apps/web/app/(ee)/api/cron/domains/renewal-reminders/route.ts (1)

37-45: Use addDays for clarity (equivalent, less surprising).

subDays(now, -days) works but is harder to read. Prefer addDays(now, days).

-    const targetDates = REMINDER_WINDOWS.map((days) => {
-      const date = subDays(now, -days);
+    const targetDates = REMINDER_WINDOWS.map((days) => {
+      const date = addDays(now, days);

Add import:

 import {
   differenceInCalendarDays,
   endOfDay,
   formatDistanceStrict,
   startOfDay,
-  subDays,
+  addDays,
+  subDays,
 } from "date-fns";

apps/web/lib/api/domains/claim-dot-link-domain.ts (1)

191-193: Unconditional resend: guard failures so background work isn’t marked failed.

Wrap the send to avoid bubbling an email error out of waitUntil’s Promise.all.

-  if (emails.length > 0) {
-    return await resend.batch.send(emails);
-  }
+  if (emails.length > 0) {
+    try {
+      return await resend.batch.send(emails);
+    } catch (err) {
+      console.error("sendDomainClaimedEmails failed:", err);
+      return null;
+    }
+  }

apps/web/app/(ee)/api/cron/payouts/reminders/program-owners/route.ts (2)

67-86: Confirm custom min-payout semantics (filter vs. threshold on total).

Current query sums only payouts whose individual amount >= minPayoutAmount. If the intent is “notify when total pending >= min,” sum all pending amounts and compare the total to the threshold instead.

       const pendingPayout = await prisma.payout.aggregate({
         where: {
           programId: program.id,
           status: "pending",
-          amount: {
-            gte: program.minPayoutAmount,
-          },
           partner: {
             payoutsEnabledAt: {
               not: null,
             },
           },
         },
         _sum: { amount: true },
         _count: { _all: true },
       });
+
+      // Only notify if total pending meets the custom minimum
+      if ((pendingPayout._sum?.amount ?? 0) < program.minPayoutAmount) {
+        continue;
+      }

---

116-121: Comment says “last week” but code uses 14 days.

Align the comment with the logic.

-    // only send notifications for programs that have not paid out any invoices in the last week
+    // only send notifications for programs that have not paid out any invoices in the last 2 weeks

apps/web/lib/partners/approve-partner-enrollment.ts (1)

179-202: Unconditional batch send—consider batch size and partial-failure handling.

• If partnerEmailsToNotify > 100, chunk to stay within provider limits.
• Optional: wrap per-batch in try/catch so one failure doesn’t mask others (you’re already using Promise.allSettled, which helps).

Example (outside this hunk):

import { chunk } from "@dub/utils";

for (const emails of chunk(partnerEmailsToNotify, 100)) {
  await resend.batch.send(
    emails.map((email) => ({
      subject: `Your application to join ${program.name} partner program has been approved!`,
      from: VARIANT_TO_FROM_MAP.notifications,
      to: email,
      react: PartnerApplicationApproved(/* ... */),
    })),
  );
}

packages/email/src/resend/client.ts (1)

3-3: Non-null assertion for TS strictness.

Avoid “string | undefined” arg errors in strict mode.

-export const resend = new Resend(process.env.RESEND_API_KEY);
+export const resend = new Resend(process.env.RESEND_API_KEY!);

apps/web/app/(ee)/api/stripe/webhook/charge-succeeded.ts (1)

155-169: Guard batch email send or centralize fallback to avoid runtime failures without RESEND_API_KEY

Direct resend.batch.send will throw in dev/preview where the key isn’t set. Either short-circuit here or route through a wrapper that no-ops/falls back when missing.

Minimal inline guard:

-  await resend.batch.send(
+  if (!process.env.RESEND_API_KEY) {
+    console.warn("RESEND_API_KEY not set. Skipping domain renewal emails.");
+    return;
+  }
+  await resend.batch.send(

Preferable: add a safeBatchSend(emails) in @dub/email/resend and call that here.

apps/web/lib/actions/partners/merge-partner-accounts.ts (1)

174-195: Add resilience: gate or wrap batch send to support dev/preview without RESEND_API_KEY

Unconditional resend.batch.send can throw when the key is absent. Keep behavior consistent with unsubscribe() which guards on env.

Quick guard:

-  await resend.batch.send([
+  if (!process.env.RESEND_API_KEY) {
+    console.warn("RESEND_API_KEY not set. Skipping verification emails.");
+    return;
+  }
+  await resend.batch.send([

Longer-term: export a safeBatchSend() helper from @dub/email/resend and use it here.

packages/email/src/resend/unsubscribe.ts (2)

20-23: Nit: avoid unnecessary return await

return await resend.contacts.remove(...) adds an extra microtask without benefit here.

-  return await resend.contacts.remove({
+  return resend.contacts.remove({
     email,
     audienceId,
   });

---

1-24: Unify send behavior behind a safe wrapper to remove per-callsite guards

To keep all call sites consistent (batch sends, subscribe/unsubscribe, etc.), expose a safeBatchSend/safeSend that gates on RESEND_API_KEY and delegates to SMTP fallback when available. Then replace direct resend.batch.send usages across the app.

apps/web/lib/api/partners/notify-partner-commission.ts (1)

143-144: Harden batch dispatch: use a safe sender and tolerate per-chunk failures

• Add env gating or use a wrapper to avoid crashes without RESEND_API_KEY.
• Prefer Promise.allSettled so one bad chunk doesn’t fail the entire flow.

-  await Promise.all(
-    emailChunks.map((emailChunk) => resend.batch.send(emailChunk)),
-  );
+  if (!process.env.RESEND_API_KEY) {
+    console.warn("RESEND_API_KEY not set. Skipping commission emails.");
+    return;
+  }
+  const results = await Promise.allSettled(
+    emailChunks.map((emailChunk) => resend.batch.send(emailChunk)),
+  );
+  const rejected = results.filter((r) => r.status === "rejected");
+  if (rejected.length) {
+    console.error(`Failed to send ${rejected.length} email chunk(s).`);
+  }

Also confirm 100 is within the current Resend batch limit.

apps/web/lib/actions/partners/create-bounty-submission.ts (1)

143-169: Guard batch send or use a helper; optionally chunk recipients

• Add env check or route through a safe helper to avoid throwing without RESEND_API_KEY.
• If owners could exceed 100, chunk to match batch limits (optional).

Minimal guard:

-        if (users.length > 0) {
-          await resend.batch.send(
+        if (users.length > 0) {
+          if (!process.env.RESEND_API_KEY) {
+            console.warn("RESEND_API_KEY not set. Skipping owner notifications.");
+          } else {
+            await resend.batch.send(
               users.map((user) => ({
                 from: VARIANT_TO_FROM_MAP.notifications,
                 to: user.email,
                 subject: "Pending bounty review",
                 react: BountyPendingReview({
                   email: user.email,
                   workspace: {
                     slug: workspace.slug,
                   },
                   bounty: {
                     id: bounty.id,
                     name: bounty.name,
                   },
                   partner: {
                     name: partner.name,
                     image: partner.image,
                     email: partner.email!,
                   },
                   submission: {
                     id: submission.id,
                   },
                 }),
               })),
-          );
+            );
+          }
         }

apps/web/ui/analytics/feedback/action.ts (1)

10-16: Harden the send path: guard against transient failures (and missing RESEND_API_KEY) instead of letting the server action throw.

Direct resend.emails.send will now throw on bad/missing credentials or network blips. Catch and log so the action doesn’t surface a 500 to users.

-  return await resend.emails.send({
-    from: "feedback@dub.co",
-    to: "steven@dub.co",
-    ...(email && { replyTo: email }),
-    subject: "🎉 New Feedback Received!",
-    react: FeedbackEmail({ email, feedback }),
-  });
+  try {
+    return await resend.emails.send({
+      from: "feedback@dub.co",
+      to: "steven@dub.co",
+      ...(email && { replyTo: email }),
+      subject: "🎉 New Feedback Received!",
+      react: FeedbackEmail({ email, feedback }),
+    });
+  } catch (err) {
+    console.error("submitFeedback: email send failed", err);
+  }

apps/web/app/(ee)/api/stripe/webhook/charge-failed.ts (2)

247-263: Don’t block the webhook; send in the background with idempotency and error handling.

Wrap this batch in waitUntil, add per-recipient Idempotency-Key, and catch errors so renewal handling isn’t aborted by email failures.

-    if (workspaceOwners.length > 0) {
-      await resend.batch.send(
-        workspaceOwners.map(({ user }) => ({
-          from: VARIANT_TO_FROM_MAP.notifications,
-          to: user.email!,
-          subject: "Domain expired",
-          react: DomainExpired({
-            email: user.email!,
-            workspace: {
-              name: workspace.name,
-              slug: workspace.slug,
-            },
-            domains,
-          }),
-        })),
-      );
-    }
+    if (workspaceOwners.length > 0) {
+      waitUntil(
+        (async () => {
+          try {
+            await resend.batch.send(
+              workspaceOwners.map(({ user }) => ({
+                from: VARIANT_TO_FROM_MAP.notifications,
+                to: user.email!,
+                subject: "Domain expired",
+                react: DomainExpired({
+                  email: user.email!,
+                  workspace: { name: workspace.name, slug: workspace.slug },
+                  domains,
+                }),
+                headers: {
+                  "Idempotency-Key": `domain-expired-${invoice.id}-${user.id}`,
+                },
+              })),
+            );
+          } catch (err) {
+            console.error("Failed to send 'Domain expired' emails:", err);
+          }
+        })(),
+      );
+    }

---

277-292: Same here: background send + idempotency for the “renewal failed” emails.

-    if (workspaceOwners.length > 0) {
-      await resend.batch.send(
-        workspaceOwners.map(({ user }) => ({
-          from: VARIANT_TO_FROM_MAP.notifications,
-          to: user.email!,
-          subject: "Domain renewal failed",
-          react: DomainRenewalFailed({
-            email: user.email!,
-            workspace: {
-              slug: workspace.slug,
-            },
-            domains,
-          }),
-        })),
-      );
-    }
+    if (workspaceOwners.length > 0) {
+      waitUntil(
+        (async () => {
+          try {
+            await resend.batch.send(
+              workspaceOwners.map(({ user }) => ({
+                from: VARIANT_TO_FROM_MAP.notifications,
+                to: user.email!,
+                subject: "Domain renewal failed",
+                react: DomainRenewalFailed({
+                  email: user.email!,
+                  workspace: { slug: workspace.slug },
+                  domains,
+                }),
+                headers: {
+                  "Idempotency-Key": `domain-renewal-failed-${invoice.id}-${user.id}`,
+                },
+              })),
+            );
+          } catch (err) {
+            console.error("Failed to send 'Domain renewal failed' emails:", err);
+          }
+        })(),
+      );
+    }

apps/web/app/(ee)/api/cron/bounties/notify-partners/route.ts (1)

101-129: Make the cron robust to single-batch failures; continue on error and log.

A transient Resend error currently aborts the whole page. Catch per-batch and proceed.

-      await resend.batch.send(
-        programEnrollmentChunk.map(({ partner }) => ({
+      try {
+        await resend.batch.send(
+          programEnrollmentChunk.map(({ partner }) => ({
             from: VARIANT_TO_FROM_MAP.notifications,
             to: partner.email!, // coerce the type here because we've already filtered out partners with no email in the prisma query
             subject: `New bounty available for ${bounty.program.name}`,
             react: NewBountyAvailable({
               email: partner.email!,
               bounty: {
                 name: bounty.name,
                 type: bounty.type,
                 endsAt: bounty.endsAt,
                 description: bounty.description,
               },
               program: {
                 name: bounty.program.name,
                 slug: bounty.program.slug,
               },
             }),
             headers: {
               "Idempotency-Key": `${bountyId}-${partner.id}`,
             },
-          })),
-      );
+          })),
+        );
+      } catch (err: any) {
+        await log({
+          message: `Resend batch failed for bounty ${bountyId}, page ${page}: ${err?.message ?? err}`,
+          type: "errors",
+        });
+      }

apps/web/lib/api/partners/notify-partner-application.ts (1)

74-76: Avoid failing the whole send on a single chunk; use allSettled.

This keeps the rest of the notifications flowing and you can still inspect failures.

-  await Promise.all(
-    emailChunks.map((emailChunk) => resend.batch.send(emailChunk)),
-  );
+  await Promise.allSettled(
+    emailChunks.map((emailChunk) => resend.batch.send(emailChunk)),
+  );

apps/web/app/(ee)/api/cron/payouts/charge-succeeded/send-stripe-payouts.ts (1)

95-111: Harden payout emails: try/catch and per-email Idempotency-Key to dedupe retries.

Prevents the payout flow from erroring on email issues and avoids duplicates on retries.

-  const resendBatch = await resend.batch.send(
+  let resendBatch;
+  try {
+    resendBatch = await resend.batch.send(
     currentInvoicePayouts
       .filter((p) => p.partner.email)
       .map((p) => {
         return {
           from: VARIANT_TO_FROM_MAP.notifications,
           to: p.partner.email!,
           subject: "You've been paid!",
           react: PartnerPayoutProcessed({
             email: p.partner.email!,
             program: p.program,
             payout: p,
             variant: "stripe",
           }),
+          headers: {
+            "Idempotency-Key": `payout-processed-${p.id}`,
+          },
         };
       }),
-  );
+    );
+  } catch (err) {
+    console.error("Failed to send PartnerPayoutProcessed emails:", err);
+  }

apps/web/app/(ee)/api/cron/payouts/charge-succeeded/send-paypal-payouts.ts (1)

49-50: Redact logs to avoid leaking payout/email payloads

Prefer logging counts/ids instead of full objects that may contain PII or payout metadata.

-  console.log("PayPal batch payout created", batchPayout);
+  console.log("PayPal batch payout created", { invoiceId, count: payouts.length });
…
-  console.log("Resend batch emails sent", batchEmails);
+  console.log("Resend batch emails sent", { count: sent?.length ?? 0 });

Also applies to: 67-67

apps/web/app/(ee)/api/cron/payouts/reminders/partners/route.ts (1)

119-131: Add idempotency keys per batch to avoid duplicate reminders on retries

Safer for cron replays and transient failures.

-    for (const partnerProgramsChunk of partnerProgramsChunks) {
-      await resend.batch.send(
+    for (const [i, partnerProgramsChunk] of partnerProgramsChunks.entries()) {
+      await resend.batch.send(
         partnerProgramsChunk.map(({ partner, programs }) => ({
           from: VARIANT_TO_FROM_MAP.notifications,
           to: partner.email,
           subject: "Connect your payout details on Dub Partners",
           variant: "notifications",
           react: ConnectPayoutReminder({
             email: partner.email,
             programs,
           }),
         })),
-      );
+        { idempotencyKey: `payout-reminders/${connectPayoutsLastRemindedAt.toISOString()}/${i}` },
+      );

Resend batch supports idempotency keys; use a deterministic key per chunk. (resend.com)

apps/web/lib/actions/partners/bulk-approve-partners.ts (1)

136-137: Optional: add idempotency keys to batch sends

Helps dedupe on retries; consider hashing recipient emails to form a stable key per chunk.

-          ...emailChunks.map((emailChunk) => resend.batch.send(emailChunk)),
+          ...emailChunks.map((emailChunk, i) =>
+            resend.batch.send(emailChunk, {
+              // e.g., approvals/<program>/<chunk-index>
+              idempotencyKey: `approvals/${program.id}/${i}`,
+            }),
+          ),

Resend batch idempotency reference. (resend.com)

apps/web/app/(ee)/api/cron/merge-partner-accounts/route.ts (1)

247-268: Add idempotency key to batch email after merge

Prevents duplicate notifications if the job is retried.

-    await resend.batch.send([
+    await resend.batch.send(
+      [
       {
         from: VARIANT_TO_FROM_MAP.notifications,
         to: sourceEmail,
         subject: "Your Dub partner accounts are now merged",
         react: PartnerAccountMerged({
           email: sourceEmail,
           sourceEmail,
           targetEmail,
         }),
       },
       {
         from: VARIANT_TO_FROM_MAP.notifications,
         to: targetEmail,
         subject: "Your Dub partner accounts are now merged",
         react: PartnerAccountMerged({
           email: targetEmail,
           sourceEmail,
           targetEmail,
         }),
       },
-    ]);
+      ],
+      { idempotencyKey: `partners/merge/${sourceEmail}->${targetEmail}` },
+    );

Resend batch idempotency reference. (resend.com)

packages/email/src/resend/subscribe.ts (1)

27-35: Handle unauthorized keys and normalize names

Adds a clearer log when the API key is present but invalid, and trims name parts.

-  return await resend.contacts.create({
-    email,
-    ...(name && {
-      firstName: name.split(" ")[0],
-      lastName: name.split(" ").slice(1).join(" "),
-    }),
-    audienceId,
-  });
+  try {
+    return await resend.contacts.create({
+      email,
+      ...(name && {
+        firstName: name.trim().split(/\s+/)[0],
+        lastName: name.trim().split(/\s+/).slice(1).join(" "),
+      }),
+      audienceId,
+    });
+  } catch (err: any) {
+    // Common failure: 401 Unauthorized due to bad key or domain issues
+    console.warn("Resend subscribe failed", {
+      status: err?.status,
+      code: err?.code,
+      audience,
+    });
+    return;
+  }

Resend contact creation flow reference. (resend.com)

packages/email/src/index.ts (4)

6-8: Harden the Resend config check (trim whitespace).

Guard against cases where RESEND_API_KEY is set to whitespace.

-  if (process.env.RESEND_API_KEY) {
+  const resendConfigured = Boolean(process.env.RESEND_API_KEY?.trim());
+  if (resendConfigured) {
     return await sendEmailViaResend(opts);
   }

---

7-7: Drop redundant await on returned promises.

Minor micro-optimization; preserves behavior while avoiding an extra microtask hop.

-    return await sendEmailViaResend(opts);
+    return sendEmailViaResend(opts);

-    return await sendViaNodeMailer({
+    return sendViaNodeMailer({
       email,
       subject,
       text,
       react,
     });

Also applies to: 17-17

---

25-28: Elevate log level for missing email configuration.

Use warn to make misconfiguration more visible in logs. Consider throwing if callers should handle this explicitly.

-  console.info(
+  console.warn(
     "Email sending failed: Neither SMTP nor Resend is configured. Please set up at least one email service to send emails.",
   );

---

1-5: Annotate a concrete return type to improve DX and safety.

Unify the return type across transports so call sites know what to expect.

 import { ResendEmailOptions } from "./resend/types";
 import { sendViaNodeMailer } from "./send-via-nodemailer";
 import { sendEmailViaResend } from "./send-via-resend";
 
-export const sendEmail = async (opts: ResendEmailOptions) => {
+type ResendResult = Awaited<ReturnType<typeof sendEmailViaResend>>;
+type SmtpResult = Awaited<ReturnType<typeof sendViaNodeMailer>>;
+export type EmailSendResult = ResendResult | SmtpResult | undefined;
+
+export const sendEmail = async (opts: ResendEmailOptions): Promise<EmailSendResult> => {

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.