From f5fc56e696968110bfe66e5c533cbc7f3790f847 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 16 Oct 2025 10:48:48 -0400
Subject: [PATCH 1/6] fix(app): show device list of only employees (#1646)

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 .../[orgId]/people/devices/data/index.ts      | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts b/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
index 058239ea1..3ec1d54f5 100644
--- a/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
@@ -19,21 +19,21 @@ export const getEmployeeDevices: () => Promise<Host[] | null> = async () => {
     return null;
   }
 
-  const organization = await db.organization.findUnique({
+  // Find all members belonging to the organization.
+  const employees = await db.member.findMany({
     where: {
-      id: organizationId,
+      organizationId,
     },
   });
 
-  if (!organization) {
-    return null;
-  }
-
-  const labelId = organization.fleetDmLabelId;
-
-  // Get all hosts to get their ids.
-  const employeeDevices = await fleet.get(`/labels/${labelId}/hosts`);
-  const allIds = employeeDevices.data.hosts.map((host: { id: number }) => host.id);
+  const labelIdsResponses = await Promise.all(
+    employees
+      .filter((employee) => employee.fleetDmLabelId)
+      .map((employee) => fleet.get(`/labels/${employee.fleetDmLabelId}/hosts`)),
+  );
+  const allIds = labelIdsResponses.flatMap((response) =>
+    response.data.hosts.map((host: { id: number }) => host.id),
+  );
 
   // Get all devices by id. in parallel
   const devices = await Promise.all(allIds.map((id: number) => fleet.get(`/hosts/${id}`)));

From b737ba3665bb3a80a4a8ea789af103591e56bb06 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 16 Oct 2025 10:50:34 -0400
Subject: [PATCH 2/6] Create trigger.dev task to send policy email due to
 resend rate limit issue (#1633)

* fix(app): trigger 2 new-policy-email events per second at most due to resend rate limit

* fix(app): create trigger.dev task to send policy email due to resend rate limit issue

* fix(app): remove unused send-policy-email API

---------

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 .../accept-requested-policy-changes.ts        | 50 ++++++++++---------
 .../src/app/api/send-policy-email/route.ts    | 50 -------------------
 .../src/jobs/tasks/email/new-policy-email.ts  | 49 ++++++++++++++++++
 3 files changed, 76 insertions(+), 73 deletions(-)
 delete mode 100644 apps/app/src/app/api/send-policy-email/route.ts
 create mode 100644 apps/app/src/jobs/tasks/email/new-policy-email.ts

diff --git a/apps/app/src/actions/policies/accept-requested-policy-changes.ts b/apps/app/src/actions/policies/accept-requested-policy-changes.ts
index bdaa73637..c1ca22993 100644
--- a/apps/app/src/actions/policies/accept-requested-policy-changes.ts
+++ b/apps/app/src/actions/policies/accept-requested-policy-changes.ts
@@ -1,6 +1,8 @@
 'use server';
 
+import { sendNewPolicyEmail } from '@/jobs/tasks/email/new-policy-email';
 import { db, PolicyStatus } from '@db';
+import { tasks } from '@trigger.dev/sdk';
 import { revalidatePath, revalidateTag } from 'next/cache';
 import { z } from 'zod';
 import { authActionClient } from '../safe-action';
@@ -92,34 +94,36 @@ export const acceptRequestedPolicyChangesAction = authActionClient
         return roles.includes('employee');
       });
 
-      // Call /api/send-policy-email to send emails to employees
-
       // Prepare the events array for the API
       const events = employeeMembers
         .filter((employee) => employee.user.email)
-        .map((employee) => ({
-          subscriberId: `${employee.user.id}-${session.activeOrganizationId}`,
-          email: employee.user.email,
-          userName: employee.user.name || employee.user.email || 'Employee',
-          policyName: policy.name,
-          organizationName: policy.organization.name,
-          url: `${process.env.NEXT_PUBLIC_PORTAL_URL ?? 'https://portal.trycomp.ai'}/${session.activeOrganizationId}`,
-          description: `The "${policy.name}" policy has been ${isNewPolicy ? 'created' : 'updated'}.`,
-        }));
+        .map((employee) => {
+          let notificationType: 'new' | 're-acceptance' | 'updated';
+          const wasAlreadySigned = policy.signedBy.includes(employee.id);
+          if (isNewPolicy) {
+            notificationType = 'new';
+          } else if (wasAlreadySigned) {
+            notificationType = 're-acceptance';
+          } else {
+            notificationType = 'updated';
+          }
+
+          return {
+            email: employee.user.email,
+            userName: employee.user.name || employee.user.email || 'Employee',
+            policyName: policy.name,
+            organizationId: session.activeOrganizationId || '',
+            organizationName: policy.organization.name,
+            notificationType,
+          };
+        });
 
       // Call the API route to send the emails
-      try {
-        await fetch(`${process.env.BETTER_AUTH_URL ?? ''}/api/send-policy-email`, {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-          },
-          body: JSON.stringify(events),
-        });
-      } catch (error) {
-        console.error('Failed to call /api/send-policy-email:', error);
-        // Don't throw, just log
-      }
+      await Promise.all(
+        events.map((event) =>
+          tasks.trigger<typeof sendNewPolicyEmail>('send-new-policy-email', event),
+        ),
+      );
 
       // If a comment was provided, create a comment
       if (comment && comment.trim() !== '') {
diff --git a/apps/app/src/app/api/send-policy-email/route.ts b/apps/app/src/app/api/send-policy-email/route.ts
deleted file mode 100644
index ad8457774..000000000
--- a/apps/app/src/app/api/send-policy-email/route.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-import { NextResponse, type NextRequest } from 'next/server';
-import { Novu } from '@novu/api';
-
-export async function POST(request: NextRequest) {
-  let events;
-  try {
-    events = await request.json();
-  } catch (error) {
-    return NextResponse.json(
-      { success: false, error: 'Invalid JSON in request body' },
-      { status: 400 }
-    );
-  }
-
-  // You may want to validate required fields in the body here
-  // For now, we just pass the whole body to Novu
-
-  const novuApiKey = process.env.NOVU_API_KEY;
-  if (!novuApiKey) {
-    return NextResponse.json(
-      { success: false, error: 'Novu API key not configured' },
-      { status: 500 }
-    );
-  }
-
-  const novu = new Novu({ secretKey: novuApiKey });
-
-  try {
-    const result = await novu.triggerBulk({
-      events: events.map((event: any) => ({
-        workflowId: "new-policy-email",
-        to: {
-          subscriberId: event.subscriberId,
-          email: event.email,
-        },
-        payload: event,
-      })),
-    });
-
-    return NextResponse.json({ success: true, result });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : 'Failed to trigger notification',
-      },
-      { status: 500 }
-    );
-  }
-}
diff --git a/apps/app/src/jobs/tasks/email/new-policy-email.ts b/apps/app/src/jobs/tasks/email/new-policy-email.ts
new file mode 100644
index 000000000..b9ee7f4da
--- /dev/null
+++ b/apps/app/src/jobs/tasks/email/new-policy-email.ts
@@ -0,0 +1,49 @@
+import { sendPolicyNotificationEmail } from '@comp/email';
+import { logger, queue, task } from '@trigger.dev/sdk';
+
+// Queue with concurrency limit of 1 to ensure rate limiting (1 email per second max)
+const policyEmailQueue = queue({
+  name: 'policy-email-queue',
+  concurrencyLimit: 2,
+});
+
+interface PolicyEmailPayload {
+  email: string;
+  userName: string;
+  policyName: string;
+  organizationId: string;
+  organizationName: string;
+  notificationType: 'new' | 'updated' | 're-acceptance';
+}
+
+export const sendNewPolicyEmail = task({
+  id: 'send-new-policy-email',
+  queue: policyEmailQueue,
+  run: async (payload: PolicyEmailPayload) => {
+    logger.info('Sending new policy email', {
+      email: payload.email,
+      policyName: payload.policyName,
+    });
+
+    try {
+      await sendPolicyNotificationEmail(payload);
+
+      logger.info('Successfully sent policy email', {
+        email: payload.email,
+        policyName: payload.policyName,
+      });
+
+      return {
+        success: true,
+        email: payload.email,
+      };
+    } catch (error) {
+      logger.error('Failed to send policy email', {
+        email: payload.email,
+        error: error instanceof Error ? error.message : String(error),
+      });
+
+      throw error;
+    }
+  },
+});

From 7bcb97e0750d118bea4c5e3cc8b47442b212a5af Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 16 Oct 2025 10:55:12 -0400
Subject: [PATCH 3/6] CS-39 [QOL] - Shipping info optional onboarding question
 (#1630)

* feat(app): add shipping info step as onboarding question

* fix(app): increase of line height for step title on onboarding

* fix(app): fix typescript error

* fix(app): update shipping info step on onboarding screen

---------

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 .../components/table/ContextColumns.tsx       | 20 +++++++-
 .../onboarding/actions/complete-onboarding.ts | 27 ++++++----
 .../components/PostPaymentOnboarding.tsx      | 15 +++---
 .../hooks/usePostPaymentOnboarding.ts         |  7 ++-
 .../setup/components/OnboardingStepInput.tsx  | 50 +++++++++++++++++++
 .../(app)/setup/hooks/useOnboardingForm.ts    |  2 +-
 apps/app/src/app/(app)/setup/lib/constants.ts | 10 ++++
 apps/app/src/app/(app)/setup/lib/types.ts     |  5 ++
 apps/app/src/lib/utils.ts                     | 10 ++++
 9 files changed, 125 insertions(+), 21 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/settings/context-hub/components/table/ContextColumns.tsx b/apps/app/src/app/(app)/[orgId]/settings/context-hub/components/table/ContextColumns.tsx
index 636d78c23..05e6c2eed 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/context-hub/components/table/ContextColumns.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/context-hub/components/table/ContextColumns.tsx
@@ -1,5 +1,6 @@
 import { deleteContextEntryAction } from '@/actions/context-hub/delete-context-entry-action';
 import { DataTableColumnHeader } from '@/components/data-table/data-table-column-header';
+import { isJSON } from '@/lib/utils';
 import {
   AlertDialog,
   AlertDialogAction,
@@ -78,7 +79,24 @@ export const columns = (): ColumnDef<Context>[] => [
     id: 'answer',
     accessorKey: 'answer',
     header: ({ column }) => <DataTableColumnHeader column={column} title="Answer" />,
-    cell: ({ row }) => <span>{row.original.answer}</span>,
+    cell: ({ row }) => {
+      if (isJSON(row.original.answer)) {
+        return (
+          <span>
+            {Object.entries(JSON.parse(row.original.answer))
+              .filter(([key, value]) => !!value)
+              .map(([key, value]) => (
+                <div key={key}>
+                  <span className="font-medium capitalize">{key}:</span>
+                  <span>{value as string}</span>
+                </div>
+              ))}
+          </span>
+        );
+      }
+
+      return <span>{row.original.answer}</span>;
+    },
     meta: { label: 'Answer' },
     enableColumnFilter: true,
     enableSorting: false,
diff --git a/apps/app/src/app/(app)/onboarding/actions/complete-onboarding.ts b/apps/app/src/app/(app)/onboarding/actions/complete-onboarding.ts
index 1002c945a..bbe85dc1f 100644
--- a/apps/app/src/app/(app)/onboarding/actions/complete-onboarding.ts
+++ b/apps/app/src/app/(app)/onboarding/actions/complete-onboarding.ts
@@ -23,6 +23,11 @@ const onboardingCompletionSchema = z.object({
   infrastructure: z.string().min(1),
   dataTypes: z.string().min(1),
   geo: z.string().min(1),
+  shipping: z.object({
+    fullName: z.string(),
+    address: z.string(),
+    phone: z.string(),
+  }),
 });
 
 export const completeOnboarding = authActionClient
@@ -63,16 +68,18 @@ export const completeOnboarding = authActionClient
 
       // Save the remaining steps to context
       const postPaymentSteps = steps.slice(3); // Steps 4-12
-      await db.context.createMany({
-        data: postPaymentSteps
-          .filter((step) => step.key in parsedInput)
-          .map((step) => ({
-            question: step.question,
-            answer: parsedInput[step.key as keyof typeof parsedInput] as string,
-            tags: ['onboarding'],
-            organizationId: parsedInput.organizationId,
-          })),
-      });
+      const contextData = postPaymentSteps
+        .filter((step) => step.key in parsedInput)
+        .map((step) => ({
+          question: step.question,
+          answer:
+            typeof parsedInput[step.key as keyof typeof parsedInput] === 'object'
+              ? JSON.stringify(parsedInput[step.key as keyof typeof parsedInput])
+              : (parsedInput[step.key as keyof typeof parsedInput] as string),
+          tags: ['onboarding'],
+          organizationId: parsedInput.organizationId,
+        }));
+      await db.context.createMany({ data: contextData });
 
       // Update organization to mark onboarding as complete
       await db.organization.update({
diff --git a/apps/app/src/app/(app)/onboarding/components/PostPaymentOnboarding.tsx b/apps/app/src/app/(app)/onboarding/components/PostPaymentOnboarding.tsx
index 29fa8f756..a5116e889 100644
--- a/apps/app/src/app/(app)/onboarding/components/PostPaymentOnboarding.tsx
+++ b/apps/app/src/app/(app)/onboarding/components/PostPaymentOnboarding.tsx
@@ -88,7 +88,7 @@ export function PostPaymentOnboarding({
               <div className="text-muted-foreground text-sm">
                 Step {stepIndex + 1} of {totalSteps}
               </div>
-              <CardTitle className="flex min-h-[56px] items-center justify-center text-center">
+              <CardTitle className="flex min-h-[56px] items-center justify-center text-center leading-6">
                 {step?.question || ''}
               </CardTitle>
             </div>
@@ -103,10 +103,7 @@ export function PostPaymentOnboarding({
                   autoComplete="off"
                 >
                   {steps.map((s, idx) => (
-                    <div
-                      key={s.key}
-                      style={{ display: idx === stepIndex ? 'block' : 'none' }}
-                    >
+                    <div key={s.key} style={{ display: idx === stepIndex ? 'block' : 'none' }}>
                       <FormField
                         name={s.key}
                         render={({ field }) => (
@@ -118,9 +115,11 @@ export function PostPaymentOnboarding({
                                 savedAnswers={savedAnswers}
                               />
                             </FormControl>
-                            <div className="min-h-[20px]">
-                              <FormMessage />
-                            </div>
+                            {s.key !== 'shipping' && (
+                              <div className="min-h-[20px]">
+                                <FormMessage />
+                              </div>
+                            )}
                           </FormItem>
                         )}
                       />
diff --git a/apps/app/src/app/(app)/onboarding/hooks/usePostPaymentOnboarding.ts b/apps/app/src/app/(app)/onboarding/hooks/usePostPaymentOnboarding.ts
index 08943bcd9..16b50af31 100644
--- a/apps/app/src/app/(app)/onboarding/hooks/usePostPaymentOnboarding.ts
+++ b/apps/app/src/app/(app)/onboarding/hooks/usePostPaymentOnboarding.ts
@@ -134,6 +134,11 @@ export function usePostPaymentOnboarding({
       infrastructure: allAnswers.infrastructure || '',
       dataTypes: allAnswers.dataTypes || '',
       geo: allAnswers.geo || '',
+      shipping: allAnswers.shipping || {
+        fullName: '',
+        address: '',
+        phone: '',
+      },
     });
   };
 
@@ -153,7 +158,7 @@ export function usePostPaymentOnboarding({
 
     // Handle multi-select fields with "Other" option
     for (const key of Object.keys(newAnswers)) {
-      if (step.options && step.key === key && key !== 'frameworkIds') {
+      if (step.options && step.key === key && key !== 'frameworkIds' && key !== 'shipping') {
         const customValue = newAnswers[`${key}Other`] || '';
         const values = (newAnswers[key] || '').split(',').filter(Boolean);
 
diff --git a/apps/app/src/app/(app)/setup/components/OnboardingStepInput.tsx b/apps/app/src/app/(app)/setup/components/OnboardingStepInput.tsx
index ca5d2135a..f0f38a230 100644
--- a/apps/app/src/app/(app)/setup/components/OnboardingStepInput.tsx
+++ b/apps/app/src/app/(app)/setup/components/OnboardingStepInput.tsx
@@ -1,3 +1,4 @@
+import { FormLabel } from '@comp/ui/form';
 import { Input } from '@comp/ui/input';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@comp/ui/select';
 import { SelectPills } from '@comp/ui/select-pills';
@@ -39,6 +40,55 @@ export function OnboardingStepInput({
     );
   }
 
+  if (currentStep.key === 'shipping') {
+    return (
+      <div className="space-y-4" data-testid={`onboarding-input-${currentStep.key}`}>
+        <div className="flex flex-col gap-4 sm:flex-row">
+          <div className="flex-1">
+            <FormLabel>Full Name</FormLabel>
+            <Input
+              {...form.register('shipping.fullName')}
+              placeholder="John Doe"
+              autoFocus
+              data-testid={`onboarding-input-${currentStep.key}-fullName`}
+            />
+            <p className="text-destructive text-[0.8rem] font-medium">
+              {form.formState.errors.shipping?.fullName?.message}
+            </p>
+          </div>
+          <div className="flex-1">
+            <FormLabel>Phone</FormLabel>
+            <Input
+              {...form.register('shipping.phone')}
+              placeholder="+1 (555) 123-4567"
+              autoFocus
+              data-testid={`onboarding-input-${currentStep.key}-phone`}
+            />
+            <p className="text-destructive text-[0.8rem] font-medium">
+              {form.formState.errors.shipping?.phone?.message}
+            </p>
+          </div>
+        </div>
+        <div>
+          <FormLabel>Address</FormLabel>
+          <Textarea
+            {...form.register('shipping.address')}
+            placeholder="123 Main St, Apt 4B, Springfield, IL, USA"
+            rows={2}
+            maxLength={300}
+            data-testid={`onboarding-input-${currentStep.key}-address`}
+          />
+          <p className="text-destructive text-[0.8rem] font-medium">
+            {form.formState.errors.shipping?.address?.message}
+          </p>
+        </div>
+        <p className="text-xs text-center sm:text-left text-muted-foreground">
+          * We won't use your shipping details for any marketing.
+        </p>
+      </div>
+    );
+  }
+
   if (currentStep.key === 'website') {
     return (
       <Controller
diff --git a/apps/app/src/app/(app)/setup/hooks/useOnboardingForm.ts b/apps/app/src/app/(app)/setup/hooks/useOnboardingForm.ts
index 0a6101114..227ce5b91 100644
--- a/apps/app/src/app/(app)/setup/hooks/useOnboardingForm.ts
+++ b/apps/app/src/app/(app)/setup/hooks/useOnboardingForm.ts
@@ -155,7 +155,7 @@ export function useOnboardingForm({
     const newAnswers: OnboardingFormFields = { ...savedAnswers, ...data };
 
     for (const key of Object.keys(newAnswers)) {
-      if (step.options && step.key === key && key !== 'frameworkIds') {
+      if (step.options && step.key === key && key !== 'frameworkIds' && key !== 'shipping') {
         const customValue = newAnswers[`${key}Other`] || '';
         const values = (newAnswers[key] || '').split(',').filter(Boolean);
 
diff --git a/apps/app/src/app/(app)/setup/lib/constants.ts b/apps/app/src/app/(app)/setup/lib/constants.ts
index 48d116335..e02922df1 100644
--- a/apps/app/src/app/(app)/setup/lib/constants.ts
+++ b/apps/app/src/app/(app)/setup/lib/constants.ts
@@ -20,6 +20,11 @@ export const companyDetailsSchema = z.object({
   authentication: z.string().min(1, 'Please select authentication methods'),
   workLocation: z.string().min(1, 'Please select work arrangement'),
   geo: z.string().min(1, 'Please select where your data is located'),
+  shipping: z.object({
+    fullName: z.string().min(1, 'Full name is required'),
+    address: z.string().min(1, 'Address is required'),
+    phone: z.string().min(1, 'Phone number is required'),
+  }),
 });
 
 export const steps: Step[] = [
@@ -137,6 +142,11 @@ export const steps: Step[] = [
       'Australia/New Zealand',
     ],
   },
+  {
+    key: 'shipping',
+    question: 'Where would you like to receive your certificate?',
+    placeholder: '',
+  },
 ];
 
 export const welcomeText = [
diff --git a/apps/app/src/app/(app)/setup/lib/types.ts b/apps/app/src/app/(app)/setup/lib/types.ts
index 3b14342a9..fcd1f051b 100644
--- a/apps/app/src/app/(app)/setup/lib/types.ts
+++ b/apps/app/src/app/(app)/setup/lib/types.ts
@@ -12,6 +12,11 @@ export type CompanyDetails = {
   dataTypes: string;
   software: string;
   geo: string;
+  shipping: {
+    fullName: string;
+    address: string;
+    phone: string;
+  };
 };
 
 export type ChatBubble = {
diff --git a/apps/app/src/lib/utils.ts b/apps/app/src/lib/utils.ts
index 2d3a3b07a..aead1844b 100644
--- a/apps/app/src/lib/utils.ts
+++ b/apps/app/src/lib/utils.ts
@@ -16,3 +16,13 @@ export function getInitials(name: string): string {
 export function sleep(ms: number) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+
+export function isJSON(str: string) {
+  if (!str) return false;
+  try {
+    const parsed = JSON.parse(str);
+    return typeof parsed === 'object' && parsed !== null;
+  } catch (e) {
+    return false;
+  }
+}

From 914c45e7021a8d91456fe7f7aa6bd83a492ce38d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 16 Oct 2025 17:28:02 -0400
Subject: [PATCH 4/6] CS-37 [Improvement] - render records on trust portal
 settings in app for vercel (#1663)

* feat(app): show domain verification status on trust portal settings

* feat(api): create an API to get the vercel trust portal domain status

* fix(app): show domain verification status using api

* fix(api): validate incoming request data using class-validator decorators for domain-status API

* fix(app): prevent API call if the domain is empty

---------

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
---
 apps/api/src/app.module.ts                    |   2 +
 apps/api/src/main.ts                          |  14 ++-
 .../src/trust-portal/dto/domain-status.dto.ts |  47 +++++++
 .../trust-portal/trust-portal.controller.ts   |  68 ++++++++++
 .../src/trust-portal/trust-portal.module.ts   |  12 ++
 .../src/trust-portal/trust-portal.service.ts  | 117 ++++++++++++++++++
 .../components/TrustPortalDomain.tsx          |  38 +++++-
 apps/app/src/hooks/use-domain.ts              |  25 ++++
 packages/docs/openapi.json                    | 104 ++++++++++++++++
 9 files changed, 424 insertions(+), 3 deletions(-)
 create mode 100644 apps/api/src/trust-portal/dto/domain-status.dto.ts
 create mode 100644 apps/api/src/trust-portal/trust-portal.controller.ts
 create mode 100644 apps/api/src/trust-portal/trust-portal.module.ts
 create mode 100644 apps/api/src/trust-portal/trust-portal.service.ts
 create mode 100644 apps/app/src/hooks/use-domain.ts

diff --git a/apps/api/src/app.module.ts b/apps/api/src/app.module.ts
index 7280e9c5a..a6410a423 100644
--- a/apps/api/src/app.module.ts
+++ b/apps/api/src/app.module.ts
@@ -16,6 +16,7 @@ import { RisksModule } from './risks/risks.module';
 import { TasksModule } from './tasks/tasks.module';
 import { VendorsModule } from './vendors/vendors.module';
 import { ContextModule } from './context/context.module';
+import { TrustPortalModule } from './trust-portal/trust-portal.module';
 
 @Module({
   imports: [
@@ -41,6 +42,7 @@ import { ContextModule } from './context/context.module';
     TasksModule,
     CommentsModule,
     HealthModule,
+    TrustPortalModule,
   ],
   controllers: [AppController],
   providers: [AppService],
diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
index 0df1cedd5..06001fcde 100644
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -1,5 +1,5 @@
 import type { INestApplication } from '@nestjs/common';
-import { VersioningType } from '@nestjs/common';
+import { ValidationPipe, VersioningType } from '@nestjs/common';
 import { NestFactory } from '@nestjs/core';
 import type { OpenAPIObject } from '@nestjs/swagger';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
@@ -11,6 +11,18 @@ import path from 'path';
 async function bootstrap(): Promise<void> {
   const app: INestApplication = await NestFactory.create(AppModule);
 
+  // Enable global validation pipe
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+      transformOptions: {
+        enableImplicitConversion: true,
+      },
+    }),
+  );
+
   // Configure body parser limits for file uploads (base64 encoded files)
   app.use(express.json({ limit: '15mb' }));
   app.use(express.urlencoded({ limit: '15mb', extended: true }));
diff --git a/apps/api/src/trust-portal/dto/domain-status.dto.ts b/apps/api/src/trust-portal/dto/domain-status.dto.ts
new file mode 100644
index 000000000..7f06dc66c
--- /dev/null
+++ b/apps/api/src/trust-portal/dto/domain-status.dto.ts
@@ -0,0 +1,47 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsNotEmpty, IsString, Matches } from 'class-validator';
+
+export class GetDomainStatusDto {
+  @ApiProperty({
+    description: 'The domain name to check status for',
+    example: 'portal.example.com',
+  })
+  @IsString()
+  @IsNotEmpty({ message: 'domain cannot be empty' })
+  @Matches(/^(?!-)[A-Za-z0-9-]+([-\.]{1}[a-z0-9]+)*\.[A-Za-z]{2,6}$/, {
+    message: 'domain must be a valid domain format',
+  })
+  domain: string;
+}
+
+export class DomainVerificationDto {
+  @ApiProperty({ description: 'Verification type (e.g., TXT, CNAME)' })
+  type: string;
+
+  @ApiProperty({ description: 'Domain for verification' })
+  domain: string;
+
+  @ApiProperty({ description: 'Verification value' })
+  value: string;
+
+  @ApiProperty({
+    description: 'Reason for verification status',
+    required: false,
+  })
+  reason?: string;
+}
+
+export class DomainStatusResponseDto {
+  @ApiProperty({ description: 'The domain name' })
+  domain: string;
+
+  @ApiProperty({ description: 'Whether the domain is verified' })
+  verified: boolean;
+
+  @ApiProperty({
+    description: 'Verification records for the domain',
+    type: [DomainVerificationDto],
+    required: false,
+  })
+  verification?: DomainVerificationDto[];
+}
diff --git a/apps/api/src/trust-portal/trust-portal.controller.ts b/apps/api/src/trust-portal/trust-portal.controller.ts
new file mode 100644
index 000000000..9a102882f
--- /dev/null
+++ b/apps/api/src/trust-portal/trust-portal.controller.ts
@@ -0,0 +1,68 @@
+import {
+  Controller,
+  Get,
+  HttpCode,
+  HttpStatus,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  ApiHeader,
+  ApiOperation,
+  ApiQuery,
+  ApiResponse,
+  ApiSecurity,
+  ApiTags,
+} from '@nestjs/swagger';
+import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
+import {
+  DomainStatusResponseDto,
+  GetDomainStatusDto,
+} from './dto/domain-status.dto';
+import { TrustPortalService } from './trust-portal.service';
+
+@ApiTags('Trust Portal')
+@Controller({ path: 'trust-portal', version: '1' })
+@UseGuards(HybridAuthGuard)
+@ApiSecurity('apikey')
+@ApiHeader({
+  name: 'X-Organization-Id',
+  description:
+    'Organization ID (required for session auth, optional for API key auth)',
+  required: false,
+})
+export class TrustPortalController {
+  constructor(private readonly trustPortalService: TrustPortalService) {}
+
+  @Get('domain/status')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({
+    summary: 'Get domain verification status',
+    description:
+      'Retrieve the verification status and DNS records for a custom domain configured in the Vercel trust portal project',
+  })
+  @ApiQuery({
+    name: 'domain',
+    description: 'The domain name to check status for',
+    example: 'portal.example.com',
+    required: true,
+  })
+  @ApiResponse({
+    status: HttpStatus.OK,
+    description: 'Domain status retrieved successfully',
+    type: DomainStatusResponseDto,
+  })
+  @ApiResponse({
+    status: HttpStatus.INTERNAL_SERVER_ERROR,
+    description: 'Failed to retrieve domain status from Vercel',
+  })
+  @ApiResponse({
+    status: HttpStatus.UNAUTHORIZED,
+    description: 'Unauthorized - Invalid or missing authentication',
+  })
+  async getDomainStatus(
+    @Query() dto: GetDomainStatusDto,
+  ): Promise<DomainStatusResponseDto> {
+    return this.trustPortalService.getDomainStatus(dto);
+  }
+}
diff --git a/apps/api/src/trust-portal/trust-portal.module.ts b/apps/api/src/trust-portal/trust-portal.module.ts
new file mode 100644
index 000000000..a5d011f76
--- /dev/null
+++ b/apps/api/src/trust-portal/trust-portal.module.ts
@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { TrustPortalController } from './trust-portal.controller';
+import { TrustPortalService } from './trust-portal.service';
+
+@Module({
+  imports: [AuthModule],
+  controllers: [TrustPortalController],
+  providers: [TrustPortalService],
+  exports: [TrustPortalService],
+})
+export class TrustPortalModule {}
diff --git a/apps/api/src/trust-portal/trust-portal.service.ts b/apps/api/src/trust-portal/trust-portal.service.ts
new file mode 100644
index 000000000..185d7d0f0
--- /dev/null
+++ b/apps/api/src/trust-portal/trust-portal.service.ts
@@ -0,0 +1,117 @@
+import {
+  BadRequestException,
+  Injectable,
+  InternalServerErrorException,
+  Logger,
+} from '@nestjs/common';
+import axios, { AxiosInstance } from 'axios';
+import {
+  DomainStatusResponseDto,
+  DomainVerificationDto,
+  GetDomainStatusDto,
+} from './dto/domain-status.dto';
+
+interface VercelDomainVerification {
+  type: string;
+  domain: string;
+  value: string;
+  reason?: string;
+}
+
+interface VercelDomainResponse {
+  name: string;
+  verified: boolean;
+  verification?: VercelDomainVerification[];
+}
+
+@Injectable()
+export class TrustPortalService {
+  private readonly logger = new Logger(TrustPortalService.name);
+  private readonly vercelApi: AxiosInstance;
+
+  constructor() {
+    const bearerToken = process.env.VERCEL_ACCESS_TOKEN;
+
+    if (!bearerToken) {
+      this.logger.warn('VERCEL_ACCESS_TOKEN is not set');
+    }
+
+    // Initialize axios instance for Vercel API
+    this.vercelApi = axios.create({
+      baseURL: 'https://api.vercel.com',
+      headers: {
+        Authorization: `Bearer ${bearerToken || ''}`,
+        'Content-Type': 'application/json',
+      },
+    });
+  }
+
+  async getDomainStatus(
+    dto: GetDomainStatusDto,
+  ): Promise<DomainStatusResponseDto> {
+    const { domain } = dto;
+
+    if (!process.env.TRUST_PORTAL_PROJECT_ID) {
+      throw new InternalServerErrorException(
+        'TRUST_PORTAL_PROJECT_ID is not configured',
+      );
+    }
+
+    if (!process.env.VERCEL_TEAM_ID) {
+      throw new InternalServerErrorException(
+        'VERCEL_TEAM_ID is not configured',
+      );
+    }
+
+    if (!domain) {
+      throw new BadRequestException('Domain is required');
+    }
+
+    try {
+      this.logger.log(`Fetching domain status for: ${domain}`);
+
+      // Get domain information including verification status
+      // Vercel API endpoint: GET /v9/projects/{projectId}/domains/{domain}
+      const response = await this.vercelApi.get<VercelDomainResponse>(
+        `/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${domain}`,
+        {
+          params: {
+            teamId: process.env.VERCEL_TEAM_ID,
+          },
+        },
+      );
+
+      const domainInfo = response.data;
+
+      const verification: DomainVerificationDto[] | undefined =
+        domainInfo.verification?.map((v) => ({
+          type: v.type,
+          domain: v.domain,
+          value: v.value,
+          reason: v.reason,
+        }));
+
+      return {
+        domain: domainInfo.name,
+        verified: domainInfo.verified ?? false,
+        verification,
+      };
+    } catch (error) {
+      this.logger.error(
+        `Failed to get domain status for ${domain}:`,
+        error instanceof Error ? error.stack : error,
+      );
+
+      // Handle axios errors with more detail
+      if (axios.isAxiosError(error)) {
+        const statusCode = error.response?.status;
+        const message = error.response?.data?.error?.message || error.message;
+        this.logger.error(`Vercel API error (${statusCode}): ${message}`);
+      }
+
+      throw new InternalServerErrorException(
+        'Failed to get domain status from Vercel',
+      );
+    }
+  }
+}
diff --git a/apps/app/src/app/(app)/[orgId]/settings/trust-portal/components/TrustPortalDomain.tsx b/apps/app/src/app/(app)/[orgId]/settings/trust-portal/components/TrustPortalDomain.tsx
index 62495cc81..247fa382a 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/trust-portal/components/TrustPortalDomain.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/trust-portal/components/TrustPortalDomain.tsx
@@ -1,5 +1,6 @@
 'use client';
 
+import { useDomain } from '@/hooks/use-domain';
 import { Button } from '@comp/ui/button';
 import {
   Card,
@@ -13,9 +14,9 @@ import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '
 import { Input } from '@comp/ui/input';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@comp/ui/tooltip';
 import { zodResolver } from '@hookform/resolvers/zod';
-import { AlertCircle, CheckCircle, ClipboardCopy, Loader2 } from 'lucide-react';
+import { AlertCircle, CheckCircle, ClipboardCopy, ExternalLink, Loader2 } from 'lucide-react';
 import { useAction } from 'next-safe-action/hooks';
-import { useEffect, useState } from 'react';
+import { useEffect, useMemo, useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { toast } from 'sonner';
 import { z } from 'zod';
@@ -51,6 +52,17 @@ export function TrustPortalDomain({
   const [isTxtVerified, setIsTxtVerified] = useState(false);
   const [isVercelTxtVerified, setIsVercelTxtVerified] = useState(false);
 
+  const { data: domainStatus } = useDomain(initialDomain);
+
+  const verificationInfo = useMemo(() => {
+    const data = domainStatus?.data;
+    if (data && !data.verified && data.verification && data.verification.length > 0) {
+      return data.verification[0];
+    }
+
+    return null;
+  }, [domainStatus]);
+
   useEffect(() => {
     const isCnameVerified = localStorage.getItem(`${initialDomain}-isCnameVerified`);
     const isTxtVerified = localStorage.getItem(`${initialDomain}-isTxtVerified`);
@@ -215,6 +227,28 @@ export function TrustPortalDomain({
                 initialDomain !== '' &&
                 !domainVerified && (
                   <div className="space-y-2 pt-2">
+                    {verificationInfo && (
+                      <div className="rounded-md border border-amber-200 bg-amber-100 p-4 dark:border-amber-900 dark:bg-amber-950">
+                        <div className="flex gap-3">
+                          <AlertCircle className="h-5 w-5 shrink-0 text-amber-600 dark:text-amber-400" />
+                          <p className="text-amber-100 text-sm dark:text-amber-200">
+                            This domain is linked to another Vercel account. To use it with this
+                            project, add a {verificationInfo.type} record at{' '}
+                            {verificationInfo.domain} to verify ownership. You can remove the record
+                            after verification is complete.
+                            <a
+                              href="https://vercel.com/docs/domains/troubleshooting#misconfigured-domain-issues"
+                              target="_blank"
+                              rel="noopener noreferrer"
+                              className="text-sm text-white underline dark:text-white ml-2"
+                            >
+                              Learn more
+                              <ExternalLink className="ml-1 mb-0.5 inline-block h-4 w-4 font-bold text-white dark:text-white stroke-2" />
+                            </a>
+                          </p>
+                        </div>
+                      </div>
+                    )}
                     <div className="rounded-md border">
                       <div className="text-sm">
                         <table className="hidden w-full lg:table">
diff --git a/apps/app/src/hooks/use-domain.ts b/apps/app/src/hooks/use-domain.ts
new file mode 100644
index 000000000..2a271ca03
--- /dev/null
+++ b/apps/app/src/hooks/use-domain.ts
@@ -0,0 +1,25 @@
+'use client';
+
+import { useApiSWR } from '@/hooks/use-api-swr';
+
+export interface DomainVerification {
+  type: string;
+  domain: string;
+  value: string;
+  reason?: string;
+}
+
+export interface DomainStatusResponse {
+  domain: string;
+  verified: boolean;
+  verification: DomainVerification[];
+}
+
+export function useDomain(domain: string) {
+  const endpoint =
+    domain && domain.trim() !== ''
+      ? `/v1/trust-portal/domain/status?domain=${domain}`
+      : null;
+
+  return useApiSWR<DomainStatusResponse>(endpoint);
+}
diff --git a/packages/docs/openapi.json b/packages/docs/openapi.json
index 1d22037fc..384b8af52 100644
--- a/packages/docs/openapi.json
+++ b/packages/docs/openapi.json
@@ -6855,6 +6855,60 @@
           "Health"
         ]
       }
+    },
+    "/v1/trust-portal/domain/status": {
+      "get": {
+        "description": "Retrieve the verification status and DNS records for a custom domain configured in the Vercel trust portal project",
+        "operationId": "TrustPortalController_getDomainStatus_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "domain",
+            "required": true,
+            "in": "query",
+            "description": "The domain name to check status for",
+            "schema": {
+              "example": "portal.example.com",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Domain status retrieved successfully",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DomainStatusResponseDto"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - Invalid or missing authentication"
+          },
+          "500": {
+            "description": "Failed to retrieve domain status from Vercel"
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Get domain verification status",
+        "tags": [
+          "Trust Portal"
+        ]
+      }
     }
   },
   "info": {
@@ -9045,6 +9099,56 @@
         "required": [
           "content"
         ]
+      },
+      "DomainVerificationDto": {
+        "type": "object",
+        "properties": {
+          "type": {
+            "type": "string",
+            "description": "Verification type (e.g., TXT, CNAME)"
+          },
+          "domain": {
+            "type": "string",
+            "description": "Domain for verification"
+          },
+          "value": {
+            "type": "string",
+            "description": "Verification value"
+          },
+          "reason": {
+            "type": "string",
+            "description": "Reason for verification status"
+          }
+        },
+        "required": [
+          "type",
+          "domain",
+          "value"
+        ]
+      },
+      "DomainStatusResponseDto": {
+        "type": "object",
+        "properties": {
+          "domain": {
+            "type": "string",
+            "description": "The domain name"
+          },
+          "verified": {
+            "type": "boolean",
+            "description": "Whether the domain is verified"
+          },
+          "verification": {
+            "description": "Verification records for the domain",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/DomainVerificationDto"
+            }
+          }
+        },
+        "required": [
+          "domain",
+          "verified"
+        ]
       }
     }
   }

From 5614d620135e86fa2c40862d439a67ebd856d747 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 16 Oct 2025 17:29:33 -0400
Subject: [PATCH 5/6] fix(portal): fixed the issue that the Posthog didn't
 identify people on the portal (#1668)

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 apps/portal/src/app/layout.tsx    |  8 +++++++-
 apps/portal/src/app/providers.tsx | 14 ++++++++++++--
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/apps/portal/src/app/layout.tsx b/apps/portal/src/app/layout.tsx
index a89cd78ab..ec4fc21fe 100644
--- a/apps/portal/src/app/layout.tsx
+++ b/apps/portal/src/app/layout.tsx
@@ -1,10 +1,12 @@
 import { env } from '@/env.mjs';
+import { auth } from '@/app/lib/auth';
 import { initializeServer } from '@comp/analytics/server';
 import { cn } from '@comp/ui/cn';
 import '@comp/ui/globals.css';
 import { GeistMono } from 'geist/font/mono';
 import type { Metadata } from 'next';
 import localFont from 'next/font/local';
+import { headers } from 'next/headers';
 import { NuqsAdapter } from 'nuqs/adapters/next/app';
 import { Suspense } from 'react';
 import { Toaster } from 'sonner';
@@ -81,6 +83,10 @@ if (env.NEXT_PUBLIC_POSTHOG_KEY && env.NEXT_PUBLIC_POSTHOG_HOST) {
 export default async function Layout(props: { children: React.ReactNode }) {
   const { children } = props;
 
+  const session = await auth.api.getSession({
+    headers: await headers(),
+  });
+
   return (
     <html lang="en" suppressHydrationWarning>
       <body
@@ -91,7 +97,7 @@ export default async function Layout(props: { children: React.ReactNode }) {
       >
         <Suspense>
           <NuqsAdapter>
-            <Providers>
+            <Providers session={session}>
               <main>{children}</main>
             </Providers>
           </NuqsAdapter>
diff --git a/apps/portal/src/app/providers.tsx b/apps/portal/src/app/providers.tsx
index 7801bc813..f29097e6c 100644
--- a/apps/portal/src/app/providers.tsx
+++ b/apps/portal/src/app/providers.tsx
@@ -1,17 +1,27 @@
 'use client';
 
 import { AnalyticsProvider } from '@comp/analytics';
+import { Session, User } from 'better-auth';
 import { ThemeProvider } from 'next-themes';
 import type { ReactNode } from 'react';
 
 type ProviderProps = {
   children: ReactNode;
+  session: {
+    session: Session | null;
+    user: User | null;
+  } | null;
 };
 
-export function Providers({ children }: ProviderProps) {
+export function Providers({ children, session }: ProviderProps) {
   return (
     <ThemeProvider attribute="class" defaultTheme="system" enableSystem disableTransitionOnChange>
-      <AnalyticsProvider>{children}</AnalyticsProvider>
+      <AnalyticsProvider
+        userId={session?.user?.id ?? undefined}
+        userEmail={session?.user?.email ?? undefined}
+      >
+        {children}
+      </AnalyticsProvider>
     </ThemeProvider>
   );
 }

From 80e63b8a420a8ba0d1973e82f0b838031ded2b7c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 17 Oct 2025 11:18:02 -0400
Subject: [PATCH 6/6] Update Trigger GitHub workflows to install email package
 (#1669)

* fix(app): add resend as a dependency to packages.email

* build(trigger): update trigger deployment workflows to install email package

---------

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
---
 .github/workflows/trigger-tasks-deploy-main.yml    | 3 +++
 .github/workflows/trigger-tasks-deploy-release.yml | 3 +++
 packages/email/package.json                        | 1 +
 3 files changed, 7 insertions(+)

diff --git a/.github/workflows/trigger-tasks-deploy-main.yml b/.github/workflows/trigger-tasks-deploy-main.yml
index a2d57deb8..bbd03d59d 100644
--- a/.github/workflows/trigger-tasks-deploy-main.yml
+++ b/.github/workflows/trigger-tasks-deploy-main.yml
@@ -21,6 +21,9 @@ jobs:
       - name: Install DB package dependencies
         working-directory: ./packages/db
         run: bun install --frozen-lockfile --ignore-scripts
+      - name: Install Email package dependencies
+        working-directory: ./packages/email
+        run: bun install --frozen-lockfile --ignore-scripts
       - name: Generate Prisma client
         working-directory: ./packages/db
         run: bunx prisma generate
diff --git a/.github/workflows/trigger-tasks-deploy-release.yml b/.github/workflows/trigger-tasks-deploy-release.yml
index ee792b1b2..b5b5f158c 100644
--- a/.github/workflows/trigger-tasks-deploy-release.yml
+++ b/.github/workflows/trigger-tasks-deploy-release.yml
@@ -24,6 +24,9 @@ jobs:
       - name: Install DB package dependencies
         working-directory: ./packages/db
         run: bun install --frozen-lockfile --ignore-scripts
+      - name: Install Email package dependencies
+        working-directory: ./packages/email
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Generate Prisma client
         working-directory: ./packages/db
diff --git a/packages/email/package.json b/packages/email/package.json
index f3a172fd6..5573fa682 100644
--- a/packages/email/package.json
+++ b/packages/email/package.json
@@ -11,6 +11,7 @@
     "date-fns": "^4.1.0",
     "next": "^15.4.6",
     "react-email": "^4.0.15",
+    "resend": "^4.4.1",
     "responsive-react-email": "^0.0.5"
   },
   "devDependencies": {