apps/backend/src/lib/email-rendering.tsx (1)

203-203: Make the boolean argument self‑explanatory.
Positional !previewMode is a bit opaque; a named constant improves readability.

♻️ Suggested tweak

-  return await bundleAndExecute<EmailRenderResult>(files, !previewMode);
+  const shouldCaptureErrors = !previewMode;
+  return await bundleAndExecute<EmailRenderResult>(files, shouldCaptureErrors);

apps/e2e/tests/backend/endpoints/api/v1/internal/email-templates.test.ts (1)

92-127: Consider using .toMatchInlineSnapshot() for the full response for consistency.

Per coding guidelines, .toMatchInlineSnapshot() is preferred. The first test (lines 33-45) uses a full response snapshot, but this test separates assertions. If the error message format is stable enough, consider consolidating:

expect(updateResponse).toMatchInlineSnapshot(`
  NiceResponse {
    "status": 400,
    "body": {
      "code": "EMAIL_RENDERING_ERROR",
      "error": "...",  // with actual error
    },
    ...
  }
`);

However, if the exact error message varies by environment (similar to the comment at line 163), the current approach with .toContain() is reasonable. Based on learnings: "Prefer .toMatchInlineSnapshot over other selectors when writing tests."

apps/backend/src/lib/js-execution.tsx (2)

142-142: Use strict equality comparison.

Line 142 uses loose equality (!=) instead of strict equality (!==).

🔧 Suggested fix

-    if (getEnvVariable("STACK_VERCEL_SANDBOX_TOKEN","") != "") {
+    if (getEnvVariable("STACK_VERCEL_SANDBOX_TOKEN","") !== "") {

---

212-214: Consider using defensive coding pattern for Map access.

The non-null assertions on engineMap.get() work because the keys are hardcoded and the map is initialized at module scope. However, per coding guidelines, prefer ?? throwErr(...) for defensive coding.

🛡️ Optional: Defensive access pattern

 async function runWithFallback(code: string, options: ExecuteJavascriptOptions): Promise<ExecuteResult> {
-  const freestyleEngine = engineMap.get("freestyle")!;
-  const vercelSandboxEngine = engineMap.get("vercel-sandbox")!;
+  const freestyleEngine = engineMap.get("freestyle") ?? throwErr("freestyle engine not found in engineMap");
+  const vercelSandboxEngine = engineMap.get("vercel-sandbox") ?? throwErr("vercel-sandbox engine not found in engineMap");

Apply similar change at line 252 for runWithoutFallback.

Based on learnings: "Code defensively. Prefer ?? throwErr(...) over non-null assertions with good error messages"

apps/e2e/tests/backend/endpoints/api/v1/internal/email-drafts.test.ts (1)

406-448: Unused draftId variable in test.

The test creates a draft and stores its ID in draftId (line 427), but then the render call at line 430 uses template_tsx_source directly instead of referencing the draft. Either:

1. The draft creation is unnecessary and can be removed, or
2. The render call should use the draft ID via a different endpoint/parameter.

This doesn't affect test correctness since the inline source matches, but the draft creation appears to serve no purpose.

♻️ Option 1: Remove unused draft creation

 it("should reject draft that throws an error when rendered", async ({ expect }) => {
   await Project.createAndSwitch({
     display_name: "Email Drafts Invalid JSX Project",
     config: { email_config: customEmailConfig },
   });

-  const createRes = await niceBackendFetch("/api/v1/internal/email-drafts", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      display_name: "Throwing Draft",
-      theme_id: false,
-      tsx_source: `
-        import { Subject, NotificationCategory } from "@stackframe/emails";
-        export function EmailTemplate() {
-          throw new Error('Intentional error from draft');
-        }
-      `,
-    },
-  });
-  expect(createRes.status).toBe(200);
-  const draftId = createRes.body.id as string;
-
   // Attempt to render the draft
   const renderRes = await niceBackendFetch("/api/v1/emails/render-email", {

docker/dependencies/freestyle-mock/Dockerfile (2)

1-1: Verify Node base image support (optionally pin digest).
Line 1 switches to node:22-slim; please confirm it aligns with your supported runtime and security patch cadence. Optional: pin the digest for reproducible builds.

---

7-36: Avoid dependency version drift between /app/package.json and preinstalledNodeModules.
Lines 7-36 duplicate versions in two places; if they diverge, needsInstall can be wrong. Consider deriving the map from /app/package.json at startup.

♻️ Suggested refactor to derive preinstalled deps from /app/package.json

-import { mkdir, writeFile, rm } from "fs/promises";
+import { mkdir, writeFile, rm, readFile } from "fs/promises";
@@
-const preinstalledNodeModules = new Map([
-  ["arktype", "2.1.20"],
-  ["react-dom", "19.1.1"],
-  ["react", "19.1.1"],
-  ["@react-email/components", "1.0.6"],
-]);
+const preinstalledNodeModules = new Map(
+  Object.entries(
+    JSON.parse(await readFile("/app/package.json", "utf8")).dependencies ?? {}
+  )
+);