@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.44.17

package/src/nodes/cart/cart-price-order.ts

@@ -6,6 +6,12 @@ import {
   ProductOptions,
 } from '@teleporthq/teleport-shared'
 import { NodeHandlerGenerator, handlerToString } from '../types'
+import {
+  STALLED_RESERVATION_RELEASE,
+  STOCK_RESERVATION_KEY,
+  buildStalledReservationCandidatesQuery,
+  buildStalledReservationReleaseQueries,
+} from '../../ecommerce/place-order-guards'
 import { cartGetTotal } from './cart-get-total'
 
 // AMBIENT, not imported — see cart-get-total.ts. `__cartPricingSettings` is
@@ -13,6 +19,16 @@ import { cartGetTotal } from './cart-get-total'
 // helpers and `__runCartTotal` are spliced into the handler by
 // `generateHandler` below.
 declare const __cartPricingSettings: any
+// Spliced in by `generateHandler`: the statement that releases the stock of
+// orders whose checkout never reached a payment page (place-order-guards.ts),
+// in the forms tried in turn: logging each order with the ledger's record
+// columns, logging on an older ledger, and for a store with no ledger.
+declare const __stalledReservationReleaseQueries: string[]
+// The orders a pass may release, read first (unlocked) so their metadata is
+// parsed here: a malformed row is skipped and logged, never cast in SQL.
+declare const __stalledReservationCandidatesQuery: string
+declare const __stalledReservationKey: string
+declare const __stalledReservationBatchSize: number
 declare function __clPriceLine(
   item: any,
   product: any,
@@ -53,9 +69,37 @@ declare function __ccMixedCartMessage(codes: string[]): string
  * here, what the order lines record). An order that cannot be priced answers
  * `priced: false` with a `reason` for the buyer — never `error`, which the
  * runtime treats as fatal — and the workflow refuses it.
+ *
+ * The payment method is decided here too, from the store's own methods
+ * (`paymentMethods` in the same settings): cash on delivery only where the
+ * store takes it, otherwise one of its enabled online providers. An empty
+ * method is refused — never read as cash on delivery — and so is a checkout
+ * that does not say which method it chose. The accepted method travels in
+ * the result (`paymentMethod`), so the order is assembled from the method
+ * checked here rather than whatever a later request says.
+ *
+ * `stockDeltas` is what the order takes from stock — the units per product
+ * (variantless lines) and per variant, duplicates summed — read off the lines
+ * priced here, for the statement that reserves them with the order.
+ *
+ * `pricedForm` / `pricedShipToDifferent` are the checkout form and the
+ * ship-to-different flag this step priced shipping and tax for. The assemble
+ * step builds the order's addresses from them, so the address an order
+ * records is always the one it was priced (and its zone decided) for.
  */
 async function cart_price_order(config: any, context: any) {
-  const refuse = (reason: string) => ({ priced: false, reason, lines: [] as unknown[] })
+  const noStock = () => ({
+    productIds: [] as string[],
+    productQtys: [] as number[],
+    variantIds: [] as string[],
+    variantQtys: [] as number[],
+  })
+  const refuse = (reason: string) => ({
+    priced: false,
+    reason,
+    lines: [] as unknown[],
+    stockDeltas: noStock(),
+  })
   const settings =
     typeof __cartPricingSettings !== 'undefined' && __cartPricingSettings
       ? __cartPricingSettings
@@ -64,6 +108,25 @@ async function cart_price_order(config: any, context: any) {
     return refuse('This store cannot price the order right now. Please try again later.')
   }
 
+  const methods =
+    settings.paymentMethods && typeof settings.paymentMethods === 'object'
+      ? settings.paymentMethods
+      : null
+  if (!methods || !Object.prototype.hasOwnProperty.call(config, 'paymentMethod')) {
+    return refuse('This store cannot take the order right now. Please try again later.')
+  }
+  const paymentMethod = typeof config.paymentMethod === 'string' ? config.paymentMethod.trim() : ''
+  if (!paymentMethod) {
+    return refuse('Choose a payment method to place your order.')
+  }
+  if (paymentMethod === 'cash_on_delivery') {
+    if (methods.cashOnDelivery !== true) {
+      return refuse("This store doesn't take payment on delivery. Choose another payment method.")
+    }
+  } else if (!Array.isArray(methods.providers) || methods.providers.indexOf(paymentMethod) === -1) {
+    return refuse("This payment method isn't available. Choose another payment method.")
+  }
+
   const readRows = (value: any): any[] => {
     if (Array.isArray(value)) {
       return value
@@ -121,6 +184,105 @@ async function cart_price_order(config: any, context: any) {
     return Array.isArray(body && body.rows) ? body.rows : []
   }
 
+  // Orders that reserved stock but never reached a payment page get no
+  // provider event, and on a store without scheduled workflows nothing else
+  // runs for them: each checkout releases the ones past their hold first, at
+  // most one pass per instance every five minutes, never awaited where the
+  // runtime keeps it alive: a long-running server, or Vercel's waitUntil when
+  // the app has one. A Vercel function without it waits for the pass (one
+  // bounded statement). A pass that releases a full batch lets the next
+  // checkout run another at once, so a backlog drains at least as fast as
+  // checkouts add to it. A failed pass is retried by the first checkout after
+  // those five minutes.
+  if (settings.releaseStalledReservations === true) {
+    const scope = globalThis as any
+    const sweepAt = Date.now()
+    if (!scope.__tqReservationSweepAt || sweepAt - scope.__tqReservationSweepAt > 5 * 60 * 1000) {
+      scope.__tqReservationSweepAt = sweepAt
+      const releaseWith = (query: string, params: unknown[]) =>
+        fetch(baseUrl + '/api/data/' + settings.dataSourceId + '/raw-query', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'x-internal-data-secret': (env && env.NEXTAUTH_SECRET) || '',
+            ...internalHeaders,
+          },
+          body: JSON.stringify({ query, params }),
+        })
+      const pass = (async () => {
+        const listed: any = await releaseWith(__stalledReservationCandidatesQuery, [])
+        const listing = await listed.json().catch(() => null)
+        if (!listed || !listed.ok || !listing || !Array.isArray(listing.rows)) {
+          return
+        }
+        const readable: string[] = []
+        const warned = scope.__tqUnreadableReservations || (scope.__tqUnreadableReservations = {})
+        for (const candidate of listing.rows) {
+          const id = String((candidate && candidate.id) || '')
+          let parsed: any = null
+          try {
+            parsed = JSON.parse(String((candidate && candidate.metadata) || ''))
+          } catch (_error) {
+            // Once per order and instance: its stock stays held for the
+            // merchant, and every other order is still released.
+            if (id && !warned[id]) {
+              warned[id] = true
+              // tslint:disable-next-line:no-console
+              console.warn(
+                '[checkout] order ' +
+                  id +
+                  ' has metadata that is not valid JSON: its reserved stock is not released automatically.'
+              )
+            }
+            continue
+          }
+          if (
+            id &&
+            parsed &&
+            typeof parsed === 'object' &&
+            Array.isArray(parsed[__stalledReservationKey])
+          ) {
+            readable.push(id)
+          }
+          if (readable.length >= __stalledReservationBatchSize) {
+            break
+          }
+        }
+        if (readable.length === 0) {
+          return
+        }
+        for (const query of __stalledReservationReleaseQueries) {
+          const response: any = await releaseWith(query, [readable])
+          const result = await response.json().catch(() => null)
+          if (response && response.ok) {
+            const row = result && Array.isArray(result.rows) ? result.rows[0] : null
+            if (row && Number(row.released) >= __stalledReservationBatchSize) {
+              scope.__tqReservationSweepAt = 0
+            }
+            return
+          }
+          // Only a ledger without the log's columns (42703) or without the
+          // table (42P01) moves on to the next form; anything else waits for
+          // the next pass.
+          const code = String((result && result.code) || '')
+          if (code !== '42703' && code !== '42P01') {
+            return
+          }
+        }
+      })().then(
+        () => undefined,
+        () => undefined
+      )
+      if (env && env.VERCEL) {
+        if (typeof scope.__tqWaitUntil === 'function') {
+          scope.__tqWaitUntil(pass)
+        } else {
+          await pass
+        }
+      }
+    }
+  }
+
   const productIds: string[] = []
   for (const line of chosen) {
     if (productIds.indexOf(line.productId) === -1) {
@@ -319,7 +481,36 @@ async function cart_price_order(config: any, context: any) {
   ) {
     return refuse('The order could not be priced right now. Please try again in a moment.')
   }
-  return { ...total, priced: true, reason: '', lines }
+  // A variant line draws on its variant's stock, never its product's; lines
+  // drawing on the same row add up (two lines of 3 are 6 units).
+  const stockDeltas = noStock()
+  for (const line of lines) {
+    const ids = line.variantId ? stockDeltas.variantIds : stockDeltas.productIds
+    const qtys = line.variantId ? stockDeltas.variantQtys : stockDeltas.productQtys
+    const id = String(line.variantId || line.productId)
+    const units = Math.floor(Number(line.quantity))
+    const qty = isFinite(units) && units >= 1 ? units : 1
+    const at = ids.indexOf(id)
+    if (at === -1) {
+      ids.push(id)
+      qtys.push(qty)
+    } else {
+      qtys[at] += qty
+    }
+  }
+  // The address the order was priced for, exactly as this step read it: the
+  // order records its shipping address from here, never from a form a later
+  // request hands the assemble step (which could name another country).
+  return {
+    ...total,
+    priced: true,
+    reason: '',
+    lines,
+    paymentMethod,
+    stockDeltas,
+    pricedForm: form,
+    pricedShipToDifferent: shipToDifferent ? 'true' : 'false',
+  }
 }
 
 export const cartPriceOrder: NodeHandlerGenerator = {
@@ -333,6 +524,13 @@ export const cartPriceOrder: NodeHandlerGenerator = {
     const bodyStart = source.indexOf('{') + 1
     return (
       source.slice(0, bodyStart) +
+      `\nvar __stalledReservationReleaseQueries = ${JSON.stringify(
+        buildStalledReservationReleaseQueries()
+      )};\nvar __stalledReservationCandidatesQuery = ${JSON.stringify(
+        buildStalledReservationCandidatesQuery()
+      )};\nvar __stalledReservationKey = ${JSON.stringify(
+        STOCK_RESERVATION_KEY
+      )};\nvar __stalledReservationBatchSize = ${STALLED_RESERVATION_RELEASE.batchSize};\n` +
       ProductDiscounts.generateProductDiscountHelperCode() +
       '\n' +
       ProductOptions.generateProductOptionsHelperCode() +

package/src/nodes/cost-bearing-node-types.ts

@@ -0,0 +1,45 @@
+import { nodeRegistry } from './index'
+
+/**
+ * The node types whose run spends the site's money or reaches outside it: AI
+ * models, mail and SMS providers, payment providers, integrations, and every
+ * node that fetches a URL the site does not own. A server segment that runs
+ * one is rate-limited per visitor whatever the page's protection (see the
+ * abuse gate in api-route-generator.ts).
+ *
+ * One set beside the node registry. `cost-bearing-node-types.test.ts` reads
+ * every registered node's server source and fails when one that calls an AI
+ * provider, a mail / SMS / payment provider or an outbound URL is missing here
+ * — a new node of that kind has to be named before it ships.
+ */
+const COST_BEARING_PREFIXES = ['ai-', 'email-', 'sms-', 'payment-', 'integration-']
+
+const OUTBOUND_NODE_TYPES = [
+  'general-http-request',
+  'utility-scrape-website',
+  'utility-extract-links',
+  'utility-pdf-extract-text',
+  'utility-youtube-transcript',
+  'utility-ocr-extract-text',
+  // Its semantic mode embeds both texts through the owner's OpenAI key.
+  'utility-similarity-scoring',
+  'transform-image',
+  'transform-color',
+  'transform-geolocation',
+  'push-send-notification',
+  // Mails a confirmation or a welcome through the site's provider, inside the
+  // newsletter helper (the node's own source shows no provider call).
+  'newsletter-subscribe',
+]
+
+const hasCostBearingPrefix = (type: string): boolean =>
+  COST_BEARING_PREFIXES.some((prefix) => type.startsWith(prefix))
+
+export const COST_BEARING_NODE_TYPES: ReadonlySet<string> = new Set([
+  ...Object.keys(nodeRegistry).filter(hasCostBearingPrefix),
+  ...OUTBOUND_NODE_TYPES,
+])
+
+/** A registered cost-bearing type, or any type named like one (an unknown `ai-…` included). */
+export const isCostBearingNodeType = (type: string): boolean =>
+  COST_BEARING_NODE_TYPES.has(type) || hasCostBearingPrefix(type)

package/src/nodes/data/data-select.ts

@@ -55,8 +55,16 @@ async function data_select(config: any, context: any) {
     return false
   }
 
-  const effectiveFilters = filters.filter(function (filter: any) {
-    return !shouldSkipOptionalFilter(filter)
+  // A filter this node would leave out is kept, marked: the data API leaves it
+  // out exactly as before, except on a customer table read for a visitor, where
+  // an empty or "all" value must not widen the read to every customer's rows.
+  const effectiveFilters: any[] = []
+  filters.forEach(function (filter: any) {
+    if (!shouldSkipOptionalFilter(filter)) {
+      effectiveFilters.push(filter)
+    } else if (filter && typeof filter === 'object') {
+      effectiveFilters.push({ ...filter, __skippable: true })
+    }
   })
 
   // A filter whose value is the unresolved route-param sentinel (see
@@ -71,6 +79,7 @@ async function data_select(config: any, context: any) {
     const __f: any = effectiveFilters[__fi]
     if (
       __f &&
+      __f.__skippable !== true &&
       (__f.value === '__TQ_UNRESOLVED_ROUTE_PARAM__' ||
         __f.destination === '__TQ_UNRESOLVED_ROUTE_PARAM__')
     ) {

package/src/nodes/email/email-mailersend.ts

@@ -1,13 +1,23 @@
-import { NodeHandlerGenerator, handlerToString } from '../types'
-import { assertHandlerHasNoModuleRefs } from '../analytics/commerce-tracking'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from './outbound-message-guard'
 import { EMAIL_RECIPIENTS_HELPER_SOURCE, EmailDeliveriesPlan } from './email-recipients'
 
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 // Ambient, not imported: a serialized handler has no module scope, so
 // generateHandler appends the recipients helper's source (beside this file).
 declare function __emailRecipients(to: unknown): unknown[]
 declare function __emailDeliveries(plan: EmailDeliveriesPlan): Promise<unknown>
 
 async function email_mailersend(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('email', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageId: '', skipped: true, reason: refused.skipped }
+      : { messageId: '', success: false, error: refused.error }
+  }
   const apiKey = config.apiKey
   const from = config.from
   const fromName = config.fromName || ''
@@ -96,10 +106,8 @@ export const emailMailersend: NodeHandlerGenerator = {
   dependencies: {
     mailersend: '^2.0.0',
   },
-  generateHandler(): string {
-    return assertHandlerHasNoModuleRefs(
-      handlerToString(email_mailersend) + '\n' + EMAIL_RECIPIENTS_HELPER_SOURCE,
-      'email-mailersend'
-    )
-  },
+  ...outboundMessageHandlerSources(email_mailersend, {
+    nodeType: 'email-mailersend',
+    extraSource: EMAIL_RECIPIENTS_HELPER_SOURCE,
+  }),
 }

package/src/nodes/email/email-mailgun.ts

@@ -1,8 +1,9 @@
 import { EmailSender } from '@teleporthq/teleport-shared'
-import { NodeHandlerGenerator, handlerToString } from '../types'
-import { assertHandlerHasNoModuleRefs } from '../analytics/commerce-tracking'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from './outbound-message-guard'
 import { EMAIL_RECIPIENTS_HELPER_SOURCE, EmailDeliveriesPlan } from './email-recipients'
 
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 // Ambient, not imported: a serialized handler has no module scope, so
 // generateHandler appends the helpers' source (EmailSender from teleport-shared,
 // the recipients helper beside this file).
@@ -11,6 +12,15 @@ declare function __emailRecipients(to: unknown): unknown[]
 declare function __emailDeliveries(plan: EmailDeliveriesPlan): Promise<unknown>
 
 async function email_mailgun(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('email', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageId: '', skipped: true, reason: refused.skipped }
+      : { messageId: '', success: false, error: refused.error }
+  }
   const apiKey = config.apiKey
   const domain = config.domain
   const from = config.from
@@ -77,14 +87,9 @@ export const emailMailgun: NodeHandlerGenerator = {
     'mailgun.js': '^10.0.0',
     'form-data': '^4.0.0',
   },
-  generateHandler(): string {
-    return assertHandlerHasNoModuleRefs(
-      handlerToString(email_mailgun) +
-        '\n' +
-        EmailSender.generateEmailSenderHelperCode() +
-        '\n' +
-        EMAIL_RECIPIENTS_HELPER_SOURCE,
-      'email-mailgun'
-    )
-  },
+  ...outboundMessageHandlerSources(email_mailgun, {
+    nodeType: 'email-mailgun',
+    extraSource:
+      EmailSender.generateEmailSenderHelperCode() + '\n' + EMAIL_RECIPIENTS_HELPER_SOURCE,
+  }),
 }

package/src/nodes/email/email-postmark.ts

@@ -1,8 +1,9 @@
 import { EmailSender } from '@teleporthq/teleport-shared'
-import { NodeHandlerGenerator, handlerToString } from '../types'
-import { assertHandlerHasNoModuleRefs } from '../analytics/commerce-tracking'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from './outbound-message-guard'
 import { EMAIL_RECIPIENTS_HELPER_SOURCE, EmailDeliveriesPlan } from './email-recipients'
 
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 // Ambient, not imported: a serialized handler has no module scope, so
 // generateHandler appends the helpers' source (EmailSender from teleport-shared,
 // the recipients helper beside this file).
@@ -11,6 +12,15 @@ declare function __emailRecipients(to: unknown): unknown[]
 declare function __emailDeliveries(plan: EmailDeliveriesPlan): Promise<unknown>
 
 async function email_postmark(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('email', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageId: '', skipped: true, reason: refused.skipped }
+      : { messageId: '', success: false, error: refused.error }
+  }
   const serverToken = config.serverToken
   const from = config.from
   const fromName = config.fromName
@@ -76,14 +86,9 @@ export const emailPostmark: NodeHandlerGenerator = {
   dependencies: {
     postmark: '^4.0.0',
   },
-  generateHandler(): string {
-    return assertHandlerHasNoModuleRefs(
-      handlerToString(email_postmark) +
-        '\n' +
-        EmailSender.generateEmailSenderHelperCode() +
-        '\n' +
-        EMAIL_RECIPIENTS_HELPER_SOURCE,
-      'email-postmark'
-    )
-  },
+  ...outboundMessageHandlerSources(email_postmark, {
+    nodeType: 'email-postmark',
+    extraSource:
+      EmailSender.generateEmailSenderHelperCode() + '\n' + EMAIL_RECIPIENTS_HELPER_SOURCE,
+  }),
 }

package/src/nodes/email/email-resend.ts

@@ -1,8 +1,9 @@
 import { EmailSender } from '@teleporthq/teleport-shared'
-import { NodeHandlerGenerator, handlerToString } from '../types'
-import { assertHandlerHasNoModuleRefs } from '../analytics/commerce-tracking'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from './outbound-message-guard'
 import { EMAIL_RECIPIENTS_HELPER_SOURCE, EmailDeliveriesPlan } from './email-recipients'
 
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 // Ambient, not imported: a serialized handler has no module scope, so
 // generateHandler appends the helpers' source (EmailSender from teleport-shared,
 // the recipients helper beside this file).
@@ -11,6 +12,15 @@ declare function __emailRecipients(to: unknown): unknown[]
 declare function __emailDeliveries(plan: EmailDeliveriesPlan): Promise<unknown>
 
 async function email_resend(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('email', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { id: '', skipped: true, reason: refused.skipped }
+      : { id: '', success: false, error: refused.error }
+  }
   const apiKey = config.apiKey
   const from = config.from
   const fromName = config.fromName
@@ -73,14 +83,9 @@ export const emailResend: NodeHandlerGenerator = {
   dependencies: {
     resend: '^4.0.0',
   },
-  generateHandler(): string {
-    return assertHandlerHasNoModuleRefs(
-      handlerToString(email_resend) +
-        '\n' +
-        EmailSender.generateEmailSenderHelperCode() +
-        '\n' +
-        EMAIL_RECIPIENTS_HELPER_SOURCE,
-      'email-resend'
-    )
-  },
+  ...outboundMessageHandlerSources(email_resend, {
+    nodeType: 'email-resend',
+    extraSource:
+      EmailSender.generateEmailSenderHelperCode() + '\n' + EMAIL_RECIPIENTS_HELPER_SOURCE,
+  }),
 }

package/src/nodes/email/email-sendgrid.ts

@@ -1,8 +1,9 @@
 import { EmailSender } from '@teleporthq/teleport-shared'
-import { NodeHandlerGenerator, handlerToString } from '../types'
-import { assertHandlerHasNoModuleRefs } from '../analytics/commerce-tracking'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from './outbound-message-guard'
 import { EMAIL_RECIPIENTS_HELPER_SOURCE, EmailDeliveriesPlan } from './email-recipients'
 
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 // Ambient, not imported: a serialized handler has no module scope, so
 // generateHandler appends the helpers' source (EmailSender from teleport-shared,
 // the recipients helper beside this file).
@@ -11,6 +12,15 @@ declare function __emailRecipients(to: unknown): unknown[]
 declare function __emailDeliveries(plan: EmailDeliveriesPlan): Promise<unknown>
 
 async function email_sendgrid(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('email', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageId: '', skipped: true, reason: refused.skipped }
+      : { messageId: '', success: false, error: refused.error }
+  }
   const apiKey = config.apiKey
   const from = config.from
   const fromName = config.fromName
@@ -86,14 +96,9 @@ export const emailSendgrid: NodeHandlerGenerator = {
   dependencies: {
     '@sendgrid/mail': '^8.0.0',
   },
-  generateHandler(): string {
-    return assertHandlerHasNoModuleRefs(
-      handlerToString(email_sendgrid) +
-        '\n' +
-        EmailSender.generateEmailSenderHelperCode() +
-        '\n' +
-        EMAIL_RECIPIENTS_HELPER_SOURCE,
-      'email-sendgrid'
-    )
-  },
+  ...outboundMessageHandlerSources(email_sendgrid, {
+    nodeType: 'email-sendgrid',
+    extraSource:
+      EmailSender.generateEmailSenderHelperCode() + '\n' + EMAIL_RECIPIENTS_HELPER_SOURCE,
+  }),
 }

package/src/nodes/email/html-escape-code.ts

@@ -0,0 +1,21 @@
+/**
+ * HTML escaping for the values an email template is filled with, as emitted
+ * JavaScript. It is idempotent: an `&` that already starts a character
+ * reference (`&name;`, `{`, ``) is left as it is, every other `&`,
+ * `<` and `>` is escaped once. A value that arrives already escaped (the
+ * lifecycle token scripts escape their tokens) is therefore not escaped a
+ * second time, and a reference can only ever render as a character, never as
+ * markup, so leaving one in place is safe.
+ *
+ * - `escapeHtmlValueJs(expr)`: for an email HTML body, where a value can sit
+ *   inside an attribute (`href="{{url}}"`): quotes are escaped too.
+ * - `escapeHtmlTextJs(expr)`: for a value that lands in text (a rich-text
+ *   placeholder, a list item): `& < >` only, as before.
+ */
+const BARE_AMPERSAND = '/&(?!(?:[a-zA-Z][a-zA-Z0-9]{1,31}|#[0-9]{1,7}|#[xX][0-9a-fA-F]{1,6});)/g'
+
+export const escapeHtmlTextJs = (expression: string): string =>
+  `${expression}.replace(${BARE_AMPERSAND}, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')`
+
+export const escapeHtmlValueJs = (expression: string): string =>
+  `${escapeHtmlTextJs(expression)}.replace(/"/g, '&quot;').replace(/'/g, '&#39;')`