feat(trust-portal): dedicated FROM env var for Trust Portal emails

[claudfuen]

Summary

• Adds a dedicated RESEND_FROM_TRUST_PORTAL env var so Trust Portal access and NDA emails can send from a brand-specific sender (e.g. Comp AI <noreply@mail.trust.inc>), distinct from the generic system sender.
• triggerEmail() gets a new trustPortal: true flag that resolves RESEND_FROM_TRUST_PORTAL, with graceful fallback to RESEND_FROM_SYSTEM so prod keeps working until the env var is set in Trigger.dev / Render.
• TrustEmailService (NDA signing, access granted, access reclaim, access request notification) now passes trustPortal: true instead of system: true.

Files

• apps/api/src/email/trigger-email.ts — adds optional flag + env resolution
• apps/api/src/trust-portal/email.service.ts — 4 callers switch to trustPortal: true
• apps/api/.env.example + root .env.example — documents the new var

Deploy steps (after merge)

Set RESEND_FROM_TRUST_PORTAL in:

1. Trigger.dev project proj_zhioyrusqertqgafqgpj env (this is where the email actually sends from)
2. Render (API host) env so the value matches when enqueueing
3. Local apps/api/.env if testing locally

Value being used: Comp AI <noreply@mail.trust.inc>

Pre-reqs in Resend:

• mail.trust.inc domain verified (SPF, DKIM, DMARC green)
• API key authorized to send from that domain

If the env var isn't set, code falls back to RESEND_FROM_SYSTEM — safe to merge before the env is configured.

Test plan

• Typecheck passes (npx turbo run typecheck --filter=@trycompai/api) — verified locally; pre-existing errors in unrelated modules only
• After deploy + env set, trigger an NDA signing email and confirm the From: header is Comp AI <noreply@mail.trust.inc>
• Trigger an access-granted, access-reclaim, and access-request-notification email and confirm same sender
• Verify other system emails (invites, finding notifications, etc.) still send from RESEND_FROM_SYSTEM

🤖 Generated with Claude Code

---

Summary by cubic

Adds a dedicated RESEND_FROM_TRUST_PORTAL sender for Trust Portal emails (NDA, access flows) so they send from a brand-specific address (e.g., Comp AI <noreply@mail.trust.inc>). Falls back to RESEND_FROM_SYSTEM if not set.

• New Features

  • New RESEND_FROM_TRUST_PORTAL env var, with fallback to RESEND_FROM_SYSTEM.
  • triggerEmail() supports trustPortal: true to resolve the new sender.
  • TrustEmailService now passes trustPortal: true for NDA and access emails.

• Migration

  • Set RESEND_FROM_TRUST_PORTAL in Trigger.dev and Render (and local .env if testing).
  • Ensure the Resend domain is verified and the API key can send from it.
  • No breaking changes; emails use RESEND_FROM_SYSTEM until configured.

^{Written for commit 7ea0521. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Building	Preview, Comment	May 14, 2026 11:28pm
comp-framework-editor	Ready	Preview, Comment	May 14, 2026 11:28pm
portal	Building	Preview, Comment	May 14, 2026 11:28pm

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

[claudfuen]

🎉 This PR is included in version 3.55.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀