validate weekly brief manifests

server/brief-outbox.mjs

@@ -4,6 +4,15 @@ import path from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 
 const hash = value => createHash('sha256').update(value).digest('hex');
+function parseManifest(raw) {
+  try {
+    const messages = JSON.parse(raw);
+    if (!Array.isArray(messages) || messages.some(message => !message || typeof message !== 'object' || Array.isArray(message))) throw new Error('manifest biçimi');
+    return messages;
+  } catch {
+    throw new Error('Haftalık özet manifesti bozuk; gönderim işlemi durduruldu.');
+  }
+}
 export function briefWeekKey(now = new Date()) {
   const date = new Date(now.getTime() + 3 * 3600000);
   date.setUTCDate(date.getUTCDate() - (date.getUTCDay()+6)%7);
@@ -85,7 +94,8 @@ export function createBriefOutbox(directory) {
           LEFT JOIN brief_reviews r ON r.batch=m.batch AND r.position=m.position
           WHERE m.state!='accepted' OR r.action IS NOT NULL
           ORDER BY b.week DESC,b.email,m.position`).all().map(row=>{
-          const message=JSON.parse(row.manifest)[row.position];
+          const message=parseManifest(row.manifest)[row.position];
+          if (!message) throw new Error('Haftalık özet manifestinde mesaj bulunamadı.');
           return {id:`${row.batch}:${row.position}`,to:message.to || row.email,
             subject:`Haftalık özet · ${row.week} · ${message.channel === 'telegram' ? 'Telegram' : 'E-posta'} · Mesaj ${row.position+1}`,
             state:row.action==='confirmed_sent'?'sent_manual':row.state,error:row.error,providerId:row.receipt,