indiecrm-cli 0.1.0 → 0.2.1

package/RESEARCH.md

@@ -0,0 +1,346 @@
+# Research commands inherited from Salesprompter
+
+The commands below are included in `indiecrm-cli`. They still use Salesprompter accounts, workspaces, and research services. Run `indiecrm auth:login` to sign in for research. IndieCRM CRM commands use a separate `indiecrm login` session. This distinction also applies to existing saved checkpoints and organization IDs.
+
+Requires Node.js 22.12 or newer (Node.js 24 LTS recommended). Chrome research also requires an installed Google Chrome.
+
+The IndieCRM CLI preserves the Salesprompter terminal workflow for lead generation, enrichment, scoring, and sync.
+
+It helps operators and agents go from company, market, or product input to qualified outbound-ready leads with a product-facing command surface and machine-readable output.
+
+## Install
+
+```bash
+npm install -g indiecrm-cli
+```
+
+or run directly:
+
+```bash
+npx -y indiecrm-cli@latest
+```
+
+## Quickstart
+
+```bash
+# Run first-time setup
+indiecrm setup
+
+# Run a local health check
+indiecrm doctor
+
+# Sign in from the CLI
+indiecrm auth:login
+
+# Verify your session
+indiecrm auth:whoami
+```
+
+New here? Create your account at `https://salesprompter.ai/sign-up`, then run `indiecrm auth:login`.
+
+For headless or automation use, generate a CLI token in the app and run `indiecrm auth:login --token <token>`.
+
+## What it does
+
+### Contacts at a named list of companies
+
+`leads:at-companies` researches Director, Head-of, VP and C-level contacts across functions. It exports a shortlist for review without starting email enrichment or outreach.
+
+Start with company names; no LinkedIn IDs are needed in your brief:
+
+```json
+{ "companies": [{ "name": "Your target company", "maxContacts": 20 }] }
+```
+
+```bash
+indiecrm auth:login
+indiecrm browser:connect
+indiecrm leads:at-companies --brief companies.json --out-dir ./research --resolve-companies --all
+```
+
+After a successful connection, Chrome is remembered for company research. If names are ambiguous, an interactive terminal shows verified candidate locations, websites and evidence links. Choose a number, then confirm; nothing is preselected. The CLI saves the decision and resumes without editing your brief. Use `--review` to review a saved ambiguity later. Enter 0 or press Enter to leave it unresolved.
+
+JSON, quiet and non-interactive runs never prompt. Their `outcome` is `complete`, `incomplete` or `needs_review`; `nextCommand` gives the terminal command for pending collection or identity review. `collectionComplete` refers only to collection, so it can be true while role review remains. Add `--require-complete` for exit code 2 whenever collection or review is unfinished. Without it, exit 0 means the command ran, not that all research is complete. `--no-interactive` disables prompts in a terminal too.
+
+Guided review fetches native details for at most ten exact-name candidates. Non-exact, composite or larger identity choices still need independently checked `--review-file` decisions. Missing/mismatched details cannot be approved. Explicit connection flags override the remembered choice; failed Chrome authentication never falls back silently to another identity.
+
+The checkpoint, shortlist and review exports refresh after every collected page, so long runs expose saved progress immediately. Company labels with punctuation, such as `(TKMS)`, are escaped safely in search queries.
+
+Use `--report-only` to refresh saved reports without contacting LinkedIn. The workspace-bound checkpoint is still checked. `progress` separates unique shortlisted people, review rows, review people, review-only people, pending searches, partial/unknown coverage and unresolved companies. `collectionComplete` is false while any coverage gap remains; `nextActions` explains what is left. Unrestricted geography is labeled explicitly.
+
+### Recover saved research without recollecting
+
+Version 0.1.83 separates collection evidence from review decisions. Keep the original brief and output directory:
+
+```bash
+# Recheck saved roles and write an actionable recovery.json; no LinkedIn requests.
+indiecrm leads:at-companies --brief companies.json --out-dir ./research --report-only
+# Verify canonical employer names against native company details for selected targets.
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --browser chrome --verify-employers --company 'Example (CH)'
+# Continue partial searches until company shortlist ceilings are filled.
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --browser chrome --continue-partial quota --all
+# Or request all accessible pages for one exact brief company name.
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --browser chrome --continue-partial exhaustive --company 'Example (CH)'
+```
+
+`--company` is repeatable and limits network work, not the overall report. `--verify-employers` checks scoped employers with saved candidates and caches their canonical-name evidence. Only equivalent presentation/legal-suffix names (for example, `BioNTech` / `BioNTech SE`) qualify automatically; group, division and subsidiary differences still require review. The exact numeric current-employer ID check always applies.
+
+`recovery.json` contains alias proposals, identity-search attempts and candidate evidence, explicit unresolved reasons, and a fingerprint-bound review template. Proposals are **not** approvals. Copy its `reviewFileTemplate` into a private JSON file and add only independently verified decisions:
+
+```json
+{
+  "fingerprint": "COPY_THE_64_CHARACTER_FINGERPRINT_FROM_RECOVERY_JSON",
+  "employerAliases": [
+    { "companyId": "123", "name": "Exact source name", "evidenceUrl": "https://official.example/evidence" }
+  ],
+  "identities": [
+    { "targetName": "Exact name in brief", "companyId": "456", "canonicalName": "Verified source name", "evidenceUrl": "https://official.example/evidence" }
+  ]
+}
+```
+
+```bash
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --review-file ./verified-decisions.json --report-only
+# Then collect any newly resolved identities through the same checkpoint.
+indiecrm leads:at-companies --brief companies.json --out-dir ./research --browser chrome --all
+```
+
+The CLI validates and persists the complete review file as `review-decisions.json`, checks its workspace/brief fingerprint, and rejects conflicting/shared identities. Supplied evidence URLs record human decisions; their contents are not independently verified by `--review-file`. Later runs reuse the decisions. An alias never approves an ambiguous role. For a new collection, `verifiedEmployerAliases` in the company brief remains supported; changing the original targeting brief still requires a new output directory.
+
+Partial continuation checkpoints the raw next offset and deduplicates people. Old checkpoints without an offset replay the first page once before advancing. `quota` stops at the shortlist ceiling; `exhaustive` means attempting the accessible 2,500-result window, **not** a promise of exhaustive coverage. Count changes, empty/repeated pages and larger result sets remain explicitly incomplete. Stopped searches require investigation; the CLI does not automatically clear `stoppedReason`. `--all` controls the number of jobs, not these safety limits. Make a private copy of the output directory before comparing old and new role-policy results.
+
+For standalone browser research, sign in once to the CLI-owned Chrome profile:
+
+```bash
+indiecrm browser:connect
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --resolve-companies --all
+```
+
+`browser:connect` opens a separate Chrome window and waits up to ten minutes for your manual Sales Navigator sign-in (change with `--wait <seconds>`). It confirms a successful native authenticated request, then closes its own browser. Google Chrome must be installed. The private profile lives at `~/.config/salesprompter/chrome-research` (or under `SALESPROMPTER_CONFIG_DIR`). Your everyday Chrome profile stays untouched. The control connection uses a private OS pipe, not a debugging port. No cookies or browser storage are read/exported. The CLI keeps only allowlisted native request headers in memory.
+
+Research runs reuse that profile in background Chrome, execute the GET requests themselves, and close their own browser when finished. No Codex task, relay worker, extension, or manual request polling is needed. A first sign-in, expired login, or security challenge still requires you: rerun `browser:connect`, then repeat the research command with the same output directory. Rate limits stop immediately without switching accounts. `--browser chrome`, `--browser-relay-port`, and `--wait-for-session` are mutually exclusive. Chrome connects lazily, so completed checkpoints and report-only runs never launch it.
+
+`browser:connect` remembers Chrome only after confirming a successful authenticated request. `browser:connect --check` checks an existing sign-in in background and also remembers it; it does not open a sign-in window. The preference is private and scoped to the CLI configuration directory. Explicit `--browser session` selects extension credentials; without a remembered choice, session remains the fallback. Explicit relay/wait flags take precedence over the preference. Credentials load only for pending requests; on an auth failure the session route tries changed credentials for the same identity once. Add `--wait-for-session 300` for a bounded refresh wait. The optional Codex `--browser-relay-port` route still needs its external worker. Salesprompter workspace authentication applies in every mode.
+
+Ctrl+C, SIGTERM and terminal hangup stop Chrome research gracefully: completed searches stay saved, the owned browser closes, and the research lock is released before exit. Repeat the same command to resume only pending work. A forced kill or power loss cannot run cleanup; if a stale lock remains, confirm that its process stopped before removing only `.research-lock` as the CLI error explains.
+
+Create a JSON brief with company names or verified numeric LinkedIn company IDs. Use `--resolve-companies` for names. Each subsidiary must resolve to its own ID; unresolved identities stay in the coverage report and are never guessed.
+
+For a name-only list, the executable end-to-end research mode is:
+
+```bash
+indiecrm leads:at-companies --brief companies.json --out-dir ./research --resolve-companies --all
+```
+
+The CLI first collects prepared IDs, then resolves missing IDs through paginated Account Search and immediately collects their contacts. It tries up to three name queries, normalizing only presentation/legal-suffix differences. Automatic resolution requires a unique matching identity in a complete result set of at most 1,000 companies plus matching native company-detail evidence. Fuzzy, shared-ID, oversized, ambiguous and composite parent/subsidiary targets remain unresolved with diagnostics in `recovery.json`. Resolutions and misses are saved in the workspace-bound checkpoint and `company-resolutions.json`, without editing the input brief. Repeat the command to resume. Add `--retry-unresolved --resolve-companies` to intentionally retry saved identity misses without repeating successful work; add `--company` to narrow the retry. `--all` removes the invocation's job-count limit, not LinkedIn pacing or per-function candidate limits. A working LinkedIn session is required for new requests; use `--browser chrome` to eliminate the external browser-worker dependency.
+
+```bash
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --resolve-companies --retry-unresolved --all --wait-for-session 300
+```
+
+```json
+{
+  "companies": [
+    { "name": "Your target company", "companyId": "123", "maxContacts": 20 },
+    { "name": "Company awaiting identity review", "maxContacts": 10 }
+  ],
+  "candidatesPerDepartment": 50
+}
+```
+
+```bash
+indiecrm leads:at-companies --brief companies.json --dry-run
+indiecrm leads:at-companies --brief companies.json --out-dir ./company-research
+# Repeat to resume the next batch; completed searches are reused.
+indiecrm leads:at-companies --brief companies.json --out-dir ./company-research
+```
+
+The default six functions are Digital Marketing & CRM, Digital Product & UX, Software Development, IT, Data & AI, and HR. Override them with `departments: [{ "name": "Security", "terms": ["security", "ciso"] }]`. Optional `regionIds` applies explicit Sales Navigator geography filters; no country is inferred from a company name or headquarters.
+
+Contacts must match the current company ID, a senior title and the requested function. Selection alternates between functions, deduplicates profile URLs and never pads a company to its ceiling. The default ceiling is 20; each company can override it. Head-of roles classified as experienced managers are searched, but generic manager titles do not pass the final seniority check.
+
+Default role matching includes talent acquisition, business intelligence, digital workplace and German department-head titles. Role policy 2 requires software-specific context for Software Development and digital/UX context for Digital Product & UX; generic engineering, physical-vehicle product roles and technical flight/hydraulic data do not automatically qualify. Broad digital/transformation, communications and operational-technology matches go into `review.csv`, not the selected contacts. Mixed-role headlines cannot borrow seniority from an assistant or former role. Current-position evidence overrides a conflicting summary employer or headline. Reports include `rolePolicyVersion`; review rows retain every applicable `reasons` entry as well as the primary `reason`.
+
+The export retains the source employer name and accepted alias evidence. Unverified employer-name differences go to review: verify equivalent canonical names with `--verify-employers`, or supply an evidence-backed review decision for non-equivalent names. Parent/subsidiary scope is never inferred.
+
+For custom functions, add `reviewTerms` (a subset of `terms`) for discovery terms that should require manual review: `{"name":"IT","terms":["it","digital"],"reviewTerms":["digital"]}`. A specific non-review term in the same senior-role clause can qualify a contact.
+
+Outputs are private local `contacts.csv`, `review.csv`, `coverage.json` (including review candidates, rejected/unresolved matches and per-function counts), `recovery.json`, `company-resolutions.json`, and `checkpoint.json`. Review counts are candidate/function pairs, not additional unique leads. A completed search batch is not exhaustive coverage: ordinary collection stops at `candidatesPerDepartment`; use `--continue-partial` explicitly to advance. The report records LinkedIn's reported total and any shortfall. Default `--max-searches 12` bounds collection jobs and resolution attempts; employer-detail verification is scoped separately with `--company`. Increase job limits explicitly for larger batches. HTTP 429/999 stops the run and preserves saved pages; resume only after cooldown.
+
+Live research requires Salesprompter workspace login and a LinkedIn session. `--browser-relay-port` uses the existing signed-in browser relay. Checkpoints are bound to both the brief and workspace; changed criteria require a new output directory. A concurrent run is refused; after a crash, remove only `.research-lock` after confirming the process stopped. This command does not import the shortlist into the workspace, find emails, or create campaigns. Review company identity, role fit and coverage before downstream use.
+
+- guided setup and auth
+- product and market discovery
+- Sales Navigator search orchestration
+- affiliate audience campaigns from affiliate links and LinkedIn searches
+- contact and company enrichment
+- email-enrichment batch preparation
+- scored-lead sync into downstream systems
+
+## Common commands
+
+```bash
+# Start the guided workflow
+indiecrm wizard
+
+# Show machine-readable output
+indiecrm --json auth:whoami
+
+# Resolve profile URLs for a pasted contact list
+indiecrm contacts:find-linkedin-urls --in ./contacts.tsv --out ./contacts.enriched.json
+
+# Resolve LinkedIn company URLs for a pasted company list
+indiecrm companies:resolve-linkedin-urls --in ./companies.txt --out ./companies.enriched.json
+
+# Build and start email enrichment from pasted company/contact rows
+# When authenticated, Salesprompter first enriches company domains in the app, then the CLI builds the email batch.
+indiecrm contacts:resolve-emails --in ./contacts.tsv --out-dir ./email-run --dry-run
+
+# Collect a Sales Navigator people search into the active workspace
+# Normal people searches use 2,500-result slices; Connections-of searches use 1,000.
+# Oversized searches split by company headcount and deduplicate by canonical profile URL.
+# LinkedIn headline drift is retained as metadata after the complete partition is proven.
+# Exhaustive runs resume completed slices automatically after interruptions or rate limits.
+indiecrm leads:collect \
+  --linkedin-url "$SALES_NAV_PEOPLE_URL"
+
+# For large discovery runs, store the leads now and enrich selected imports later
+indiecrm leads:collect \
+  --linkedin-url "$SALES_NAV_PEOPLE_URL" \
+  --defer-email-enrichment
+
+# Enrich one or more stored imports: Sales Navigator company -> official domain -> Hunter email
+# This updates workspace data only. It does not create or start outreach.
+# Stale ids and raw legal-name misses use conservative exact-name recovery.
+# Hunter prefers official domains and can fall back to the exact company name.
+indiecrm leads:enrich-import \
+  --run-id "$CLI_IMPORT_RUN_ID"
+
+indiecrm affiliate:launch \
+  --affiliate-link "https://example.com/?ref=you" \
+  --linkedin-url "https://www.linkedin.com/sales/search/people?query=..." \
+  --max-results 100 \
+  --dry-run
+
+# Collect a Sales Navigator people audience locally and create its campaign page
+indiecrm affiliate:launch \
+  --affiliate-link "https://example.com/?ref=you" \
+  --linkedin-url "https://www.linkedin.com/sales/search/people?query=..." \
+  --max-results 100
+
+# End to end: collect, exclude customers, deduplicate, verify, enrich, and create a draft
+indiecrm affiliate:grow \
+  --affiliate-link "https://example.com/?ref=you" \
+  --linkedin-url "https://www.linkedin.com/sales/search/people?query=..." \
+  --max-results 100 \
+  --seed-profile "https://www.linkedin.com/in/existing-customer" \
+  --steps 3 \
+  --timing-mode custom \
+  --daily-limit 25 \
+  --send-from 09:00 \
+  --send-to 16:00
+
+# Verify live campaign state, lead safety, and contact activity, then activate explicitly
+indiecrm affiliate:list
+indiecrm affiliate:status "$AFFILIATE_RUN_ID"
+indiecrm affiliate:finish "$AFFILIATE_RUN_ID"
+indiecrm affiliate:analytics "$AFFILIATE_RUN_ID"
+indiecrm affiliate:regenerate-sequence "$AFFILIATE_RUN_ID"
+indiecrm affiliate:enrich "$AFFILIATE_RUN_ID"
+indiecrm affiliate:enrich "$AFFILIATE_RUN_ID" \
+  --source-audience-run-id "$NEW_AUDIENCE_RUN_ID"
+indiecrm affiliate:activate "$AFFILIATE_RUN_ID"
+
+# See included capability packs
+indiecrm packs:list
+
+# Explore the full command surface
+indiecrm --help
+```
+
+Collect an exact signed-in LinkedIn product-search order locally, without uploading it:
+
+```bash
+indiecrm products:collect \
+  --query-url "$LINKEDIN_PRODUCTS_URL" \
+  --checkpoint ./data/products.checkpoint.json \
+  --raw-jsonl ./data/products.raw.jsonl \
+  --out ./data/products.complete.json \
+  --relay-port 43117
+```
+
+Use a signed-in in-app-browser worker with the loopback `GET /task` and `POST /page` protocol. Interrupted, bounded, challenged, or rate-limited runs remain checkpointed and do not create the complete artifact.
+
+Enrich that proven order with public product-page details, without changing its ranks or uploading it:
+
+```bash
+indiecrm products:collect-details \
+  --catalog ./data/products.complete.json \
+  --checkpoint ./data/products.details.checkpoint.json \
+  --raw-jsonl ./data/products.details.raw.jsonl \
+  --out ./data/products.with-details.json \
+  --relay-port 43118
+```
+
+The detail worker uses the same local `GET /task` lease protocol and posts only allowlisted product fields to `POST /detail`. Public URLs must be HTTPS; product images are capped at 2,048 characters, other URLs at 4,096, descriptions at 10,000, other strings at 200, roles/features at 100 entries, and customer companies at 50. The final artifact is created only after every rank has either a complete detail page or explicit unavailable-page proof.
+
+Download stored workspace leads without starting a new Sales Navigator scrape:
+
+```bash
+indiecrm leads:download --out ./salesprompter-leads.csv
+indiecrm leads:download --run-id <uuid> --emails-only --out ./run-leads.csv
+```
+
+Use `--search <value>` to match a person, title, or company. The command uses the
+active Salesprompter workspace and downloads the same filtered data available in
+the app's CLI imports view.
+
+## Output modes
+
+- `--json` for machine-readable output
+- `--quiet` to suppress successful payload output
+
+## Notes
+
+- Use your own authorized data access and workspace credentials.
+- Respect provider terms and customer data boundaries.
+- `affiliate:grow` is an alias for `affiliate:run`. It excludes repeated `--seed-profile` customers, removes profiles already stored in prior workspace affiliate audiences, and verifies the final persisted count before preparing Instantly.
+- If every collected profile is known or excluded, no audience or Instantly campaign is created. A stale Sales Navigator session also fails before persistence with a safe retry instruction.
+- Affiliate outreach uses Hunter first, requires Hunter's `valid` verdict before import, and sends recovered addresses through Hunter Email Verifier before creating a draft Instantly campaign. Catch-all, disposable, webmail, invalid, unknown, claimed, and unresolved addresses are excluded. Instantly verification remains enabled as a second gate.
+- Affiliate preparation uses exactly three emails with three observable variants per step; `affiliate:regenerate-sequence` rebuilds and syncs them through the Salesprompter app.
+- For reviewed Gojiberry copy, use `affiliate:copy <run-id> --out review.json --html preview.html`. This creates nine distinct variants without changing the campaign. Subjects, greetings, value lines, CTAs, link labels, and opt-outs use native Instantly spintax; step URLs keep their exact tracking parameters. Edit the structured `draft`, then run `--draft review.json --out reviewed.json` to validate it again. Apply only an unchanged saved review with `--apply reviewed.json`; active campaigns also require `--allow-active`. Newer Salesprompter or Instantly edits invalidate old reviews. Sending limits and audience membership are untouched.
+- The copy pack keeps a concise `(paid link)` disclosure. Wording and spintax cannot guarantee inbox delivery. Preview the actual email in Instantly, especially with plain-text sending enabled. Semantic relevance, factual claims, reading level and final mobile wrapping still need human review.
+- `affiliate:list` shows safe workspace summaries. `affiliate:analytics` shows aggregate and step/variant outcomes without exposing lead data; unsupported per-step meeting and won fields render as `n/a`.
+- `affiliate:run` defaults to `--timing-mode custom`, so its daily limit and weekday sending window are honored. Use `--timing-mode auto` only when capacity-derived scheduling is intended.
+- `affiliate:enrich` starts durable email recovery and adds only newly found addresses to an existing campaign. It returns a background-processing status for large audiences instead of blocking the terminal. Pass `--source-audience-run-id` to merge a newer compatible audience into that campaign without creating a duplicate campaign.
+- `affiliate:finish` closes the loop: it requires persisted Hunter-valid evidence for new campaigns, repairs stalled Instantly verification in 1,000-lead batches, quarantines stale pending or invalid leads outside the sending campaign, accepts an explicitly audited recovery fallback, activates only a fully verified campaign, and reads the live state back. Use `--requeue-pending` only after restoring Instantly verification capacity.
+- A draft campaign does not send until `affiliate:activate` is run.
+- The CLI is designed for interactive users and agent-assisted workflows.
+- A repo-local Chrome extension compatibility copy is available in `chrome-extension/` for local LinkedIn session sync and popup copy/debug flows.
+
+## Development
+
+```bash
+npm install
+npm run build
+npm test
+```
+
+For contribution and security processes, see:
+
+- [CONTRIBUTING.md](./CONTRIBUTING.md)
+- [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md)
+- [SECURITY.md](./SECURITY.md)
+
+## Links
+
+- Docs: https://salesprompter.ai/docs
+- App: https://salesprompter.ai
+- CLI repository: https://github.com/danielsinewe/indiecrm-cli
+- Original research source: https://github.com/danielsinewe/salesprompter-cli

package/SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are applied to the latest published CLI version.
+
+If you are reporting a vulnerability, please verify it against the latest release first when possible.
+
+## Reporting a vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues.
+
+Send reports to:
+
+- `hello@danielsinewe.com`
+
+Include:
+
+- affected version
+- reproduction steps
+- impact assessment
+- logs, screenshots, or proof of concept if available
+
+## Response expectations
+
+We aim to:
+
+- acknowledge receipt promptly
+- reproduce and assess the report
+- ship a fix or mitigation when confirmed
+- coordinate disclosure when appropriate
+
+## Sensitive data
+
+This CLI may operate on CRM data, research outputs, workspace metadata, and separate IndieCRM and Salesprompter authenticated sessions. Please avoid sending real customer data unless it is necessary to reproduce the issue.

package/dist/affiliate-copy.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+const hash = z.string().regex(/^[a-f0-9]{64}$/);
+export const AffiliateCopyReviewSchema = z.object({
+    status: z.literal("ok"),
+    applied: z.boolean(),
+    runId: z.string().uuid(),
+    campaignId: z.string(),
+    campaignName: z.string().nullable(),
+    sourceHash: hash,
+    remoteSequenceHash: hash,
+    reviewHash: hash,
+    draft: z
+        .object({ version: z.literal(1), steps: z.array(z.unknown()).length(3) })
+        .passthrough(),
+    sequence: z.array(z.unknown()).length(3),
+    previews: z
+        .array(z.object({
+        step: z.number(),
+        variant: z.string(),
+        angle: z.string(),
+        maxWords: z.number(),
+        combinations: z.number(),
+        examples: z
+            .array(z.object({
+            subject: z.string(),
+            body: z.string(),
+            html: z.string(),
+        }))
+            .min(1),
+    }))
+        .length(9),
+    warnings: z.array(z.string()),
+    sources: z.array(z.string()),
+});
+const escapeHtml = (value) => value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+/** Render escaped data, never trusted remote HTML; 360 px cards emulate a phone. */
+export function renderAffiliateCopyReview(review) {
+    return `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'"><title>Gojiberry copy review</title><style>body{font:16px/1.55 system-ui;background:#f3f5f7;color:#17222f;margin:24px}main{max-width:1200px;margin:auto}.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,360px),1fr));gap:24px}article{max-width:360px;background:white;border:1px solid #d9e1e8;border-radius:12px;padding:20px;overflow-wrap:anywhere}h1{font-size:24px}h2{font-size:18px}small{color:#536171}p{margin:0 0 20px}a{color:#17655b}summary{cursor:pointer}section{margin-top:20px}</style><main><h1>${escapeHtml(review.campaignName ?? "Affiliate copy review")}</h1><p>9 variants · native Instantly spintax · review only${review.applied ? " (this review was applied)" : " — no campaign changes"}</p><div class="grid">${review.previews
+        .map((preview) => `<article><small>STEP ${preview.step} · ${escapeHtml(preview.variant)} · ${escapeHtml(preview.angle)}</small><h2>${escapeHtml(preview.examples[0].subject)}</h2><small>Up to ${preview.maxWords} words with fallback values · ${preview.combinations.toLocaleString("en-US")} combinations</small>${preview.examples
+        .map((example, index) => `${index ? `<details><summary>${index === 1 ? "Missing-name fallback" : "Long-name sample"}</summary>` : ""}<section>${example.body
+        .split("\n\n")
+        .map((line) => {
+        const link = line.match(/^\[([^\]]+)\]\((https:\/\/[^\s]+)\) \(paid link\)$/);
+        return `<p>${link ? `<a href="${escapeHtml(link[2])}" rel="noreferrer sponsored">${escapeHtml(link[1])}</a> (paid link)` : escapeHtml(line)}</p>`;
+    })
+        .join("")}</section>${index ? "</details>" : ""}`)
+        .join("")}</article>`)
+        .join("")}</div><h2>Review notes</h2><ul>${review.warnings.map((warning) => `<li>${escapeHtml(warning)}</li>`).join("")}</ul><p>Changing this file does not change the saved JSON review. Preview edited drafts again before applying.</p></main></html>`;
+}