chore: remove lockfile changes from branch

.npmrc

@@ -1,3 +1,3 @@
 legacy-peer-deps = true
 prefer-dedupe = true
-min-release-age = 7
+# min-release-age = 7

apps/docs/package.json

@@ -10,6 +10,7 @@
     "postinstall": "fumadocs-mdx"
   },
   "dependencies": {
+    "@radix-ui/react-tabs": "^1.1.13",
     "fumadocs-core": "16.5.0",
     "fumadocs-mdx": "14.2.6",
     "fumadocs-ui": "16.5.0",

apps/openpage-api/package.json

@@ -16,7 +16,7 @@
   },
   "devDependencies": {
     "@types/node": "^20",
-    "@types/react": "^19.2.17",
+    "@types/react": "18.3.27",
     "typescript": "5.6.2"
   }
 }

apps/remix/app/components/general/app-command-menu.tsx

@@ -19,7 +19,7 @@ import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
 import { keepPreviousData } from '@tanstack/react-query';
-import { defaultFilter as commandScore } from 'cmdk';
+import { commandScore } from 'cmdk/dist/command-score';
 import {
   ArrowLeftIcon,
   CheckIcon,

apps/remix/app/components/general/document-signing/document-signing-radio-field.tsx

@@ -146,17 +146,14 @@ export const DocumentSigningRadioField = ({ field, onSignField, onUnsignField }:
       {isLoading && <DocumentSigningFieldsLoader />}
 
       {!field.inserted && (
-        <RadioGroup
-          value={selectedOption}
-          onValueChange={(value) => handleSelectItem(value)}
-          className="z-10 my-0.5 gap-y-1"
-        >
+        <RadioGroup onValueChange={(value) => handleSelectItem(value)} className="z-10 my-0.5 gap-y-1">
           {values?.map((item, index) => (
             <div key={index} className="flex items-center">
               <RadioGroupItem
                 className="h-3 w-3 shrink-0"
                 value={item.value}
                 id={`option-${field.id}-${item.id}`}
+                checked={item.checked}
                 disabled={isReadOnly}
               />
               {!item.value.includes('empty-value-') && item.value && (
@@ -170,13 +167,14 @@ export const DocumentSigningRadioField = ({ field, onSignField, onUnsignField }:
       )}
 
       {field.inserted && (
-        <RadioGroup value={field.customText ?? ''} className="my-0.5 gap-y-1">
+        <RadioGroup className="my-0.5 gap-y-1">
           {values?.map((item, index) => (
             <div key={index} className="flex items-center">
               <RadioGroupItem
                 className="h-3 w-3"
                 value={item.value}
                 id={`option-${field.id}-${item.id}`}
+                checked={item.value === field.customText}
                 disabled={isReadOnly}
               />
               {!item.value.includes('empty-value-') && item.value && (

apps/remix/app/components/general/pdf-viewer/pdf-viewer.tsx

@@ -215,7 +215,7 @@ export default function PDFViewer({
 
 type VirtualizedPageListProps = {
   scrollParentRef: ScrollTarget;
-  constraintRef: React.RefObject<HTMLDivElement | null>;
+  constraintRef: React.RefObject<HTMLDivElement>;
   pages: PageMeta[];
   numPages: number;
   pdf: pdfjsLib.PDFDocumentProxy;

apps/remix/app/entry.client.tsx

@@ -31,26 +31,6 @@ function initPosthog() {
   }
 }
 
-/**
- * Surfaces hydration recoveries (React 19 discards the server HTML and
- * re-renders on the client instead of dying) so we can track how often
- * extensions/early clicks interfere with hydration in the wild.
- */
-function onRecoverableError(error: unknown, errorInfo: { componentStack?: string }) {
-  console.error('[hydration] recovered from error', error, errorInfo.componentStack);
-
-  if (extractPostHogConfig()) {
-    void import('posthog-js').then(({ default: posthog }) => {
-      if (posthog.__loaded) {
-        posthog.capture('$hydration_recoverable_error', {
-          message: error instanceof Error ? error.message : String(error),
-          componentStack: errorInfo.componentStack,
-        });
-      }
-    });
-  }
-}
-
 async function main() {
   const locale = detect(fromHtmlTag('lang')) || 'en';
 
@@ -64,7 +44,6 @@ async function main() {
           <HydratedRouter />
         </I18nProvider>
       </StrictMode>,
-      { onRecoverableError },
     );
   });
 

apps/remix/package.json

@@ -57,9 +57,9 @@
     "papaparse": "^5.5.3",
     "posthog-js": "^1.297.2",
     "posthog-node": "4.18.0",
-    "react": "^19.2.7",
+    "react": "^18",
     "react-call": "^1.8.1",
-    "react-dom": "^19.2.7",
+    "react-dom": "^18",
     "react-dropzone": "^14.3.8",
     "react-hook-form": "^7.66.1",
     "react-hotkeys-hook": "^4.6.2",
@@ -93,8 +93,8 @@
     "@types/luxon": "^3.7.1",
     "@types/node": "^20",
     "@types/papaparse": "^5.5.0",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
+    "@types/react": "18.3.27",
+    "@types/react-dom": "^18",
     "@types/ua-parser-js": "^0.7.39",
     "cross-env": "^10.1.0",
     "esbuild": "^0.27.0",

apps/remix/vite.config.ts

@@ -121,7 +121,7 @@ export default defineConfig({
         'nodemailer',
         /playwright/,
         '@playwright/browser-chromium',
-        '@documenso/skia-canvas',
+        'skia-canvas',
       ],
     },
   },

package.json

@@ -48,17 +48,14 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.8",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
     "@commitlint/cli": "^20.1.0",
     "@commitlint/config-conventional": "^20.0.0",
     "@datadog/pprof": "^5.13.5",
-    "@documenso/skia-canvas": "^3.0.8-documenso.3",
     "@lingui/cli": "^5.6.0",
     "@prisma/client": "^6.19.0",
-    "@trpc/client": "11.17.0",
-    "@trpc/react-query": "11.17.0",
-    "@trpc/server": "11.17.0",
+    "@trpc/client": "11.8.1",
+    "@trpc/react-query": "11.8.1",
+    "@trpc/server": "11.8.1",
     "@ts-rest/core": "^3.52.1",
     "@ts-rest/open-api": "^3.52.1",
     "@ts-rest/serverless": "^3.52.1",
@@ -95,41 +92,13 @@
     "@lingui/conf": "^5.6.0",
     "@lingui/core": "^5.6.0",
     "@prisma/extension-read-replicas": "^0.4.1",
-    "@radix-ui/react-accordion": "^1.2.16",
-    "@radix-ui/react-alert-dialog": "^1.1.19",
-    "@radix-ui/react-aspect-ratio": "^1.1.11",
-    "@radix-ui/react-avatar": "^1.2.2",
-    "@radix-ui/react-checkbox": "^1.3.7",
-    "@radix-ui/react-collapsible": "^1.1.16",
-    "@radix-ui/react-context-menu": "^2.3.3",
-    "@radix-ui/react-dialog": "^1.1.19",
-    "@radix-ui/react-dropdown-menu": "^2.1.20",
-    "@radix-ui/react-hover-card": "^1.1.19",
-    "@radix-ui/react-label": "^2.1.11",
-    "@radix-ui/react-menubar": "^1.1.20",
-    "@radix-ui/react-navigation-menu": "^1.2.18",
-    "@radix-ui/react-popover": "^1.1.19",
-    "@radix-ui/react-progress": "^1.1.12",
-    "@radix-ui/react-radio-group": "^1.4.3",
-    "@radix-ui/react-scroll-area": "^1.2.14",
-    "@radix-ui/react-select": "^2.3.3",
-    "@radix-ui/react-separator": "^1.1.11",
-    "@radix-ui/react-slider": "^1.4.3",
-    "@radix-ui/react-slot": "^1.3.0",
-    "@radix-ui/react-switch": "^1.3.3",
-    "@radix-ui/react-tabs": "^1.1.17",
-    "@radix-ui/react-toast": "^1.2.19",
-    "@radix-ui/react-toggle": "^1.1.14",
-    "@radix-ui/react-toggle-group": "^1.1.15",
-    "@radix-ui/react-tooltip": "^1.2.12",
     "ai": "^5.0.104",
     "cron-parser": "^5.5.0",
     "fflate": "^0.8.3",
     "luxon": "^3.7.2",
     "patch-package": "^8.0.1",
     "posthog-node": "4.18.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^18",
     "typescript": "5.6.2",
     "@marsidev/react-turnstile": "^1.5.0",
     "zod": "^3.25.76"
@@ -138,10 +107,6 @@
     "lodash": "4.18.1",
     "pdfjs-dist": "5.4.296",
     "postcss": "^8.5.19",
-    "react": "$react",
-    "react-dom": "$react-dom",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
     "typescript": "5.6.2",
     "zod": "$zod",
     "fumadocs-mdx": {

packages/ee/package.json

@@ -19,7 +19,7 @@
     "arctic": "^3.7.0",
     "hono": "^4.12.14",
     "luxon": "^3.7.2",
-    "react": "^19.2.7",
+    "react": "^18",
     "ts-pattern": "^5.9.0",
     "zod": "^3.25.76"
   }

packages/email/components.ts

@@ -1,19 +1,17 @@
-export {
-  Body,
-  Button,
-  Column,
-  Container,
-  Font,
-  Head,
-  Heading,
-  Hr,
-  Html,
-  Img,
-  Link,
-  Preview,
-  Row,
-  render,
-  Section,
-  Tailwind,
-  Text,
-} from 'react-email';
+export { Body } from '@react-email/body';
+export { Button } from '@react-email/button';
+export { Column } from '@react-email/column';
+export { Container } from '@react-email/container';
+export { Font } from '@react-email/font';
+export { Head } from '@react-email/head';
+export { Heading } from '@react-email/heading';
+export { Hr } from '@react-email/hr';
+export { Html } from '@react-email/html';
+export { Img } from '@react-email/img';
+export { Link } from '@react-email/link';
+export { Preview } from '@react-email/preview';
+export { render } from '@react-email/render';
+export { Row } from '@react-email/row';
+export { Section } from '@react-email/section';
+export { Tailwind } from '@react-email/tailwind';
+export { Text } from '@react-email/text';

packages/email/package.json

@@ -19,9 +19,27 @@
   "dependencies": {
     "@documenso/nodemailer-resend": "5.0.0",
     "@documenso/tailwind-config": "*",
-    "@react-email/render": "2.1.0",
+    "@react-email/body": "0.2.0",
+    "@react-email/button": "0.2.0",
+    "@react-email/code-block": "0.2.0",
+    "@react-email/code-inline": "0.0.5",
+    "@react-email/column": "0.0.13",
+    "@react-email/container": "0.0.15",
+    "@react-email/font": "0.0.9",
+    "@react-email/head": "0.0.12",
+    "@react-email/heading": "0.0.15",
+    "@react-email/hr": "0.0.11",
+    "@react-email/html": "0.0.11",
+    "@react-email/img": "0.0.11",
+    "@react-email/link": "0.0.12",
+    "@react-email/preview": "0.0.13",
+    "@react-email/render": "2.0.0",
+    "@react-email/row": "0.0.12",
+    "@react-email/section": "0.0.16",
+    "@react-email/tailwind": "^2.0.1",
+    "@react-email/text": "0.1.5",
     "nodemailer": "^9.0.0",
-    "react-email": "^6.9.0",
+    "react-email": "^5.0.6",
     "resend": "^6.5.2"
   },
   "devDependencies": {

packages/lib/client-only/hooks/use-autosave.ts

@@ -8,7 +8,7 @@ type SaveRequest<T, R> = {
 export const useAutoSave = <T, R = void>(onSave: (data: T) => Promise<R>, options: { delay?: number } = {}) => {
   const { delay = 2000 } = options;
 
-  const saveTimeoutRef = useRef<NodeJS.Timeout | undefined>(undefined);
+  const saveTimeoutRef = useRef<NodeJS.Timeout>();
   const saveQueueRef = useRef<SaveRequest<T, R>[]>([]);
   const isProcessingRef = useRef(false);
 

packages/lib/client-only/providers/envelope-editor-provider.tsx

@@ -15,7 +15,7 @@ import { useToast } from '@documenso/ui/primitives/use-toast';
 import { useLingui } from '@lingui/react/macro';
 import { EnvelopeType, Prisma, ReadStatus, SendStatus, SigningStatus } from '@prisma/client';
 import type React from 'react';
-import { createContext, useCallback, useContext, useMemo, useRef, useState, useSyncExternalStore } from 'react';
+import { createContext, useCallback, useContext, useMemo, useRef, useState } from 'react';
 import { useSearchParams } from 'react-router';
 
 import type { TDocumentEmailSettings } from '../../types/document-email';
@@ -107,39 +107,7 @@ export const EnvelopeEditorProvider = ({
 
   const [_searchParams, setSearchParams] = useSearchParams();
 
-  /**
-   * The envelope is kept in a ref-backed external store instead of useState so
-   * that async consumers (debounced autosave callbacks, flushAutosave, resetForms)
-   * can synchronously read the latest value via `getEnvelope`.
-   *
-   * React subscribes to the store through useSyncExternalStore, keeping renders in
-   * sync without maintaining a separate copy of the state.
-   */
-  const envelopeStoreRef = useRef(initialEnvelope);
-  const envelopeStoreSubscribersRef = useRef(new Set<() => void>());
-
-  const subscribeToEnvelopeStore = useCallback((onStoreChange: () => void) => {
-    envelopeStoreSubscribersRef.current.add(onStoreChange);
-
-    return () => {
-      envelopeStoreSubscribersRef.current.delete(onStoreChange);
-    };
-  }, []);
-
-  const getEnvelope = useCallback(() => envelopeStoreRef.current, []);
-
-  const setEnvelope = useCallback((action: React.SetStateAction<TEditorEnvelope>) => {
-    const next = typeof action === 'function' ? action(envelopeStoreRef.current) : action;
-
-    envelopeStoreRef.current = next;
-
-    for (const onStoreChange of envelopeStoreSubscribersRef.current) {
-      onStoreChange();
-    }
-  }, []);
-
-  const envelope = useSyncExternalStore(subscribeToEnvelopeStore, getEnvelope, getEnvelope);
-
+  const [envelope, _setEnvelope] = useState(initialEnvelope);
   const [autosaveError, setAutosaveError] = useState<boolean>(false);
 
   const isCscMode = IS_INSTANCE_CSC_MODE();
@@ -167,6 +135,8 @@ export const EnvelopeEditorProvider = ({
     };
   }, [isCscMode, providedEditorConfig]);
 
+  const envelopeRef = useRef(initialEnvelope);
+
   const externalFlushCallbacksRef = useRef<Map<string, () => Promise<void>>>(new Map());
   const pendingMutationsRef = useRef<Set<Promise<unknown>>>(new Set());
 
@@ -186,6 +156,14 @@ export const EnvelopeEditorProvider = ({
     });
   }, []);
 
+  const setEnvelope: typeof _setEnvelope = (action) => {
+    _setEnvelope((prev) => {
+      const next = typeof action === 'function' ? action(prev) : action;
+      envelopeRef.current = next;
+      return next;
+    });
+  };
+
   const isEmbedded = editorConfig.embedded !== undefined;
 
   const editorFields = useEditorFields({
@@ -214,18 +192,16 @@ export const EnvelopeEditorProvider = ({
     try {
       let recipients: TEditorEnvelope['recipients'] = [];
 
-      const currentEnvelope = getEnvelope();
-
       if (!isEmbedded) {
         const response = await setRecipientsMutation.mutateAsync({
-          envelopeId: currentEnvelope.id,
-          envelopeType: currentEnvelope.type,
+          envelopeId: envelope.id,
+          envelopeType: envelope.type,
           recipients: localRecipients,
         });
 
         recipients = response.data;
       } else {
-        recipients = mapLocalRecipientsToRecipients({ envelope: currentEnvelope, localRecipients });
+        recipients = mapLocalRecipientsToRecipients({ envelope, localRecipients });
       }
 
       setEnvelope((prev) => ({
@@ -235,7 +211,9 @@ export const EnvelopeEditorProvider = ({
       }));
 
       // Reset the local fields to ensure deleted recipient fields are removed.
-      editorFields.resetForm(getEnvelope().fields);
+      editorFields.resetForm(
+        envelope.fields.filter((field) => recipients.some((recipient) => recipient.id === field.recipientId)),
+      );
 
       setAutosaveError(false);
     } catch (err) {
@@ -270,18 +248,16 @@ export const EnvelopeEditorProvider = ({
     try {
       let fields: TSetEnvelopeFieldsResponse['data'] = [];
 
-      const currentEnvelope = getEnvelope();
-
       if (!isEmbedded) {
         const response = await setFieldsMutation.mutateAsync({
-          envelopeId: currentEnvelope.id,
-          envelopeType: currentEnvelope.type,
+          envelopeId: envelope.id,
+          envelopeType: envelope.type,
           fields: localFields,
         });
 
         fields = response.data;
       } else {
-        fields = mapLocalFieldsToFields({ envelope: currentEnvelope, localFields });
+        fields = mapLocalFieldsToFields({ envelope, localFields });
       }
 
       setEnvelope((prev) => ({
@@ -333,7 +309,7 @@ export const EnvelopeEditorProvider = ({
     try {
       const response = !isEmbedded
         ? await updateEnvelopeMutation.mutateAsync({
-            envelopeId: getEnvelope().id,
+            envelopeId: envelope.id,
             data,
             meta,
           })
@@ -491,14 +467,12 @@ export const EnvelopeEditorProvider = ({
   };
 
   const resetForms = () => {
-    const currentEnvelope = getEnvelope();
-
     editorRecipients.resetForm({
-      recipients: currentEnvelope.recipients,
-      documentMeta: currentEnvelope.documentMeta,
+      recipients: envelopeRef.current.recipients,
+      documentMeta: envelopeRef.current.documentMeta,
     });
 
-    editorFields.resetForm(currentEnvelope.fields);
+    editorFields.resetForm(envelopeRef.current.fields);
   };
 
   const flushAutosave = async (): Promise<TEditorEnvelope> => {
@@ -514,7 +488,7 @@ export const EnvelopeEditorProvider = ({
       await Promise.allSettled(Array.from(pendingMutationsRef.current));
     }
 
-    return getEnvelope();
+    return envelopeRef.current;
   };
 
   return (

packages/lib/package.json

@@ -29,7 +29,6 @@
     "@documenso/email": "*",
     "@documenso/prisma": "*",
     "@documenso/signing": "*",
-    "@documenso/skia-canvas": "^3.0.8-documenso.3",
     "@lingui/core": "^5.6.0",
     "@lingui/macro": "^5.6.0",
     "@lingui/react": "^5.6.0",
@@ -65,9 +64,10 @@
     "postcss-selector-parser": "^7.1.4",
     "posthog-js": "^1.297.2",
     "posthog-node": "4.18.0",
-    "react": "^19.2.7",
+    "react": "^18",
     "remeda": "^2.32.0",
     "sharp": "0.34.5",
+    "skia-canvas": "^3.0.8",
     "stripe": "^12.18.0",
     "ts-pattern": "^5.9.0",
     "zod": "^3.25.76"

packages/lib/server-only/ai/pdf-to-images.ts

@@ -1,6 +1,6 @@
-import { Canvas, Image, Path2D } from '@documenso/skia-canvas';
 import pMap from 'p-map';
 import * as pdfjsLib from 'pdfjs-dist/legacy/build/pdf.mjs';
+import { Canvas, Image, Path2D } from 'skia-canvas';
 
 // @ts-expect-error napi-rs/canvas satisfies the requirements
 globalThis.Path2D = Path2D;

packages/lib/server-only/konva/skia-backend.ts

@@ -2,9 +2,8 @@
  * !: This is a workaround to fix the memory leak in the skia-canvas library.
  * !: Internals are ported from the original `konva/skia-backend.js` file.
  */
-
-import { Canvas, DOMMatrix, Image, Path2D } from '@documenso/skia-canvas';
 import { Konva } from 'konva/lib/_CoreInternals';
+import { Canvas, DOMMatrix, Image, Path2D } from 'skia-canvas';
 
 // @ts-expect-error skia-canvas satisfies the requirements
 global.DOMMatrix = DOMMatrix;
@@ -38,6 +37,6 @@ Konva.Util.createImageElement = () => {
   return node as unknown as HTMLImageElement;
 };
 
-Konva._renderBackend = '@documenso/skia-canvas';
+Konva._renderBackend = 'skia-canvas';
 
 export default Konva;

packages/lib/server-only/pdf/helpers.ts

@@ -1,8 +1,8 @@
 import path from 'node:path';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { FontLibrary } from '@documenso/skia-canvas';
 import type { Recipient } from '@prisma/client';
 import { FieldType } from '@prisma/client';
+import { FontLibrary } from 'skia-canvas';
 import { match } from 'ts-pattern';
 
 /**

packages/lib/server-only/pdf/insert-field-in-pdf-v2.ts

@@ -2,8 +2,8 @@
 import '../konva/skia-backend';
 
 import type { FieldWithSignature } from '@documenso/prisma/types/field-with-signature';
-import type { Canvas } from '@documenso/skia-canvas';
 import Konva from 'konva';
+import type { Canvas } from 'skia-canvas';
 
 import { renderField } from '../../universal/field-renderer/render-field';
 import { ensureFontLibrary } from './helpers';

packages/lib/server-only/pdf/render-audit-logs.ts

@@ -1,16 +1,14 @@
-// sort-imports-ignore
-import '../konva/skia-backend';
-
-import fs from 'node:fs';
-import path from 'node:path';
-import type { Canvas } from '@documenso/skia-canvas';
-import { Image as SkiaImage } from '@documenso/skia-canvas';
 import type { I18n } from '@lingui/core';
 import { msg } from '@lingui/core/macro';
 import type { DocumentMeta, Envelope, RecipientRole } from '@prisma/client';
 import Konva from 'konva';
+import 'konva/skia-backend';
+import fs from 'node:fs';
+import path from 'node:path';
 import type { DateTimeFormatOptions } from 'luxon';
 import { DateTime } from 'luxon';
+import type { Canvas } from 'skia-canvas';
+import { Image as SkiaImage } from 'skia-canvas';
 import { match, P } from 'ts-pattern';
 import { UAParser } from 'ua-parser-js';
 

packages/lib/server-only/pdf/render-certificate.ts

@@ -1,16 +1,14 @@
-// sort-imports-ignore
-import '../konva/skia-backend';
-
-import fs from 'node:fs';
-import path from 'node:path';
-import type { Canvas } from '@documenso/skia-canvas';
-import { Image as SkiaImage } from '@documenso/skia-canvas';
 import type { I18n } from '@lingui/core';
 import { msg } from '@lingui/core/macro';
 import type { Field, RecipientRole, Signature } from '@prisma/client';
 import { SigningStatus } from '@prisma/client';
 import Konva from 'konva';
+import 'konva/skia-backend';
+import fs from 'node:fs';
+import path from 'node:path';
 import { DateTime } from 'luxon';
+import type { Canvas } from 'skia-canvas';
+import { Image as SkiaImage } from 'skia-canvas';
 import { UAParser } from 'ua-parser-js';
 import { renderSVG } from 'uqr';
 

packages/lib/universal/field-renderer/render-signature-field.ts

@@ -14,7 +14,7 @@ let SkiaImage: any;
 
 void (async () => {
   if (typeof window === 'undefined') {
-    const mod = await import('@documenso/skia-canvas');
+    const mod = await import('skia-canvas');
     SkiaImage = mod.Image;
   }
 })();

packages/trpc/package.json

@@ -12,9 +12,9 @@
     "@documenso/prisma": "*",
     "@simplewebauthn/server": "^13.2.2",
     "@tanstack/react-query": "5.90.10",
-    "@trpc/client": "11.17.0",
-    "@trpc/react-query": "11.17.0",
-    "@trpc/server": "11.17.0",
+    "@trpc/client": "11.8.1",
+    "@trpc/react-query": "11.8.1",
+    "@trpc/server": "11.8.1",
     "@ts-rest/core": "^3.52.1",
     "formidable": "^3.5.4",
     "luxon": "^3.7.2",

packages/trpc/server/admin-router/email-transport/update-email-transport.ts

@@ -1,7 +1,6 @@
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import {
   decryptEmailTransportConfig,
-  EMAIL_TRANSPORT_SECRET_KEYS,
   encryptEmailTransportConfig,
   ZEmailTransportConfigSchema,
 } from '@documenso/lib/server-only/email/email-transport-config';
@@ -30,16 +29,16 @@ export const updateEmailTransportRoute = adminProcedure
     const existingConfig = decryptEmailTransportConfig(existing.config);
 
     // Start from the incoming config; backfill empty secret fields from the existing
-    // config (only when the type is unchanged).
-    const merged: Record<string, unknown> = { ...data.config };
+    // config (only when the type is unchanged). Secrets are never sent back to the
+    // client, so a blank incoming value means "keep the existing secret".
+    const merged = { ...data.config };
 
-    if (existingConfig.type === data.config.type) {
-      for (const key of EMAIL_TRANSPORT_SECRET_KEYS) {
-        const incoming = (data.config as Record<string, unknown>)[key];
-        if (incoming === undefined || incoming === '') {
-          merged[key] = (existingConfig as Record<string, unknown>)[key];
-        }
-      }
+    if (merged.type === 'SMTP_AUTH' && existingConfig.type === 'SMTP_AUTH' && !merged.password) {
+      merged.password = existingConfig.password;
+    }
+
+    if (merged.type !== 'SMTP_AUTH' && merged.type === existingConfig.type && !merged.apiKey) {
+      merged.apiKey = existingConfig.apiKey;
     }
 
     const config = ZEmailTransportConfigSchema.parse(merged);

packages/trpc/server/admin-router/update-organisation-member-role.ts

@@ -148,7 +148,7 @@ export const updateOrganisationMemberRoleRoute = adminProcedure
       return;
     }
 
-    const targetRole = role as OrganisationMemberRole;
+    const targetRole = role;
 
     if (currentOrganisationRole === targetRole) {
       throw new AppError(AppErrorCode.INVALID_REQUEST, {

packages/trpc/server/admin-router/update-subscription-claim.ts

@@ -54,10 +54,11 @@ export const updateSubscriptionClaimRoute = adminProcedure
     }
   });
 
-function getNewTruthyFlags(a: Partial<TClaimFlags>, b: Partial<TClaimFlags>): Record<keyof TClaimFlags, true> {
+function getNewTruthyFlags(a: Partial<TClaimFlags>, b: Partial<TClaimFlags>) {
   const flags: { [key in keyof TClaimFlags]?: true } = {};
 
   for (const key in b) {
+    // SAFETY: `b` is a Partial<TClaimFlags>, so its enumerable keys are TClaimFlags keys.
     // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
     const typedKey = key as keyof TClaimFlags;
 
@@ -66,6 +67,5 @@ function getNewTruthyFlags(a: Partial<TClaimFlags>, b: Partial<TClaimFlags>): Re
     }
   }
 
-  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-  return flags as Record<keyof TClaimFlags, true>;
+  return flags;
 }

packages/trpc/server/auth-router/create-passkey.ts

@@ -8,6 +8,8 @@ export const createPasskeyRoute = authenticatedProcedure
   .input(ZCreatePasskeyRequestSchema)
   .output(ZCreatePasskeyResponseSchema)
   .mutation(async ({ ctx, input }) => {
+    // SAFETY: ZRegistrationResponseJSONSchema validates the same fields RegistrationResponseJSON
+    // declares; the assertion only restores the library type that zod inference loses.
     // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
     const verificationResponse = input.verificationResponse as RegistrationResponseJSON;
 

packages/trpc/server/document-router/access-auth-request-2fa-email.ts

@@ -29,8 +29,6 @@ export const accessAuthRequest2FAEmailRoute = procedure
 
       assertRateLimit(rateLimitResult);
 
-      const user = ctx.user;
-
       // Get document and recipient by token
       const envelope = await prisma.envelope.findFirst({
         where: {

packages/trpc/server/enterprise-router/update-organisation-email.types.ts

@@ -6,11 +6,11 @@ export const ZUpdateOrganisationEmailRequestSchema = z
   .object({
     emailId: z.string(),
   })
-  .extend(
+  .merge(
     ZCreateOrganisationEmailRequestSchema.pick({
       emailName: true,
       // replyTo: true
-    }).shape,
+    }),
   );
 
 export const ZUpdateOrganisationEmailResponseSchema = z.void();

packages/trpc/server/folder-router/router.ts

@@ -174,7 +174,7 @@ export const folderRouter = router({
             folderId: parentId,
             type,
           });
-        } catch (error) {
+        } catch {
           throw new AppError(AppErrorCode.NOT_FOUND, {
             message: 'Parent folder not found',
           });

packages/trpc/server/profile-router/router.ts

@@ -92,7 +92,7 @@ export const profileRouter = router({
 
       const parsedTeamId = teamId ? Number(teamId) : null;
 
-      if (typeof parsedTeamId === 'number') {
+      if (parsedTeamId !== null) {
         if (Number.isNaN(parsedTeamId) || parsedTeamId <= 0) {
           throw new AppError(AppErrorCode.INVALID_BODY, {
             message: 'Invalid team ID provided',

packages/trpc/server/team-router/update-team-settings.ts

@@ -138,7 +138,7 @@ export const updateTeamSettingsRoute = authenticatedProcedure
 
     if (brandingCss === null) {
       sanitizedBrandingCss = null;
-    } else if (typeof brandingCss === 'string') {
+    } else if (brandingCss !== undefined) {
       const result = sanitizeBrandingCss(brandingCss);
       sanitizedBrandingCss = result.css.trim() === '' ? null : result.css;
       cssWarnings = result.warnings;

packages/ui/components/signing-card.tsx

@@ -35,7 +35,7 @@ export const SigningCard3D = ({ className, name, signature, signingCelebrationIm
 
   const [trackMouse, setTrackMouse] = useState(false);
 
-  const timeoutRef = useRef<number | undefined>(undefined);
+  const timeoutRef = useRef<number | undefined>();
 
   const cardX = useMotionValue(0);
   const cardY = useMotionValue(0);

packages/ui/package.json

@@ -18,32 +18,59 @@
     "@documenso/tailwind-config": "*",
     "@documenso/tsconfig": "*",
     "@types/luxon": "^3.7.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "react": "^19.2.7",
+    "@types/react": "18.3.27",
+    "@types/react-dom": "^18",
+    "react": "^18",
     "typescript": "5.6.2"
   },
   "dependencies": {
     "@documenso/lib": "*",
-    "@hello-pangea/dnd": "^18.0.1",
+    "@hello-pangea/dnd": "^16.6.0",
     "@hookform/resolvers": "^3",
     "@lingui/macro": "^5.6.0",
     "@lingui/react": "^5.6.0",
+    "@radix-ui/react-accordion": "^1.2.12",
+    "@radix-ui/react-alert-dialog": "^1.1.15",
+    "@radix-ui/react-aspect-ratio": "^1.1.8",
+    "@radix-ui/react-avatar": "^1.1.11",
+    "@radix-ui/react-checkbox": "^1.3.3",
+    "@radix-ui/react-collapsible": "^1.1.12",
+    "@radix-ui/react-context-menu": "^2.2.16",
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-hover-card": "^1.1.15",
+    "@radix-ui/react-label": "^2.1.8",
+    "@radix-ui/react-menubar": "^1.1.16",
+    "@radix-ui/react-navigation-menu": "^1.2.14",
+    "@radix-ui/react-popover": "^1.1.15",
+    "@radix-ui/react-progress": "^1.1.8",
+    "@radix-ui/react-radio-group": "^1.3.8",
+    "@radix-ui/react-scroll-area": "^1.2.10",
+    "@radix-ui/react-select": "^2.2.6",
+    "@radix-ui/react-separator": "^1.1.8",
+    "@radix-ui/react-slider": "^1.3.6",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@radix-ui/react-switch": "^1.2.6",
+    "@radix-ui/react-tabs": "^1.1.13",
+    "@radix-ui/react-toast": "^1.2.15",
+    "@radix-ui/react-toggle": "^1.1.10",
+    "@radix-ui/react-toggle-group": "^1.1.11",
+    "@radix-ui/react-tooltip": "^1.2.8",
     "@scure/base": "^1.2.6",
     "@tanstack/react-table": "^8.21.3",
     "class-variance-authority": "^0.7.1",
     "clsx": "^1.2.1",
-    "cmdk": "^1.1.1",
+    "cmdk": "^0.2.1",
     "colord": "^2.9.3",
     "framer-motion": "^12.43.0",
     "lucide-react": "^0.554.0",
     "luxon": "^3.7.2",
     "pdfjs-dist": "5.4.296",
     "perfect-freehand": "^1.2.2",
-    "react": "^19.2.7",
+    "react": "^18",
     "react-colorful": "^5.6.1",
     "react-day-picker": "^8.10.1",
-    "react-dom": "^19.2.7",
+    "react-dom": "^18",
     "react-hook-form": "^7.66.1",
     "react-rnd": "^10.5.2",
     "remeda": "^2.32.0",

packages/ui/primitives/command.tsx

@@ -145,9 +145,7 @@ const CommandItem = React.forwardRef<
   <CommandPrimitive.Item
     ref={ref}
     className={cn(
-      // cmdk 1.x always renders data-disabled="true|false", so the variant must
-      // check the value (bare data-[disabled] matches attribute presence).
-      'relative flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none hover:bg-accent hover:text-accent-foreground aria-selected:bg-accent aria-selected:text-accent-foreground data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50',
+      'relative flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none hover:bg-accent hover:text-accent-foreground aria-selected:bg-accent aria-selected:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50',
       className,
     )}
     {...props}

packages/ui/primitives/document-flow/field-content.tsx

@@ -103,10 +103,15 @@ export const FieldContent = ({ field, documentMeta }: FieldIconProps) => {
   ) {
     return (
       <div className="flex flex-col gap-y-2 py-0.5">
-        <RadioGroup value={field.customText ?? ''} className="gap-y-1">
+        <RadioGroup className="gap-y-1">
           {field.fieldMeta.values.map((item, index) => (
             <div key={index} className="flex items-center">
-              <RadioGroupItem className="pointer-events-none h-3 w-3" value={item.value} id={`option-${index}`} />
+              <RadioGroupItem
+                className="pointer-events-none h-3 w-3"
+                value={item.value}
+                id={`option-${index}`}
+                checked={item.value === field.customText}
+              />
               {item.value && (
                 <Label htmlFor={`option-${index}`} className="ml-1.5 font-normal text-foreground text-xs">
                   {item.value}

packages/ui/primitives/recipient-role-icons.tsx

@@ -1,6 +1,5 @@
 import type { RecipientRole } from '@prisma/client';
 import { BadgeCheck, Copy, Eye, PencilLine, User } from 'lucide-react';
-import type { JSX } from 'react';
 
 export const ROLE_ICONS: Record<RecipientRole, JSX.Element> = {
   SIGNER: <PencilLine className="h-4 w-4" />,

packages/ui/primitives/signature-pad/signature-pad-draw.tsx

@@ -13,7 +13,7 @@ import { getSvgPathFromStroke } from './helper';
 import { Point } from './point';
 import { SignaturePadColorPicker } from './signature-pad-color-picker';
 
-const checkSignatureValidity = (element: RefObject<HTMLCanvasElement | null>) => {
+const checkSignatureValidity = (element: RefObject<HTMLCanvasElement>) => {
   if (!element.current) {
     return false;
   }