chore: extract translations

.agents/skills/create-justification/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: create-justification
+description: Create a new justification file in .agents/justifications/ with a unique three-word ID, frontmatter, and formatted title
+license: MIT
+compatibility: opencode
+metadata:
+  audience: agents
+  workflow: decision-making
+---
+
+## What I do
+
+I help you create new justification files in the `.agents/justifications/` directory. Each justification file gets:
+
+- A unique three-word identifier (e.g., `swift-emerald-river`)
+- Frontmatter with the current date and formatted title
+- Content you provide
+
+## How to use
+
+Run the script with a slug and content:
+
+```bash
+npx tsx scripts/create-justification.ts "decision-name" "Justification content here"
+```
+
+Or use heredoc for multi-line content:
+
+```bash
+npx tsx scripts/create-justification.ts "decision-name" << HEREDOC
+Multi-line
+justification content
+goes here
+HEREDOC
+```
+
+## File format
+
+Files are created as: `{three-word-id}-{slug}.md`
+
+Example: `swift-emerald-river-decision-name.md`
+
+The file includes frontmatter:
+
+```markdown
+---
+date: 2026-01-13
+title: Decision Name
+---
+
+Your content here
+```
+
+## When to use me
+
+Use this skill when you need to document the reasoning or justification for a decision, approach, or architectural choice. The unique ID ensures no filename conflicts, and the frontmatter provides metadata for organization.

.agents/skills/create-plan/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: create-plan
+description: Create a new plan file in .agents/plans/ with a unique three-word ID, frontmatter, and formatted title
+license: MIT
+compatibility: opencode
+metadata:
+  audience: agents
+  workflow: planning
+---
+
+## What I do
+
+I help you create new plan files in the `.agents/plans/` directory. Each plan file gets:
+
+- A unique three-word identifier (e.g., `happy-blue-moon`)
+- Frontmatter with the current date and formatted title
+- Content you provide
+
+## How to use
+
+Run the script with a slug and content:
+
+```bash
+npx tsx scripts/create-plan.ts "feature-name" "Plan content here"
+```
+
+Or use heredoc for multi-line content:
+
+```bash
+npx tsx scripts/create-plan.ts "feature-name" << HEREDOC
+Multi-line
+plan content
+goes here
+HEREDOC
+```
+
+## File format
+
+Files are created as: `{three-word-id}-{slug}.md`
+
+Example: `happy-blue-moon-feature-name.md`
+
+The file includes frontmatter:
+
+```markdown
+---
+date: 2026-01-13
+title: Feature Name
+---
+
+Your content here
+```
+
+## When to use me
+
+Use this skill when you need to create a new plan document for a feature, task, or project. The unique ID ensures no filename conflicts, and the frontmatter provides metadata for organization.

.agents/skills/create-scratch/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: create-scratch
+description: Create a new scratch file in .agents/scratches/ with a unique three-word ID, frontmatter, and formatted title
+license: MIT
+compatibility: opencode
+metadata:
+  audience: agents
+  workflow: exploration
+---
+
+## What I do
+
+I help you create new scratch files in the `.agents/scratches/` directory. Each scratch file gets:
+
+- A unique three-word identifier (e.g., `calm-teal-cloud`)
+- Frontmatter with the current date and formatted title
+- Content you provide
+
+## How to use
+
+Run the script with a slug and content:
+
+```bash
+npx tsx scripts/create-scratch.ts "note-name" "Scratch content here"
+```
+
+Or use heredoc for multi-line content:
+
+```bash
+npx tsx scripts/create-scratch.ts "note-name" << HEREDOC
+Multi-line
+scratch content
+goes here
+HEREDOC
+```
+
+## File format
+
+Files are created as: `{three-word-id}-{slug}.md`
+
+Example: `calm-teal-cloud-note-name.md`
+
+The file includes frontmatter:
+
+```markdown
+---
+date: 2026-01-13
+title: Note Name
+---
+
+Your content here
+```
+
+## When to use me
+
+Use this skill when you need to create a temporary note, exploration document, or scratch pad for ideas. The unique ID ensures no filename conflicts, and the frontmatter provides metadata for organization.

.github/ISSUE_TEMPLATE/deploy-provider-request.yml

@@ -1,61 +0,0 @@
-name: 'One-Click Deploy Provider Request'
-description: Request a new one-click deployment provider (Railway, Render, etc.) to be added to our README
-title: 'One-Click Deploy Provider Request: [Provider Name]'
-labels: ['deploy-provider-request']
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for your interest in adding a one-click deploy option for Documenso!
-
-        Each provider we list requires us to create, test, and maintain a deployment template, which is ongoing work on top of everything else. To keep this manageable, we ask that providers (or users) **open an issue instead of a PR** so the community can signal interest.
-
-        **How this works:**
-
-        - 👍 this issue if you'd like to see Documenso deployable on this provider.
-        - If community interest is high enough, we'll consider adding it to the README.
-        - Opening an issue is not a guarantee of inclusion. PRs adding badges without a prior issue and demonstrated interest will be closed.
-  - type: input
-    attributes:
-      label: Provider Name
-      placeholder: e.g. Railway
-    validations:
-      required: true
-  - type: input
-    attributes:
-      label: Provider Website
-      placeholder: e.g. https://railway.com
-    validations:
-      required: true
-  - type: input
-    attributes:
-      label: Deploy/Template URL
-      description: A link to an existing deployment template or deploy button URL, if one exists.
-  - type: dropdown
-    attributes:
-      label: Who creates and maintains the deployment template?
-      options:
-        - The provider
-        - Me / the community
-        - Nobody yet
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Testing & Maintenance
-      description: Has the template been tested against the current Documenso release? How are updates handled when Documenso ships breaking changes (env vars, migrations, Docker changes)?
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Why this provider?
-      description: Tell us why Documenso users would benefit — existing user base, region coverage, free tier, etc.
-    validations:
-      required: true
-  - type: checkboxes
-    attributes:
-      label: Please check the boxes that apply to this request.
-      options:
-        - label: I have searched existing issues to make sure this provider has not already been requested.
-        - label: I understand that inclusion depends on community interest and is not guaranteed.
-        - label: I understand that PRs adding deploy badges without a prior issue will be closed.

.github/actions/node-install/action.yml

@@ -2,7 +2,7 @@ name: 'Setup node'
 inputs:
   node_version:
     required: false
-    default: v24.x
+    default: v22.x
 
 runs:
   using: 'composite'

.github/workflows/ci.yml

@@ -15,7 +15,6 @@ jobs:
   build_app:
     name: Build App
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -30,30 +29,9 @@ jobs:
       - name: Build app
         run: npm run build
 
-  unit_tests:
-    name: Unit Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - uses: ./.github/actions/node-install
-
-      - name: Copy env
-        run: cp .env.example .env
-
-      # Includes the 2FA enforcement drift guard (packages/trpc), which is the
-      # only check that catches a session route without enforcement middleware.
-      - name: Run unit tests
-        run: npm run test -w @documenso/lib -w @documenso/trpc
-
   build_docker:
     name: Build Docker Image
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/codeql-analysis.yml

@@ -11,7 +11,6 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     permissions:
       actions: read
       contents: read

.github/workflows/deploy.yml

@@ -8,7 +8,6 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    timeout-minutes: 60
 
     steps:
       - name: Checkout code

.github/workflows/issue-labeler.yml

@@ -7,7 +7,6 @@ on:
 jobs:
   label-when-assigned:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - name: Label issue
         uses: actions/github-script@v6

.github/workflows/issue-opened.yml

@@ -7,7 +7,6 @@ on:
 jobs:
   label_issues:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     permissions:
       issues: write
     steps:

.github/workflows/pr-labeler.yml

@@ -13,7 +13,6 @@ jobs:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - uses: actions/labeler@v4
         with:

.github/workflows/publish.yml

@@ -14,7 +14,6 @@ jobs:
   build_and_publish_platform_containers:
     name: Build and publish platform containers
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
@@ -79,7 +78,6 @@ jobs:
   create_and_publish_manifest:
     name: Create and publish manifest
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     needs: build_and_publish_platform_containers
     steps:
       - name: Checkout

.github/workflows/semantic-pull-requests.yml

@@ -15,7 +15,6 @@ jobs:
   validate-pr:
     name: Validate PR title
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         id: lint_pr_title

.github/workflows/stale.yml

@@ -7,7 +7,6 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     permissions:
       issues: write
       pull-requests: write

.github/workflows/translations-force-pull.yml

@@ -18,7 +18,6 @@ jobs:
   pull_translations:
     name: Force pull translations
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     environment: Translations
     permissions:
       contents: write

.github/workflows/translations-pull.yml

@@ -16,7 +16,6 @@ jobs:
   pull_translations:
     name: Pull translations
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     environment: Translations
     permissions:
       contents: write

.github/workflows/translations-upload.yml

@@ -14,7 +14,6 @@ jobs:
   extract_translations:
     name: Extract and upload translations
     runs-on: ubuntu-latest
-    timeout-minutes: 30
     environment: Translations
     permissions:
       contents: write

.npmrc

@@ -1,3 +1,3 @@
 legacy-peer-deps = true
 prefer-dedupe = true
-min-release-age = 7
+# min-release-age = 7

README.md

@@ -107,7 +107,7 @@ Contact us if you are interested in our Enterprise plan for large organizations
 
 To run Documenso locally, you will need
 
-- Node.js (v24 or above)
+- Node.js (v22 or above)
 - Postgres SQL Database
 - Docker (optional)
 
@@ -186,37 +186,21 @@ For full instructions, requirements, and configuration details, see the [Self Ho
 
 ### One-Click Deploys
 
-> [!NOTE]
-> Want to see another provider listed here? Please [open a provider request](https://github.com/documenso/documenso/issues/new?template=deploy-provider-request.yml) instead of a PR so the community can signal interest. PRs adding deploy badges without a prior issue will be closed.
+#### Railway
 
-<table>
-  <tr>
-    <td align="center" width="200">
-      <a href="https://railway.com/deploy/DjrRRX?referralCode=EZR3s0&utm_medium=integration&utm_source=template&utm_campaign=generic">
-        <img src="https://railway.com/button.svg" alt="Deploy on Railway" height="40" />
-      </a>
-    </td>
-    <td align="center" width="200">
-      <a href="https://render.com/deploy?repo=https://github.com/documenso/documenso">
-        <img src="https://render.com/images/deploy-to-render-button.svg" alt="Deploy to Render" height="40" />
-      </a>
-    </td>
-    <td align="center" width="200">
-      <a href="https://app.koyeb.com/deploy?type=git&repository=github.com/documenso/documenso&branch=main&name=documenso-app&builder=dockerfile&dockerfile=/docker/Dockerfile">
-        <img src="https://www.koyeb.com/static/images/deploy/button.svg" alt="Deploy to Koyeb" height="40" />
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center" width="200">
-      <a href="https://elest.io/open-source/documenso">
-        <img src="https://elest.io/images/logos/deploy-to-elestio-btn.png" alt="Deploy on Elestio" height="40" />
-      </a>
-    </td>
-    <td align="center" width="200"></td>
-    <td align="center" width="200"></td>
-  </tr>
-</table>
+[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/deploy/DjrRRX?referralCode=EZR3s0&utm_medium=integration&utm_source=template&utm_campaign=generic)
+
+#### Render
+
+[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/documenso/documenso)
+
+#### Koyeb
+
+[![Deploy to Koyeb](https://www.koyeb.com/static/images/deploy/button.svg)](https://app.koyeb.com/deploy?type=git&repository=github.com/documenso/documenso&branch=main&name=documenso-app&builder=dockerfile&dockerfile=/docker/Dockerfile)
+
+#### Elestio
+
+[![Deploy on Elestio](https://elest.io/images/logos/deploy-to-elestio-btn.png)](https://elest.io/open-source/documenso)
 
 ## Security
 

apps/docs/content/docs/developers/api/documents.mdx

@@ -28,62 +28,35 @@ Each document contains one or more PDF files, a list of recipients, and the fiel
 
 A document object contains the following properties:
 
-| Property            | Type           | Description                                                                                  |
-| ------------------- | -------------- | -------------------------------------------------------------------------------------------- |
-| `id`                | string         | Unique identifier (e.g., `envelope_abc123`)                                                  |
-| `secondaryId`       | string         | Legacy identifier in prefixed form (`document_123` for documents, `template_123` for templates) |
-| `internalVersion`   | number         | Internal envelope schema version                                                             |
-| `type`              | string         | `DOCUMENT` or `TEMPLATE`                                                                     |
-| `status`            | string         | Current status: `DRAFT`, `PENDING`, `COMPLETED`, `REJECTED`, or `CANCELLED`                  |
-| `title`             | string         | Document title                                                                               |
-| `source`            | string         | How the document was created: `DOCUMENT`, `TEMPLATE`, `TEMPLATE_DIRECT_LINK`                 |
-| `visibility`        | string         | Who can view: `EVERYONE`, `ADMIN`, `MANAGER_AND_ABOVE`                                       |
-| `templateType`      | string         | Template visibility: `PUBLIC`, `PRIVATE`, or `ORGANISATION` (only meaningful for templates)  |
-| `externalId`        | string \| null | Your custom identifier for the document                                                      |
-| `userId`            | number         | ID of the user who owns the document                                                         |
-| `teamId`            | number         | ID of the team the document belongs to                                                       |
-| `folderId`          | string \| null | ID of the folder containing the document                                                     |
-| `templateId`        | number \| null | Legacy ID of the template this document was created from                                     |
-| `authOptions`       | object \| null | Access and action authentication requirements                                                |
-| `formValues`        | object \| null | Pre-filled form values                                                                       |
-| `publicTitle`       | string         | Public title shown on profile and direct-link pages                                          |
-| `publicDescription` | string         | Public description shown on profile and direct-link pages                                    |
-| `createdAt`         | string         | ISO 8601 timestamp                                                                           |
-| `updatedAt`         | string         | ISO 8601 timestamp                                                                           |
-| `completedAt`       | string \| null | Timestamp when all recipients completed signing                                              |
-| `deletedAt`         | string \| null | Timestamp if soft-deleted                                                                    |
-| `recipients`        | array          | List of recipients and their signing status                                                  |
-| `fields`            | array          | Signature and form fields on the document                                                    |
-| `envelopeItems`     | array          | PDF files attached to the document                                                           |
-| `directLink`        | object \| null | Direct-link signing configuration (`id`, `token`, `enabled`, `directTemplateRecipientId`)    |
-| `team`              | object         | Owning team (`id`, `url`)                                                                    |
-| `user`              | object         | Document owner (`id`, `name`, `email`)                                                       |
-| `documentMeta`      | object         | Email settings, redirect URL, signing options                                                |
-
-Documents created through the API have `source: "DOCUMENT"` — there is no separate `API` source value. To tag documents created by your integration, set `externalId` when creating them.
+| Property        | Type           | Description                                                    |
+| --------------- | -------------- | -------------------------------------------------------------- |
+| `id`            | string         | Unique identifier (e.g., `envelope_abc123`)                    |
+| `type`          | string         | `DOCUMENT` or `TEMPLATE`                                       |
+| `status`        | string         | Current status: `DRAFT`, `PENDING`, `COMPLETED`, or `REJECTED` |
+| `title`         | string         | Document title                                                 |
+| `source`        | string         | How the document was created: `DOCUMENT`, `TEMPLATE`, `API`    |
+| `visibility`    | string         | Who can view: `EVERYONE`, `ADMIN`, `MANAGER_AND_ABOVE`         |
+| `externalId`    | string \| null | Your custom identifier for the document                        |
+| `createdAt`     | string         | ISO 8601 timestamp                                             |
+| `updatedAt`     | string         | ISO 8601 timestamp                                             |
+| `completedAt`   | string \| null | Timestamp when all recipients completed signing                |
+| `deletedAt`     | string \| null | Timestamp if soft-deleted                                      |
+| `recipients`    | array          | List of recipients and their signing status                    |
+| `fields`        | array          | Signature and form fields on the document                      |
+| `envelopeItems` | array          | PDF files attached to the document                             |
+| `documentMeta`  | object         | Email settings, redirect URL, signing options                  |
 
 ### Example Document Object
 
 ```json
 {
   "id": "envelope_abc123xyz",
-  "secondaryId": "document_123",
-  "internalVersion": 2,
   "type": "DOCUMENT",
   "status": "PENDING",
-  "source": "DOCUMENT",
+  "source": "API",
   "visibility": "EVERYONE",
-  "templateType": "PRIVATE",
   "title": "Service Agreement",
   "externalId": "contract-2025-001",
-  "userId": 1,
-  "teamId": 1,
-  "folderId": null,
-  "templateId": null,
-  "authOptions": null,
-  "formValues": null,
-  "publicTitle": "",
-  "publicDescription": "",
   "createdAt": "2025-01-15T10:30:00.000Z",
   "updatedAt": "2025-01-15T10:35:00.000Z",
   "completedAt": null,
@@ -100,41 +73,23 @@ Documents created through the API have `source: "DOCUMENT"` — there is no sepa
   ],
   "fields": [
     {
-      "id": 123,
-      "secondaryId": "field_abc123",
+      "id": "field_123",
       "type": "SIGNATURE",
-      "recipientId": 1,
-      "envelopeId": "envelope_abc123xyz",
-      "envelopeItemId": "envelope_item_xyz",
       "page": 1,
-      "positionX": "10",
-      "positionY": "80",
-      "width": "30",
-      "height": "5",
-      "customText": "",
-      "inserted": false,
-      "fieldMeta": null
+      "positionX": 10,
+      "positionY": 80,
+      "width": 30,
+      "height": 5,
+      "recipientId": 1
     }
   ],
   "envelopeItems": [
     {
       "id": "envelope_item_xyz",
-      "envelopeId": "envelope_abc123xyz",
-      "documentDataId": "doc_data_abc123",
       "title": "contract.pdf",
       "order": 1
     }
   ],
-  "directLink": null,
-  "team": {
-    "id": 1,
-    "url": "your-team"
-  },
-  "user": {
-    "id": 1,
-    "name": "Jane Smith",
-    "email": "jane@example.com"
-  },
   "documentMeta": {
     "subject": "Please sign this document",
     "message": "Hi, please review and sign this agreement.",
@@ -144,8 +99,6 @@ Documents created through the API have `source: "DOCUMENT"` — there is no sepa
 }
 ```
 
-Field position and size values are stored as decimals and serialized as strings in API responses.
-
 ## List Documents
 
 Retrieve a paginated list of documents.
@@ -161,7 +114,7 @@ GET /envelope
 | `page`             | integer | Page number (default: 1)                                      |
 | `perPage`          | integer | Results per page (default: 10, max: 100)                      |
 | `type`             | string  | Filter by `DOCUMENT` or `TEMPLATE`                            |
-| `status`           | string  | Filter by status: `DRAFT`, `PENDING`, `COMPLETED`, `REJECTED`, `CANCELLED` |
+| `status`           | string  | Filter by status: `DRAFT`, `PENDING`, `COMPLETED`, `REJECTED` |
 | `source`           | string  | Filter by creation source                                     |
 | `folderId`         | string  | Filter by folder ID                                           |
 | `orderByColumn`    | string  | Sort field (only `createdAt` supported)                       |
@@ -201,8 +154,8 @@ const response = await fetch(`${BASE_URL}/envelope`, {
   },
 });
 
-const { data, count } = await response.json();
-console.log(`Found ${count} documents`);
+const { data, pagination } = await response.json();
+console.log(`Found ${pagination.totalItems} documents`);
 
 // Filter by status
 const pendingResponse = await fetch(
@@ -244,10 +197,12 @@ const pendingDocs = await pendingResponse.json();
       ]
     }
   ],
-  "count": 42,
-  "currentPage": 1,
-  "perPage": 10,
-  "totalPages": 5
+  "pagination": {
+    "page": 1,
+    "perPage": 10,
+    "totalPages": 5,
+    "totalItems": 42
+  }
 }
 ```
 
@@ -673,72 +628,6 @@ The response includes signing URLs for each recipient:
 
 ---
 
-## Cancel Document
-
-Cancel a pending document. This changes its status from `PENDING` to `CANCELLED`.
-
-```
-POST /envelope/cancel
-```
-
-### Request Body
-
-| Field        | Type   | Required | Description                         |
-| ------------ | ------ | -------- | ----------------------------------- |
-| `envelopeId` | string | Yes      | Document ID                         |
-| `reason`     | string | No       | Reason for cancelling the document |
-
-### Code Examples
-
-<Tabs items={['curl', 'TypeScript']}>
-<Tab value="curl">
-```bash
-curl -X POST "https://app.documenso.com/api/v2/envelope/cancel" \
-  -H "Authorization: api_xxxxxxxxxxxxxxxx" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "envelopeId": "envelope_abc123",
-    "reason": "The agreement is no longer needed."
-  }'
-```
-</Tab>
-<Tab value="TypeScript">
-```typescript
-const response = await fetch('https://app.documenso.com/api/v2/envelope/cancel', {
-  method: 'POST',
-  headers: {
-    Authorization: 'api_xxxxxxxxxxxxxxxx',
-    'Content-Type': 'application/json',
-  },
-  body: JSON.stringify({
-    envelopeId: 'envelope_abc123',
-    reason: 'The agreement is no longer needed.',
-  }),
-});
-
-const { success } = await response.json();
-```
-</Tab>
-</Tabs>
-
-### Response
-
-```json
-{
-  "success": true
-}
-```
-
-### Behavior
-
-- Only documents in `PENDING` status can be cancelled. Other statuses return `400`.
-- Cancellation is not idempotent. Cancelling the same document again returns `400`.
-- The document owner and team members with `MANAGER` or higher permissions can cancel it. Requests for documents you cannot view return `404`; requests for visible documents without sufficient permissions return `401`.
-- A successful cancellation fires the `DOCUMENT_CANCELLED` webhook.
-- Cancellation emails are sent only to eligible non-CC, non-rejected recipients who were sent or opened the document.
-
----
-
 ## Delete Document
 
 Delete a document. Completed documents cannot be deleted.
@@ -781,7 +670,7 @@ const response = await fetch('https://app.documenso.com/api/v2/envelope/delete',
 
 const { success } = await response.json();
 
-```
+````
 </Tab>
 </Tabs>
 
@@ -791,7 +680,7 @@ const { success } = await response.json();
 {
   "success": true
 }
-```
+````
 
 ---
 
@@ -805,11 +694,9 @@ POST /envelope/get-many
 
 ### Request Body
 
-| Field      | Type   | Required | Description                                                                  |
-| ---------- | ------ | -------- | ---------------------------------------------------------------------------- |
-| `ids`      | object | Yes      | ID selector containing `type` and `ids`                                      |
-| `ids.type` | string | Yes      | `envelopeId`, `documentId`, or `templateId`                                  |
-| `ids.ids`  | array  | Yes      | 1-20 IDs: strings for `envelopeId`; numbers for `documentId` or `templateId` |
+| Field         | Type  | Required | Description           |
+| ------------- | ----- | -------- | --------------------- |
+| `envelopeIds` | array | Yes      | Array of document IDs |
 
 ### Code Examples
 
@@ -820,17 +707,12 @@ curl -X POST "https://app.documenso.com/api/v2/envelope/get-many" \
   -H "Authorization: api_xxxxxxxxxxxxxxxx" \
   -H "Content-Type: application/json" \
   -d '{
-    "ids": {
-      "type": "envelopeId",
-      "ids": ["envelope_abc123", "envelope_def456", "envelope_ghi789"]
-    }
+    "envelopeIds": ["envelope_abc123", "envelope_def456", "envelope_ghi789"]
   }'
 ```
 </Tab>
 <Tab value="TypeScript">
 ```typescript
-const requestedIds = ['envelope_abc123', 'envelope_def456', 'envelope_ghi789'];
-
 const response = await fetch('https://app.documenso.com/api/v2/envelope/get-many', {
   method: 'POST',
   headers: {
@@ -838,36 +720,16 @@ const response = await fetch('https://app.documenso.com/api/v2/envelope/get-many
     'Content-Type': 'application/json',
   },
   body: JSON.stringify({
-    ids: {
-      type: 'envelopeId',
-      ids: requestedIds,
-    },
+    envelopeIds: ['envelope_abc123', 'envelope_def456', 'envelope_ghi789'],
   }),
 });
 
-const { data } = await response.json();
+const documents = await response.json();
 
-```
+````
 </Tab>
 </Tabs>
 
-### Response
-
-```json
-{
-  "data": [
-    {
-      "id": "envelope_abc123",
-      "type": "DOCUMENT",
-      "status": "PENDING",
-      "title": "Service Agreement"
-    }
-  ]
-}
-```
-
-The endpoint silently omits envelopes you cannot access instead of returning `404`. Compare `data.length` with `requestedIds.length` to detect omissions.
-
 ---
 
 ## Document Statuses
@@ -878,7 +740,6 @@ The endpoint silently omits envelopes you cannot access instead of returning `40
 | `PENDING` | Document has been sent. Waiting for recipients to sign. |
 | `COMPLETED` | All recipients have signed. Document is sealed. |
 | `REJECTED` | A recipient rejected the document. |
-| `CANCELLED` | The document was cancelled by its owner or a team member with `MANAGER` or higher permissions. |
 
 ### Status Transitions
 
@@ -886,13 +747,11 @@ The endpoint silently omits envelopes you cannot access instead of returning `40
 flowchart LR
   DRAFT --> PENDING --> COMPLETED
   PENDING --> REJECTED
-  PENDING --> CANCELLED
 ```
 
 - **DRAFT to PENDING**: Call the distribute endpoint
 - **PENDING to COMPLETED**: All recipients complete their signing
 - **PENDING to REJECTED**: A recipient rejects the document
-- **PENDING to CANCELLED**: The document owner or a team member with `MANAGER` or higher permissions cancels the document
 
 <Callout type="warn">
   You cannot modify recipients or fields after a document moves to `PENDING` status.
@@ -914,8 +773,8 @@ flowchart LR
 | Parameter  | Values                                      | Description               |
 | ---------- | ------------------------------------------- | ------------------------- |
 | `type`     | `DOCUMENT`, `TEMPLATE`                      | Filter by envelope type   |
-| `status`   | `DRAFT`, `PENDING`, `COMPLETED`, `REJECTED`, `CANCELLED` | Filter by status          |
-| `source`   | `DOCUMENT`, `TEMPLATE`, `TEMPLATE_DIRECT_LINK`          | Filter by creation source |
+| `status`   | `DRAFT`, `PENDING`, `COMPLETED`, `REJECTED` | Filter by status          |
+| `source`   | `DOCUMENT`, `TEMPLATE`, `API`               | Filter by creation source |
 | `folderId` | string                                      | Filter by folder          |
 
 ### Sorting
@@ -941,10 +800,10 @@ async function getAllPendingDocuments() {
       },
     );
 
-    const { data, currentPage, totalPages } = await response.json();
+    const { data, pagination } = await response.json();
     documents.push(...data);
 
-    hasMore = currentPage < totalPages;
+    hasMore = page < pagination.totalPages;
     page++;
   }
 

apps/docs/content/docs/developers/api/migrate-to-envelopes.mdx

@@ -119,7 +119,7 @@ Full reference in the [V2 OpenAPI reference](https://openapi.documenso.com).
 | ------------------------------------------------- | ----------------------------------------------------- |
 | `GET /api/v2/document`                            | `GET /api/v2/envelope`                                |
 | `GET /api/v2/document/{documentId}`               | `GET /api/v2/envelope/{envelopeId}`                   |
-| `POST /api/v2/document/get-many`                  | `POST /api/v2/envelope/get-many` (body changes from `documentIds: number[]` to `ids: { type: "documentId"; ids: number[] }`) |
+| `POST /api/v2/document/get-many`                  | `POST /api/v2/envelope/get-many`                      |
 | `POST /api/v2/document/create`                    | `POST /api/v2/envelope/create`                        |
 | `POST /api/v2/document/create/beta`               | `POST /api/v2/envelope/create`                        |
 | `POST /api/v2/document/update`                    | `POST /api/v2/envelope/update`                        |
@@ -140,7 +140,7 @@ Full reference in the [V2 OpenAPI reference](https://openapi.documenso.com).
 | ------------------------------------- | ------------------------------------------------ |
 | `GET /api/v2/template`                | `GET /api/v2/envelope` (with `type=TEMPLATE`)    |
 | `GET /api/v2/template/{templateId}`   | `GET /api/v2/envelope/{envelopeId}`              |
-| `POST /api/v2/template/get-many`      | `POST /api/v2/envelope/get-many` (body changes from `templateIds: number[]` to `ids: { type: "templateId"; ids: number[] }`) |
+| `POST /api/v2/template/get-many`      | `POST /api/v2/envelope/get-many`                 |
 | `POST /api/v2/template/create`        | `POST /api/v2/envelope/create` (`type=TEMPLATE`) |
 | `POST /api/v2/template/create/beta`   | `POST /api/v2/envelope/create` (`type=TEMPLATE`) |
 | `POST /api/v2/template/update`        | `POST /api/v2/envelope/update`                   |

apps/docs/content/docs/developers/api/rate-limits.mdx

@@ -11,12 +11,6 @@ Documenso enforces rate limits on all API endpoints to ensure service stability.
 
 ## HTTP Rate Limits
 
-The rate limit applies to:
-
-- `/api/v1/*`
-- `/api/v2/*`
-- `/api/v2-beta/*`
-
 **Limit:** 1000 requests per minute per IP address  
 **Response:** 429 Too Many Requests
 
@@ -25,7 +19,7 @@ The rate limit applies to:
   this value, in which case you can be rate-limited before reaching the global limit.
 </Callout>
 
-### Global per-IP 429 Response
+### Rate Limit Response
 
 ```json
 {
@@ -33,22 +27,10 @@ The rate limit applies to:
 }
 ```
 
-### Rate Limit Headers
-
-Responses from `/api/v1/*`, `/api/v2/*`, and `/api/v2-beta/*` include these headers. The only
-exception is CORS preflight (`OPTIONS`) requests, which are answered before the rate limiter runs
-and carry no rate limit headers:
-
-| Header                  | Description                                                            |
-| ----------------------- | ---------------------------------------------------------------------- |
-| `X-RateLimit-Limit`     | Maximum requests allowed in the current global window                  |
-| `X-RateLimit-Remaining` | Requests remaining in the current global window                        |
-| `X-RateLimit-Reset`     | End of the current global window, as a Unix epoch timestamp in seconds |
-
-A 429 response from a windowed limiter also includes `Retry-After`, in seconds, with a minimum
-value of `1`. The global API limit uses fixed, epoch-aligned one-minute buckets, so the actual wait
-until the next window is between 1 and 60 seconds. Honor `Retry-After` exactly instead of sleeping
-for a fixed 60 seconds. See the [Retry-After handling example](/docs/developers/examples/common-workflows#error-handling-patterns).
+<Callout type="warn">
+  No rate limit headers are currently provided. When you receive a 429 response, wait at least 60
+  seconds before retrying.
+</Callout>
 
 ## Resource Limits
 
@@ -62,55 +44,24 @@ Beyond HTTP rate limits, your account has usage limits based on your subscriptio
 | Total Recipients | 10   | Unlimited | Unlimited   | Unlimited  |
 | Direct Templates | 3    | Unlimited | Unlimited   | Unlimited  |
 
-### Organisation Limit 429 Responses
+### Error Response
 
-Organisation windowed limits and organisation monthly quotas produce 429 responses whose body
-shape depends on the API version, and neither matches the global per-IP limiter's
-`{ "error": "..." }` body.
-
-On `/api/v1/*`, the body contains only a message:
+When you exceed a resource limit:
 
 ```json
 {
-  "message": "Too many requests, please try again later. Contact support if you require higher limits."
+  "error": "You have reached your document limit for this month. Please upgrade your plan.",
+  "code": "LIMIT_EXCEEDED",
+  "statusCode": 400
 }
 ```
 
-On `/api/v2/*` and `/api/v2-beta/*`, the body is a structured error object:
-
-```json
-{
-  "message": "Too many requests, please try again later. Contact support if you require higher limits.",
-  "code": "TOO_MANY_REQUESTS",
-  "data": {
-    "code": "TOO_MANY_REQUESTS",
-    "httpStatus": 429,
-    "appError": {
-      "code": "TOO_MANY_REQUESTS",
-      "message": "Too many requests, please try again later. Contact support if you require higher limits."
-    }
-  }
-}
-```
-
-Organisation windowed limit responses include the `X-RateLimit-*` headers and `Retry-After` for
-their own window. Monthly quota responses carry no quota-specific rate limit headers or
-`Retry-After` because the quota is not a time window; rely on the status code and message instead.
-
 ## Error Codes
 
-| Code                | Status | Description                                                        |
-| ------------------- | ------ | ------------------------------------------------------------------ |
-| `TOO_MANY_REQUESTS` | 429    | Global per-IP, organisation windowed, or monthly quota exceeded    |
-| `LIMIT_EXCEEDED`    | 400    | Resource usage limit exceeded                                      |
-
-There are three sources of `TOO_MANY_REQUESTS` responses:
-
-1. The global per-IP limit, returning the `{ "error": "..." }` body shown above.
-2. Organisation windowed rate limits for the `api`, `document`, and `email` counters.
-3. Organisation monthly quotas for the same three counters. Every authenticated API request
-   consumes the `api` counter, so any endpoint can return this 429 once the monthly API quota is
-   exhausted — not just envelope-related ones.
+| Code                | Status | Description                   |
+| ------------------- | ------ | ----------------------------- |
+| `TOO_MANY_REQUESTS` | 429    | HTTP rate limit exceeded      |
+| `LIMIT_EXCEEDED`    | 400    | Resource usage limit exceeded |
 
 ---
 

apps/docs/content/docs/developers/api/teams.mdx

@@ -95,7 +95,7 @@ Documents created with a team token belong to that team:
 <Tab value="curl">
 ```bash
 curl -X POST "https://app.documenso.com/api/v2/envelope/create" \
-  -H "Authorization: api_xxxxxxxxxxxxxxxx" \
+  -H "Authorization: api_team_xxxxxxxxxxxxxxxx" \
   -H "Content-Type: multipart/form-data" \
   -F 'payload={
     "type": "DOCUMENT",
@@ -157,11 +157,11 @@ Retrieve all documents belonging to the team:
 ```bash
 # List all team documents
 curl -X GET "https://app.documenso.com/api/v2/envelope" \
-  -H "Authorization: api_xxxxxxxxxxxxxxxx"
+  -H "Authorization: api_team_xxxxxxxxxxxxxxxx"
 
 # Filter by status
 curl -X GET "https://app.documenso.com/api/v2/envelope?status=PENDING" \
-  -H "Authorization: api_xxxxxxxxxxxxxxxx"
+  -H "Authorization: api_team_xxxxxxxxxxxxxxxx"
 ````
 
 </Tab>
@@ -191,7 +191,7 @@ Templates created with a team token are shared across the team.
 <Tab value="curl">
 ```bash
 curl -X POST "https://app.documenso.com/api/v2/template/create" \
-  -H "Authorization: api_xxxxxxxxxxxxxxxx" \
+  -H "Authorization: api_team_xxxxxxxxxxxxxxxx" \
   -H "Content-Type: multipart/form-data" \
   -F 'payload={
     "title": "NDA Template",
@@ -269,7 +269,7 @@ console.log('Created team template:', template.id);
 <Tab value="curl">
 ```bash
 curl -X GET "https://app.documenso.com/api/v2/template" \
-  -H "Authorization: api_xxxxxxxxxxxxxxxx"
+  -H "Authorization: api_team_xxxxxxxxxxxxxxxx"
 ````
 
 </Tab>

apps/docs/content/docs/developers/examples/common-workflows.mdx

@@ -51,7 +51,6 @@ async function createAndSendDocument(
   pdfBuffer: Buffer,
   filename: string,
   title: string,
-  externalId: string,
   recipients: Recipient[],
 ): Promise<CreateAndSendResult> {
   const recipientPayload = recipients.map((recipient, index) => ({
@@ -90,7 +89,6 @@ async function createAndSendDocument(
     JSON.stringify({
       type: 'DOCUMENT',
       title,
-      externalId,
       recipients: recipientPayload,
       meta: {
         subject: `Please sign: ${title}`,
@@ -147,7 +145,6 @@ const result = await createAndSendDocument(
   pdfBuffer,
   'contract.pdf',
   'Service Agreement',
-  'nda-contract-ndac214',
   [
     { email: 'client@example.com', name: 'John Smith', role: 'SIGNER' },
     { email: 'manager@company.com', name: 'Jane Doe', role: 'SIGNER' },
@@ -175,7 +172,6 @@ ENVELOPE_RESPONSE=$(curl -s -X POST "${BASE_URL}/envelope/create" \
   -F 'payload={
     "type": "DOCUMENT",
     "title": "Service Agreement",
-    "externalId": "nda-contract-ndac214",
     "recipients": [
       {
         "email": "client@example.com",
@@ -245,8 +241,6 @@ echo $DISTRIBUTE_RESPONSE | jq '.recipients[] | {email, signingUrl}'
 </Tab>
 </Tabs>
 
-`externalId` is your application's own reference for this document, such as an invoice number or a database key. Documenso stores it on the envelope and repeats it in every webhook as `payload.externalId`, so your handler can match the event to your record without keeping a lookup table of Documenso IDs. To react when everyone has signed, see [Workflow 4](#workflow-4-wait-for-completion-with-webhooks). To fetch the finished PDF, see [Workflow 5](#workflow-5-download-signed-documents).
-
 ---
 
 ## Workflow 2: Create Document from Template with Custom Data
@@ -1006,12 +1000,9 @@ async function fetchWithRetry(
       // Retry on rate limit
       if (response.status === 429) {
         const retryAfter = response.headers.get('Retry-After');
-        // Honor Retry-After exactly; the cap only applies to the exponential fallback.
-        const delay = retryAfter
-          ? parseInt(retryAfter) * 1000
-          : Math.min(baseDelayMs * Math.pow(2, attempt), maxDelayMs);
+        const delay = retryAfter ? parseInt(retryAfter) * 1000 : baseDelayMs * Math.pow(2, attempt);
         console.log(`Rate limited, waiting ${delay}ms...`);
-        await new Promise((resolve) => setTimeout(resolve, delay));
+        await new Promise((resolve) => setTimeout(resolve, Math.min(delay, maxDelayMs)));
         continue;
       }
 

apps/docs/content/docs/self-hosting/configuration/meta.json

@@ -9,7 +9,6 @@
     "background-jobs",
     "signing-certificate",
     "telemetry",
-    "two-factor-enforcement",
     "organisation-limits",
     "advanced"
   ]

apps/docs/content/docs/self-hosting/configuration/two-factor-enforcement.mdx

@@ -1,54 +0,0 @@
----
-title: Two-Factor Enforcement
-description: Require two-factor authentication instance-wide or per organisation, with grace periods and important limitations.
----
-
-import { Callout } from 'fumadocs-ui/components/callout';
-
-## Overview
-
-Documenso can require users to enable two-factor authentication (2FA) at two levels:
-
-- **Instance-wide enforcement** — configured by an instance administrator under **Admin → Site Settings**. Requires a Documenso license that includes the feature. Once a user's grace period expires, they are redirected to a forced enrolment page before they can continue using the app.
-- **Per-organisation enforcement** — available to everyone, configured by organisation admins in the organisation settings. Once a member's grace period expires, only access to that organisation (and its teams) is blocked; the rest of the app stays usable.
-
-A user satisfies enforcement when they have 2FA enabled **and** their current session has passed a second factor (a TOTP/backup-code challenge, a user-verified passkey sign-in, or enabling 2FA during the session). Sessions created before the user enabled 2FA must sign out and back in to verify.
-
-## Grace Periods
-
-Both levels support a grace period of 0–365 days:
-
-- **Instance**: the window starts at the later of the user's grace start (typically account creation, restarted by an admin 2FA reset) and the moment enforcement was enabled.
-- **Organisation**: the window starts at the latest of joining the organisation, the moment the organisation enabled enforcement, and the user's grace start.
-
-A grace period of **0 days** enforces immediately: for the instance policy, users are forced to enrol right after signing up or signing in; for the organisation policy, members are blocked from the organisation until they enrol.
-
-**Joining is never blocked; access is.** Invitations and SSO sign-ins always succeed — the grace window starts at join. Members who never comply still occupy a seat and count towards member limits; organisation admins can see per-member 2FA compliance in the members list.
-
-Reducing an active grace period requires an explicit acknowledgement in the settings UI, since it can immediately block users who have not yet enrolled.
-
-Enabling enforcement requires the acting administrator to already satisfy the policy themselves (2FA enabled and verified on their current session). This prevents administrators from locking themselves out with a 0-day grace period.
-
-## Known Limitation: API Tokens Are Exempt
-
-<Callout type="warn">
-  Enforcement applies to interactive (session-based) access only. **API tokens minted before a
-  user's deadline keep working after it.** A blocked user cannot mint new tokens, but existing
-  tokens are not revoked by enforcement. If you need to cut off a non-compliant user's API access,
-  revoke their tokens explicitly.
-</Callout>
-
-## Licensing
-
-Instance-wide enforcement is license-gated:
-
-- Without the license, the instance-wide section in Admin → Site Settings is visible but disabled.
-- If enforcement was configured while licensed and the license later lapses, the stored configuration becomes **inactive** (nothing is enforced) and the only permitted change is disabling it.
-
-Per-organisation enforcement does not require a license. When instance-wide enforcement is active, it takes precedence over organisation policies.
-
----
-
-## See Also
-
-- [License](/docs/self-hosting/configuration/license) - Configuring your Documenso license

apps/docs/content/docs/self-hosting/deployment/docker-compose.mdx

@@ -81,7 +81,7 @@ services:
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?err}
       - POSTGRES_DB=${POSTGRES_DB:?err}
     healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
+      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER}']
       interval: 10s
       timeout: 5s
       retries: 5

apps/docs/content/docs/self-hosting/deployment/docker.mdx

@@ -102,7 +102,7 @@ See [Email Configuration](/docs/self-hosting/configuration/email) for other tran
 | Variable                                    | Description                                                    | Default                   |
 | ------------------------------------------- | -------------------------------------------------------------- | ------------------------- |
 | `PORT`                                      | Port the application listens on                                | `3000`                    |
-| `NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH`      | Path to signing certificate inside container — set to the volume-mount path (e.g. `/opt/documenso/cert.p12`). Only Docker Compose defaults this; plain `docker run` must set it explicitly | -                         |
+| `NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH`      | Path to signing certificate inside container                   | `/opt/documenso/cert.p12` |
 | `NEXT_PRIVATE_SIGNING_PASSPHRASE`           | Passphrase for the signing certificate                         | -                         |
 | `NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS`  | Base64-encoded `.p12` certificate (alternative to file path)   | -                         |
 | `NEXT_PUBLIC_UPLOAD_TRANSPORT`              | Document storage: `database` or `s3`                           | `database`                |
@@ -136,7 +136,6 @@ docker run -d \
   -e NEXT_PUBLIC_WEBAPP_URL="https://sign.example.com" \
   -e NEXT_PRIVATE_INTERNAL_WEBAPP_URL="http://localhost:3000" \
   -e NEXT_PRIVATE_DATABASE_URL="postgresql://user:password@db-host:5432/documenso" \
-  -e NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH="/opt/documenso/cert.p12" \
   -e NEXT_PRIVATE_SIGNING_PASSPHRASE="your-certificate-password" \
   -e NEXT_PRIVATE_SMTP_TRANSPORT="smtp-auth" \
   -e NEXT_PRIVATE_SMTP_HOST="smtp.example.com" \
@@ -155,12 +154,6 @@ A signing certificate is required for document signing. You have two options for
 - **Volume mount** — mount a `.p12` file from the host into the container at `/opt/documenso/cert.p12` (shown above). This is the simplest approach for small to moderate deployments.
 - **Base64-encoded contents** — set `NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS` with the base64-encoded certificate string. Use this when file mounting is not available (e.g., Railway, Vercel).
 
-<Callout type="warn">
-  Plain `docker run` deployments must set `NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH` explicitly. This
-  prevents production deployments from accidentally using the insecure example certificate.
-  Docker Compose sets the file path for you.
-</Callout>
-
 For production deployments that require Adobe Approved Trust List recognition, consider using a [Google Cloud HSM](/docs/self-hosting/configuration/signing-certificate/google-cloud-hsm) or another external HSM.
 
 <Callout type="warn">
@@ -185,7 +178,6 @@ NEXT_PUBLIC_WEBAPP_URL=https://sign.example.com
 NEXT_PRIVATE_INTERNAL_WEBAPP_URL=http://localhost:3000
 NEXT_PRIVATE_DATABASE_URL=postgresql://user:password@db-host:5432/documenso
 NEXT_PRIVATE_DIRECT_DATABASE_URL=postgresql://user:password@db-host:5432/documenso
-NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12
 NEXT_PRIVATE_SIGNING_PASSPHRASE=your-certificate-password
 NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
 NEXT_PRIVATE_SMTP_HOST=smtp.example.com
@@ -211,12 +203,6 @@ docker run -d \
 
 Documenso provides health check endpoints for monitoring:
 
-<Callout type="info">
-  If a certificate is mounted but signing fails, ensure `NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH`
-  explicitly points to its path inside the container. Production does not use the development
-  example certificate as a fallback.
-</Callout>
-
 | Endpoint                  | Purpose                                                        |
 | ------------------------- | -------------------------------------------------------------- |
 | `/api/health`             | Checks database connectivity and certificate status            |

apps/docs/content/docs/self-hosting/deployment/manual.mdx

@@ -14,8 +14,8 @@ import { Step, Steps } from 'fumadocs-ui/components/steps';
 
 ## Prerequisites
 
-- Node.js 24 or later
-- npm 11.17 or later
+- Node.js 22 or later
+- npm 11 or later
 - PostgreSQL 14 or later
 - A Linux server (for systemd service setup)
 

apps/docs/content/docs/self-hosting/getting-started/requirements.mdx

@@ -141,8 +141,8 @@ If building from source (not using Docker images):
 
 | Requirement | Version |
 | ----------- | ------- |
-| Node.js     | 24+     |
-| npm         | 11.17+  |
+| Node.js     | 22+     |
+| npm         | 11+     |
 
 ---
 
@@ -169,7 +169,7 @@ Documenso runs on:
 | MySQL/MariaDB  | PostgreSQL-specific features required |
 | SQLite         | Not suitable for production workloads |
 | MongoDB        | Relational database required          |
-| Node.js < 24   | Modern JavaScript features required   |
+| Node.js < 22   | Modern JavaScript features required   |
 
 ---
 

apps/docs/content/docs/users/organisations/preferences/document.mdx

@@ -34,7 +34,7 @@ To access the preferences, navigate to either the organisation or teams settings
 | **Default Recipients**               | Recipients that are automatically added to new documents. Can be overridden per document.                                       |
 | **Default Envelope Expiration**      | How long recipients have to sign before the signing link expires. See [recipient expiration](/docs/users/documents/advanced/recipient-expiration). |
 | **Default Signing Reminders**        | When and how often to email recipients who have not yet signed. See [signing reminders](/docs/users/documents/advanced/signing-reminders). |
-| **Delegate Document Ownership**      | By default, documents created with a team API token are owned by the user who created the token. Enable this setting to let supported API requests assign ownership to another team member.                                                    |
+| **Delegate Document Ownership**      | Allow team API tokens to delegate document ownership to another team member.                                                    |
 | **AI Features**                      | Enable AI-powered features such as automatic recipient detection. Only shown if AI features are configured on the instance.     |
 
 Document visibility, language, and signature settings can be overridden per document.

apps/docs/package.json

@@ -10,12 +10,13 @@
     "postinstall": "fumadocs-mdx"
   },
   "dependencies": {
-    "fumadocs-core": "16.14.3",
-    "fumadocs-mdx": "15.2.3",
-    "fumadocs-ui": "16.14.3",
+    "@radix-ui/react-tabs": "^1.1.13",
+    "fumadocs-core": "16.5.0",
+    "fumadocs-mdx": "14.2.6",
+    "fumadocs-ui": "16.5.0",
     "lucide-react": "^0.563.0",
     "mermaid": "^11.12.2",
-    "next": "^16.3.3",
+    "next": "16.2.6",
     "next-plausible": "^3.12.5",
     "next-themes": "^0.4.6",
     "react": "^19.2.4",

apps/openpage-api/package.json

@@ -12,11 +12,11 @@
   "dependencies": {
     "@documenso/prisma": "*",
     "luxon": "^3.7.2",
-    "next": "^16.3.3"
+    "next": "16.2.6"
   },
   "devDependencies": {
     "@types/node": "^20",
-    "@types/react": "^19.2.17",
+    "@types/react": "18.3.27",
     "typescript": "5.6.2"
   }
 }

apps/remix/Dockerfile.bun

@@ -0,0 +1,25 @@
+FROM oven/bun:1 AS dependencies-env
+COPY . /app
+
+FROM dependencies-env AS development-dependencies-env
+COPY ./package.json bun.lockb /app/
+WORKDIR /app
+RUN bun i --frozen-lockfile
+
+FROM dependencies-env AS production-dependencies-env
+COPY ./package.json bun.lockb /app/
+WORKDIR /app
+RUN bun i --production
+
+FROM dependencies-env AS build-env
+COPY ./package.json bun.lockb /app/
+COPY --from=development-dependencies-env /app/node_modules /app/node_modules
+WORKDIR /app
+RUN bun run build
+
+FROM dependencies-env
+COPY ./package.json bun.lockb /app/
+COPY --from=production-dependencies-env /app/node_modules /app/node_modules
+COPY --from=build-env /app/build /app/build
+WORKDIR /app
+CMD ["bun", "run", "start"]

apps/remix/Dockerfile.pnpm

@@ -0,0 +1,26 @@
+FROM node:20-alpine AS dependencies-env
+RUN npm i -g pnpm
+COPY . /app
+
+FROM dependencies-env AS development-dependencies-env
+COPY ./package.json pnpm-lock.yaml /app/
+WORKDIR /app
+RUN pnpm i --frozen-lockfile
+
+FROM dependencies-env AS production-dependencies-env
+COPY ./package.json pnpm-lock.yaml /app/
+WORKDIR /app
+RUN pnpm i --prod --frozen-lockfile
+
+FROM dependencies-env AS build-env
+COPY ./package.json pnpm-lock.yaml /app/
+COPY --from=development-dependencies-env /app/node_modules /app/node_modules
+WORKDIR /app
+RUN pnpm build
+
+FROM dependencies-env
+COPY ./package.json pnpm-lock.yaml /app/
+COPY --from=production-dependencies-env /app/node_modules /app/node_modules
+COPY --from=build-env /app/build /app/build
+WORKDIR /app
+CMD ["pnpm", "start"]

apps/remix/app/components/dialogs/admin-user-reset-two-factor-dialog.tsx

@@ -56,7 +56,7 @@ export const AdminUserResetTwoFactorDialog = ({ className, user }: AdminUserRese
         .with(AppErrorCode.NOT_FOUND, () => msg`User not found.`)
         .with(
           AppErrorCode.UNAUTHORIZED,
-          () => msg`You are not authorized to reset two factor authentication for this user.`,
+          () => msg`You are not authorized to reset two factor authentcation for this user.`,
         )
         .otherwise(() => msg`An error occurred while resetting two factor authentication for the user.`);
 
@@ -85,8 +85,7 @@ export const AdminUserResetTwoFactorDialog = ({ className, user }: AdminUserRese
           <AlertDescription className="mr-2">
             <Trans>
               Reset the users two factor authentication. This action is irreversible and will disable two factor
-              authentication for the user. Their two-factor enforcement grace period will restart from the moment of the
-              reset.
+              authentication for the user.
             </Trans>
           </AlertDescription>
         </div>
@@ -109,8 +108,7 @@ export const AdminUserResetTwoFactorDialog = ({ className, user }: AdminUserRese
               <Alert variant="destructive">
                 <AlertDescription className="selection:bg-red-100">
                   <Trans>
-                    This action is irreversible. Please ensure you have informed the user before proceeding. Any
-                    two-factor enforcement grace period for this user will restart from the moment of the reset.
+                    This action is irreversible. Please ensure you have informed the user before proceeding.
                   </Trans>
                 </AlertDescription>
               </Alert>

apps/remix/app/components/dialogs/envelope-distribute-dialog.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { useCurrentEnvelopeEditor } from '@documenso/lib/client-only/providers/envelope-editor-provider';
 import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
@@ -72,7 +71,6 @@ export const EnvelopeDistributeDialog = ({
   const { toast } = useToast();
   const { t, i18n } = useLingui();
   const navigate = useNavigate();
-  const analytics = useAnalytics();
 
   const [isOpen, setIsOpen] = useState(false);
   const [isSyncing, setIsSyncing] = useState(false);
@@ -202,12 +200,6 @@ export const EnvelopeDistributeDialog = ({
     } catch (err) {
       const error = AppError.parseError(err);
 
-      analytics.captureException(err, {
-        source: 'editor',
-        location: 'distribute_document',
-        envelopeId: envelope.id,
-      });
-
       const errorMessage = getDistributeErrorMessage(error.code);
 
       toast({

apps/remix/app/components/dialogs/envelope-redistribute-dialog.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { getRecipientType } from '@documenso/lib/client-only/recipient-type';
 import { AppError } from '@documenso/lib/errors/app-error';
 import type { TEnvelope } from '@documenso/lib/types/envelope';
@@ -52,7 +51,6 @@ export const EnvelopeRedistributeDialog = ({ envelope, envelopeType, trigger }:
 
   const { toast } = useToast();
   const { t, i18n } = useLingui();
-  const analytics = useAnalytics();
 
   const [isOpen, setIsOpen] = useState(false);
 
@@ -97,13 +95,6 @@ export const EnvelopeRedistributeDialog = ({ envelope, envelopeType, trigger }:
       setIsOpen(false);
     } catch (err) {
       const error = AppError.parseError(err);
-
-      analytics.captureException(err, {
-        source: 'editor',
-        location: 'redistribute_document',
-        envelopeId: envelope.id,
-      });
-
       const errorMessage = getDistributeErrorMessage(error.code);
 
       toast({

apps/remix/app/components/dialogs/envelopes-bulk-download-dialog.tsx

@@ -290,11 +290,10 @@ export const EnvelopesBulkDownloadDialog = ({
         {isOverDownloadLimit && (
           <Alert variant="warning">
             <AlertDescription>
-              <Plural
-                value={MAX_BULK_DOWNLOAD_ENVELOPES}
-                one="You can download up to # document at a time. Deselect some documents to continue."
-                other="You can download up to # documents at a time. Deselect some documents to continue."
-              />
+              <Trans>
+                You can download up to {MAX_BULK_DOWNLOAD_ENVELOPES} documents at a time. Deselect some documents to
+                continue.
+              </Trans>
             </AlertDescription>
           </Alert>
         )}

apps/remix/app/components/dialogs/organisation-create-dialog.tsx

@@ -1,7 +1,7 @@
 import type { InternalClaimPlans } from '@documenso/ee/server-only/stripe/get-internal-claim-plans';
 import { useUpdateSearchParams } from '@documenso/lib/client-only/hooks/use-update-search-params';
 import { useSession } from '@documenso/lib/client-only/providers/session';
-import { DOCUMENSO_CLOUD_ENTERPRISE_CTA_URL, IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
+import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
 import { AppError } from '@documenso/lib/errors/app-error';
 import { INTERNAL_CLAIM_ID } from '@documenso/lib/types/subscription';
 import { parseMessageDescriptorMacro } from '@documenso/lib/utils/i18n';
@@ -380,7 +380,7 @@ const BillingPlanForm = ({ value, onChange, plans, canCreateFreeOrganisation }:
         ))}
 
         <Link
-          to={DOCUMENSO_CLOUD_ENTERPRISE_CTA_URL}
+          to="https://documen.so/enterprise-cta"
           target="_blank"
           className="flex items-center space-x-2 rounded-md border bg-muted/30 p-4"
         >

apps/remix/app/components/dialogs/template-bulk-send-dialog.tsx

@@ -1,7 +1,4 @@
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import type { TBulkSendCsvError } from '@documenso/lib/server-only/template/validate-bulk-send-csv';
 import { trpc } from '@documenso/trpc/react';
-import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
 import { Button } from '@documenso/ui/primitives/button';
 import { Checkbox } from '@documenso/ui/primitives/checkbox';
 import {
@@ -18,11 +15,9 @@ import { useToast } from '@documenso/ui/primitives/use-toast';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
-import { Plural, Trans } from '@lingui/react/macro';
+import { Trans } from '@lingui/react/macro';
 import { File as FileIcon, Upload, X } from 'lucide-react';
-import { useState } from 'react';
 import { useForm } from 'react-hook-form';
-import { match } from 'ts-pattern';
 import { z } from 'zod';
 
 import { useCurrentTeam } from '~/providers/team';
@@ -34,8 +29,6 @@ const ZBulkSendFormSchema = z.object({
 
 type TBulkSendFormSchema = z.infer<typeof ZBulkSendFormSchema>;
 
-type TBulkSendValidationError = TBulkSendCsvError | { type: 'UPLOAD_ERROR'; code: string };
-
 export type TemplateBulkSendDialogProps = {
   templateId: number;
   recipients: Array<{ email: string; name?: string | null }>;
@@ -49,9 +42,6 @@ export const TemplateBulkSendDialog = ({ templateId, recipients, trigger, onSucc
 
   const team = useCurrentTeam();
 
-  const [open, setOpen] = useState(false);
-  const [validationError, setValidationError] = useState<TBulkSendValidationError | null>(null);
-
   const form = useForm<TBulkSendFormSchema>({
     resolver: zodResolver(ZBulkSendFormSchema),
     defaultValues: {
@@ -61,20 +51,6 @@ export const TemplateBulkSendDialog = ({ templateId, recipients, trigger, onSucc
 
   const { mutateAsync: uploadBulkSend } = trpc.template.uploadBulkSend.useMutation();
 
-  const onOpenChange = (value: boolean) => {
-    if (form.formState.isSubmitting) {
-      return;
-    }
-
-    setOpen(value);
-
-    if (!value) {
-      setValidationError(null);
-
-      form.reset();
-    }
-  };
-
   const onDownloadTemplate = () => {
     const headers = recipients.flatMap((_, index) => [`recipient_${index + 1}_email`, `recipient_${index + 1}_name`]);
 
@@ -95,44 +71,36 @@ export const TemplateBulkSendDialog = ({ templateId, recipients, trigger, onSucc
   };
 
   const onSubmit = async (values: TBulkSendFormSchema) => {
-    setValidationError(null);
-
     try {
       const csv = await values.file.text();
 
-      const result = await uploadBulkSend({
+      await uploadBulkSend({
         templateId,
         teamId: team?.id,
         csv: csv,
         sendImmediately: values.sendImmediately,
       });
 
-      if (!result.success) {
-        setValidationError(result.error);
-
-        return;
-      }
-
       toast({
         title: _(msg`Success`),
         description: _(msg`Your bulk send has been initiated. You will receive an email notification upon completion.`),
       });
 
-      setOpen(false);
       form.reset();
-
       onSuccess?.();
     } catch (err) {
       console.error(err);
 
-      const error = AppError.parseError(err);
-
-      setValidationError({ type: 'UPLOAD_ERROR', code: error.code });
+      toast({
+        title: _(msg`Error`),
+        description: _(msg`Failed to upload CSV. Please check the file format and try again.`),
+        variant: 'destructive',
+      });
     }
   };
 
   return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
+    <Dialog>
       <DialogTrigger asChild>
         {trigger ?? (
           <Button variant="outline" className="shrink-0" size="sm">
@@ -206,10 +174,7 @@ export const TemplateBulkSendDialog = ({ templateId, recipients, trigger, onSucc
                             className="hidden"
                             onChange={(e) => {
                               const file = e.target.files?.[0];
-
                               if (file) {
-                                setValidationError(null);
-
                                 onChange(file);
                               }
                             }}
@@ -230,11 +195,7 @@ export const TemplateBulkSendDialog = ({ templateId, recipients, trigger, onSucc
                           type="button"
                           variant="link"
                           className="p-0 text-destructive text-xs hover:text-destructive"
-                          onClick={() => {
-                            setValidationError(null);
-
-                            form.resetField('file');
-                          }}
+                          onClick={() => onChange(null)}
                           disabled={form.formState.isSubmitting}
                         >
                           <X className="h-4 w-4" />
@@ -257,72 +218,6 @@ export const TemplateBulkSendDialog = ({ templateId, recipients, trigger, onSucc
               )}
             />
 
-            {validationError !== null && (
-              <Alert variant="destructive">
-                <AlertDescription className="max-h-32 overflow-y-auto">
-                  {match(validationError)
-                    .with({ type: 'PARSE_ERROR' }, () => (
-                      <Trans>The CSV could not be parsed. Please check the file format and try again.</Trans>
-                    ))
-                    .with({ type: 'EMPTY' }, () => (
-                      <Trans>
-                        The CSV does not contain any rows. Please add at least one row of recipient details.
-                      </Trans>
-                    ))
-                    .with({ type: 'ROW_LIMIT_EXCEEDED' }, ({ rowCount, maxRows }) => (
-                      <Trans>
-                        <Plural value={rowCount} one="The CSV contains # row." other="The CSV contains # rows." />{' '}
-                        <Plural
-                          value={maxRows}
-                          one="A maximum of # row is allowed per upload."
-                          other="A maximum of # rows is allowed per upload."
-                        />
-                      </Trans>
-                    ))
-                    .with({ type: 'MISSING_COLUMNS' }, ({ missingColumns }) => (
-                      <>
-                        <Trans>
-                          The CSV is missing the following required columns. Please download the template CSV for the
-                          correct format.
-                        </Trans>
-
-                        <ul className="mt-1 list-inside list-disc">
-                          {missingColumns.map((column) => (
-                            <li key={column} className="font-mono">
-                              {column}
-                            </li>
-                          ))}
-                        </ul>
-                      </>
-                    ))
-                    .with({ type: 'INVALID_RECIPIENTS' }, ({ rowErrors }) => (
-                      <>
-                        <Trans>The CSV contains invalid recipient emails. Please fix the following rows:</Trans>
-
-                        <ul className="mt-1 list-inside list-disc">
-                          {rowErrors.map((rowError, index) => (
-                            <li key={index}>
-                              <Trans>
-                                Row {rowError.row}: <span className="font-mono">{rowError.column}</span> must be a valid
-                                email or empty
-                              </Trans>
-                            </li>
-                          ))}
-                        </ul>
-                      </>
-                    ))
-                    .with({ type: 'UPLOAD_ERROR' }, ({ code }) =>
-                      code === AppErrorCode.LIMIT_EXCEEDED ? (
-                        <Trans>The CSV exceeds the maximum file size.</Trans>
-                      ) : (
-                        <Trans>Failed to upload CSV. Please check the file format and try again.</Trans>
-                      ),
-                    )
-                    .exhaustive()}
-                </AlertDescription>
-              </Alert>
-            )}
-
             <FormField
               control={form.control}
               name="sendImmediately"
@@ -345,12 +240,7 @@ export const TemplateBulkSendDialog = ({ templateId, recipients, trigger, onSucc
             />
 
             <DialogFooter className="mt-4">
-              <Button
-                variant="secondary"
-                onClick={() => onOpenChange(false)}
-                disabled={form.formState.isSubmitting}
-                type="button"
-              >
+              <Button variant="secondary" onClick={() => form.reset()} type="button">
                 <Trans>Cancel</Trans>
               </Button>
 

apps/remix/app/components/embed/authoring/configure-document-recipients.tsx

@@ -18,8 +18,6 @@ import { useCallback, useRef } from 'react';
 import type { Control } from 'react-hook-form';
 import { useFieldArray, useFormContext, useFormState } from 'react-hook-form';
 
-import { useCspNonce } from '~/utils/nonce';
-
 import { useConfigureDocument } from './configure-document-context';
 import type { TConfigureEmbedFormSchema } from './configure-document-view.types';
 
@@ -34,7 +32,6 @@ export interface ConfigureDocumentRecipientsProps {
 export const ConfigureDocumentRecipients = ({ control, isSubmitting }: ConfigureDocumentRecipientsProps) => {
   const { _ } = useLingui();
   const { isTemplate } = useConfigureDocument();
-  const cspNonce = useCspNonce();
 
   const $sensorApi = useRef<SensorAPI | null>(null);
 
@@ -215,7 +212,6 @@ export const ConfigureDocumentRecipients = ({ control, isSubmitting }: Configure
       />
 
       <DragDropContext
-        nonce={cspNonce}
         onDragEnd={onDragEnd}
         sensors={[
           (api: SensorAPI) => {

apps/remix/app/components/embed/embed-direct-template-client-page.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { useThrottleFn } from '@documenso/lib/client-only/hooks/use-throttle-fn';
 import { DEFAULT_DOCUMENT_DATE_FORMAT } from '@documenso/lib/constants/date-formats';
 import { APP_I18N_OPTIONS } from '@documenso/lib/constants/i18n';
@@ -78,7 +77,6 @@ export const EmbedDirectTemplateClientPage = ({
 }: EmbedDirectTemplateClientPageProps) => {
   const { _ } = useLingui();
   const { toast } = useToast();
-  const analytics = useAnalytics();
 
   const [searchParams] = useSearchParams();
 
@@ -266,13 +264,6 @@ export const EmbedDirectTemplateClientPage = ({
       const error = AppError.parseError(err);
       const errorMessage = getDirectTemplateErrorMessage(error.code);
 
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'direct_template',
-        recipientId: recipient.id,
-        envelopeId,
-      });
-
       toast({
         title: _(errorMessage.title),
         description: _(errorMessage.description),
@@ -317,14 +308,6 @@ export const EmbedDirectTemplateClientPage = ({
       }
     } catch (err) {
       console.error(err);
-
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'embed_init',
-        recipientId: recipient.id,
-        envelopeId,
-      });
-
       setHasFinishedInit(true);
     }
 

apps/remix/app/components/embed/embed-document-signing-page-v1.tsx

@@ -1,8 +1,6 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { useThrottleFn } from '@documenso/lib/client-only/hooks/use-throttle-fn';
 import { APP_I18N_OPTIONS } from '@documenso/lib/constants/i18n';
 import { PDF_VIEWER_PAGE_SELECTOR } from '@documenso/lib/constants/pdf-viewer';
-import { AppError } from '@documenso/lib/errors/app-error';
 import { ZSignDocumentEmbedDataSchema } from '@documenso/lib/types/embed-document-sign-schema';
 import { isFieldUnsignedAndRequired } from '@documenso/lib/utils/advanced-fields-helpers';
 import { getDocumentDataUrlForPdfViewer } from '@documenso/lib/utils/envelope-download';
@@ -34,7 +32,6 @@ import { useEffect, useId, useLayoutEffect, useMemo, useState } from 'react';
 import { BrandingLogo } from '~/components/general/branding-logo';
 import PDFViewerLazy from '~/components/general/pdf-viewer/pdf-viewer-lazy';
 import { injectCss } from '~/utils/css-vars';
-import { getSigningCompletionErrorMessage } from '~/utils/toast-error-messages';
 
 import { DocumentSigningAttachmentsPopover } from '../general/document-signing/document-signing-attachments-popover';
 import { useRequiredDocumentSigningContext } from '../general/document-signing/document-signing-provider';
@@ -76,7 +73,6 @@ export const EmbedSignDocumentV1ClientPage = ({
 }: EmbedSignDocumentV1ClientPageProps) => {
   const { _ } = useLingui();
   const { toast } = useToast();
-  const analytics = useAnalytics();
 
   const { fullName, email, signature, setFullName, setEmail, setSignature } = useRequiredDocumentSigningContext();
 
@@ -156,14 +152,6 @@ export const EmbedSignDocumentV1ClientPage = ({
 
       setHasCompletedDocument(true);
     } catch (err) {
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'complete_document',
-        recipientId: recipient.id,
-        documentId,
-        envelopeId,
-      });
-
       if (window.parent) {
         window.parent.postMessage(
           {
@@ -174,12 +162,9 @@ export const EmbedSignDocumentV1ClientPage = ({
         );
       }
 
-      const error = AppError.parseError(err);
-      const toastMessage = getSigningCompletionErrorMessage(error.code);
-
       toast({
-        title: _(toastMessage.title),
-        description: _(toastMessage.description),
+        title: _(msg`Something went wrong`),
+        description: _(msg`We were unable to submit this document at this time. Please try again later.`),
         variant: 'destructive',
       });
     }
@@ -246,15 +231,6 @@ export const EmbedSignDocumentV1ClientPage = ({
       }
     } catch (err) {
       console.error(err);
-
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'embed_init',
-        recipientId: recipient.id,
-        documentId,
-        envelopeId,
-      });
-
       setHasFinishedInit(true);
     }
 

apps/remix/app/components/embed/embed-document-signing-page-v2.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { APP_I18N_OPTIONS } from '@documenso/lib/constants/i18n';
 import { ZSignDocumentEmbedDataSchema } from '@documenso/lib/types/embed-document-sign-schema';
 import { mapSecondaryIdToDocumentId } from '@documenso/lib/utils/envelope';
@@ -26,7 +25,6 @@ export const EmbedSignDocumentV2ClientPage = ({
   allowWhitelabelling = false,
 }: EmbedSignDocumentV2ClientPageProps) => {
   const { _ } = useLingui();
-  const analytics = useAnalytics();
 
   const { envelope, recipient, envelopeData, setFullName, setEmail, fullName, email } =
     useRequiredEnvelopeSigningContext();
@@ -172,14 +170,6 @@ export const EmbedSignDocumentV2ClientPage = ({
       }
     } catch (err) {
       console.error(err);
-
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'embed_init',
-        recipientId: recipient.id,
-        envelopeId: envelope.id,
-      });
-
       setHasFinishedInit(true);
     }
 

apps/remix/app/components/embed/multisign/multi-sign-document-signing-view.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { PDF_VIEWER_PAGE_SELECTOR } from '@documenso/lib/constants/pdf-viewer';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { getDocumentDataUrlForPdfViewer } from '@documenso/lib/utils/envelope-download';
@@ -27,7 +26,6 @@ import { useState } from 'react';
 import { match, P } from 'ts-pattern';
 
 import PDFViewerLazy from '~/components/general/pdf-viewer/pdf-viewer-lazy';
-import { getSigningCompletionErrorMessage } from '~/utils/toast-error-messages';
 
 import { useRequiredDocumentSigningContext } from '../../general/document-signing/document-signing-provider';
 import { DocumentSigningRejectDialog } from '../../general/document-signing/document-signing-reject-dialog';
@@ -58,7 +56,6 @@ export const MultiSignDocumentSigningView = ({
 }: MultiSignDocumentSigningViewProps) => {
   const { _ } = useLingui();
   const { toast } = useToast();
-  const analytics = useAnalytics();
 
   const { fullName, email, signature, setFullName, setSignature } = useRequiredDocumentSigningContext();
 
@@ -103,13 +100,6 @@ export const MultiSignDocumentSigningView = ({
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'sign_field',
-        recipientId,
-        documentId: document?.id,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while signing the document.`),
@@ -129,13 +119,6 @@ export const MultiSignDocumentSigningView = ({
       }
 
       console.error(err);
-
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'remove_field',
-        recipientId,
-        documentId: document?.id,
-      });
     }
   };
 
@@ -156,21 +139,11 @@ export const MultiSignDocumentSigningView = ({
         recipientId,
       });
     } catch (err) {
-      analytics.captureException(err, {
-        source: 'embed',
-        location: 'complete_document',
-        recipientId,
-        documentId: document?.id,
-      });
-
       onDocumentError?.();
 
-      const error = AppError.parseError(err);
-      const toastMessage = getSigningCompletionErrorMessage(error.code);
-
       toast({
-        title: _(toastMessage.title),
-        description: _(toastMessage.description),
+        title: _(msg`Error`),
+        description: _(msg`Failed to complete the document. Please try again.`),
         variant: 'destructive',
       });
     } finally {

apps/remix/app/components/forms/2fa/disable-authenticator-app-dialog.tsx

@@ -1,6 +1,5 @@
 import { authClient } from '@documenso/auth/client';
 import { useSession } from '@documenso/lib/client-only/providers/session';
-import { AppError } from '@documenso/lib/errors/app-error';
 import { Button } from '@documenso/ui/primitives/button';
 import {
   Dialog,
@@ -69,23 +68,15 @@ export const DisableAuthenticatorAppDialog = () => {
 
   const { isSubmitting: isDisable2FASubmitting } = disable2FAForm.formState;
 
-  // Todo: (2FA enforcement, step 5) Once org enforcement state is available
-  // client-side, warn BEFORE disabling that org/team access will block at the
-  // org 2FA deadline. Until then the warning is shown after the fact based on
-  // the server response.
   const onDisable2FAFormSubmit = async ({ totpCode, backupCode }: TDisable2FAForm) => {
     try {
-      const { orgEnforcementApplies } = await authClient.twoFactor.disable({ totpCode, backupCode });
+      await authClient.twoFactor.disable({ totpCode, backupCode });
 
       toast({
         title: _(msg`Two-factor authentication disabled`),
-        description: orgEnforcementApplies
-          ? _(
-              msg`Two-factor authentication has been disabled for your account. One of your organisations requires two-factor authentication: access to it will be blocked at its deadline until you re-enable 2FA.`,
-            )
-          : _(
-              msg`Two-factor authentication has been disabled for your account. You will no longer be required to enter a code from your authenticator app when signing in.`,
-            ),
+        description: _(
+          msg`Two-factor authentication has been disabled for your account. You will no longer be required to enter a code from your authenticator app when signing in.`,
+        ),
       });
 
       flushSync(() => {
@@ -93,19 +84,7 @@ export const DisableAuthenticatorAppDialog = () => {
       });
 
       await refreshSession();
-    } catch (err) {
-      const error = AppError.parseError(err);
-
-      if (error.code === 'TWO_FACTOR_DISABLE_FORBIDDEN') {
-        toast({
-          title: _(msg`Unable to disable two-factor authentication`),
-          description: _(msg`Two-factor authentication is required by this instance and cannot be disabled.`),
-          variant: 'destructive',
-        });
-
-        return;
-      }
-
+    } catch (_err) {
       toast({
         title: _(msg`Unable to disable two-factor authentication`),
         description: _(

apps/remix/app/components/forms/2fa/enable-authenticator-app-dialog.tsx

@@ -1,7 +1,6 @@
 import { authClient } from '@documenso/auth/client';
 import { downloadFile } from '@documenso/lib/client-only/download-file';
 import { useSession } from '@documenso/lib/client-only/providers/session';
-import { AppError } from '@documenso/lib/errors/app-error';
 import { Button } from '@documenso/ui/primitives/button';
 import {
   Dialog,
@@ -70,18 +69,11 @@ export const EnableAuthenticatorAppDialog = ({ onSuccess }: EnableAuthenticatorA
 
       setSetup2FAData(data);
     } catch (err) {
-      const error = AppError.parseError(err);
-
       toast({
         title: _(msg`Unable to setup two-factor authentication`),
-        description:
-          error.code === 'TWO_FACTOR_ALREADY_ENABLED'
-            ? _(
-                msg`Two-factor authentication is already enabled for your account. Disable it before setting it up again.`,
-              )
-            : _(
-                msg`We were unable to setup two-factor authentication for your account. Please ensure that you have entered your code correctly and try again.`,
-              ),
+        description: _(
+          msg`We were unable to setup two-factor authentication for your account. Please ensure that you have entered your code correctly and try again.`,
+        ),
         variant: 'destructive',
       });
     }

apps/remix/app/components/forms/2fa/two-factor-code-dialog.tsx

@@ -1,158 +0,0 @@
-import { Button } from '@documenso/ui/primitives/button';
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from '@documenso/ui/primitives/dialog';
-import { FormControl, FormField, FormItem, FormLabel, FormMessage } from '@documenso/ui/primitives/form/form';
-import { Input } from '@documenso/ui/primitives/input';
-import { PinInput, PinInputGroup, PinInputSlot } from '@documenso/ui/primitives/pin-input';
-import { Trans } from '@lingui/react/macro';
-import type React from 'react';
-import { useState } from 'react';
-import { type FieldValues, type Path, useFormContext } from 'react-hook-form';
-import { z } from 'zod';
-
-/**
- * Schema for forms that accept a two factor code. Compose with `.extend()` or `.merge()`.
- */
-export const ZTwoFactorCodeFieldSchema = z.object({
-  totpCode: z.string().trim().optional(),
-  backupCode: z.string().trim().optional(),
-});
-
-export type TTwoFactorCodeFieldSchema = z.infer<typeof ZTwoFactorCodeFieldSchema>;
-
-export const hasTwoFactorCode = (data: TTwoFactorCodeFieldSchema) => !!data.totpCode || !!data.backupCode;
-
-type TwoFactorMethod = 'totp' | 'backup';
-
-export type TwoFactorCodeDialogProps = {
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-  isSubmitting?: boolean;
-  submitLabel: React.ReactNode;
-
-  /**
-   * Called when the user submits the code. Typically the parent form's submit handler.
-   */
-  onSubmit: () => void;
-};
-
-/**
- * Collects a TOTP or backup code on top of an existing form, mirroring the
- * sign in and disable 2FA dialogs.
- *
- * Must be rendered inside a `<Form>` whose values include `totpCode` and `backupCode`.
- */
-export const TwoFactorCodeDialog = <T extends FieldValues & TTwoFactorCodeFieldSchema>({
-  open,
-  onOpenChange,
-  isSubmitting,
-  submitLabel,
-  onSubmit,
-}: TwoFactorCodeDialogProps) => {
-  const form = useFormContext<T>();
-
-  const [method, setMethod] = useState<TwoFactorMethod>('totp');
-
-  const totpCodeName = 'totpCode' as Path<T>;
-  const backupCodeName = 'backupCode' as Path<T>;
-
-  const onToggleMethod = () => {
-    form.resetField(totpCodeName);
-    form.resetField(backupCodeName);
-
-    setMethod((current) => (current === 'totp' ? 'backup' : 'totp'));
-  };
-
-  const handleOpenChange = (value: boolean) => {
-    if (isSubmitting) {
-      return;
-    }
-
-    if (!value) {
-      form.resetField(totpCodeName);
-      form.resetField(backupCodeName);
-      setMethod('totp');
-    }
-
-    onOpenChange(value);
-  };
-
-  return (
-    <Dialog open={open} onOpenChange={handleOpenChange}>
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>
-            <Trans>Two-Factor Authentication</Trans>
-          </DialogTitle>
-
-          <DialogDescription>
-            {method === 'totp' ? (
-              <Trans>Enter the code from your authenticator app to continue.</Trans>
-            ) : (
-              <Trans>Enter one of your backup codes to continue.</Trans>
-            )}
-          </DialogDescription>
-        </DialogHeader>
-
-        <fieldset disabled={isSubmitting}>
-          {method === 'totp' && (
-            <FormField
-              control={form.control}
-              name={totpCodeName}
-              render={({ field }) => (
-                <FormItem>
-                  <FormControl>
-                    <PinInput {...field} value={field.value ?? ''} maxLength={6} autoFocus>
-                      {Array(6)
-                        .fill(null)
-                        .map((_, i) => (
-                          <PinInputGroup key={i}>
-                            <PinInputSlot index={i} />
-                          </PinInputGroup>
-                        ))}
-                    </PinInput>
-                  </FormControl>
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-          )}
-
-          {method === 'backup' && (
-            <FormField
-              control={form.control}
-              name={backupCodeName}
-              render={({ field }) => (
-                <FormItem>
-                  <FormLabel>
-                    <Trans>Backup Code</Trans>
-                  </FormLabel>
-                  <FormControl>
-                    <Input type="text" autoComplete="off" autoFocus {...field} value={field.value ?? ''} />
-                  </FormControl>
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-          )}
-
-          <DialogFooter className="mt-4">
-            <Button type="button" variant="secondary" onClick={onToggleMethod}>
-              {method === 'totp' ? <Trans>Use Backup Code</Trans> : <Trans>Use Authenticator</Trans>}
-            </Button>
-
-            <Button type="button" loading={isSubmitting} onClick={onSubmit}>
-              {submitLabel}
-            </Button>
-          </DialogFooter>
-        </fieldset>
-      </DialogContent>
-    </Dialog>
-  );
-};

apps/remix/app/components/forms/organisation-two-factor-enforcement-form.tsx

@@ -1,282 +0,0 @@
-import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
-import { useSession } from '@documenso/lib/client-only/providers/session';
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { isTwoFactorGracePeriodReduction } from '@documenso/lib/utils/two-factor';
-import { trpc } from '@documenso/trpc/react';
-import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
-import { Button } from '@documenso/ui/primitives/button';
-import { Checkbox } from '@documenso/ui/primitives/checkbox';
-import {
-  Form,
-  FormControl,
-  FormDescription,
-  FormField,
-  FormItem,
-  FormLabel,
-  FormMessage,
-} from '@documenso/ui/primitives/form/form';
-import { Input } from '@documenso/ui/primitives/input';
-import { Switch } from '@documenso/ui/primitives/switch';
-import { useToast } from '@documenso/ui/primitives/use-toast';
-import { zodResolver } from '@hookform/resolvers/zod';
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import { Loader } from 'lucide-react';
-import { useForm } from 'react-hook-form';
-import { z } from 'zod';
-
-const ZTwoFactorEnforcementFormSchema = z.object({
-  twoFactorRequired: z.boolean(),
-  twoFactorGracePeriodDays: z.coerce.number().int().min(0).max(365),
-  acknowledgeGracePeriodReduction: z.boolean(),
-});
-
-type TTwoFactorEnforcementFormSchema = z.infer<typeof ZTwoFactorEnforcementFormSchema>;
-
-/**
- * Organisation 2FA enforcement settings (require toggle + grace period).
- *
- * Rendered only for MANAGE_ORGANISATION_SECURITY holders (ADMIN). When
- * instance-wide enforcement is active the fields are shown disabled — not
- * hidden — with a banner explaining that the instance policy takes
- * precedence, so a configured organisation policy stays visible instead of
- * resurfacing already-expired later.
- */
-export const OrganisationTwoFactorEnforcementForm = () => {
-  const { _, i18n } = useLingui();
-  const { toast } = useToast();
-
-  const organisation = useCurrentOrganisation();
-  const { twoFactorEnforcement: instanceTwoFactorEnforcement } = useSession();
-
-  const isInstanceEnforcementActive = instanceTwoFactorEnforcement.required;
-
-  const { data: organisationWithSettings, isLoading } = trpc.organisation.get.useQuery({
-    organisationReference: organisation.url,
-  });
-
-  const utils = trpc.useUtils();
-
-  const { mutateAsync: updateOrganisationSettings } = trpc.organisation.settings.update.useMutation();
-
-  const settings = organisationWithSettings?.organisationGlobalSettings;
-
-  const form = useForm<TTwoFactorEnforcementFormSchema>({
-    values: {
-      twoFactorRequired: settings?.twoFactorRequired ?? false,
-      twoFactorGracePeriodDays: settings?.twoFactorGracePeriodDays ?? 7,
-      acknowledgeGracePeriodReduction: false,
-    },
-    resolver: zodResolver(ZTwoFactorEnforcementFormSchema),
-  });
-
-  const watchedValues = form.watch();
-
-  // Client-side mirror of the server's grace-reduction detection so we can
-  // surface the acknowledgement checkbox before submitting.
-  const isGraceReduction =
-    settings !== undefined &&
-    isTwoFactorGracePeriodReduction({
-      previous: settings.twoFactorRequired
-        ? {
-            anchors: [settings.twoFactorEnforcedFrom],
-            gracePeriodDays: settings.twoFactorGracePeriodDays,
-          }
-        : null,
-      next: watchedValues.twoFactorRequired
-        ? {
-            anchors: [settings.twoFactorRequired ? settings.twoFactorEnforcedFrom : new Date()],
-            gracePeriodDays: watchedValues.twoFactorGracePeriodDays,
-          }
-        : null,
-      now: new Date(),
-    });
-
-  const onSubmit = async (data: TTwoFactorEnforcementFormSchema) => {
-    try {
-      await updateOrganisationSettings({
-        organisationId: organisation.id,
-        acknowledgeGracePeriodReduction: data.acknowledgeGracePeriodReduction,
-        data: {
-          twoFactorRequired: data.twoFactorRequired,
-          twoFactorGracePeriodDays: data.twoFactorGracePeriodDays,
-        },
-      });
-
-      await utils.organisation.get.invalidate();
-
-      toast({
-        title: _(msg`Two-factor enforcement settings updated`),
-      });
-
-      form.setValue('acknowledgeGracePeriodReduction', false);
-    } catch (err) {
-      const error = AppError.parseError(err);
-
-      if (error.code === AppErrorCode.TWO_FACTOR_REQUIRED) {
-        toast({
-          title: _(msg`Two-factor authentication required`),
-          description: _(
-            msg`You must have two-factor authentication enabled and verified on this session before requiring it for the organisation.`,
-          ),
-          variant: 'destructive',
-        });
-
-        return;
-      }
-
-      toast({
-        title: _(msg`Something went wrong`),
-        description: _(msg`We were unable to update the two-factor enforcement settings. Please try again.`),
-        variant: 'destructive',
-      });
-    }
-  };
-
-  if (isLoading || !settings) {
-    return (
-      <div className="flex justify-center rounded-lg border py-16">
-        <Loader className="h-6 w-6 animate-spin text-muted-foreground" />
-      </div>
-    );
-  }
-
-  return (
-    <Form {...form}>
-      <form onSubmit={form.handleSubmit(onSubmit)}>
-        <fieldset
-          disabled={form.formState.isSubmitting || isInstanceEnforcementActive}
-          className="flex flex-col gap-y-4"
-        >
-          {isInstanceEnforcementActive && (
-            <Alert variant="neutral">
-              <AlertTitle>
-                <Trans>Instance policy takes precedence</Trans>
-              </AlertTitle>
-              <AlertDescription>
-                <Trans>
-                  Two-factor authentication is enforced instance-wide by your administrator, so the organisation policy
-                  below is not editable while the instance policy is active.
-                </Trans>
-              </AlertDescription>
-            </Alert>
-          )}
-
-          <FormField
-            control={form.control}
-            name="twoFactorRequired"
-            render={({ field }) => (
-              <FormItem className="flex flex-row items-center justify-between rounded-lg border p-4">
-                <div className="space-y-0.5 pr-4">
-                  <FormLabel>
-                    <Trans>Require two-factor authentication</Trans>
-                  </FormLabel>
-                  <FormDescription>
-                    <Trans>
-                      Members must enable two-factor authentication to access this organisation. Joining is never
-                      blocked — the grace period starts when a member joins.
-                    </Trans>
-                  </FormDescription>
-                </div>
-                <FormControl>
-                  <Switch checked={field.value} onCheckedChange={field.onChange} />
-                </FormControl>
-              </FormItem>
-            )}
-          />
-
-          <FormField
-            control={form.control}
-            name="twoFactorGracePeriodDays"
-            render={({ field }) => (
-              <FormItem>
-                <FormLabel>
-                  <Trans>Grace period (days)</Trans>
-                </FormLabel>
-                <FormControl>
-                  <Input type="number" min={0} max={365} {...field} />
-                </FormControl>
-                <FormDescription>
-                  <Trans>
-                    Number of days a member has to enable two-factor authentication after joining. 0 blocks organisation
-                    access immediately until they enrol.
-                  </Trans>
-                </FormDescription>
-                <FormMessage />
-              </FormItem>
-            )}
-          />
-
-          {settings.twoFactorRequired && settings.twoFactorEnforcedFrom && (
-            <p className="text-muted-foreground text-sm">
-              <Trans>
-                Enforcement has been active since {i18n.date(settings.twoFactorEnforcedFrom, { dateStyle: 'long' })}.
-              </Trans>
-            </p>
-          )}
-
-          <Alert variant="neutral">
-            <AlertDescription>
-              <ul className="list-disc space-y-1 pl-4">
-                <li>
-                  <Trans>
-                    API tokens are exempt: tokens minted before a member's deadline keep working after it. Blocked
-                    members cannot mint new tokens.
-                  </Trans>
-                </li>
-                <li>
-                  <Trans>
-                    Members who have not yet complied still occupy a seat and count towards your member limit.
-                  </Trans>
-                </li>
-              </ul>
-            </AlertDescription>
-          </Alert>
-
-          {isGraceReduction && (
-            <Alert variant="warning">
-              <AlertTitle>
-                <Trans>This change reduces an active grace period</Trans>
-              </AlertTitle>
-              <AlertDescription className="flex flex-col gap-y-3">
-                <Trans>
-                  Members who have not yet enabled two-factor authentication will have less time to comply — possibly
-                  none, which blocks their organisation access immediately.
-                </Trans>
-
-                <FormField
-                  control={form.control}
-                  name="acknowledgeGracePeriodReduction"
-                  render={({ field }) => (
-                    <FormItem className="flex flex-row items-center gap-x-2 space-y-0">
-                      <FormControl>
-                        <Checkbox
-                          checked={field.value}
-                          onCheckedChange={(checked) => field.onChange(checked === true)}
-                        />
-                      </FormControl>
-                      <FormLabel className="font-normal">
-                        <Trans>I understand that this reduces the remaining grace period for members</Trans>
-                      </FormLabel>
-                    </FormItem>
-                  )}
-                />
-              </AlertDescription>
-            </Alert>
-          )}
-
-          <div className="flex justify-end">
-            <Button
-              type="submit"
-              loading={form.formState.isSubmitting}
-              disabled={isGraceReduction && !watchedValues.acknowledgeGracePeriodReduction}
-            >
-              <Trans>Update</Trans>
-            </Button>
-          </div>
-        </fieldset>
-      </form>
-    </Form>
-  );
-};

apps/remix/app/components/forms/password-setup-request-button.tsx

@@ -1,53 +0,0 @@
-import { usePasswordSetupRequest } from '@documenso/lib/client-only/hooks/use-password-setup-request';
-import { useSession } from '@documenso/lib/client-only/providers/session';
-import { Button } from '@documenso/ui/primitives/button';
-import { useToast } from '@documenso/ui/primitives/use-toast';
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import { CheckIcon } from 'lucide-react';
-import { match } from 'ts-pattern';
-
-/**
- * Compact "send me a setup link" button that reports via toast, for settings
- * cards where the surrounding layout provides the explanation.
- */
-export const PasswordSetupRequestButton = () => {
-  const { _ } = useLingui();
-  const { toast } = useToast();
-  const { user } = useSession();
-
-  const { requestSetupLink, isPending, isSuccess } = usePasswordSetupRequest({
-    onSuccess: () => {
-      toast({
-        title: _(msg`Check your email`),
-        description: _(msg`We've sent a link to ${user.email}. Follow it to set your password.`),
-        duration: 5000,
-      });
-    },
-    onError: (errorCode) => {
-      toast({
-        title: _(msg`An error occurred`),
-        description: match(errorCode)
-          .with('SIGNIN_DISABLED', () => _(msg`Password sign in is disabled for this instance.`))
-          .otherwise(() => _(msg`We were unable to send the email. Please try again later.`)),
-        variant: 'destructive',
-      });
-    },
-  });
-
-  if (isSuccess) {
-    return (
-      <Button variant="outline" className="flex-shrink-0 bg-background" disabled>
-        <CheckIcon className="mr-2 h-4 w-4" />
-        <Trans>Link sent</Trans>
-      </Button>
-    );
-  }
-
-  return (
-    <Button variant="outline" className="flex-shrink-0 bg-background" loading={isPending} onClick={requestSetupLink}>
-      <Trans>Send setup link</Trans>
-    </Button>
-  );
-};

apps/remix/app/components/forms/password-setup-request.tsx

@@ -1,61 +0,0 @@
-import { usePasswordSetupRequest } from '@documenso/lib/client-only/hooks/use-password-setup-request';
-import { useSession } from '@documenso/lib/client-only/providers/session';
-import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
-import { Button } from '@documenso/ui/primitives/button';
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import { match } from 'ts-pattern';
-
-export type PasswordSetupRequestProps = {
-  className?: string;
-};
-
-/**
- * Inline "send me a setup link" control with its own sent/error states, for
- * contexts like dialogs where a toast would be missed.
- */
-export const PasswordSetupRequest = ({ className }: PasswordSetupRequestProps) => {
-  const { _ } = useLingui();
-  const { user } = useSession();
-
-  const { requestSetupLink, isPending, isSuccess, errorCode } = usePasswordSetupRequest();
-
-  if (isSuccess) {
-    return (
-      <Alert className={className} variant="neutral">
-        <AlertTitle>
-          <Trans>Check your email</Trans>
-        </AlertTitle>
-        <AlertDescription>
-          <Trans>
-            We've sent a link to {user.email}. Follow it to set your password, then sign in again to continue.
-          </Trans>
-        </AlertDescription>
-      </Alert>
-    );
-  }
-
-  return (
-    <div className={className}>
-      {errorCode && (
-        <Alert className="mb-4" variant="destructive">
-          <AlertTitle>
-            <Trans>An error occurred</Trans>
-          </AlertTitle>
-          <AlertDescription>
-            {match(errorCode)
-              .with('SIGNIN_DISABLED', () =>
-                _(msg`Password sign in is disabled for this instance. Please contact support.`),
-              )
-              .otherwise(() => _(msg`We were unable to send the email. Please try again or contact support.`))}
-          </AlertDescription>
-        </Alert>
-      )}
-
-      <Button type="button" loading={isPending} onClick={requestSetupLink}>
-        <Trans>Send setup link</Trans>
-      </Button>
-    </div>
-  );
-};

apps/remix/app/components/forms/password.tsx

@@ -1,6 +1,6 @@
 import { authClient } from '@documenso/auth/client';
 import type { SessionUser } from '@documenso/auth/server/lib/session/session';
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { AppError } from '@documenso/lib/errors/app-error';
 import { ZCurrentPasswordSchema, ZPasswordSchema } from '@documenso/trpc/server/auth-router/schema';
 import { cn } from '@documenso/ui/lib/utils';
 import { Button } from '@documenso/ui/primitives/button';
@@ -11,21 +11,20 @@ import { zodResolver } from '@hookform/resolvers/zod';
 import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
-import { useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { match } from 'ts-pattern';
-import type { z } from 'zod';
+import { z } from 'zod';
 
-import { hasTwoFactorCode, TwoFactorCodeDialog, ZTwoFactorCodeFieldSchema } from './2fa/two-factor-code-dialog';
-
-export const ZPasswordFormSchema = ZTwoFactorCodeFieldSchema.extend({
-  currentPassword: ZCurrentPasswordSchema,
-  password: ZPasswordSchema,
-  repeatedPassword: ZPasswordSchema,
-}).refine((data) => data.password === data.repeatedPassword, {
-  message: 'Passwords do not match',
-  path: ['repeatedPassword'],
-});
+export const ZPasswordFormSchema = z
+  .object({
+    currentPassword: ZCurrentPasswordSchema,
+    password: ZPasswordSchema,
+    repeatedPassword: ZPasswordSchema,
+  })
+  .refine((data) => data.password === data.repeatedPassword, {
+    message: 'Passwords do not match',
+    path: ['repeatedPassword'],
+  });
 
 export type TPasswordFormSchema = z.infer<typeof ZPasswordFormSchema>;
 
@@ -34,51 +33,29 @@ export type PasswordFormProps = {
   user: SessionUser;
 };
 
-export const PasswordForm = ({ className, user }: PasswordFormProps) => {
+export const PasswordForm = ({ className }: PasswordFormProps) => {
   const { _ } = useLingui();
   const { toast } = useToast();
 
-  const [isTwoFactorDialogOpen, setIsTwoFactorDialogOpen] = useState(false);
-
   const form = useForm<TPasswordFormSchema>({
     values: {
       currentPassword: '',
       password: '',
       repeatedPassword: '',
-      totpCode: '',
-      backupCode: '',
     },
     resolver: zodResolver(ZPasswordFormSchema),
   });
 
   const isSubmitting = form.formState.isSubmitting;
 
-  const onFormSubmit = async (values: TPasswordFormSchema) => {
-    const { currentPassword, password, totpCode, backupCode } = values;
-
-    // Collect the 2FA code in a dialog once the password fields are valid.
-    if (user.twoFactorEnabled && !hasTwoFactorCode(values)) {
-      if (isTwoFactorDialogOpen) {
-        const message = _(msg`A code is required`);
-
-        form.setError('totpCode', { message });
-        form.setError('backupCode', { message });
-      }
-
-      setIsTwoFactorDialogOpen(true);
-      return;
-    }
-
+  const onFormSubmit = async ({ currentPassword, password }: TPasswordFormSchema) => {
     try {
       await authClient.emailPassword.updatePassword({
         currentPassword,
         password,
-        totpCode: totpCode || undefined,
-        backupCode: backupCode || undefined,
       });
 
       form.reset();
-      setIsTwoFactorDialogOpen(false);
 
       toast({
         title: _(msg`Password updated`),
@@ -89,14 +66,9 @@ export const PasswordForm = ({ className, user }: PasswordFormProps) => {
       const error = AppError.parseError(err);
 
       const errorMessage = match(error.code)
-        .with(AppErrorCode.NO_PASSWORD, () => msg`User has no password.`)
-        .with(AppErrorCode.INCORRECT_PASSWORD, () => msg`Current password is incorrect.`)
-        .with(AppErrorCode.SAME_PASSWORD, () => msg`Your new password cannot be the same as your old password.`)
-        .with(
-          AppErrorCode.INCORRECT_TWO_FACTOR_CODE,
-          AppErrorCode.TWO_FACTOR_MISSING_CREDENTIALS,
-          () => msg`The two factor code you provided is invalid. Please try again.`,
-        )
+        .with('NO_PASSWORD', () => msg`User has no password.`)
+        .with('INCORRECT_PASSWORD', () => msg`Current password is incorrect.`)
+        .with('SAME_PASSWORD', () => msg`Your new password cannot be the same as your old password.`)
         .otherwise(
           () => msg`We encountered an unknown error while attempting to update your password. Please try again later.`,
         );
@@ -111,12 +83,7 @@ export const PasswordForm = ({ className, user }: PasswordFormProps) => {
 
   return (
     <Form {...form}>
-      {/* method="post" so a pre-hydration native submit can't leak passwords into the URL. */}
-      <form
-        method="post"
-        className={cn('flex w-full flex-col gap-y-4', className)}
-        onSubmit={form.handleSubmit(onFormSubmit)}
-      >
+      <form className={cn('flex w-full flex-col gap-y-4', className)} onSubmit={form.handleSubmit(onFormSubmit)}>
         <fieldset className="flex w-full flex-col gap-y-4" disabled={isSubmitting}>
           <FormField
             control={form.control}
@@ -173,14 +140,6 @@ export const PasswordForm = ({ className, user }: PasswordFormProps) => {
           </Button>
         </div>
       </form>
-
-      <TwoFactorCodeDialog<TPasswordFormSchema>
-        open={isTwoFactorDialogOpen}
-        onOpenChange={setIsTwoFactorDialogOpen}
-        isSubmitting={isSubmitting}
-        submitLabel={<Trans>Update password</Trans>}
-        onSubmit={form.handleSubmit(onFormSubmit)}
-      />
     </Form>
   );
 };

apps/remix/app/components/forms/signin.tsx

@@ -1,6 +1,5 @@
 import { authClient } from '@documenso/auth/client';
 import { AuthenticationErrorCode } from '@documenso/auth/server/lib/errors/error-codes';
-import { formatPath } from '@documenso/lib/constants/app';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { env } from '@documenso/lib/utils/env';
 import { zEmail } from '@documenso/lib/utils/zod';
@@ -45,7 +44,7 @@ const handleFallbackErrorMessages = (code: string) => {
   return message;
 };
 
-const LOGIN_REDIRECT_PATH = formatPath('/');
+const LOGIN_REDIRECT_PATH = '/';
 
 export const ZSignInFormSchema = z.object({
   email: zEmail().min(1),

apps/remix/app/components/general/admin-two-factor-enforcement-section.tsx

@@ -1,332 +0,0 @@
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { isTwoFactorGracePeriodReduction } from '@documenso/lib/utils/two-factor';
-import { trpc } from '@documenso/trpc/react';
-import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
-import { Button } from '@documenso/ui/primitives/button';
-import { Checkbox } from '@documenso/ui/primitives/checkbox';
-import {
-  Form,
-  FormControl,
-  FormDescription,
-  FormField,
-  FormItem,
-  FormLabel,
-  FormMessage,
-} from '@documenso/ui/primitives/form/form';
-import { Input } from '@documenso/ui/primitives/input';
-import { Switch } from '@documenso/ui/primitives/switch';
-import { useToast } from '@documenso/ui/primitives/use-toast';
-import { zodResolver } from '@hookform/resolvers/zod';
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import { LoaderIcon } from 'lucide-react';
-import { useForm } from 'react-hook-form';
-import { z } from 'zod';
-
-const ZTwoFactorEnforcementFormSchema = z.object({
-  enabled: z.boolean(),
-  gracePeriodDays: z.coerce.number().int().min(0).max(365),
-  acknowledgeGracePeriodReduction: z.boolean(),
-});
-
-type TTwoFactorEnforcementFormSchema = z.infer<typeof ZTwoFactorEnforcementFormSchema>;
-
-/**
- * Instance-wide 2FA enforcement settings for the admin site-settings page.
- *
- * License-gated states:
- *
- * - Licensed: full form.
- * - Unlicensed + unconfigured: section visible but disabled with a "requires
- *   license" note.
- * - Unlicensed + configured ("configured but inactive", e.g. license lapsed):
- *   stored values shown read-only with a disable-only affordance — the only
- *   permitted unlicensed update is turning the stored policy off.
- */
-export const AdminTwoFactorEnforcementSection = () => {
-  const { _, i18n } = useLingui();
-  const { toast } = useToast();
-
-  const { data: enforcementConfig, isLoading } = trpc.admin.getTwoFactorEnforcement.useQuery();
-
-  const utils = trpc.useUtils();
-
-  const { mutateAsync: updateTwoFactorEnforcement, isPending: isUpdatePending } =
-    trpc.admin.updateTwoFactorEnforcement.useMutation();
-
-  const form = useForm<TTwoFactorEnforcementFormSchema>({
-    values: {
-      enabled: enforcementConfig?.enabled ?? false,
-      gracePeriodDays: enforcementConfig?.gracePeriodDays ?? 7,
-      acknowledgeGracePeriodReduction: false,
-    },
-    resolver: zodResolver(ZTwoFactorEnforcementFormSchema),
-  });
-
-  const watchedValues = form.watch();
-
-  const isLicensed = enforcementConfig?.isLicensed ?? false;
-  const isConfiguredButInactive = !isLicensed && (enforcementConfig?.enabled ?? false);
-
-  // Client-side mirror of the server's grace-reduction detection so we can
-  // surface the acknowledgement checkbox before submitting. The server resets
-  // `enforcedFrom` to now on an off→on transition, hence the `new Date()`
-  // anchor when the stored policy is currently disabled.
-  const isGraceReduction =
-    enforcementConfig !== undefined &&
-    isTwoFactorGracePeriodReduction({
-      previous: enforcementConfig.enabled
-        ? {
-            anchors: [enforcementConfig.enforcedFrom ? new Date(enforcementConfig.enforcedFrom) : null],
-            gracePeriodDays: enforcementConfig.gracePeriodDays,
-          }
-        : null,
-      next: watchedValues.enabled
-        ? {
-            anchors: [
-              enforcementConfig.enabled && enforcementConfig.enforcedFrom
-                ? new Date(enforcementConfig.enforcedFrom)
-                : new Date(),
-            ],
-            gracePeriodDays: watchedValues.gracePeriodDays,
-          }
-        : null,
-      now: new Date(),
-    });
-
-  const onUpdate = async (data: {
-    enabled: boolean;
-    gracePeriodDays: number;
-    acknowledgeGracePeriodReduction?: boolean;
-  }) => {
-    try {
-      await updateTwoFactorEnforcement(data);
-
-      await utils.admin.getTwoFactorEnforcement.invalidate();
-
-      toast({
-        title: _(msg`Two-factor enforcement settings updated`),
-      });
-
-      form.setValue('acknowledgeGracePeriodReduction', false);
-    } catch (err) {
-      const error = AppError.parseError(err);
-
-      if (error.code === AppErrorCode.TWO_FACTOR_REQUIRED) {
-        toast({
-          title: _(msg`Two-factor authentication required`),
-          description: _(
-            msg`Enable two-factor authentication on your own account and verify it on this session before requiring it for the instance.`,
-          ),
-          variant: 'destructive',
-        });
-
-        return;
-      }
-
-      if (error.code === AppErrorCode.FORBIDDEN) {
-        toast({
-          title: _(msg`License required`),
-          description: _(
-            msg`Your license does not include instance-wide two-factor enforcement. Only disabling the stored configuration is permitted.`,
-          ),
-          variant: 'destructive',
-        });
-
-        return;
-      }
-
-      toast({
-        title: _(msg`Something went wrong`),
-        description: _(msg`We were unable to update the two-factor enforcement settings. Please try again.`),
-        variant: 'destructive',
-      });
-    }
-  };
-
-  const onSubmit = async (data: TTwoFactorEnforcementFormSchema) => {
-    await onUpdate(data);
-  };
-
-  // Disable-only affordance for the "configured but inactive" state: submits
-  // an enabled→disabled transition with the stored values unchanged, which is
-  // the only unlicensed update the server accepts.
-  const onDisableOnly = async () => {
-    if (!enforcementConfig) {
-      return;
-    }
-
-    await onUpdate({
-      enabled: false,
-      gracePeriodDays: enforcementConfig.gracePeriodDays,
-    });
-  };
-
-  return (
-    <div>
-      <h2 className="font-semibold">
-        <Trans>Instance Two-Factor Enforcement</Trans>
-      </h2>
-      <p className="mt-2 text-muted-foreground text-sm">
-        <Trans>
-          Require every user on this instance, including administrators, to enable two-factor authentication within a
-          grace period.
-        </Trans>
-      </p>
-
-      {isLoading || !enforcementConfig ? (
-        <div className="mt-4 flex justify-center rounded-lg border py-16">
-          <LoaderIcon className="h-6 w-6 animate-spin text-muted-foreground" />
-        </div>
-      ) : (
-        <Form {...form}>
-          <form onSubmit={form.handleSubmit(onSubmit)}>
-            <fieldset disabled={form.formState.isSubmitting || !isLicensed} className="mt-4 flex flex-col gap-y-4">
-              {!isLicensed && !isConfiguredButInactive && (
-                <Alert variant="neutral">
-                  <AlertTitle>
-                    <Trans>Requires a license</Trans>
-                  </AlertTitle>
-                  <AlertDescription>
-                    <Trans>
-                      Instance-wide two-factor enforcement requires a Documenso license that includes this feature.
-                    </Trans>
-                  </AlertDescription>
-                </Alert>
-              )}
-
-              {isConfiguredButInactive && (
-                <Alert variant="warning">
-                  <AlertTitle>
-                    <Trans>Configured but inactive</Trans>
-                  </AlertTitle>
-                  <AlertDescription>
-                    <Trans>
-                      Two-factor enforcement is configured but your current license does not include this feature, so it
-                      is not being enforced. You can disable the stored configuration below; changing it requires a
-                      license.
-                    </Trans>
-                  </AlertDescription>
-                </Alert>
-              )}
-
-              <FormField
-                control={form.control}
-                name="enabled"
-                render={({ field }) => (
-                  <FormItem className="flex flex-row items-center justify-between rounded-lg border p-4">
-                    <div className="space-y-0.5 pr-4">
-                      <FormLabel>
-                        <Trans>Require two-factor authentication</Trans>
-                      </FormLabel>
-                      <FormDescription>
-                        <Trans>
-                          Users who have not enabled two-factor authentication by their deadline are redirected to a
-                          forced enrolment page before they can continue.
-                        </Trans>
-                      </FormDescription>
-                    </div>
-                    <FormControl>
-                      <Switch checked={field.value} onCheckedChange={field.onChange} />
-                    </FormControl>
-                  </FormItem>
-                )}
-              />
-
-              <FormField
-                control={form.control}
-                name="gracePeriodDays"
-                render={({ field }) => (
-                  <FormItem>
-                    <FormLabel>
-                      <Trans>Grace period (days)</Trans>
-                    </FormLabel>
-                    <FormControl>
-                      <Input type="number" min={0} max={365} {...field} />
-                    </FormControl>
-                    <FormDescription>
-                      <Trans>
-                        Number of days a user has to enable two-factor authentication. 0 forces enrolment immediately
-                        after signing up or signing in.
-                      </Trans>
-                    </FormDescription>
-                    <FormMessage />
-                  </FormItem>
-                )}
-              />
-
-              {enforcementConfig.isActive && enforcementConfig.enforcedFrom && (
-                <p className="text-muted-foreground text-sm">
-                  <Trans>
-                    Enforcement has been active since{' '}
-                    {i18n.date(new Date(enforcementConfig.enforcedFrom), { dateStyle: 'long' })}.
-                  </Trans>
-                </p>
-              )}
-
-              <Alert variant="neutral">
-                <AlertDescription>
-                  <Trans>
-                    API tokens are exempt: tokens minted before a user's deadline keep working after it. Blocked users
-                    cannot mint new tokens.
-                  </Trans>
-                </AlertDescription>
-              </Alert>
-
-              {isGraceReduction && (
-                <Alert variant="warning">
-                  <AlertTitle>
-                    <Trans>This change reduces an active grace period</Trans>
-                  </AlertTitle>
-                  <AlertDescription className="flex flex-col gap-y-3">
-                    <Trans>
-                      Users who have not yet enabled two-factor authentication will have less time to comply — possibly
-                      none, which blocks their access immediately.
-                    </Trans>
-
-                    <FormField
-                      control={form.control}
-                      name="acknowledgeGracePeriodReduction"
-                      render={({ field }) => (
-                        <FormItem className="flex flex-row items-center gap-x-2 space-y-0">
-                          <FormControl>
-                            <Checkbox
-                              checked={field.value}
-                              onCheckedChange={(checked) => field.onChange(checked === true)}
-                            />
-                          </FormControl>
-                          <FormLabel className="font-normal">
-                            <Trans>I understand that this reduces the remaining grace period for users</Trans>
-                          </FormLabel>
-                        </FormItem>
-                      )}
-                    />
-                  </AlertDescription>
-                </Alert>
-              )}
-
-              <div className="flex justify-end">
-                <Button
-                  type="submit"
-                  loading={form.formState.isSubmitting}
-                  disabled={isGraceReduction && !watchedValues.acknowledgeGracePeriodReduction}
-                >
-                  <Trans>Update</Trans>
-                </Button>
-              </div>
-            </fieldset>
-
-            {isConfiguredButInactive && (
-              <div className="mt-4 flex justify-end">
-                <Button type="button" variant="destructive" loading={isUpdatePending} onClick={onDisableOnly}>
-                  <Trans>Disable enforcement</Trans>
-                </Button>
-              </div>
-            )}
-          </form>
-        </Form>
-      )}
-    </div>
-  );
-};

apps/remix/app/components/general/app-command-menu.tsx

@@ -1,6 +1,5 @@
 import { useDebouncedValue } from '@documenso/lib/client-only/hooks/use-debounced-value';
 import { useSession } from '@documenso/lib/client-only/providers/session';
-import { formatPath } from '@documenso/lib/constants/app';
 import { SUPPORTED_LANGUAGES } from '@documenso/lib/constants/i18n';
 import {
   DOCUMENTS_PAGE_SHORTCUT,
@@ -17,9 +16,9 @@ import { useToast } from '@documenso/ui/primitives/use-toast';
 import type { MessageDescriptor } from '@lingui/core';
 import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
-import { Plural, Trans } from '@lingui/react/macro';
+import { Trans } from '@lingui/react/macro';
 import { keepPreviousData } from '@tanstack/react-query';
-import { defaultFilter as commandScore } from 'cmdk';
+import { commandScore } from 'cmdk/dist/command-score';
 import {
   ArrowLeftIcon,
   CheckIcon,
@@ -596,21 +595,9 @@ export const AppCommandMenu = ({ open, onOpenChange }: AppCommandMenuProps) => {
 
             <span className="ml-auto text-muted-foreground text-xs">
               {hasValidSearch ? (
-                isVisibleCountCapped ? (
-                  <Trans>{formatChipCount(totalVisibleCount, isVisibleCountCapped)} results</Trans>
-                ) : (
-                  <Plural
-                    value={totalVisibleCount}
-                    one="# result"
-                    other="# results"
-                  />
-                )
+                <Trans>{formatChipCount(totalVisibleCount, isVisibleCountCapped)} results</Trans>
               ) : (
-                <Plural
-                  value={totalVisibleCount}
-                  one="# item"
-                  other="# items"
-                />
+                <Trans>{totalVisibleCount} items</Trans>
               )}
             </span>
           </div>
@@ -875,7 +862,7 @@ const PromptLanguageCommands = ({
 
       formData.append('lang', lang);
 
-      const response = await fetch(formatPath('/api/locale'), {
+      const response = await fetch('/api/locale', {
         method: 'post',
         body: formData,
       });

apps/remix/app/components/general/direct-template/direct-template-page.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { RECIPIENT_ROLES_DESCRIPTION } from '@documenso/lib/constants/recipient-roles';
 import { AppError } from '@documenso/lib/errors/app-error';
 import type { TTemplate } from '@documenso/lib/types/template';
@@ -42,7 +41,6 @@ export const DirectTemplatePageView = ({
 
   const { _ } = useLingui();
   const { toast } = useToast();
-  const analytics = useAnalytics();
 
   const { email, fullName, setEmail } = useRequiredDocumentSigningContext();
   const { recipient, setRecipient } = useRequiredDocumentSigningAuthContext();
@@ -126,13 +124,6 @@ export const DirectTemplatePageView = ({
       const error = AppError.parseError(err);
       const errorMessage = getDirectTemplateErrorMessage(error.code);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'direct_template',
-        recipientId: directTemplateRecipient.id,
-        envelopeId: template.envelopeId,
-      });
-
       toast({
         title: _(errorMessage.title),
         description: _(errorMessage.description),

apps/remix/app/components/general/document-signing/document-signing-auth-account.tsx

@@ -1,5 +1,4 @@
 import { authClient } from '@documenso/auth/client';
-import { formatPath } from '@documenso/lib/constants/app';
 import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
 import { Button } from '@documenso/ui/primitives/button';
 import { DialogFooter } from '@documenso/ui/primitives/dialog';
@@ -35,9 +34,7 @@ export const DocumentSigningAuthAccount = ({
       const currentPath = `${window.location.pathname}${window.location.search}${window.location.hash}`;
 
       await authClient.signOut({
-        redirectPath: formatPath(
-          `/signin?returnTo=${encodeURIComponent(currentPath)}#embedded=true&email=${isDirectTemplate ? '' : email}`,
-        ),
+        redirectPath: `/signin?returnTo=${encodeURIComponent(currentPath)}#embedded=true&email=${isDirectTemplate ? '' : email}`,
       });
     } catch {
       setIsSigningOut(false);

apps/remix/app/components/general/document-signing/document-signing-auth-page.tsx

@@ -1,5 +1,4 @@
 import { authClient } from '@documenso/auth/client';
-import { formatPath } from '@documenso/lib/constants/app';
 import { Button } from '@documenso/ui/primitives/button';
 import { useToast } from '@documenso/ui/primitives/use-toast';
 import { msg } from '@lingui/core/macro';
@@ -22,10 +21,10 @@ export const DocumentSigningAuthPageView = ({ email, emailHasAccount }: Document
     try {
       setIsSigningOut(true);
 
-      let redirectPath = formatPath('/signin');
+      let redirectPath = '/signin';
 
       if (email) {
-        redirectPath = emailHasAccount ? formatPath(`/signin#email=${email}`) : formatPath(`/signup#email=${email}`);
+        redirectPath = emailHasAccount ? `/signin#email=${email}` : `/signup#email=${email}`;
       }
 
       await authClient.signOut({

apps/remix/app/components/general/document-signing/document-signing-auth-password.tsx

@@ -1,7 +1,5 @@
 import { AppError } from '@documenso/lib/errors/app-error';
 import { DocumentAuth, type TRecipientActionAuth } from '@documenso/lib/types/document-auth';
-import { UserAuthMethod } from '@documenso/lib/types/user-auth-method';
-import { trpc } from '@documenso/trpc/react';
 import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
 import { Button } from '@documenso/ui/primitives/button';
 import { DialogFooter } from '@documenso/ui/primitives/dialog';
@@ -9,13 +7,11 @@ import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '
 import { Input } from '@documenso/ui/primitives/input';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { Trans, useLingui } from '@lingui/react/macro';
-import { Loader2Icon } from 'lucide-react';
 import { useEffect, useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { z } from 'zod';
 
 import { useRequiredDocumentSigningAuthContext } from './document-signing-auth-provider';
-import { DocumentSigningAuthSetPassword } from './document-signing-auth-set-password';
 
 export type DocumentSigningAuthPasswordProps = {
   open: boolean;
@@ -39,12 +35,8 @@ export const DocumentSigningAuthPassword = ({
 }: DocumentSigningAuthPasswordProps) => {
   const { t } = useLingui();
 
-  const { user, isCurrentlyAuthenticating, setIsCurrentlyAuthenticating } = useRequiredDocumentSigningAuthContext();
-
-  // Fetched on demand since this is only needed once the user opts for password auth.
-  const { data: authMethodsData, isPending: isAuthMethodsPending } = trpc.auth.getAuthMethods.useQuery(undefined, {
-    enabled: !!user,
-  });
+  const { recipient, isCurrentlyAuthenticating, setIsCurrentlyAuthenticating } =
+    useRequiredDocumentSigningAuthContext();
 
   const form = useForm<TPasswordAuthFormSchema>({
     resolver: zodResolver(ZPasswordAuthFormSchema),
@@ -55,10 +47,6 @@ export const DocumentSigningAuthPassword = ({
 
   const [formErrorCode, setFormErrorCode] = useState<string | null>(null);
 
-  // If the query fails we fall through to the regular password form rather than blocking.
-  const isPasswordSetupRequired =
-    !!user && !!authMethodsData && !authMethodsData.authMethods.includes(UserAuthMethod.PASSWORD);
-
   const onFormSubmit = async ({ password }: TPasswordAuthFormSchema) => {
     try {
       setIsCurrentlyAuthenticating(true);
@@ -76,6 +64,8 @@ export const DocumentSigningAuthPassword = ({
 
       const error = AppError.parseError(err);
       setFormErrorCode(error.code);
+
+      // Todo: Alert.
     }
   };
 
@@ -89,22 +79,9 @@ export const DocumentSigningAuthPassword = ({
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [open]);
 
-  if (user && isAuthMethodsPending) {
-    return (
-      <div className="flex items-center justify-center py-8">
-        <Loader2Icon className="h-6 w-6 animate-spin text-muted-foreground" />
-      </div>
-    );
-  }
-
-  if (isPasswordSetupRequired) {
-    return <DocumentSigningAuthSetPassword onOpenChange={onOpenChange} />;
-  }
-
   return (
     <Form {...form}>
-      {/* method="post" so a pre-hydration native submit can't leak the password into the URL. */}
-      <form method="post" onSubmit={form.handleSubmit(onFormSubmit)}>
+      <form onSubmit={form.handleSubmit(onFormSubmit)}>
         <fieldset disabled={isCurrentlyAuthenticating}>
           <div className="space-y-4">
             {formErrorCode && (

apps/remix/app/components/general/document-signing/document-signing-auth-set-password.tsx

@@ -1,63 +0,0 @@
-import { isSigninEnabledForProvider } from '@documenso/lib/constants/auth';
-import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
-import { Button } from '@documenso/ui/primitives/button';
-import { DialogFooter } from '@documenso/ui/primitives/dialog';
-import { Trans } from '@lingui/react/macro';
-
-import { PasswordSetupRequest } from '~/components/forms/password-setup-request';
-
-export type DocumentSigningAuthSetPasswordProps = {
-  onOpenChange: (value: boolean) => void;
-};
-
-/**
- * Shown in place of the password reauth form when the signed in user has no
- * password (e.g. they signed up via OAuth or a passkey).
- *
- * Password based action auth is meant to prove more than possession of a session,
- * so rather than letting the session set a password inline we send the user the
- * verified reset link and ask them to come back.
- */
-export const DocumentSigningAuthSetPassword = ({ onOpenChange }: DocumentSigningAuthSetPasswordProps) => {
-  const isEmailPasswordSigninEnabled = isSigninEnabledForProvider('email');
-
-  return (
-    <div className="space-y-4">
-      {isEmailPasswordSigninEnabled ? (
-        <>
-          <Alert variant="neutral">
-            <AlertTitle>
-              <Trans>No password set</Trans>
-            </AlertTitle>
-            <AlertDescription>
-              <Trans>
-                Signing this field requires a password, but your account does not have one. We can email you a link to
-                set one. Once done, sign in again and return to this document to continue.
-              </Trans>
-            </AlertDescription>
-          </Alert>
-
-          <PasswordSetupRequest />
-        </>
-      ) : (
-        <Alert variant="warning">
-          <AlertTitle>
-            <Trans>Password authentication unavailable</Trans>
-          </AlertTitle>
-          <AlertDescription>
-            <Trans>
-              Your account does not have a password and password sign in is disabled for this instance. Please contact
-              the document sender to use a different authentication method.
-            </Trans>
-          </AlertDescription>
-        </Alert>
-      )}
-
-      <DialogFooter>
-        <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
-          <Trans>Close</Trans>
-        </Button>
-      </DialogFooter>
-    </div>
-  );
-};

apps/remix/app/components/general/document-signing/document-signing-checkbox-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -40,7 +39,6 @@ export const DocumentSigningCheckboxField = ({
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { recipient, isAssistantMode } = useDocumentSigningRecipientContext();
 
@@ -128,13 +126,6 @@ export const DocumentSigningCheckboxField = ({
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -166,13 +157,6 @@ export const DocumentSigningCheckboxField = ({
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),
@@ -232,13 +216,6 @@ export const DocumentSigningCheckboxField = ({
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while updating the signature.`),

apps/remix/app/components/general/document-signing/document-signing-complete-dialog.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { type TRecipientAccessAuth, ZDocumentAccessAuthSchema } from '@documenso/lib/types/document-auth';
 import { fieldsContainUnsignedRequiredField } from '@documenso/lib/utils/advanced-fields-helpers';
@@ -15,7 +14,6 @@ import {
 } from '@documenso/ui/primitives/dialog';
 import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '@documenso/ui/primitives/form/form';
 import { Input } from '@documenso/ui/primitives/input';
-import { useToast } from '@documenso/ui/primitives/use-toast';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { Trans, useLingui } from '@lingui/react/macro';
 import type { Field, Recipient } from '@prisma/client';
@@ -29,8 +27,6 @@ import { useEmbedSigningContext } from '~/components/embed/embed-signing-context
 import { AccessAuth2FAForm } from '~/components/general/document-signing/access-auth-2fa-form';
 import { DocumentSigningDisclosure } from '~/components/general/document-signing/document-signing-disclosure';
 
-import { getSigningCompletionErrorMessage } from '~/utils/toast-error-messages';
-
 import { useRequiredDocumentSigningAuthContext } from './document-signing-auth-provider';
 
 export type DocumentSigningCompleteDialogProps = {
@@ -89,9 +85,7 @@ export const DocumentSigningCompleteDialog = ({
   position,
   disableNameInput = false,
 }: DocumentSigningCompleteDialogProps) => {
-  const analytics = useAnalytics();
-  const { t, i18n } = useLingui();
-  const { toast } = useToast();
+  const { t } = useLingui();
 
   const [showDialog, setShowDialog] = useState(false);
 
@@ -180,23 +174,6 @@ export const DocumentSigningCompleteDialog = ({
 
         return;
       }
-
-      analytics.captureException(error, {
-        source: 'signing',
-        location: 'complete_document',
-      });
-
-      // This dialog owns the completion error toast for every signing surface
-      // so the user gets a specific, actionable message. Callers should run
-      // their own side effects (e.g. embeds posting document-error) and
-      // rethrow rather than toasting themselves.
-      const toastMessage = getSigningCompletionErrorMessage(err.code);
-
-      toast({
-        title: i18n._(toastMessage.title),
-        description: i18n._(toastMessage.description),
-        variant: 'destructive',
-      });
     }
   };
 

apps/remix/app/components/general/document-signing/document-signing-date-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { convertToLocalSystemFormat, DEFAULT_DOCUMENT_DATE_FORMAT } from '@documenso/lib/constants/date-formats';
 import { DEFAULT_DOCUMENT_TIME_ZONE } from '@documenso/lib/constants/time-zones';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
@@ -40,7 +39,6 @@ export const DocumentSigningDateField = ({
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { recipient, isAssistantMode } = useDocumentSigningRecipientContext();
 
@@ -87,13 +85,6 @@ export const DocumentSigningDateField = ({
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -122,13 +113,6 @@ export const DocumentSigningDateField = ({
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),

apps/remix/app/components/general/document-signing/document-signing-dropdown-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -36,7 +35,6 @@ export const DocumentSigningDropdownField = ({
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { recipient, isAssistantMode } = useDocumentSigningRecipientContext();
 
@@ -88,13 +86,6 @@ export const DocumentSigningDropdownField = ({
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -129,13 +120,6 @@ export const DocumentSigningDropdownField = ({
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),

apps/remix/app/components/general/document-signing/document-signing-email-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -34,7 +33,6 @@ export const DocumentSigningEmailField = ({ field, onSignField, onUnsignField }:
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { email: providedEmail } = useRequiredDocumentSigningContext();
 
@@ -80,13 +78,6 @@ export const DocumentSigningEmailField = ({ field, onSignField, onUnsignField }:
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -115,13 +106,6 @@ export const DocumentSigningEmailField = ({ field, onSignField, onUnsignField }:
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),

apps/remix/app/components/general/document-signing/document-signing-form.tsx

@@ -1,4 +1,3 @@
-import { AppError } from '@documenso/lib/errors/app-error';
 import type { DocumentAndSender } from '@documenso/lib/server-only/document/get-document-by-token';
 import type { TRecipientAccessAuth } from '@documenso/lib/types/document-auth';
 import { isFieldUnsignedAndRequired } from '@documenso/lib/utils/advanced-fields-helpers';
@@ -20,8 +19,6 @@ import { useId, useMemo, useState } from 'react';
 import { Controller, useForm } from 'react-hook-form';
 import { useNavigate } from 'react-router';
 
-import { getSigningCompletionErrorMessage } from '~/utils/toast-error-messages';
-
 import { AssistantConfirmationDialog, type NextSigner } from '../../dialogs/assistant-confirmation-dialog';
 import { DocumentSigningCompleteDialog } from './document-signing-complete-dialog';
 import { useRequiredDocumentSigningContext } from './document-signing-provider';
@@ -103,12 +100,9 @@ export const DocumentSigningForm = ({
     try {
       await completeDocument({ nextSigner });
     } catch (err) {
-      const error = AppError.parseError(err);
-      const toastMessage = getSigningCompletionErrorMessage(error.code);
-
       toast({
-        title: _(toastMessage.title),
-        description: _(toastMessage.description),
+        title: _(msg`Error`),
+        description: _(msg`An error occurred while completing the document. Please try again.`),
         variant: 'destructive',
       });
 

apps/remix/app/components/general/document-signing/document-signing-initials-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -39,7 +38,6 @@ export const DocumentSigningInitialsField = ({
   const { toast } = useToast();
   const { _ } = useLingui();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { fullName } = useRequiredDocumentSigningContext();
   const { recipient, isAssistantMode } = useDocumentSigningRecipientContext();
@@ -86,13 +84,6 @@ export const DocumentSigningInitialsField = ({
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -121,13 +112,6 @@ export const DocumentSigningInitialsField = ({
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),

apps/remix/app/components/general/document-signing/document-signing-name-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -40,7 +39,6 @@ export const DocumentSigningNameField = ({ field, onSignField, onUnsignField }:
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { fullName: providedFullName, setFullName: setProvidedFullName } = useRequiredDocumentSigningContext();
 
@@ -118,13 +116,6 @@ export const DocumentSigningNameField = ({ field, onSignField, onUnsignField }:
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -153,13 +144,6 @@ export const DocumentSigningNameField = ({ field, onSignField, onUnsignField }:
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),

apps/remix/app/components/general/document-signing/document-signing-number-field.tsx

@@ -1,5 +1,4 @@
 import { validateNumberField } from '@documenso/lib/advanced-fields-validation/validate-number';
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -48,7 +47,6 @@ export const DocumentSigningNumberField = ({ field, onSignField, onUnsignField }
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { recipient, isAssistantMode } = useDocumentSigningRecipientContext();
 
@@ -144,13 +142,6 @@ export const DocumentSigningNumberField = ({ field, onSignField, onUnsignField }
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -202,13 +193,6 @@ export const DocumentSigningNumberField = ({ field, onSignField, onUnsignField }
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),

apps/remix/app/components/general/document-signing/document-signing-page-view-v1.tsx

@@ -1,3 +1,4 @@
+import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DEFAULT_DOCUMENT_DATE_FORMAT } from '@documenso/lib/constants/date-formats';
 import { PDF_VIEWER_PAGE_SELECTOR } from '@documenso/lib/constants/pdf-viewer';
 import { DEFAULT_DOCUMENT_TIME_ZONE } from '@documenso/lib/constants/time-zones';
@@ -82,6 +83,8 @@ export const DocumentSigningPageViewV1 = ({
     ? authUser.twoFactorEnabled && authUser.email === recipient.email
     : false;
 
+  const analytics = useAnalytics();
+
   const [selectedSignerId, setSelectedSignerId] = useState<number | null>(allRecipients?.[0]?.id);
   const [isExpanded, setIsExpanded] = useState(false);
 
@@ -115,6 +118,12 @@ export const DocumentSigningPageViewV1 = ({
 
     await completeDocumentWithToken(payload);
 
+    analytics.capture('App: Recipient has completed signing', {
+      signerId: recipient.id,
+      documentId: document.id,
+      timestamp: new Date().toISOString(),
+    });
+
     if (documentMeta?.redirectUrl) {
       window.location.href = documentMeta.redirectUrl;
     } else {

apps/remix/app/components/general/document-signing/document-signing-radio-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -32,7 +31,6 @@ export const DocumentSigningRadioField = ({ field, onSignField, onUnsignField }:
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { recipient, targetSigner, isAssistantMode } = useDocumentSigningRecipientContext();
 
@@ -93,13 +91,6 @@ export const DocumentSigningRadioField = ({ field, onSignField, onUnsignField }:
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -129,13 +120,6 @@ export const DocumentSigningRadioField = ({ field, onSignField, onUnsignField }:
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the selection.`),
@@ -162,17 +146,14 @@ export const DocumentSigningRadioField = ({ field, onSignField, onUnsignField }:
       {isLoading && <DocumentSigningFieldsLoader />}
 
       {!field.inserted && (
-        <RadioGroup
-          value={selectedOption}
-          onValueChange={(value) => handleSelectItem(value)}
-          className="z-10 my-0.5 gap-y-1"
-        >
+        <RadioGroup onValueChange={(value) => handleSelectItem(value)} className="z-10 my-0.5 gap-y-1">
           {values?.map((item, index) => (
             <div key={index} className="flex items-center">
               <RadioGroupItem
                 className="h-3 w-3 shrink-0"
                 value={item.value}
                 id={`option-${field.id}-${item.id}`}
+                checked={item.checked}
                 disabled={isReadOnly}
               />
               {!item.value.includes('empty-value-') && item.value && (
@@ -186,13 +167,14 @@ export const DocumentSigningRadioField = ({ field, onSignField, onUnsignField }:
       )}
 
       {field.inserted && (
-        <RadioGroup value={field.customText ?? ''} className="my-0.5 gap-y-1">
+        <RadioGroup className="my-0.5 gap-y-1">
           {values?.map((item, index) => (
             <div key={index} className="flex items-center">
               <RadioGroupItem
                 className="h-3 w-3"
                 value={item.value}
                 id={`option-${field.id}-${item.id}`}
+                checked={item.value === field.customText}
                 disabled={isReadOnly}
               />
               {!item.value.includes('empty-value-') && item.value && (

apps/remix/app/components/general/document-signing/document-signing-reject-dialog.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { trpc } from '@documenso/trpc/react';
 import { Button } from '@documenso/ui/primitives/button';
 import {
@@ -42,7 +41,6 @@ export function DocumentSigningRejectDialog({
 }: DocumentSigningRejectDialogProps) {
   const { t } = useLingui();
   const { toast } = useToast();
-  const analytics = useAnalytics();
   const [searchParams] = useSearchParams();
 
   const [isOpen, setIsOpen] = useState(false);
@@ -78,12 +76,6 @@ export function DocumentSigningRejectDialog({
         window.location.href = `/sign/${token}/rejected`;
       }
     } catch (err) {
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'reject_document',
-        documentId,
-      });
-
       toast({
         title: t`Error`,
         description: t`An error occurred while rejecting the document. Please try again.`,

apps/remix/app/components/general/document-signing/document-signing-signature-field.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -48,7 +47,6 @@ export const DocumentSigningSignatureField = ({
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { recipient } = useDocumentSigningRecipientContext();
 
@@ -159,13 +157,6 @@ export const DocumentSigningSignatureField = ({
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while signing the document.`),
@@ -192,13 +183,6 @@ export const DocumentSigningSignatureField = ({
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the signature.`),

apps/remix/app/components/general/document-signing/document-signing-text-field.tsx

@@ -1,5 +1,4 @@
 import { validateTextField } from '@documenso/lib/advanced-fields-validation/validate-text';
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { TRecipientActionAuth } from '@documenso/lib/types/document-auth';
@@ -51,7 +50,6 @@ export const DocumentSigningTextField = ({ field, onSignField, onUnsignField }:
   const { _ } = useLingui();
   const { toast } = useToast();
   const { revalidate } = useRevalidator();
-  const analytics = useAnalytics();
 
   const { recipient, isAssistantMode } = useDocumentSigningRecipientContext();
 
@@ -172,13 +170,6 @@ export const DocumentSigningTextField = ({ field, onSignField, onUnsignField }:
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: isAssistantMode
@@ -209,13 +200,6 @@ export const DocumentSigningTextField = ({ field, onSignField, onUnsignField }:
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'remove_field',
-        fieldType: field.type,
-        recipientId: field.recipientId,
-      });
-
       toast({
         title: _(msg`Error`),
         description: _(msg`An error occurred while removing the field.`),

apps/remix/app/components/general/document/document-edit-form.tsx

@@ -28,7 +28,6 @@ import { useNavigate, useSearchParams } from 'react-router';
 import { z } from 'zod';
 import PDFViewerLazy from '~/components/general/pdf-viewer/pdf-viewer-lazy';
 import { useCurrentTeam } from '~/providers/team';
-import { useCspNonce } from '~/utils/nonce';
 import { getDistributeErrorMessage } from '~/utils/toast-error-messages';
 
 export type DocumentEditFormProps = {
@@ -43,7 +42,6 @@ const EditDocumentSteps: EditDocumentStep[] = ['settings', 'signers', 'fields',
 export const DocumentEditForm = ({ className, initialDocument, documentRootPath }: DocumentEditFormProps) => {
   const { toast } = useToast();
   const { _ } = useLingui();
-  const cspNonce = useCspNonce();
 
   const navigate = useNavigate();
 
@@ -475,7 +473,6 @@ export const DocumentEditForm = ({ className, initialDocument, documentRootPath
               onSubmit={onAddSignersFormSubmit}
               onAutoSave={onAddSignersFormAutoSave}
               isDocumentPdfLoaded={isDocumentPdfLoaded}
-              nonce={cspNonce}
             />
 
             <AddFieldsFormPartial

apps/remix/app/components/general/document/document-upload-button-legacy.tsx

@@ -1,4 +1,5 @@
 import { useLimits } from '@documenso/ee/server-only/limits/provider/client';
+import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
 import { useSession } from '@documenso/lib/client-only/providers/session';
 import { DEFAULT_DOCUMENT_TIME_ZONE, TIME_ZONES } from '@documenso/lib/constants/time-zones';
@@ -37,6 +38,7 @@ export const DocumentUploadButtonLegacy = ({ className, type }: DocumentUploadBu
   const team = useCurrentTeam();
 
   const navigate = useNavigate();
+  const analytics = useAnalytics();
   const organisation = useCurrentOrganisation();
 
   const userTimezone =
@@ -101,6 +103,12 @@ export const DocumentUploadButtonLegacy = ({ className, type }: DocumentUploadBu
           description: _(msg`Your document has been uploaded successfully.`),
           duration: 5000,
         });
+
+        analytics.capture('App: Document Uploaded', {
+          userId: user.id,
+          documentId: id,
+          timestamp: new Date().toISOString(),
+        });
       }
 
       // Handle legacy template creation.

apps/remix/app/components/general/envelope-editor/envelope-editor-fields-page-renderer.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { useDebouncedValue } from '@documenso/lib/client-only/hooks/use-debounced-value';
 import type { TLocalField } from '@documenso/lib/client-only/hooks/use-editor-fields';
 import { usePageRenderer } from '@documenso/lib/client-only/hooks/use-page-renderer';
@@ -38,12 +37,8 @@ import { useEffect, useMemo, useRef, useState } from 'react';
 import { fieldButtonList } from './envelope-editor-fields-drag-drop';
 import { EnvelopeRecipientSelectorCommand } from './envelope-recipient-selector';
 
-/** How far past a resize handle you can still grab it, in screen pixels. */
-const TRANSFORMER_ANCHOR_HIT_STROKE_PX = 24;
-
 export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageRenderData }) => {
   const { t, i18n } = useLingui();
-  const analytics = useAnalytics();
   const { envelope, editorFields, getRecipientColorKey } = useCurrentEnvelopeEditor();
   const { currentEnvelopeItem, setRenderError } = useCurrentEnvelopeRender();
 
@@ -281,13 +276,6 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
       unsafeRenderFieldOnLayer(field);
     } catch (err) {
       console.error(err);
-
-      analytics.captureException(err, {
-        source: 'editor',
-        location: 'envelope_page_render',
-        envelopeId: envelope.id,
-      });
-
       setRenderError(true);
     }
   };
@@ -362,9 +350,6 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
       shouldOverdrawWholeArea: true,
       ignoreStroke: true,
       flipEnabled: false,
-      anchorStyleFunc: (anchor) => {
-        anchor.hitStrokeWidth(TRANSFORMER_ANCHOR_HIT_STROKE_PX / scale);
-      },
       boundBoxFunc: (oldBox, newBox) => {
         // Enforce minimum size
         if (newBox.width < 30 || newBox.height < 20) {

apps/remix/app/components/general/envelope-editor/envelope-editor-recipient-form.tsx

@@ -45,7 +45,6 @@ import { isDeepEqual } from 'remeda';
 import { AiFeaturesEnableDialog } from '~/components/dialogs/ai-features-enable-dialog';
 import { AiRecipientDetectionDialog } from '~/components/dialogs/ai-recipient-detection-dialog';
 import { useCurrentTeam } from '~/providers/team';
-import { useCspNonce } from '~/utils/nonce';
 
 export const EnvelopeEditorRecipientForm = () => {
   const { envelope, setRecipientsDebounced, updateEnvelope, editorRecipients, isEmbedded, editorConfig } =
@@ -53,7 +52,6 @@ export const EnvelopeEditorRecipientForm = () => {
 
   const organisation = useCurrentOrganisation();
   const team = useCurrentTeam();
-  const cspNonce = useCspNonce();
 
   const { t } = useLingui();
   const { toast } = useToast();
@@ -797,7 +795,6 @@ export const EnvelopeEditorRecipientForm = () => {
           </div>
 
           <DragDropContext
-            nonce={cspNonce}
             onDragEnd={onDragEnd}
             sensors={[
               (api: SensorAPI) => {

apps/remix/app/components/general/envelope-editor/envelope-editor-upload-page.tsx

@@ -1,5 +1,4 @@
 import { useLimits } from '@documenso/ee/server-only/limits/provider/client';
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { useEnvelopeAutosave } from '@documenso/lib/client-only/hooks/use-envelope-autosave';
 import { useCurrentEnvelopeEditor } from '@documenso/lib/client-only/providers/envelope-editor-provider';
 import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
@@ -26,7 +25,6 @@ import { useEffect, useMemo, useRef, useState } from 'react';
 import { ErrorCode as DropzoneErrorCode, type FileRejection, useDropzone } from 'react-dropzone';
 
 import { EnvelopeItemDeleteDialog } from '~/components/dialogs/envelope-item-delete-dialog';
-import { useCspNonce } from '~/utils/nonce';
 
 import { EnvelopeEditorInvalidDirectTemplateAlert } from './envelope-editor-invalid-direct-template-alert';
 import { EnvelopeEditorRecipientForm } from './envelope-editor-recipient-form';
@@ -43,12 +41,10 @@ type LocalFile = {
 
 export const EnvelopeEditorUploadPage = () => {
   const organisation = useCurrentOrganisation();
-  const cspNonce = useCspNonce();
 
   const { t, i18n } = useLingui();
   const { maximumEnvelopeItemCount, remaining } = useLimits();
   const { toast } = useToast();
-  const analytics = useAnalytics();
 
   const {
     envelope,
@@ -217,12 +213,6 @@ export const EnvelopeEditorUploadPage = () => {
     const { data } = await createPromise.catch((error) => {
       console.error(error);
 
-      analytics.captureException(error, {
-        source: isEmbedded ? 'embed' : 'editor',
-        location: 'create_envelope_items',
-        envelopeId: envelope.id,
-      });
-
       // Set error state on files in batch upload.
       setLocalFiles((prev) =>
         prev.map((uploadingFile) =>
@@ -300,12 +290,6 @@ export const EnvelopeEditorUploadPage = () => {
     } catch (error) {
       console.error(error);
 
-      analytics.captureException(error, {
-        source: isEmbedded ? 'embed' : 'editor',
-        location: 'replace_pdf',
-        envelopeId: envelope.id,
-      });
-
       toast({
         title: t`Replace failed`,
         description: t`Something went wrong while replacing the PDF`,
@@ -496,7 +480,7 @@ export const EnvelopeEditorUploadPage = () => {
 
           {/* Uploaded Files List */}
           <div className="mt-4">
-            <DragDropContext nonce={cspNonce} onDragEnd={onDragEnd}>
+            <DragDropContext onDragEnd={onDragEnd}>
               <Droppable droppableId="files">
                 {(provided) => (
                   <div

apps/remix/app/components/general/envelope-editor/envelope-generic-page-renderer.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { usePageRenderer } from '@documenso/lib/client-only/hooks/use-page-renderer';
 import {
   type PageRenderData,
@@ -19,7 +18,6 @@ type GenericLocalField = TEnvelope['fields'][number] & {
 
 export const EnvelopeGenericPageRenderer = ({ pageData }: { pageData: PageRenderData }) => {
   const { i18n } = useLingui();
-  const analytics = useAnalytics();
 
   const {
     envelopeStatus,
@@ -116,13 +114,6 @@ export const EnvelopeGenericPageRenderer = ({ pageData }: { pageData: PageRender
       unsafeRenderFieldOnLayer(field);
     } catch (err) {
       console.error(err);
-
-      analytics.captureException(err, {
-        source: 'editor',
-        location: 'envelope_page_render',
-        envelopeId: currentEnvelopeItem?.envelopeId,
-      });
-
       setRenderError(true);
     }
   };

apps/remix/app/components/general/envelope-signing/envelope-signer-page-renderer.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { usePageRenderer } from '@documenso/lib/client-only/hooks/use-page-renderer';
 import {
   type PageRenderData,
@@ -54,7 +53,6 @@ export const EnvelopeSignerPageRenderer = ({ pageData }: { pageData: PageRenderD
 
   const { executeActionAuthProcedure } = useRequiredDocumentSigningAuthContext();
   const { toast } = useToast();
-  const analytics = useAnalytics();
 
   const {
     envelopeData,
@@ -428,14 +426,6 @@ export const EnvelopeSignerPageRenderer = ({ pageData }: { pageData: PageRenderD
       unsafeRenderFieldOnLayer(unparsedField, fieldCanvasStyleCache);
     } catch (err) {
       console.error(err);
-
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'page_render',
-        recipientId: recipient.id,
-        envelopeId: envelope.id,
-      });
-
       setRenderError(true);
     }
   };
@@ -517,14 +507,6 @@ export const EnvelopeSignerPageRenderer = ({ pageData }: { pageData: PageRenderD
     } catch (err) {
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'sign_field',
-        fieldType: payload.type,
-        recipientId: recipient.id,
-        envelopeId: envelope.id,
-      });
-
       toast({
         title: t`Error`,
         description: t`An error occurred while signing the field.`,

apps/remix/app/components/general/envelope-signing/envelope-signing-complete-dialog.tsx

@@ -118,6 +118,12 @@ export const EnvelopeSignerCompleteDialog = () => {
           title: t`Document already signed`,
           description: t`This document was already signed and no further action was taken.`,
         });
+      } else {
+        analytics.capture('App: Recipient has completed signing', {
+          signerId: recipient.id,
+          documentId: envelope.id,
+          timestamp: new Date().toISOString(),
+        });
       }
 
       if (onDocumentCompleted) {
@@ -142,18 +148,15 @@ export const EnvelopeSignerCompleteDialog = () => {
       const error = AppError.parseError(err);
 
       if (error.code !== AppErrorCode.TWO_FACTOR_AUTH_FAILED) {
-        analytics.captureException(err, {
-          source: 'signing',
-          location: 'complete_document',
-          recipientId: recipient.id,
-          envelopeId: envelope.id,
+        toast({
+          title: t`Something went wrong`,
+          description: t`We were unable to submit this document at this time. Please try again later.`,
+          variant: 'destructive',
         });
 
         onDocumentError?.();
       }
 
-      // Rethrow so DocumentSigningCompleteDialog can handle 2FA retries and
-      // toast a specific completion error message.
       throw err;
     }
   };
@@ -221,18 +224,14 @@ export const EnvelopeSignerCompleteDialog = () => {
       }
     } catch (err) {
       console.log('err', err);
-
-      analytics.captureException(err, {
-        source: 'signing',
-        location: 'complete_document_next_signer',
-        recipientId: recipient.id,
-        envelopeId: envelope.id,
+      toast({
+        title: t`Something went wrong`,
+        description: t`We were unable to submit this document at this time. Please try again later.`,
+        variant: 'destructive',
       });
 
       onDocumentError?.();
 
-      // Rethrow so DocumentSigningCompleteDialog can toast a specific
-      // completion error message.
       throw err;
     }
   };

apps/remix/app/components/general/envelope/envelope-drop-zone-wrapper.tsx

@@ -93,6 +93,14 @@ export const EnvelopeDropZoneWrapper = ({ children, type, className }: EnvelopeD
         duration: 5000,
       });
 
+      if (type === EnvelopeType.DOCUMENT) {
+        analytics.capture('App: Document Uploaded', {
+          userId: user.id,
+          documentId: id,
+          timestamp: new Date().toISOString(),
+        });
+      }
+
       const pathPrefix = type === EnvelopeType.DOCUMENT ? formatDocumentsPath(team.url) : formatTemplatesPath(team.url);
 
       const aiQueryParam = team.preferences.aiFeaturesEnabled ? '?ai=true' : '';
@@ -101,11 +109,6 @@ export const EnvelopeDropZoneWrapper = ({ children, type, className }: EnvelopeD
     } catch (err) {
       const error = AppError.parseError(err);
 
-      analytics.captureException(err, {
-        source: 'editor',
-        location: 'upload_document',
-      });
-
       const errorMessage = getUploadErrorMessage(error.code);
 
       toast({

apps/remix/app/components/general/envelope/envelope-upload-button.tsx

@@ -1,5 +1,4 @@
 import { useLimits } from '@documenso/ee/server-only/limits/provider/client';
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
 import { useSession } from '@documenso/lib/client-only/providers/session';
 import { TIME_ZONES } from '@documenso/lib/constants/time-zones';
@@ -35,7 +34,6 @@ export const EnvelopeUploadButton = ({ className, type, folderId }: EnvelopeUplo
   const { t, i18n } = useLingui();
   const { toast } = useToast();
   const { user } = useSession();
-  const analytics = useAnalytics();
 
   const team = useCurrentTeam();
 
@@ -114,11 +112,6 @@ export const EnvelopeUploadButton = ({ className, type, folderId }: EnvelopeUplo
 
       console.error(err);
 
-      analytics.captureException(err, {
-        source: 'editor',
-        location: 'upload_document',
-      });
-
       const errorMessage = getUploadErrorMessage(error.code);
 
       toast({

apps/remix/app/components/general/pdf-viewer/pdf-viewer.tsx

@@ -1,4 +1,3 @@
-import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics';
 import type { ImageLoadingState, PageRenderData } from '@documenso/lib/client-only/providers/envelope-render-provider';
 import { PDF_VIEWER_PAGE_CLASSNAME } from '@documenso/lib/constants/pdf-viewer';
 import { cn } from '@documenso/ui/lib/utils';
@@ -69,7 +68,6 @@ export default function PDFViewer({
 }: PDFViewerProps) {
   const { t } = useLingui();
   const { toast } = useToast();
-  const analytics = useAnalytics();
 
   const $el = useRef<HTMLDivElement>(null);
 
@@ -152,11 +150,6 @@ export default function PDFViewer({
         console.error(err);
         setLoadingState('error');
 
-        analytics.captureException(err, {
-          source: 'pdf_viewer',
-          location: 'pdf_load',
-        });
-
         toast({
           title: t`Error`,
           description: t`An error occurred while loading the document.`,
@@ -222,7 +215,7 @@ export default function PDFViewer({
 
 type VirtualizedPageListProps = {
   scrollParentRef: ScrollTarget;
-  constraintRef: React.RefObject<HTMLDivElement | null>;
+  constraintRef: React.RefObject<HTMLDivElement>;
   pages: PageMeta[];
   numPages: number;
   pdf: pdfjsLib.PDFDocumentProxy;
@@ -373,8 +366,6 @@ const PdfViewerPage = ({
  * Manages rendering a page from a pdf.
  */
 const usePdfPageImage = ({ pageNumber, pdf, scale, scaledWidth, scaledHeight }: PdfViewerPageProps) => {
-  const analytics = useAnalytics();
-
   const [imageLoadingState, setImageLoadingState] = useState<ImageLoadingState>('loading');
 
   const [imageUrl, setImageUrl] = useState('');
@@ -466,12 +457,6 @@ const usePdfPageImage = ({ pageNumber, pdf, scale, scaledWidth, scaledHeight }:
 
         if (!isCancelled) {
           console.error(err);
-
-          analytics.captureException(err, {
-            source: 'pdf_viewer',
-            location: 'pdf_page_render',
-          });
-
           setImageLoadingState('error');
         }
       } finally {

apps/remix/app/components/general/settings-upsell/branding-upsell.tsx

@@ -1,195 +0,0 @@
-import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
-import { Trans } from '@lingui/react/macro';
-import { motion, useReducedMotion } from 'framer-motion';
-
-import { EASE, POP, SPRING } from './motion';
-import { SettingsUpsellCard } from './settings-upsell-card';
-import { useTimedCycle } from './use-timed-cycle';
-
-const DEMO_BRANDS = [
-  {
-    name: 'Documenso',
-    letter: 'D',
-    domain: 'noreply@app.documenso.com',
-    accent: '#A2E771',
-    ink: '#162C07',
-    tint: '#F2FBEA',
-    sheen: 'rgba(162, 231, 113, 0.32)',
-  },
-  {
-    name: 'Documenso',
-    letter: 'D',
-    domain: 'noreply@app.documenso.com',
-    accent: '#387BC7',
-    ink: '#ffffff',
-    tint: '#EDF3FA',
-    sheen: 'rgba(56, 123, 199, 0.28)',
-  },
-  {
-    name: 'Documenso',
-    letter: 'D',
-    domain: 'noreply@app.documenso.com',
-    accent: '#9747F5',
-    ink: '#ffffff',
-    tint: '#F4EDFE',
-    sheen: 'rgba(151, 71, 245, 0.26)',
-  },
-];
-
-/**
- * Milliseconds each brand is shown before cycling to the next.
- */
-const BRAND_CYCLE_INTERVAL_MS = 2400;
-
-export const BrandingUpsell = () => {
-  const organisation = useCurrentOrganisation();
-
-  const isReducedMotion = useReducedMotion();
-  const brandIndex = useTimedCycle(DEMO_BRANDS.map(() => BRAND_CYCLE_INTERVAL_MS));
-
-  const isStatic = isReducedMotion ?? false;
-
-  const brand = DEMO_BRANDS[brandIndex];
-
-  return (
-    <SettingsUpsellCard
-      planLabel={<Trans>Teams</Trans>}
-      title={<Trans>Unlock Branding Preferences</Trans>}
-      description={
-        <Trans>Put your own brand on every document you send. Branding is available on the Teams plan and above.</Trans>
-      }
-      features={[
-        <Trans key="logo">Your logo on signing pages and emails</Trans>,
-        <Trans key="details">Company details and website in email footers</Trans>,
-        <Trans key="teams">Separate branding per team</Trans>,
-      ]}
-      preview={
-        <div className="mx-auto w-full max-w-xs">
-          <div className="flex h-8 items-center justify-between px-1">
-            <span className="font-mono text-[10px] text-muted-foreground uppercase tracking-widest">
-              <Trans>Brand accent</Trans>
-            </span>
-
-            <div className="flex shrink-0 items-center gap-2">
-              {DEMO_BRANDS.map((dotBrand, index) => (
-                <motion.div
-                  key={index}
-                  initial={isStatic ? false : undefined}
-                  animate={{
-                    scale: index === brandIndex ? 1.25 : 1,
-                    opacity: index === brandIndex ? 1 : 0.42,
-                    boxShadow:
-                      index === brandIndex ? '0 0 0 3px rgba(15, 23, 42, 0.08)' : '0 0 0 0 rgba(15, 23, 42, 0)',
-                  }}
-                  transition={SPRING}
-                  className="h-[13px] w-[13px] rounded-full"
-                  style={{ backgroundColor: dotBrand.accent }}
-                />
-              ))}
-            </div>
-          </div>
-
-          <div className="relative mt-3 flex flex-col overflow-hidden rounded-lg border bg-background shadow-sm">
-            <motion.div
-              initial={isStatic ? false : undefined}
-              animate={{ backgroundColor: brand.tint }}
-              transition={{ duration: 0.45, ease: EASE }}
-              className="flex items-center gap-2.5 border-b px-4 py-3"
-            >
-              {/* The sender identity never changes — only the tile colours tween per brand. */}
-              <motion.div
-                initial={isStatic ? false : undefined}
-                animate={{ backgroundColor: brand.accent, color: brand.ink }}
-                transition={{ backgroundColor: { duration: 0.4 }, color: { duration: 0.4 } }}
-                className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg font-semibold text-sm"
-              >
-                {brand.letter}
-              </motion.div>
-
-              {/*
-               * Hardcoded inks (not theme tokens): this row sits on the
-               * hardcoded light `tint` band, so it pairs with hardcoded ink
-               * colours the same way the email sibling pairs its hardcoded
-               * avatar surfaces (hardcoded surface => hardcoded ink).
-               */}
-              <div className="min-w-0">
-                <div className="font-medium text-[#0f172a] text-sm">
-                  <p className="truncate">{brand.name}</p>
-                </div>
-
-                <div className="font-mono text-[#64748b] text-xs">
-                  <p className="truncate">{brand.domain}</p>
-                </div>
-              </div>
-            </motion.div>
-
-            <div className="px-4 py-3.5">
-              <p className="font-medium text-sm">
-                <Trans>Please sign: Example.pdf</Trans>
-              </p>
-
-              <p className="mt-1 text-muted-foreground text-xs">
-                <Trans>{organisation.name} has invited you to sign this document.</Trans>
-              </p>
-
-              {/* Same replay split as the logo tile: colours tween on the persistent button, the pop replays per brand on the remounting label. */}
-              <motion.div
-                initial={isStatic ? false : undefined}
-                animate={{ backgroundColor: brand.accent, color: brand.ink }}
-                transition={{ backgroundColor: { duration: 0.4 }, color: { duration: 0.4 } }}
-                className="mt-3 inline-block rounded-md px-3 py-1.5 font-medium text-xs"
-              >
-                <motion.span
-                  key={brandIndex}
-                  initial={isStatic ? false : { scale: 0.96 }}
-                  animate={{ scale: 1 }}
-                  transition={{ ...POP, delay: 0.06 }}
-                  className="inline-block"
-                >
-                  <Trans>Sign</Trans>
-                </motion.span>
-              </motion.div>
-            </div>
-
-            <div className="mt-auto flex items-center gap-2.5 border-t bg-muted px-4 py-2.5">
-              <span className="font-mono text-[10px] text-muted-foreground uppercase tracking-widest">
-                <Trans>Company details</Trans>
-              </span>
-
-              <motion.div
-                initial={isStatic ? false : undefined}
-                animate={{ backgroundColor: brand.accent }}
-                transition={{ duration: 0.4 }}
-                className="h-1.5 w-[54px] rounded-full"
-                style={{ opacity: 0.45 }}
-              />
-
-              <motion.div
-                initial={isStatic ? false : undefined}
-                animate={{ backgroundColor: brand.accent }}
-                transition={{ duration: 0.4 }}
-                className="h-1.5 w-[34px] rounded-full"
-                style={{ opacity: 0.22 }}
-              />
-            </div>
-
-            {/*
-             * Keyed remount replays the sweep per brand. No opacity envelope —
-             * keyframe arrays are unreliable on strict-mode remounts; both
-             * endpoints sit outside the overflow-hidden card, so the clip
-             * provides the fade in/out instead.
-             */}
-            <motion.div
-              key={`sheen-${brandIndex}`}
-              initial={isStatic ? false : { x: '-130%' }}
-              animate={{ x: '240%' }}
-              transition={{ duration: 1.15, ease: 'easeOut' }}
-              className="pointer-events-none absolute inset-y-0 left-0 w-[55%]"
-              style={{ background: `linear-gradient(105deg, transparent, ${brand.sheen}, transparent)` }}
-            />
-          </div>
-        </div>
-      }
-    />
-  );
-};

apps/remix/app/components/general/settings-upsell/email-domains-upsell.tsx

@@ -1,213 +0,0 @@
-import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
-import { DOCUMENSO_CLOUD_ENTERPRISE_CTA_URL } from '@documenso/lib/constants/app';
-import { formatAvatarUrl } from '@documenso/lib/utils/avatars';
-import { cn } from '@documenso/ui/lib/utils';
-import { Avatar, AvatarFallback, AvatarImage } from '@documenso/ui/primitives/avatar';
-import { Trans } from '@lingui/react/macro';
-import { AnimatePresence, motion, useReducedMotion } from 'framer-motion';
-import { BadgeCheckIcon, MailIcon } from 'lucide-react';
-import { BrandingLogoIcon } from '../branding-logo-icon';
-import { EASE, POP, SPRING } from './motion';
-import { SettingsUpsellCard } from './settings-upsell-card';
-import { useTimedCycle } from './use-timed-cycle';
-
-/**
- * Named sender identities cycled through while the preview is in its branded
- * state — one per branded cycle step, shown as the sender name and address.
- */
-const BRANDED_SENDERS = [
-  { name: 'Support', email: 'support@example.com' },
-  { name: 'Team', email: 'hello@example.com' },
-  { name: 'Sales', email: 'sales@example.com' },
-  { name: 'Example', email: 'noreply@example.com' },
-];
-
-/**
- * How long the initial unbranded (Documenso default) state is shown before
- * the first flip starts. Shown exactly once — the cycle never returns to it.
- */
-const INITIAL_STATE_DURATION_MS = 2500;
-
-/**
- * How long each branded sender identity is shown before cycling to the next,
- * giving the viewer time to read the changed address.
- */
-const BRANDED_STATE_DURATION_MS = 5000;
-
-/**
- * One duration per cycle step: the unbranded state first, then one step per
- * named sender identity, derived from the identity count so the two cannot
- * drift.
- */
-const EMAIL_CYCLE_DURATIONS_MS = [INITIAL_STATE_DURATION_MS, ...BRANDED_SENDERS.map(() => BRANDED_STATE_DURATION_MS)];
-
-export const EmailDomainsUpsell = () => {
-  const organisation = useCurrentOrganisation();
-
-  const isReducedMotion = useReducedMotion();
-
-  // Loop from index 1: the unbranded Documenso intro plays exactly once,
-  // then the cycle rotates through the branded senders only.
-  const cycleIndex = useTimedCycle(EMAIL_CYCLE_DURATIONS_MS, 1);
-
-  const isBranded = cycleIndex > 0;
-  const brandedSender = BRANDED_SENDERS[cycleIndex - 1] ?? BRANDED_SENDERS[0];
-
-  const isStatic = isReducedMotion ?? false;
-
-  return (
-    <SettingsUpsellCard
-      planLabel={<Trans>Enterprise</Trans>}
-      title={<Trans>Unlock Email Domains</Trans>}
-      description={
-        <Trans>Send documents from your own domain. Email domains are available on the Enterprise plan.</Trans>
-      }
-      features={[
-        <Trans key="journey">Send emails to recipients from your domain</Trans>,
-        <Trans key="dns">Easy DNS setup with auto-generated DKIM and SPF records</Trans>,
-        <Trans key="senders">Named senders with defaults per team, template or document</Trans>,
-      ]}
-      ctaLabel={<Trans>Contact Sales</Trans>}
-      ctaTo={DOCUMENSO_CLOUD_ENTERPRISE_CTA_URL}
-      ctaExternal
-      preview={
-        <div className="mx-auto w-full max-w-xs">
-          <div className="relative h-8">
-            <AnimatePresence mode="wait" initial={false}>
-              <motion.div
-                key={isBranded ? 'chip-on' : 'chip-off'}
-                initial={isStatic ? false : { opacity: 0, y: 8, scale: 0.96 }}
-                animate={{ opacity: 1, y: 0, scale: 1 }}
-                exit={{ opacity: 0, y: -8, scale: 0.96 }}
-                transition={SPRING}
-                className={cn(
-                  'absolute inset-0 flex items-center gap-2 rounded-full border bg-background px-3 font-mono text-xs',
-                  isBranded ? 'border-documenso-300 text-documenso-800' : 'text-muted-foreground',
-                )}
-              >
-                {isBranded ? (
-                  <BadgeCheckIcon className="h-3.5 w-3.5 shrink-0 text-documenso-700" />
-                ) : (
-                  <MailIcon className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
-                )}
-
-                <span className="truncate">
-                  {isBranded ? <Trans>Sending from your domain</Trans> : <Trans>Sending from app.documenso.com</Trans>}
-                </span>
-              </motion.div>
-            </AnimatePresence>
-          </div>
-
-          <div className="relative mt-4 overflow-hidden rounded-lg border bg-background shadow-sm">
-            <div className="flex items-center gap-2 border-b p-4">
-              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full font-semibold text-sm">
-                <AnimatePresence mode="wait" initial={false}>
-                  <motion.span
-                    key={`logo-${cycleIndex}`}
-                    initial={isStatic ? false : { opacity: 0, y: 6 }}
-                    animate={{ opacity: 1, y: 0 }}
-                    exit={{ opacity: 0, y: -6 }}
-                    transition={{ duration: 0.22 }}
-                  >
-                    {/*
-                     * Remounts with its keyed parent on every cycle step so the
-                     * pop replays each change. Single-value spring (POP
-                     * overshoots past 1) instead of scale keyframes — keyframe
-                     * arrays are unreliable on strict-mode remounts.
-                     */}
-                    <motion.span
-                      initial={isStatic ? false : { scale: 0.8 }}
-                      animate={{ scale: 1 }}
-                      transition={{ scale: POP }}
-                      className="inline-block"
-                    >
-                      {isBranded ? (
-                        <Avatar className="h-8 w-8 border border-solid">
-                          {organisation.avatarImageId && (
-                            <AvatarImage src={formatAvatarUrl(organisation.avatarImageId)} />
-                          )}
-                          <AvatarFallback className="text-sm">{brandedSender.name[0]}</AvatarFallback>
-                        </Avatar>
-                      ) : (
-                        <BrandingLogoIcon className="h-8 w-8" />
-                      )}
-                    </motion.span>
-                  </motion.span>
-                </AnimatePresence>
-              </div>
-
-              <div className="min-w-0">
-                <div className="font-medium text-sm">
-                  <AnimatePresence mode="wait" initial={false}>
-                    <motion.div
-                      key={`name-${cycleIndex}`}
-                      initial={isStatic ? false : { opacity: 0, y: 10 }}
-                      animate={{ opacity: 1, y: 0 }}
-                      exit={{ opacity: 0, y: -10 }}
-                      transition={{ duration: 0.28, ease: EASE }}
-                      className="flex min-w-0 items-center gap-1.5"
-                    >
-                      <span className="min-w-0 truncate">{isBranded ? brandedSender.name : 'Documenso'}</span>
-
-                      {/* Inside the keyed row so it exits with the name and pops back in on every cycle step. */}
-                      {isBranded && (
-                        <motion.span
-                          initial={isStatic ? false : { scale: 0, rotate: -40 }}
-                          animate={{ scale: 1, rotate: 0 }}
-                          transition={{ ...POP, delay: 0.12 }}
-                          className="shrink-0"
-                        >
-                          <BadgeCheckIcon className="h-3.5 w-3.5 text-documenso-700" />
-                        </motion.span>
-                      )}
-                    </motion.div>
-                  </AnimatePresence>
-                </div>
-
-                <div className="font-mono text-muted-foreground text-xs">
-                  <AnimatePresence mode="wait" initial={false}>
-                    <motion.p
-                      key={`addr-${cycleIndex}`}
-                      initial={isStatic ? false : { opacity: 0, y: 10 }}
-                      animate={{ opacity: 1, y: 0 }}
-                      exit={{ opacity: 0, y: -10 }}
-                      transition={{ duration: 0.28, ease: EASE }}
-                      className="truncate"
-                    >
-                      {isBranded ? brandedSender.email : 'noreply@app.documenso.com'}
-                    </motion.p>
-                  </AnimatePresence>
-                </div>
-              </div>
-            </div>
-
-            <div className="p-4">
-              <p className="font-medium text-sm">
-                <Trans>Please sign: Example.pdf</Trans>
-              </p>
-
-              <p className="mt-1 text-muted-foreground text-xs">
-                <Trans>{organisation.name} has invited you to sign this document.</Trans>
-              </p>
-            </div>
-
-            {/*
-             * Keyed remount replays the sweep on every cycle step. No opacity
-             * envelope — keyframe arrays are unreliable on strict-mode
-             * remounts; both endpoints sit outside the overflow-hidden card,
-             * so the clip provides the fade in/out instead.
-             */}
-            <motion.div
-              key={`sheen-${cycleIndex}`}
-              initial={isStatic ? false : { x: '-130%' }}
-              animate={{ x: '240%' }}
-              transition={{ duration: 1.2, ease: 'easeOut' }}
-              className="pointer-events-none absolute inset-y-0 left-0 w-[55%]"
-              style={{ background: 'linear-gradient(105deg, transparent, rgba(162, 231, 113, 0.32), transparent)' }}
-            />
-          </div>
-        </div>
-      }
-    />
-  );
-};

apps/remix/app/components/general/settings-upsell/motion.ts

@@ -1,9 +0,0 @@
-/**
- * Shared motion vocabulary for the settings upsell previews. Values ported
- * from the design prototype (`design/SSO Upsell.dc.html`).
- */
-export const SPRING = { type: 'spring', stiffness: 280, damping: 22 } as const;
-
-export const POP = { type: 'spring', stiffness: 420, damping: 16 } as const;
-
-export const EASE = [0.22, 0.61, 0.36, 1] as const;

apps/remix/app/components/general/settings-upsell/settings-upsell-card.tsx

@@ -1,118 +0,0 @@
-import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
-import { canExecuteOrganisationAction } from '@documenso/lib/utils/organisations';
-import { Badge } from '@documenso/ui/primitives/badge';
-import { Button } from '@documenso/ui/primitives/button';
-import { Trans } from '@lingui/react/macro';
-import { ArrowRightIcon, CheckIcon, LockIcon } from 'lucide-react';
-import type { ReactNode } from 'react';
-import { Link } from 'react-router';
-
-export type SettingsUpsellCardProps = {
-  planLabel: ReactNode;
-  title: ReactNode;
-  description: ReactNode;
-  features: ReactNode[];
-  preview: ReactNode;
-
-  /**
-   * CTA label. Defaults to "Upgrade Plan".
-   */
-  ctaLabel?: ReactNode;
-
-  /**
-   * CTA destination. Defaults to the organisation billing settings page.
-   */
-  ctaTo?: string;
-
-  /**
-   * Render the CTA as an external link (new tab) instead of an internal route.
-   */
-  ctaExternal?: boolean;
-};
-
-/**
- * Shared split-card layout for claim-gated settings upsells on Documenso
- * Cloud. The left pane pitches the feature (plan badge, title, description,
- * feature list, upgrade CTA); the right pane renders a decorative scenario
- * preview supplied by the caller.
- *
- * Callers decide *when* to render this (cloud + missing claim flag).
- */
-export const SettingsUpsellCard = ({
-  planLabel,
-  title,
-  description,
-  features,
-  preview,
-  ctaLabel,
-  ctaTo,
-  ctaExternal = false,
-}: SettingsUpsellCardProps) => {
-  const organisation = useCurrentOrganisation();
-
-  const canManageBilling = canExecuteOrganisationAction('MANAGE_BILLING', organisation.currentOrganisationRole);
-
-  const ctaHref = ctaTo ?? `/o/${organisation.url}/settings/billing`;
-
-  const ctaContent = (
-    <>
-      {ctaLabel ?? <Trans>Upgrade Plan</Trans>}
-      <ArrowRightIcon className="ml-2 h-4 w-4" />
-    </>
-  );
-
-  return (
-    <div className="mt-8 overflow-hidden rounded-xl border-2 ring-4 ring-muted/70 md:grid md:grid-cols-[1.08fr_0.92fr] xl:-mx-8">
-      {/*
-       * `min-w-0` on both grid items: `fr` tracks have an `auto` content
-       * minimum, so long preview content (e.g. a wide mono domain line) would
-       * otherwise widen the right track beyond its 0.92fr share — and
-       * re-balance the whole grid on every preview cycle (layout shift).
-       */}
-      <div className="flex min-w-0 flex-col items-start p-6 md:p-8">
-        <Badge size="small">
-          <LockIcon className="mr-1 h-3 w-3" />
-          <span className="uppercase">{planLabel}</span>
-        </Badge>
-
-        <h3 className="mt-4 font-semibold text-xl">{title}</h3>
-
-        <p className="mt-2 max-w-[40ch] text-muted-foreground text-sm">{description}</p>
-
-        <ul className="mt-6 space-y-3">
-          {features.map((feature, index) => (
-            <li key={index} className="flex items-start gap-2.5 text-sm">
-              <span className="mt-0.5 flex h-5 w-5 shrink-0 items-center justify-center rounded-full bg-documenso-200">
-                <CheckIcon className="h-3 w-3 text-documenso-800" strokeWidth={2.5} />
-              </span>
-              {feature}
-            </li>
-          ))}
-        </ul>
-
-        {canManageBilling ? (
-          <Button className="mt-8" asChild>
-            {ctaExternal ? (
-              <a href={ctaHref} target="_blank" rel="noreferrer">
-                {ctaContent}
-              </a>
-            ) : (
-              <Link to={ctaHref}>{ctaContent}</Link>
-            )}
-          </Button>
-        ) : (
-          <p className="mt-8 text-muted-foreground text-xs">
-            <Trans>Contact your organisation owner to upgrade plans.</Trans>
-          </p>
-        )}
-      </div>
-
-      <div
-        aria-hidden="true"
-        className="flex min-w-0 flex-col justify-center gap-3 border-t bg-muted p-6 md:border-t-0 md:border-l md:p-8"
-      >
-        {preview}
-      </div>
-    </div>
-  );
-};

apps/remix/app/components/general/settings-upsell/sso-portal-upsell.tsx

@@ -1,260 +0,0 @@
-import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
-import { useSession } from '@documenso/lib/client-only/providers/session';
-import { DOCUMENSO_CLOUD_ENTERPRISE_CTA_URL } from '@documenso/lib/constants/app';
-import { Trans } from '@lingui/react/macro';
-import { AnimatePresence, motion, useReducedMotion } from 'framer-motion';
-import { FingerprintIcon } from 'lucide-react';
-import type { ReactNode } from 'react';
-import { EASE, POP, SPRING } from './motion';
-import { SettingsUpsellCard } from './settings-upsell-card';
-import { useTimedCycle } from './use-timed-cycle';
-
-export const SsoPortalUpsell = () => {
-  const isReducedMotion = useReducedMotion();
-  const sceneIndex = useTimedCycle(SSO_SCENE_DURATIONS_MS);
-
-  return (
-    <SettingsUpsellCard
-      planLabel={<Trans>Enterprise</Trans>}
-      title={<Trans>Unlock the Organisation SSO Portal</Trans>}
-      description={
-        <Trans>
-          Give your members a dedicated single sign-on portal. The SSO portal is available on the Enterprise plan.
-        </Trans>
-      }
-      features={[
-        <Trans key="oidc">Works with any OIDC provider — Okta, Entra ID, Google and more</Trans>,
-        <Trans key="jit">Accounts are automatically added to your organisation on sign-in</Trans>,
-        <Trans key="control">Restrict sign-ins by email domain and choose the default role</Trans>,
-      ]}
-      ctaLabel={<Trans>Contact Sales</Trans>}
-      ctaTo={DOCUMENSO_CLOUD_ENTERPRISE_CTA_URL}
-      ctaExternal
-      preview={
-        <div className="mx-auto w-full max-w-xs">
-          <div className="relative h-[236px]">
-            <AnimatePresence mode="wait" initial={false}>
-              {sceneIndex === 0 && <PortalScene key="portal" isStatic={isReducedMotion ?? false} />}
-              {sceneIndex === 1 && <RedirectScene key="redirect" />}
-              {sceneIndex === 2 && <SuccessScene key="success" />}
-            </AnimatePresence>
-          </div>
-        </div>
-      }
-    />
-  );
-};
-
-/**
- * Absolute-positioned panel each scene renders in, handling the shared
- * slide-and-fade transition between scenes.
- */
-const ScenePanel = ({ children }: { children: ReactNode }) => {
-  return (
-    <motion.div
-      initial={{ opacity: 0, y: 12, scale: 0.98 }}
-      animate={{ opacity: 1, y: 0, scale: 1 }}
-      exit={{ opacity: 0, y: -12, scale: 0.98 }}
-      transition={{ duration: 0.34, ease: EASE }}
-      className="absolute inset-0 flex flex-col items-center justify-center overflow-hidden rounded-lg border bg-background p-6 text-center shadow-sm"
-    >
-      {children}
-    </motion.div>
-  );
-};
-
-/**
- * Scene 1: the organisation's SSO portal, with a timed faux press on the
- * "Continue with SSO" button (cursor flies in, button dips, sheen sweeps).
- *
- * When `isStatic` is set (reduced motion) every element renders with
- * `initial={false}`, skipping entrance and press animations.
- */
-const PortalScene = ({ isStatic }: { isStatic: boolean }) => {
-  const organisation = useCurrentOrganisation();
-
-  const rise = (delay: number) => ({
-    initial: isStatic ? false : { y: 10, opacity: 0 },
-    animate: { y: 0, opacity: 1 },
-    transition: { ...SPRING, delay },
-  });
-
-  return (
-    <ScenePanel>
-      <motion.div
-        initial={isStatic ? false : { scale: 0.5, opacity: 0 }}
-        animate={{ scale: 1, opacity: 1 }}
-        transition={{ ...POP, delay: 0.04 }}
-      >
-        <div className="flex h-10 w-10 items-center justify-center rounded-md bg-documenso-200 font-semibold text-documenso-900">
-          {([...organisation.name][0] ?? 'D').toUpperCase()}
-        </div>
-      </motion.div>
-
-      <motion.p {...rise(0.12)} className="mt-3.5 font-semibold text-sm">
-        <Trans>Welcome to {organisation.name}</Trans>
-      </motion.p>
-
-      <motion.p {...rise(0.18)} className="mt-1 text-muted-foreground text-xs">
-        <Trans>Single sign-on</Trans>
-      </motion.p>
-
-      <div className="relative mt-4 w-full">
-        <motion.div
-          initial={isStatic ? false : { y: 10, opacity: 0, scale: 1 }}
-          animate={{ y: 0, opacity: 1, scale: [1, 1, 0.955, 1] }}
-          transition={{
-            y: { ...SPRING, delay: 0.24 },
-            opacity: { duration: 0.3, delay: 0.24 },
-            scale: { duration: 2.6, times: [0, 0.63, 0.72, 0.84], ease: 'easeOut' },
-          }}
-          className="relative flex h-[38px] w-full items-center justify-center overflow-hidden rounded-md bg-foreground font-semibold text-background text-sm"
-        >
-          <span>
-            <Trans>Continue with SSO</Trans>
-          </span>
-
-          <motion.div
-            initial={isStatic ? false : { x: '-130%' }}
-            animate={{ x: '150%' }}
-            transition={{ duration: 0.85, delay: 1.75, ease: 'easeOut' }}
-            className="absolute top-0 bottom-0 left-[20%] w-3/5"
-            style={{ background: 'linear-gradient(105deg, transparent, rgba(162, 231, 113, 0.45), transparent)' }}
-          />
-        </motion.div>
-
-        <motion.svg
-          initial={isStatic ? false : { x: 30, y: 30, opacity: 0, scale: 1 }}
-          animate={{
-            x: [30, 30, 0, 0, 0],
-            y: [30, 30, 0, 0, 0],
-            opacity: [0, 1, 1, 1, 0],
-            scale: [1, 1, 1, 0.82, 1],
-          }}
-          transition={{ duration: 2.6, times: [0, 0.3, 0.63, 0.72, 0.94], ease: EASE }}
-          width={17}
-          height={17}
-          viewBox="0 0 24 24"
-          strokeWidth={1.4}
-          strokeLinejoin="round"
-          className="absolute right-[26px] -bottom-2.5 fill-foreground stroke-background"
-        >
-          <path d="M4 2.5 19 12l-6.6 1.4L9.7 19.6z" />
-        </motion.svg>
-      </div>
-    </ScenePanel>
-  );
-};
-
-/**
- * Scene 2: redirecting to the identity provider, with a rotating ring around
- * a fingerprint tile and a filling progress bar.
- */
-const RedirectScene = () => {
-  return (
-    <ScenePanel>
-      <div className="relative flex h-[46px] w-[46px] items-center justify-center">
-        <motion.div
-          animate={{ rotate: 360 }}
-          transition={{ duration: 0.95, repeat: Number.POSITIVE_INFINITY, ease: 'linear' }}
-          className="absolute inset-0 rounded-full border-2"
-          style={{ borderTopColor: '#A2E771' }}
-        />
-
-        <div className="flex h-[34px] w-[34px] items-center justify-center rounded-full bg-muted">
-          <FingerprintIcon className="h-[18px] w-[18px] text-muted-foreground" strokeWidth={1.6} />
-        </div>
-      </div>
-
-      <motion.p
-        initial={{ y: 8, opacity: 0 }}
-        animate={{ y: 0, opacity: 1 }}
-        transition={{ ...SPRING, delay: 0.08 }}
-        className="mt-3.5 max-w-[22ch] text-sm"
-      >
-        <Trans>Redirecting to your identity provider</Trans>
-      </motion.p>
-
-      <div className="mt-4 h-1 w-[140px] overflow-hidden rounded-full bg-border">
-        <motion.div
-          initial={{ width: '0%' }}
-          animate={{ width: '100%' }}
-          transition={{ duration: 1.35, ease: 'easeInOut' }}
-          className="h-full rounded-full bg-documenso"
-        />
-      </div>
-    </ScenePanel>
-  );
-};
-
-/**
- * Scene 3: signed in, with an expanding pulse ring, a popping green circle,
- * a drawn checkmark and the signed-in member's email.
- */
-const SuccessScene = () => {
-  const { user } = useSession();
-
-  return (
-    <ScenePanel>
-      <div className="relative h-10 w-10">
-        <motion.div
-          initial={{ scale: 0.7, opacity: 0.85 }}
-          animate={{ scale: 2.1, opacity: 0 }}
-          transition={{ duration: 1.1, ease: 'easeOut' }}
-          className="absolute inset-0 rounded-full border-2"
-          style={{ borderColor: '#A2E771' }}
-        />
-
-        <motion.div
-          initial={{ scale: 0.4, opacity: 0 }}
-          animate={{ scale: 1, opacity: 1 }}
-          transition={POP}
-          className="absolute inset-0 flex items-center justify-center rounded-full bg-documenso-200"
-        >
-          <svg
-            width={19}
-            height={19}
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth={2.4}
-            strokeLinecap="round"
-            strokeLinejoin="round"
-            className="text-documenso-900"
-          >
-            <motion.path
-              d="M20 6 9 17l-5-5"
-              initial={{ pathLength: 0 }}
-              animate={{ pathLength: 1 }}
-              transition={{ duration: 0.4, delay: 0.12, ease: 'easeOut' }}
-            />
-          </svg>
-        </motion.div>
-      </div>
-
-      <motion.p
-        initial={{ y: 10, opacity: 0 }}
-        animate={{ y: 0, opacity: 1 }}
-        transition={{ ...SPRING, delay: 0.16 }}
-        className="mt-3.5 font-semibold text-sm"
-      >
-        <Trans>Signed in</Trans>
-      </motion.p>
-
-      <motion.p
-        initial={{ y: 10, opacity: 0 }}
-        animate={{ y: 0, opacity: 1 }}
-        transition={{ ...SPRING, delay: 0.24 }}
-        className="mt-1 font-mono text-muted-foreground text-xs"
-      >
-        {user.email}
-      </motion.p>
-    </ScenePanel>
-  );
-};
-
-/**
- * Milliseconds each scene is shown before advancing: portal, redirect,
- * success.
- */
-const SSO_SCENE_DURATIONS_MS = [3000, 2500, 3000];

apps/remix/app/components/general/settings-upsell/use-timed-cycle.ts

@@ -1,47 +0,0 @@
-import { useReducedMotion } from 'framer-motion';
-import { useEffect, useState } from 'react';
-
-/**
- * Cycles an index through `durations.length` steps, waiting `durations[i]`
- * milliseconds on step `i` before advancing to the next.
- *
- * When the cycle wraps past the last step it continues from `loopStartIndex`
- * (default `0`), letting consumers play intro-only steps exactly once and
- * then loop through the remaining steps forever.
- *
- * Under `prefers-reduced-motion` the cycle never starts and the index stays
- * at 0, so consumers render their initial state statically.
- *
- * Pass module-level constants for `durations` and `loopStartIndex` — their
- * identities are intentionally not dependencies.
- */
-export const useTimedCycle = (durations: number[], loopStartIndex = 0) => {
-  const [index, setIndex] = useState(0);
-
-  const isReducedMotion = useReducedMotion();
-
-  useEffect(() => {
-    if (isReducedMotion || durations.length === 0) {
-      setIndex(0);
-      return;
-    }
-
-    let current = 0;
-    let timeout: ReturnType<typeof setTimeout>;
-
-    const tick = () => {
-      const next = current + 1;
-
-      current = next >= durations.length ? Math.min(loopStartIndex, durations.length - 1) : next;
-
-      setIndex(current);
-      timeout = setTimeout(tick, durations[current]);
-    };
-
-    timeout = setTimeout(tick, durations[0]);
-
-    return () => clearTimeout(timeout);
-  }, [isReducedMotion]);
-
-  return index;
-};

apps/remix/app/components/general/template/template-edit-form.tsx

@@ -25,7 +25,6 @@ import { z } from 'zod';
 
 import PDFViewerLazy from '~/components/general/pdf-viewer/pdf-viewer-lazy';
 import { useCurrentTeam } from '~/providers/team';
-import { useCspNonce } from '~/utils/nonce';
 
 export type TemplateEditFormProps = {
   className?: string;
@@ -39,7 +38,6 @@ const EditTemplateSteps: EditTemplateStep[] = ['settings', 'signers', 'fields'];
 export const TemplateEditForm = ({ initialTemplate, className, templateRootPath }: TemplateEditFormProps) => {
   const { _ } = useLingui();
   const { toast } = useToast();
-  const cspNonce = useCspNonce();
 
   const navigate = useNavigate();
   const team = useCurrentTeam();
@@ -341,7 +339,6 @@ export const TemplateEditForm = ({ initialTemplate, className, templateRootPath
               onSubmit={onAddTemplatePlaceholderFormSubmit}
               onAutoSave={onAddTemplatePlaceholderFormAutoSave}
               isDocumentPdfLoaded={isDocumentPdfLoaded}
-              nonce={cspNonce}
             />
 
             <AddTemplateFieldsFormPartial

apps/remix/app/components/general/two-factor-grace-banner.tsx

@@ -1,144 +0,0 @@
-import { useOptionalCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation';
-import { useOptionalSession } from '@documenso/lib/client-only/providers/session';
-import type { TTwoFactorEnforcementStatus } from '@documenso/lib/utils/two-factor';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import { AlertTriangleIcon, XIcon } from 'lucide-react';
-import { useMemo, useState } from 'react';
-import { Link, useLocation } from 'react-router';
-
-type GraceBannerCandidate = {
-  /**
-   * Dismissal scope: `instance` or `org:<organisationId>`.
-   */
-  scope: string;
-  deadline: Date;
-  isSessionUnverified: boolean;
-};
-
-const buildDismissalKey = (userId: number, candidate: GraceBannerCandidate) =>
-  `2fa-grace-banner:${userId}:${candidate.scope}:${candidate.deadline.getTime()}`;
-
-const toCandidate = (
-  status: TTwoFactorEnforcementStatus,
-  scope: string,
-  isSessionUnverified: boolean,
-): GraceBannerCandidate | null => {
-  // Banner territory is the grace window only: required, not yet satisfied,
-  // not yet expired. Expiry is handled by the org 403 screen (and, for
-  // instance enforcement, the onboarding redirect).
-  if (!status.required || status.isSatisfied || status.isDeadlineExpired) {
-    return null;
-  }
-
-  return {
-    scope,
-    deadline: status.deadline,
-    isSessionUnverified,
-  };
-};
-
-/**
- * Shared grace-period banner for 2FA enforcement.
- *
- * Shows the NEAREST applicable deadline between instance enforcement and the
- * current organisation's enforcement. Dismissal is stored in `sessionStorage`
- * keyed by userId + scope + deadline, so a changed deadline re-shows the
- * banner.
- */
-export const TwoFactorGraceBanner = () => {
-  const { i18n } = useLingui();
-
-  const { sessionData } = useOptionalSession();
-  const currentOrganisation = useOptionalCurrentOrganisation();
-
-  const location = useLocation();
-
-  const [dismissedKeys, setDismissedKeys] = useState<string[]>([]);
-
-  const candidate = useMemo(() => {
-    if (!sessionData) {
-      return null;
-    }
-
-    const isSessionUnverified = sessionData.user.twoFactorEnabled && !sessionData.session.twoFactorVerified;
-
-    const candidates = [
-      toCandidate(sessionData.twoFactorEnforcement, 'instance', isSessionUnverified),
-      currentOrganisation
-        ? toCandidate(currentOrganisation.twoFactorEnforcement, `org:${currentOrganisation.id}`, isSessionUnverified)
-        : null,
-    ].filter((value): value is GraceBannerCandidate => value !== null);
-
-    if (candidates.length === 0) {
-      return null;
-    }
-
-    return candidates.reduce((nearest, current) =>
-      current.deadline.getTime() < nearest.deadline.getTime() ? current : nearest,
-    );
-  }, [sessionData, currentOrganisation]);
-
-  if (!sessionData || !candidate) {
-    return null;
-  }
-
-  const dismissalKey = buildDismissalKey(sessionData.user.id, candidate);
-
-  const isDismissed =
-    dismissedKeys.includes(dismissalKey) ||
-    (typeof window !== 'undefined' && window.sessionStorage.getItem(dismissalKey) === 'true');
-
-  if (isDismissed) {
-    return null;
-  }
-
-  const onDismiss = () => {
-    try {
-      window.sessionStorage.setItem(dismissalKey, 'true');
-    } catch {
-      // Storage may be unavailable (private browsing); fall back to state.
-    }
-
-    setDismissedKeys((keys) => [...keys, dismissalKey]);
-  };
-
-  const returnTo = encodeURIComponent(`${location.pathname}${location.search}`);
-
-  return (
-    <div className="bg-yellow-200 dark:bg-yellow-400">
-      <div className="mx-auto flex max-w-screen-xl items-center justify-between gap-x-4 px-4 py-2 font-medium text-sm text-yellow-900">
-        <div className="flex items-center gap-x-2">
-          <AlertTriangleIcon className="h-4 w-4 flex-shrink-0" />
-
-          <span>
-            {candidate.isSessionUnverified ? (
-              <Trans>
-                Two-factor authentication is required from {i18n.date(candidate.deadline, { dateStyle: 'long' })}.
-                Two-factor authentication is enabled for your account, but this session has not been verified with a
-                second factor — sign out and log back in to verify this session.
-              </Trans>
-            ) : (
-              <Trans>
-                Two-factor authentication is required from {i18n.date(candidate.deadline, { dateStyle: 'long' })}.{' '}
-                <Link to={`/onboarding/2fa?returnTo=${returnTo}`} className="underline">
-                  Enable it now
-                </Link>{' '}
-                to keep access.
-              </Trans>
-            )}
-          </span>
-        </div>
-
-        <button
-          type="button"
-          className="rounded p-1 hover:bg-yellow-300 dark:hover:bg-yellow-500"
-          aria-label="Dismiss"
-          onClick={onDismiss}
-        >
-          <XIcon className="h-4 w-4" />
-        </button>
-      </div>
-    </div>
-  );
-};

apps/remix/app/components/general/use-admin-search-categories.ts

@@ -39,14 +39,13 @@ const ADMIN_GROUP_ICONS: Record<TAdminSearchResultType, LucideIcon> = {
 
 /**
  * Admin list pages which support prefilling their search from the URL, used
- * for the "View all results" links on capped groups. Teams and
+ * for the "View all results" links on capped groups. Teams, recipients and
  * subscriptions have no admin list pages.
  */
 const ADMIN_GROUP_LIST_PATHS: Partial<Record<TAdminSearchResultType, (_query: string) => string>> = {
   document: (query) => `/admin/documents?term=${encodeURIComponent(query)}`,
   user: (query) => `/admin/users?search=${encodeURIComponent(query)}`,
   organisation: (query) => `/admin/organisations?query=${encodeURIComponent(query)}`,
-  recipient: (query) => `/admin/documents?term=${encodeURIComponent(`recipient:${query}`)}`,
 };
 
 export type UseAdminSearchCategoriesOptions = {

apps/remix/app/components/tables/organisation-members-table.tsx

@@ -6,7 +6,6 @@ import { isOrganisationRoleWithinUserHierarchy } from '@documenso/lib/utils/orga
 import { extractInitials } from '@documenso/lib/utils/recipient-formatter';
 import { trpc } from '@documenso/trpc/react';
 import { AvatarWithText } from '@documenso/ui/primitives/avatar';
-import { Badge } from '@documenso/ui/primitives/badge';
 import type { DataTableColumnDef } from '@documenso/ui/primitives/data-table';
 import { DataTable } from '@documenso/ui/primitives/data-table';
 import { DataTablePagination } from '@documenso/ui/primitives/data-table-pagination';
@@ -101,23 +100,6 @@ export const OrganisationMembersDataTable = () => {
         header: _(msg`Groups`),
         cell: ({ row }) => row.original.groups.filter((group) => group.type === OrganisationGroupType.CUSTOM).length,
       },
-      {
-        // Per-member 2FA compliance indicator: enrolment is the durable half
-        // of the satisfaction rule, so org admins can see who has and hasn't
-        // enrolled (non-compliant members still consume seats).
-        header: _(msg`2FA`),
-        accessorKey: 'twoFactorEnabled',
-        cell: ({ row }) =>
-          row.original.twoFactorEnabled ? (
-            <Badge variant="default">
-              <Trans>Enrolled</Trans>
-            </Badge>
-          ) : (
-            <Badge variant="neutral">
-              <Trans>Not enrolled</Trans>
-            </Badge>
-          ),
-      },
       {
         header: _(msg`Actions`),
         cell: ({ row }) => (

apps/remix/app/entry.client.tsx

@@ -18,23 +18,6 @@ import './utils/polyfills/promise-with-resolvers';
  * the page early, leaving dead event handlers (broken dropdowns, native form
  * submits).
  */
-/**
- * Signing and direct template URLs contain recipient tokens which must never
- * be sent to PostHog. Recipient context is attached explicitly via
- * `recipientId` where needed instead.
- */
-const redactTokensFromUrl = (value: string) => {
-  return value.replace(/(\/(?:sign|d|direct)\/)([^/?#]+)/g, '$1:token');
-};
-
-const URL_EVENT_PROPERTIES = [
-  '$current_url',
-  '$pathname',
-  '$referrer',
-  '$initial_referrer',
-  '$prev_pageview_pathname',
-] as const;
-
 function initPosthog() {
   const postHogConfig = extractPostHogConfig();
 
@@ -42,59 +25,12 @@ function initPosthog() {
     void import('posthog-js').then(({ default: posthog }) => {
       posthog.init(postHogConfig.key, {
         api_host: postHogConfig.host,
-        // Only create person profiles for identified (authenticated) users,
-        // anonymous recipients on signing pages stay anonymous.
-        person_profiles: 'identified_only',
-        // Explicit events only, autocapture on signing pages blows up usage
-        // without providing actionable data.
-        autocapture: false,
-        capture_pageview: true,
-        capture_pageleave: false,
         capture_exceptions: true,
-        before_send: (event) => {
-          if (!event) {
-            return null;
-          }
-
-          for (const property of URL_EVENT_PROPERTIES) {
-            const value = event.properties?.[property];
-
-            if (typeof value === 'string') {
-              event.properties[property] = redactTokensFromUrl(value);
-            }
-          }
-
-          if (event.$set_once && typeof event.$set_once['$initial_current_url'] === 'string') {
-            event.$set_once['$initial_current_url'] = redactTokensFromUrl(event.$set_once['$initial_current_url']);
-          }
-
-          return event;
-        },
       });
     });
   }
 }
 
-/**
- * Surfaces hydration recoveries (React 19 discards the server HTML and
- * re-renders on the client instead of dying) so we can track how often
- * extensions/early clicks interfere with hydration in the wild.
- */
-function onRecoverableError(error: unknown, errorInfo: { componentStack?: string }) {
-  console.error('[hydration] recovered from error', error, errorInfo.componentStack);
-
-  if (extractPostHogConfig()) {
-    void import('posthog-js').then(({ default: posthog }) => {
-      if (posthog.__loaded) {
-        posthog.capture('$hydration_recoverable_error', {
-          message: error instanceof Error ? error.message : String(error),
-          componentStack: errorInfo.componentStack,
-        });
-      }
-    });
-  }
-}
-
 async function main() {
   const locale = detect(fromHtmlTag('lang')) || 'en';
 
@@ -108,7 +44,6 @@ async function main() {
           <HydratedRouter />
         </I18nProvider>
       </StrictMode>,
-      { onRecoverableError },
     );
   });
 

apps/remix/app/entry.server.tsx

@@ -7,11 +7,10 @@ import { createReadableStreamFromReadable } from '@react-router/node';
 import { isbot } from 'isbot';
 import type { RenderToPipeableStreamOptions } from 'react-dom/server';
 import { renderToPipeableStream } from 'react-dom/server';
-import type { EntryContext, RouterContextProvider } from 'react-router';
+import type { AppLoadContext, EntryContext } from 'react-router';
 import { ServerRouter } from 'react-router';
 
 import { langCookie } from './storage/lang-cookie.server';
-import { nonceContext } from './utils/nonce';
 
 export const streamTimeout = 5_000;
 
@@ -20,7 +19,7 @@ export default async function handleRequest(
   responseStatusCode: number,
   responseHeaders: Headers,
   routerContext: EntryContext,
-  loadContext: RouterContextProvider,
+  loadContext: AppLoadContext,
 ) {
   let language = await langCookie.parse(request.headers.get('cookie') ?? '');
 
@@ -34,7 +33,7 @@ export default async function handleRequest(
   // scripts it injects (route manifest, hydration data, module preloads).
   // The same nonce is also exposed to the React tree via the root loader so
   // our own inline scripts/styles can carry it.
-  const nonce = loadContext.get(nonceContext) || undefined;
+  const nonce = loadContext.nonce || undefined;
 
   return new Promise((resolve, reject) => {
     let shellRendered = false;

apps/remix/app/middleware/admin.ts

@@ -1,13 +0,0 @@
-import { getOptionalSession } from '@documenso/auth/server/lib/utils/get-session';
-import { isAdmin } from '@documenso/lib/utils/is-admin';
-import { type MiddlewareFunction, redirect } from 'react-router';
-
-export const adminMiddleware: MiddlewareFunction = async ({ request }, next) => {
-  const { user } = await getOptionalSession(request);
-
-  if (!user || !isAdmin(user)) {
-    throw redirect('/');
-  }
-
-  return next();
-};

apps/remix/app/middleware/nonce.ts

@@ -1,8 +0,0 @@
-import type { MiddlewareFunction } from 'react-router';
-
-import { getRequestNonce } from '../../server/load-context';
-import { nonceContext } from '../utils/nonce';
-
-export const nonceMiddleware: MiddlewareFunction = ({ context }) => {
-  context.set(nonceContext, getRequestNonce());
-};