Currently direct templates can be created without the required
signatures fields for signers.
This means that the document can be fully signed by everyone but will
ultimately fail the sealing step which leaves the document in an
unrecoverable state.
Programmatically record an external rejection on behalf of a recipient
who declined outside the platform. Flags the rejection as external in
the audit log, optionally attributes it to a specific team member via
actAsEmail, and enforces team membership and document visibility.
Adds a CANCELLED envelope status that privileged members (owner or team
admin/manager) can move a pending document into. Sending recipient
notifications via a background job while retaining the document in the
dashboard as proof of distribution.
Includes a dedicated Cancelled tab, single and bulk cancel actions,
the ENVELOPE_CANCELLED mutability guard, and e2e coverage for
permissions
and visibility.
Per-product direction: AcroForm widget to Documenso field creation
should not happen automatically on upload. It must be a deliberate,
opt-in action on a draft envelope.
- Revert AcroForm extraction from create-envelope (route) and
create-envelope-items upload paths. They no longer thread
acroFormFields into envelope items or run the extractor.
- Stop flattening on upload (flattenForm: false) so widgets survive
in the stored PDF until the user opts in.
- New tRPC mutation envelope.field.importFromPdf is the single entry
point. It loads each item's stored PDF, extracts widgets, creates
Field rows assigned to the first signable recipient (creating a
placeholder Recipient 1 SIGNER when none exist), flattens the PDF
in place, swaps documentDataId, and emits FIELD_CREATED audit log
entries on DOCUMENT envelopes.
- Editor fields panel gains an "Import from PDF form" button next to
"Detect with AI", gated to DRAFT envelopes. Success toasts the
count and revalidates the editor.
- Rewrite acroform-import.spec.ts e2e to the new flow: upload
preserves widgets and creates zero fields; service call creates
fields, flattens PDF, audits, and cleans up old DocumentData.
- Invert four DOCUMENT-upload assertions in form-flattening.spec.ts
to match the new preserve-widgets, no-auto-flatten contract.
Template and template-to-doc flatten behavior is unchanged.
Detect AcroForm widgets (text, checkbox, radio, dropdown, signature) at upload
time and reuse their geometry as Documenso fields instead of stripping them via
form.flatten(). Imported fields land in the editor as ordinary Field rows
assigned to the first signable recipient, removing the manual re-placement step
users hit when preparing PDFs in Adobe Acrobat.
Extraction runs before normalizePdf so widget geometry is still readable.
Text fields go through a name+format heuristic that maps DATE/NUMBER/EMAIL/
NAME/INITIALS/TEXT, with AcroForm /AA format actions taking precedence over
name tokens. Coordinates are converted via per-rotation transforms (0/90/180/
270) against the rendered page dimensions; widgets fully off-page are
dropped, partial overlap is clamped. Signed signatures (SignatureField.
isSigned()) are detected and skip both the import and the form flatten so
the signature stays valid. Encrypted PDFs, XFA hybrids, malformed PDFs, and
internal extractor errors all return an empty result with skipReason set so
the upload proceeds untouched.
Every imported field carries fieldMeta.source = 'acroform' (new optional on
ZBaseFieldMeta) for future provenance queries. DOCUMENT envelopes emit a
per-field FIELD_CREATED audit entry matching create-envelope-fields.ts.
Recipient assignment picks the first Recipient with role SIGNER or APPROVER
sorted by (signingOrder asc nulls last, id asc); when no signable recipient
exists, a placeholder Recipient 1 SIGNER is created mirroring the
placeholder-pipeline behaviour.
Platform-plan organisations and teams can now customise non-embed
signing pages with six brand colour tokens, a border-radius, and
a free-text custom CSS block (up to 256 KB).
- Stored on OrganisationGlobalSettings / TeamGlobalSettings;
teams inherit from the org via brandingEnabled === null.
- CSS is sanitised on save (PostCSS) so we can inline it at SSR
with no per-render parsing.
- Rendered via a nonce'd <style> scoped under .documenso-branded,
using native CSS nesting so user selectors don't need scoping.
- Gated on the existing embedSigningWhiteLabel claim (or
self-hosted) — reuses the embed white-label decision.
Ephraim Duncan
David Nguyen
Lucas Smith
Catalin Pit
ephraimduncan
ザヘド