Email template variables: building an order confirmation end to end

// Option A: render the line items in your own code and send finished html + text.
// Node 22 or later, as an .mjs file. Needs RASKET_SEND_KEY.
const API = process.env.RASKET_API_URL ?? "https://api.rasket.com";

const order = {
  id: "1002",
  email: "ronald@example.com",
  firstName: "Ronald",
  items: [
    { title: "Blue mug", quantity: 2, unitCents: 1200 },
    { title: "Tea towel & cloth", quantity: 1, unitCents: 1800 },
  ],
};

// You are the template engine now, so escaping every value is your job.
const escapeHtml = (s) =>
  String(s).replace(/[&<>"']/g, (c) =>
    ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c],
  );
const usd = (cents) =>
  new Intl.NumberFormat("en-US", { style: "currency", currency: "USD" }).format(cents / 100);
const lineCents = (item) => item.quantity * item.unitCents;
const totalCents = order.items.reduce((sum, item) => sum + lineCents(item), 0);

const rows = order.items
  .map(
    (item) =>
      `<tr><td>${escapeHtml(item.title)}</td><td>${item.quantity}</td>` +
      `<td align="right">${usd(lineCents(item))}</td></tr>`,
  )
  .join("");
const lines = order.items
  .map((item) => `${item.quantity} × ${item.title}  ${usd(lineCents(item))}`)
  .join("\n");

const res = await fetch(`${API}/emails`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.RASKET_SEND_KEY}`,
    "User-Agent": "acme-shop/1.0",
    "Content-Type": "application/json",
    "Idempotency-Key": `order-${order.id}-confirmation`,
  },
  body: JSON.stringify({
    from: "Acme Shop <orders@acme.example>",
    to: [order.email],
    subject: `Order ${order.id} is confirmed`,
    html:
      `<p>Hi ${escapeHtml(order.firstName)},</p><table>${rows}` +
      `<tr><td colspan="2"><b>Total</b></td><td align="right"><b>${usd(totalCents)}</b></td></tr>` +
      `</table>`,
    text: `Hi ${order.firstName},\n\n${lines}\n\nTotal: ${usd(totalCents)}`,
  }),
});
// A proxy can answer a 502 with HTML, so read the body without trusting it to be JSON.
const sent = await res.json().catch(() => ({}));
if (!res.ok) throw new Error(`${res.status} ${sent.name ?? res.statusText}: ${sent.message ?? ""}`);
console.log(res.status, sent.id);

// Option B: keep the template and pass the items as one plain-text string.
// Node 22 or later, as an .mjs file. Needs RASKET_SEND_KEY.
const API = process.env.RASKET_API_URL ?? "https://api.rasket.com";
const MAX_VALUE = 2000; // characters per variable value

const items = [
  { title: "Blue mug", quantity: 2 },
  { title: "Tea towel & cloth", quantity: 1 },
];
let summary = items.map((item) => `${item.quantity} × ${item.title}`).join(", ");
if (summary.length > MAX_VALUE) {
  summary = items.length === 1 ? "1 item" : `${items.length} items`;
}

const res = await fetch(`${API}/emails`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.RASKET_SEND_KEY}`,
    "User-Agent": "acme-shop/1.0",
    "Content-Type": "application/json",
    "Idempotency-Key": "order-1003-confirmation",
  },
  body: JSON.stringify({
    to: ["ronald@example.com"],
    template: {
      id: "order-confirmation",
      variables: { order_number: "1003", items_summary: summary, total: "$42.00" },
    },
  }),
});
// A proxy can answer a 502 with HTML, so read the body without trusting it to be JSON.
const sent = await res.json().catch(() => ({}));
if (!res.ok) throw new Error(`${res.status} ${sent.name ?? res.statusText}: ${sent.message ?? ""}`);
console.log(res.status, sent.id);

// Deploy step: save the published version's variables. Runs with the full_access key,
// which stays in the pipeline. Node 22 or later, as an .mjs file. Needs RASKET_DEPLOY_KEY.
import { writeFile } from "node:fs/promises";

const API = process.env.RASKET_API_URL ?? "https://api.rasket.com";
const ALIAS = "order-confirmation";
const headers = {
  Authorization: `Bearer ${process.env.RASKET_DEPLOY_KEY}`,
  "User-Agent": "acme-deploy/1.0",
};

// Versions come newest first, 100 to a page; the published one can be several pages back.
// A variable lists fallback_value only when it has one: {"key":"first_name","type":"string",
// "fallback_value":"there"} next to {"key":"order_number","type":"string"}.
let published;
let cursor = "";
while (!published) {
  const res = await fetch(`${API}/templates/${ALIAS}/versions?limit=100${cursor}`, { headers });
  const page = await res.json().catch(() => ({}));
  if (!res.ok) throw new Error(`${res.status} ${page.name ?? res.statusText}: ${page.message ?? ""}`);
  published = page.data.find((version) => version.published);
  if (!published && !page.has_more) throw new Error(`${ALIAS} has no published version`);
  cursor = `&after=${page.data.at(-1)?.id}`;
}

const variables = published.variables.map((v) => ({
  key: v.key,
  type: v.type,
  required: !("fallback_value" in v),
}));
// Written next to this script; keep it beside server.mjs, which reads it from there.
await writeFile(
  new URL(`./${ALIAS}.tool.json`, import.meta.url),
  JSON.stringify({ alias: ALIAS, version: published.version_number, variables }, null, 2),
);
console.log(`${ALIAS} version ${published.version_number}: ${variables.map((v) => v.key).join(", ")}`);

// order-confirmation version 1: first_name, order_number, items_summary, total
// With a sending_access key: Error: 401 restricted_api_key: This key has sending access only, …
// With nothing published:    Error: order-confirmation has no published version

// An MCP server with one tool: send the order confirmation. It holds only a sending_access
// key and the schema the deploy saved. Node 22 or later, as an .mjs file. Needs RASKET_SEND_KEY.
// npm i @modelcontextprotocol/sdk@1.31.0 zod@4.6.7
// This SDK takes a whole zod object as inputSchema. An older 1.x release that wants a shape
// takes input.shape instead, which drops additionalProperties: false.
import { createHash } from "node:crypto";
import { readFile } from "node:fs/promises";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";

const API = process.env.RASKET_API_URL ?? "https://api.rasket.com";
const saved = JSON.parse(
  await readFile(new URL("./order-confirmation.tool.json", import.meta.url), "utf8"),
);

const TYPES = {
  string: () => z.string(),
  number: () => z.number(),
  boolean: () => z.boolean(),
  list: () => z.array(z.unknown()),
  object: () => z.record(z.string(), z.unknown()),
};
const input = z.strictObject({
  to: z.email(),
  ...Object.fromEntries(
    saved.variables.map((v) => [v.key, v.required ? TYPES[v.type]() : TYPES[v.type]().optional()]),
  ),
});

// The model sends natural JSON; the API takes strings or numbers, so convert here.
const toSendValue = (value) =>
  typeof value === "string" || typeof value === "number"
    ? value
    : typeof value === "boolean"
      ? String(value)
      : JSON.stringify(value);

const server = new McpServer({ name: "acme-email", version: "1.0.0" });
server.registerTool(
  "send_order_confirmation",
  {
    description: "Send the order confirmation to one customer. Fill only the listed fields.",
    inputSchema: input,
  },
  async ({ to, ...variables }) => {
    const body = JSON.stringify({
      to: [to],
      template: {
        id: saved.alias,
        variables: Object.fromEntries(
          Object.entries(variables).map(([key, value]) => [key, toSendValue(value)]),
        ),
      },
    });
    const res = await fetch(`${API}/emails`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.RASKET_SEND_KEY}`,
        "User-Agent": "acme-agent-tools/1.0",
        "Content-Type": "application/json",
        // The same call made twice sends one email.
        "Idempotency-Key": createHash("sha256").update(body).digest("hex"),
      },
      body,
    });
    // A refusal names the field, so the model can fix the value and call again.
    return { content: [{ type: "text", text: `${res.status} ${await res.text()}` }], isError: !res.ok };
  },
);

// stdout carries the protocol, so the server prints nothing of its own.
await server.connect(new StdioServerTransport());

{
  "mcpServers": {
    "acme-email": {
      "command": "node",
      "args": ["./tools/server.mjs"],
      "env": { "RASKET_SEND_KEY": "${RASKET_SEND_KEY}" }
    }
  }
}