\" + esc(c.label) + \": \" +\n \"\" + esc(c.was || \"—\") + \" \" +\n \"→ \" + esc(c.now || \"—\") + \"

\"\n ).join(\"\");\n const portalUrl = d.portal_url || \"\";\n return {\n subject: \"Schedule update: \" + activityTitle + \" - \" + eventName,\n preheader: \"Heads up — \" + activityTitle + \" details changed for \" + playerName + \".\",\n html: tag(\"Schedule updated\", \"#B79C6F\") +\n h1(\"Heads up — \" + esc(activityTitle) + \" details changed.\") +\n para(\"Hi \" + esc(familyName) + \", a few things shifted for \" + esc(playerName) + \" at \" + esc(eventName) + \". Please double-check the new details:\") +\n rule() +\n (changeLines ? \"

\" + changeLines + \"

\" : \"\") +\n (newWhen ? field(\"Now\", newWhen) : \"\") +\n (newWhere ? field(\"Where\", newWhere) : \"\") +\n (portalUrl ? \"

View full schedule

\" : \"\") +\n italic(\"This email was sent automatically because a coach updated the schedule. If anything looks wrong, contact your club staff.\"),\n };\n }\n\n if (kind === \"schedule_cancelled\") {\n // Sent to families when an activity is cancelled or removed entirely.\n const playerName = d.player_name || \"your player\";\n const familyName = d.family_name || \"Family\";\n const eventName = d.event_name || \"the event\";\n const activityTitle = d.activity_title || \"an activity\";\n const originalWhen = d.original_when || \"\";\n return {\n subject: \"Cancelled: \" + activityTitle + \" - \" + eventName,\n preheader: activityTitle + \" has been cancelled.\",\n html: tag(\"Activity cancelled\", \"#A73721\") +\n h1(esc(activityTitle) + \" has been cancelled.\") +\n para(\"Hi \" + esc(familyName) + \", we wanted to let you know right away — \" + esc(activityTitle) + \" for \" + esc(playerName) + \" at \" + esc(eventName) + \" is no longer happening.\") +\n rule() +\n (originalWhen ? field(\"Was scheduled for\", originalWhen) : \"\") +\n para(\"You can clear it from your calendar. If a make-up is being scheduled, you'll get a fresh notification.\") +\n italic(\"Questions? Reply to this email or reach out to your club staff.\"),\n };\n }\n\n if (kind === \"event_broadcast\") {\n // One-shot blast from admin to all families on an event.\n // Data shape (snake_case from frontend):\n // family_name, event_name, event_id, subject, body, portal_url\n const familyName = d.family_name || d.familyName || \"there\";\n const eventName = d.event_name || d.eventName || \"the event\";\n const subject = d.subject || (\"Update from \" + eventName);\n const bodyText = d.body || \"\";\n // Convert plain-text newlines to HTML breaks; preserve double-newlines as paragraph spacing.\n const bodyHtml = esc(bodyText)\n .split(/\\n\\n+/)\n .map(p => '

' + p.replace(/\\n/g, '
') + '

')\n .join(\"\");\n return {\n subject: subject,\n preheader: \"Message about \" + eventName + \" from Forms Academy\",\n html: tag(eventName, \"#1A2D44\") +\n h1(\"Hi \" + esc(familyName.split(\" \")[0]) + \",\") +\n bodyHtml +\n rule() +\n para(\"Open the family portal to see the full event details, schedule, and roster.\") +\n btn(d.portal_url || portalUrl, \"Open Forms portal\") +\n italic(\"Questions? Reply to this email — it goes straight to staff.\"),\n };\n }\n\n if (kind === \"daily_digest\") {\n // 8AM operational briefing for Tier 1 admins.\n // Data shape:\n // admin_name, date_label, body (pre-formatted plain text), portal_url\n const adminName = d.admin_name || d.adminName || \"Admin\";\n const dateLabel = d.date_label || d.dateLabel || \"today\";\n const bodyText = d.body || \"Quiet day. No urgent items.\";\n // The body is already richly formatted plain text from the cron — keep monospace\n // styling so the section dividers (━━━) and bullet alignment survive in email clients.\n const bodyHtml = '

' +\n      esc(bodyText) +\n      '

';\n return {\n subject: \"Forms briefing - \" + dateLabel,\n preheader: \"Daily ops summary for \" + dateLabel,\n html: tag(\"Daily briefing\", \"#8a6d2c\") +\n h1(\"Good morning, \" + esc(adminName.split(\" \")[0]) + \".\") +\n para(\"Here's what's happening at Forms Academy today.\") +\n bodyHtml +\n btn(d.portal_url || portalUrl, \"Open the portal\") +\n italic(\"This briefing runs every weekday at 8 AM Central. Reply to send feedback.\"),\n };\n }\n\n\n\n if (kind === \"team_feed_digest\") {\n // Daily digest of new team and squad feed posts for a family.\n const familyName = d.family_name || d.familyName || \"there\";\n const primaryName = d.primary_name || d.primaryName || \"\";\n const firstName = primaryName.split(\" \")[0] || familyName.split(\" \")[0] || \"there\";\n const items = Array.isArray(d.items) ? d.items : [];\n const totalPosts = Number(d.total_posts || d.totalPosts || items.length || 0);\n const windowLabel = d.window_label || d.windowLabel || \"today\";\n const portal = d.portal_url || d.portalUrl || portalUrl;\n const preferencesUrl = d.manage_preferences_url || d.managePreferencesUrl || portal;\n const firstScope = items[0]?.scope_name || \"your team\";\n const itemHtml = items.map((item: any) => feedDigestItem(item)).join(\"\");\n\n return {\n subject: totalPosts === 1 ? \"New update from \" + firstScope : totalPosts + \" new team updates \" + windowLabel,\n preheader: \"A quick digest of new team feed posts \" + windowLabel + \".\",\n html: tag(\"Team feed digest\", \"#8a6d2c\") +\n h1(\"Hi \" + esc(firstName) + \",\") +\n para(\"Here's what's new on your players' teams \" + esc(windowLabel) + \".\") +\n (itemHtml || para(\"No new posts were included in this digest.\")) +\n btn(portal, \"Open the portal\") +\n rule() +\n '

You are getting this because team feed updates are on. Manage email preferences.

',\n };\n }\n\n if (kind === \"session_reminder\") {\n // 24h-out reminder for a training session.\n // Data: family_name, player_name, session_title, when, location, team_name, portal_url\n const familyName = d.family_name || d.familyName || \"there\";\n const playerName = d.player_name || d.playerName || \"your player\";\n const title = d.session_title || d.sessionTitle || \"Training\";\n const when = d.when || \"tomorrow\";\n const location = d.location || \"\";\n const teamName = d.team_name || d.teamName || \"\";\n return {\n subject: `Reminder: ${playerName} has training tomorrow`,\n preheader: `${title} - ${when}`,\n html: tag(\"Training tomorrow\", \"#8a6d2c\") +\n h1(\"Hi \" + esc(familyName.split(\" \")[0]) + \",\") +\n para(\"Just a heads-up that \" + esc(playerName) + \" has training in about 24 hours.\") +\n rule() +\n field(\"Session\", esc(title)) +\n field(\"When\", esc(when)) +\n (location ? field(\"Where\", esc(location)) : \"\") +\n (teamName ? field(\"Team\", esc(teamName)) : \"\") +\n btn(d.portal_url || portalUrl, \"View session details\") +\n italic(\"Need to update RSVP? Tap above to open the family portal.\"),\n };\n }\n\n if (kind === \"activity_reminder\") {\n // 24h-out reminder for an event activity (match, ceremony, meal, etc.)\n // Data: family_name, player_list, activity_title, event_name, when, location, opponent, portal_url\n const familyName = d.family_name || d.familyName || \"there\";\n const playerList = d.player_list || d.playerList || \"your player\";\n const title = d.activity_title || d.activityTitle || \"Activity\";\n const eventName = d.event_name || d.eventName || \"\";\n const when = d.when || \"tomorrow\";\n const location = d.location || \"\";\n const opponent = d.opponent || \"\";\n return {\n subject: `Reminder: ${title}${eventName ? \" - \" + eventName : \"\"}`,\n preheader: `${title} - ${when}`,\n html: tag(eventName || \"Event tomorrow\", \"#246B3F\") +\n h1(\"Hi \" + esc(familyName.split(\" \")[0]) + \",\") +\n para(\"This is a reminder for \" + esc(playerList) + \": \" + esc(title) + \" is in about 24 hours.\") +\n rule() +\n field(\"Activity\", esc(title)) +\n (opponent ? field(\"Opponent\", esc(opponent)) : \"\") +\n (eventName ? field(\"Event\", esc(eventName)) : \"\") +\n field(\"When\", esc(when)) +\n (location ? field(\"Where\", esc(location)) : \"\") +\n btn(d.portal_url || portalUrl, \"Open the portal\") +\n italic(\"Plan your travel time accordingly. Reply with any questions.\"),\n };\n }\n\n if (kind === \"family_welcome\") {\n // First-touch email when an admin creates a family record. Includes the\n // magic link to the parent portal. Designed to feel warm, not transactional.\n // Data shape:\n // family_name, primary_name, portal_url, child_names (array), org_name\n const familyName = d.family_name || d.familyName || \"there\";\n const firstName = (d.primary_name || d.primaryName || \"\").split(\" \")[0] || familyName.split(\" \")[0];\n const orgName = d.org_name || d.orgName || \"Forms Academy\";\n const childList = Array.isArray(d.child_names || d.childNames) ? (d.child_names || d.childNames) : [];\n const childLine = childList.length > 0\n ? \"We've added \" + childList.map((n) => esc(n)).join(\", \") + \" to your family record.\"\n : \"\";\n\n return {\n subject: \"Welcome to \" + orgName,\n preheader: \"Your parent portal is ready\",\n html: tag(\"Welcome\", \"#8a6d2c\") +\n h1(\"Hi \" + esc(firstName) + \",\") +\n para(\"Welcome to \" + esc(orgName) + \". We're glad to have your family with us.\") +\n (childLine ? para(childLine) : \"\") +\n para(\"Your parent portal is ready. From there you'll be able to RSVP for training and matches, see upcoming schedules, manage your contact info, and stay in touch with the coaches. No password — just tap the button below to sign in.\") +\n btn(d.portal_url || portalUrl, \"Open my portal\") +\n rule() +\n para(\"Bookmark that link if you'd like quick access. The link signs you in automatically. You can keep it private — anyone with the link can access your family's portal.\") +\n italic(\"Questions? Just reply to this email. We read every message.\"),\n };\n }\n\n if (kind === \"family_portal_link\") {\n // Resend of a parent portal magic link to an existing family. Used when:\n // - admin clicks \"Send portal link\" on a roster row\n // - admin clicks \"Send portal link\" on the family detail page\n // - admin promotes a guest player and the family is already known\n // Tone is short and utilitarian — they already know Forms Academy, they\n // just need access. Distinct from family_welcome which is first-touch.\n // Data shape: family_name, primary_name, portal_url, child_names (array), org_name\n const familyName = d.family_name || d.familyName || \"there\";\n const firstName = (d.primary_name || d.primaryName || \"\").split(\" \")[0] || familyName.split(\" \")[0];\n const orgName = d.org_name || d.orgName || \"Forms Academy\";\n const childList = Array.isArray(d.child_names || d.childNames) ? (d.child_names || d.childNames) : [];\n const playerLine = childList.length === 1\n ? \"Use this to manage \" + esc(childList[0]) + \"'s schedule, RSVPs, and payments.\"\n : childList.length > 1\n ? \"Use this to manage \" + childList.map((n) => esc(n)).join(\", \") + \" — schedule, RSVPs, and payments.\"\n : \"Use this to manage your family's schedule, RSVPs, and payments.\";\n\n return {\n subject: \"Your \" + orgName + \" portal access\",\n preheader: \"A fresh sign-in link to your parent portal\",\n html: tag(\"Portal access\", \"#8a6d2c\") +\n h1(\"Hi \" + esc(firstName) + \",\") +\n para(\"Here's a fresh sign-in link to your \" + esc(orgName) + \" parent portal.\") +\n para(playerLine) +\n btn(d.portal_url || portalUrl, \"Open my portal\") +\n rule() +\n para(\"The link signs you in automatically — no password needed. It expires in 7 days. Keep it private; anyone with the link can access your family's portal.\") +\n italic(\"Need help? Just reply to this email.\"),\n };\n }\n\n if (kind === \"admin_new_signup\") {\n // Operational alert email to Tier 1 admin when a new family signs up via /?join.\n // Should feel utilitarian — bullet of key facts, link to admin to follow up.\n // Data shape:\n // family_name, primary_name, primary_email, primary_phone,\n // child_names (array), interests (array), interests_note, how_heard, admin_url\n const familyName = d.family_name || d.familyName || \"(unknown family)\";\n const primaryName = d.primary_name || d.primaryName || \"\";\n const primaryEmail = d.primary_email || d.primaryEmail || \"\";\n const primaryPhone = d.primary_phone || d.primaryPhone || \"\";\n const childNames = Array.isArray(d.child_names || d.childNames) ? (d.child_names || d.childNames) : [];\n const interestsArr = Array.isArray(d.interests) ? d.interests : [];\n const interestsNote = d.interests_note || d.interestsNote || \"\";\n const howHeard = d.how_heard || d.howHeard || \"\";\n const adminUrl = d.admin_url || d.adminUrl || portalUrl;\n\n return {\n subject: \"[New signup] \" + familyName,\n preheader: primaryName + \" just joined Forms Academy\",\n html: tag(\"New family signup\", \"#246B3F\") +\n h1(esc(familyName) + \" just signed up\") +\n para(\"A new family completed the public join form. Their portal magic link has already been sent. Quick rundown:\") +\n rule() +\n field(\"Primary contact\", esc(primaryName) + (primaryEmail ? \" — \" + esc(primaryEmail) : \"\")) +\n (primaryPhone ? field(\"Phone\", esc(primaryPhone)) : \"\") +\n (childNames.length > 0 ? field(\"Children\", childNames.map((c) => esc(c)).join(\"
\")) : \"\") +\n (interestsArr.length > 0 ? field(\"Interested in\", interestsArr.map((i) => esc(i)).join(\", \")) : \"\") +\n (interestsNote ? field(\"Their note\", esc(interestsNote)) : \"\") +\n (howHeard ? field(\"How they heard\", esc(howHeard)) : \"\") +\n rule() +\n para(\"Recommended next step: follow up within a couple of days to confirm program fit and get their first event registration done.\") +\n btn(adminUrl, \"Open admin\") +\n italic(\"This alert sends automatically when anyone uses the public /join page.\"),\n };\n }\n\n throw new Error(\"unknown kind: \" + kind);\n}\n\nfunction emailShell(title: string, body: string, preheader: string): string {\n return '' + esc(title) + '' +\n '' +\n '' +\n '

' +\n '' +\n '' +\n '' +\n '

FORMS ACADEMY

Family Notification

' + body + '

' +\n 'Forms Academy - Frisco, TX - Madrid, Spain
' +\n 'formsacademy.com' +\n '

';\n}\n\nfunction tag(label: string, color: string): string {\n return '

' + esc(label) + '

';\n}\n\nfunction h1(text: string): string {\n return '

' + text + '

';\n}\n\nfunction para(text: string): string {\n return '

' + text + '

';\n}\n\nfunction italic(text: string): string {\n return '

' + esc(text) + '

';\n}\n\nfunction rule(): string {\n return '

';\n}\n\nfunction btn(href: string, label: string): string {\n return '

' +\n '' + esc(label) + '' +\n '

';\n}\n\nfunction field(label: string, value: string): string {\n return '

' +\n '

' + esc(label) + '

' +\n '

' + esc(value) + '

' +\n '

';\n}\n\nfunction linkField(label: string, url: string): string {\n return '

' +\n '

' + esc(label) + '

' +\n '

' + esc(url) + '

' +\n '

';\n}\n\nfunction blockField(label: string, value: string): string {\n return '

' +\n '

' + esc(label) + '

' +\n '

' + esc(value) + '

' +\n '

';\n}\n\n\n\nfunction feedDigestItem(item: any): string {\n const scopeName = item?.scope_name || \"Team update\";\n const scopeContext = item?.scope_context || \"\";\n const authorName = item?.author_name || \"Forms Academy\";\n const postedAt = item?.posted_at_relative || \"\";\n const preview = item?.preview || \"\";\n const url = item?.url || \"#\";\n const photoCount = Number(item?.photo_count || 0);\n const photoLabel = photoCount === 1 ? \"1 photo\" : photoCount + \" photos\";\n\n return '' +\n '

' + esc(scopeName) + (scopeContext ? ' · ' + esc(scopeContext) + '' : '') + '

' +\n '

' + esc(authorName) + (postedAt ? ' - ' + esc(postedAt) : '') + '

' +\n (preview ? '

' + esc(preview) + '

' : '') +\n (photoCount > 0 ? '' + esc(photoLabel) + '' : '') +\n '';\n}\n\nfunction receiptBox(amountCents: number, currency: string, paidAt: string, method: string): string {\n return '

' +\n '

Payment Receipt

' +\n '

' +\n '' + esc(fmtMoney(amountCents, currency)) + '' +\n '' + (paidAt ? esc(fmtDate(paidAt)) : \"\") + ' - ' + esc(method) + '' +\n '

';\n}\n\nfunction esc(s: any): string {\n if (s == null) return \"\";\n const str = String(s);\n return str.replace(/&/g, \"&\").replace(//g, \">\").replace(/\"/g, \""\").replace(/'/g, \"'\");\n}\n\nfunction fmtMoney(cents: number, currency: string): string {\n if (cents == null) return \"-\";\n const amt = (cents / 100).toFixed(2);\n if (currency === \"EUR\") return \"EUR \" + amt;\n if (currency === \"GBP\") return \"GBP \" + amt;\n return \"$\" + amt;\n}\n\nfunction fmtDate(iso: string): string {\n if (!iso) return \"\";\n return new Date(iso).toLocaleDateString(\"en-US\", { weekday: \"long\", month: \"long\", day: \"numeric\", year: \"numeric\" });\n}\n\nfunction fmtDateRange(start: string, end?: string): string {\n if (!start) return \"\";\n const s = new Date(start);\n if (!end || end === start) return fmtDate(start);\n const e = new Date(end);\n return s.toLocaleDateString(\"en-US\", { weekday: \"short\", month: \"short\", day: \"numeric\" }) + \" to \" + e.toLocaleDateString(\"en-US\", { month: \"short\", day: \"numeric\", year: \"numeric\" });\n}\n\nfunction json(obj: any, status: number, headers: Record): Response {\n return new Response(JSON.stringify(obj), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...headers },\n });\n}\n\n// ─── DB-driven email_templates support ──────────────────────────────────────\n// Lets admins publish template rows from the Master UI that override the\n// hardcoded buildTemplate() output above. Safe by design:\n// • Only `status='published'` rows are used; drafts are ignored\n// • Lookup is scoped by kind, org_id, and workspace (`academy`, `residency`, or `both`)\n// • Any failure (network, table-missing, no row) silently falls back to\n// the hardcoded path so email sending never breaks\n// • Variable syntax supports both `{variable_name}` and `{{variable_name}}`\n\nconst SUPABASE_URL_FOR_TEMPLATES = \"https://lmgplytnycmvuemhvmfc.supabase.co\";\nconst SUPABASE_ANON_FOR_TEMPLATES = Deno.env.get(\"FORMS_SUPABASE_ANON\") ||\n \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxtZ3BseXRueWNtdnVlbWh2bWZjIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMwNzQ5ODMsImV4cCI6MjA4ODY1MDk4M30.aLfnSeqMyvyxqwAzM9LQcT2RTMDujc3H3jnFylVmRI8\";\nconst FORMS_ORG_ID_FOR_TEMPLATES = \"a0000000-0000-0000-0000-000000000001\";\n\ntype DbTemplate = { subject: string; preheader: string | null; html_body: string; current_version?: number | string | null; workspace?: string | null };\n\nasync function fetchPublishedTemplate(kind: string, data: any = {}, body: any = {}): Promise {\n // DB-first lookup for admin-authored templates. Published rows are eligible\n // regardless of whether the UI marks them as managed; the lookup is still\n // constrained by kind, org_id, status, and workspace.\n const requestedKind = String(kind || \"\").trim();\n const relevantWorkspace = resolveTemplateWorkspace(requestedKind, data, body);\n try {\n const url = new URL(`${SUPABASE_URL_FOR_TEMPLATES}/rest/v1/email_templates`);\n url.searchParams.set(\"kind\", `eq.${requestedKind}`);\n url.searchParams.set(\"org_id\", `eq.${FORMS_ORG_ID_FOR_TEMPLATES}`);\n url.searchParams.set(\"status\", \"eq.published\");\n url.searchParams.set(\"workspace\", relevantWorkspace === \"both\" ? \"eq.both\" : `in.(both,${relevantWorkspace})`);\n url.searchParams.set(\"html_body\", \"not.is.null\");\n url.searchParams.set(\"select\", \"html_body,subject,preheader,current_version,workspace\");\n url.searchParams.set(\"limit\", \"10\");\n\n const res = await fetch(url.toString(), {\n headers: {\n \"apikey\": SUPABASE_ANON_FOR_TEMPLATES,\n \"Authorization\": `Bearer ${SUPABASE_ANON_FOR_TEMPLATES}`,\n \"Accept\": \"application/json\",\n },\n });\n if (!res.ok) {\n console.warn(`[emails] email_templates lookup failed for kind=${requestedKind} workspace=${relevantWorkspace}: ${res.status}`);\n return null;\n }\n const rows = await res.json();\n if (!Array.isArray(rows) || rows.length === 0) return null;\n const row = rows.find((r: any) => r?.workspace === relevantWorkspace) ||\n rows.find((r: any) => r?.workspace === \"both\") ||\n rows[0];\n if (!row?.subject || !row?.html_body) return null;\n console.log(`[emails] email_templates matched kind=${requestedKind} workspace=${relevantWorkspace} row_workspace=${row.workspace || \"\"} current_version=${row.current_version ?? \"\"}`);\n return {\n subject: row.subject,\n preheader: row.preheader ?? null,\n html_body: row.html_body,\n current_version: row.current_version ?? null,\n workspace: row.workspace ?? null,\n };\n } catch (e: any) {\n console.warn(`[emails] email_templates lookup threw for kind=${requestedKind} workspace=${relevantWorkspace}: ${e?.message || e}`);\n return null;\n }\n}\n\nfunction resolveTemplateWorkspace(kind: string, data: any = {}, body: any = {}): string {\n const d: Record = data || {};\n const b: Record = body || {};\n const candidates = [\n b.workspace,\n b.relevant_workspace,\n b.relevantWorkspace,\n b.account,\n b.stripe_account,\n b.stripeAccount,\n d.workspace,\n d.relevant_workspace,\n d.relevantWorkspace,\n d.account,\n d.stripe_account,\n d.stripeAccount,\n d.program,\n d.program_slug,\n d.programSlug,\n d.org_slug,\n d.orgSlug,\n d.org_name,\n d.orgName,\n kind,\n ];\n for (const raw of candidates) {\n const value = String(raw || \"\").toLowerCase();\n if (!value) continue;\n if (value === \"both\") return \"both\";\n if (value.includes(\"residency\")) return \"residency\";\n if (value.includes(\"academy\") || value.includes(\"madrid\") || value === \"main\") return \"academy\";\n }\n return \"academy\";\n}\n\n// Replace `{variable_name}` and `{{variable_name}}` placeholders with values\n// from data. Handles both snake_case and camelCase lookups so admins can author\n// templates with the UI's convention while callers may still pass legacy keys.\nfunction interpolateDbTemplate(t: DbTemplate, data: any, portalUrl: string): { subject: string; preheader: string; html: string } {\n const d: Record = data || {};\n // Make portal_url + portalUrl + portalURL all resolve to the same thing.\n const baseCtx: Record = {\n ...d,\n portal_url: d.portal_url || d.portalUrl || d.portalURL || portalUrl,\n portalUrl: d.portalUrl || d.portal_url || portalUrl,\n };\n\n const lookup = (key: string): string => {\n // Try exact, then snake↔camel translation, then empty.\n if (baseCtx[key] !== undefined && baseCtx[key] !== null) return String(baseCtx[key]);\n const camel = key.replace(/_([a-z])/g, (_m, c) => c.toUpperCase());\n if (baseCtx[camel] !== undefined && baseCtx[camel] !== null) return String(baseCtx[camel]);\n const snake = key.replace(/[A-Z]/g, (m) => \"_\" + m.toLowerCase());\n if (baseCtx[snake] !== undefined && baseCtx[snake] !== null) return String(baseCtx[snake]);\n return \"\";\n };\n\n // Substitute with HTML-escaping (for html_body context)\n const substituteHtml = (s: string): string => {\n if (!s) return \"\";\n const withDoubleBrace = s.replace(/\\{\\{\\s*([a-zA-Z][a-zA-Z0-9_.]*)\\ s*\\}\\}/g, (_match, key) => {\n return escapeForOutput(lookup(key));\n });\n return withDoubleBrace.replace(/\\{(?!\\{)\\s*([a-zA-Z][a-zA-Z0-9_.]*)\\ s*\\}(?!\\})/g, (_match, key) => {\n return escapeForOutput(lookup(key));\n });\n };\n\n // Substitute WITHOUT HTML-escaping (for subject/preheader — plain text RFC 5322 headers)\n const substitutePlain = (s: string): string => {\n if (!s) return \"\";\n const withDoubleBrace = s.replace(/\\{\\{\\s*([a-zA-Z][a-zA-Z0-9_.]*)\\ s*\\}\\}/g, (_match, key) => {\n return lookup(key);\n });\n return withDoubleBrace.replace(/\\{(?!\\{)\\s*([a-zA-Z][a-zA-Z0-9_.]*)\\ s*\\}(?!\\})/g, (_match, key) => {\n return lookup(key);\n });\n };\n\n // For subject + preheader we want plain text — no HTML escaping.\n // For html_body we HTML-escape interpolated values to prevent rogue data\n // from injecting markup. The static template HTML (authored by admins) stays intact.\n return {\n subject: stripHtml(substitutePlain(t.subject)),\n preheader: stripHtml(substitutePlain(t.preheader || \"\")),\n html: substituteHtml(t.html_body),\n };\n}\n\n// Strip any HTML tags from a string. Used to clean subject/preheader so they\n// don't accidentally render as HTML inside email client previews.\nfunction stripHtml(s: string): string {\n if (!s) return \"\";\n return String(s).replace(/<[^>]*>/g, \"\").replace(/\\s+/g, \" \").trim();\n}\n\n// HTML-escape a value before it's substituted into the html_body. Prevents\n// a malicious or accidental angle-bracket in `data` from breaking the email\n// shell. The static portions of the template (authored by admins via the\n// rich-text editor) keep their HTML intact.\nfunction escapeForOutput(s: string): string {\n if (!s) return \"\";\n return String(s).replace(/[&<>\"']/g, (c) => ({\n \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\"\n }[c] as string));\n}\n",[132],"pulls","branches",1,"forks","envVars",{"_148":150,"_151":59},"connections",{"_148":59,"_149":59},"count","unfilledCount",4,"emptyCount",{"_41":131,"_31":132,"_29":133,"_126":-5,"_39":40,"_38":134,"_127":24,"_36":158,"_13":136,"_32":137,"_34":138,"_23":24,"_129":-5,"_155":159,"_26":160},{"_41":125,"_31":27,"_29":30,"_126":-5,"_39":40,"_38":14,"_127":118,"_36":154,"_13":59,"_32":33,"_34":35,"_23":24,"_129":-5,"_155":156,"_26":157},["D",1780702038838],"children",[],[27],["D",1780476082981],[],[132],["D",1777464210488],{"_93":92,"_100":96},{"_93":92,"_94":-5,"_95":96,"_18":53,"_97":98,"_99":24},{"_13":82,"_31":83,"_41":40,"_84":42,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":43,"_91":92},"ctx",{"_75":-5,"_120":198,"_199":200,"_201":202,"_203":24,"_204":24,"_205":24,"_206":118,"_207":-5,"_208":-7,"_209":-7,"_210":59,"_211":24,"_212":24,"_213":-5,"_214":24,"_215":24,"_216":24,"_217":-5},"ENV",{"_169":170,"_171":172,"_173":83,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v25