[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_170":171,"_172":173},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_127":-5,"_20":128,"_22":129,"_130":131,"_132":133,"_25":134,"_24":-5,"_135":-5,"_136":-5,"_137":54,"_138":139,"_140":45,"_141":-5,"_142":-5,"_143":144},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","director","name","formsMasterEmails","branchName","main","version","path","","project",{"_34":74,"_13":14,"_46":75,"_76":-5,"_77":54,"_78":79,"_80":79,"_81":19,"_82":-5,"_83":84,"_85":-5,"_86":54,"_87":-5,"_88":-5,"_89":48,"_90":91,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_105":106,"_107":108,"_109":110,"_111":54},"tree",[65,66],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":43,"_49":62,"_51":63,"_53":54,"_55":-5,"_18":64},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":56},"id","c11f5f75-8e71-4553-a8f9-ed6db1bb1a37","test_probe.ts","fileId","1844dff2-6136-11f1-ba96-1607ee4eb77e","parentId","branchId","702e16b0-43c3-11f1-b7a1-42b51c65c3df","branchVersion",25,"latest",true,"createdAt",["D",1780702038838],0,"fileType","script","content","// probe","deleted",false,"label",[36],"2a9b0996-a92f-4ae8-933d-6d26ba024b22","main.ts","70321ff8-43c3-11f1-b7a1-42b51c65c3df",27,["D",1781389101496],"http","// Forms Master Email Endpoint via Resend — v2 (hardened)\n//\n// Env vars required:\n// RESEND_API_KEY — your Resend key\n// FORMS_EMAILS_KEY — shared secret; crons and trusted servers send it as X-Forms-Key\n// FORMS_SUPABASE_SERVICE_KEY — Supabase service_role key (Dashboard > Settings > API).\n// Used server-side only for recipient verification, admin\n// role checks, Tier 1 resolution, and published-template reads.\n// Env vars optional:\n// EMAIL_FROM — defaults to \"Forms Academy \"\n//\n// WHAT CHANGED vs v1:\n// 1. No more open relay. Three caller classes:\n// - Trusted: X-Forms-Key matches FORMS_EMAILS_KEY (crons). All kinds allowed.\n// - Admin: Authorization Bearer that resolves to an active\n// org_members admin. All kinds allowed.\n// - Public (no auth): ONLY family_welcome (recipient must be an existing\n// p_families.primary_email) and admin_new_signup (recipient is forced to\n// Tier 1 admins regardless of what the caller sends). Rate limited.\n// 2. idempotency_key is now real. Backed by Val.town sqlite; duplicate keys\n// return ok:true, deduped:true and do not send.\n// 3. Published templates from the email_templates DB table are now honored.\n// If a row exists with kind= and status='published', its subject,\n// preheader, and html_body are used with {varName} substitution (values\n// HTML-escaped). Drafts are ignored; hardcoded templates remain the fallback,\n// so behavior is unchanged until you publish from the Master UI.\n// 4. Fixed double-escaping in session_reminder and activity_reminder (O'Brien\n// no longer renders as O'Brien).\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst SUPABASE_URL = \"https://lmgplytnycmvuemhvmfc.supabase.co\";\nconst SUPABASE_ANON =\n \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxtZ3BseXRueWNtdnVlbWh2bWZjIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMwNzQ5ODMsImV4cCI6MjA4ODY1MDk4M30.aLfnSeqMyvyxqwAzM9LQcT2RTMDujc3H3jnFylVmRI8\";\nconst FORMS_ORG_ID = \"a0000000-0000-0000-0000-000000000001\";\n\n// Kinds the public (unauthenticated) join page may trigger. Everything else\n// requires the shared secret or an admin session.\nconst PUBLIC_KINDS = new Set([\"family_welcome\", \"admin_new_signup\"]);\nconst PUBLIC_RATE_LIMIT_PER_HOUR = 30;\n\nlet tablesReady = false;\nasync function ensureTables() {\n if (tablesReady) return;\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS email_idempotency (\n key TEXT PRIMARY KEY, created_at TEXT NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS email_public_sends (\n id INTEGER PRIMARY KEY AUTOINCREMENT, created_at TEXT NOT NULL)`);\n tablesReady = true;\n}\n\nfunction svcHeaders(serviceKey: string) {\n return {\n \"apikey\": serviceKey,\n \"Authorization\": `Bearer ${serviceKey}`,\n \"Content-Type\": \"application/json\",\n };\n}\n\nasync function svcGet(serviceKey: string, path: string): Promise {\n const res = await fetch(`${SUPABASE_URL}/rest/v1/${path}`, {\n headers: svcHeaders(serviceKey),\n });\n if (!res.ok) throw new Error(`Supabase ${res.status}: ${await res.text()}`);\n return res.json();\n}\n\n// Resolve a Supabase user JWT to an active admin org_member. Returns true/false.\nasync function isAdminJwt(serviceKey: string, jwt: string): Promise {\n try {\n const userRes = await fetch(`${SUPABASE_URL}/auth/v1/user`, {\n headers: { \"apikey\": SUPABASE_ANON, \"Authorization\": `Bearer ${jwt}` },\n });\n if (!userRes.ok) return false;\n const user = await userRes.json();\n if (!user?.id) return false;\n const rows = await svcGet(\n serviceKey,\n `org_members?org_id=eq.${FORMS_ORG_ID}&user_id=eq.${user.id}&role=eq.admin&status=eq.active&select=user_id&limit=1`,\n );\n return rows.length > 0;\n } catch {\n return false;\n }\n}\n\nasync function recipientIsKnownFamily(\n serviceKey: string,\n email: string,\n): Promise {\n const e = String(email || \"\").trim().toLowerCase().replace(/[%*,()]/g, \"\");\n if (!e || !e.includes(\"@\")) return false;\n const rows = await svcGet(\n serviceKey,\n `p_families?org_id=eq.${FORMS_ORG_ID}&primary_email=ilike.${\n encodeURIComponent(e)\n }&select=id&limit=1`,\n );\n return rows.length > 0;\n}\n\nasync function tier1AdminEmails(serviceKey: string): Promise {\n const rows = await svcGet(\n serviceKey,\n `org_members?org_id=eq.${FORMS_ORG_ID}&admin_tier=eq.1&status=eq.active&select=user:users(email)`,\n );\n return rows.map((r: any) => r.user?.email).filter((e: any) =>\n e && e.includes(\"@\")\n );\n}\n\n// ─── Published template support ───────────────────────────────────────────\n// The Master UI's Email Templates editor writes to email_templates. Only rows\n// with status='published' are honored here. Substitution: {varName} tokens are\n// replaced from the request's data payload; both snake_case keys and their\n// camelCase aliases are available. Values are HTML-escaped in the body.\n\nasync function fetchPublishedTemplate(\n serviceKey: string,\n kind: string,\n): Promise {\n try {\n const rows = await svcGet(\n serviceKey,\n `email_templates?org_id=eq.${FORMS_ORG_ID}&kind=eq.${\n encodeURIComponent(kind)\n }&status=eq.published&select=subject,preheader,html_body&limit=1`,\n );\n return rows[0] || null;\n } catch (e) {\n console.error(\"[emails] template fetch failed, using hardcoded:\", e);\n return null;\n }\n}\n\nfunction buildVarMap(d: any): Record {\n const vars: Record = {};\n for (const [k, v] of Object.entries(d || {})) {\n if (v == null || typeof v === \"object\") continue;\n vars[k] = v;\n const camel = k.replace(\n /_([a-z])/g,\n (_: string, c: string) => c.toUpperCase(),\n );\n if (!(camel in vars)) vars[camel] = v;\n }\n return vars;\n}\n\nfunction applyDbTemplate(tpl: any, d: any) {\n const vars = buildVarMap(d);\n const plain = (s: string) =>\n String(s || \"\").replace(\n /\\{(\\w+)\\}/g,\n (m, k) => (k in vars ? String(vars[k]) : m),\n );\n const html = (s: string) =>\n String(s || \"\").replace(\n /\\{(\\w+)\\}/g,\n (m, k) => (k in vars ? esc(vars[k]) : m),\n );\n return {\n subject: plain(tpl.subject),\n preheader: plain(tpl.preheader || \"\"),\n html: html(tpl.html_body),\n };\n}\n\n// ─── HTTP handler ─────────────────────────────────────────────────────────\n\nexport default async function (req: Request): Promise {\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization, X-Forms-Key\",\n };\n if (req.method === \"OPTIONS\") return new Response(null, { headers: cors });\n if (req.method !== \"POST\") return json({ error: \"POST only\" }, 405, cors);\n\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"invalid json\" }, 400, cors);\n }\n\n const { kind, data = {}, portalUrl, idempotency_key } = body || {};\n let to = body?.to;\n if (!kind || !to) return json({ error: \"missing kind or to\" }, 400, cors);\n\n const serviceKey = Deno.env.get(\"FORMS_SUPABASE_SERVICE_KEY\");\n const sharedSecret = Deno.env.get(\"FORMS_EMAILS_KEY\");\n\n // ── Authorization ──\n const presentedSecret = req.headers.get(\"X-Forms-Key\") || \"\";\n const trusted = !!sharedSecret && presentedSecret === sharedSecret;\n\n let admin = false;\n if (!trusted) {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n const jwt = authHeader.startsWith(\"Bearer \") ? authHeader.slice(7) : null;\n if (jwt && serviceKey) admin = await isAdminJwt(serviceKey, jwt);\n }\n\n if (kind === \"test\") {\n return json(\n {\n ok: true,\n echo: { kind, to, data },\n caller: trusted ? \"trusted\" : admin ? \"admin\" : \"public\",\n },\n 200,\n cors,\n );\n }\n\n if (!trusted && !admin) {\n // Public path: tightly scoped.\n if (!PUBLIC_KINDS.has(kind)) {\n return json({ error: \"unauthorized for kind: \" + kind }, 403, cors);\n }\n if (!serviceKey) {\n // Without the service key we cannot verify recipients — fail closed.\n return json(\n { error: \"server not configured for public sends\" },\n 503,\n cors,\n );\n }\n await ensureTables();\n const hourAgo = new Date(Date.now() - 3600 * 1000).toISOString();\n const cnt = await sqlite.execute({\n sql: \"SELECT COUNT(*) AS n FROM email_public_sends WHERE created_at > ?\",\n args: [hourAgo],\n });\n const n = Number(\n (cnt.rows?.[0] as any)?.n ?? (cnt.rows?.[0] as any)?.[0] ?? 0,\n );\n if (n >= PUBLIC_RATE_LIMIT_PER_HOUR) {\n return json({ error: \"rate limited\" }, 429, cors);\n }\n if (kind === \"admin_new_signup\") {\n // Recipient is never caller-controlled on the public path.\n const admins = await tier1AdminEmails(serviceKey);\n if (admins.length === 0) {\n return json({ error: \"no admin recipients on file\" }, 500, cors);\n }\n to = admins;\n } else {\n const known = await recipientIsKnownFamily(serviceKey, to);\n if (!known) return json({ error: \"unknown recipient\" }, 403, cors);\n }\n await sqlite.execute({\n sql: \"INSERT INTO email_public_sends (created_at) VALUES (?)\",\n args: [new Date().toISOString()],\n });\n } else if (to === \"__tier1__\") {\n // Trusted/admin callers may also use the sentinel.\n if (!serviceKey) {\n return json({ error: \"FORMS_SUPABASE_SERVICE_KEY not set\" }, 500, cors);\n }\n const admins = await tier1AdminEmails(serviceKey);\n if (admins.length === 0) {\n return json({ error: \"no admin recipients on file\" }, 500, cors);\n }\n to = admins;\n }\n\n // ── Idempotency (real now) ──\n if (idempotency_key) {\n await ensureTables();\n const existing = await sqlite.execute({\n sql: \"SELECT key FROM email_idempotency WHERE key = ?\",\n args: [String(idempotency_key)],\n });\n if ((existing.rows || []).length > 0) {\n return json({ ok: true, deduped: true, kind }, 200, cors);\n }\n await sqlite.execute({\n sql:\n \"INSERT OR IGNORE INTO email_idempotency (key, created_at) VALUES (?, ?)\",\n args: [String(idempotency_key), new Date().toISOString()],\n });\n }\n\n // ── Raw pass-through: skip all templating, send html directly ──\n if (kind === \"raw\") {\n const rawSubject = body.subject;\n const rawHtml = body.html;\n if (!rawSubject || !rawHtml) {\n return json(\n { error: \"raw kind requires subject and html fields\" },\n 400,\n cors,\n );\n }\n const apiKey = Deno.env.get(\"RESEND_API_KEY\");\n if (!apiKey) return json({ error: \"RESEND_API_KEY not set\" }, 500, cors);\n const fromEmail = body.from || Deno.env.get(\"EMAIL_FROM\") ||\n \"Forms Academy \";\n const resp = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + apiKey,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: fromEmail,\n to: Array.isArray(to) ? to : [to],\n subject: rawSubject,\n html: rawHtml,\n }),\n });\n const result = await resp.json();\n if (!resp.ok) {\n return json({ error: \"resend rejected\", detail: result }, 502, cors);\n }\n return json(\n { ok: true, id: result.id, kind: \"raw\", to, subject: rawSubject },\n 200,\n cors,\n );\n }\n\n // ── Template: published DB row wins, hardcoded is the fallback ──\n let template;\n const dbTpl = serviceKey\n ? await fetchPublishedTemplate(serviceKey, kind)\n : null;\n if (dbTpl) {\n template = applyDbTemplate(dbTpl, data);\n } else {\n try {\n template = buildTemplate(\n kind,\n data,\n portalUrl || \"https://forms-master.netlify.app\",\n );\n } catch (e: any) {\n return json(\n { error: \"template build failed\", detail: e.message },\n 400,\n cors,\n );\n }\n }\n\n const apiKey = Deno.env.get(\"RESEND_API_KEY\");\n if (!apiKey) return json({ error: \"RESEND_API_KEY not set\" }, 500, cors);\n const fromEmail = Deno.env.get(\"EMAIL_FROM\") ||\n \"Forms Academy \";\n\n const resp = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + apiKey,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: fromEmail,\n to: Array.isArray(to) ? to : [to],\n subject: template.subject,\n html: emailShell(template.subject, template.html, template.preheader),\n }),\n });\n const result = await resp.json();\n if (!resp.ok) {\n return json({ error: \"resend rejected\", detail: result }, 502, cors);\n }\n return json(\n {\n ok: true,\n id: result.id,\n kind,\n to,\n subject: template.subject,\n template_source: dbTpl ? \"published\" : \"builtin\",\n },\n 200,\n cors,\n );\n}\n\nfunction buildTemplate(kind: string, d: any, portalUrl: string) {\n const dateLine = fmtDateRange(d.startsOn, d.endsOn);\n const locationParts = [\n d.city,\n d.state,\n d.country && d.country !== \"US\" ? d.country : null,\n ].filter(Boolean);\n const locationLine = locationParts.join(\", \");\n\n if (kind === \"invitation\") {\n const inviteUrl = d.inviteUrl || portalUrl;\n const playerName = d.playerName || \"your player\";\n const eventName = d.eventName || \"an event\";\n return {\n subject: \"You are invited - \" + playerName + \" to \" + eventName,\n preheader: playerName + \" is invited to \" + eventName,\n html: tag(\"An Invitation\", \"#8a6d2c\") +\n h1(esc(playerName) + \" is invited to \" + esc(eventName) + \".\") +\n para(\n \"We would love to have \" + esc(playerName) +\n \" join us. Below are the details. Tap the button when you are ready to register.\",\n ) +\n rule() +\n (dateLine ? field(\"When\", dateLine) : \"\") +\n (locationLine\n ? field(\n \"Where\",\n (d.venueName ? d.venueName + \" - \" : \"\") + locationLine,\n )\n : \"\") +\n (d.organizer ? field(\"Organizer\", d.organizer) : \"\") +\n (d.priceFromCents != null\n ? field(\n \"Cost\",\n \"from \" + fmtMoney(d.priceFromCents, d.currency || \"USD\") +\n \" per player\",\n )\n : \"\") +\n (d.registrationDeadline\n ? field(\"Register by\", fmtDate(d.registrationDeadline))\n : \"\") +\n btn(inviteUrl, \"Register \" + playerName.split(\" \")[0]) +\n italic(\n \"This is a personal invitation. If you have any questions, reply to this email.\",\n ),\n };\n }\n\n if (kind === \"registration_confirmation\") {\n const playerName = d.playerName || \"your player\";\n const eventName = d.eventName || \"the event\";\n return {\n subject: \"Registration confirmed - \" + playerName + \" for \" + eventName,\n preheader: playerName + \" is registered for \" + eventName + \".\",\n html: tag(\"Confirmation - Receipt\", \"#2E8C49\") +\n h1(\"You are in. \" + esc(playerName) + \" is registered.\") +\n para(\n \"Thanks for completing payment. Save this email as your receipt - it has everything for \" +\n esc(eventName) + \".\",\n ) +\n rule() +\n field(\"Player\", playerName) +\n field(\"Event\", eventName) +\n (dateLine ? field(\"When\", dateLine) : \"\") +\n (locationLine\n ? field(\n \"Where\",\n (d.venueName ? d.venueName + \" - \" : \"\") + locationLine,\n )\n : \"\") +\n (d.squadName ? field(\"Squad\", d.squadName) : \"\") +\n rule() +\n receiptBox(\n d.amountPaidCents,\n d.currency || \"USD\",\n d.paidAt,\n d.paymentMethod || \"stripe\",\n ) +\n btn(portalUrl, \"Open Family Portal\") +\n italic(\n \"Need to make changes? Reply to this email or message us through the family portal.\",\n ),\n };\n }\n\n if (kind === \"event_reminder\") {\n const playerName = d.playerName || \"your player\";\n const eventName = d.eventName || \"the event\";\n const when = d.relativeWhen || \"soon\";\n return {\n subject: \"Reminder - \" + eventName + \" starts \" + when,\n preheader: eventName + \" starts \" + when,\n html: tag(when.toUpperCase(), \"#2471A3\") +\n h1(esc(eventName) + \" starts \" + esc(when) + \".\") +\n para(\"A quick note so \" + esc(playerName) + \" arrives prepared.\") +\n rule() +\n (dateLine ? field(\"When\", dateLine) : \"\") +\n (locationLine\n ? field(\n \"Where\",\n (d.venueName ? d.venueName + \" - \" : \"\") + locationLine,\n )\n : \"\") +\n (d.onsiteContact ? field(\"On-site Contact\", d.onsiteContact) : \"\") +\n (d.officialWebsite\n ? linkField(\"Official Website\", d.officialWebsite)\n : \"\") +\n (d.hotelBlock\n ? blockField(\"Hotel / Accommodations\", d.hotelBlock)\n : \"\") +\n italic(\"Travel safely - see you there.\"),\n };\n }\n\n if (kind === \"roster_draft_invitation\") {\n const playerName = d.player_name || \"your player\";\n const eventName = d.event_name || \"the event\";\n const eventDates = d.event_dates || \"\";\n const eventLocation = d.event_location || \"\";\n const squadName = d.squad_name || \"\";\n const amount = d.amount_display || \"\";\n const deadline = d.confirmation_deadline || \"\";\n const draftedBy = d.drafted_by_name || \"Forms Academy staff\";\n const url = d.registration_url || portalUrl;\n const familyName = d.family_name || \"Hi\";\n\n return {\n subject: \"Coach selected \" + playerName + \" for \" + eventName,\n preheader: draftedBy + \" has selected \" + playerName + \" for \" +\n eventName + \" - confirm to lock the spot.\",\n html: tag(\"Coach Draft - Action Needed\", \"#B79C6F\") +\n h1(\n esc(draftedBy) + \" has selected \" + esc(playerName) + \" for \" +\n esc(eventName) + \".\",\n ) +\n para(\n \"Hi \" + esc(familyName) +\n \", great news. Our staff has built a roster for the event below and would like \" +\n esc(playerName) +\n \" on it. The spot is held for your family - please confirm to lock it in, or decline if \" +\n esc(playerName) + \" is not available.\",\n ) +\n rule() +\n field(\"Player\", playerName) +\n field(\"Event\", eventName) +\n (eventDates ? field(\"When\", eventDates) : \"\") +\n (eventLocation ? field(\"Where\", eventLocation) : \"\") +\n (squadName ? field(\"Squad\", squadName) : \"\") +\n (amount ? field(\"Cost\", amount) : \"\") +\n (deadline ? field(\"Confirm by\", deadline) : \"\") +\n rule() +\n btn(url, \"Confirm spot for \" + playerName.split(\" \")[0]) +\n italic(\n \"If \" + playerName.split(\" \")[0] +\n \" can't make this one, just reply to this email and we'll release the spot.\",\n ),\n };\n }\n\n if (kind === \"roster_draft_declined\") {\n const playerName = d.player_name || \"a player\";\n const familyName = d.family_name || \"A family\";\n const eventName = d.event_name || \"the event\";\n const squadName = d.squad_name || \"\";\n const reason = d.reason || \"(no reason given)\";\n const adminName = d.admin_name || \"Hi\";\n return {\n subject: \"Family declined - \" + playerName + \" for \" + eventName,\n preheader: familyName + \" has declined the spot. The slot is open again.\",\n html: tag(\"Family Declined - Roster Action Needed\", \"#A73721\") +\n h1(esc(familyName) + \" has declined \" + esc(playerName) + \"'s spot.\") +\n para(\n \"Heads up \" + esc(adminName) + \", the spot for \" + esc(playerName) +\n \" on \" + esc(squadName || eventName) +\n \" is open again. Consider drafting a replacement when you have a chance.\",\n ) +\n rule() +\n field(\"Player\", playerName) +\n field(\"Event\", eventName) +\n (squadName ? field(\"Squad\", squadName) : \"\") +\n field(\"Reason\", reason) +\n italic(\"This is an automated notification from the Roster Builder.\"),\n };\n }\n\n if (kind === \"schedule_changed\") {\n const playerName = d.player_name || \"your player\";\n const familyName = d.family_name || \"Family\";\n const eventName = d.event_name || \"the event\";\n const activityTitle = d.activity_title || \"an activity\";\n const newWhen = d.new_when || \"\";\n const newWhere = d.new_where || \"\";\n const changes = d.changes || [];\n const changeLines = (Array.isArray(changes) ? changes : []).map((c) =>\n '

' + esc(c.label) +\n \": \" +\n '' +\n esc(c.was || \"-\") + \" \" +\n \"to \" + esc(c.now || \"-\") + \"

\"\n ).join(\"\");\n const portalUrl2 = d.portal_url || \"\";\n return {\n subject: \"Schedule update: \" + activityTitle + \" - \" + eventName,\n preheader: \"Heads up - \" + activityTitle + \" details changed for \" +\n playerName + \".\",\n html: tag(\"Schedule updated\", \"#B79C6F\") +\n h1(\"Heads up - \" + esc(activityTitle) + \" details changed.\") +\n para(\n \"Hi \" + esc(familyName) + \", a few things shifted for \" +\n esc(playerName) + \" at \" + esc(eventName) +\n \". Please double-check the new details:\",\n ) +\n rule() +\n (changeLines\n ? '

' + changeLines + \"

\"\n : \"\") +\n (newWhen ? field(\"Now\", newWhen) : \"\") +\n (newWhere ? field(\"Where\", newWhere) : \"\") +\n (portalUrl2\n ? '

View full schedule

'\n : \"\") +\n italic(\n \"This email was sent automatically because a coach updated the schedule. If anything looks wrong, contact your club staff.\",\n ),\n };\n }\n\n if (kind === \"schedule_cancelled\") {\n const playerName = d.player_name || \"your player\";\n const familyName = d.family_name || \"Family\";\n const eventName = d.event_name || \"the event\";\n const activityTitle = d.activity_title || \"an activity\";\n const originalWhen = d.original_when || \"\";\n return {\n subject: \"Cancelled: \" + activityTitle + \" - \" + eventName,\n preheader: activityTitle + \" has been cancelled.\",\n html: tag(\"Activity cancelled\", \"#A73721\") +\n h1(esc(activityTitle) + \" has been cancelled.\") +\n para(\n \"Hi \" + esc(familyName) +\n \", we wanted to let you know right away - \" + esc(activityTitle) +\n \" for \" + esc(playerName) + \" at \" + esc(eventName) +\n \" is no longer happening.\",\n ) +\n rule() +\n (originalWhen ? field(\"Was scheduled for\", originalWhen) : \"\") +\n para(\n \"You can clear it from your calendar. If a make-up is being scheduled, you'll get a fresh notification.\",\n ) +\n italic(\n \"Questions? Reply to this email or reach out to your club staff.\",\n ),\n };\n }\n\n if (kind === \"event_broadcast\") {\n const familyName = d.family_name || d.familyName || \"there\";\n const eventName = d.event_name || d.eventName || \"the event\";\n const subject = d.subject || (\"Update from \" + eventName);\n const bodyText = d.body || \"\";\n const bodyHtml = esc(bodyText)\n .split(/\\n\\n+/)\n .map((p) =>\n '

' +\n p.replace(/\\n/g, \"
\") + \"

\"\n )\n .join(\"\");\n return {\n subject: subject,\n preheader: \"Message about \" + eventName + \" from Forms Academy\",\n html: tag(eventName, \"#1A2D44\") +\n h1(\"Hi \" + esc(familyName.split(\" \")[0]) + \",\") +\n bodyHtml +\n rule() +\n para(\n \"Open the family portal to see the full event details, schedule, and roster.\",\n ) +\n btn(d.portal_url || portalUrl, \"Open Forms portal\") +\n italic(\"Questions? Reply to this email - it goes straight to staff.\"),\n };\n }\n\n if (kind === \"daily_digest\") {\n const adminName = d.admin_name || d.adminName || \"Admin\";\n const dateLabel = d.date_label || d.dateLabel || \"today\";\n const bodyText = d.body || \"Quiet day. No urgent items.\";\n const bodyHtml =\n \"

\" +\n      esc(bodyText) +\n      \"

\";\n return {\n subject: \"Forms briefing - \" + dateLabel,\n preheader: \"Daily ops summary for \" + dateLabel,\n html: tag(\"Daily briefing\", \"#8a6d2c\") +\n h1(\"Good morning, \" + esc(adminName.split(\" \")[0]) + \".\") +\n para(\"Here's what's happening at Forms Academy today.\") +\n bodyHtml +\n btn(d.portal_url || portalUrl, \"Open the portal\") +\n italic(\n \"This briefing runs every weekday at 8 AM Central. Reply to send feedback.\",\n ),\n };\n }\n\n if (kind === \"session_reminder\") {\n // NOTE: field() escapes its value — pass raw strings, never pre-escaped.\n const familyName = d.family_name || d.familyName || \"there\";\n const playerName = d.player_name || d.playerName || \"your player\";\n const title = d.session_title || d.sessionTitle || \"Training\";\n const when = d.when || \"tomorrow\";\n const location = d.location || \"\";\n const teamName = d.team_name || d.teamName || \"\";\n return {\n subject: `Reminder: ${playerName} has training tomorrow`,\n preheader: `${title} - ${when}`,\n html: tag(\"Training tomorrow\", \"#8a6d2c\") +\n h1(\"Hi \" + esc(familyName.split(\" \")[0]) + \",\") +\n para(\n \"Just a heads-up that \" + esc(playerName) +\n \" has training in about 24 hours.\",\n ) +\n rule() +\n field(\"Session\", title) +\n field(\"When\", when) +\n (location ? field(\"Where\", location) : \"\") +\n (teamName ? field(\"Team\", teamName) : \"\") +\n btn(d.portal_url || portalUrl, \"View session details\") +\n italic(\"Need to update RSVP? Tap above to open the family portal.\"),\n };\n }\n\n if (kind === \"activity_reminder\") {\n // NOTE: field() escapes its value — pass raw strings, never pre-escaped.\n const familyName = d.family_name || d.familyName || \"there\";\n const playerList = d.player_list || d.playerList || \"your player\";\n const title = d.activity_title || d.activityTitle || \"Activity\";\n const eventName = d.event_name || d.eventName || \"\";\n const when = d.when || \"tomorrow\";\n const location = d.location || \"\";\n const opponent = d.opponent || \"\";\n return {\n subject: `Reminder: ${title}${eventName ? \" - \" + eventName : \"\"}`,\n preheader: `${title} - ${when}`,\n html: tag(eventName || \"Event tomorrow\", \"#246B3F\") +\n h1(\"Hi \" + esc(familyName.split(\" \")[0]) + \",\") +\n para(\n \"This is a reminder for \" + esc(playerList) + \": \" + esc(title) +\n \" is in about 24 hours.\",\n ) +\n rule() +\n field(\"Activity\", title) +\n (opponent ? field(\"Opponent\", opponent) : \"\") +\n (eventName ? field(\"Event\", eventName) : \"\") +\n field(\"When\", when) +\n (location ? field(\"Where\", location) : \"\") +\n btn(d.portal_url || portalUrl, \"Open the portal\") +\n italic(\"Plan your travel time accordingly. Reply with any questions.\"),\n };\n }\n\n if (kind === \"family_welcome\") {\n const familyName = d.family_name || d.familyName || \"there\";\n const firstName = (d.primary_name || d.primaryName || \"\").split(\" \")[0] ||\n familyName.split(\" \")[0];\n const orgName = d.org_name || d.orgName || \"Forms Academy\";\n const childList = Array.isArray(d.child_names || d.childNames)\n ? (d.child_names || d.childNames)\n : [];\n const childLine = childList.length > 0\n ? \"We've added \" + childList.map((n) => esc(n)).join(\", \") +\n \" to your family record.\"\n : \"\";\n\n return {\n subject: \"Welcome to \" + orgName,\n preheader: \"Your parent portal is ready\",\n html: tag(\"Welcome\", \"#8a6d2c\") +\n h1(\"Hi \" + esc(firstName) + \",\") +\n para(\n \"Welcome to \" + esc(orgName) +\n \". We're glad to have your family with us.\",\n ) +\n (childLine ? para(childLine) : \"\") +\n para(\n \"Your parent portal is ready. From there you'll be able to RSVP for training and matches, see upcoming schedules, manage your contact info, and stay in touch with the coaches. No password - just tap the button below to sign in.\",\n ) +\n btn(d.portal_url || portalUrl, \"Open my portal\") +\n rule() +\n para(\n \"Bookmark that link if you'd like quick access. The link signs you in automatically. You can keep it private - anyone with the link can access your family's portal.\",\n ) +\n italic(\"Questions? Just reply to this email. We read every message.\"),\n };\n }\n\n if (kind === \"admin_new_signup\") {\n const familyName = d.family_name || d.familyName || \"(unknown family)\";\n const primaryName = d.primary_name || d.primaryName || \"\";\n const primaryEmail = d.primary_email || d.primaryEmail || \"\";\n const primaryPhone = d.primary_phone || d.primaryPhone || \"\";\n const childNames = Array.isArray(d.child_names || d.childNames)\n ? (d.child_names || d.childNames)\n : [];\n const interestsArr = Array.isArray(d.interests) ? d.interests : [];\n const interestsNote = d.interests_note || d.interestsNote || \"\";\n const howHeard = d.how_heard || d.howHeard || \"\";\n const adminUrl = d.admin_url || d.adminUrl || portalUrl;\n\n return {\n subject: \"[New signup] \" + familyName,\n preheader: primaryName + \" just joined Forms Academy\",\n html: tag(\"New family signup\", \"#246B3F\") +\n h1(esc(familyName) + \" just signed up\") +\n para(\n \"A new family completed the public join form. Their portal magic link has already been sent. Quick rundown:\",\n ) +\n rule() +\n field(\n \"Primary contact\",\n primaryName + (primaryEmail ? \" - \" + primaryEmail : \"\"),\n ) +\n (primaryPhone ? field(\"Phone\", primaryPhone) : \"\") +\n (childNames.length > 0\n ? fieldHtml(\"Children\", childNames.map((c) => esc(c)).join(\"
\"))\n : \"\") +\n (interestsArr.length > 0\n ? field(\"Interested in\", interestsArr.join(\", \"))\n : \"\") +\n (interestsNote ? field(\"Their note\", interestsNote) : \"\") +\n (howHeard ? field(\"How they heard\", howHeard) : \"\") +\n rule() +\n para(\n \"Recommended next step: follow up within a couple of days to confirm program fit and get their first event registration done.\",\n ) +\n btn(adminUrl, \"Open admin\") +\n italic(\n \"This alert sends automatically when anyone uses the public /join page.\",\n ),\n };\n }\n\n throw new Error(\"unknown kind: \" + kind);\n}\n\nfunction emailShell(title: string, body: string, preheader: string): string {\n return '' +\n esc(title) + \"\" +\n '' +\n '\" +\n '

' +\n '' +\n '\" +\n '\" +\n '

' +\n '' +\n '' +\n '' +\n \"

FORMS ACADEMY

Family Notification

' + body + \"

' +\n \"Forms Academy - Frisco, TX - Madrid, Spain
\" +\n 'formsacademy.com' +\n \"

\";\n}\n\nfunction tag(label: string, color: string): string {\n return '

' +\n    esc(label) + \"

\";\n}\n\nfunction h1(text: string): string {\n return '

' +\n text + \"

\";\n}\n\nfunction para(text: string): string {\n return '

' +\n text + \"

\";\n}\n\nfunction italic(text: string): string {\n return '

' +\n esc(text) + \"

\";\n}\n\nfunction rule(): string {\n return '

';\n}\n\nfunction btn(href: string, label: string): string {\n return '

' +\n '' +\n esc(label) + \"\" +\n \"

\";\n}\n\nfunction field(label: string, value: string): string {\n return '

' +\n '

' +\n    esc(label) + \"

\" +\n '

' +\n esc(value) + \"

\" +\n \"

\";\n}\n\n// Like field(), but the value is pre-built trusted HTML (e.g.
-joined,\n// already-escaped lists). Never pass raw user input here.\nfunction fieldHtml(label: string, valueHtml: string): string {\n return '

' +\n '

' +\n    esc(label) + \"

\" +\n '

' +\n valueHtml + \"

\" +\n \"

\";\n}\n\nfunction linkField(label: string, url: string): string {\n return '

' +\n '

' +\n    esc(label) + \"

\" +\n '

' +\n esc(url) + \"

\" +\n \"

\";\n}\n\nfunction blockField(label: string, value: string): string {\n return '

' +\n '

' +\n    esc(label) + \"

\" +\n '

' +\n    esc(value) + \"

\" +\n \"

\";\n}\n\nfunction receiptBox(\n amountCents: number,\n currency: string,\n paidAt: string,\n method: string,\n): string {\n return '

' +\n '

Payment Receipt

' +\n '

' +\n '' +\n esc(fmtMoney(amountCents, currency)) + \"\" +\n '' +\n (paidAt ? esc(fmtDate(paidAt)) : \"\") + \" - \" + esc(method) + \"\" +\n \"

\";\n}\n\nfunction esc(s: any): string {\n if (s == null) return \"\";\n const str = String(s);\n return str.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\").replace(/'/g, \"'\");\n}\n\nfunction fmtMoney(cents: number, currency: string): string {\n if (cents == null) return \"-\";\n const amt = (cents / 100).toFixed(2);\n if (currency === \"EUR\") return \"EUR \" + amt;\n if (currency === \"GBP\") return \"GBP \" + amt;\n return \"$\" + amt;\n}\n\nfunction fmtDate(iso: string): string {\n if (!iso) return \"\";\n return new Date(iso).toLocaleDateString(\"en-US\", {\n weekday: \"long\",\n month: \"long\",\n day: \"numeric\",\n year: \"numeric\",\n });\n}\n\nfunction fmtDateRange(start: string, end?: string): string {\n if (!start) return \"\";\n const s = new Date(start);\n if (!end || end === start) return fmtDate(start);\n const e = new Date(end);\n return s.toLocaleDateString(\"en-US\", {\n weekday: \"short\",\n month: \"short\",\n day: \"numeric\",\n }) + \" to \" +\n e.toLocaleDateString(\"en-US\", {\n month: \"short\",\n day: \"numeric\",\n year: \"numeric\",\n });\n}\n\nfunction json(\n obj: any,\n status: number,\n headers: Record,\n): Response {\n return new Response(JSON.stringify(obj), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...headers },\n });\n}",[58],{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":43,"_49":62,"_51":63,"_53":54,"_55":-5,"_68":72,"_18":73},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":69,"_18":70},["D",1780702038838],"children",[],[36],["D",1781389101496],[],[58],"702d329a-43c3-11f1-b7a1-42b51c65c3df",["D",1777464210488],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","019cdfb8-beb5-7562-b6a2-fa005c0ee90f","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019cdfb8-beb5-7562-b6a2-fe2ba5beed97","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_126":122},"org",{"_11":12,"_120":-5,"_121":122,"_83":84,"_123":124,"_125":54},"branch",{"_17":60,"_13":16,"_34":41,"_112":74,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/1977df9e-bb24-475d-ff22-184507695c00/square512?exp=1789545599&sig=93b165fc38ddcbdba322b7dd6cbdd58cfb427daf904e568db81252317cf545ef","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":74,"_13":14,"_46":166,"_76":-5,"_77":54,"_78":79,"_80":79,"_81":19,"_82":-5,"_83":84,"_85":-5,"_86":54,"_87":-5,"_88":-5,"_89":48,"_90":91,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_105":167,"_107":168,"_109":169,"_111":54},[160,161],"files",[160,161],"counts",{"_149":48,"_150":151,"_152":48,"_31":153,"_154":155},[145,146],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":43,"_49":62,"_51":63,"_53":54,"_55":-5,"_18":148},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":147},[36],[58],"pulls","branches",1,"forks",{"_156":158,"_159":48},"connections",{"_156":48,"_157":48},"count","unfilledCount",4,"emptyCount",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":43,"_49":62,"_51":63,"_53":54,"_55":-5,"_68":164,"_18":165},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":162,"_18":163},[],[36],[],[58],["D",1777464210488],{"_11":12,"_126":122},{"_11":12,"_120":-5,"_121":122,"_83":84,"_123":124,"_125":54},{"_17":60,"_13":16,"_34":41,"_112":74,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"ctx",{"_105":-5,"_142":203,"_204":205,"_206":207,"_208":54,"_209":54,"_210":54,"_211":45,"_212":-5,"_213":-7,"_214":-7,"_215":48,"_216":54,"_217":54,"_218":-5,"_219":54,"_220":54,"_221":54,"_222":-5},"ENV",{"_174":175,"_176":177,"_178":16,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code