How I built this site, and the business system behind it.

// Verify first, write second. The duplicate check is built from fields
// inside the message, so recording an unverified message would let a forged
// one block the real one.
if (!(await verifyWebhookSignature(tap, payload, received))) {
  return json(c, { error: "bad_signature" }, 401);
}

const dedupeKey = await sha256Hex(`${payload?.id}|${payload?.status}|${payload?.transaction?.created}`);

// The same event twice is one event.
const ins = await env.DB.prepare(
  "INSERT OR IGNORE INTO webhook_events (tap_charge_id, tap_status, dedupe_key, signature_valid, processing_status) VALUES (?, ?, ?, 1, 'verified')",
).bind(String(payload?.id || ""), String(payload?.status || ""), dedupeKey).run();
if (ins.meta.changes === 0) return json(c, { ok: true, duplicate: true });

// A signature proves who sent the message, not that its body is true. The
// charge is read again from Tap, and only that answer moves any money state.
const charge = await retrieveCharge(tap, String(payload.id));
await reconcile(env, charge);

// Write it down first, then ask for the money back. If the answer is lost,
// a PENDING row still says a refund may have happened, and reconciliation
// can settle it. The retry key comes from that row, so a retry can never
// become a second refund.
const claim = await c.env.DB.prepare(
  "INSERT INTO refunds (order_id, idempotency_key, amount_minor, reason, status, created_by) VALUES (?, ?, ?, 'requested_by_customer', 'PENDING', ?)",
).bind(row.oid, `rf_claim_${crypto.randomUUID()}`, amount, actor).run();
const claimId = Number(claim.meta?.last_row_id || 0);
if (!claimId) return flash(c, "e", "تعذّر تسجيل المطالبة، ولم يُطلب أي استرداد");

const idem = `rf_${row.oid}_${claimId}`;
await c.env.DB.prepare("UPDATE refunds SET idempotency_key = ? WHERE id = ?").bind(idem, claimId).run();

try {
  rf = await createRefund(tap, { chargeId: row.cid, amountMinor: amount, reason: "requested_by_customer", idempotencyKey: idem });
} catch (e: any) {
  // "No" and "no answer" are different facts. A refusal frees the amount;
  // silence keeps the row PENDING, because the money may already have moved.
  if (e?.refused) {
    await c.env.DB.prepare("UPDATE refunds SET status = 'FAILED' WHERE id = ?").bind(claimId).run();
  }
}

// Two people press "book" on overlapping times in the same instant. Both
// rows are written; then each request re-reads the window, and the older
// claim keeps the time. The newer one cancels itself and tells the visitor.
export function slotVerdict(
  mineId: number,
  startsAt: string,
  hours: number,
  windowRows: SlotRow[],
): { overlapping: SlotRow[]; mustYield: boolean } {
  const startMs = new Date(startsAt).getTime();
  const endMs = endOf(startsAt, hours);
  const overlapping = windowRows.filter((r) =>
    r.id !== mineId && collides(startMs, endMs, new Date(r.starts_at).getTime(), endOf(r.starts_at, r.hours)),
  );
  // If we cannot identify our own row, we do not yield: destroying a real
  // booking on an uncertain fact is worse than an overlap I can see and fix.
  const mustYield = mineId > 0 && overlapping.some((r) => mineId > r.id);
  return { overlapping, mustYield };
}

// Confirming an appointment: one press wins. The status change and the
// client's confirmation email are committed together, so a confirmed
// booking has always told the client, and a second click changes nothing.
const stamp = nowIso();
const claim = c.env.DB.prepare(
  "UPDATE bookings SET status = 'confirmed', meet_link = COALESCE(meet_link, ?), updated_at = ? WHERE id = ? AND status = 'pending_confirm'",
).bind(meet, stamp, id);
const won = {
  sql: "EXISTS (SELECT 1 FROM bookings WHERE id = ? AND status = 'confirmed' AND updated_at = ?)",
  bind: [id, stamp],
};
const [claimed] = await c.env.DB.batch(mail ? [claim, mailClaim(c.env, mail, won)] : [claim]);
if (!claimed?.meta?.changes) return flash(c, "e", "غير قابل للتأكيد");

// The email goes first. The Google Calendar copy is a courtesy and has no
// say in whether the client is told.
const mailed = mail ? await sendClaimed(c.env, mail) : true;

// Every five minutes, 288 times a day. Each step is isolated: one failing
// step is logged and the rest still run. The order is deliberate: money is
// settled before holds are released, and housekeeping always comes last.
async scheduled(_event: ScheduledController, env: Env, _ctx: ExecutionContext) {
  const step = <T>(name: string, work: () => Promise<T>) => work().catch((e) => {
    console.error(`cron: ${name}:`, String(e?.message || e));
    return null;
  });
  const lastTick = await step("heartbeat", () => heartbeat(env));
  await step("reconcile", () => reconcilePending(env, lastTick));
  await step("booking holds", () => expireUnpaidBookings(env));
  await step("mail retry", () => retryWhenDue(env));
  await step("retainer billing", () => generateRetainerInvoices(env));
  await step("estate check", () => monitorEstate(env));
  await step("request expiry", () => expireStaleBookings(env));
  // Claimed once per row, so 288 runs a day still send one reminder.
  await step("appointment reminders", () => sendAppointmentReminders(env));
  await step("digest", () => sendReminderDigest(env));
  await step("contract reminders", () => remindExpiringContracts(env));
  // Before housekeeping: a signature that stopped proving anything cannot wait.
  await step("signature sweep", () => sweepSignatures(env));
  await step("retention", () => purgeOperationalLogs(env));
  await step("blog queue", () => publishFromQueue(env));
}

// The panel is written in Arabic and rendered on the server. One button
// walks the live page and swaps each text for its English entry (561 of
// them), flips the direction, and re-formats every date in Riyadh time.
function apply(lang){
  var en = lang === "en", html = document.documentElement;
  html.lang = lang; html.dir = en ? "ltr" : "rtl";
  document.querySelectorAll("[data-en]").forEach(function(el){
    if (el.dataset.ar === undefined) el.dataset.ar = (el.textContent || "");
    el.textContent = en ? (el.dataset.en || el.dataset.ar) : el.dataset.ar;
  });
  texts.forEach(function(p){
    if (!en) { p[0].nodeValue = p[1]; return; }
    var t = swap(p[1]); if (t !== null) p[0].nodeValue = t;
  });
  var fmt = tsFmt(en);
  if (fmt) document.querySelectorAll("time[datetime]").forEach(function(el){
    var iso = el.getAttribute("datetime"); if (!iso) return;
    try { el.textContent = fmt.format(new Date(iso)); } catch (e) {}
  });
  document.title = en ? (DICT[docTitle] || docTitle) : docTitle;
  btn.textContent = en ? "عربي" : "EN";
}

// Names and phone numbers arrive from public forms. A cell that starts with
// = + - or @ would run as a formula in my own spreadsheet, so it is written
// as text. The byte-order mark lets Excel open Arabic correctly.
function csvCell(v: unknown): string {
  let s = String(v ?? "");
  if (/^[=+\-@\t\r]/.test(s)) s = `'${s}`;
  return /[",\n\r]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
}

function csvResponse(name: string, header: string[], rows: unknown[][]): Response {
  const body = "" + [header, ...rows].map((r) => r.map(csvCell).join(",")).join("\r\n");
  return new Response(body, {
    headers: {
      "content-type": "text/csv; charset=utf-8",
      "content-disposition": `attachment; filename="${name}"`,
    },
  });
}

// An email is first a row, written in the same batch as the fact it
// announces. If the order is marked paid, the receipt is already queued;
// if the batch fails, neither exists. The send comes after the commit.
export function mailClaim(env: { DB: D1Database }, msg: Mail, when?: { sql: string; bind: unknown[] }): D1PreparedStatement {
  return env.DB.prepare(
    `INSERT OR IGNORE INTO notifications_log (order_id, template_key, recipient, status, provider, idempotency_key, subject, body_text, attempts, claimed_at)
     SELECT ?, ?, ?, 'queued', 'resend', ?, ?, ?, 1, ? ${when ? `WHERE ${when.sql}` : ""}`,
  ).bind(msg.orderId, msg.templateKey, msg.to, msg.idem, msg.subject, msg.text, new Date().toISOString(), ...(when?.bind ?? []));
}

// The send behind a claim this caller won. A failed send is left to the
// hourly retry; it is never lost and never sent twice.
export async function sendClaimed(env: { DB: D1Database } & EmailEnv, msg: Mail): Promise<boolean> {
  const r = await sendEmail(env, { to: msg.to, subject: msg.subject, text: msg.text });
  if (r.ok) {
    await env.DB.prepare("UPDATE notifications_log SET status = 'sent', provider_message_id = ?, claimed_at = NULL WHERE idempotency_key = ?")
      .bind(r.id || null, msg.idem).run();
  } else {
    await env.DB.prepare("UPDATE notifications_log SET claimed_at = NULL WHERE idempotency_key = ?")
      .bind(msg.idem).run().catch(() => { /* the lease runs out by itself */ });
  }
  return r.ok;
}

// One conversation is one person plus one subject. Reply prefixes in both
// languages are removed, so "Re: X" and "رد: X" land in the thread of "X".
export function normalizeSubject(subject: string): string {
  return String(subject || "")
    .replace(/^\s*((re|fwd?|رد|اعادة توجيه|إعادة توجيه)\s*:\s*)+/gi, "")
    .trim()
    .toLowerCase();
}

export async function threadKeyFor(counterpart: string, subject: string): Promise<string> {
  const data = `${String(counterpart || "").trim().toLowerCase()}|${normalizeSubject(subject)}`;
  const d = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data));
  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, "0")).join("");
}

// Escape everything first, then allow a short list of Markdown. No raw tag
// can survive, a link must be http(s) or a path on this site, and a link to
// an article that is not published yet stays plain text until it is.
function esc(s: string): string {
  return s.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch] as string));
}

function inline(s: string, isPublished: (slug: string) => boolean): string {
  return s
    .replace(/`([^`]+)`/g, "<code>$1</code>")
    .replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>")
    .replace(/\*([^*]+)\*/g, "<em>$1</em>")
    .replace(
      /\[([^\]]+)\]\((https?:\/\/[^\s)]+|\/(?!\/)[^\s)]*)\)/g,
      (_m, text: string, href: string) => {
        const self = SELF_ABS.exec(href);
        const path = self ? self[1] : href;
        if (!path.startsWith("/")) return `<a href="${href}" rel="noopener">${text}</a>`;
        const m = ARTICLE.exec(path);
        if (m && !m[1].includes(".") && !isPublished(m[1])) return text;
        return `<a href="${href}">${text}</a>`;
      },
    );
}

// A page built by a Worker is not cached just because it says so: the Worker
// has to store it. Only successful pages that declared a lifetime are kept,
// never an error, because a cached 404 would outlive the publish that fixes it.
export default {
  async fetch(req: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
    if (req.method !== "GET") return app.fetch(req, env, ctx);

    const cache = caches.default;
    const hit = await cache.match(req);
    if (hit) return hit;

    const res = await app.fetch(req, env, ctx);
    if (res.status === 200 && (res.headers.get("Cache-Control") || "").includes("s-maxage")) {
      // A body can be read once: the copy is stored, the original returned.
      // Failing to cache is a slower page, not a broken one.
      ctx.waitUntil(cache.put(req, res.clone()).catch((e) => {
        console.error("blog: cache.put refused", req.url, String(e));
      }));
    }
    return res;
  },
};

// One press in the panel shares a published article to LinkedIn: the title,
// a short summary and the link, as a public article post.
const title = p.title_en || p.title_ar;
const excerpt = p.title_en ? (p.excerpt_en || "") : (p.excerpt_ar || "");
const commentary = `${title}${excerpt ? `\n\n${excerpt}` : ""}\n\n${link}`;

const res = await fetch("https://api.linkedin.com/v2/ugcPosts", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "content-type": "application/json",
    "X-Restli-Protocol-Version": "2.0.0",
  },
  body: JSON.stringify({
    author: person,
    lifecycleState: "PUBLISHED",
    specificContent: {
      "com.linkedin.ugc.ShareContent": {
        shareCommentary: { text: commentary },
        shareMediaCategory: "ARTICLE",
        media: [{ status: "READY", originalUrl: link, title: { text: title } }],
      },
    },
    visibility: { "com.linkedin.ugc.MemberNetworkVisibility": "PUBLIC" },
  }),
});

// Every page has a real route in both languages: the Arabic one is the
// English path under /ar. Switching maps the CURRENT path, so the reader
// stays on the same page instead of landing on the home page.
function pathFor(lang: Lang, current: string): string {
  const bare = current === '/ar' || current === '/ar/'
    ? '/'
    : current.startsWith('/ar/') ? current.slice(3) : current;
  const normalized = bare.startsWith('/') ? bare : `/${bare}`;
  if (lang !== 'ar') return normalized;
  return normalized === '/' ? '/ar/' : `/ar${normalized}`;
}

// No reload and no extra history entry: the address simply follows the language.
function syncPath(lang: Lang) {
  const current = window.location.pathname;
  const target = pathFor(lang, current);
  if (target !== current) {
    window.history.replaceState(null, '', target + window.location.search + window.location.hash);
  }
}

// The first thing inside <body>. The page knows its language and its
// direction before anything is drawn, so Arabic never flashes left to right.
const langScript = `(function(){try{
  var p = location.pathname;
  var ar = p === '/ar' || p === '/ar/' || p.indexOf('/ar/') === 0;
  var d = document.documentElement;
  d.lang = ar ? 'ar' : 'en';
  d.dir = ar ? 'rtl' : 'ltr';
}catch(e){}})();`;

// Runs after the build. A static export leaves every page with lang="en",
// so this writes Arabic into the bytes of every page under /ar/. Search
// engines, screen readers and translators read it without running JavaScript.
for (const file of htmlFilesUnder(AR_ROOT)) {
  const html = readFileSync(file, "utf8");
  const tag = html.match(/<html[^>]*>/)?.[0];
  if (!tag) {
    console.error(`fix-ar-lang: no <html> tag in ${file}`);
    process.exit(1);
  }
  if (tag.includes('lang="ar"') && tag.includes('dir="rtl"')) continue;
  const fixed = tag
    .replace(/\slang="[^"]*"/, ' lang="ar"')
    .replace(/\sdir="[^"]*"/, ' dir="rtl"');
  writeFileSync(file, html.replace(tag, fixed));
  patched++;
}

// A build that produced no Arabic pages is a broken build, not a quiet one.
if (patched === 0 && alreadyCorrect === 0) process.exit(1);

// Both language routes of a case page call this one builder, so the English
// and Arabic pages cannot disagree. `creator` points at the same Person id as
// the home page, which makes every project a link in one knowledge graph.
const graph = {
  '@context': 'https://schema.org',
  '@graph': [
    {
      '@type': 'CreativeWork',
      '@id': `${url}#project`,
      name: project.name[lang],
      description: project.description[lang],
      inLanguage: lang,
      url,
      sameAs: project.liveUrl,
      creator: { '@id': `${SITE}/#person` },
      keywords: project.stack.join(', '),
    },
    {
      '@type': 'BreadcrumbList',
      itemListElement: [
        { '@type': 'ListItem', position: 1, name: OWNER[lang], item: home },
        { '@type': 'ListItem', position: 2, name: project.name[lang], item: url },
      ],
    },
  ],
};

// How the publish time of a LinkedIn post was worked out for the structured
// data: the post id carries it. The top 41 bits are milliseconds since 1970.
const publishedAt = (activityId: string) =>
  new Date(Number(BigInt(activityId) >> 22n)).toISOString();

publishedAt('7431610991085297665');
// '2026-02-23T08:08:52.930Z'

# Majed Alandajani

> Solutions Architect and AI Automation Engineer in Jeddah, Saudi Arabia.
> He builds production systems that turn manual operations into
> autonomous workflows.

## Pages
## Selected work
## Profiles
## Honors and Community Endorsements
## Live Production Platforms Architected & Built by Majed

// The 3D scene draws inside a Web Worker, so three.js never blocks the page.
// Three outcomes race (ready, error, silence) and a single latch settles the
// race once: the worker keeps the canvas, or the page falls back to drawing
// on the main thread. The visitor sees the logo either way.
const worker = new Worker(new URL('./scene.worker.tsx', import.meta.url));
let settled = false;
const fallBack = () => {
  if (settled) return;
  settled = true;
  setUseWorker(false);
};
const timer = window.setTimeout(fallBack, READY_TIMEOUT_MS);
worker.onerror = fallBack;
worker.onmessage = (e: MessageEvent<{ type: string }>) => {
  if (e.data.type === 'error') fallBack();
  if (e.data.type === 'ready' && !settled) {
    settled = true;
    window.clearTimeout(timer);
  }
};

const rect = canvas.getBoundingClientRect();
const offscreen = canvas.transferControlToOffscreen();
const dpr = Math.min(Math.max(1, window.devicePixelRatio || 1), 1.5);
worker.postMessage(
  { type: 'init', canvas: offscreen, width: rect.width, height: rect.height, dpr },
  [offscreen],
);

// The scene draws only when asked. About 30 frames a second while the
// pointer plays with it, about 18 for the slow ambient motion, nothing at
// all when it is still, and nothing while it is off screen.
const loop = (time: number) => {
  if (pausedRef.current) {
    raf = requestAnimationFrame(loop);
    return;
  }
  const p = progressRef.current;
  const { x: mx, y: my } = mouseRef.current;
  if (Math.abs(mx - lastMx) + Math.abs(my - lastMy) > 0.0005) {
    lastMx = mx;
    lastMy = my;
    lastMoveAt = time;
  }
  const pointerActive = time - lastMoveAt < 900;
  const animActive = !reduced && (p < 0.6 || p >= 0.92);
  const interval = pointerActive ? 33 : 55;
  const timed = (animActive || pointerActive) && time - lastTick > interval;
  if (p !== last || timed) {
    invalidate();
    last = p;
    if (timed) lastTick = time;
  }
  raf = requestAnimationFrame(loop);
};

// The hold while you scroll is plain CSS (position: sticky). This effect only
// turns the scroll position into a number from 0 to 1. Sizes are measured by a
// ResizeObserver, so the scroll handler never forces the browser to lay out.
useEffect(() => {
  if (reduced) {
    progressRef.current = 1;
    return;
  }
  const pin = pinRef.current;
  const section = sectionRef.current;
  if (!pin || !section) return;
  let top = 0;
  let distance = 1;
  const update = () => {
    progressRef.current = Math.min(1, Math.max(0, (window.scrollY - top) / distance));
  };
  const measure = () => {
    top = pin.getBoundingClientRect().top + window.scrollY;
    distance = Math.max(1, pin.offsetHeight - section.offsetHeight);
    update();
  };
  const ro = new ResizeObserver(measure);
  ro.observe(pin);
  ro.observe(section);
  window.addEventListener('scroll', update, { passive: true });
  return () => {
    ro.disconnect();
    window.removeEventListener('scroll', update);
  };
}, [reduced]);

// Sections below the fold skip layout on the first load (content-visibility).
// After six seconds they are released one per idle moment, and the first
// click or key press releases all of them, so a jump link always lands right.
const RELEASE_AFTER_MS = 6000;

export function DeferredLayoutRelease() {
  useEffect(() => {
    let idle = 0;
    const next = () => document.querySelector('.cv-section');
    const releaseAll = () => {
      document.querySelectorAll('.cv-section').forEach((el) => el.classList.remove('cv-section'));
    };
    const schedule = (fn: () => void) =>
      typeof window.requestIdleCallback === 'function'
        ? window.requestIdleCallback(fn, { timeout: 1000 })
        : window.setTimeout(fn, 50);
    const step = () => {
      next()?.classList.remove('cv-section');
      if (next()) idle = schedule(step);
    };
    const timer = window.setTimeout(() => { idle = schedule(step); }, RELEASE_AFTER_MS);
    const events = ['pointerdown', 'keydown'] as const;
    events.forEach((e) => window.addEventListener(e, releaseAll, { once: true, passive: true }));
    return () => {
      window.clearTimeout(timer);
      if (typeof window.cancelIdleCallback === 'function') window.cancelIdleCallback(idle);
      events.forEach((e) => window.removeEventListener(e, releaseAll));
    };
  }, []);
  return null;
}

// The analytics queue exists from the first moment, so no event is lost.
// The library itself waits for the visitor's first interaction, or seven
// seconds, and only the page path is sent, never the query string.
gtag('config', GA_ID, { page_location: location.origin + location.pathname });
(function () {
  var done = false, o = { passive: true }, t;
  var ev = ['pointerdown', 'keydown', 'touchstart', 'scroll'];
  function load() {
    if (done) return;
    done = true;
    clearTimeout(t);
    ev.forEach(function (e) { removeEventListener(e, load, o); });
    var s = document.createElement('script');
    s.async = true;
    s.src = 'https://www.googletagmanager.com/gtag/js?id=' + GA_ID;
    document.head.appendChild(s);
  }
  ev.forEach(function (e) { addEventListener(e, load, o); });
  t = setTimeout(load, 7000);
})();

// At build time the catalog comes from the database through the API. If the
// API cannot be reached, the catalog kept in code is used, so a network
// hiccup can never fail a publish.
let OFFS: Off[] = OFFERINGS.map(toCard);
try {
  const r = await fetch(`${SITE}/api/products`, { headers: { accept: 'application/json' } });
  if (r.ok) {
    const j: any = await r.json();
    if (Array.isArray(j?.offerings) && j.offerings.length > 0) OFFS = j.offerings;
  }
} catch { /* offline build: the fallback stays */ }

// The store is built once, as static pages. Then, on every visit, it asks the
// API how each product is sold right now: request a quote, book, or pay.
// Changing how a product is sold needs no rebuild.
const live = new Map<string, { paymentMode?: string; priceMinor?: number | null }>();
let paymentsOn = false;

fetch(`${apiBase}/api/products`)
  .then((r) => (r.ok ? r.json() : null))
  .then((j: any) => {
    if (!Array.isArray(j?.offerings)) return;
    paymentsOn = !!j.paymentsOn;
    for (const o of j.offerings) live.set(o.slug, o);
    document.querySelectorAll<HTMLElement>('[data-book]').forEach((btn) => {
      const o = live.get(btn.dataset.book || '');
      if (!paymentsOn || o?.paymentMode !== 'direct' || !o.priceMinor) return;
      relabel(btn, 'ادفع', 'Pay');
    });
  })
  .catch(() => { /* the built page stands as it is */ });

// One key per booking attempt, created when the form opens and sent with
// every retry. A retry after a lost answer gets the same order back, never a
// second one. The key is retired only when the attempt is really over.
const res = await fetch(`${apiBase}/api/orders`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ ...body, attemptKey }),
});
const j: any = await res.json().catch(() => ({}));

// Nothing was charged, so the next press is a new attempt, not a retry.
if (j.error === 'charge_create_failed' || j.error === 'attempt_closed') attemptKey = '';
if (!res.ok) throw new Error(j.error || 'error');

// A paid product answers with the payment page, also on a retry.
if (j.redirectUrl) { location.assign(j.redirectUrl); return; }

msgEl.textContent = en()
  ? 'Request received. I will contact you within one business day.'
  : 'تم استلام طلبك. سأتواصل معك خلال يوم عمل واحد.';
form.reset();
attemptKey = ''; // the next submission is a genuinely new booking

# A push deploys only what it changed. Shared code is compiled into both the
# API and the panel, so a change there redeploys both. Test-only changes do
# not change what a Worker serves, so they deploy nothing.
- name: Plan
  run: |
    has() { grep -qE "$1" <<<"$CHANGED"; }
    WORKER_FILES="$(grep -vE '^store-system/[^/]+/test/' <<<"$CHANGED" || true)"
    hasw() { grep -qE "$1" <<<"$WORKER_FILES"; }

    SHARED=0
    if hasw '^store-system/shared/'; then SHARED=1; fi

    if hasw '^store-system/api/'   || [ "$SHARED" = 1 ]; then on api;   fi
    if hasw '^store-system/admin/' || [ "$SHARED" = 1 ]; then on admin; fi
    if hasw '^store-system/blog/'; then on blog; fi

    SITE_FILES="$(grep -vE '^scripts/ci/' <<<"$CHANGED" || true)"
    if grep -qE '^(src/|public/|assets/|scripts/|next\.config|wrangler\.worker\.jsonc|package\.json)' <<<"$SITE_FILES"; then
      on portfolio
    fi

# After every deploy the live address must answer as expected. Six tries,
# waiting 5, 10, 20, 40 and 80 seconds, with a fresh query each time so no
# cache can answer for the new version.
ATTEMPTS=6
WAIT=5

for i in $(seq 1 $ATTEMPTS); do
  sep="?"; case "$URL" in *\?*) sep="&";; esac
  got="$(curl -s -o /dev/null -w '%{http_code}' --max-time 25 "${URL}${sep}ci=$(date +%s)-$i" || echo 000)"
  case ",$WANT," in *",$got,"*) matched=1;; *) matched=0;; esac
  if [ "$matched" = 1 ]; then
    echo "OK  $URL answered $got (attempt $i)"
    exit 0
  fi
  echo "..  $URL answered $got, wanted $WANT (attempt $i of $ATTEMPTS)"
  [ "$i" -lt "$ATTEMPTS" ] && sleep "$WAIT" && WAIT=$((WAIT * 2))
done

echo "::error::$URL answered $got after $ATTEMPTS attempts, expected $WANT."
exit 1

// Tests run against a real SQLite database built from the same 31
// migrations as production. A batch here is a real transaction, exactly like
// D1: statement N sees statement N-1, and any failure rolls back everything.
async batch(stmts) {
  if (inBatch) throw new Error("D1_ERROR: batch() called while a batch is already open");
  inBatch = true;
  db.exec("BEGIN");
  try {
    const out = stmts.map((s) => s._runSync());
    db.exec("COMMIT");
    return out;
  } catch (e) {
    db.exec("ROLLBACK");
    throw e;
  } finally {
    inBatch = false;
  }
},

/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

// Erasing a person (PDPL) without destroying the documents the law says I
// must keep. Every identifier is replaced in place, longest first, so the
// scope and the amounts survive while the person does not.
const MARK = "[محذوف بموجب طلب PDPL]";

const values = [...new Set(raw.map((v) => String(v || "").trim()).filter((v) => v.length > 2))]
  .sort((x, y) => y.length - x.length);
const params = values.flatMap((v) => [v, MARK]);

// replace(replace(col, ?, ?), ?, ?) ... one layer per value that exists,
// because SQLite's replace() returns NULL if any argument is NULL.
const scrub = (col: string) => values.reduce((e) => `replace(${e}, ?, ?)`, col);

for (const p of proposals) {
  stmts.push(env.DB.prepare(
    `UPDATE proposals SET client_email = NULL,
        title_ar = ${scrub("title_ar")}, title_en = ${scrub("title_en")}, body_md = ${scrub("body_md")}
      WHERE id = ?`,
  ).bind(...params, ...params, ...params, p.id));
}
// All statements run as one batch: the person is erased everywhere, or nowhere.