@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/email/template.js

@@ -0,0 +1,713 @@
+/**
+ * Notice copy — the chain lane's three (paused, resumed, review request), the member emails'
+ * six (invite, accepted, access granted, review needed / batched / reminder) and the source
+ * contact's low-balance notice.
+ *
+ * Ported STRUCTURE only from eval-engine's `lib/email/template.ts` (a ~56KB, multi-account console
+ * document): one internal `Notice` object per render → `render()` turns it into
+ * `{subject, html, text}` for email, and `chatBody()` turns the SAME object into a short plain-text
+ * twin for a chat surface — so a paused notice can never say something different in the two lanes.
+ * The kit doesn't have v1's owner-pooled subscription/payout accounts (billing is per-collection,
+ * one status column, not three account kinds), so the content itself is far smaller: no coin
+ * figures, no two-account panel, no dollar amounts — just what stopped, why, and where to look.
+ *
+ * Written for EMAIL: inline styles only (no external stylesheet — Gmail strips `<style>` blocks
+ * that aren't inlined onto the elements that need them), a real `text` twin for plain-text clients
+ * and spam filters, and no images (nothing to block, nothing to alt).
+ *
+ * What must never appear here: claim answers, files, the submitter, a key, or anything from the
+ * evaluation itself — a notice is delivery, not a claim payload (matches lib/matrix/events.ts's own
+ * rule). The member emails (invites, access, review requests — the member-emails spec) do carry
+ * people's names, and only through `untrusted()`.
+ *
+ * ALL copy and markup live in this file (member-emails spec, status line): a redesign of the look
+ * or the words touches nothing in the sending, batching or recipient code.
+ */
+const REASON_COPY = {
+    "engine-credits": {
+        label: "the decision engine is out of credits",
+        body: "The decision engine account behind this collection has run out of credits, so we stopped evaluating new claims rather than run up a bill that hasn't been funded.",
+    },
+    "engine-no-grant": {
+        label: "our evaluation authorization was revoked",
+        body: "This oracle no longer holds an active EvaluateClaimAuthorization for this collection, so the chain will not accept a decision from it. Grant the authorization again, then re-register the collection to resume.",
+    },
+    "rubric-unusable": {
+        label: "the anchored rubric could not be used",
+        body: "The rubric anchored to this collection's protocol could not be resolved, or no longer matches its claim form, so every claim would be refused the same way. Fix the anchored rubric or claim form, then resume the collection.",
+    },
+    "payer-credits": {
+        label: "the organisation paying for reviews is out of credits",
+        body: "Reviews of this collection are paid per review from its organisation's credits, and the payment service refused the next one for want of credits (or of the permission to spend them). Top up the organisation's credits in the Decision Console and the oracle resumes on its own.",
+    },
+    "payer-delegation": {
+        label: "no one is set up to pay for its reviews",
+        body: "Reviews of this collection are paid per review by its organisation, and there is no usable review-billing permission on this oracle: none was stored, it expired or was used up, or it was signed by someone who no longer owns the organisation. The organisation's owner renews review billing in the Decision Console and the oracle resumes on its own.",
+    },
+    "oracle-plan": {
+        // Never sent (an IXO condition, paged instead); the copy is here for the type's sake.
+        label: "this oracle's plan does not cover per-review billing",
+        body: "The payment service no longer lets this oracle bill reviews per review. IXO has been told and reviews resume on their own once it is fixed.",
+    },
+    "admin-unfunded": {
+        label: "its admin account can't pay evaluations",
+        // The generic fallback only — `adminUnfundedParagraphs` names the account and the amount.
+        body: "The collection's admin account cannot pay what the chain charges to deliver a decision, so decisions are being recorded but cannot be delivered on chain. Top up the admin account and the oracle resumes on its own.",
+    },
+};
+function adminUnfundedParagraphs(detail) {
+    const { adminAddress, verdict, required, balance } = detail;
+    const needs = required.length > 0
+        ? required.map((coin) => `${coin.amount} ${coin.denom}`).join(" + ")
+        : "an unknown amount";
+    const legs = verdict === "approve" ? "approval" : "rejection";
+    const what = verdict === "approve"
+        ? "the evaluation payment, plus the approval payment unless an escrow holds it"
+        : "the evaluation payment plus the rejection payment";
+    const holds = balance === undefined
+        ? "less than that"
+        : balance.amount === "0" && required.length <= 1
+            ? "nothing"
+            : `${balance.amount} ${balance.denom}`;
+    return [
+        `Delivering this claim's ${legs} on chain needs ${needs} from the collection's admin account ${adminAddress} (${what}), which currently holds ${holds}. Decisions are being recorded but cannot be delivered on chain until it is topped up.`,
+        "Top up the admin account and the oracle resumes on its own within a minute — you'll get a second notice when it's back.",
+    ];
+}
+/**
+ * V1's `portalActionUrl` had a double-slash bug (`.replace(/\/+$/, "") + "//wallet"` — two slashes
+ * before the path). Fixed here: strip trailing slashes on the base exactly once, then join with
+ * exactly one leading slash.
+ */
+export function portalCollectionUrl(config, collectionId) {
+    return `${config.PORTAL_BASE_URL.replace(/\/+$/, "")}/workspace/collections?collectionId=${encodeURIComponent(collectionId)}`;
+}
+function pausedNotice(input) {
+    const { collectionId, reason, actionUrl, detail } = input;
+    const { label, body } = REASON_COPY[reason];
+    return {
+        tone: "paused",
+        brand: input.brand,
+        subject: `Collection ${collectionId} paused — ${label}`,
+        headline: "We have paused evaluations for this collection",
+        paragraphs: reason === "admin-unfunded" && detail
+            ? adminUnfundedParagraphs(detail)
+            : [
+                body,
+                "Nothing has been lost and nothing has been rejected. Claims that come in while this is paused are kept and evaluated, oldest first, once it is resolved.",
+            ],
+        actionLabel: "View this collection",
+        actionUrl,
+        summary: `Collection ${collectionId} is paused: ${label}.`,
+    };
+}
+function resumedNotice(input) {
+    const { collectionId, actionUrl } = input;
+    return {
+        tone: "resumed",
+        brand: input.brand,
+        subject: `Collection ${collectionId} is evaluating again`,
+        headline: "You are all set — we are evaluating your claims again",
+        paragraphs: [
+            "Evaluations have resumed for this collection. Claims that came in while it was paused are being processed now, oldest first.",
+            "You do not need to do anything.",
+        ],
+        actionLabel: "View this collection",
+        actionUrl,
+        summary: `Collection ${collectionId} is evaluating again.`,
+    };
+}
+function reviewRequestNotice(input) {
+    const { claimId, collectionId, link } = input;
+    return {
+        tone: "review",
+        brand: input.brand,
+        subject: `A claim needs your review — collection ${collectionId}`,
+        headline: "A claim needs your review",
+        paragraphs: [
+            `A claim submitted to collection ${collectionId} needs your review before a decision can be finalized.`,
+            "Open it in the portal to answer.",
+        ],
+        actionLabel: "Review this claim",
+        actionUrl: link,
+        summary: `Claim ${claimId} in collection ${collectionId} needs your review.`,
+    };
+}
+// In a member context the `owner` role is a CO-owner: the source's real owner is never invited.
+const ROLE_LABEL = {
+    owner: "Co-owner",
+    developer: "Developer",
+    reviewer: "Reviewer",
+    viewer: "Viewer",
+    submitter: "Submitter",
+};
+const ROLE_LINE = {
+    reviewer: "Reviewers answer the questions some claims need before their decision is final.",
+    developer: "Developers manage API keys, webhooks and claims.",
+    viewer: "Viewers can see claims, decisions and spending, but can't change anything.",
+    submitter: "Submitters file claims and their files, and see the decisions.",
+    owner: "Co-owners can do everything the owner can, including inviting other people.",
+};
+const NAME_MAX = 60;
+/** Zero-width (U+200B–U+200F: ZWSP, ZWNJ, ZWJ, LRM, RLM), bidi embeddings/overrides/isolates, BOM. */
+const INVISIBLE = /[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g;
+/**
+ * §1.5: every source, protocol and person's name is user-supplied — one line, cut at 60 characters
+ * with `…`. Escaping stays where it always was (the renders `esc()` every value); a name only
+ * reaches a URL through `encodeURIComponent`, and today none does. Code points, not UTF-16 units,
+ * so the cut never splits a surrogate pair. Bidi overrides and zero-width characters go first: a
+ * name must not reorder the text around it ("…gnp.exe") or hide inside a look-alike.
+ */
+function untrusted(value) {
+    const line = [...value.replace(INVISIBLE, "").replace(/\s+/g, " ").trim()];
+    return line.length > NAME_MAX ? `${line.slice(0, NAME_MAX).join("")}…` : line.join("");
+}
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+/** §1.6: `12 Oct 2026` — UTC, never relative ("in 3 days" is wrong by the time it is read). */
+function fmtDate(at) {
+    return `${at.getUTCDate()} ${MONTHS[at.getUTCMonth()]} ${at.getUTCFullYear()}`;
+}
+/** §1.6: `12 Oct 2026, 14:05 UTC`. */
+export function fmtTime(at) {
+    const hh = String(at.getUTCHours()).padStart(2, "0");
+    const mm = String(at.getUTCMinutes()).padStart(2, "0");
+    return `${fmtDate(at)}, ${hh}:${mm} UTC`;
+}
+/** §1.4: `apc_7f3a…9c1d` — the first 8 characters (prefix included), `…`, the last 4. */
+function shortClaimId(claimId) {
+    return claimId.length > 13 ? `${claimId.slice(0, 8)}…${claimId.slice(-4)}` : claimId;
+}
+function plural(n, one, many) {
+    return `${n} ${n === 1 ? one : many}`;
+}
+/**
+ * The oracle's own API base as the console names it — `https://<ORACLE_HOSTNAME>`, `http` only for
+ * localhost (the CLI's `oracleUrlFor` rule), so a local console reaches a local `wrangler dev`.
+ */
+export function oracleApiUrl(config) {
+    const host = config.ORACLE_HOSTNAME;
+    return `${/^(localhost|127\.0\.0\.1)(:|$)/.test(host) ? "http" : "https"}://${host}`;
+}
+/**
+ * `CONSOLE_URL` + a path + its query, the base's trailing slashes stripped once (the `//` bug
+ * above). The console is multi-oracle, so every link names WHICH oracle (`oracle=`, appended after
+ * the path's own params) and, for a source's pages, which source (`source=`, last) — else its
+ * `/invite` page would have to try a token on every oracle it lists. Every value is encoded.
+ */
+function consoleLink(input, path, params, { source = true } = {}) {
+    const query = {
+        ...params,
+        oracle: input.oracleUrl,
+        ...(source ? { source: input.source.id } : {}),
+    };
+    const qs = Object.entries(query)
+        .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
+        .join("&");
+    return `${input.consoleUrl.replace(/\/+$/, "")}${path}?${qs}`;
+}
+/** The Protocols row, only when the grant is limited (`nb.protocols`). */
+function protocolsRow(protocols) {
+    return protocols?.length
+        ? [{ label: "Protocols", value: protocols.map(untrusted).join(", ") }]
+        : [];
+}
+/** The Access until row, only when the grant has an expiry. */
+function accessUntilRow(at) {
+    return at ? [{ label: "Access until", value: fmtDate(at) }] : [];
+}
+function inviteNotice(input) {
+    const source = untrusted(input.source.name);
+    const inviter = untrusted(input.inviter);
+    const role = ROLE_LABEL[input.role];
+    const expires = fmtDate(input.expiresAt);
+    return {
+        tone: "member",
+        brand: input.brand,
+        subject: `${inviter} invited you to ${source}`,
+        headline: `You've been invited to ${source}`,
+        paragraphs: [
+            `${inviter} added you to ${source} on the Decision Console as a ${role}. ${ROLE_LINE[input.role]}`,
+            "Sign in with your IXO account to accept. If you don't have one yet, you'll create it as you sign in.",
+            `After you accept, ${inviter} confirms your access, and we'll email you when it's ready.`,
+        ],
+        details: [
+            { label: "Source", value: source },
+            { label: "Role", value: role },
+            ...protocolsRow(input.protocols),
+            { label: "Invited by", value: inviter },
+            { label: "Expires", value: expires },
+        ],
+        actionLabel: "Accept invitation",
+        actionUrl: consoleLink(input, "/invite", { token: input.inviteToken }, 
+        // No `source=`: the token is what names it.
+        { source: false }),
+        summary: `Join as a ${role}. The invitation expires on ${expires}.`,
+        footer: `This invitation was sent to ${input.inviteeEmail}. If you weren't expecting it, you can ignore this email: nothing happens unless you accept. The link works once.`,
+    };
+}
+function inviteAcceptedNotice(input) {
+    const source = untrusted(input.source.name);
+    const member = untrusted(input.member);
+    return {
+        tone: "member",
+        brand: input.brand,
+        subject: `${member} accepted your invitation to ${source}`,
+        headline: `Approve ${member}'s access`,
+        paragraphs: [
+            `${member} accepted your invitation to ${source} and signed in as ${input.accountDid}. They can't see or do anything until you approve.`,
+            "Check this is the person you meant, then approve on the Team page. You'll confirm with your IXO account.",
+        ],
+        details: [
+            { label: "Invited", value: input.invitedEmail },
+            { label: "Signed in as", value: input.accountDid },
+            { label: "Role", value: ROLE_LABEL[input.role] },
+            ...protocolsRow(input.protocols),
+            ...accessUntilRow(input.accessUntil),
+        ],
+        actionLabel: "Review and approve",
+        actionUrl: consoleLink(input, "/team", { member: input.memberId }),
+        summary: "Approve their access so they can start.",
+        footer: `You're getting this because you invited ${input.invitedEmail} to ${source}.`,
+    };
+}
+function accessGrantedNotice(input) {
+    const source = untrusted(input.source.name);
+    const owner = untrusted(input.owner);
+    const role = ROLE_LABEL[input.role];
+    const reviewer = input.role === "reviewer";
+    return {
+        tone: "member",
+        brand: input.brand,
+        subject: `Your access to ${source} is ready`,
+        headline: `Your access to ${source} is ready`,
+        paragraphs: reviewer
+            ? [
+                `${owner} approved you as a ${role}.`,
+                "When a claim needs your review, we'll email you a link straight to it. Everything waiting for you is also in your review queue.",
+                "The first time you answer a review in a new browser, the console creates a signing key for you. It proves the answers are yours, and it takes a second.",
+            ]
+            : [`${owner} approved you as a ${role}.`, "Open the Decision Console to get started."],
+        details: [
+            { label: "Source", value: source },
+            { label: "Role", value: role },
+            ...protocolsRow(input.protocols),
+            ...accessUntilRow(input.accessUntil),
+        ],
+        actionLabel: reviewer ? "Open review queue" : "Open the Decision Console",
+        actionUrl: consoleLink(input, reviewer ? "/reviews" : "/", {}),
+        summary: `${owner} approved you as a ${role}.`,
+        footer: `You're getting this because ${owner} gave you access to ${source}.${input.accessUntil ? ` Your access ends on ${fmtDate(input.accessUntil)} unless they renew it.` : ""}`,
+    };
+}
+function reviewFooter(audience, source) {
+    if (audience === "contact")
+        return `You're getting this because you're the contact for ${source}.`;
+    const why = audience === "reviewer"
+        ? `you're a reviewer for ${source}`
+        : `you can review claims for ${source}`;
+    return `You're getting this because ${why}. You can turn these emails off in your console profile.`;
+}
+/** §6/§7: one row per claim, oldest first, at most 5, then `And {m} more`. */
+const BATCH_ROWS = 5;
+function oldestFirst(claims) {
+    return [...claims].sort((a, b) => a.waitingSince.getTime() - b.waitingSince.getTime());
+}
+function claimRows(sorted) {
+    const rows = sorted.slice(0, BATCH_ROWS).map((claim) => ({
+        label: untrusted(claim.protocol),
+        value: `${shortClaimId(claim.claimId)} · ${plural(claim.questions, "question", "questions")}${claim.answerBy ? ` · answer by ${fmtDate(claim.answerBy)}` : ""}`,
+    }));
+    const more = sorted.length - BATCH_ROWS;
+    return more > 0 ? [...rows, { label: `And ${more} more`, value: "in your review queue" }] : rows;
+}
+/**
+ * The payment deadline in plain words, for the earliest paid claim among `claims` — none has one ⇒
+ * no line at all, so an unpaid claim's copy is exactly what it was.
+ */
+function answerByLine(claims) {
+    const deadlines = claims.flatMap((c) => (c.answerBy ? [c.answerBy.getTime()] : []));
+    if (deadlines.length === 0)
+        return [];
+    // To the minute: a hold that was not extended runs out 24 h after verify, the same day.
+    const by = fmtTime(new Date(Math.min(...deadlines)));
+    return [
+        claims.length === 1
+            ? `Answer by ${by}, or this claim can't be paid.`
+            : `The earliest deadline is ${by}; claims not answered by their date can't be paid.`,
+    ];
+}
+function reviewQueueUrl(input) {
+    return consoleLink(input, "/reviews", {});
+}
+function reviewNeededNotice(input) {
+    const source = untrusted(input.source.name);
+    const protocol = untrusted(input.claim.protocol);
+    const questions = plural(input.claim.questions, "question", "questions");
+    return {
+        tone: "review",
+        brand: input.brand,
+        subject: `Review needed: ${protocol} claim for ${source}`,
+        // The contact is told, not asked: they may not be a reviewer themselves.
+        headline: `A claim is waiting for ${input.audience === "contact" ? "a reviewer" : "your review"}`,
+        paragraphs: [
+            `A ${protocol} claim submitted to ${source} needs a reviewer's answers to ${questions} before its decision is final.`,
+            "The first reviewer to answer completes it. If someone has already answered, the link shows you the result.",
+            ...answerByLine([input.claim]),
+        ],
+        details: [
+            { label: "Claim", value: shortClaimId(input.claim.claimId) },
+            { label: "Protocol", value: protocol },
+            { label: "Questions", value: String(input.claim.questions) },
+            { label: "Waiting since", value: fmtTime(input.claim.waitingSince) },
+            ...(input.claim.answerBy
+                ? [{ label: "Answer by", value: fmtTime(input.claim.answerBy) }]
+                : []),
+        ],
+        actionLabel: "Review claim",
+        actionUrl: consoleLink(input, `/claims/${encodeURIComponent(input.claim.claimId)}`, {
+            review: "1",
+        }),
+        summary: `${questions} to answer before the decision is final.`,
+        footer: reviewFooter(input.audience, source),
+    };
+}
+function reviewBatchNotice(input) {
+    const source = untrusted(input.source.name);
+    const sorted = oldestFirst(input.claims);
+    const n = sorted.length;
+    const your = input.audience === "contact" ? "" : "your ";
+    return {
+        tone: "review",
+        brand: input.brand,
+        subject: `${n} claims need ${your}review for ${source}`,
+        headline: `${n} claims are waiting for ${input.audience === "contact" ? "a reviewer" : "your review"}`,
+        paragraphs: [
+            `${n} claims submitted to ${source} need a reviewer's answers before their decisions are final.`,
+            "The first reviewer to answer each one completes it.",
+            ...answerByLine(sorted),
+        ],
+        details: claimRows(sorted),
+        actionLabel: "Open review queue",
+        actionUrl: reviewQueueUrl(input),
+        summary: `The oldest has been waiting since ${fmtTime(sorted[0]?.waitingSince ?? new Date(0))}.`,
+        footer: reviewFooter(input.audience, source),
+    };
+}
+function reviewReminderNotice(input) {
+    const source = untrusted(input.source.name);
+    const sorted = oldestFirst(input.claims);
+    const n = sorted.length;
+    const one = n === 1;
+    const claims = plural(n, "claim", "claims");
+    const oldest = fmtDate(sorted[0]?.waitingSince ?? new Date(0));
+    return {
+        tone: "review",
+        brand: input.brand,
+        subject: `${input.days === 14 ? "Two weeks waiting" : "Still waiting"}: ${claims} ${one ? "needs" : "need"} review for ${source}`,
+        headline: `These claims have been waiting ${input.days === 14 ? "two weeks" : "3 days"}`,
+        paragraphs: [
+            `${claims} for ${source} ${one ? "has" : "have"} been waiting for a reviewer since ${oldest}. Until someone answers, ${one ? "its decision stays" : "their decisions stay"} pending and the submitter has no result.`,
+            ...answerByLine(sorted),
+        ],
+        details: claimRows(sorted),
+        actionLabel: "Open review queue",
+        actionUrl: reviewQueueUrl(input),
+        summary: "Until someone answers, the submitter has no decision.",
+        footer: reviewFooter(input.audience, source),
+    };
+}
+/** The Decision Console's "Pay for reviews" page (its `BILLING_HUB` tab). */
+export const CONSOLE_REVIEW_BILLING_PATH = "/billing/reviews";
+/** How to raise or renew review billing — the same words in both notices (owner, 2026-10-14). */
+function raiseReviewBilling(input) {
+    const page = `${input.consoleUrl.replace(/\/+$/, "")}${CONSOLE_REVIEW_BILLING_PATH}`;
+    return `To raise it, any of three ways: ask Claude Code to run \`decision-oracle api review-billing enable --source ${input.source.id} --cap <PAY>\` (it shows a dry run first); use the OpenHands web app, signed in as the organisation's owner; or use the Decision Console's Pay for reviews tab: ${page}.`;
+}
+/** upay as PAY, exact and grouped: `1,234.5 PAY`. No float ever touches the amount. */
+function fmtPay(upay) {
+    const n = BigInt(upay);
+    const fraction = (n % 1000000n).toString().padStart(6, "0").replace(/0+$/, "");
+    return `${(n / 1000000n).toLocaleString("en-US")}${fraction ? `.${fraction}` : ""} PAY`;
+}
+/** Whole cents as dollars: `$1,234.50`. The only place a money figure is formatted for a person. */
+function fmtCents(cents) {
+    return (cents / 100).toLocaleString("en-US", { style: "currency", currency: "USD" });
+}
+function balanceLowNotice(input) {
+    const source = untrusted(input.source.name);
+    const balance = fmtCents(input.balanceCents);
+    const floor = fmtCents(input.floorCents);
+    return {
+        tone: "balance",
+        brand: input.brand,
+        subject: `Credits are running low for ${source}`,
+        headline: "Your credits are running low",
+        paragraphs: [
+            `The credits that pay for ${source}'s decisions are down to ${balance}, below the ${floor} you asked us to warn you at.`,
+            "When they run out, new claims need payment before they're accepted. Claims already accepted still finish.",
+        ],
+        details: [
+            { label: "Source", value: source },
+            { label: "Balance", value: balance },
+            { label: "Warn below", value: floor },
+        ],
+        actionLabel: "Add credits",
+        // §12.1: every top-up link is the console's Credits page — the 402 `fundingUrl`'s too.
+        actionUrl: `${input.consoleUrl.replace(/\/+$/, "")}/credits`,
+        summary: `${balance} left, below your ${floor} warning level.`,
+        footer: `You're getting this because this address is the contact for ${source}. We send it once a day while the balance stays below the level set on the source.`,
+    };
+}
+function reviewBillingExpiringNotice(input) {
+    const source = untrusted(input.source.name);
+    const day = input.expiresAt.toISOString().slice(0, 10);
+    const within = input.daysLeft === 7 ? "a week" : "a month";
+    return {
+        tone: "balance",
+        brand: input.brand,
+        subject: `Review billing for ${source} ends on ${day}`,
+        headline: `Review billing ends in under ${within}`,
+        paragraphs: [
+            `The permission that pays for reviews of ${source}'s collections from its credits ends on ${day}.`,
+            "After that, reviews of those collections pause until a new one is signed. Renew it before then and nothing stops.",
+            raiseReviewBilling(input).replace("To raise it", "To renew it"),
+        ],
+        details: [
+            { label: "Source", value: source },
+            { label: "Ends", value: day },
+        ],
+        actionLabel: "Renew review billing",
+        actionUrl: `${input.consoleUrl.replace(/\/+$/, "")}${CONSOLE_REVIEW_BILLING_PATH}`,
+        summary: `Review billing for ${source} ends on ${day}.`,
+        footer: `You're getting this because you signed ${source}'s review billing, or this address is its contact. We send it 30 and 7 days before the end.`,
+    };
+}
+function reviewBillingCapNotice(input) {
+    const source = untrusted(input.source.name);
+    const left = fmtPay(input.remainingUpay);
+    const cap = fmtPay(input.capUpay);
+    const reviews = input.reviewsLeft === null ? null : plural(input.reviewsLeft, "review", "reviews");
+    return {
+        tone: "balance",
+        brand: input.brand,
+        subject: `Review billing for ${source} has used ${input.percent}% of its limit`,
+        headline: `${input.percent}% of your review billing limit is used`,
+        paragraphs: [
+            `The permission that pays for reviews of ${source}'s collections has ${left} left of its ${cap} limit${reviews ? ` — about ${reviews} at the current price` : ""}.`,
+            "The limit counts everything it has ever paid and never resets. When it runs out, reviews of those collections pause until a higher limit is signed.",
+            `${raiseReviewBilling(input)} The new limit replaces this one.`,
+        ],
+        details: [
+            { label: "Source", value: source },
+            { label: "Left", value: left },
+            { label: "Limit", value: cap },
+            ...(reviews ? [{ label: "About", value: reviews }] : []),
+        ],
+        actionLabel: "Raise the limit",
+        actionUrl: `${input.consoleUrl.replace(/\/+$/, "")}${CONSOLE_REVIEW_BILLING_PATH}`,
+        summary: `${left} left of ${source}'s review billing limit.`,
+        footer: `You're getting this because you signed ${source}'s review billing, or this address is its contact. We send it once at 80% and once at 95% of each limit.`,
+    };
+}
+// --- HTML ----------------------------------------------------------------------------------------
+function esc(value) {
+    return value
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+const SANS = `-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif`;
+/** The chain lane's footer — the default when a notice sets none (member-emails §1.2). */
+const CHAIN_FOOTER = "You are getting this because you have a claim collection registered with this evaluation oracle.";
+/** The paragraphs with the callout slotted in after the one it qualifies — every render's order. */
+function blocks(notice) {
+    const out = [];
+    notice.paragraphs.forEach((text, i) => {
+        out.push({ text });
+        if (notice.callout?.afterParagraph === i)
+            out.push({ text: notice.callout.text, callout: true });
+    });
+    return out;
+}
+function detailsHtml(details) {
+    const rows = details
+        .map((row, i) => {
+        const rule = i === 0 ? "" : "border-top:1px solid #e3e8ef;";
+        return `<tr><td valign="top" style="${rule}padding:9px 16px 9px 0;font:400 13px/1.45 ${SANS};color:#55606b;white-space:nowrap;">${esc(row.label)}</td><td valign="top" style="${rule}padding:9px 0;font:400 14px/1.45 ${SANS};color:#12161c;">${esc(row.value)}</td></tr>`;
+    })
+        .join("");
+    return `<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="margin:4px 0 18px;border-collapse:collapse;">${rows}</table>`;
+}
+function renderHtml(notice) {
+    const body = blocks(notice)
+        .map(({ text, callout }) => callout
+        ? `<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="margin:0 0 14px;"><tr><td bgcolor="#fff6e5" style="background:#fff6e5;border:1px solid #f1d9a6;border-radius:8px;padding:12px 14px;font:400 14px/1.55 ${SANS};color:#6b4600;">${esc(text)}</td></tr></table>`
+        : `<p style="margin:0 0 14px;font:400 15px/1.6 ${SANS};color:#12161c;">${esc(text)}</p>`)
+        .join("");
+    const details = notice.details?.length ? detailsHtml(notice.details) : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width,initial-scale=1" />
+<meta name="color-scheme" content="light" />
+<meta name="supported-color-schemes" content="light" />
+<title>${esc(notice.subject)}</title>
+</head>
+<body bgcolor="#f6f8fa" style="margin:0;padding:0;width:100%;background:#f6f8fa;">
+<div style="display:none;max-height:0;overflow:hidden;opacity:0;">${esc(notice.summary)}</div>
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#f6f8fa" style="background:#f6f8fa;">
+<tr><td align="center" style="padding:32px 12px 40px;">
+<table role="presentation" width="600" cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;">
+  <tr><td style="padding:0 2px 16px;">
+    <span style="font:700 13px/1 ${SANS};letter-spacing:0.14em;text-transform:uppercase;color:#12161c;">${esc(notice.brand)}</span>
+  </td></tr>
+  <tr><td bgcolor="#ffffff" style="background:#ffffff;border:1px solid #e3e8ef;border-radius:12px;padding:30px 32px;">
+    <h1 style="margin:0 0 14px;font:700 22px/1.3 ${SANS};letter-spacing:-0.01em;color:#12161c;">${esc(notice.headline)}</h1>
+    ${body}${details}
+    <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin-top:10px;"><tr>
+      <td bgcolor="#007c99" style="border-radius:8px;background:#007c99;">
+        <a href="${esc(notice.actionUrl)}" style="display:inline-block;padding:12px 22px;border-radius:8px;font:600 14px/1 ${SANS};color:#ffffff;text-decoration:none;">${esc(notice.actionLabel)}</a>
+      </td>
+    </tr></table>
+    <p style="margin:12px 0 0;font:400 12px/1.5 ui-monospace,SFMono-Regular,Menlo,monospace;color:#55606b;word-break:break-all;">${esc(notice.actionUrl)}</p>
+  </td></tr>
+  <tr><td style="padding:18px 6px 0;font:400 12px/1.6 ${SANS};color:#6b7681;">
+    ${esc(notice.footer ?? CHAIN_FOOTER)}
+  </td></tr>
+</table>
+</td></tr>
+</table>
+</body>
+</html>`;
+}
+/** `Label: value`, one line each — the details block in every plain-text render. */
+function detailLines(notice) {
+    return (notice.details ?? []).map((row) => `${row.label}: ${row.value}`);
+}
+function renderText(notice) {
+    const details = detailLines(notice);
+    return [
+        notice.headline,
+        "",
+        blocks(notice)
+            .map((b) => b.text)
+            .join("\n\n"),
+        "",
+        ...(details.length ? [...details, ""] : []),
+        `${notice.actionLabel}: ${notice.actionUrl}`,
+        "",
+        "—",
+        notice.footer ?? CHAIN_FOOTER,
+    ].join("\n");
+}
+function render(notice) {
+    return { subject: notice.subject, html: renderHtml(notice), text: renderText(notice) };
+}
+/**
+ * The legacy `.m.rule.roomnotif` push rule pings the WHOLE room when a plain `body` contains
+ * `@room` (case-insensitive glob) and the sender may notify — the oracle may. A user-supplied name
+ * must not do that, so the `@` becomes a fullwidth `＠` (no zero-width trick: `untrusted()` strips
+ * those, and a reader copying the text gets what they see).
+ */
+const ROOM_PING = /@(room)/gi;
+/**
+ * The chat-surface twin — same content, condensed. `workflows/steps.ts` posts it into the
+ * collection's review room as the `m.room.message` `body` (Matrix is the PRIMARY channel; email is
+ * the twin), so a paused/resumed notice can never drift between the
+ * two lanes: both renders are provably built from ONE Notice. The details and the callout ride
+ * along (member-emails §1.9); the footer does not — a room post isn't addressed to one person.
+ */
+function chatBody(notice) {
+    const details = detailLines(notice);
+    return [
+        notice.summary,
+        ...blocks(notice).map((b) => b.text),
+        ...(details.length ? [details.join("\n")] : []),
+        `${notice.actionLabel}: ${notice.actionUrl}`,
+    ]
+        .join("\n\n")
+        .replace(ROOM_PING, "＠$1");
+}
+/**
+ * The `formatted_body` twin of `chatBody` — the Matrix HTML subset only (`p`, `strong`, `br`,
+ * `a`), no tables/bgcolor: the email `render()` markup is far too heavy for a chat bubble. The
+ * callout is a bold paragraph. Same escaping rule as the email: every interpolated value goes
+ * through `esc`.
+ */
+function noticeHtml(notice) {
+    const paragraphs = blocks(notice)
+        .map(({ text, callout }) => callout ? `<p><strong>${esc(text)}</strong></p>` : `<p>${esc(text)}</p>`)
+        .join("");
+    const details = notice.details?.length
+        ? `<p>${notice.details.map((row) => `${esc(row.label)}: ${esc(row.value)}`).join("<br>")}</p>`
+        : "";
+    return `<p><strong>${esc(notice.summary)}</strong></p>${paragraphs}${details}<p><a href="${esc(notice.actionUrl)}">${esc(notice.actionLabel)}</a></p>`;
+}
+function chat(notice) {
+    return { body: chatBody(notice), formattedBody: noticeHtml(notice) };
+}
+// --- the exported renders --------------------------------------------------------------------------
+export function renderPausedEmail(input) {
+    return render(pausedNotice(input));
+}
+export function pausedNoticeChat(input) {
+    return chatBody(pausedNotice(input));
+}
+export function pausedNoticeHtml(input) {
+    return noticeHtml(pausedNotice(input));
+}
+export function renderResumedEmail(input) {
+    return render(resumedNotice(input));
+}
+export function resumedNoticeChat(input) {
+    return chatBody(resumedNotice(input));
+}
+export function resumedNoticeHtml(input) {
+    return noticeHtml(resumedNotice(input));
+}
+export function renderReviewRequestEmail(input) {
+    return render(reviewRequestNotice(input));
+}
+export function reviewRequestNoticeChat(input) {
+    return chatBody(reviewRequestNotice(input));
+}
+export function renderInviteEmail(input) {
+    return render(inviteNotice(input));
+}
+export function renderInviteAcceptedEmail(input) {
+    return render(inviteAcceptedNotice(input));
+}
+export function renderAccessGrantedEmail(input) {
+    return render(accessGrantedNotice(input));
+}
+export function renderReviewNeededEmail(input) {
+    return render(reviewNeededNotice(input));
+}
+/** §1.9: the review room's post, from the SAME Notice as the email. */
+export function reviewNeededChat(input) {
+    return chat(reviewNeededNotice(input));
+}
+export function renderReviewBatchEmail(input) {
+    return render(reviewBatchNotice(input));
+}
+export function reviewBatchChat(input) {
+    return chat(reviewBatchNotice(input));
+}
+export function renderReviewReminderEmail(input) {
+    return render(reviewReminderNotice(input));
+}
+export function reviewReminderChat(input) {
+    return chat(reviewReminderNotice(input));
+}
+export function renderBalanceLowEmail(input) {
+    return render(balanceLowNotice(input));
+}
+export function renderReviewBillingCapEmail(input) {
+    return render(reviewBillingCapNotice(input));
+}
+export function renderReviewBillingExpiringEmail(input) {
+    return render(reviewBillingExpiringNotice(input));
+}
+//# sourceMappingURL=template.js.map