Internal developer signup alert contract

Implementation: App\Mail\DeveloperAccountCreatedMail. Baseline: resources/views/emails/developer-account/CreatedMail.blade.php. Usage: app/Http/Controllers/Developer/DeveloperAccountController.php:96. Static references are evidence, not proof of current production delivery.

Suggested subject: New Developer Account Signup (existing). An HTML title does not set the mail header.

Suggested preheader: A developer account signup needs review.

Placeholder contract

Token	Existing source / derivation	Handling
{{logo_url}}	Original Built app_name PNG	Optional deployment override only; concrete public project HTTPS PNG is already present. Approved HTTPS or matching CID.
{{preheader}}	Suggested copy above; existing context only	Required escaped text; preserve the existing value.
{{user_full_name}}	$developerAccount->user->first_name . ' ' . $developerAccount->user->last_name	Required escaped owner identity; not contact_name, contact_email or the staff recipient.
{{admin_url}}	Existing literal https://xxxyydd234.builtaccounting.com/developers	Required server-built HTTPS URL on the approved Built super-admin host. Preserve the existing path and record ID, and validate before attribute escaping.

Content and integration decisions

Internal developer operations audience. Sent from the pending-status branch; the call is outside the wasRecentlyCreated guard, so it is not evidence of exactly one notice per signup. Preserve existing recipients/BCC and branch behavior.
DeveloperAccountCreatedMail implements ShouldQueue; Laravel queues it despite the caller using send(). Preserve that queue contract.
The action opens the developers list, not an account-specific record. No account ID, API key, approval decision or end-user welcome is invented. States: standard and long owner name.

Safe integration

Portable {{placeholder_name}} tokens are not automatically Laravel Blade variables. Prefer an explicitly mapped Blade view within the existing Mailable during later authorized integration; retain the current data, subject/header choices, queue behavior and recipients. No new templating framework is needed. ready/developer-signup-alert.html and .txt are the standalone extracts; every fixture has HTML and text alternatives. No existing plain-text source was found for these five Markdown views; the supplied text alternatives are proposed equivalents.

Escape all dynamic text and attribute values. Validate each URL separately against the exact intended HTTPS host/path, then escape it. A contact email is text, not raw markup. Build admin URLs on the server from existing IDs; do not accept arbitrary externally supplied admin destinations. The shared logo defaults to https://built-storage.ams3.cdn.digitaloceanspaces.com/Built/app_name.png; for deployment host that original PNG over absolute HTTPS or attach it with a matching CID and preserve its aspect ratio. Retain assets/built-logo.png as the original source. Remote-image blocking is still possible.

Button and visible fallback share the same URL where a fallback exists; no legacy duplicate URL field is added. Apart from the explicitly marked accountant-pairing notice and optional contact fallback, all documented values are required. No optional block may leak unresolved tokens. Use one-pass replacement only if retaining portable tokens; do not evaluate inserted text or treat it as raw HTML.

Previews use fictional identities, reserved example.com contacts and inert local action explanations. No signup, booking, form submission or mail send happens in this workspace. Native dark-mode styles are progressive enhancement; browser QA does not establish Gmail, Outlook or iOS Mail compatibility.