+                listed: true,
+                invalidSince: undefined,
+                updatedAt: now,
+            };
+            const row = byPage.get(page.pageId);
+            if (row)
+                await ctx.db.patch("metaPages", row._id, fields);
+            else {
+                await ctx.db.insert("metaPages", {
+                    connectionId: args.connectionId,
+                    pageId: page.pageId,
+                    ...fields,
+                    createdAt: now,
+                });
+            }
+        }
+        const links = await ctx.db
+            .query("sitePages")
+            .withIndex("by_connectionId", (range) => range.eq("connectionId", args.connectionId))
+            .take(MAX_LINKS_PER_CONNECTION);
+        const linked = new Set(links.map((link) => link.pageId));
+        if (args.complete) {
+            for (const row of rows) {
+                if (listed.has(row.pageId))
+                    continue;
+                if (linked.has(row.pageId)) {
+                    await ctx.db.patch("metaPages", row._id, {
+                        listed: false,
+                        updatedAt: now,
+                    });
+                }
+                else {
+                    await ctx.db.delete("metaPages", row._id);
+                }
+            }
+        }
+        let resumed = false;
+        for (const link of links) {
+            const page = args.pages.find((row) => row.pageId === link.pageId);
+            if (!page) {
+                if (args.complete && link.lastError !== PAGE_NOT_GRANTED) {
+                    await pauseLink(ctx, link, PAGE_NOT_GRANTED, now);
+                }
+                continue;
+            }
+            if (!page.leadsAllowed) {
+                if (link.lastError !== LEADS_NOT_ALLOWED) {
+                    await pauseLink(ctx, link, LEADS_NOT_ALLOWED, now);
+                }
+                continue;
+            }
+            // A fresh token resumes a Page a dead token (or a missing grant) had
+            // stopped.
+            if (link.nextReconcileAt === PAUSED_AT) {
+                await ctx.db.patch("sitePages", link._id, {
+                    lastError: undefined,
+                    failures: 0,
+                    nextReconcileAt: now,
+                    updatedAt: now,
+                });
+                resumed = true;
+            }
+        }
+        if (resumed)
+            await kickLeadsLoop(ctx, now);
+        return null;
+    },
+});
+export const handlerRegistered = internalQuery({
+    args: {},
+    returns: v.boolean(),
+    handler: async (ctx) => await handlerReady(ctx),
+});
+/**
+ * Reads and stores the Pages a connection's token acts for, on a host that
+ * opted into Lead Ads (its form lead handler is registered). A host that did
+ * not makes no Pages read and keeps no Page token.
+ */
+export async function syncOwnerPages(ctx, client, connection) {
+    if (!(await ctx.runQuery(internal.metaLeads.handlerRegistered, {})))
+        return;
+    const pages = await readPages(client, connection.token);
+    await ctx.runMutation(internal.metaLeads.savePages, {
+        connectionId: connection.connectionId,
+        connectionTokenIv: connection.tokenIv,
+        pages: pages.pages,
+        complete: pages.complete,
+    });
+}
+const OWNERS_BATCH = 20;
+const ownerToReadValidator = v.object({
+    connectionId: v.id("metaConnections"),
+    creationTime: v.number(),
+    tokenCipher: v.string(),
+    tokenIv: v.string(),
+    active: v.boolean(),
+});
+export const ownersToRead = internalQuery({
+    args: { after: v.union(v.number(), v.null()) },
+    returns: v.array(ownerToReadValidator),
+    handler: async (ctx, args) => {
+        const after = args.after;
+        const rows = await ctx.db
+            .query("metaConnections")
+            .withIndex("by_creation_time", (range) => after === null ? range : range.gt("_creationTime", after))
+            .take(OWNERS_BATCH);
+        return rows.map((row) => ({
+            connectionId: row._id,
+            creationTime: row._creationTime,
+            tokenCipher: row.tokenCipher,
+            tokenIv: row.tokenIv,
+            active: row.status === "active",
+        }));
+    },
+});
+/**
+ * The host registered its form lead handler for the first time: the Pages of
+ * the owners already connected are read now, a batch of owners at a time,
+ * instead of at each owner's next login.
+ */
+export const readOwnersPages = internalAction({
+    args: { after: v.union(v.number(), v.null()) },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        if (!hasSecretsKey(env.RASTRO_SECRETS_KEY))
+            return null;
+        const owners = await ctx.runQuery(internal.metaLeads.ownersToRead, args);
+        const client = graph();
+        for (const owner of owners) {
+            if (!owner.active)
+                continue;
+            let token;
+            try {
+                token = await decryptSecret(env.RASTRO_SECRETS_KEY, {
+                    cipher: owner.tokenCipher,
+                    iv: owner.tokenIv,
+                });
+            }
+            catch {
+                continue;
+            }
+            await syncOwnerPages(ctx, client, {
+                connectionId: owner.connectionId,
+                token,
+                tokenIv: owner.tokenIv,
+            });
+        }
+        if (owners.length === OWNERS_BATCH) {
+            await ctx.scheduler.runAfter(0, internal.metaLeads.readOwnersPages, {
+                after: owners[owners.length - 1].creationTime,
+            });
+        }
+        return null;
+    },
+});
+async function pauseLink(ctx, link, message, now) {
+    await ctx.db.patch("sitePages", link._id, {
+        runId: undefined,
+        lastError: message.slice(0, MAX_ERROR),
+        nextReconcileAt: PAUSED_AT,
+        updatedAt: now,
+    });
+}
+/**
+ * Meta refused the Page token sealed with `tokenIv`: the Page stops until a
+ * login lists it with a new one. A newer token (another IV) is left alone.
+ */
+export const markPageInvalid = internalMutation({
+    args: {
+        pageRowId: v.id("metaPages"),
+        tokenIv: v.string(),
+        message: v.string(),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const row = await ctx.db.get("metaPages", args.pageRowId);
+        if (row?.tokenIv !== args.tokenIv)
+            return null;
+        const now = Date.now();
+        await ctx.db.patch("metaPages", row._id, {
+            invalidSince: row.invalidSince ?? now,
+            updatedAt: now,
+        });
+        const links = await ctx.db
+            .query("sitePages")
+            .withIndex("by_pageId", (range) => range.eq("pageId", row.pageId))
+            .take(2);
+        for (const link of links) {
+            if (link.connectionId !== row.connectionId)
+                continue;
+            await pauseLink(ctx, link, `META_TOKEN_INVALID: ${args.message}`, now);
+        }
+        return null;
+    },
+});
+/** Forgets a removed connection's Pages and links, a batch at a time. */
+export async function removeConnectionPages(ctx, connectionId, batch) {
+    const links = await ctx.db
+        .query("sitePages")
+        .withIndex("by_connectionId", (range) => range.eq("connectionId", connectionId))
+        .take(batch);
+    for (const link of links)
+        await ctx.db.delete("sitePages", link._id);
+    const pages = await ctx.db
+        .query("metaPages")
+        .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", connectionId))
+        .take(batch);
+    for (const page of pages)
+        await ctx.db.delete("metaPages", page._id);
+    return links.length === batch || pages.length === batch;
+}
+async function connectionByOwner(ctx, ownerKey) {
+    return await ctx.db
+        .query("metaConnections")
+        .withIndex("by_ownerKey", (range) => range.eq("ownerKey", ownerKey))
+        .unique();
+}
+async function linkOfPage(ctx, pageId) {
+    return await ctx.db
+        .query("sitePages")
+        .withIndex("by_pageId", (range) => range.eq("pageId", pageId))
+        .first();
+}
+/**
+ * The owner's Pages as a screen shows them: whether Meta granted their
+ * leads, the site each feeds (whoever linked it, since a Page feeds one
+ * site) and whether this owner linked it. Never a token.
+ */
+export const pages = query({
+    args: { ownerKey: v.string() },
+    returns: v.array(metaPageValidator),
+    handler: async (ctx, args) => {
+        const ownerKey = ownerKeyOf(args.ownerKey);
+        const connection = await connectionByOwner(ctx, ownerKey);
+        if (!connection)
+            return [];
+        const rows = await ctx.db
+            .query("metaPages")
+            .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", connection._id))
+            .take(MAX_PAGES_PER_CONNECTION * 2);
+        const ready = await handlerReady(ctx);
+        const out = [];
+        for (const row of rows) {
+            const link = await linkOfPage(ctx, row.pageId);
+            const own = link ? link.ownerKey === ownerKey : null;
+            const lastError = !row.listed
+                ? "META_PERMISSION_MISSING"
+                : row.invalidSince !== undefined
+                    ? "META_TOKEN_INVALID"
+                    : own
+                        ? (pageErrorCode(link?.lastError) ??
+                            (ready ? null : "HANDLER_MISSING"))
+                        : null;
+            out.push({
+                pageId: row.pageId,
+                name: row.name,
+                tasks: row.tasks,
+                leadsAllowed: row.leadsAllowed,
+                linkedSiteId: link?.siteId ?? null,
+                own,
+                subscribedAt: own ? (link?.subscribedAt ?? null) : null,
+                lastError,
+                handlerReady: ready,
+            });
+        }
+        return out.sort((left, right) => left.name.localeCompare(right.name));
+    },
+});
+/**
+ * The Pages linked to the sites, for the control plane's webhook routes, and
+ * whether this host's leadgen route takes forwards at all: `leadgenReady` (the
+ * component has `RASTRO_FEDERATION_AUDIENCE`), the `issuer` it checks them
+ * against and the `audience` it expects. The control plane routes a Page here
+ * only when it is ready, the issuer is its own and the audience is the one it
+ * signs forwards for (decision D1). `handlerReady` says whether the host
+ * registered its form lead handler: without it no Page is read, so a screen
+ * with no Pages names the host's setup instead of the Meta login.
+ */
+export const linkedPages = query({
+    args: { siteIds: v.array(v.id("sites")) },
+    returns: linkedPagesValidator,
+    handler: async (ctx, args) => {
+        const siteIds = [...new Set(args.siteIds)];
+        if (siteIds.length < 1 ||
+            siteIds.length > MAX_REPORT_SITES ||
+            siteIds.length !== args.siteIds.length) {
+            fail("INVALID_ARGUMENT", `siteIds must contain 1-${MAX_REPORT_SITES} unique IDs`);
+        }
+        const out = [];
+        for (const siteId of siteIds) {
+            const links = await ctx.db
+                .query("sitePages")
+                .withIndex("by_siteId", (range) => range.eq("siteId", siteId))
+                .take(MAX_SITE_PAGES);
+            for (const link of links)
+                out.push({ pageId: link.pageId, siteId });
+        }
+        const { issuer, audience } = leadgenTrust(env);
+        return {
+            pages: out,
+            leadgenReady: audience !== null,
+            issuer,
+            audience,
+            handlerReady: await handlerReady(ctx),
+        };
+    },
+});
+// ---------------------------------------------------------------------------
+// Link a Page to a site.
+const preparedLinkValidator = v.object({
+    pageRowId: v.id("metaPages"),
+    tokenCipher: v.string(),
+    tokenIv: v.string(),
+});
+export const prepareLink = internalQuery({
+    args: {
+        siteId: v.id("sites"),
+        pageId: v.string(),
+        ownerKey: v.string(),
+        onlyOwn: v.boolean(),
+    },
+    returns: preparedLinkValidator,
+    handler: async (ctx, args) => {
+        await requireSite(ctx, args.siteId);
+        const connection = await connectionByOwner(ctx, args.ownerKey);
+        if (!connection)
+            fail("NOT_FOUND", "no Meta connection for this owner");
+        if (connection.status !== "active") {
+            fail("META_TOKEN_INVALID", "the owner's Meta token is invalid; connect again");
+        }
+        const page = await ctx.db
+            .query("metaPages")
+            .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", connection._id).eq("pageId", args.pageId))
+            .unique();
+        if (!page?.listed) {
+            fail("NOT_FOUND", "the owner's Meta login does not list this Page");
+        }
+        if (!page.leadsAllowed)
+            fail("META_PERMISSION_MISSING", LEADS_NOT_ALLOWED);
+        await checkLinkable(ctx, args);
+        return {
+            pageRowId: page._id,
+            tokenCipher: page.tokenCipher,
+            tokenIv: page.tokenIv,
+        };
+    },
+});
+/** The conflicts a link refuses; checked before Meta and again on saving. */
+async function checkLinkable(ctx, args) {
+    const link = await linkOfPage(ctx, args.pageId);
+    if (link && link.siteId !== args.siteId) {
+        fail("CONFLICT", "this Page already feeds another site; unlink it there");
+    }
+    if (link && link.ownerKey !== args.ownerKey && args.onlyOwn) {
+        fail("CONFLICT", "this Page is linked to the site by another owner on this host; change it there");
+    }
+    if (!link) {
+        const siblings = await ctx.db
+            .query("sitePages")
+            .withIndex("by_siteId", (range) => range.eq("siteId", args.siteId))
+            .take(MAX_SITE_PAGES);
+        if (siblings.length >= MAX_SITE_PAGES) {
+            fail("LIMIT_EXCEEDED", `a site links at most ${MAX_SITE_PAGES} Pages`);
+        }
+    }
+    return link;
+}
+const graphFormValidator = v.object({
+    formId: v.string(),
+    name: v.string(),
+    status: v.string(),
+    questions: v.array(metaFormQuestionValidator),
+    whatsappButton: v.union(v.boolean(), v.null()),
+    createdTime: v.union(v.number(), v.null()),
+});
+const toFormArgs = (forms) => forms.slice(0, MAX_FORMS_PER_PAGE).map((form) => ({
+    formId: form.formId,
+    name: form.name.slice(0, 200),
+    status: form.status.slice(0, 32),
+    questions: form.questions.slice(0, MAX_QUESTIONS).map((question) => ({
+        key: question.key.slice(0, 120),
+        label: question.label.slice(0, 300),
+        type: question.type.slice(0, 40),
+        ...(question.options
+            ? {
+                options: question.options.slice(0, 100).map((option) => ({
+                    key: option.key.slice(0, 200),
+                    value: option.value.slice(0, 300),
+                })),
+            }
+            : {}),
+    })),
+    whatsappButton: form.whatsappButton,
+    createdTime: form.createdTime,
+}));
+/** Upserts a Page's forms; with `complete`, a form Meta no longer lists goes. */
+async function upsertForms(ctx, pageId, forms, complete) {
+    const now = Date.now();
+    const rows = await ctx.db
+        .query("metaForms")
+        .withIndex("by_pageId", (range) => range.eq("pageId", pageId))
+        .take(MAX_FORMS_PER_PAGE * 2);
+    const byId = new Map(rows.map((row) => [row.formId, row]));
+    for (const form of forms) {
+        const fields = {
+            name: form.name,
+            status: form.status,
+            questions: form.questions,
+            whatsappButton: form.whatsappButton ?? undefined,
+            createdTime: form.createdTime ?? undefined,
+            syncedAt: now,
+        };
+        const row = byId.get(form.formId);
+        if (row)
+            await ctx.db.patch("metaForms", row._id, fields);
+        else {
+            await ctx.db.insert("metaForms", {
+                pageId,
+                formId: form.formId,
+                ...fields,
+            });
+        }
+    }
+    if (complete) {
+        // Deleted at Meta: its rules and leads stay; the listing forgets it.
+        const listed = new Set(forms.map((form) => form.formId));
+        for (const row of rows) {
+            if (!listed.has(row.formId))
+                await ctx.db.delete("metaForms", row._id);
+        }
+    }
+}
+export const saveForms = internalMutation({
+    args: {
+        pageId: v.string(),
+        forms: v.array(graphFormValidator),
+        complete: v.boolean(),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        await upsertForms(ctx, args.pageId, args.forms, args.complete);
+        return null;
+    },
+});
+export const saveLink = internalMutation({
+    args: {
+        siteId: v.id("sites"),
+        pageId: v.string(),
+        ownerKey: v.string(),
+        onlyOwn: v.boolean(),
+        subscribedAt: v.number(),
+        reconcileFrom: v.number(),
+        forms: v.union(v.array(graphFormValidator), v.null()),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const connection = await connectionByOwner(ctx, args.ownerKey);
+        if (!connection || connection.status !== "active") {
+            fail("META_TOKEN_INVALID", "the owner's Meta token is invalid; connect again");
+        }
+        const page = await ctx.db
+            .query("metaPages")
+            .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", connection._id).eq("pageId", args.pageId))
+            .unique();
+        if (!page)
+            fail("NOT_FOUND", "the owner's Meta login does not list this Page");
+        const existing = await checkLinkable(ctx, args);
+        const now = Date.now();
+        const fields = {
+            name: page.name,
+            ownerKey: args.ownerKey,
+            connectionId: connection._id,
+            subscribedAt: args.subscribedAt,
+            subscriptionCheckedAt: args.subscribedAt,
+            lastError: undefined,
+            failures: 0,
+            nextReconcileAt: now,
+            updatedAt: now,
+        };
+        if (existing) {
+            // Linked again: the subscription is renewed, the cursors stay.
+            await ctx.db.patch("sitePages", existing._id, fields);
+        }
+        else {
+            await ctx.db.insert("sitePages", {
+                siteId: args.siteId,
+                pageId: args.pageId,
+                ...fields,
+                reconcileFrom: args.reconcileFrom,
+                createdAt: now,
+            });
+        }
+        if (args.forms)
+            await upsertForms(ctx, args.pageId, args.forms, true);
+        await kickLeadsLoop(ctx, now);
+        return null;
+    },
+});
+/**
+ * Makes one of the owner's Pages feed the site's leads: subscribes the app to
+ * the Page's `leadgen` webhook with the Page's own token, reads its forms,
+ * records the link and starts the reconciliation. One Page feeds one site
+ * (`CONFLICT` otherwise). With `onlyOwn` (the federated path) a Page another
+ * owner linked to the site is a `CONFLICT` too; the host's own call moves it.
+ * `backfillDays` (0–30, host only) also brings the leads of the days before.
+ */
+export const linkPage = action({
+    args: {
+        siteId: v.id("sites"),
+        pageId: v.string(),
+        ownerKey: v.string(),
+        onlyOwn: v.optional(v.boolean()),
+        backfillDays: v.optional(v.number()),
+    },
+    returns: v.object({ linked: v.boolean(), forms: v.number() }),
+    handler: async (ctx, args) => {
+        const pageId = graphIdOf(args.pageId, "pageId");
+        const ownerKey = ownerKeyOf(args.ownerKey);
+        const backfillDays = args.backfillDays ?? 0;
+        if (!Number.isSafeInteger(backfillDays) ||
+            backfillDays < 0 ||
+            backfillDays > MAX_BACKFILL_DAYS) {
+            fail("INVALID_ARGUMENT", `backfillDays must be an integer from 0 to ${MAX_BACKFILL_DAYS}`);
+        }
+        requireKey();
+        requireLeadgenRoute();
+        const onlyOwn = args.onlyOwn ?? false;
+        const prepared = await ctx.runQuery(internal.metaLeads.prepareLink, {
+            siteId: args.siteId,
+            pageId,
+            ownerKey,
+            onlyOwn,
+        });
+        const token = await decryptSecret(env.RASTRO_SECRETS_KEY, {
+            cipher: prepared.tokenCipher,
+            iv: prepared.tokenIv,
+        });
+        const client = graph();
+        try {
+            await client.subscribePage(token, pageId);
+        }
+        catch (error) {
+            if (error instanceof MetaGraphError && error.kind === "token") {
+                await ctx.runMutation(internal.metaLeads.markPageInvalid, {
+                    pageRowId: prepared.pageRowId,
+                    tokenIv: prepared.tokenIv,
+                    message: error.message,
+                });
+            }
+            if (error instanceof MetaGraphError) {
+                console.warn(`[rastro] Meta refused the leadgen subscription of Page ${pageId}: ${error.message}`);
+            }
+            pageFailure(error);
+        }
+        const subscribedAt = Date.now();
+        let forms = null;
+        try {
+            const listed = await client.leadForms(token, pageId);
+            if (listed.complete)
+                forms = listed.forms;
+        }
+        catch (error) {
+            // The forms come with the first reconciliation run anyway.
+            if (!(error instanceof MetaGraphError))
+                throw error;
+        }
+        await ctx.runMutation(internal.metaLeads.saveLink, {
+            siteId: args.siteId,
+            pageId,
+            ownerKey,
+            onlyOwn,
+            subscribedAt,
+            reconcileFrom: subscribedAt - backfillDays * DAY_MS,
+            forms: forms ? toFormArgs(forms) : null,
+        });
+        return { linked: true, forms: forms?.length ?? 0 };
+    },
+});
+/**
+ * Stops a Page feeding the site: forgets the link and so its reconciliation.
+ * The app's `leadgen` subscription stays on the Page: it is the Page's and
+ * the app's, shared by every host (one app, one dashboard webhook), so taking
+ * it off here would silence a host that links the Page now. The dashboard
+ * drops notifications for a Page no host claims. The site's form rules and
+ * the leads already in stay. With `ownerKey`, only that owner's link
+ * (another's is a `CONFLICT`). An action, like `linkPage`, for the callers
+ * that pair them.
+ */
+export const unlinkPage = action({
+    args: {
+        siteId: v.id("sites"),
+        pageId: v.string(),
+        ownerKey: v.optional(v.string()),
+    },
+    returns: v.object({ unlinked: v.boolean() }),
+    handler: async (ctx, args) => {
+        const pageId = graphIdOf(args.pageId, "pageId");
+        return await ctx.runMutation(internal.metaLeads.removeLink, {
+            siteId: args.siteId,
+            pageId,
+            ownerKey: args.ownerKey === undefined ? undefined : ownerKeyOf(args.ownerKey),
+        });
+    },
+});
+export const removeLink = internalMutation({
+    args: {
+        siteId: v.id("sites"),
+        pageId: v.string(),
+        ownerKey: v.optional(v.string()),
+    },
+    returns: v.object({ unlinked: v.boolean() }),
+    handler: async (ctx, args) => {
+        const link = await linkOfPage(ctx, args.pageId);
+        if (!link || link.siteId !== args.siteId)
+            return { unlinked: false };
+        if (args.ownerKey !== undefined && link.ownerKey !== args.ownerKey) {
+            fail("CONFLICT", "this Page is linked to the site by another owner on this host; unlink it there");
+        }
+        await ctx.db.delete("sitePages", link._id);
+        return { unlinked: true };
+    },
+});
+// ---------------------------------------------------------------------------
+// Forms.
+const sitePageTokensValidator = v.array(v.object({
+    pageId: v.string(),
+    pageRowId: v.id("metaPages"),
+    tokenCipher: v.string(),
+    tokenIv: v.string(),
+}));
+export const loadSitePageTokens = internalQuery({
+    args: { siteId: v.id("sites"), pageId: v.optional(v.string()) },
+    returns: sitePageTokensValidator,
+    handler: async (ctx, args) => {
+        await requireSite(ctx, args.siteId);
+        const links = await ctx.db
+            .query("sitePages")
+            .withIndex("by_siteId", (range) => range.eq("siteId", args.siteId))
+            .take(MAX_SITE_PAGES);
+        const out = [];
+        for (const link of links) {
+            if (args.pageId !== undefined && link.pageId !== args.pageId)
+                continue;
+            const page = await ctx.db
+                .query("metaPages")
+                .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", link.connectionId).eq("pageId", link.pageId))
+                .unique();
+            if (!page || page.invalidSince !== undefined || !page.listed)
+                continue;
+            out.push({
+                pageId: link.pageId,
+                pageRowId: page._id,
+                tokenCipher: page.tokenCipher,
+                tokenIv: page.tokenIv,
+            });
+        }
+        return out;
+    },
+});
+/**
+ * Reads the instant forms of the site's linked Pages (or one of them) from
+ * Meta again. New forms show up by themselves every reconciliation run; this
+ * is the screen's "refresh now".
+ */
+export const refreshForms = action({
+    args: { siteId: v.id("sites"), pageId: v.optional(v.string()) },
+    returns: v.object({ pages: v.number(), forms: v.number() }),
+    handler: async (ctx, args) => {
+        const pageId = args.pageId === undefined ? undefined : graphIdOf(args.pageId, "pageId");
+        requireKey();
+        const targets = await ctx.runQuery(internal.metaLeads.loadSitePageTokens, {
+            siteId: args.siteId,
+            ...(pageId === undefined ? {} : { pageId }),
+        });
+        const client = graph();
+        let forms = 0;
+        for (const target of targets) {
+            const token = await decryptSecret(env.RASTRO_SECRETS_KEY, {
+                cipher: target.tokenCipher,
+                iv: target.tokenIv,
+            });
+            let listed;
+            try {
+                listed = await client.leadForms(token, target.pageId);
+            }
+            catch (error) {
+                if (error instanceof MetaGraphError && error.kind === "token") {
+                    await ctx.runMutation(internal.metaLeads.markPageInvalid, {
+                        pageRowId: target.pageRowId,
+                        tokenIv: target.tokenIv,
+                        message: error.message,
+                    });
+                }
+                pageFailure(error);
+            }
+            await ctx.runMutation(internal.metaLeads.saveForms, {
+                pageId: target.pageId,
+                forms: toFormArgs(listed.forms),
+                complete: listed.complete,
+            });
+            forms += listed.forms.length;
+        }
+        return { pages: targets.length, forms };
+    },
+});
+async function rulesOf(ctx, siteId, formId) {
+    return await ctx.db
+        .query("formRules")
+        .withIndex("by_siteId_and_formId", (range) => range.eq("siteId", siteId).eq("formId", formId))
+        .unique();
+}
+/** Whether `ownerKey` may edit the form's rules: its Page and its rules. */
+function ownsRules(link, rules, ownerKey) {
+    return (link?.ownerKey === ownerKey && (rules === null || rules.setBy === ownerKey));
+}
+async function handlerReady(ctx) {
+    return ((await ctx.db
+        .query("metaFormLeadHandler")
+        .withIndex("by_key", (range) => range.eq("key", "handler"))
+        .unique()) !== null);
+}
+/**
+ * The Pages linked to the site and their forms, for the forms screen: each
+ * form's leads in the 30 UTC days up to `now` (and per day), its last lead,
+ * its rules and the end screen's WhatsApp button. With `ownerKey`, whether
+ * that owner linked each Page and may edit each form's rules (`own`).
+ */
+export const forms = query({
+    args: {
+        siteId: v.id("sites"),
+        now: v.optional(v.number()),
+        ownerKey: v.optional(v.string()),
+    },
+    returns: metaFormsValidator,
+    handler: async (ctx, args) => {
+        await requireSite(ctx, args.siteId);
+        const now = nowOf(args.now);
+        const ownerKey = args.ownerKey === undefined ? undefined : ownerKeyOf(args.ownerKey);
+        const ready = await handlerReady(ctx);
+        const links = await ctx.db
+            .query("sitePages")
+            .withIndex("by_siteId", (range) => range.eq("siteId", args.siteId))
+            .take(MAX_SITE_PAGES);
+        const to = now === undefined ? 0 : dayOf(now);
+        const from = to - (MONTH_DAYS - 1) * DAY_MS;
+        // Every form's cohort days, one index range a day: a day holds a row per
+        // form that had leads that day, so the cap only bites past
+        // MAX_SITE_FORMS forms with leads on the same day.
+        const days = new Map();
+        if (now !== undefined) {
+            for (let index = 0; index < MONTH_DAYS; index += 1) {
+                const dayStart = from + index * DAY_MS;
+                const rows = await ctx.db
+                    .query("leadDailyRollups")
+                    .withIndex("by_siteId_and_dimension_and_dayStart_and_key", (range) => range
+                    .eq("siteId", args.siteId)
+                    .eq("dimension", "form")
+                    .eq("dayStart", dayStart))
+                    .take(MAX_SITE_FORMS);
+                for (const row of rows) {
+                    const series = days.get(row.key) ?? Array.from({ length: MONTH_DAYS }, () => 0);
+                    series[index] += row.leads;
+                    days.set(row.key, series);
+                }
+            }
+        }
+        // At most MAX_SITE_FORMS forms in all: every Page's active forms first,
+        // then the others (Meta keeps archived forms forever) while room is left.
+        // Each form costs one more read (its rules); its last lead is on its row.
+        const pageForms = new Map();
+        let budget = MAX_SITE_FORMS;
+        for (const link of links) {
+            const active = await ctx.db
+                .query("metaForms")
+                .withIndex("by_pageId_and_status", (range) => range.eq("pageId", link.pageId).eq("status", "ACTIVE"))
+                .take(Math.min(budget, MAX_FORMS_PER_PAGE));
+            budget -= active.length;
+            pageForms.set(link.pageId, active);
+        }
+        for (const link of links) {
+            if (budget <= 0)
+                break;
+            const listed = pageForms.get(link.pageId) ?? [];
+            const room = Math.min(budget, MAX_FORMS_PER_PAGE - listed.length);
+            if (room <= 0)
+                continue;
+            const before = await ctx.db
+                .query("metaForms")
+                .withIndex("by_pageId_and_status", (range) => range.eq("pageId", link.pageId).lt("status", "ACTIVE"))
+                .take(room);
+            const after = room - before.length > 0
+                ? await ctx.db
+                    .query("metaForms")
+                    .withIndex("by_pageId_and_status", (range) => range.eq("pageId", link.pageId).gt("status", "ACTIVE"))
+                    .take(room - before.length)
+                : [];
+            budget -= before.length + after.length;
+            pageForms.set(link.pageId, [...listed, ...before, ...after]);
+        }
+        const out = [];
+        for (const link of links) {
+            const page = await ctx.db
+                .query("metaPages")
+                .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", link.connectionId).eq("pageId", link.pageId))
+                .unique();
+            const rows = pageForms.get(link.pageId) ?? [];
+            const forms = [];
+            for (const form of rows) {
+                const daily = now === undefined
+                    ? null
+                    : (days.get(form.formId) ??
+                        Array.from({ length: MONTH_DAYS }, () => 0));
+                const leads30d = daily === null ? null : daily.reduce((sum, count) => sum + count, 0);
+                const rules = await rulesOf(ctx, args.siteId, form.formId);
+                forms.push({
+                    formId: form.formId,
+                    name: form.name,
+                    status: form.status,
+                    questions: form.questions,
+                    whatsappButton: form.whatsappButton ?? null,
+                    whatsappButtonConfirmed: rules?.whatsappButtonConfirmed === true,
+                    createdTime: form.createdTime ?? null,
+                    syncedAt: form.syncedAt,
+                    leads30d,
+                    daily,
+                    lastLeadAt: form.lastLead?.siteId === args.siteId ? form.lastLead.at : null,
+                    rules: {
+                        configured: rules !== null,
+                        count: rules?.rules.length ?? 0,
+                        entryColumn: rules?.entryColumn ?? null,
+                        ...(ownerKey === undefined
+                            ? {}
+                            : { own: ownsRules(link, rules, ownerKey) }),
+                    },
+                });
+            }
+            forms.sort((left, right) => Number(left.status !== "ACTIVE") -
+                Number(right.status !== "ACTIVE") ||
+                (right.lastLeadAt ?? 0) - (left.lastLeadAt ?? 0) ||
+                left.name.localeCompare(right.name));
+            out.push({
+                pageId: link.pageId,
+                pageName: link.name,
+                leadsAllowed: page?.leadsAllowed ?? false,
+                subscribedAt: link.subscribedAt ?? null,
+                lastReconcileAt: link.lastReconcileAt ?? null,
+                lastLeadAt: link.lastLeadAt ?? null,
+                lastError: pageErrorCode(link.lastError) ?? (ready ? null : "HANDLER_MISSING"),
+                ...(ownerKey === undefined ? {} : { own: link.ownerKey === ownerKey }),
+                handlerReady: ready,
+                forms,
+            });
+        }
+        return out;
+    },
+});
+// ---------------------------------------------------------------------------
+// Rules.
+/** The form, which must belong to a Page linked to the site. */
+async function siteForm(ctx, siteId, formId) {
+    await requireSite(ctx, siteId);
+    const form = await ctx.db
+        .query("metaForms")
+        .withIndex("by_formId", (range) => range.eq("formId", formId))
+        .first();
+    const link = form ? await linkOfPage(ctx, form.pageId) : null;
+    if (!form || !link || link.siteId !== siteId) {
+        fail("NOT_FOUND", "the form is not on a Page linked to this site");
+    }
+    return { form, link };
+}
+function columnsOf(pipeline) {
+    return new Set((pipeline?.columns ?? []).map((column) => column.key));
+}
+function columnOf(value, declared, field) {
+    const column = value.trim();
+    if (!declared.has(column)) {
+        fail("INVALID_ARGUMENT", `${field} ${column.slice(0, 64)} is not on the site's pipeline (setPipeline)`);
+    }
+    return column;
+}
+function reasonOf(value) {
+    const reason = cleanString(value, MAX_REASON);
+    if (!reason)
+        fail("INVALID_ARGUMENT", "a discard needs its reason");
+    return reason;
+}
+/**
+ * The rules as stored: each question a choice question of the form, each
+ * answer one of its options (by key or shown value, stored by key), each
+ * column on the site's pipeline. `lenient` (the simulation's draft) skips
+ * what does not resolve instead of refusing it.
+ */
+function cleanRules(rules, questions, declared, lenient) {
+    if (rules.length > MAX_RULES) {
+        fail("LIMIT_EXCEEDED", `a form has at most ${MAX_RULES} rules`);
+    }
+    const byKey = new Map(questions.map((question) => [question.key, question]));
+    const out = [];
+    for (const rule of rules) {
+        const question = byKey.get(rule.questionKey);
+        if (!choiceOptions(question)) {
+            if (lenient)
+                continue;
+            fail("INVALID_ARGUMENT", `${rule.questionKey.slice(0, 64)} is not a choice question of the form`);
+        }
+        if (rule.answers.length === 0 || rule.answers.length > MAX_RULE_ANSWERS) {
+            if (lenient)
+                continue;
+            fail("INVALID_ARGUMENT", `a rule names 1-${MAX_RULE_ANSWERS} answers`);
+        }
+        const answers = [];
+        for (const answer of rule.answers) {
+            const key = optionKeyOf(question, answer);
+            if (key === null) {
+                if (lenient)
+                    continue;
+                fail("INVALID_ARGUMENT", `${answer.slice(0, 64)} is not an option of ${rule.questionKey.slice(0, 64)}`);
+            }
+            if (!answers.includes(key))
+                answers.push(key);
+        }
+        if (answers.length === 0)
+            continue;
+        let to;
+        if ("column" in rule.to) {
+            if (lenient && !declared.has(rule.to.column.trim()))
+                continue;
+            to = { column: columnOf(rule.to.column, declared, "column") };
+        }
+        else {
+            const reason = cleanString(rule.to.discard, MAX_REASON);
+            if (!reason) {
+                if (lenient)
+                    continue;
+                reasonOf(rule.to.discard);
+            }
+            to = { discard: reason };
+        }
+        out.push({ questionKey: rule.questionKey, answers, to });
+    }
+    return out;
+}
+function cleanFirstContact(value) {
+    const text = value.text === undefined
+        ? undefined
+        : cleanString(value.text, MAX_FIRST_CONTACT_TEXT) || undefined;
+    let brakes = value.brakes;
+    if (brakes) {
+        const { waitMinutes, maxPerHour } = brakes;
+        if (!Number.isSafeInteger(waitMinutes) ||
+            waitMinutes < 15 ||
+            waitMinutes > 1_440 ||
+            !Number.isSafeInteger(maxPerHour) ||
+            maxPerHour < 1 ||
+            maxPerHour > 120) {
+            fail("INVALID_ARGUMENT", "brakes: wait 15-1440 whole minutes, send 1-120 per hour");
+        }
+        brakes = {
+            waitMinutes,
+            maxPerHour,
+            businessHoursOnly: brakes.businessHoursOnly,
+        };
+    }
+    if (value.mode === "automatic" && !brakes) {
+        fail("INVALID_ARGUMENT", "an automatic first contact needs its brakes");
+    }
+    if (value.mode === "one_click" && !text) {
+        fail("INVALID_ARGUMENT", "a one-click first contact needs its text");
+    }
+    return {
+        mode: value.mode,
+        ...(text ? { text } : {}),
+        ...(brakes ? { brakes } : {}),
+    };
+}
+const DEFAULT_FIRST_CONTACT = { mode: "lead_starts" };
+/**
+ * Where a site's form sends its leads: the rules in order (the first that
+ * matches decides; none → `entryColumn`, null for the host's own entry), and
+ * how the host makes the first contact. Replaces what was there; it decides
+ * the next leads only. With `ownerKey` and `onlyOwn` (the federated path), a
+ * Page or rules another owner set are a `CONFLICT`.
+ */
+export const setFormRules = mutation({
+    args: {
+        siteId: v.id("sites"),
+        formId: v.string(),
+        entryColumn: v.union(v.string(), v.null()),
+        rules: v.array(formRuleValidator),
+        firstContact: firstContactValidator,
+        /** The host checked the end screen's WhatsApp button by hand. */
+        whatsappButtonConfirmed: v.optional(v.boolean()),
+        ownerKey: v.optional(v.string()),
+        onlyOwn: v.optional(v.boolean()),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const formId = graphIdOf(args.formId, "formId");
+        const { form, link } = await siteForm(ctx, args.siteId, formId);
+        const existing = await rulesOf(ctx, args.siteId, formId);
+        const ownerKey = args.ownerKey === undefined ? undefined : ownerKeyOf(args.ownerKey);
+        if (args.onlyOwn) {
+            if (ownerKey === undefined) {
+                fail("INVALID_ARGUMENT", "onlyOwn needs the ownerKey");
+            }
+            if (!ownsRules(link, existing, ownerKey)) {
+                fail("CONFLICT", "this form's Page or rules were set by another owner on this host; change them there");
+            }
+        }
+        const pipeline = await ctx.db
+            .query("sitePipelines")
+            .withIndex("by_siteId", (range) => range.eq("siteId", args.siteId))
+            .unique();
+        const declared = columnsOf(pipeline);
+        const entryColumn = args.entryColumn === null
+            ? undefined
+            : columnOf(args.entryColumn, declared, "entryColumn");
+        const rules = cleanRules(args.rules, form.questions, declared, false);
+        const fields = {
+            siteId: args.siteId,
+            formId,
+            ...(entryColumn ? { entryColumn } : {}),
+            rules,
+            signatures: await Promise.all(rules.map((rule) => sha256Hex(ruleSignature(rule)))),
+            firstContact: cleanFirstContact(args.firstContact),
+            ...((args.whatsappButtonConfirmed ?? existing?.whatsappButtonConfirmed)
+                ? { whatsappButtonConfirmed: true }
+                : {}),
+            ...(ownerKey ? { setBy: ownerKey } : {}),
+            updatedAt: Date.now(),
+        };
+        if (existing)
+            await ctx.db.replace("formRules", existing._id, fields);
+        else
+            await ctx.db.insert("formRules", fields);
+        return null;
+    },
+});
+/** Distinct leads a rule decided since `since` (bounded). */
+async function decidedSince(ctx, siteId, formId, signature, since) {
+    const rows = await ctx.db
+        .query("formLeads")
+        .withIndex("by_siteId_and_formId_and_ruleSignature_and_receivedAt", (range) => range
+        .eq("siteId", siteId)
+        .eq("formId", formId)
+        .eq("ruleSignature", signature)
+        .gt("receivedAt", since))
+        .take(MAX_MONTH_LEADS);
+    return rows.length;
+}
+/**
+ * A form's rules for the drawer, each with the leads it decided in the 30
+ * days up to `now` (null without `now`). A form never configured answers its
+ * defaults with `configured: false`.
+ */
+export const formRules = query({
+    args: {
+        siteId: v.id("sites"),
+        formId: v.string(),
+        now: v.optional(v.number()),
+        ownerKey: v.optional(v.string()),
+    },
+    returns: formRulesValidator,
+    handler: async (ctx, args) => {
+        const formId = graphIdOf(args.formId, "formId");
+        const { link } = await siteForm(ctx, args.siteId, formId);
+        const now = nowOf(args.now);
+        const rules = await rulesOf(ctx, args.siteId, formId);
+        const since = now === undefined ? 0 : now - MONTH_DAYS * DAY_MS;
+        const rows = [];
+        for (const [index, rule] of (rules?.rules ?? []).entries()) {
+            const signature = rules?.signatures[index];
+            rows.push({
+                ...rule,
+                monthCount: now === undefined || signature === undefined
+                    ? null
+                    : await decidedSince(ctx, args.siteId, formId, signature, since),
+            });
+        }
+        return {
+            siteId: args.siteId,
+            formId,
+            configured: rules !== null,
+            entryColumn: rules?.entryColumn ?? null,
+            rules: rows,
+            firstContact: rules?.firstContact ?? DEFAULT_FIRST_CONTACT,
+            whatsappButtonConfirmed: rules?.whatsappButtonConfirmed === true,
+            updatedAt: rules?.updatedAt ?? null,
+            ...(args.ownerKey === undefined
+                ? {}
+                : { own: ownsRules(link, rules, ownerKeyOf(args.ownerKey)) }),
+        };
+    },
+});
+/**
+ * The form's leads of the 30 days up to `now` under a draft of its rules:
+ * how many each rule would decide, and where they would all go. Reads the
+ * choice answers Rastro keeps; never Meta.
+ */
+export const simulateFormRules = query({
+    args: {
+        siteId: v.id("sites"),
+        formId: v.string(),
+        entryColumn: v.union(v.string(), v.null()),
+        rules: v.array(formRuleValidator),
+        now: v.number(),
+    },
+    returns: formRulesSimulationValidator,
+    handler: async (ctx, args) => {
+        const formId = graphIdOf(args.formId, "formId");
+        const { form } = await siteForm(ctx, args.siteId, formId);
+        const now = nowOf(args.now);
+        const pipeline = await ctx.db
+            .query("sitePipelines")
+            .withIndex("by_siteId", (range) => range.eq("siteId", args.siteId))
+            .unique();
+        const declared = columnsOf(pipeline);
+        // The draft as it would be saved, minus what does not resolve yet.
+        const draft = [];
+        const draftIndex = [];
+        for (const [index, rule] of args.rules.entries()) {
+            const [clean] = cleanRules([rule], form.questions, declared, true);
+            if (clean) {
+                draft.push(clean);
+                draftIndex.push(index);
+            }
+        }
+        const entryColumn = args.entryColumn !== null && declared.has(args.entryColumn.trim())
+            ? args.entryColumn.trim()
+            : null;
+        const leads = await ctx.db
+            .query("formLeads")
+            .withIndex("by_siteId_and_formId_and_receivedAt", (range) => range
+            .eq("siteId", args.siteId)
+            .eq("formId", formId)
+            .gt("receivedAt", now - MONTH_DAYS * DAY_MS)
+            .lte("receivedAt", now))
+            .order("desc")
+            .take(MAX_MONTH_LEADS + 1);
+        const partial = leads.length > MAX_MONTH_LEADS;
+        const perRule = args.rules.map(() => 0);
+        const columns = new Map();
+        const discarded = new Map();
+        let entry = 0;
+        for (const lead of leads.slice(0, MAX_MONTH_LEADS)) {
+            const outcome = evaluateRules(draft, entryColumn, lead.answers);
+            if (outcome.ruleIndex === null)
+                entry += 1;
+            else
+                perRule[draftIndex[outcome.ruleIndex]] += 1;
+            if ("discard" in outcome.decision) {
+                const reason = outcome.decision.discard;
+                discarded.set(reason, (discarded.get(reason) ?? 0) + 1);
+            }
+            else if (outcome.decision.column !== null) {
+                const column = outcome.decision.column;
+                columns.set(column, (columns.get(column) ?? 0) + 1);
+            }
+        }
+        return {
+            total: Math.min(leads.length, MAX_MONTH_LEADS),
+            entry,
+            rules: perRule,
+            columns: [...columns].map(([column, count]) => ({
+                column,
+                leads: count,
+            })),
+            discarded: [...discarded].map(([reason, count]) => ({
+                reason,
+                leads: count,
+            })),
+            partial,
+        };
+    },
+});
+/**
+ * Sends a discarded lead back to the funnel: its decision is cleared (it
+ * goes to the host's entry) and the reason it had is kept as history. The
+ * host moves its card back itself. With `ownerKey`, only for a Page that
+ * owner linked.
+ */
+export const returnFormLead = mutation({
+    args: {
+        siteId: v.id("sites"),
+        leadId: v.string(),
+        ownerKey: v.optional(v.string()),
+    },
+    returns: v.object({ returned: v.boolean() }),
+    handler: async (ctx, args) => {
+        const leadId = ctx.db.normalizeId("leads", args.leadId);
+        if (!leadId)
+            fail("NOT_FOUND", "lead not found");
+        const row = await ctx.db
+            .query("formLeads")
+            .withIndex("by_leadId", (range) => range.eq("leadId", leadId))
+            .first();
+        if (!row || row.siteId !== args.siteId) {
+            fail("NOT_FOUND", "no form lead with this id on the site");
+        }
+        if (args.ownerKey !== undefined) {
+            const link = await linkOfPage(ctx, row.pageId);
+            if (link?.ownerKey !== ownerKeyOf(args.ownerKey)) {
+                fail("CONFLICT", "this lead's Page is linked by another owner on this host; return it there");
+            }
+        }
+        if (!("discard" in row.decision))
+            return { returned: false };
+        await ctx.db.patch("formLeads", row._id, {
+            decision: { column: null },
+            returned: { at: Date.now(), reason: row.decision.discard },
+        });
+        return { returned: true };
+    },
+});
+// ---------------------------------------------------------------------------
+// The host's handler.
+/**
+ * Registers the host's form lead handler: a function handle to an internal
+ * mutation that receives each lead (see `formLeadPayloadValidator`). Safe to
+ * call again; `null` removes it, and leads then wait (not marked ingested)
+ * until a handler is back.
+ */
+export const setFormLeadHandler = mutation({
+    args: { handle: v.union(v.string(), v.null()) },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const existing = await ctx.db
+            .query("metaFormLeadHandler")
+            .withIndex("by_key", (range) => range.eq("key", "handler"))
+            .unique();
+        if (args.handle === null) {
+            if (existing)
+                await ctx.db.delete("metaFormLeadHandler", existing._id);
+            return null;
+        }
+        const handle = args.handle.trim();
+        if (!HANDLE.test(handle) || handle.length > 512) {
+            fail("INVALID_ARGUMENT", "handle must come from createFunctionHandle(internal.yourModule.yourMutation)");
+        }
+        const now = Date.now();
+        if (existing) {
+            if (existing.handle !== handle) {
+                await ctx.db.patch("metaFormLeadHandler", existing._id, {
+                    handle,
+                    updatedAt: now,
+                });
+            }
+        }
+        else {
+            await ctx.db.insert("metaFormLeadHandler", {
+                key: "handler",
+                handle,
+                updatedAt: now,
+            });
+            // The host opts into Lead Ads here: its owners' Pages are read now.
+            await ctx.scheduler.runAfter(0, internal.metaLeads.readOwnersPages, {
+                after: null,
+            });
+            // Leads that waited for a handler come in now, not in 15 minutes.
+            const links = await ctx.db
+                .query("sitePages")
+                .withIndex("by_nextReconcileAt", (range) => range.lt("nextReconcileAt", PAUSED_AT))
+                .take(MAX_LINKS_PER_CONNECTION);
+            let woke = false;
+            for (const link of links) {
+                if (link.runId !== undefined)
+                    continue;
+                if (!link.lastError?.startsWith("HANDLER_MISSING"))
+                    continue;
+                await ctx.db.patch("sitePages", link._id, {
+                    nextReconcileAt: now,
+                    updatedAt: now,
+                });
+                woke = true;
+            }
+            if (woke)
+                await kickLeadsLoop(ctx, now);
+        }
+        return null;
+    },
+});
+// ---------------------------------------------------------------------------
+// Ingestion.
+const ingestStatusValidator = v.union(v.literal("ingested"), v.literal("duplicate"), v.literal("unlinked"), v.literal("handler_missing"), v.literal("paused"));
+/**
+ * What a failed commit says, safe for a log: a `ConvexError`'s `code` or the
+ * error's class name. Never the message: the host's handler had the lead's
+ * name, phone and e-mail in hand, and its message (or a validator's dump of
+ * the arguments) may carry them.
+ */
+export function failureCode(error) {
+    if (error instanceof ConvexError &&
+        isPlainRecord(error.data) &&
+        typeof error.data.code === "string" &&
+        /^[A-Za-z0-9_.:-]{1,60}$/u.test(error.data.code)) {
+        return error.data.code;
+    }
+    if (error instanceof Error &&
+        /^[A-Za-z0-9_]{1,60}$/u.test(error.name) &&
+        error.name !== "Error") {
+        return error.name;
+    }
+    return "HANDLER_ERROR";
+}
+/**
+ * Counts one failed commit of a lead (its ids and the error's code, nothing
+ * else). Returns the attempts so far and whether the lead was already skipped.
+ */
+export const recordLeadFailure = internalMutation({
+    args: {
+        leadgenId: v.string(),
+        pageId: v.string(),
+        formId: v.string(),
+        code: v.string(),
+    },
+    returns: v.object({ attempts: v.number(), skipped: v.boolean() }),
+    handler: async (ctx, args) => {
+        const now = Date.now();
+        const row = await ctx.db
+            .query("formLeadFailures")
+            .withIndex("by_leadgenId", (range) => range.eq("leadgenId", args.leadgenId))
+            .first();
+        const code = args.code.slice(0, 60);
+        if (row) {
+            const attempts = row.attempts + 1;
+            await ctx.db.patch("formLeadFailures", row._id, {
+                attempts,
+                lastCode: code,
+                lastAt: now,
+            });
+            return { attempts, skipped: row.skippedAt !== undefined };
+        }
+        await ctx.db.insert("formLeadFailures", {
+            leadgenId: args.leadgenId,
+            pageId: args.pageId,
+            formId: args.formId,
+            attempts: 1,
+            lastCode: code,
+            lastAt: now,
+        });
+        return { attempts: 1, skipped: false };
+    },
+});
+/** Marks leads the reconciliation gave up on, so they no longer hold it. */
+export const skipFailedLeads = internalMutation({
+    args: { leadgenIds: v.array(v.string()) },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const now = Date.now();
+        for (const leadgenId of args.leadgenIds.slice(0, MAX_SKIPPED_PER_RUN)) {
+            const row = await ctx.db
+                .query("formLeadFailures")
+                .withIndex("by_leadgenId", (range) => range.eq("leadgenId", leadgenId))
+                .first();
+            if (row && row.skippedAt === undefined) {
+                await ctx.db.patch("formLeadFailures", row._id, { skippedAt: now });
+            }
+        }
+        return null;
+    },
+});
+/**
+ * Commits one lead: the ingestion record, the lead (origin `lead_form`) and
+ * the host's handler call, in one transaction. `contact` and `freeAnswers`
+ * only pass through to the handler. A handler that throws rolls everything
+ * back, so the lead is read again later.
+ */
+const commitResultValidator = v.object({
+    status: ingestStatusValidator,
+    leadId: v.union(v.string(), v.null()),
+});
+export const commitFormLead = internalMutation({
+    args: {
+        pageId: v.string(),
+        leadgenId: v.string(),
+        receivedAt: v.number(),
+        formId: v.string(),
+        adId: v.union(v.string(), v.null()),
+        adsetId: v.union(v.string(), v.null()),
+        campaignId: v.union(v.string(), v.null()),
+        platform: v.union(v.string(), v.null()),
+        isOrganic: v.boolean(),
+        choices: v.array(formChoiceAnswerValidator),
+        contact: v.object({
+            name: v.union(v.string(), v.null()),
+            phone: v.union(v.string(), v.null()),
+            email: v.union(v.string(), v.null()),
+        }),
+        freeAnswers: v.array(v.object({
+            questionKey: v.string(),
+            label: v.string(),
+            value: v.string(),
+        })),
+    },
+    returns: commitResultValidator,
+    handler: async (ctx, args) => {
+        const seen = await ctx.db
+            .query("formLeads")
+            .withIndex("by_leadgenId", (range) => range.eq("leadgenId", args.leadgenId))
+            .first();
+        if (seen)
+            return { status: "duplicate", leadId: seen.leadId };
+        // Removed by the host: never brought back.
+        if (await isForgottenFormLead(ctx, args.leadgenId)) {
+            return { status: "duplicate", leadId: null };
+        }
+        const link = await linkOfPage(ctx, args.pageId);
+        if (!link)
+            return { status: "unlinked", leadId: null };
+        const handler = await ctx.db
+            .query("metaFormLeadHandler")
+            .withIndex("by_key", (range) => range.eq("key", "handler"))
+            .unique();
+        if (!handler)
+            return { status: "handler_missing", leadId: null };
+        const form = await ctx.db
+            .query("metaForms")
+            .withIndex("by_formId", (range) => range.eq("formId", args.formId))
+            .first();
+        const rules = await rulesOf(ctx, link.siteId, args.formId);
+        const outcome = evaluateRules(rules?.rules ?? [], rules?.entryColumn ?? null, args.choices);
+        const now = Date.now();
+        const receivedAt = Math.min(args.receivedAt, now);
+        const leadKey = `meta_lead:${args.leadgenId}`;
+        const { leadId } = await recordLeadCore(ctx, {
+            siteId: link.siteId,
+            leadKey,
+            channel: "form",
+            entryPoint: LEAD_FORM_ORIGIN,
+            ad: args.adId ? { adId: args.adId } : undefined,
+            column: "column" in outcome.decision && outcome.decision.column !== null
+                ? outcome.decision.column
+                : undefined,
+            occurredAt: receivedAt,
+            form: { formId: args.formId, pageId: args.pageId },
+        });
+        const row = {
+            siteId: link.siteId,
+            pageId: args.pageId,
+            formId: args.formId,
+            leadgenId: args.leadgenId,
+            leadId,
+            receivedAt,
+            ...(args.adId ? { adId: args.adId } : {}),
+            ...(args.adsetId ? { adsetId: args.adsetId } : {}),
+            ...(args.campaignId ? { campaignId: args.campaignId } : {}),
+            ...(args.platform ? { platform: args.platform } : {}),
+            isOrganic: args.isOrganic,
+            answers: args.choices,
+            decision: outcome.decision,
+            rulePath: outcome.rulePath,
+            ...(outcome.ruleIndex === null
+                ? {}
+                : {
+                    ruleIndex: outcome.ruleIndex,
+                    ...(rules?.signatures[outcome.ruleIndex]
+                        ? { ruleSignature: rules.signatures[outcome.ruleIndex] }
+                        : {}),
+                }),
+            createdAt: now,
+        };
+        await ctx.db.insert("formLeads", row);
+        const payload = {
+            siteId: link.siteId,
+            leadId,
+            leadKey,
+            leadgenId: args.leadgenId,
+            receivedAt,
+            contact: args.contact,
+            freeAnswers: args.freeAnswers,
+            answers: labelChoices(form?.questions ?? [], args.choices),
+            decision: outcome.decision,
+            rulePath: outcome.rulePath,
+            ruleIndex: outcome.ruleIndex,
+            origin: await formLeadOrigin(ctx, row),
+            firstContact: rules?.firstContact ?? DEFAULT_FIRST_CONTACT,
+        };
+        await ctx.runMutation(handler.handle, payload);
+        await ctx.db.patch("sitePages", link._id, {
+            lastLeadAt: Math.max(link.lastLeadAt ?? 0, receivedAt),
+        });
+        if (form) {
+            const last = form.lastLead?.siteId === link.siteId ? form.lastLead.at : 0;
+            if (receivedAt > last) {
+                await ctx.db.patch("metaForms", form._id, {
+                    lastLead: { siteId: link.siteId, at: receivedAt },
+                });
+            }
+        }
+        const failure = await ctx.db
+            .query("formLeadFailures")
+            .withIndex("by_leadgenId", (range) => range.eq("leadgenId", args.leadgenId))
+            .first();
+        if (failure)
+            await ctx.db.delete("formLeadFailures", failure._id);
+        return { status: "ingested", leadId };
+    },
+});
+const ingestJobValidator = v.union(v.object({
+    status: v.union(v.literal("duplicate"), v.literal("unlinked"), v.literal("handler_missing"), v.literal("paused")),
+}), v.object({
+    status: v.literal("ready"),
+    linkId: v.id("sitePages"),
+    pageRowId: v.id("metaPages"),
+    tokenCipher: v.string(),
+    tokenIv: v.string(),
+}));
+export const loadIngestJob = internalQuery({
+    args: { pageId: v.string(), leadgenId: v.optional(v.string()) },
+    returns: ingestJobValidator,
+    handler: async (ctx, args) => {
+        if (args.leadgenId !== undefined) {
+            const seen = await ctx.db
+                .query("formLeads")
+                .withIndex("by_leadgenId", (range) => range.eq("leadgenId", args.leadgenId))
+                .first();
+            if (seen || (await isForgottenFormLead(ctx, args.leadgenId))) {
+                return { status: "duplicate" };
+            }
+        }
+        const link = await linkOfPage(ctx, args.pageId);
+        if (!link)
+            return { status: "unlinked" };
+        if (!(await handlerReady(ctx)))
+            return { status: "handler_missing" };
+        const connection = await ctx.db.get("metaConnections", link.connectionId);
+        const page = await ctx.db
+            .query("metaPages")
+            .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", link.connectionId).eq("pageId", link.pageId))
+            .unique();
+        if (connection?.status !== "active" ||
+            !page ||
+            !page.listed ||
+            !page.leadsAllowed ||
+            page.invalidSince !== undefined ||
+            link.nextReconcileAt === PAUSED_AT) {
+            return { status: "paused" };
+        }
+        return {
+            status: "ready",
+            linkId: link._id,
+            pageRowId: page._id,
+            tokenCipher: page.tokenCipher,
+            tokenIv: page.tokenIv,
+        };
+    },
+});
+const formQuestionsValidator = v.union(v.null(), v.object({
+    pageId: v.string(),
+    questions: v.array(metaFormQuestionValidator),
+}));
+export const formQuestions = internalQuery({
+    args: { formId: v.string() },
+    returns: formQuestionsValidator,
+    handler: async (ctx, args) => {
+        const form = await ctx.db
+            .query("metaForms")
+            .withIndex("by_formId", (range) => range.eq("formId", args.formId))
+            .first();
+        return form ? { pageId: form.pageId, questions: form.questions } : null;
+    },
+});
+/**
+ * One lead, read from Meta, into the host: its answers split (personal ones
+ * kept in memory only), its form's questions read first when unknown, then
+ * `commitFormLead`. Returns what happened; never throws on Meta or on the
+ * handler, so a run goes on with the next lead.
+ */
+async function ingestLead(ctx, client, page, lead) {
+    const done = (status) => ({
+        status,
+        attempts: 0,
+        skipped: false,
+    });
+    if (!lead.formId) {
+        console.warn(`[rastro] lead ${lead.leadgenId} names no form; skipped`);
+        return done("skipped");
+    }
+    let form = await ctx.runQuery(internal.metaLeads.formQuestions, {
+        formId: lead.formId,
+    });
+    if (!form) {
+        try {
+            const listed = await client.leadForms(page.token, page.pageId);
+            await ctx.runMutation(internal.metaLeads.saveForms, {
+                pageId: page.pageId,
+                forms: toFormArgs(listed.forms),
+                complete: false,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof MetaGraphError))
+                throw error;
+        }
+        form = await ctx.runQuery(internal.metaLeads.formQuestions, {
+            formId: lead.formId,
+        });
+    }
+    if (form && form.pageId !== page.pageId) {
+        console.warn(`[rastro] lead ${lead.leadgenId} belongs to another Page's form; skipped`);
+        return done("skipped");
+    }
+    // Without the form's questions every answer stays in memory: nothing is
+    // known to be a choice.
+    const split = splitLeadFields(form?.questions ?? [], lead.fields);
+    try {
+        const result = await ctx.runMutation(internal.metaLeads.commitFormLead, {
+            pageId: page.pageId,
+            leadgenId: lead.leadgenId,
+            receivedAt: lead.createdTime,
+            formId: lead.formId,
+            adId: lead.adId,
+            adsetId: lead.adsetId,
+            campaignId: lead.campaignId,
+            platform: lead.platform,
+            isOrganic: lead.isOrganic,
+            choices: split.choices,
+            contact: split.contact,
+            freeAnswers: split.freeAnswers,
+        });
+        if (result.status === "handler_missing") {
+            console.warn(`[rastro] form lead ${lead.leadgenId}: ${HANDLER_MISSING}`);
+        }
+        return done(result.status);
+    }
+    catch (error) {
+        // The host's handler threw (or the commit failed): nothing was kept, and
+        // the next reconciliation reads the lead again. Only the error's code is
+        // logged and kept: its message is the host's, and may carry the contact.
+        const code = failureCode(error);
+        console.error(`[rastro] form lead ${lead.leadgenId}: HANDLER_FAILED (${code})`);
+        const counted = await ctx.runMutation(internal.metaLeads.recordLeadFailure, {
+            leadgenId: lead.leadgenId,
+            pageId: page.pageId,
+            formId: lead.formId,
+            code,
+        });
+        return { status: "failed", ...counted };
+    }
+}
+/**
+ * Brings one lead in, from Meta's webhook (forwarded by the control plane to
+ * `/rastro/meta/leadgen`). Idempotent on the leadgen id; a lead that cannot
+ * come in now (no handler, a stopped Page) is left for the reconciliation.
+ */
+export const ingestFormLead = internalAction({
+    args: { pageId: v.string(), leadgenId: v.string() },
+    returns: v.object({ status: v.string() }),
+    handler: async (ctx, args) => {
+        const job = await ctx.runQuery(internal.metaLeads.loadIngestJob, args);
+        if (job.status !== "ready") {
+            if (job.status === "handler_missing") {
+                console.warn(`[rastro] form lead ${args.leadgenId}: ${HANDLER_MISSING}`);
+            }
+            return { status: job.status };
+        }
+        let token;
+        try {
+            token = await decryptSecret(env.RASTRO_SECRETS_KEY, {
+                cipher: job.tokenCipher,
+                iv: job.tokenIv,
+            });
+        }
+        catch {
+            console.warn(`[rastro] form lead ${args.leadgenId}: SECRETS_KEY_MISSING; the reconciliation retries`);
+            return { status: "failed" };
+        }
+        const client = graph();
+        let lead;
+        try {
+            lead = await client.lead(token, args.leadgenId);
+        }
+        catch (error) {
+            if (!(error instanceof MetaGraphError))
+                throw error;
+            if (error.kind === "token") {
+                await ctx.runMutation(internal.metaLeads.markPageInvalid, {
+                    pageRowId: job.pageRowId,
+                    tokenIv: job.tokenIv,
+                    message: error.message,
+                });
+            }
+            console.warn(`[rastro] Meta refused form lead ${args.leadgenId} (${error.kind}): ${error.message}`);
+            return { status: "meta_refused" };
+        }
+        if (lead.leadgenId !== args.leadgenId)
+            return { status: "failed" };
+        const outcome = await ingestLead(ctx, client, { pageId: args.pageId, token }, lead);
+        return { status: outcome.status };
+    },
+});
+/**
+ * The webhook's way in (http.ts): schedules the ingestion when the Page feeds
+ * a site here. Answers whether it did.
+ */
+export const scheduleLeadgen = internalMutation({
+    args: { pageId: v.string(), leadgenId: v.string() },
+    returns: v.object({ scheduled: v.boolean() }),
+    handler: async (ctx, args) => {
+        if (!(await linkOfPage(ctx, args.pageId)))
+            return { scheduled: false };
+        await ctx.scheduler.runAfter(0, internal.metaLeads.ingestFormLead, args);
+        return { scheduled: true };
+    },
+});
+// ---------------------------------------------------------------------------
+// Reconciliation: one scheduler chain for every linked Page.
+/** Makes sure the chain runs by `at` (starts it, or pulls it earlier). */
+export async function kickLeadsLoop(ctx, at) {
+    const state = await ctx.db
+        .query("metaLeadsLoop")
+        .withIndex("by_key", (range) => range.eq("key", "loop"))
+        .unique();
+    if (state) {
+        const job = await ctx.db.system.get("_scheduled_functions", state.jobId);
+        const alive = job?.state.kind === "pending" || job?.state.kind === "inProgress";
+        if (alive && state.scheduledFor <= at)
+            return;
+        if (job?.state.kind === "pending")
+            await ctx.scheduler.cancel(state.jobId);
+    }
+    const jobId = await ctx.scheduler.runAt(at, internal.metaLeads.loop, {});
+    if (state) {
+        await ctx.db.patch("metaLeadsLoop", state._id, { scheduledFor: at, jobId });
+    }
+    else {
+        await ctx.db.insert("metaLeadsLoop", {
+            key: "loop",
+            scheduledFor: at,
+            jobId,
+        });
+    }
+}
+/** One link of the chain: hands the due Pages to fresh runs, moves on. */
+export const loop = internalMutation({
+    args: {},
+    returns: v.null(),
+    handler: async (ctx) => {
+        const now = Date.now();
+        const due = await ctx.db
+            .query("sitePages")
+            .withIndex("by_nextReconcileAt", (range) => range.lte("nextReconcileAt", now))
+            .take(LOOP_BATCH);
+        for (const link of due) {
+            const runId = crypto.randomUUID();
+            await ctx.db.patch("sitePages", link._id, {
+                runId,
+                nextReconcileAt: now + RECONCILE_LEASE_MS,
+                ...(link.runId !== undefined
+                    ? {
+                        lastError: "RUN_TIMEOUT: the previous reconciliation did not finish",
+                    }
+                    : {}),
+            });
+            await ctx.scheduler.runAfter(0, internal.metaLeads.reconcilePage, {
+                linkId: link._id,
+                runId,
+            });
+        }
+        const state = await ctx.db
+            .query("metaLeadsLoop")
+            .withIndex("by_key", (range) => range.eq("key", "loop"))
+            .unique();
+        const next = await ctx.db
+            .query("sitePages")
+            .withIndex("by_nextReconcileAt", (range) => range.lt("nextReconcileAt", PAUSED_AT))
+            .first();
+        if (!next) {
+            if (state)
+                await ctx.db.delete("metaLeadsLoop", state._id);
+            return null;
+        }
+        const at = Math.max(next.nextReconcileAt, now + (due.length ? LOOP_STAGGER_MS : 0));
+        const jobId = await ctx.scheduler.runAt(at, internal.metaLeads.loop, {});
+        if (state) {
+            await ctx.db.patch("metaLeadsLoop", state._id, {
+                scheduledFor: at,
+                jobId,
+            });
+        }
+        else {
+            await ctx.db.insert("metaLeadsLoop", {
+                key: "loop",
+                scheduledFor: at,
+                jobId,
+            });
+        }
+        return null;
+    },
+});
+const runArgs = { linkId: v.id("sitePages"), runId: v.string() };
+const reconcileJobValidator = v.union(v.null(), v.object({
+    pageId: v.string(),
+    reconcileFrom: v.number(),
+    connectionActive: v.boolean(),
+    handlerReady: v.boolean(),
+    /** The app's subscription to the Page is to be asserted again. */
+    subscriptionDue: v.boolean(),
+    page: v.union(v.null(), v.object({
+        pageRowId: v.id("metaPages"),
+        tokenCipher: v.string(),
+        tokenIv: v.string(),
+        listed: v.boolean(),
+        leadsAllowed: v.boolean(),
+        invalid: v.boolean(),
+    })),
+}));
+export const loadReconcileJob = internalQuery({
+    args: runArgs,
+    returns: reconcileJobValidator,
+    handler: async (ctx, args) => {
+        const link = await ctx.db.get("sitePages", args.linkId);
+        if (!link || link.runId !== args.runId)
+            return null;
+        const connection = await ctx.db.get("metaConnections", link.connectionId);
+        const page = await ctx.db
+            .query("metaPages")
+            .withIndex("by_connectionId_and_pageId", (range) => range.eq("connectionId", link.connectionId).eq("pageId", link.pageId))
+            .unique();
+        return {
+            pageId: link.pageId,
+            reconcileFrom: link.reconcileFrom,
+            connectionActive: connection?.status === "active",
+            handlerReady: await handlerReady(ctx),
+            subscriptionDue: Date.now() - (link.subscriptionCheckedAt ?? link.subscribedAt ?? 0) >=
+                SUBSCRIPTION_CHECK_MS,
+            page: page
+                ? {
+                    pageRowId: page._id,
+                    tokenCipher: page.tokenCipher,
+                    tokenIv: page.tokenIv,
+                    listed: page.listed,
+                    leadsAllowed: page.leadsAllowed,
+                    invalid: page.invalidSince !== undefined,
+                }
+                : null,
+        };
+    },
+});
+export const markSubscriptionChecked = internalMutation({
+    args: { ...runArgs, at: v.number() },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const link = await ctx.db.get("sitePages", args.linkId);
+        if (!link || link.runId !== args.runId)
+            return null;
+        await ctx.db.patch("sitePages", link._id, {
+            subscriptionCheckedAt: args.at,
+        });
+        return null;
+    },
+});
+/** The Page's active forms with where the run reads each from (seconds). */
+export const reconcileForms = internalQuery({
+    args: runArgs,
+    returns: v.array(v.object({ formId: v.string(), sinceSec: v.number() })),
+    handler: async (ctx, args) => {
+        const link = await ctx.db.get("sitePages", args.linkId);
+        if (!link || link.runId !== args.runId)
+            return [];
+        const rows = await ctx.db
+            .query("metaForms")
+            .withIndex("by_pageId_and_status", (range) => range.eq("pageId", link.pageId).eq("status", "ACTIVE"))
+            .take(MAX_FORMS_PER_PAGE);
+        const from = Math.floor(link.reconcileFrom / 1000);
+        return rows.map((form) => ({
+            formId: form.formId,
+            sinceSec: form.cursor?.linkId === link._id
+                ? Math.max(form.cursor.sec, from)
+                : from,
+        }));
+    },
+});
+export const saveCursor = internalMutation({
+    args: { ...runArgs, formId: v.string(), sec: v.number() },
+    returns: v.object({ stop: v.boolean() }),
+    handler: async (ctx, args) => {
+        const link = await ctx.db.get("sitePages", args.linkId);
+        if (!link || link.runId !== args.runId)
+            return { stop: true };
+        const form = await ctx.db
+            .query("metaForms")
+            .withIndex("by_formId", (range) => range.eq("formId", args.formId))
+            .first();
+        if (!form || form.pageId !== link.pageId)
+            return { stop: false };
+        const current = form.cursor?.linkId === link._id ? form.cursor.sec : 0;
+        if (args.sec > current) {
+            await ctx.db.patch("metaForms", form._id, {
+                cursor: { linkId: link._id, sec: args.sec },
+            });
+        }
+        return { stop: false };
+    },
+});
+const reconcileOutcomeValidator = v.union(v.object({
+    kind: v.literal("ok"),
+    usagePct: v.number(),
+    regainMs: v.union(v.number(), v.null()),
+    /** Something worth showing that did not stop the run. */
+    note: v.union(v.string(), v.null()),
+}), v.object({
+    kind: v.union(v.literal("token"), v.literal("connection"), v.literal("granted"), v.literal("throttled"), v.literal("permission"), v.literal("other"), v.literal("key")),
+    message: v.string(),
+    regainMs: v.union(v.number(), v.null()),
+}));
+/** Records how a run ended and when the Page is read next. */
+export const finishReconcile = internalMutation({
+    args: {
+        ...runArgs,
+        startedAt: v.number(),
+        outcome: reconcileOutcomeValidator,
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const link = await ctx.db.get("sitePages", args.linkId);
+        if (!link || link.runId !== args.runId)
+            return null;
+        const now = Date.now();
+        const { outcome } = args;
+        if (outcome.kind === "ok") {
+            const busy = outcome.usagePct > USAGE_BACKOFF_PCT;
+            const next = now +
+                (busy
+                    ? Math.max(outcome.regainMs ?? 0, THROTTLE_BACKOFF_MS)
+                    : RECONCILE_INTERVAL_MS);
+            await ctx.db.patch("sitePages", link._id, {
+                runId: undefined,
+                failures: 0,
+                lastReconcileAt: args.startedAt,
+                lastError: outcome.note ?? (busy ? "META_RATE_LIMITED: backing off" : undefined),
+                nextReconcileAt: next,
+                updatedAt: now,
+            });
+            await kickLeadsLoop(ctx, next);
+            return null;
+        }
+        const message = outcome.message.slice(0, MAX_ERROR);
+        if (outcome.kind === "token" ||
+            outcome.kind === "connection" ||
+            outcome.kind === "granted") {
+            // Stopped until a login lists the Page with a working token again.
+            await pauseLink(ctx, link, message, now);
+            return null;
+        }
+        const failures = (link.failures ?? 0) + 1;
+        const delay = outcome.kind === "throttled"
+            ? Math.max(outcome.regainMs ?? 0, THROTTLE_BACKOFF_MS)
+            : outcome.kind === "permission"
+                ? PERMISSION_RETRY_MS
+                : retryDelay(failures);
+        const code = outcome.kind === "throttled"
+            ? "META_RATE_LIMITED"
+            : outcome.kind === "key"
+                ? "SECRETS_KEY_MISSING"
+                : outcome.kind === "permission"
+                    ? "META_PERMISSION_MISSING"
+                    : "META_UNAVAILABLE";
+        const next = now + delay;
+        await ctx.db.patch("sitePages", link._id, {
+            runId: undefined,
+            failures,
+            lastError: `${code}: ${message}`.slice(0, MAX_ERROR),
+            nextReconcileAt: next,
+            updatedAt: now,
+        });
+        await kickLeadsLoop(ctx, next);
+        return null;
+    },
+});
+/**
+ * One form's leads since its cursor, in windows Meta lists completely.
+ *
+ * Meta lists a form's leads newest first and the client stops at its cap, so
+ * a capped listing (`complete: false`) holds the window's newest leads and
+ * lacks its oldest: nothing of it is trusted, the window is halved and read
+ * again. A complete window is ingested oldest first; the cursor then moves
+ * to its end (to the last lead's second for the window that reaches now, so
+ * a lead Meta lists late in that second is still read). The cursor never
+ * moves over a lead that failed and was not given up on: the leads after it
+ * are still ingested, and skipped by their leadgen id when read again.
+ */
+async function reconcileForm(ctx, read) {
+    let since = read.sinceSec;
+    // How many seconds the next listing spans; null reads up to now.
+    let width = null;
+    // A note of an earlier window of this run (a lead given up on).
+    let shown = null;
+    for (let fetches = 0; fetches < MAX_FORM_FETCHES; fetches += 1) {
+        const nowSec = Math.floor(Date.now() / 1000);
+        const until = width !== null && since + width <= nowSec ? since + width : null;
+        // `> since - 1`: a lead in the cursor's own second is read again, and
+        // skipped by its leadgen id if it is in.
+        const result = await read.client.formLeads(read.token, read.formId, since - 1, until ?? undefined);
+        read.track(result.usage);
+        if (!result.complete) {
+            const span = (until ?? nowSec + 1) - since;
+            if (span <= 1) {
+                return {
+                    kind: "done",
+                    note: "META_TRUNCATED: Meta listed more leads in one second than one read holds; the cursor holds",
+                };
+            }
+            width = Math.max(1, Math.floor(span / 2));
+            continue;
+        }
+        const leads = result.leads
+            .filter((lead) => lead.createdTime >= read.reconcileFrom &&
+            (until === null || lead.createdTime < until * 1000))
+            .sort((left, right) => left.createdTime - right.createdTime);
+        const outcomes = [];
+        let handlerMissing = false;
+        for (const lead of leads) {
+            const outcome = await ingestLead(ctx, read.client, { pageId: read.pageId, token: read.token }, lead.formId ? lead : { ...lead, formId: read.formId });
+            if (outcome.status === "unlinked")
+                return { kind: "unlinked" };
+            if (outcome.status === "handler_missing") {
+                handlerMissing = true;
+                break;
+            }
+            outcomes.push({
+                leadgenId: lead.leadgenId,
+                sec: Math.floor(lead.createdTime / 1000),
+                outcome,
+            });
+        }
+        // A failing lead with a later one of its form in (now or before) is the
+        // lead's problem, not an outage: after MAX_LEAD_ATTEMPTS it is given up
+        // on. While the later leads fail too (the host's CRM is down), every one
+        // is held, however long it takes.
+        let lastIn = -1;
+        outcomes.forEach((row, index) => {
+            if (row.outcome.status === "ingested" ||
+                row.outcome.status === "duplicate")
+                lastIn = index;
+        });
+        let cursor = since;
+        let held = null;
+        const givenUp = [];
+        for (const [index, row] of outcomes.entries()) {
+            const { status, attempts, skipped } = row.outcome;
+            if (status === "failed") {
+                if (skipped || (lastIn > index && attempts >= MAX_LEAD_ATTEMPTS)) {
+                    if (!skipped)
+                        givenUp.push(row.leadgenId);
+                    cursor = Math.max(cursor, row.sec);
+                    continue;
+                }
+                held = { attempts };
+                break;
+            }
+            cursor = Math.max(cursor, row.sec);
+        }
+        let note = null;
+        if (givenUp.length > 0) {
+            await ctx.runMutation(internal.metaLeads.skipFailedLeads, {
+                leadgenIds: givenUp,
+            });
+            for (const leadgenId of givenUp) {
+                console.error(`[rastro] form lead ${leadgenId} of form ${read.formId}: skipped after ${MAX_LEAD_ATTEMPTS} failed attempts (formLeadFailures)`);
+            }
+            note = `HANDLER_GAVE_UP: ${givenUp.length} form lead(s) skipped after ${MAX_LEAD_ATTEMPTS} failed attempts (first: ${givenUp[0]})`;
+        }
+        const stopped = handlerMissing || held !== null;
+        if (handlerMissing)
+            note = HANDLER_MISSING;
+        else if (held !== null) {
+            note = `HANDLER_FAILED: a form lead did not come in (${held.attempts} attempt(s)); it is read again next run`;
+        }
+        const next = stopped || until === null ? cursor : until;
+        if (next > read.sinceSec) {
+            const saved = await ctx.runMutation(internal.metaLeads.saveCursor, { ...read.run, formId: read.formId, sec: next });
+            if (saved.stop)
+                return { kind: "stop" };
+        }
+        if (stopped || until === null)
+            return { kind: "done", note: note ?? shown };
+        // Caught up to the window's end: the next one from there, wider.
+        since = until;
+        width = Math.max(1, (width ?? 1) * 2);
+        // Keep reading, but remember what to show.
+        if (note !== null)
+            shown = note;
+    }
+    return {
+        kind: "done",
+        note: shown ??
+            "META_TRUNCATED: a form has more leads than one run reads; the next run goes on from here",
+    };
+}
+/**
+ * One reconciliation run of a Page: its forms read again (new ones show up
+ * by themselves), then each active form's leads since its cursor, oldest
+ * first, in windows Meta lists completely (`reconcileForm`), through the
+ * same ingestion as the webhook. A lead that cannot come in now (the handler
+ * threw, or is missing) holds its form's cursor there, so it is read again
+ * next run, until it is given up on (MAX_LEAD_ATTEMPTS); leads already in
+ * are skipped by their leadgen id.
+ */
+export const reconcilePage = internalAction({
+    args: runArgs,
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const startedAt = Date.now();
+        const job = await ctx.runQuery(internal.metaLeads.loadReconcileJob, args);
+        if (!job)
+            return null;
+        const finish = (outcome) => ctx.runMutation(internal.metaLeads.finishReconcile, {
+            ...args,
+            startedAt,
+            outcome,
+        });
+        if (!job.connectionActive) {
+            await finish({
+                kind: "connection",
+                message: "META_TOKEN_INVALID: the Meta connection's token was refused; connect again",
+                regainMs: null,
+            });
+            return null;
+        }
+        if (!job.page || !job.page.listed) {
+            await finish({
+                kind: "granted",
+                message: PAGE_NOT_GRANTED,
+                regainMs: null,
+            });
+            return null;
+        }
+        if (job.page.invalid) {
+            await finish({
+                kind: "token",
+                message: "META_TOKEN_INVALID: Meta refused the Page token; connect again",
+                regainMs: null,
+            });
+            return null;
+        }
+        if (!job.page.leadsAllowed) {
+            await finish({
+                kind: "granted",
+                message: LEADS_NOT_ALLOWED,
+                regainMs: null,
+            });
+            return null;
+        }
+        let token;
+        try {
+            token = await decryptSecret(env.RASTRO_SECRETS_KEY, {
+                cipher: job.page.tokenCipher,
+                iv: job.page.tokenIv,
+            });
+        }
+        catch {
+            await finish({
+                kind: "key",
+                message: "RASTRO_SECRETS_KEY is missing or not the one the Page token was sealed with",
+                regainMs: null,
+            });
+            return null;
+        }
+        const client = graph();
+        let usage = { pct: 0, regainMs: null };
+        const track = (next) => {
+            usage = {
+                pct: Math.max(usage.pct, next.pct),
+                regainMs: Math.max(usage.regainMs ?? 0, next.regainMs ?? 0) || null,
+            };
+        };
+        let note = null;
+        try {
+            if (job.subscriptionDue) {
+                // Idempotent; a refusal is handled below like any other Graph one.
+                await client.subscribePage(token, job.pageId);
+                await ctx.runMutation(internal.metaLeads.markSubscriptionChecked, {
+                    ...args,
+                    at: Date.now(),
+                });
+            }
+            const listed = await client.leadForms(token, job.pageId);
+            track(listed.usage);
+            await ctx.runMutation(internal.metaLeads.saveForms, {
+                pageId: job.pageId,
+                forms: toFormArgs(listed.forms),
+                complete: listed.complete,
+            });
+            if (!job.handlerReady) {
+                // Nothing can come in without the host's handler: Meta is not asked
+                // for leads until one is registered.
+                await finish({
+                    kind: "ok",
+                    usagePct: usage.pct,
+                    regainMs: usage.regainMs,
+                    note: HANDLER_MISSING,
+                });
+                return null;
+            }
+            const targets = await ctx.runQuery(internal.metaLeads.reconcileForms, args);
+            for (const target of targets) {
+                const read = await reconcileForm(ctx, {
+                    run: args,
+                    client,
+                    token,
+                    pageId: job.pageId,
+                    reconcileFrom: job.reconcileFrom,
+                    formId: target.formId,
+                    sinceSec: target.sinceSec,
+                    track,
+                });
+                if (read.kind === "unlinked") {
+                    await finish({
+                        kind: "ok",
+                        usagePct: usage.pct,
+                        regainMs: null,
+                        note: null,
+                    });
+                    return null;
+                }
+                if (read.kind === "stop")
+                    return null;
+                if (read.note !== null)
+                    note = read.note;
+            }
+            await finish({
+                kind: "ok",
+                usagePct: usage.pct,
+                regainMs: usage.regainMs,
+                note,
+            });
+        }
+        catch (error) {
+            if (error instanceof MetaGraphError) {
+                if (error.kind === "token") {
+                    await ctx.runMutation(internal.metaLeads.markPageInvalid, {
+                        pageRowId: job.page.pageRowId,
+                        tokenIv: job.page.tokenIv,
+                        message: error.message,
+                    });
+                }
+                await finish({
+                    kind: error.kind === "app" ? "other" : error.kind,
+                    message: error.kind === "token"
+                        ? `META_TOKEN_INVALID: ${error.message}`
+                        : error.message,
+                    regainMs: error.regainMs ?? usage.regainMs,
+                });
+            }
+            else {
+                await finish({
+                    kind: "other",
+                    message: error instanceof Error ? error.message : "reconciliation failed",
+                    regainMs: null,
+                });
+            }
+        }
+        return null;
+    },
+});
+// ---------------------------------------------------------------------------
+// Report.
+function validateSites(siteIds) {
+    const unique = [...new Set(siteIds)];
+    if (unique.length < 1 ||
+        unique.length > MAX_REPORT_SITES ||
+        unique.length !== siteIds.length) {
+        fail("INVALID_ARGUMENT", `siteIds must contain 1-${MAX_REPORT_SITES} unique IDs`);
+    }
+    return unique;
+}
+/**
+ * Per form, over the cohort days in the range: its leads, qualified, sales
+ * and revenue (from the lead rollups), and where its rules sent the leads
+ * (columns, the host's entry, discards by reason, the ones sent back).
+ */
+export const formsReport = query({
+    args: { siteIds: v.array(v.id("sites")), from: v.number(), to: v.number() },
+    returns: formsReportValidator,
+    handler: async (ctx, args) => {
+        const siteIds = validateSites(args.siteIds);
+        if (!Number.isSafeInteger(args.from) ||
+            !Number.isSafeInteger(args.to) ||
+            args.from < 0 ||
+            args.to < args.from ||
+            args.to - args.from >= MAX_REPORT_RANGE_DAYS * DAY_MS) {
+            fail("INVALID_ARGUMENT", `range must use inclusive integer milliseconds and span at most ${MAX_REPORT_RANGE_DAYS} UTC days`);
+        }
+        const first = dayOf(args.from);
+        let budget = MAX_LEAD_REPORT_ROWS;
+        let partial = false;
+        const entries = new Map();
+        const entryOf = (siteId, formId, pageId) => {
+            const key = `${siteId}:${formId}`;
+            let entry = entries.get(key);
+            if (!entry) {
+                entry = {
+                    siteId,
+                    pageId,
+                    formId,
+                    leads: 0,
+                    qualified: 0,
+                    won: 0,
+                    revenueCents: 0,
+                    columns: new Map(),
+                    entry: 0,
+                    discarded: new Map(),
+                    returned: 0,
+                };
+                entries.set(key, entry);
+            }
+            return entry;
+        };
+        for (const siteId of siteIds) {
+            await requireSite(ctx, siteId);
+            const rollups = await ctx.db
+                .query("leadDailyRollups")
+                .withIndex("by_siteId_and_dimension_and_dayStart_and_key", (range) => range
+                .eq("siteId", siteId)
+                .eq("dimension", "form")
+                .gte("dayStart", first)
+                .lte("dayStart", args.to))
+                .take(budget + 1);
+            if (rollups.length > budget) {
+                fail("REPORT_INCOMPLETE", "forms report exceeds its row budget", {
+                    maximumRows: MAX_LEAD_REPORT_ROWS,
+                });
+            }
+            budget -= rollups.length;
+            const rows = await ctx.db
+                .query("formLeads")
+                .withIndex("by_siteId_and_receivedAt", (range) => range
+                .eq("siteId", siteId)
+                .gte("receivedAt", first)
+                .lte("receivedAt", args.to))
+                .take(budget + 1);
+            if (rows.length > budget)
+                partial = true;
+            const counted = rows.slice(0, budget);
+            budget -= counted.length;
+            for (const row of counted) {
+                const entry = entryOf(siteId, row.formId, row.pageId);
+                if (row.returned)
+                    entry.returned += 1;
+                if ("discard" in row.decision) {
+                    const reason = row.decision.discard;
+                    entry.discarded.set(reason, (entry.discarded.get(reason) ?? 0) + 1);
+                }
+                else if (row.decision.column === null) {
+                    entry.entry += 1;
+                }
+                else {
+                    const column = row.decision.column;
+                    entry.columns.set(column, (entry.columns.get(column) ?? 0) + 1);
+                }
+            }
+            for (const row of rollups) {
+                const existing = entries.get(`${siteId}:${row.key}`);
+                const entry = existing ??
+                    entryOf(siteId, row.key, (await ctx.db
+                        .query("metaForms")
+                        .withIndex("by_formId", (range) => range.eq("formId", row.key))
+                        .first())?.pageId ?? "");
+                entry.leads += row.leads;
+                entry.qualified += row.qualified;
+                entry.won += row.won;
+                entry.revenueCents += row.revenueCents;
+            }
+        }
+        const forms = [];
+        for (const entry of entries.values()) {
+            // Removed leads leave zeroed rollups and no decisions behind.
+            if (entry.leads === 0 &&
+                entry.columns.size === 0 &&
+                entry.discarded.size === 0 &&
+                entry.entry === 0) {
+                continue;
+            }
+            const form = await ctx.db
+                .query("metaForms")
+                .withIndex("by_formId", (range) => range.eq("formId", entry.formId))
+                .first();
+            forms.push({
+                siteId: entry.siteId,
+                pageId: entry.pageId || form?.pageId || "",
+                formId: entry.formId,
+                name: form?.name ?? null,
+                leads: entry.leads,
+                qualified: entry.qualified,
+                won: entry.won,
+                revenueCents: entry.revenueCents,
+                columns: [...entry.columns].map(([column, leads]) => ({
+                    column,
+                    leads,
+                })),
+                entry: entry.entry,
+                discarded: [...entry.discarded].map(([reason, leads]) => ({
+                    reason,
+                    leads,
+                })),
+                returned: entry.returned,
+            });
+        }
+        forms.sort((left, right) => right.leads - left.leads || left.formId.localeCompare(right.formId));
+        return { forms, partial };
+    },
+});
+//# sourceMappingURL=metaLeads.js.map