Switch den-api emails to React Email

apps/app/package.json

@@ -62,8 +62,8 @@
     "lucide-react": "^0.577.0",
     "marked": "^17.0.1",
     "motion": "^12.38.0",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1",
+    "react": "catalog:",
+    "react-dom": "catalog:",
     "react-markdown": "^10.1.0",
     "react-resizable-panels": "^4.11.0",
     "react-router-dom": "^7.14.1",

apps/share/package.json

@@ -15,8 +15,8 @@
     "botid": "^1.5.11",
     "jsonc-parser": "^3.3.1",
     "next": "16.1.6",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
+    "react": "catalog:",
+    "react-dom": "catalog:",
     "sharp": "^0.34.5",
     "ulid": "^2.3.0",
     "yaml": "^2.8.1"

apps/ui-demo/package.json

@@ -11,8 +11,8 @@
   },
   "dependencies": {
     "@openwork/ui": "workspace:*",
-    "react": "19.2.4",
-    "react-dom": "19.2.4"
+    "react": "catalog:",
+    "react-dom": "catalog:"
   },
   "devDependencies": {
     "@types/react": "19.2.14",

ee/apps/den-api/.env.example

@@ -7,8 +7,17 @@ BETTER_AUTH_SECRET=replace-with-32-plus-character-secret
 DEN_DB_ENCRYPTION_KEY=
 BETTER_AUTH_URL=http://localhost:8790
 DEN_BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000,http://localhost:3001
-LOOPS_TRANSACTIONAL_ID_DEN_VERIFY_EMAIL=replace-with-loops-template-id
-LOOPS_TRANSACTIONAL_ID_DEN_ORG_INVITE_EMAIL=replace-with-loops-template-id
+EMAIL_FROM=OpenWork <team@openworklabs.com>
+# Transactional email uses Resend when RESEND_API_KEY is set.
+RESEND_API_KEY=
+# Otherwise, transactional email uses SMTP/Nodemailer when SMTP_HOST is set.
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+SMTP_SECURE=false
+# Optional Loops API key for contact/event syncs after signup and subscription.
+LOOPS_API_KEY=
 PROVISIONER_MODE=daytona
 WORKER_URL_TEMPLATE=https://workers.local/{workerId}
 WORKER_ACTIVITY_BASE_URL=http://localhost:8790

ee/apps/den-api/package.json

@@ -6,6 +6,7 @@
     "dev": "OPENWORK_DEV_MODE=1 tsx watch src/server.ts",
     "dev:local": "sh -lc 'OPENWORK_DEV_MODE=1 PORT=${DEN_API_PORT:-8790} tsx watch src/server.ts'",
     "build": "node ./scripts/build.mjs",
+    "build:email": "pnpm --filter @openwork/email build",
     "build:den-db": "pnpm --filter @openwork-ee/den-db build",
     "seed:demo-org": "pnpm run build:den-db && sh -lc 'DEN_WEB_PORT=${DEN_WEB_PORT:-3005}; OPENWORK_DEV_MODE=${OPENWORK_DEV_MODE:-1} DATABASE_URL=${DATABASE_URL:-mysql://root:password@127.0.0.1:3306/openwork_den} DEN_DB_ENCRYPTION_KEY=${DEN_DB_ENCRYPTION_KEY:-local-dev-db-encryption-key-please-change-1234567890} BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-local-dev-secret-not-for-production-use!!} BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:$DEN_WEB_PORT} tsx scripts/seed-demo-org.ts'",
     "start": "node dist/server.js"
@@ -21,6 +22,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openwork-ee/den-db": "workspace:*",
     "@openwork-ee/utils": "workspace:*",
+    "@openwork/email": "workspace:*",
     "@openwork/types": "workspace:*",
     "@standard-community/standard-json": "^0.3.5",
     "@standard-community/standard-openapi": "^0.2.9",

ee/apps/den-api/scripts/build.mjs

@@ -55,5 +55,6 @@ function run(command, args) {
 process.env.DEN_API_LATEST_APP_VERSION = process.env.DEN_API_LATEST_APP_VERSION || readDesktopVersion()
 writeGeneratedVersionFile(process.env.DEN_API_LATEST_APP_VERSION)
 
+run(pnpmCommand, ["run", "build:email"])
 run(pnpmCommand, ["run", "build:den-db"])
 run(pnpmCommand, ["exec", "tsc", "-p", "tsconfig.json"])

ee/apps/den-api/src/auth.ts

@@ -1,11 +1,8 @@
 import { getInitialActiveOrganizationIdForUser } from "./active-organization.js";
 import { db } from "./db.js";
 import { env } from "./env.js";
-import {
-  sendDenOrganizationInvitationEmail,
-  sendDenVerificationEmail,
-} from "./email.js";
 import { syncDenSignupContact } from "./loops.js";
+import { sendEmail } from "./utils/email/send-email.js";
 import {
   DEN_API_KEY_DEFAULT_PREFIX,
   DEN_API_KEY_RATE_LIMIT_MAX,
@@ -228,9 +225,10 @@ export const auth = betterAuth({
       expiresIn: 600,
       allowedAttempts: 5,
       async sendVerificationOTP({ email, otp, type }) {
-        await sendDenVerificationEmail({
-          email,
-          verificationCode: otp,
+        await sendEmail({
+          to: email,
+          template: "verification",
+          props: { verificationCode: otp },
         });
       },
     }),
@@ -249,13 +247,16 @@ export const auth = betterAuth({
         },
       },
       async sendInvitationEmail(data) {
-        await sendDenOrganizationInvitationEmail({
-          email: data.email,
-          inviteLink: buildInvitationLink(data.id),
-          invitedByName: data.inviter.user.name ?? data.inviter.user.email,
-          invitedByEmail: data.inviter.user.email,
-          organizationName: data.organization.name,
-          role: data.role,
+        await sendEmail({
+          to: data.email,
+          template: "organizationInvite",
+          props: {
+            inviteLink: buildInvitationLink(data.id),
+            invitedByName: data.inviter.user.name ?? data.inviter.user.email,
+            invitedByEmail: data.inviter.user.email,
+            organizationName: data.organization.name,
+            role: data.role,
+          },
         });
       },
       organizationHooks: {

ee/apps/den-api/src/env.ts

@@ -21,9 +21,14 @@ const EnvSchema = z.object({
   GITHUB_CONNECTOR_APP_WEBHOOK_SECRET: z.string().optional(),
   GOOGLE_CLIENT_ID: z.string().optional(),
   GOOGLE_CLIENT_SECRET: z.string().optional(),
+  EMAIL_FROM: z.string().optional(),
+  RESEND_API_KEY: z.string().optional(),
+  SMTP_HOST: z.string().optional(),
+  SMTP_PORT: z.string().optional(),
+  SMTP_USER: z.string().optional(),
+  SMTP_PASS: z.string().optional(),
+  SMTP_SECURE: z.string().optional(),
   LOOPS_API_KEY: z.string().optional(),
-  LOOPS_TRANSACTIONAL_ID_DEN_VERIFY_EMAIL: z.string().optional(),
-  LOOPS_TRANSACTIONAL_ID_DEN_ORG_INVITE_EMAIL: z.string().optional(),
   OPENWORK_DEV_MODE: z.string().optional(),
   PORT: z.string().optional(),
   CORS_ORIGINS: z.string().optional(),
@@ -183,10 +188,21 @@ export const env = {
     clientId: optionalString(parsed.GOOGLE_CLIENT_ID),
     clientSecret: optionalString(parsed.GOOGLE_CLIENT_SECRET),
   },
+  email: {
+    from: optionalString(parsed.EMAIL_FROM),
+  },
+  resend: {
+    apiKey: optionalString(parsed.RESEND_API_KEY),
+  },
+  smtp: {
+    host: optionalString(parsed.SMTP_HOST),
+    port: Number(parsed.SMTP_PORT ?? "587"),
+    user: optionalString(parsed.SMTP_USER),
+    pass: optionalString(parsed.SMTP_PASS),
+    secure: (parsed.SMTP_SECURE ?? "false").toLowerCase() === "true",
+  },
   loops: {
     apiKey: optionalString(parsed.LOOPS_API_KEY),
-    transactionalIdDenVerifyEmail: optionalString(parsed.LOOPS_TRANSACTIONAL_ID_DEN_VERIFY_EMAIL),
-    transactionalIdDenOrgInviteEmail: optionalString(parsed.LOOPS_TRANSACTIONAL_ID_DEN_ORG_INVITE_EMAIL),
   },
   port,
   workerProxyPort: Number(parsed.WORKER_PROXY_PORT ?? "8789"),