Bound the approval to one candidate batch
This workflow serves SaaS operators and developers reviewing import materials, not activating a promotion. Agree owner, count, format, discount intent and expiry interpretation before generating. Record whether the package is strings-only or contains coupon parameters. The website does not connect your account, verify existing codes or track redemptions. Avoid confidential campaign inputs when server processing is not authorized.
Preserve the package and inspect its actual contents
Keep the original ZIP unchanged. Preview entries and extract codes.csv, create-promo-codes.mjs and the instructions using their actual archive paths. Inspect file contents rather than trusting an extension. Record revision and SHA-256; extraction tools may upload the archive. Never include credentials in it. The generated script is executable code: read it locally before any run, not by importing or executing it inside an online inspector.
Validate a copy without changing the executable truth
Validate quoting, headers and row widths. Project only the code column onto a review copy, using exact matching to investigate duplicates. Deduplicating full rows can miss the same code with different notes; fuzzy matching can collapse different legitimate codes. Do not silently trim, change case or open codes as spreadsheet numbers. Unexpected counts or duplicates require investigation, not deletion followed by approval.
The importer embeds CODES rather than reading CSV. Compare exact code values and counts with the full CSV, then inspect embedded campaign, coupon and promotion parameters. CSV labels are descriptions, not executable settings. Check duration, restrictions and expiry interpretation independently. A strings-only package does not demonstrate a usable discount. Keep generated evidence intact; if you regenerate, review the entire new package. If making authorized local changes, record every affected artifact and repeat reconciliation.
Explain revisions and perform only a local preview
Compare baseline and proposed CSV with stable code identities and consistent order, separating notes from actual candidate changes. The CSV diff cannot inspect JavaScript constants, so reconcile the script manually. Keep the dependency setup and script revision in the review record. Never paste real keys into website tools or share unsanitized environment output.
Run the inspected importer locally with DRY_RUN enabled. It still imports its dependency and initializes a client; missing dependencies or client configuration can fail before preview. Record such failures and resolve them locally without turning dry mode off as a workaround. Compare previewed codes with the approved list, not merely the summary. Its created counter increments during preview and does not represent real resources. A successful preview cannot prove availability, restriction acceptance or API compatibility.
Hand off evidence and stop before production
The CSV redemptions, status and notes columns are blank or planned placeholders, not account telemetry. Preserve that distinction in any review ledger. Package the approved ZIP or explicitly versioned local revision, files, decisions and sanitized preview evidence, excluding credentials and personal/customer data. Hash after the last change; hashes identify files, not API correctness or ownership.
Real test-mode creation, partial-failure reconciliation, production authorization and actual redemption checks belong to a separate execution procedure. Do not assume retry keys make reruns safe forever. Record untested cases and the execution owner rather than treating preflight as launch approval. Use campaign-link preflight for tracking URLs and QR placement, CSV cleanup for broader table work, or archive inspection for unrelated extraction tasks.