CRM email action boundaries: reviewer evidence

function crmAppBaseUrl(purpose: string): URL {
  const configured = process.env.CRM_APP_URL?.trim();
  const value =
    configured ||
    (() => {
      if (isProd()) {
        throw new Error(
          `CRM_APP_URL is required to send ${purpose} in production`,
        );
      }
      return "http://localhost:5173";
    })();

  let url: URL;
  try {
    url = new URL(value);
  } catch {
    throw new Error(
      `CRM_APP_URL must be an absolute HTTP(S) URL for ${purpose}`,
    );
  }
  if (
    (url.protocol !== "http:" && url.protocol !== "https:") ||
    !url.hostname ||
    url.username ||
    url.password
  ) {
    throw new Error(
      `CRM_APP_URL must be an absolute HTTP(S) URL for ${purpose}`,
    );
  }
  if (isProd() && url.protocol !== "https:") {
    throw new Error(`CRM_APP_URL must use HTTPS for ${purpose} in production`);
  }
  return url;
}

/**
 * Build a CRM route below the configured deployment path while preserving
 * configured query parameters. Route-specific parameters override same-named
 * base parameters.
 */
export function crmAppUrl(
  path: string,
  purpose: string,
  searchParams?: Readonly<Record<string, string>>,
): string {
  const url = crmAppBaseUrl(purpose);
  const basePath = url.pathname.replace(/\/+$/, "");
  url.pathname = `${basePath}/${path.replace(/^\/+/, "")}`;
  url.hash = "";

  if (searchParams) {
    for (const [name, value] of Object.entries(searchParams)) {
      url.searchParams.set(name, value);
    }
  }

  return url.toString();
}

      for (const recipient of recipients) {
        // Await each send so serverless cold-shutdowns don't drop the outbound
        // HTTP call. One bad hook must not abort the rest.
        if (!emailService || !emailIdentity || !trackingBaseUrl) continue;
        try {
          const renderedContent = augmentAutomationEmailAction({
            html: renderHtmlTemplate(hook.htmlBody, allVars),
            text: hook.textBody
              ? renderTextTemplate(hook.textBody, allVars)
              : undefined,
            triggerEvent,
            sendToType: hook.sendToType,
            brand,
          });
          const email = {
            ...emailIdentity,
            to: recipient,
            subject: renderSubjectTemplate(hook.subject, allVars),
            html: renderedContent.html,
            text: renderedContent.text ?? undefined,
          };
          // Marketing automations get the same footer as campaigns: a
          // visible unsubscribe link + List-Unsubscribe headers and the
          // sender's postal address. Transactional sends omit it.
          const footer =
            hook.sendToType === "contact" && marketingFooter
              ? marketingFooter
              : null;
          await sendTrackedEmail({
            db,
            emailService,
            brandId,
            customerId:
              hook.sendToType === "contact" ? (contact?.id ?? null) : null,
            source: "automation",
            sourceId: hook.id,
            trackingBaseUrl,
            email,
            metadata: { triggerEvent, sendToType: hook.sendToType },
            unsubscribeUrl: footer?.unsubscribeUrl,
            postalAddress: footer?.postalAddress,
          });
          acceptedCount++;
        } catch (err) {
          hadRetryableFailure = true;
          console.error("[triggerEmailHooks] send failed:", err);
        }
      }