apps/web/package.json (1)

6-6: Avoid duplicate prisma:generate; add a predev and simplify the dev script

Running prisma:generate twice in parallel is redundant and can add noise. Suggest running it once via a predev script.

Apply this diff to the dev line:

-"dev": "concurrently --kill-others \"pnpm prisma:generate && next dev --turbo --port 8888\" \"pnpm prisma:generate && pnpm prisma:studio --browser none\"",
+"dev": "concurrently --kill-others \"next dev --turbo --port 8888\" \"pnpm prisma:studio --browser none\"",

And add this script entry (outside the changed line) so generation runs once before dev:

{
  "scripts": {
    "predev": "pnpm prisma:generate"
  }
}

packages/email/src/resend/types.ts (1)

10-10: Prefer readonly array for bulk payload type

This prevents accidental in-place mutation of the batch payload.

-export type ResendBulkEmailOptions = ResendEmailOptions[];
+export type ResendBulkEmailOptions = ReadonlyArray<ResendEmailOptions>;

apps/web/next.config.js (1)

20-22: Conditionally applying esmExternals only in production makes sense

Good call—keeps dev simpler (and Turbopack doesn’t use this anyway). Consider future-proofing by keying off Next’s phase if you ever need finer control, but this is fine as-is.

packages/email/src/resend/client.ts (1)

3-3: Nullable Resend client aligns with local dev without API key

LGTM. For ergonomics, consider a tiny type guard to reduce repetitive null checks at call sites.

import type { Resend as ResendType } from "resend";
export const hasResend = (client: typeof resend): client is ResendType => !!client;

packages/email/src/resend/subscribe.ts (1)

13-18: Tweak log level/message when client is missing

The guard is correct. Switch to warn and clarify the message since we’re checking the client, not the env directly.

-  if (!resend) {
-    console.error(
-      "No RESEND_API_KEY is set in the environment variables. Skipping.",
-    );
-    return;
-  }
+  if (!resend) {
+    console.warn("Resend client not configured (RESEND_API_KEY missing). Skipping subscribe().");
+    return;
+  }

packages/email/src/resend/unsubscribe.ts (1)

11-16: Match unsubscribe’s guard logging to subscribe’s

Same suggestion: use warn and clarify the message for consistency.

-  if (!resend) {
-    console.error(
-      "No RESEND_API_KEY is set in the environment variables. Skipping.",
-    );
-    return;
-  }
+  if (!resend) {
+    console.warn("Resend client not configured (RESEND_API_KEY missing). Skipping unsubscribe().");
+    return;
+  }

apps/web/app/(ee)/api/cron/payouts/reminders/program-owners/route.ts (1)

186-201: Batch API usage looks correct; consider filtering null emails and deduping.

Map uses user.email!; add a truthy filter and dedupe to avoid bounces/duplicates.

-      const res = await sendBatchEmail(
-        programOwnerChunk.map(({ workspace, user, program, payout }) => ({
+      const res = await sendBatchEmail(
+        Array.from(
+          new Set(programOwnerChunk.map((x) => x.user.email).filter(Boolean)),
+        ).map((email) => ({
           variant: "notifications",
-          email: user.email!,
+          email: email!,
           subject: `${payout.partnersCount} ${pluralize(
             "partner",
             payout.partnersCount,
           )} awaiting your payout for ${program.name}`,
           react: ProgramPayoutReminder({
-            email: user.email!,
+            email: email!,
             workspace,
             program,
             payout,
           }),
         })),
       );

apps/web/app/(ee)/api/cron/payouts/charge-succeeded/send-stripe-payouts.ts (1)

94-111: Rename resendBatch variable; optional email-null guard.

Now that Resend isn’t called directly, rename to batchResult for clarity and filter out null emails pre-map.

-  const resendBatch = await sendBatchEmail(
-    currentInvoicePayouts
-      .filter((p) => p.partner.email)
+  const batchResult = await sendBatchEmail(
+    currentInvoicePayouts
+      .filter((p) => !!p.partner.email)
       .map((p) => {
         return {
           variant: "notifications",
           email: p.partner.email!,
           subject: "You've been paid!",
           react: PartnerPayoutProcessed({
             email: p.partner.email!,
             program: p.program,
             payout: p,
             variant: "stripe",
           }),
         };
       }),
   );

apps/web/lib/actions/partners/create-bounty-submission.ts (1)

142-166: Guard against missing recipient emails in batch.

A stray null email will throw downstream; filter before mapping.

-          await sendBatchEmail(
-            users.map((user) => ({
+          await sendBatchEmail(
+            users
+              .filter((u) => !!u.email)
+              .map((user) => ({
               variant: "notifications",
               email: user.email,
               subject: "Pending bounty review",
               react: BountyPendingReview({
                 email: user.email,
                 workspace: {
                   slug: workspace.slug,
                 },
                 bounty: {
                   id: bounty.id,
                   name: bounty.name,
                 },
                 partner: {
                   name: partner.name,
                   image: partner.image,
                   email: partner.email!,
                 },
                 submission: {
                   id: submission.id,
                 },
               }),
             })),
           );

apps/web/app/(ee)/api/cron/payouts/charge-succeeded/send-paypal-payouts.ts (1)

50-67: LGTM; minor logging nit.

Consider updating the log line to avoid “Resend” wording now that you’re using sendBatchEmail.

-  console.log("Resend batch emails sent", batchEmails);
+  console.log("Batch emails sent", batchEmails);

apps/web/lib/api/partners/notify-partner-application.ts (2)

1-2: Avoid coupling app code to Resend internals for types

Prefer importing a payload type from "@dub/email" (re-export) to avoid leaking implementation details of the Resend transport into app code.

---

73-76: Use allSettled to avoid aborting all batches on one failure

One failing batch will reject the whole Promise.all. Safely fan-out and log failures.

-  await Promise.all(
-    emailChunks.map((emailChunk) => sendBatchEmail(emailChunk)),
-  );
+  const results = await Promise.allSettled(
+    emailChunks.map((emailChunk) => sendBatchEmail(emailChunk)),
+  );
+  results.forEach((r, i) => r.status === "rejected" && console.error("sendBatchEmail chunk failed", { i, error: r.reason }));

apps/web/app/(ee)/api/cron/bounties/notify-partners/route.ts (2)

62-63: String interpolation nit

Minor readability: wrap the ternary in parens or extract to a const; current form is fine though.

---

106-128: Good inclusion of Idempotency-Key; consider per-recipient keys

The batch-level key prevents duplicate batch sends, but a per-recipient key is safer if batches are retried partially by the provider.

-        headers: {
-          "Idempotency-Key": `${bountyId}-page-${page}`,
-        },
+        headers: {
+          "Idempotency-Key": `${bountyId}-page-${page}-${partner.email}`,
+        },

apps/web/lib/actions/partners/bulk-approve-partners.ts (1)

19-21: Avoid importing transport-specific types in app layer

If possible, re-export ResendBulkEmailOptions (or a transport-agnostic alias) from "@dub/email" and import from there.

apps/web/lib/partners/approve-partner-enrollment.ts (1)

178-201: Optional: add idempotency and tolerate multi-user lists

Partner can have multiple users; consider a per-email Idempotency-Key. Chunking is probably unnecessary here but harmless if added.

             sendBatchEmail(
               partnerEmailsToNotify.map((email) => ({
                 subject: `Your application to join ${program.name} partner program has been approved!`,
                 variant: "notifications",
                 email,
+                headers: {
+                  "Idempotency-Key": `partner-approved-${program.id}-${partner.id}-${email}`,
+                },
                 react: PartnerApplicationApproved({

apps/web/lib/api/partners/notify-partner-commission.ts (2)

69-77: Unnecessary Promise.resolve wrapper around Prisma call

Passing the Prisma promise directly is clearer; Promise.resolve is redundant here.

-    commission.linkId
-      ? Promise.resolve(
-        prisma.link.findUnique({
-          where: {
-            id: commission.linkId,
-          },
-          select: {
-            shortLink: true,
-          },
-        }),
-      )
-      : Promise.resolve(null),
+    commission.linkId
+      ? prisma.link.findUnique({
+          where: { id: commission.linkId },
+          select: { shortLink: true },
+        })
+      : null,

---

141-144: Batch send approach LGTM

Chunking by 100 and parallelizing batches is reasonable. Consider sequentializing batches later if you hit provider rate limits.

packages/email/src/index.ts (2)

16-24: Preserve replyTo/from in SMTP fallback (single send)

Parity with the Resend path helps support proper replies and branding.

   if (smtpConfigured) {
-    const { email, subject, text, react } = opts;
+    const { email, subject, text, react, replyTo, from } = opts;
     return await sendViaNodeMailer({
       email,
       subject,
       text,
       react,
+      replyTo,
+      from,
     });
   }

---

41-48: Preserve replyTo/from in SMTP fallback (batch send)

Ensure batch SMTP sends carry reply-to/from.

-    await Promise.all(payload.map((p) => sendViaNodeMailer({
-      email: p.email,
-      subject: p.subject,
-      text: p.text,
-      react: p.react,
-    })));
+    await Promise.all(
+      payload.map((p) =>
+        sendViaNodeMailer({
+          email: p.email,
+          subject: p.subject,
+          text: p.text,
+          react: p.react,
+          replyTo: p.replyTo,
+          from: p.from,
+        }),
+      ),
+    );

apps/web/app/(ee)/api/cron/merge-partner-accounts/route.ts (1)

247-268: Deduplicate recipients and log batch-send errors — 'notifications' variant verified

Avoid double-sending when sourceEmail === targetEmail and surface failures from sendBatchEmail (variant "notifications" exists in packages/email/src/resend/constants.ts).

-    await sendBatchEmail([
-      {
-        variant: "notifications",
-        email: sourceEmail,
-        subject: "Your Dub partner accounts are now merged",
-        react: PartnerAccountMerged({
-          email: sourceEmail,
-          sourceEmail,
-          targetEmail,
-        }),
-      },
-      {
-        variant: "notifications",
-        email: targetEmail,
-        subject: "Your Dub partner accounts are now merged",
-        react: PartnerAccountMerged({
-          email: targetEmail,
-          sourceEmail,
-          targetEmail,
-        }),
-      },
-    ]);
+    const recipients = [...new Set([sourceEmail, targetEmail])];
+    const result = await sendBatchEmail(
+      recipients.map((email) => ({
+        variant: "notifications",
+        email,
+        subject: "Your Dub partner accounts are now merged",
+        react: PartnerAccountMerged({ email, sourceEmail, targetEmail }),
+      })),
+    );
+    if (result?.error) {
+      await log({
+        message: `merge-partner-accounts: batch email failed: ${String(result.error)}`,
+        type: "alerts",
+      });
+    }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/api/bounties/get-bounty-or-throw.ts:53-63
Timestamp: 2025-08-26T15:38:48.173Z
Learning: In bounty-related code, getBountyOrThrow returns group objects with { id } field (transformed from BountyGroup.groupId), while other routes working directly with BountyGroup Prisma records use the actual groupId field. This is intentional - getBountyOrThrow abstracts the join table details.

Learnt from: devkiran
PR: dubinc/dub#2177
File: apps/web/lib/api/links/bulk-create-links.ts:66-84
Timestamp: 2025-06-06T07:59:03.120Z
Learning: In apps/web/lib/api/links/bulk-create-links.ts, the team accepts the risk of potential undefined results from links.find() operations when building invalidLinks arrays, because existing links are fetched from the database based on the input links, so matches are expected to always exist.

apps/web/lib/api/domains/add-domain-vercel.ts (1)

12-20: Fix return type mismatch and avoid masking prod misconfig

Returning Response.json(...) violates the declared Promise<CustomResponse> (you’re returning a Response), and unconditionally succeeding hides missing credentials in production. Gate by NODE_ENV and return a plain object.

-  if (
-    !process.env.PROJECT_ID_VERCEL ||
-    !process.env.TEAM_ID_VERCEL ||
-    !process.env.AUTH_BEARER_TOKEN
-  ) {
-    return Response.json({
-      success: true,
-    });
-  }
+  const missingCreds =
+    !process.env.PROJECT_ID_VERCEL ||
+    !process.env.TEAM_ID_VERCEL ||
+    !process.env.AUTH_BEARER_TOKEN;
+  if (missingCreds) {
+    if (process.env.NODE_ENV !== "production") {
+      return { success: true, skipped: true };
+    }
+    return { success: false, error: "Missing Vercel credentials" };
+  }

apps/web/app/(ee)/api/cron/year-in-review/route.ts (1)

115-118: Fix payload shape: mapping Resend-style objects to { email, ... } required

You’re still passing { from, to, reply_to, subject, text, react } objects into sendBatchEmail, which expects items with an email field (recipient) and optional variant, replyTo, etc. This will fail at runtime. Prior review already flagged this.

Apply this diff:

-      const { data, error } = await sendBatchEmail(
-        // @ts-ignore
-        batch.map((b) => b.email),
-      );
+      const { data, error } = await sendBatchEmail(
+        batch.map((b) => {
+          const e = b.email;
+          const to = Array.isArray(e.to) ? e.to[0] : e.to;
+          return {
+            variant: "notifications",
+            email: to,
+            subject: e.subject,
+            text: e.text,
+            react: e.react,
+            replyTo: (e as any).reply_to ?? (e as any).replyTo,
+            from: e.from,
+          };
+        }),
+      );

apps/web/app/(ee)/api/cron/payouts/process/process-payouts.ts (1)

227-245: Re-introduce contextual logging before dispatch (aligns with earlier feedback)

Helps correlate chunked sends and investigate local no-op paths. Mirrors the prior “keep this check/log” suggestion.

 for (const payoutChunk of payoutChunks) {
+  console.info(`Dispatching ${payoutChunk.length} payout confirmation emails`);
   await sendBatchEmail(
     payoutChunk.map((payout) => ({
       variant: "notifications",
       email: payout.partner.email!,
       subject: "You've got money coming your way!",
       react: PartnerPayoutConfirmed({
         email: payout.partner.email!,
         program,
         payout: {
           id: payout.id,
           amount: payout.amount,
           startDate: payout.periodStart,
           endDate: payout.periodEnd,
         },
       }),
     })),
   );
 }

apps/web/package.json (1)

151-151: Restore trailing newline at EOF.

Prevents needless diffs and satisfies editors/linters that expect a newline-terminated file.

-}
+}
+

apps/web/lib/api/domains/add-domain-vercel.ts (1)

22-38: Handle non-2xx from Vercel and add a timeout

Currently errors just fall through as JSON; add res.ok handling and a short timeout to avoid hanging calls. Maintain CustomResponse shape on both paths.

-  return await fetch(
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 10_000);
+  try {
+    const res = await fetch(
     `https://api.vercel.com/v10/projects/${process.env.PROJECT_ID_VERCEL}/domains?teamId=${process.env.TEAM_ID_VERCEL}`,
-    {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${process.env.AUTH_BEARER_TOKEN}`,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        name: domain.toLowerCase(),
-        ...(redirectToApex && {
-          redirect: getDomainWithoutWWW(domain.toLowerCase()),
-        }),
-      }),
-    },
-  ).then((res) => res.json());
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${process.env.AUTH_BEARER_TOKEN}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        name: domain.toLowerCase(),
+        ...(redirectToApex && {
+          redirect: getDomainWithoutWWW(domain.toLowerCase()),
+        }),
+      }),
+      signal: controller.signal,
+    });
+    const payload = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      // Treat "already exists" as success if Vercel reports a conflict.
+      if (res.status === 409 && payload?.error?.code === "domain_already_exists") {
+        return { success: true, data: payload, alreadyExists: true };
+      }
+      return {
+        success: false,
+        error: payload?.error?.message ?? `Vercel API ${res.status}`,
+        status: res.status,
+      };
+    }
+    return { success: true, data: payload };
+  } finally {
+    clearTimeout(timeout);
+  }

apps/web/app/(ee)/api/cron/bounties/notify-partners/route.ts (2)

62-64: Nit: log formatting is clearer now

Readable log of applicable groups; no action needed.

---

106-128: Confirm header passthrough in SMTP fallback (Idempotency-Key may be ignored)

You set headers: { "Idempotency-Key": ... }, which Resend supports. The SMTP fallback in @dub/email currently sends only { email, subject, text, react } and appears to drop headers. If you rely on this header for dedupe, it won’t apply locally.

Option A (preferred): update sendViaNodeMailer path to accept and forward headers where feasible.

Option B: if headers aren’t needed locally, add a brief comment noting headers are only effective with Resend.

I can draft the small change in packages/email/src/index.ts to forward headers if helpful.

apps/web/app/(ee)/api/cron/payouts/charge-succeeded/send-stripe-payouts.ts (1)

94-113: Guard empty payloads and avoid logging PII; also debrand log message

Build the batch once, skip when empty, and log a compact summary instead of the full response.

-  const resendBatch = await sendBatchEmail(
-    currentInvoicePayouts
-      .filter((p) => p.partner.email)
-      .map((p) => {
-        return {
-          variant: "notifications",
-          email: p.partner.email!,
-          subject: "You've been paid!",
-          react: PartnerPayoutProcessed({
-            email: p.partner.email!,
-            program: p.program,
-            payout: p,
-            variant: "stripe",
-          }),
-        };
-      }),
-  );
-
-  console.log("Sent Resend batch emails", JSON.stringify(resendBatch, null, 2));
+  const emails = currentInvoicePayouts
+    .filter((p) => p.partner.email)
+    .map((p) => ({
+      variant: "notifications" as const,
+      email: p.partner.email!,
+      subject: "You've been paid!",
+      react: PartnerPayoutProcessed({
+        email: p.partner.email!,
+        program: p.program,
+        payout: p,
+        variant: "stripe",
+      }),
+    }));
+
+  if (emails.length === 0) {
+    console.log("No partner payout emails to send.");
+  } else {
+    const res = await sendBatchEmail(emails);
+    console.log("Sent payout emails", { count: emails.length, error: res?.error });
+  }

packages/email/src/resend/subscribe.ts (1)

13-18: Align message with new gating

You now gate on the client instance, not strictly the env var; make the log transport-agnostic.

-  if (!resend) {
-    console.error(
-      "No RESEND_API_KEY is set in the environment variables. Skipping.",
-    );
+  if (!resend) {
+    console.error("Resend client not configured. Skipping subscribe.");
     return;
   }

packages/email/src/resend/client.ts (1)

3-3: Add explicit union type for clarity across module boundaries

Improves IDE/helpfulness when consumers import resend.

-export const resend = process.env.RESEND_API_KEY ? new Resend(process.env.RESEND_API_KEY) : null
+export const resend: Resend | null =
+  process.env.RESEND_API_KEY ? new Resend(process.env.RESEND_API_KEY) : null

apps/web/lib/actions/partners/create-bounty-submission.ts (1)

142-166: Filter null emails before batching

Prevents undefined recipients in SMTP fallback and removes need for implicit non-null assumptions.

-          await sendBatchEmail(
-            users.map((user) => ({
+          const recipients = users.filter((u) => !!u.email);
+          if (recipients.length) {
+            await sendBatchEmail(
+              recipients.map((user) => ({
                 variant: "notifications",
                 email: user.email,
                 subject: "Pending bounty review",
                 react: BountyPendingReview({
                   email: user.email,
                   workspace: {
                     slug: workspace.slug,
                   },
                   bounty: {
                     id: bounty.id,
                     name: bounty.name,
                   },
                   partner: {
                     name: partner.name,
                     image: partner.image,
                     email: partner.email!,
                   },
                   submission: {
                     id: submission.id,
                   },
                 }),
-            })),
-          );
+              })),
+            );
+          }

apps/web/app/(ee)/api/cron/domains/renewal-reminders/route.ts (1)

111-123: Filter recipients and log accurate counts

Avoid sending to undefined addresses; keep logs concise.

-      const res = await sendBatchEmail(
-        reminderDomainsChunk.map(({ workspace, user, domain }) => ({
-          email: user.email!,
+      const payload = reminderDomainsChunk
+        .filter(({ user }) => !!user.email)
+        .map(({ workspace, user, domain }) => ({
+          email: user.email!,
           subject: "Your domain is expiring soon",
           variant: "notifications",
           react: DomainRenewalReminder({
             email: user.email!,
             workspace,
             domain,
           }),
-        })),
-      );
-      console.log(`Sent ${reminderDomainsChunk.length} emails`, res);
+        }));
+      const res = await sendBatchEmail(payload);
+      console.log(`Sent ${payload.length} emails`, { error: res?.error });

apps/web/app/(ee)/api/cron/payouts/reminders/partners/route.ts (1)

119-129: Capture result and avoid verbose/PII logs

Log a summary and potential error; consider trimming the subsequent console.info(partnerProgramsChunk) as it may include PII.

-      await sendBatchEmail(
+      const res = await sendBatchEmail(
         partnerProgramsChunk.map(({ partner, programs }) => ({
           email: partner.email,
           subject: "Connect your payout details on Dub Partners",
           variant: "notifications",
           react: ConnectPayoutReminder({
             email: partner.email,
             programs,
           }),
         })),
       );
+      console.log("Sent partner payout reminders", {
+        count: partnerProgramsChunk.length,
+        error: res?.error,
+      });

Additionally update the next log line to avoid dumping recipient data:

// replace line 131
console.info({ partnersNotified: partnerProgramsChunk.length });

apps/web/lib/actions/partners/merge-partner-accounts.ts (1)

173-194: Add plain-text fallback for OTP emails

Improves deliverability/readability in clients that block HTML.

   await sendBatchEmail([
     {
       variant: "notifications",
       email: sourceEmail,
       subject: "Verify your email to merge your Dub Partners accounts",
+      text: `Your verification code is ${sourceEmailCode}. It expires in ${EMAIL_OTP_EXPIRY_IN / 60} minutes.`,
       react: VerifyEmailForAccountMerge({
         email: sourceEmail,
         code: sourceEmailCode,
         expiresInMinutes: EMAIL_OTP_EXPIRY_IN / 60,
       }),
     },
     {
       variant: "notifications",
       email: targetEmail,
       subject: "Verify your email to merge your Dub Partners accounts",
+      text: `Your verification code is ${targetEmailCode}. It expires in ${EMAIL_OTP_EXPIRY_IN / 60} minutes.`,
       react: VerifyEmailForAccountMerge({
         email: targetEmail,
         code: targetEmailCode,
         expiresInMinutes: EMAIL_OTP_EXPIRY_IN / 60,
       }),
     },
   ]);

apps/web/lib/api/partners/notify-partner-application.ts (1)

74-76: Prefer settled when sending multiple chunks

Prevents one failing chunk from rejecting the whole batch.

-  await Promise.all(
-    emailChunks.map((emailChunk) => sendBatchEmail(emailChunk)),
-  );
+  await Promise.allSettled(
+    emailChunks.map((emailChunk) => sendBatchEmail(emailChunk)),
+  );

apps/web/app/(ee)/api/cron/merge-partner-accounts/route.ts (1)

247-268: Optional: include plain-text fallback

Add text for clients that block HTML.

   await sendBatchEmail([
     {
       variant: "notifications",
       email: sourceEmail,
       subject: "Your Dub partner accounts are now merged",
+      text: `Your partner accounts (${sourceEmail} → ${targetEmail}) are now merged.`,
       react: PartnerAccountMerged({
         email: sourceEmail,
         sourceEmail,
         targetEmail,
       }),
     },
     {
       variant: "notifications",
       email: targetEmail,
       subject: "Your Dub partner accounts are now merged",
+      text: `Your partner accounts (${sourceEmail} → ${targetEmail}) are now merged.`,
       react: PartnerAccountMerged({
         email: targetEmail,
         sourceEmail,
         targetEmail,
       }),
     },
   ]);

apps/web/lib/api/partners/notify-partner-commission.ts (2)

69-77: Remove redundant Promise.resolve wrapper

The inner prisma call already returns a Promise; the wrapper adds noise.

-    commission.linkId
-      ? Promise.resolve(
-        prisma.link.findUnique({
-          where: {
-            id: commission.linkId,
-          },
-          select: {
-            shortLink: true,
-          },
-        }),
-      )
-      : Promise.resolve(null),
+    commission.linkId
+      ? prisma.link.findUnique({
+          where: { id: commission.linkId },
+          select: { shortLink: true },
+        })
+      : Promise.resolve(null),

---

143-144: Optional: use settled to isolate failures between chunks

Avoids a single chunk failure rejecting the whole send.

-  await Promise.all(
-    emailChunks.map((emailChunk) => sendBatchEmail(emailChunk)),
-  );
+  await Promise.allSettled(
+    emailChunks.map((emailChunk) => sendBatchEmail(emailChunk)),
+  );

packages/email/src/index.ts (1)

26-29: Return a consistent result from sendEmail when no transport is configured

Right now this falls through and returns undefined; consider returning a uniform result (e.g., { error }) to make call-sites observable.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/api/bounties/get-bounty-or-throw.ts:53-63
Timestamp: 2025-08-26T15:38:48.173Z
Learning: In bounty-related code, getBountyOrThrow returns group objects with { id } field (transformed from BountyGroup.groupId), while other routes working directly with BountyGroup Prisma records use the actual groupId field. This is intentional - getBountyOrThrow abstracts the join table details.

Learnt from: devkiran
PR: dubinc/dub#2177
File: apps/web/lib/api/links/bulk-create-links.ts:66-84
Timestamp: 2025-06-06T07:59:03.120Z
Learning: In apps/web/lib/api/links/bulk-create-links.ts, the team accepts the risk of potential undefined results from links.find() operations when building invalidLinks arrays, because existing links are fetched from the database based on the input links, so matches are expected to always exist.

packages/email/src/send-via-resend.ts (1)

39-39: Add missing semicolons to satisfy project style.

Prettier with semi: true will flag these; add semicolons after the function expression and the return statement.

-}
+};
@@
-    }
+    };

You can check locally with:

npx prettier --check "packages/email/src/send-via-resend.ts"

Also applies to: 62-62

apps/web/next.config.js (1)

20-22: Use a ternary for conditional spread (clearer, avoids spreading a boolean)

Spreading the result of cond && {} works but is unconventional. A ternary reads clearer and avoids coercing false into an object.

-    ...(process.env.NODE_ENV === "production" && {
-      esmExternals: "loose",
-    }),
+    ...(process.env.NODE_ENV === "production"
+      ? { esmExternals: "loose" }
+      : {}),

packages/email/src/send-via-resend.ts (3)

53-68: Keep batch noop response shape consistent with resend.batch.send.

The fallback returns { data: [], error: null }. Verify this matches the exact type returned by resend.batch.send(payload) to avoid narrowing/union issues at call sites. Optionally annotate the function’s return type to lock the contract.

---

5-17: Don't drop supported Resend fields — spread remaining CreateEmailOptions and use nullish default for replyTo.

Preserve unknown Resend/CreateEmailOptions with a rest spread and prefer replyTo ?? "support@dub.co".

-const resendEmailForOptions = (opts: ResendEmailOptions) => {
+const resendEmailForOptions = (opts: ResendEmailOptions) => {
   const {
     email,
     from,
     variant = "primary",
     bcc,
     replyTo,
     subject,
     text,
     react,
     scheduledAt,
-    headers,
+    headers,
+    ...rest,
   } = opts;
 
   return {
     to: email,
     from: from || VARIANT_TO_FROM_MAP[variant],
+    ...rest,
     bcc: bcc,
-    replyTo: replyTo || "support@dub.co",
+    replyTo: replyTo ?? "support@dub.co",
     subject,
     text,
     react,
     scheduledAt,

---

41-51: Clarify/normalize sendEmail return type.

sendEmailViaResend returns undefined when RESEND is not configured and otherwise returns the Resend SDK response; sendEmail therefore can return a Resend response, Nodemailer sendMail info, or undefined. Call sites that capture/inspect the result: apps/web/scripts/send-emails.tsx:17, apps/web/app/(ee)/api/stripe/connect/webhook/payout-paid.ts:46, apps/web/app/(ee)/api/cron/payouts/balance-available/route.ts:137. Either normalize sendEmail/sendEmailViaResend to a stable envelope (and update types) or update callers to handle undefined and multiple provider response shapes.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/app/(ee)/api/cron/domains/transfer/utils.ts (1)

47-48: Guard against missing owner email instead of non-null asserting.

currentWorkspace?.users[0]?.user?.email! can still be undefined at runtime and crash email sending. Prefer an explicit check and early return/log.

Apply:

-  const ownerEmail = currentWorkspace?.users[0]?.user?.email!;
+  const ownerEmail = currentWorkspace?.users?.[0]?.user?.email;
+  if (!ownerEmail) {
+    // TODO: route to your logger/telemetry if available
+    return;
+  }

apps/web/app/api/tokens/route.ts (1)

168-185: Consider setting an explicit variant and guarding for missing recipient.

To keep “from” consistent across transports (Resend vs. NodeMailer fallback per retrieved learnings) and avoid accidental undefined recipients in edge cases, add an explicit variant and a simple runtime guard.

If sendEmail supports variant, apply:

-    waitUntil(
-      sendEmail({
-        to: session.user.email,
+    waitUntil(
+      sendEmail({
+        to: session.user.email,
+        variant: "notifications",
         subject: `A new API key has been created for your workspace ${workspace.name} on Dub`,
         react: APIKeyCreated({
           email: session.user.email,
           token: {
             name,
             type: scopesToName(scopes || []).name,
             permissions: scopesToName(scopes || []).description,
           },
           workspace: {
             name: workspace.name,
             slug: workspace.slug,
           },
         }),
       }),
     );

Optional guard (if session.user.email can be nullable in some auth flows):

-    waitUntil(
+    if (session.user.email) {
+      waitUntil(
         sendEmail({
           to: session.user.email,
           subject: `A new API key has been created for your workspace ${workspace.name} on Dub`,
           react: APIKeyCreated({
             email: session.user.email,
             token: {
               name,
               type: scopesToName(scopes || []).name,
               permissions: scopesToName(scopes || []).description,
             },
             workspace: {
               name: workspace.name,
               slug: workspace.slug,
             },
           }),
         }),
-    );
+      );
+    }

Note: Referencing the retrieved learning about the NodeMailer fallback’s simplified sender handling; an explicit variant helps ensure consistency in local SMTP.

apps/web/app/(ee)/api/stripe/connect/webhook/payout-paid.ts (2)

64-66: Reduce PII/noise in logs — log only message identifiers

Current log dumps the full provider response and email address. Prefer minimal, structured logs.

-    console.log(
-      `Sent email to partner ${partner.email} (${stripeAccount}): ${JSON.stringify(sentEmail, null, 2)}`,
-    );
+    const msgId =
+      sentEmail && typeof sentEmail === "object" && "id" in (sentEmail as any)
+        ? (sentEmail as any).id
+        : undefined;
+    console.log(
+      JSON.stringify({
+        event: "partner_payout_email_sent",
+        stripeAccount,
+        to: partner.email,
+        id: msgId ?? null,
+      }),
+    );

---

46-67: Make webhook resilient: don’t let email send failure bubble up

If sendEmail throws, you risk failing the webhook after DB updates. Wrap with try/catch and log.

-    const sentEmail = await sendEmail({
+    try {
+      const sentEmail = await sendEmail({
         variant: "notifications",
         subject: "Your funds have been transferred to your bank account",
         to: partner.email,
         react: PartnerPayoutWithdrawalCompleted({
           email: partner.email,
           payout: {
             amount: stripePayout.amount,
             currency: stripePayout.currency,
             arrivalDate: stripePayout.arrival_date,
             traceId:
               typeof stripePayout.trace_id === "string"
                 ? stripePayout.trace_id
                 : null,
           },
         }),
-    });
-
-    console.log(
-      `Sent email to partner ${partner.email} (${stripeAccount}): ${JSON.stringify(sentEmail, null, 2)}`,
-    );
+      });
+      const msgId =
+        sentEmail && typeof sentEmail === "object" && "id" in (sentEmail as any)
+          ? (sentEmail as any).id
+          : undefined;
+      console.log(
+        JSON.stringify({
+          event: "partner_payout_email_sent",
+          stripeAccount,
+          to: partner.email,
+          id: msgId ?? null,
+        }),
+      );
+    } catch (err) {
+      console.error(
+        JSON.stringify({
+          event: "partner_payout_email_error",
+          stripeAccount,
+          to: partner.email,
+          error: err instanceof Error ? err.message : String(err),
+        }),
+      );
+    }

apps/web/app/(ee)/api/paypal/webhook/payouts-item-failed.ts (2)

86-87: Avoid non-null assertion on paypalEmail.

Template receives partner.paypalEmail! without a guard. If null in prod data, this will render invalid content or throw. Guard or provide a fallback.

Apply:

-            partner: {
-              paypalEmail: payout.partner.paypalEmail!,
-            },
+            partner: {
+              paypalEmail: payout.partner.paypalEmail ?? paypalEmail,
+            },

---

41-45: Use centralized logger instead of console.log for missing payout.

For consistency and observability, prefer log({ type: "errors", ... }) here too.

-  if (!payout) {
-    console.log(
-      `[PayPal] Payout not found for invoice ${invoiceId} and partner ${paypalEmail}`,
-    );
-    return;
-  }
+  if (!payout) {
+    await log({
+      message: `[PayPal] Payout not found for invoice ${invoiceId} and partner ${paypalEmail}`,
+      type: "errors",
+    });
+    return;
+  }

apps/web/lib/integrations/install.ts (1)

39-99: Add error handling around waitUntil(sendEmail) and drop unnecessary non-null assertions.

Prevents silent failures in background work; also removes redundant ! inside a guarded block.

Apply:

       if (email && integration) {
-        await sendEmail({
-          to: email!,
-          subject: `The "${integration.name}" integration has been added to your workspace`,
-          react: IntegrationInstalled({
-            email: email!,
-            workspace: {
-              name: workspace.name,
-              slug: workspace.slug,
-            },
-            integration: {
-              name: integration.name,
-              slug: integration.slug,
-            },
-          }),
-        });
+        try {
+          await sendEmail({
+            to: email,
+            subject: `The "${integration.name}" integration has been added to your workspace`,
+            react: IntegrationInstalled({
+              email,
+              workspace: { name: workspace.name, slug: workspace.slug },
+              integration: { name: integration.name, slug: integration.slug },
+            }),
+          });
+        } catch (err) {
+          console.error("Failed to send integration-installed email", {
+            userId,
+            workspaceId,
+            integrationId,
+            email,
+            error: err instanceof Error ? err.message : String(err),
+          });
+        }
       }

apps/web/app/api/webhooks/route.ts (1)

119-126: Prefer deterministic unique lookup for Zapier installation

If installedIntegration has a unique constraint on (projectId, integrationId), use findUnique with the compound key for determinism and intent. Otherwise, consider adding that constraint.

Would you confirm whether a unique index exists on (projectId, integrationId) in InstalledIntegration?

apps/web/app/(ee)/api/cron/program-application-reminder/route.ts (2)

38-42: Clarify message: application may exist but be older than 3 days

The current message can mislead when the record is filtered out by createdAt. Suggest tweaking copy.

-      return new Response(
-        `Application ${applicationId} not found. Skipping...`,
-      );
+      return new Response(
+        `Application ${applicationId} not found or older than 3 days. Skipping...`,
+      );

---

21-25: Minor: extract magic number to a named constant for readability

Creates a single source of truth for the 3-day window.

-        createdAt: {
-          gt: new Date(Date.now() - 3 * 24 * 60 * 60 * 1000),
-        },
+        createdAt: {
+          gt: new Date(Date.now() - THREE_DAYS_MS),
+        },

Outside this hunk (near Line 16), add:

const THREE_DAYS_MS = 3 * 24 * 60 * 60 * 1000;

apps/web/app/api/dub/webhook/lead-created.ts (1)

54-65: Option: consider sendBatchEmail for multiple owners

If owners > 1 is common, batching will reduce transport calls and centralize error handling. Not required, just aligns with the PR’s direction to consolidate batch sends.

apps/web/lib/rewardful/import-commissions.ts (1)

117-129: Guard email send so a notification failure doesn’t fail the import job.

If sendEmail throws (e.g., missing transport locally), the whole import completion path will error after credentials are deleted. Consider soft-failing with logging.

Apply:

-  if (workspaceUser && workspaceUser.user.email) {
-    await sendEmail({
+  if (workspaceUser && workspaceUser.user.email) {
+    try {
+      await sendEmail({
         to: workspaceUser.user.email,
         subject: "Rewardful campaign imported",
         react: ProgramImported({
           email: workspaceUser.user.email,
           workspace: workspaceUser.project,
           program,
           provider: "Rewardful",
           importId,
         }),
-    });
+      });
+    } catch (err) {
+      console.error("Failed to send import completion email", {
+        importId,
+        programId: program.id,
+        userId: workspaceUser.userId,
+        err,
+      });
+    }
-  }
+  }

apps/web/app/(ee)/api/cron/welcome-user/route.ts (1)

44-65: Make Resend subscribe non-blocking so email still sends without RESEND_API_KEY

If subscribe() throws in local dev (no Resend key), Promise.all will reject and prevent sendEmail from running. To preserve the “email always sends; subscribe best-effort” behavior, decouple and swallow subscribe errors.

-    await Promise.all([
-      subscribe({
-        email: user.email,
-        name: user.name || undefined,
-        audience: isPartner ? "partners.dub.co" : "app.dub.co",
-      }),
-      sendEmail({
-        to: user.email,
-        replyTo: "steven.tey@dub.co",
-        subject: `Welcome to Dub${isPartner ? " Partners" : ""}!`,
-        react: isPartner
-          ? WelcomeEmailPartner({
-            email: user.email,
-            name: user.name,
-          })
-          : WelcomeEmail({
-            email: user.email,
-            name: user.name,
-          }),
-        variant: "marketing",
-      }),
-    ]);
+    const subscribePromise = subscribe({
+      email: user.email,
+      name: user.name || undefined,
+      audience: isPartner ? "partners.dub.co" : "app.dub.co",
+    }).catch((err) => {
+      console.warn("Resend subscribe failed; continuing.", err);
+    });
+
+    await sendEmail({
+      to: user.email,
+      replyTo: "steven.tey@dub.co",
+      subject: `Welcome to Dub${isPartner ? " Partners" : ""}!`,
+      react: isPartner
+        ? WelcomeEmailPartner({
+            email: user.email,
+            name: user.name,
+          })
+        : WelcomeEmail({
+            email: user.email,
+            name: user.name,
+          }),
+      variant: "marketing",
+    });
+
+    await subscribePromise;

apps/web/app/(ee)/api/cron/import/short/utils.ts (3)

33-34: Optional: construct the Short.io URL with URL/URLSearchParams and add timeout/error handling

No behavior change here, but building the URL via URLSearchParams avoids subtle formatting issues and guarantees proper encoding; adding a timeout and status check prevents hanging/crashing on upstream issues.

Apply this diff:

-  const data = await fetch(
-    `https://api.short.io/api/links?domain_id=${domainId}&limit=50${pageToken ? `&pageToken=${pageToken}` : ""
-    }`,
-    {
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: shortApiKey,
-      },
-    },
-  ).then((res) => res.json());
+  const url = new URL("https://api.short.io/api/links");
+  const params = new URLSearchParams({ domain_id: String(domainId), limit: "50" });
+  if (pageToken) params.set("pageToken", pageToken);
+  url.search = params.toString();
+  const data = await fetch(url.toString(), {
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: shortApiKey,
+    },
+    // Avoid hanging if Short.io is slow/unavailable
+    signal: AbortSignal.timeout(10_000),
+  }).then(async (res) => {
+    if (!res.ok) throw new Error(`Short.io ${res.status} ${await res.text()}`);
+    return res.json();
+  });

---

149-155: Type-safe filter and faster tag lookup

Two small wins:

• Replace filter(Boolean) with a type-guard to narrow to string[].
• Use a Map for O(1) lookups instead of Array.find in a loop. Helpful when many tags exist.

Apply this diff within the mapping:

-          tagIds: tags
-            .map(
-              (tag: string) =>
-                allTags.find((t) => t.name === tag)?.id ?? null,
-            )
-            .filter(Boolean),
+          tagIds: tags
+            .map((tag) => tagNameToId.get(tag))
+            .filter((id): id is string => Boolean(id)),

And add this once above the bulkCreateLinks call (right before Line 142):

// Build a lookup to avoid O(n^2) scans
const tagNameToId = new Map(allTags.map(({ name, id }) => [name, id] as const));

---

216-229: Guard empty recipient and make email non-blocking

The rename to to is consistent with the new email API. To avoid failing the import flow due to an email transient and to skip sending when ownerEmail is empty, make the send optional and use Promise.allSettled. This aligns with the “SMTP fallback is a simple backup” behavior noted in retrieved learnings.

Apply this diff:

-    await Promise.all([
+    await Promise.allSettled([
       // delete key from redis
       redis.del(`import:short:${workspaceId}`),
 
       // send email to user
-      sendEmail({
-        subject: `Your Short.io links have been imported!`,
-        to: ownerEmail,
-        react: LinksImported({
-          email: ownerEmail,
-          provider: "Short.io",
-          count,
-          links,
-          domains: [domain],
-          workspaceName: workspace?.name ?? "",
-          workspaceSlug: workspace?.slug ?? "",
-        }),
-      }),
+      ...(ownerEmail
+        ? [
+            sendEmail({
+              subject: "Your Short.io links have been imported!",
+              to: ownerEmail,
+              react: LinksImported({
+                email: ownerEmail,
+                provider: "Short.io",
+                count,
+                links,
+                domains: [domain],
+                workspaceName: workspace?.name ?? "",
+                workspaceSlug: workspace?.slug ?? "",
+              }),
+            }),
+          ]
+        : []),
     ]);

apps/web/lib/actions/partners/ban-partner.ts (2)

34-36: Prefer enum comparison for status check.

Improves type-safety and consistency with the enum used on updates.

-    if (programEnrollment.status === "banned") {
+    if (programEnrollment.status === ProgramEnrollmentStatus.banned) {

---

95-99: Enrich the log message for missing partner email.

Helps triage by including identifiers.

-        if (!partner.email) {
-          console.error("Partner has no email address.");
+        if (!partner.email) {
+          console.error(`Partner ${partnerId} has no email address (programId=${programId}).`);
           return;
         }

apps/web/lib/actions/send-invite-referral-email.ts (2)

37-37: Guard against missing app name in subject

Avoid “undefined” in subjects when NEXT_PUBLIC_APP_NAME isn’t set (common in local).

-        subject: `You've been invited to start using ${process.env.NEXT_PUBLIC_APP_NAME}`,
+        subject: `You've been invited to start using ${process.env.NEXT_PUBLIC_APP_NAME ?? "Dub"}`,

---

28-30: Avoid PII in rate-limit keys by hashing the email

Storing raw emails in keys can leak PII via metrics/logs. Hash before keying.

Add import:

+import { createHash } from "node:crypto";

Hash and use the digest:

-    const { success: successEmail } = await ratelimit(2, "2 h").limit(
-      `invite-referral-email:${email}`,
-    );
+    const hashedEmail = createHash("sha256")
+      .update(email.toLowerCase())
+      .digest("hex");
+    const { success: successEmail } = await ratelimit(2, "2 h").limit(
+      `invite-referral-email:${hashedEmail}`,
+    );

apps/web/lib/tolt/import-commissions.ts (1)

314-390: Avoid mixing booleans with promises in Promise.all

Promise.all([ ..., saleAmount > 0 && recordSale..., ..., saleAmount > 0 && prisma.customer.update(...) ]) relies on truthy coercion. It works but harms readability and types.

Consider:

const tasks = [
  prisma.commission.create({ /* ... */ }),
  prisma.link.update({ /* ... */ }),
] as Promise<unknown>[];

if (saleAmount > 0) {
  tasks.push(
    recordSaleWithTimestamp({ /* ... */ }),
    prisma.customer.update({ /* ... */ })
  );
}

await Promise.all(tasks);

apps/web/app/(ee)/api/cron/domains/verify/utils.ts (4)

125-127: Typo in log message ("andhas").

Minor but noisy in ops logs.

-      message: `Domain *${domain}* has been invalid for > 30 days andhas links but no link clicks, deleting.`,
+      message: `Domain *${domain}* has been invalid for > 30 days and has links but no link clicks, deleting.`,

---

108-121: Avoid re-promoting a deleted domain to primary.

findFirst() doesn’t exclude the just-deleted domain or deleted domains in general. Could flip primary back onto a deleted record.

Apply:

-          const anotherDomain = await prisma.domain.findFirst({
-            where: {
-              projectId: workspace.id,
-            },
-          });
+          const anotherDomain = await prisma.domain.findFirst({
+            where: {
+              projectId: workspace.id,
+              slug: { not: domain },
+              deletedAt: null, // adjust to your schema
+            },
+            orderBy: { primary: "desc" }, // prefer an existing primary if any
+          });

---

197-207: Persisting “sentEmail” even if delivery fails.

With allSettled, prisma.sentEmail.create will still run if sends fail. If that’s intended (record attempt), ignore. Otherwise, gate creation on successful sends.

-  return await Promise.allSettled([
-    log({...}),
-    ...emails.map(...sendEmail...),
-    prisma.sentEmail.create({...}),
-  ]);
+  const results = await Promise.allSettled([
+    ...emails.map(...sendEmail...),
+  ]);
+  const allOk = results.every(r => r.status === "fulfilled");
+  await log({...});
+  if (allOk) {
+    await prisma.sentEmail.create({...});
+  }
+  return results;

Also applies to: 210-220

---

3-5: Use sendBatchEmail (single scheduled batch) with the repo's array payload shape

sendBatchEmail is exported in packages/email and expects an array of per-recipient items ({ to, subject, variant, react, … }); change the import to import { sendEmail, sendBatchEmail } from "@dub/email"; and replace the per-recipient ...emails.map(email => limiter.schedule(() => sendEmail(...))) with a single scheduled call:

limiter.schedule(() =>
sendBatchEmail(
emails.map((email) => ({
to: email,
subject: Your domain ${domain} has been deleted,
variant: "notifications",
react: DomainDeleted({ email, domain, workspaceSlug }),
})),
),
);

Do the same for the InvalidDomain path. Locations: apps/web/app/(ee)/api/cron/domains/verify/utils.ts (imports at lines 3–5; callsites around 128–141 and 195–209).

apps/web/app/api/user/set-password/route.ts (1)

39-47: Rename to to is consistent; consider non-blocking send for latency.

Optional: mirror reset-password and avoid awaiting email to reduce API latency.

Apply within this block:

-  await sendEmail({
+  waitUntil(sendEmail({
     subject: `${process.env.NEXT_PUBLIC_APP_NAME}: Password reset instructions`,
     to: session.user.email,
     react: ResetPasswordLink({
       email: session.user.email,
       url: `${process.env.NEXTAUTH_URL}/auth/reset-password/${token}`,
     }),
-  });
+  }));

Add import (outside the range):

import { waitUntil } from "@vercel/functions";

Verify this route runs in an environment where @vercel/functions waitUntil is available.

apps/web/lib/partnerstack/update-stripe-customers.ts (3)

181-186: Use an accurate error code and fix the metadata key in the message.

The case is “multiple customers,” but code is STRIPE_CUSTOMER_NOT_FOUND, and the message references metadata.tolt_referral while the logic checks metadata.customer_key.

-      await logImportError({
-        ...commonImportLogInputs,
-        code: "STRIPE_CUSTOMER_NOT_FOUND",
-        message: `Stripe search returned multiple customers for ${customer.email} for workspace ${workspace.slug} and none had metadata.tolt_referral set`,
-      });
+      await logImportError({
+        ...commonImportLogInputs,
+        code: "STRIPE_MULTIPLE_CUSTOMERS_FOUND",
+        message: `Stripe search returned multiple customers for ${customer.email} in workspace ${workspace.slug} and none had metadata.customer_key set`,
+      });

---

104-119: Don’t throw if the workspace user membership changed; fall back gracefully.

If the user was removed during the long-running job, findUniqueOrThrow will crash the tail of the import. Prefer findUnique and keep the existing null guard.

-  const workspaceUser = await prisma.projectUsers.findUniqueOrThrow({
+  const workspaceUser = await prisma.projectUsers.findUnique({
     where: {
       userId_projectId: {
         userId,
         projectId: workspace.id,
       },
     },

---

57-61: Trim unused field from select to save I/O.

name isn’t used downstream; fetch only what you need.

-      select: {
-        id: true,
-        name: true,
-        email: true,
-      },
+      select: {
+        id: true,
+        email: true,
+      },

apps/web/lib/actions/partners/approve-bounty-submission.ts (3)

98-115: Avoid inserting non-promises into Promise.allSettled.

Using partner.email && sendEmail(...) can push a falsy scalar into the array. Prefer conditionally spreading an array so the list only contains Promises.

Apply this minimal diff:

-        partner.email &&
-        sendEmail({
+        ...(partner.email
+          ? [
+              sendEmail({
                   subject: "Bounty approved!",
                   to: partner.email,
                   variant: "notifications",
                   react: BountyApproved({
                     email: partner.email,
                     program: {
                       name: program.name,
                       slug: program.slug,
                       supportEmail: program.supportEmail || "support@dub.co",
                     },
                     bounty: {
                       name: bounty.name,
                       type: bounty.type,
                     },
                   }),
-        }),
+              }),
+            ]
+          : []),

---

99-103: Align subject with template copy or add context.

Template preview says “Bounty confirmed”. Consider matching that or adding program/bounty context for clarity.

Example:

-          subject: "Bounty approved!",
+          subject: `Bounty confirmed — ${program.name}`,

---

98-115: Optional: set replyTo to program.supportEmail (Resend path)

Resend supports replyTo (ResendEmailOptions extends CreateEmailOptions) and send-via-resend already forwards replyTo (defaults to "support@dub.co"). Add replyTo: program.supportEmail to the sendEmail call in apps/web/lib/actions/partners/approve-bounty-submission.ts to improve reply UX; NodeMailer fallback intentionally ignores extras.

apps/web/lib/actions/send-otp.ts (2)

72-85: Rename misspelled local variable for clarity.

hasExistingApplicaitons → hasExistingApplications.

-        const [isPartnerAccount, hasExistingApplicaitons] = await Promise.all([
+        const [isPartnerAccount, hasExistingApplications] = await Promise.all([
...
-        if (!isPartnerAccount && !hasExistingApplicaitons) {
+        if (!isPartnerAccount && !hasExistingApplications) {

---

112-129: Avoid partial success between DB write and email send.

Promise.all can leave a token created even if email sending fails. Sequence the operations to improve consistency.

-    await Promise.all([
-      prisma.emailVerificationToken.create({
-        data: {
-          identifier: email,
-          token: code,
-          expires: new Date(Date.now() + EMAIL_OTP_EXPIRY_IN * 1000),
-        },
-      }),
-
-      sendEmail({
-        subject: `${process.env.NEXT_PUBLIC_APP_NAME}: OTP to verify your account`,
-        to: email,
-        react: VerifyEmail({
-          email,
-          code,
-        }),
-      }),
-    ]);
+    await prisma.emailVerificationToken.create({
+      data: {
+        identifier: email,
+        token: code,
+        expires: new Date(Date.now() + EMAIL_OTP_EXPIRY_IN * 1000),
+      },
+    });
+    await sendEmail({
+      subject: `${process.env.NEXT_PUBLIC_APP_NAME}: OTP to verify your account`,
+      to: email,
+      react: VerifyEmail({ email, code }),
+    });

If you prefer atomicity, wrap in a transaction and only commit before sending, or add a retry on send failure.

apps/web/lib/actions/partners/reject-bounty-submission.ts (1)

89-110: Prefer an explicit ternary to keep Promise.allSettled inputs homogeneous and aid TS narrowing

Using partner.email && … inserts a non-Promise value when falsy. Promise.allSettled will coerce it, but a ternary keeps intent clear and narrows partner.email to string in the true branch.

-        partner.email &&
-        sendEmail({
-          subject: "Bounty rejected",
-          to: partner.email,
-          variant: "notifications",
-          react: BountyRejected({
-            email: partner.email,
-            program: {
-              name: program.name,
-              slug: program.slug,
-              supportEmail: program.supportEmail || "support@dub.co",
-            },
-            bounty: {
-              name: bounty.name,
-            },
-            submission: {
-              rejectionReason:
-                REJECT_BOUNTY_SUBMISSION_REASONS[rejectionReason],
-            },
-          }),
-        }),
+        partner.email
+          ? sendEmail({
+              subject: "Bounty rejected",
+              to: partner.email,
+              variant: "notifications",
+              react: BountyRejected({
+                email: partner.email,
+                program: {
+                  name: program.name,
+                  slug: program.slug,
+                  supportEmail: program.supportEmail || "support@dub.co",
+                },
+                bounty: {
+                  name: bounty.name,
+                },
+                submission: {
+                  rejectionReason:
+                    REJECT_BOUNTY_SUBMISSION_REASONS[rejectionReason],
+                },
+              }),
+            })
+          : Promise.resolve(),

apps/web/lib/actions/partners/create-bounty-submission.ts (3)

135-152: Avoid brittle rest-destructuring for workspace.

const { users, program, ...workspace } = ... assumes flat fields; if the API returns { workspace }, workspace.slug here will be undefined.

Proposed explicit destructure (adjust to the actual return shape):

-const { users, program, ...workspace } = await getWorkspaceUsers({
+const { users, program, workspace } = await getWorkspaceUsers({
   programId,
   role: Role.owner,
   notificationPreference: "newBountySubmitted",
 });

If the function doesn’t return workspace, keep current code but add a runtime guard before using workspace.slug.

---

141-167: Harden batch send: filter/unique recipients and keep payload small.

Guard against missing emails and duplicates before calling sendBatchEmail.

-        if (users.length > 0) {
-          await sendBatchEmail(
-            users.map((user) => ({
+        if (users.length > 0) {
+          const recipients = Array.from(
+            new Set(users.map((u) => u.email).filter(Boolean))
+          ) as string[];
+          if (recipients.length) {
+            await sendBatchEmail(
+              recipients.map((email) => ({
                 variant: "notifications",
-                to: user.email,
+                to: email,
                 subject: "Pending bounty review",
                 react: BountyPendingReview({
-                  email: user.email,
+                  email,
                   workspace: {
                     slug: workspace.slug,
                   },
                   bounty: {
                     id: bounty.id,
                     name: bounty.name,
                   },
                   partner: {
                     name: partner.name,
                     image: partner.image,
-                    email: partner.email!,
+                    email: partner.email ?? "(not provided)",
                   },
                   submission: {
                     id: submission.id,
                   },
                 }),
               })),
-          );
+            );
+          }
         }

Note: If bulk payload should use email instead of to, swap the key accordingly after verifying the API.

---

132-188: Wrap waitUntil task with try/catch for safe background execution.

Prevents unhandled rejections from surfacing as function errors and adds context to logs.

-    waitUntil(
-      (async () => {
+    waitUntil(
+      (async () => {
+        try {
         // Send email to the program owners
         const { users, program, ...workspace } = await getWorkspaceUsers({
           programId,
           role: Role.owner,
           notificationPreference: "newBountySubmitted",
         });
         ...
-        }
-      })(),
+        }
+        } catch (err) {
+          console.error("createBountySubmissionAction: email dispatch failed", {
+            programId,
+            bountyId,
+            submissionId: submission.id,
+            err,
+          });
+        }
+      })(),
     );

apps/web/app/(ee)/api/cron/import/rebrandly/utils.ts (4)

21-22: Use URLSearchParams for tags URL construction (consistency + safety).

Match the pattern used below for links to avoid hand-built query strings and ensure proper encoding.

-    `https://api.rebrandly.com/v1/tags?orderBy=name&orderDir=desc&limit=25${lastTagId ? `&last=${lastTagId}` : ""}`,
+    new URL(
+      "https://api.rebrandly.com/v1/tags?" +
+        new URLSearchParams({
+          orderBy: "name",
+          orderDir: "desc",
+          limit: "25",
+          ...(lastTagId ? { last: lastTagId } : {}),
+        }).toString(),
+    ).toString(),

---

44-49: Preserve Rebrandly tag color when available (fallback to random).

If Rebrandly provides a color, prefer it to maintain user context; otherwise use randomBadgeColor().

-      color: randomBadgeColor(),
+      color: tag.color || randomBadgeColor(),

---

141-143: Avoid shadowing links identifier inside the completion block.

Minor readability nit: renaming prevents confusion with the outer links array used earlier.

-    const links = workspace?.links ?? [];
+    const recentLinks = workspace?.links ?? [];
@@
-          links,
+          links: recentLinks,

---

174-174: Unify importLinksFromRebrandly return type (number vs QStash result).

Currently the function returns the final count when the import completes (utils.ts:174) but returns the qstash.publishJSON result when scheduling another job (utils.ts:253–267). The only caller (apps/web/app/(ee)/api/cron/import/rebrandly/route.ts) awaits the call but does not use its return value, so no call-site depends on the mixed type. Make the function consistently return the count (preferred) or change it to Promise and handle qstash responses upstream.

apps/web/app/(ee)/api/stripe/webhook/utils.ts (1)

33-45: Prefer filtering valid recipients and using allSettled to avoid short-circuiting on single failure

Map currently returns false for owners without email and Promise.all will reject on first failure. Filter first and use allSettled for resilience.

-  return await Promise.all(
-    owners.map(
-      (owner) =>
-        owner.email &&
-        sendEmail({
-          to: owner.email,
-          from: "Steven Tey <steven@dub.co>",
-          replyTo: "steven.tey@dub.co",
-          subject: "Feedback for Dub.co?",
-          text: `Hey ${owner.name ? owner.name.split(" ")[0] : "there"}!\n\nSaw you canceled your Dub subscription${reasonText ? ` and mentioned that ${reasonText}` : ""} – do you mind sharing if there's anything we could've done better on our side?\n\nWe're always looking to improve our product offering so any feedback would be greatly appreciated!\n\nThank you so much in advance!\n\nBest,\nSteven Tey\nFounder, Dub.co`,
-        }),
-    ),
-  );
+  return await Promise.allSettled(
+    owners
+      .filter((o) => !!o.email)
+      .map((owner) =>
+        sendEmail({
+          to: owner.email!,
+          from: "Steven Tey <steven@dub.co>",
+          replyTo: "steven.tey@dub.co",
+          subject: "Feedback for Dub.co?",
+          text: `Hey ${owner.name ? owner.name.split(" ")[0] : "there"}!\n\nSaw you canceled your Dub subscription${reasonText ? ` and mentioned that ${reasonText}` : ""} – do you mind sharing if there's anything we could've done better on our side?\n\nWe're always looking to improve our product offering so any feedback would be greatly appreciated!\n\nThank you so much in advance!\n\nBest,\nSteven Tey\nFounder, Dub.co`,
+        }),
+      ),
+  );

apps/web/lib/cron/send-limit-email.ts (1)

21-24: Guard against division by zero for percentage

If workspace.linksLimit is 0, this will Infinity/NaN. Add a safe guard.

-  const percentage = Math.round(
-    (workspace.linksUsage / workspace.linksLimit) * 100,
-  );
+  const percentage =
+    workspace.linksLimit > 0
+      ? Math.round((workspace.linksUsage / workspace.linksLimit) * 100)
+      : 0;

apps/web/lib/webhook/failure.ts (2)

109-126: Consider awaiting or deferring email to avoid process teardown dropping sends

These sends are fire-and-forget. If this runs in a serverless request context, they can be dropped when the handler returns.

-  sendEmail({
+  await sendEmail({
     subject: "Webhook is failing to deliver",
     to: email,
     react: WebhookFailed({
       email,
       workspace: {
         name: workspace.name,
         slug: workspace.slug,
       },
       webhook: {
         id: webhook.id,
         url: webhook.url,
         consecutiveFailures: webhook.consecutiveFailures,
         disableThreshold: WEBHOOK_FAILURE_DISABLE_THRESHOLD,
       },
     }),
   });

---

156-172: Same here: await or queue send to ensure delivery

Mirror the approach for the disabled notification.

-  sendEmail({
+  await sendEmail({
     subject: "Webhook has been disabled",
     to: email,
     react: WebhookDisabled({
       email,
       workspace: {
         name: workspace.name,
         slug: workspace.slug,
       },
       webhook: {
         id: webhook.id,
         url: webhook.url,
         disableThreshold: WEBHOOK_FAILURE_DISABLE_THRESHOLD,
       },
     }),
   });

apps/web/app/(ee)/api/stripe/webhook/invoice-payment-failed.tsx (1)

69-75: Use strict equality in the subject prefix.

Avoid == in TS; switch to === for attemptCount.

-        subject: `${attemptCount == 2
+        subject: `${attemptCount === 2
           ? "2nd notice: "
-          : attemptCount == 3
+          : attemptCount === 3
             ? "3rd notice: "
             : ""
           }Your payment for Dub.co failed`,

packages/email/src/send-via-nodemailer.ts (2)

15-23: Remove ts-ignore and coerce env types; add sane defaults for local dev.

Prevents type leaks and eases MailHog defaults.

-  const transporter = nodemailer.createTransport({
-    // @ts-ignore (Fix this)
-    host: process.env.SMTP_HOST,
-    port: process.env.SMTP_PORT,
+  const transporter = nodemailer.createTransport({
+    host: process.env.SMTP_HOST ?? "localhost",
+    port: Number(process.env.SMTP_PORT ?? 1025),

---

29-31: Optional: clearer local sender.

A recognizable local from helps debugging.

-    from: "noreply@example.com",
+    from: "Dub Local <noreply@localhost>",

apps/web/app/(ee)/api/cron/year-in-review/route.ts (1)

106-121: Remove stale ts-ignore comments; types line up now.

emailData is typed with ResendEmailOptions, so both the recipients log and the batch call can be strictly typed without @ts-ignore.

-      console.log(
-        `📨 Recipients:`,
-        // @ts-ignore
-        batch.map((b) => b.email.to),
-      );
+      console.log(
+        `📨 Recipients:`,
+        batch.map((b) => b.email.to),
+      );
@@
-      const { data, error } = await sendBatchEmail(
-        // @ts-ignore
-        batch.map((b) => b.email),
-      );
+      const { data, error } = await sendBatchEmail(
+        batch.map((b) => b.email),
+      );

apps/web/app/(ee)/api/stripe/webhook/checkout-session-completed.ts (2)

109-121: Rename to to looks correct; watch SMTP fallback ignoring replyTo.

The switch to to aligns with the new email API. Note: in local SMTP fallback, replyTo/from aren’t preserved (per retrieved learning), so don’t rely on replyTo being honored during MailHog testing.

Using the retrieved learning: sendViaNodeMailer is a minimal backup and won’t preserve from/replyTo. If replyTo is important, consider reflecting it in the email body for local runs or adding a header note.

---

100-106: Avoid unsafe casts by filtering null emails.

You can drop the as string by filtering falsy emails up front.

-  const users = workspace.users.map(({ user }) => ({
-    id: user.id,
-    name: user.name,
-    email: user.email,
-  }));
+  const users = workspace.users
+    .filter(({ user }) => Boolean(user.email))
+    .map(({ user }) => ({
+      id: user.id,
+      name: user.name,
+      email: user.email as string,
+    }));

apps/web/scripts/send-emails.tsx (1)

20-25: Ternary subject is hard to scan; simplify for readability.

-    subject: `${attemptCount == 2
-      ? "2nd notice: "
-      : attemptCount == 3
-        ? "3rd notice: "
-        : ""
-      }Your payment for Dub.co failed`,
+    subject: `${attemptCount === 2 ? "2nd notice: " : attemptCount === 3 ? "3rd notice: " : ""}Your payment for Dub.co failed`,

Or:

+    const prefix = attemptCount === 2 ? "2nd notice: " : attemptCount === 3 ? "3rd notice: " : "";
+    subject: `${prefix}Your payment for Dub.co failed`,

apps/web/app/(ee)/api/stripe/webhook/charge-failed.ts (2)

246-260: Batch API usage looks good; consider surfacing send errors.

-      await sendBatchEmail(
+      const res1 = await sendBatchEmail(
         workspaceOwners.map(({ user }) => ({
           variant: "notifications",
           to: user.email!,
           subject: "Domain expired",
           react: DomainExpired({
             email: user.email!,
             workspace: {
               name: workspace.name,
               slug: workspace.slug,
             },
             domains,
           }),
         })),
       );
+      if (res1.error) console.warn("sendBatchEmail(domain expired) error:", res1.error);

---

276-289: Same as above: log/send telemetry on batch result.

-      await sendBatchEmail(
+      const res2 = await sendBatchEmail(
         workspaceOwners.map(({ user }) => ({
           variant: "notifications",
           to: user.email!,
           subject: "Domain renewal failed",
           react: DomainRenewalFailed({
             email: user.email!,
             workspace: {
               slug: workspace.slug,
             },
             domains,
           }),
         })),
       );
+      if (res2.error) console.warn("sendBatchEmail(domain renewal failed) error:", res2.error);