thumbgate 1.7.0 → 1.9.0

package/scripts/autonomous-workflow.js

@@ -0,0 +1,377 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { ensureDir } = require('./fs-utils');
+const {
+  executeJob,
+  readJobState,
+  resumeJob,
+} = require('./async-job-runner');
+const {
+  createCheckpoint,
+  advanceCheckpoint,
+  loadCheckpoint,
+  saveCheckpoint,
+} = require('./workflow-gate-checkpoint');
+const { appendWorkflowRun } = require('./workflow-runs');
+
+function normalizeText(value) {
+  if (value === undefined || value === null) return '';
+  return String(value).trim();
+}
+
+function slugify(value, fallback = 'workflow') {
+  // Avoid any `-+` quantifier in an edge-anchored regex (Sonar javascript:S5852
+  // still flags even the anchored form). Strip edge dashes with a linear scan.
+  const collapsed = normalizeText(value).toLowerCase().replace(/[^a-z0-9]+/g, '-');
+  let start = 0;
+  let end = collapsed.length;
+  while (start < end && collapsed.charCodeAt(start) === 45) start += 1;
+  while (end > start && collapsed.charCodeAt(end - 1) === 45) end -= 1;
+  const normalized = collapsed.slice(start, end);
+  return normalized || fallback;
+}
+
+function getWorkflowPaths(workflowId, cwd = process.cwd()) {
+  const rootDir = path.join(cwd, '.thumbgate', 'autonomous-workflows', workflowId);
+  return {
+    rootDir,
+    checkpointPath: path.join(rootDir, 'checkpoint.json'),
+    reportJsonPath: path.join(rootDir, 'report.json'),
+    reportMdPath: path.join(rootDir, 'report.md'),
+    planPath: path.join(rootDir, 'plan.json'),
+  };
+}
+
+function normalizePlan(input, workflowId) {
+  if (Array.isArray(input)) {
+    return {
+      workflowId,
+      summary: input.map((step) => normalizeText(step)).filter(Boolean).join(' | ') || 'Execution plan ready',
+      steps: input
+        .map((step, index) => ({
+          id: `step_${index + 1}`,
+          description: normalizeText(step),
+        }))
+        .filter((step) => step.description),
+    };
+  }
+
+  if (input && typeof input === 'object') {
+    const steps = Array.isArray(input.steps)
+      ? input.steps
+        .map((step, index) => {
+          if (typeof step === 'string') {
+            return {
+              id: `step_${index + 1}`,
+              description: normalizeText(step),
+            };
+          }
+
+          if (step && typeof step === 'object') {
+            return {
+              id: normalizeText(step.id) || `step_${index + 1}`,
+              description: normalizeText(step.description || step.summary || step.name),
+            };
+          }
+
+          return null;
+        })
+        .filter(Boolean)
+      : [];
+
+    return {
+      workflowId,
+      summary: normalizeText(input.summary) || steps.map((step) => step.description).join(' | ') || 'Execution plan ready',
+      steps,
+    };
+  }
+
+  const summary = normalizeText(input) || 'Execution plan ready';
+  return {
+    workflowId,
+    summary,
+    steps: summary ? [{ id: 'step_1', description: summary }] : [],
+  };
+}
+
+function buildDefaultPlan(spec, workflowId) {
+  const executionSteps = Array.isArray(spec.stages)
+    ? spec.stages.map((stage, index) => normalizeText(stage && (stage.name || stage.context || stage.command)) || `Stage ${index + 1}`)
+    : [];
+
+  return normalizePlan({
+    summary: normalizeText(spec.planSummary) || `Run ${executionSteps.length || 0} execution stage(s) and verify output`,
+    steps: [
+      { id: 'intent', description: normalizeText(spec.intent) || 'Intent captured' },
+      { id: 'plan', description: 'Execution plan generated' },
+      ...executionSteps.map((description, index) => ({
+        id: `execute_${index + 1}`,
+        description,
+      })),
+      { id: 'verify', description: 'Verification loop completed' },
+      { id: 'report', description: 'Evidence-backed report recorded' },
+    ],
+    workflowId,
+  }, workflowId);
+}
+
+function resolvePlan(spec, workflowId) {
+  if (typeof spec.plan === 'function') {
+    return normalizePlan(spec.plan(spec), workflowId);
+  }
+
+  if (spec.plan) {
+    return normalizePlan(spec.plan, workflowId);
+  }
+
+  return buildDefaultPlan(spec, workflowId);
+}
+
+function buildExecutionJob(spec, workflowId, paths, plan) {
+  return {
+    id: spec.jobId || `${workflowId}-execution`,
+    tags: Array.isArray(spec.tags) ? spec.tags : [],
+    skill: spec.skill || 'autonomous-workflow',
+    partnerProfile: spec.partnerProfile || null,
+    verificationMode: spec.verificationMode === 'none' ? 'none' : 'standard',
+    autoImprove: spec.autoImprove !== false,
+    recordFeedback: spec.recordFeedback !== false,
+    stages: Array.isArray(spec.stages) ? spec.stages : [],
+    metadata: {
+      workflowId,
+      planSummary: plan.summary,
+      workflowRoot: paths.rootDir,
+    },
+  };
+}
+
+function writeWorkflowPlan(paths, plan) {
+  ensureDir(paths.rootDir);
+  fs.writeFileSync(paths.planPath, `${JSON.stringify(plan, null, 2)}\n`, 'utf8');
+  return paths.planPath;
+}
+
+function collectEvidenceArtifacts(paths, executionResult, extraArtifacts = []) {
+  return [
+    paths.checkpointPath,
+    paths.planPath,
+    paths.reportJsonPath,
+    paths.reportMdPath,
+    executionResult && executionResult.jobStatePath ? executionResult.jobStatePath : null,
+    ...extraArtifacts,
+  ].filter(Boolean);
+}
+
+function writeWorkflowReport(paths, report) {
+  ensureDir(paths.rootDir);
+  fs.writeFileSync(paths.reportJsonPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+
+  const markdown = [
+    `# ${report.workflowName}`,
+    '',
+    `- Workflow ID: ${report.workflowId}`,
+    `- Status: ${report.status}`,
+    `- Intent: ${report.intent}`,
+    `- Verification accepted: ${report.verification ? String(report.verification.accepted) : 'skipped'}`,
+    `- Evidence artifacts: ${report.evidenceArtifacts.length}`,
+    '',
+    '## Plan',
+    '',
+    report.plan.summary,
+    '',
+    ...report.plan.steps.map((step) => `- ${step.id}: ${step.description}`),
+    '',
+    '## Execution',
+    '',
+    ...report.execution.stageHistory.map((stage) => `- ${stage.name} @ ${stage.completedAt}`),
+    '',
+    '## Evidence Artifacts',
+    '',
+    ...report.evidenceArtifacts.map((artifact) => `- ${artifact}`),
+  ].join('\n');
+
+  fs.writeFileSync(paths.reportMdPath, `${markdown}\n`, 'utf8');
+  return {
+    json: paths.reportJsonPath,
+    markdown: paths.reportMdPath,
+  };
+}
+
+function recordAutonomousWorkflowRun(spec, report, evidenceArtifacts, feedbackDir) {
+  const proofBacked = report.status === 'completed'
+    && (!report.verification || report.verification.accepted)
+    && evidenceArtifacts.length > 0;
+
+  return appendWorkflowRun({
+    workflowId: report.workflowId,
+    workflowName: report.workflowName,
+    owner: spec.owner || 'automation',
+    runtime: 'node',
+    status: report.status,
+    customerType: spec.customerType || 'internal_dogfood',
+    teamId: spec.teamId || null,
+    reviewed: proofBacked,
+    reviewedBy: proofBacked ? (spec.reviewedBy || 'automation') : null,
+    proofBacked,
+    proofArtifacts: evidenceArtifacts,
+    source: spec.source || 'autonomous-workflow',
+    metadata: {
+      intent: report.intent,
+      planSummary: report.plan.summary,
+      verificationAttempts: report.verification ? report.verification.attempts : 0,
+      executionJobId: report.execution.jobId,
+    },
+  }, feedbackDir);
+}
+
+function runAutonomousWorkflow(spec = {}, options = {}) {
+  const cwd = options.cwd || process.cwd();
+  const workflowId = normalizeText(spec.workflowId) || slugify(spec.name || spec.intent, 'autonomous-workflow');
+  const workflowName = normalizeText(spec.name) || `Autonomous workflow ${workflowId}`;
+  const intent = normalizeText(spec.intent) || 'Intent not provided';
+  const paths = getWorkflowPaths(workflowId, cwd);
+  const plan = resolvePlan(spec, workflowId);
+
+  writeWorkflowPlan(paths, plan);
+
+  let checkpoint = createCheckpoint({
+    workflowId,
+    phase: 'intent',
+    status: 'running',
+    intent: { summary: intent },
+    plan,
+    evidence: [paths.planPath],
+    metadata: {
+      workflowName,
+    },
+  });
+  saveCheckpoint(checkpoint, paths.checkpointPath);
+
+  checkpoint = advanceCheckpoint(checkpoint, {
+    phase: 'plan',
+    status: 'running',
+    plan,
+    evidence: [paths.planPath],
+  });
+  saveCheckpoint(checkpoint, paths.checkpointPath);
+
+  const job = buildExecutionJob(spec, workflowId, paths, plan);
+  const executionResult = options.resume === true
+    ? resumeJob(job.id, job)
+    : executeJob(job);
+  const jobState = readJobState(job.id);
+
+  checkpoint = advanceCheckpoint(checkpoint, {
+    phase: 'verify',
+    status: executionResult.status,
+    evidence: jobState && jobState.verification ? [paths.checkpointPath] : [],
+    metadata: {
+      executionJobId: job.id,
+      executionStatus: executionResult.status,
+    },
+  });
+  saveCheckpoint(checkpoint, paths.checkpointPath);
+
+  const report = {
+    workflowId,
+    workflowName,
+    status: executionResult.status,
+    intent,
+    plan,
+    execution: {
+      jobId: job.id,
+      status: executionResult.status,
+      stageHistory: Array.isArray(jobState && jobState.stageHistory) ? jobState.stageHistory : [],
+      checkpointCount: Array.isArray(jobState && jobState.checkpoints) ? jobState.checkpoints.length : 0,
+      currentContext: jobState && jobState.currentContext ? jobState.currentContext : '',
+      jobStatePath: jobState ? path.join(getFeedbackDir(options.feedbackDir), 'jobs', job.id, 'state.json') : null,
+    },
+    verification: executionResult.phases ? executionResult.phases.verification : null,
+    phases: executionResult.phases || null,
+    timestamp: new Date().toISOString(),
+    evidenceArtifacts: [],
+  };
+
+  const evidenceArtifacts = collectEvidenceArtifacts(paths, report.execution, spec.proofArtifacts);
+  report.evidenceArtifacts = evidenceArtifacts;
+
+  checkpoint = advanceCheckpoint(checkpoint, {
+    phase: 'report',
+    status: executionResult.status,
+    report: {
+      status: report.status,
+      generatedAt: report.timestamp,
+    },
+    evidence: evidenceArtifacts,
+  });
+  saveCheckpoint(checkpoint, paths.checkpointPath);
+
+  writeWorkflowReport(paths, report);
+  report.workflowRun = recordAutonomousWorkflowRun(spec, report, evidenceArtifacts, options.feedbackDir);
+  fs.writeFileSync(paths.reportJsonPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+
+  return report;
+}
+
+function getFeedbackDir(feedbackDir) {
+  if (feedbackDir) return feedbackDir;
+  return process.env.THUMBGATE_FEEDBACK_DIR || path.join(process.cwd(), '.thumbgate');
+}
+
+function resumeAutonomousWorkflow(spec = {}, options = {}) {
+  return runAutonomousWorkflow(spec, { ...options, resume: true });
+}
+
+function readWorkflowReport(workflowId, options = {}) {
+  const paths = getWorkflowPaths(workflowId, options.cwd || process.cwd());
+  if (!fs.existsSync(paths.reportJsonPath)) return null;
+  return JSON.parse(fs.readFileSync(paths.reportJsonPath, 'utf8'));
+}
+
+function isCliInvocation(argv = process.argv) {
+  const invokedPath = argv[1];
+  return invokedPath ? path.resolve(invokedPath) === __filename : false;
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const args = {};
+  for (const arg of argv) {
+    if (!arg.startsWith('--')) continue;
+    const [key, ...rest] = arg.slice(2).split('=');
+    args[key] = rest.length > 0 ? rest.join('=') : true;
+  }
+  return args;
+}
+
+if (isCliInvocation()) {
+  const args = parseArgs();
+  if (!args.file) {
+    console.error('Usage: node scripts/autonomous-workflow.js --file=workflow.json [--resume]');
+    process.exit(1);
+  }
+
+  const specPath = path.resolve(args.file);
+  const spec = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+  const report = args.resume ? resumeAutonomousWorkflow(spec) : runAutonomousWorkflow(spec);
+  console.log(JSON.stringify(report, null, 2));
+  process.exit(report.status === 'completed' ? 0 : 1);
+}
+
+module.exports = {
+  buildDefaultPlan,
+  collectEvidenceArtifacts,
+  getWorkflowPaths,
+  normalizePlan,
+  parseArgs,
+  readWorkflowReport,
+  recordAutonomousWorkflowRun,
+  resumeAutonomousWorkflow,
+  runAutonomousWorkflow,
+  slugify,
+  writeWorkflowPlan,
+  writeWorkflowReport,
+};

package/scripts/autoresearch-runner.js

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+'use strict';
+/**
+ * Autoresearch Runner (AUTORESEARCH-02)
+ *
+ * Karpathy-inspired self-optimizing loop for the ThumbGate feedback studio.
+ * Each iteration: mutate local evolution state → run primary + holdout checks
+ * → measure score → keep/discard with rollback snapshots.
+ *
+ * The runner never rewrites tracked source files. It mutates the local
+ * evolution-state overlay, evaluates in place, and only persists accepted
+ * settings plus rollback snapshots.
+ *
+ * Mutation targets (in priority order):
+ *   1. Thompson Sampling priors (HALF_LIFE_DAYS, DECAY_FLOOR)
+ *   2. Prevention rule thresholds (minOccurrences)
+ *   3. Verification loop retries (MAX_RETRIES)
+ *   4. DPO temperature (DPO_BETA)
+ *
+ * Score function: command pass rate × approval weighting, with holdout gating.
+ *
+ * Zero external dependencies.
+ *
+ * Exports: runIteration, runLoop, scoreSuite, MUTATION_TARGETS
+ */
+
+const {
+  getProgress,
+} = require('./experiment-tracker');
+const { buildResearchBrief } = require('./hf-papers');
+const {
+  EVOLUTION_TARGETS,
+  parseCommandScore,
+  runWorkspaceEvolution,
+} = require('./workspace-evolver');
+
+// ---------------------------------------------------------------------------
+// Mutation Targets
+// ---------------------------------------------------------------------------
+
+const MUTATION_TARGETS = EVOLUTION_TARGETS;
+
+// ---------------------------------------------------------------------------
+// Score Function
+// ---------------------------------------------------------------------------
+
+/**
+ * Score a test suite run. Returns a number in [0, 1].
+ *
+ * @param {object} params
+ * @param {string} params.testOutput - stdout from test run
+ * @param {number} [params.approvalRate] - Current approval rate from feedback
+ * @returns {{ score: number, testPassRate: number, details: object }}
+ */
+function scoreSuite(params) {
+  return parseCommandScore(params.testOutput || '', 0, typeof params.approvalRate === 'number' ? params.approvalRate : 0.5);
+}
+
+// ---------------------------------------------------------------------------
+// Single Iteration
+// ---------------------------------------------------------------------------
+
+/**
+ * Run one autoresearch iteration.
+ *
+ * 1. Pick a random mutation target
+ * 2. Read current value, compute a random neighbor
+ * 3. Run the test suite in a tmp env with the mutation
+ * 4. Score and keep/discard via experiment tracker
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.targetName] - Force a specific mutation target
+ * @param {number} [opts.nextValue] - Force the candidate value instead of a random neighbor
+ * @param {string} [opts.testCommand] - Override test command (default: npm test)
+ * @param {string[]} [opts.holdoutCommands] - Optional holdout commands required for acceptance
+ * @param {number} [opts.timeoutMs] - Test timeout in ms (default: 120000)
+ * @param {string} [opts.cwd] - Working directory for evaluation commands
+ * @param {string} [opts.researchQuery] - Optional external research query
+ * @param {number} [opts.paperLimit] - Max papers to ingest for research context
+ * @param {Function} [opts.fetchImpl] - Optional fetch implementation override
+ * @param {Function} [opts.searchPapersImpl] - Optional paper search override
+ * @returns {Promise<object>} experiment result
+ */
+async function runIteration(opts = {}) {
+  const options = opts || {};
+  const timeoutMs = options.timeoutMs || 120000;
+  const testCommand = options.testCommand || 'npm test';
+  const research = options.researchQuery
+    ? await buildResearchBrief({
+      query: options.researchQuery,
+      limit: options.paperLimit,
+      fetchImpl: options.fetchImpl,
+      searchPapersImpl: options.searchPapersImpl,
+      template: 'autoresearch-brief',
+    })
+    : null;
+
+  const result = runWorkspaceEvolution({
+    targetName: options.targetName,
+    nextValue: options.nextValue,
+    primaryCommands: [testCommand],
+    holdoutCommands: options.holdoutCommands || [],
+    timeoutMs,
+    cwd: options.cwd,
+    hypothesisSuffix: research ? `Research query: ${research.query}` : null,
+    additionalMetrics: {
+      researchQuery: research ? research.query : null,
+      researchPackId: research ? research.packId : null,
+      researchPaperIds: research ? research.citations.map((citation) => citation.paperId).filter(Boolean) : [],
+    },
+  });
+
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Multi-Iteration Loop
+// ---------------------------------------------------------------------------
+
+/**
+ * Run N autoresearch iterations.
+ *
+ * @param {object} params
+ * @param {number} params.iterations - Number of experiments to run
+ * @param {string} [params.targetName] - Force a specific mutation target
+ * @param {number} [params.nextValue] - Force the candidate value instead of a random neighbor
+ * @param {string} [params.testCommand] - Override test command
+ * @param {string[]} [params.holdoutCommands] - Optional holdout commands required for acceptance
+ * @param {number} [params.timeoutMs] - Per-iteration timeout
+ * @param {string} [params.cwd] - Working directory for evaluation commands
+ * @param {string} [params.researchQuery] - Optional external research query
+ * @param {number} [params.paperLimit] - Max papers to ingest for research context
+ * @param {Function} [params.fetchImpl] - Optional fetch implementation override
+ * @param {Function} [params.searchPapersImpl] - Optional paper search override
+ * @returns {Promise<object>} { results, progress }
+ */
+async function runLoop(params) {
+  const iterations = params.iterations || 1;
+  const results = [];
+
+  for (let i = 0; i < iterations; i++) {
+    console.log(`\n[autoresearch] Iteration ${i + 1}/${iterations}`);
+    try {
+      const result = await runIteration({
+        targetName: params.targetName,
+        nextValue: Number.isFinite(params.nextValue) ? params.nextValue : undefined,
+        testCommand: params.testCommand,
+        holdoutCommands: params.holdoutCommands,
+        timeoutMs: params.timeoutMs,
+        cwd: params.cwd,
+        researchQuery: params.researchQuery,
+        paperLimit: params.paperLimit,
+        fetchImpl: params.fetchImpl,
+        searchPapersImpl: params.searchPapersImpl,
+      });
+      results.push(result);
+      if (result.kept) {
+        console.log(`  ✓ KEPT: ${result.name} (delta: +${(result.delta || 0).toFixed(4)})`);
+      } else if (result.skipped) {
+        console.log(`  ⊘ SKIPPED: ${result.reason}`);
+      } else {
+        console.log(`  ✗ DISCARDED: ${result.reason}`);
+      }
+    } catch (err) {
+      console.error(`  ✗ ERROR: ${err.message}`);
+      results.push({ error: err.message });
+    }
+  }
+
+  const progress = getProgress();
+  console.log(`\n[autoresearch] Progress: ${progress.completed} experiments, ${progress.kept} kept (${progress.keepRate}%)`);
+  return { results, progress };
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+if (require.main === module) {
+  const args = {};
+  process.argv.slice(2).forEach((arg) => {
+    if (!arg.startsWith('--')) return;
+    const [key, ...rest] = arg.slice(2).split('=');
+    args[key] = rest.length > 0 ? rest.join('=') : true;
+  });
+
+  if (args.run) {
+    const iterations = Number(args.iterations || 1);
+    const testCommand = args['test-command'] || 'npm test';
+    const timeoutMs = Number(args.timeout || 120000);
+    const paperLimit = Number(args['paper-limit'] || 5);
+    const holdoutCommands = args.holdout ? [args.holdout] : [];
+    runLoop({
+      iterations,
+      targetName: args.target || null,
+      nextValue: args['next-value'] !== undefined ? Number(args['next-value']) : undefined,
+      testCommand,
+      holdoutCommands,
+      timeoutMs,
+      cwd: args.cwd || undefined,
+      researchQuery: args['research-query'] || null,
+      paperLimit,
+    }).catch((error) => {
+      console.error(error.message);
+      process.exit(1);
+    });
+  } else if (args.targets) {
+    console.log('Mutation targets:');
+    MUTATION_TARGETS.forEach((t) => {
+      console.log(`  ${t.name} (${t.type}): range [${t.range.join(', ')}], step ${t.step}`);
+    });
+  } else {
+    console.log(`Usage:
+  node scripts/autoresearch-runner.js --run [--iterations=5] [--target=half_life_days] [--next-value=8] [--test-command="npm test"] [--holdout="npm run self-heal:check"] [--timeout=120000] [--research-query="rank fusion"] [--paper-limit=5]
+  node scripts/autoresearch-runner.js --targets`);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Exports
+// ---------------------------------------------------------------------------
+
+module.exports = {
+  runIteration,
+  runLoop,
+  scoreSuite,
+  MUTATION_TARGETS,
+};

package/scripts/billing.js

@@ -511,6 +511,7 @@ function buildTrialActivationEmail({ customerEmail, apiKey, sessionId, planId, a
   const origin = resolvePublicAppOrigin(appOrigin);
   const dashboardUrl = joinPublicUrl(origin, '/dashboard');
   const docsUrl = 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md';
+  const supportEmail = process.env.THUMBGATE_SUPPORT_EMAIL || CONFIG.TRIAL_EMAIL_REPLY_TO || 'igor.ganapolsky@gmail.com';
   const command = `npx thumbgate pro --activate --key=${apiKey || ''}`;
   const subject = 'Your 7-day ThumbGate Pro trial is live';
   const preheader = 'Activate Pro in one command, open the dashboard, and start blocking repeated AI coding mistakes.';
@@ -519,6 +520,7 @@ function buildTrialActivationEmail({ customerEmail, apiKey, sessionId, planId, a
   const exampleFeedback = 'thumbs down: the answer skipped exact files and tests; next time include paths, commands, and verification evidence.';
   const safeDashboardUrl = escapeHtml(dashboardUrl);
   const safeDocsUrl = escapeHtml(docsUrl);
+  const safeSupportEmail = escapeHtml(supportEmail);
   const safeCommand = escapeHtml(command);
   const safeApiKey = escapeHtml(apiKey || '');
   return {
@@ -544,7 +546,7 @@ function buildTrialActivationEmail({ customerEmail, apiKey, sessionId, planId, a
       apiKey,
       '',
       `Verification evidence: ${docsUrl}`,
-      'Keep this key private. Questions? Reply to this email or write hello@thumbgate.app.',
+      `Keep this key private. Questions? Reply to this email or write ${supportEmail}.`,
       sessionId ? `Stripe session: ${sessionId}` : null,
       planId ? `Plan: ${planId}` : null,
     ].filter(Boolean).join('\n'),
@@ -591,7 +593,7 @@ function buildTrialActivationEmail({ customerEmail, apiKey, sessionId, planId, a
 
                 <p style="margin:0;font-size:13px;line-height:1.6;color:#526273;">
                   Proof trail: <a href="${safeDocsUrl}" style="color:#087a91;">verification evidence</a>.
-                  Keep this key private. Questions? Reply here or write <a href="mailto:hello@thumbgate.app" style="color:#087a91;">hello@thumbgate.app</a>.
+                  Keep this key private. Questions? Reply here or write <a href="mailto:${safeSupportEmail}" style="color:#087a91;">${safeSupportEmail}</a>.
                 </p>
                 ${sessionId ? `<p style="margin:12px 0 0;font-size:12px;line-height:1.5;color:#7a8790;">Stripe session: ${escapeHtml(sessionId)}</p>` : ''}
               </td>