chore: improve document preference form's default settings and reset functionality

Add V2 API routes to download an envelope's certificate and audit log
separately, and align the internal cert/audit log downloads to use
envelopeId.

Enforces document visibility via getEnvelopeWhereInput and loads field
signatures so certificates render correctly.

.env.example

@@ -103,7 +103,7 @@ NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID="documenso"
 NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY="password"
 
 # [[SMTP]]
-# OPTIONAL: Defines the transport to use for sending emails. Available options: smtp-auth (default) | smtp-api | mailchannels
+# OPTIONAL: Defines the transport to use for sending emails. Available options: smtp-auth (default) | smtp-api | resend | mailchannels
 NEXT_PRIVATE_SMTP_TRANSPORT="smtp-auth"
 # OPTIONAL: Defines the host to use for sending emails.
 NEXT_PRIVATE_SMTP_HOST="127.0.0.1"

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -34,7 +34,7 @@ body:
       label: Browser [e.g., Chrome, Firefox]
   - type: input
     attributes:
-      label: Version [e.g., 2.0.1]
+      label: Version [e.g., 2.13.0]
   - type: checkboxes
     attributes:
       label: Please check the boxes that apply to this issue report.
@@ -44,4 +44,3 @@ body:
         - label: I have included relevant environment information.
         - label: I have included any relevant screenshots.
         - label: I understand that this is a voluntary contribution and that there is no guarantee of resolution.
-        - label: I want to work on creating a PR for this issue if approved

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/documenso/documenso/security/advisories/new
+    about: Please report security vulnerabilities privately via GitHub Security Advisories. Do not open a public issue.
+  - name: Questions & Discussions
+    url: https://github.com/documenso/documenso/discussions
+    about: Ask questions, share ideas, and discuss Documenso with the community.
+  - name: Discord
+    url: https://documen.so/discord
+    about: Chat with the community and the team.

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -33,4 +33,3 @@ body:
         - label: I have explained the use case or scenario for this feature.
         - label: I have included any relevant technical details or design suggestions.
         - label: I understand that this is a suggestion and that there is no guarantee of implementation.
-        - label: I want to work on creating a PR for this issue if approved

.github/ISSUE_TEMPLATE/improvement.yml

@@ -15,17 +15,6 @@ body:
       description: 'Are there any additional context or information that might be relevant to the improvement suggestion.'
     validations:
       required: false
-  - type: dropdown
-    id: assignee
-    attributes:
-      label: 'Do you want to work on this improvement?'
-      multiple: false
-      options:
-        - 'No'
-        - 'Yes'
-      default: 0
-    validations:
-      required: true
   - type: checkboxes
     attributes:
       label: 'Please check the boxes that apply to this improvement suggestion.'

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,14 @@
+<!--
+  We are no longer accepting external pull requests.
+
+  Aside from a small group of trusted contributors we reach out to directly,
+  new external PRs will usually be closed with a request to open an issue instead.
+  This is a security decision. See https://documenso.com/blog/why-we-re-pausing-external-pull-requests
+
+  If you're a trusted contributor or maintainer, continue below.
+  Otherwise, please open a detailed issue: https://github.com/documenso/documenso/issues/new/choose
+-->
+
 ## Description
 
 <!--- Describe the changes introduced by this pull request. -->

.github/PULL_REQUEST_TEMPLATE/test-addition.md

@@ -1,40 +0,0 @@
----
-name: Test Addition
-about: Submit a new test, either unit or end-to-end (E2E), for review and inclusion
----
-
-## Description
-
-<!--- Provide a clear and concise description of the new test you are adding. -->
-<!--- Explain the purpose of the test and what it aims to validate. -->
-
-## Related Issue
-
-<!--- If this test addition is related to a specific issue, reference it here using #issue_number. -->
-<!--- For example, "Fixes #123" or "Addresses #456". -->
-
-## Test Details
-
-<!--- Describe the details of the test you're adding. -->
-<!--- Include information about inputs, expected outputs, and any specific scenarios. -->
-
-- Test Name: Name of the test
-- Type: [Unit / E2E]
-- Description: Brief description of what the test checks
-- Inputs: What inputs the test uses (if applicable)
-- Expected Output: What output or behavior the test expects
-
-## Checklist
-
-<!--- Please check the boxes that apply to this pull request. -->
-<!--- You can add or remove items as needed. -->
-
-- [ ] I have written the new test and ensured it works as intended.
-- [ ] I have added necessary documentation to explain the purpose of the test.
-- [ ] I have followed the project's testing guidelines and coding style.
-- [ ] I have addressed any review feedback from previous submissions, if applicable.
-
-## Additional Notes
-
-<!--- Provide any additional context or notes for the reviewers. -->
-<!--- This might include explanations about the testing approach or any potential concerns. -->

.github/workflows/first-interaction.yml

@@ -1,13 +1,10 @@
 name: 'Welcome New Contributors'
 
 on:
-  pull_request:
-    types: ['opened']
   issues:
     types: ['opened']
 
 permissions:
-  pull-requests: write
   issues: write
 
 jobs:
@@ -20,10 +17,7 @@ jobs:
       - uses: actions/first-interaction@v1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-          pr-message: |
-            Thank you for creating your first Pull Request and for being a part of the open signing revolution! 💚🚀
-            <br /> Feel free to hop into our community in [Discord](https://documen.so/discord)
           issue-message: |
             Thank you for opening your first issue and for being a part of the open signing revolution!
-            <br /> One of our team members will review it and get back to you as soon as it possible 💚
+            <br /> One of our team members will review it and get back to you as soon as possible 💚
             <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

.github/workflows/issue-assignee-check.yml

@@ -1,62 +0,0 @@
-name: 'Issue Assignee Check'
-
-on:
-  issues:
-    types: ['assigned']
-
-permissions:
-  issues: write
-
-jobs:
-  countIssues:
-    if: ${{ github.event.issue.assignee }} && github.event.action == 'assigned' && github.event.sender.type == 'User'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-
-      - name: Install Octokit
-        run: npm install @octokit/rest@18
-
-      - name: Check Assigned User's Issue Count
-        id: parse-comment
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { Octokit } = require("@octokit/rest");
-            const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
-
-            const username = context.payload.issue.assignee.login;
-            console.log(`Username Extracted: ${username}`);
-
-            const { data: issues } = await octokit.issues.listForRepo({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              assignee: username,
-              state: 'open'
-            });
-
-            const issueCount = issues.length;
-            console.log(`Issue Count For ${username}: ${issueCount}`);
-
-            if (issueCount > 3) {
-              let issueCountMessage = `### 🚨 Documenso Police 🚨`;
-              issueCountMessage += `\n@${username} has ${issueCount} open issues assigned already. Consider whether this issue should be assigned to them or left open for another contributor.`;
-
-              await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body: issueCountMessage,
-                headers: {
-                  'Authorization': `token ${{ secrets.GITHUB_TOKEN }}`,
-                }
-              });
-            }

.github/workflows/pr-review-reminder.yml

@@ -1,63 +0,0 @@
-name: 'PR Review Reminder'
-
-on:
-  pull_request:
-    types: ['opened', 'ready_for_review']
-
-permissions:
-  pull-requests: write
-
-jobs:
-  checkPRs:
-    if: ${{ github.event.pull_request.user.login }} && github.event.action == ('opened' || 'ready_for_review')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-
-      - name: Install Octokit
-        run: npm install @octokit/rest@18
-
-      - name: Check user's PRs awaiting review
-        id: parse-prs
-        uses: actions/github-script@v5
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { Octokit } = require("@octokit/rest");
-            const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
-
-            const username = context.payload.pull_request.user.login;
-            console.log(`Username Extracted: ${username}`);
-
-            const { data: pullRequests } = await octokit.pulls.list({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              state: 'open',
-              sort: 'created',
-              direction: 'asc',
-            });
-
-            const userPullRequests = pullRequests.filter(pr => pr.user.login === username && (pr.state === 'open' || pr.state === 'ready_for_review'));
-            const prCount = userPullRequests.length;
-            console.log(`PR Count for ${username}: ${prCount}`);
-
-            if (prCount > 3) {
-              let prReminderMessage = `🚨 @${username} has ${prCount} pull requests awaiting review. Please consider reviewing them when possible. 🚨`;
-
-              await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.payload.pull_request.number,
-                body: prReminderMessage,
-                headers: {
-                  'Authorization': `token ${{ secrets.GITHUB_TOKEN }}`,
-                }
-              });
-            }

.github/workflows/semantic-pull-requests.yml

@@ -16,24 +16,6 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - name: Check PR creator's previous activity
-        id: check_activity
-        run: |
-          CREATOR=$(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" | jq -r '.user.login')
-          ACTIVITY=$(curl -s "https://api.github.com/search/commits?q=author:${CREATOR}+repo:${{ github.repository }}" | jq -r '.total_count')
-          if [ "$ACTIVITY" -eq 0 ]; then
-            echo "::set-output name=is_new::true"
-          else
-            echo "::set-output name=is_new::false"
-          fi
-
-      - name: Count PRs created by user
-        id: count_prs
-        run: |
-          CREATOR=$(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" | jq -r '.user.login')
-          PR_COUNT=$(curl -s "https://api.github.com/search/issues?q=type:pr+is:open+author:${CREATOR}+repo:${{ github.repository }}" | jq -r '.total_count')
-          echo "::set-output name=pr_count::$PR_COUNT"
-
       - uses: amannn/action-semantic-pull-request@v5
         id: lint_pr_title
         env:
@@ -44,8 +26,6 @@ jobs:
         with:
           header: pr-title-lint-error
           message: |
-            Hey There! and thank you for opening this pull request! 📝👋🏼
-
             We require pull request titles to follow the [Conventional Commits Spec](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted.
 
             Details:
@@ -53,10 +33,3 @@ jobs:
             ```
             ${{ steps.lint_pr_title.outputs.error_message }}
             ```
-
-      - if: ${{ steps.lint_pr_title.outputs.error_message == null && steps.check_activity.outputs.is_new == 'false' && steps.count_prs.outputs.pr_count < 2}}
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          header: pr-title-lint-error
-          message: |
-            Thank you for following the naming conventions for pull request titles! 💚🚀

.github/workflows/stale.yml

@@ -21,4 +21,4 @@ jobs:
           stale-pr-message: 'This PR has not seen activitiy for a while. It will be closed in 30 days unless further activity is detected.'
           close-pr-message: 'This PR has been closed because of inactivity.'
           exempt-pr-labels: 'WIP,on-hold,needs review'
-          exempt-issue-labels: 'WIP,on-hold,needs review,roadmap,assigned,needs triage'
+          exempt-issue-labels: 'WIP,on-hold,needs review,roadmap,status: assigned,status: triage'

.gitpod.yml

@@ -31,8 +31,7 @@ vscode:
   extensions:
     - aaron-bond.better-comments
     - bradlc.vscode-tailwindcss
-    - dbaeumer.vscode-eslint
-    - esbenp.prettier-vscode
+    - biomejs.biome
     - mikestead.dotenv
     - unifiedjs.vscode-mdx
     - GitHub.vscode-pull-request-github

.well-known/security.txt

@@ -1,7 +1,14 @@
-# General Issues
+# Report security vulnerabilities privately via GitHub Security Advisories (preferred).
+Contact: https://github.com/documenso/documenso/security/advisories/new
+
+# Alternatively, report critical issues privately by email.
+Contact: mailto:security@documenso.com
+
+# Security policy
+Policy: https://github.com/documenso/documenso/security/policy
+
+# General (non-security) issues
 Contact: https://github.com/documenso/documenso/issues/new?assignees=&labels=bug&projects=&template=bug-report.yml
 
-# Report critical issues privately to let us take appropriate action before publishing.
-Contact: mailto:security@documenso.com
 Preferred-Languages: en
-Canonical: https://documenso.com/.well-known/security.txt
+Canonical: https://documenso.com/.well-known/security.txt

CONTRIBUTING.md

@@ -1,13 +1,27 @@
 # Contributing to Documenso
 
-If you plan to contribute to Documenso, please take a moment to feel awesome ✨ People like you are what open source is about ♥. Any contributions, no matter how big or small, are highly appreciated.
+> **We are no longer accepting external pull requests.**
+>
+> Aside from a small group of trusted contributors we reach out to directly, we no longer merge external PRs. New pull requests will usually be closed with a request to open an issue instead. This is a security decision, not a judgement on your work. Read [Why We're Pausing External Pull Requests](https://documenso.com/blog/why-we-re-pausing-external-pull-requests) for the full reasoning.
+>
+> Documenso stays open source. You can still read, audit, run, and fork the code. The best way to contribute is through detailed issues.
 
-## Before getting started
+## How to contribute now
 
-- Before jumping into a PR be sure to search [existing PRs](https://github.com/documenso/documenso/pulls) or [issues](https://github.com/documenso/documenso/issues) for an open or closed item that relates to your submission.
-- Select an issue from [here](https://github.com/documenso/documenso/issues) or create a new one
-- Consider the results from the discussion on the issue
-- Accept the [Contributor License Agreement](https://documen.so/cla) to ensure we can accept your contributions.
+The most useful contribution is a detailed issue. Treat it like a spec. The more detail, the better:
+
+- The problem you're trying to solve, and who it affects
+- How you expect the feature or change to behave
+- Edge cases, constraints, and anything you've already considered
+- Examples, mockups, or references where they help
+
+Before opening an issue, search [existing issues](https://github.com/documenso/documenso/issues) and [discussions](https://github.com/documenso/documenso/discussions) for related items. If a proposal is detailed and fits where Documenso is heading, we'll pick it up and build against it.
+
+For security vulnerabilities, do not open a public issue. Follow our [Security Policy](./SECURITY.md) instead.
+
+---
+
+The sections below are for trusted contributors working with us directly, and for anyone running Documenso locally or maintaining a fork.
 
 ## English only PRs and Issues
 

README.md

@@ -51,16 +51,18 @@ Join us in creating the next generation of open trust infrastructure.
 
 ## Community and Next Steps 🎯
 
-- Check out the first source code release in this repository and test it.
+- Try Documenso by self-hosting it or signing up at [documenso.com](https://documenso.com).
 - Tell us what you think in the [Discussions](https://github.com/documenso/documenso/discussions).
-- Join the [Discord server](https://documen.so/discord) for any questions and getting to know to other community members.
+- Join the [Discord server](https://documen.so/discord) for any questions and getting to know other community members.
 - ⭐ the repository to help us raise awareness.
-- Spread the word on Twitter that Documenso is working towards a more open signing tool.
-- Fix or create [issues](https://github.com/documenso/documenso/issues), that are needed for the first production release.
+- Open detailed [issues](https://github.com/documenso/documenso/issues) to report bugs or propose features.
 
 ## Contributing
 
-- To contribute, please see our [contribution guide](https://github.com/documenso/documenso/blob/main/CONTRIBUTING.md).
+> **Note**: We no longer accept external pull requests, aside from a small group of trusted contributors we reach out to directly. The best way to contribute is through detailed issues. Read [Why We're Pausing External Pull Requests](https://documenso.com/blog/why-we-re-pausing-external-pull-requests) for the reasoning.
+
+- Documenso stays open source. You can read, audit, run, and fork the code.
+- To report issues or propose changes, see our [contribution guide](https://github.com/documenso/documenso/blob/main/CONTRIBUTING.md).
 
 ## Contact us
 
@@ -81,17 +83,21 @@ Contact us if you are interested in our Enterprise plan for large organizations
   <a href=""><img src="" alt=""></a>
 </p>
 
-- [Typescript](https://www.typescriptlang.org/) - Language
-- [ReactRouter](https://reactrouter.com/) - Framework
+- [TypeScript](https://www.typescriptlang.org/) - Language
+- [React Router v7](https://reactrouter.com/) - Framework
+- [Hono](https://hono.dev/) - Server
 - [Prisma](https://www.prisma.io/) - ORM
-- [Tailwind](https://tailwindcss.com/) - CSS
-- [shadcn/ui](https://ui.shadcn.com/) - Component Library
+- [Tailwind CSS](https://tailwindcss.com/) - CSS
+- [shadcn/ui](https://ui.shadcn.com/) + [Radix UI](https://www.radix-ui.com/) - Component Library
 - [react-email](https://react.email/) - Email Templates
+- [Lingui](https://lingui.dev/) - Internationalization
 - [tRPC](https://trpc.io/) - API
-- [@documenso/pdf-sign](https://www.npmjs.com/package/@documenso/pdf-sign) - PDF Signatures (launching soon)
-- [React-PDF](https://github.com/wojtekmaj/react-pdf) - Viewing PDFs
-- [PDF-Lib](https://github.com/Hopding/pdf-lib) - PDF manipulation
+- [@libpdf/core](https://www.npmjs.com/package/@libpdf/core) - PDF Signatures
+- [pdf.js](https://mozilla.github.io/pdf.js/) - Viewing PDFs
+- [@cantoo/pdf-lib](https://github.com/cantoo-scribe/pdf-lib) - PDF manipulation
 - [Stripe](https://stripe.com/) - Payments
+- [Biome](https://biomejs.dev/) - Linting & Formatting
+- [Playwright](https://playwright.dev/) - E2E Testing
 
 <!-- - Support for [opensignpdf (requires Java on server)](https://github.com/open-pdf-sign) is currently planned. -->
 
@@ -196,6 +202,10 @@ For full instructions, requirements, and configuration details, see the [Self Ho
 
 [![Deploy on Elestio](https://elest.io/images/logos/deploy-to-elestio-btn.png)](https://elest.io/open-source/documenso)
 
+## Security
+
+If you believe you have found a security vulnerability in Documenso, please report it through our [Security Policy](https://github.com/documenso/documenso/security/policy). We prioritize private reports via [GitHub Security Advisories](https://github.com/documenso/documenso/security/advisories/new). See [SECURITY.md](./SECURITY.md) for scope and details.
+
 ## Troubleshooting
 
 For troubleshooting self-hosted deployments, see the [Troubleshooting guide](https://docs.documenso.com/docs/self-hosting/maintenance/troubleshooting) and [Tips & Common Pitfalls](https://docs.documenso.com/docs/self-hosting/getting-started/tips).

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+We take the security of Documenso seriously. As a platform trusted with legally binding documents, the safety of the project and the people who rely on it is a priority for us. We're grateful to the security researchers who help keep it that way. If you've found an issue, we'd genuinely like to hear about it.
+
+## Reporting a Vulnerability
+
+Report security vulnerabilities privately. Do not open a public issue, discussion, or pull request for security reports.
+
+We accept reports through two channels, in order of preference:
+
+1. **GitHub Security Advisories (preferred)**. Use the [private vulnerability reporting form](https://github.com/documenso/documenso/security/advisories/new). This is our primary channel and lets us triage and work with you on a fix.
+2. **Email**. If you cannot use GitHub Security Advisories, email [security@documenso.com](mailto:security@documenso.com).
+
+Include the affected version, a clear description, steps to reproduce, and the potential impact.
+
+## Triage and Response
+
+We triage reports as we have availability. We read every report we receive, and we appreciate the time and effort it takes to put one together.
+
+We also run [Codex](https://openai.com/codex/) security analysis across the codebase. If Codex has already reported the issue you're sending us, we may close your report as a duplicate. Please don't take this as a reflection on your work; it just means our automated tooling happened to surface the same thing first.
+
+## Scope
+
+This policy covers vulnerabilities in the Documenso application code in this repository.
+
+The items below are out of scope and will not be accepted. They are deployment, infrastructure, and configuration concerns that belong with the operator's firewall, network, and environment setup, not the application:
+
+- Server-Side Request Forgery (SSRF) and related network-egress concerns
+- DNS rebinding and other DNS-level issues
+- Rate limiting, denial of service, and volumetric attacks
+- TLS and certificate configuration, HTTP security headers, and other reverse-proxy or web-server configuration
+- Findings that depend on insecure self-hosted infrastructure or misconfiguration
+
+If you're unsure whether something is in scope, report it privately anyway and we'll happily take a look.
+
+## Supported Versions
+
+Security fixes are applied to the latest release. Run the most recent version of Documenso.

SIGNING.md

@@ -1,67 +1,9 @@
-# Creating your own signing certificate
+# Signing Certificate
 
-For the digital signature of your documents you need a signing certificate in .p12 format (public and private key). You can buy one (not recommended for dev) or use the steps to create a self-signed one:
+Documenso needs a signing certificate to digitally sign documents. For full, up-to-date instructions on generating, converting, and configuring a certificate, see the official documentation:
 
-1. Generate a private key using the OpenSSL command. You can run the following command to generate a 2048-bit RSA key:
+- [Signing Certificate](https://docs.documenso.com/docs/self-hosting/configuration/signing-certificate): Overview and all certificate options
+- [Local Certificate](https://docs.documenso.com/docs/self-hosting/configuration/signing-certificate/local): Generate a self-signed `.p12` certificate with OpenSSL
+- [Google Cloud HSM](https://docs.documenso.com/docs/self-hosting/configuration/signing-certificate/google-cloud-hsm): Sign using Google Cloud KMS
 
-   `openssl genrsa -out private.key 2048`
-
-2. Generate a self-signed certificate using the private key. You can run the following command to generate a self-signed certificate:
-
-   `openssl req -new -x509 -key private.key -out certificate.crt -days 365`
-
-   This will prompt you to enter some information, such as the Common Name (CN) for the certificate. Make sure you enter the correct information. The `-days` parameter sets the number of days for which the certificate is valid.
-
-3. Combine the private key and the self-signed certificate to create the p12 certificate. You can run the following commands to do this:
-
-   ```bash
-   # Set certificate password securely (won't appear in command history)
-   read -s -p "Enter certificate password: " CERT_PASS
-   echo
-   
-   # Create the p12 certificate using the environment variable
-   openssl pkcs12 -export -out certificate.p12 -inkey private.key -in certificate.crt \
-       -password env:CERT_PASS \
-       -keypbe PBE-SHA1-3DES \
-       -certpbe PBE-SHA1-3DES \
-       -macalg sha1
-   ```
-
-4. **IMPORTANT**: A certificate password is required to prevent signing failures. Make sure to use a strong password (minimum 4 characters) when prompted. Certificates without passwords will cause "Failed to get private key bags" errors during document signing.
-
-5. Place the certificate `/apps/remix/resources/certificate.p12` (If the path does not exist, it needs to be created)
-
-## Docker
-
-> We are still working on the publishing of docker images, in the meantime you can follow the steps below to create a production ready docker image.
-
-Want to create a production ready docker image? Follow these steps:
-
-- cd into `docker` directory
-- Make `build.sh` executable by running `chmod +x build.sh`
-- Run `./build.sh` to start building the docker image.
-- Publish the image to your docker registry of choice (or) If you prefer running the image from local, run the below command
-
-```
-docker run -d --restart=unless-stopped -p 3000:3000 -v documenso:/app/data --name documenso documenso:latest
-```
-
-Command Breakdown:
-
-- `-d` - Let's you run the container in background
-- `-p` - Passes down which ports to use. First half is the host port, Second half is the app port. You can change the first half anything you want and reverse proxy to that port.
-- `-v` - Volume let's you persist the data
-- `--name` - Name of the container
-- `documenso:latest` - Image you have built
-
-## Deployment
-
-We support a variety of deployment methods, and are actively working on adding more. Stay tuned for updates!
-
-## Railway
-
-[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/deploy/DjrRRX?referralCode=EZR3s0&utm_medium=integration&utm_source=template&utm_campaign=generic)
-
-## Render
-
-[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/documenso/documenso)
+For deploying Documenso with Docker, see the [Docker Deployment](https://docs.documenso.com/docs/self-hosting/deployment/docker) and [Docker Compose](https://docs.documenso.com/docs/self-hosting/deployment/docker-compose) guides.

apps/docs/README.md

@@ -1,45 +1,16 @@
-# docs
+# @documenso/docs
 
-This is a Next.js application generated with
-[Create Fumadocs](https://github.com/fuma-nama/fumadocs).
+The Documenso documentation site, built with [Next.js](https://nextjs.org/) and [Fumadocs](https://fumadocs.dev/). Published at [docs.documenso.com](https://docs.documenso.com).
 
-Run development server:
+Content lives under `content/docs/` as MDX. See [WRITING_STYLE.md](../../WRITING_STYLE.md) for the documentation writing conventions.
 
 ```bash
-npm run dev
-# or
-pnpm dev
-# or
-yarn dev
+# From the monorepo root
+npm run dev --filter=@documenso/docs
 ```
 
-Open http://localhost:3000 with your browser to see the result.
+## Structure
 
-## Explore
-
-In the project, you can see:
-
-- `lib/source.ts`: Code for content source adapter, [`loader()`](https://fumadocs.dev/docs/headless/source-api) provides the interface to access your content.
-- `lib/layout.shared.tsx`: Shared options for layouts, optional but preferred to keep.
-
-| Route                     | Description                                            |
-| ------------------------- | ------------------------------------------------------ |
-| `app/(home)`              | The route group for your landing page and other pages. |
-| `app/docs`                | The documentation layout and pages.                    |
-| `app/api/search/route.ts` | The Route Handler for search.                          |
-
-### Fumadocs MDX
-
-A `source.config.ts` config file has been included, you can customise different options like frontmatter schema.
-
-Read the [Introduction](https://fumadocs.dev/docs/mdx) for further details.
-
-## Learn More
-
-To learn more about Next.js and Fumadocs, take a look at the following
-resources:
-
-- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js
-  features and API.
-- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
-- [Fumadocs](https://fumadocs.dev) - learn about Fumadocs
+- `content/docs/`: Documentation pages (MDX).
+- `lib/source.ts`: Content source adapter.
+- `lib/layout.shared.tsx`: Shared layout options.

apps/docs/content/docs/developers/local-development/index.mdx

@@ -15,16 +15,17 @@ Pick the one that fits your needs the best.
 
 ## Tech Stack
 
-- [Typescript](https://www.typescriptlang.org/) - Language
-- [React Router](https://reactrouter.com/) - Framework
+- [TypeScript](https://www.typescriptlang.org/) - Language
+- [React Router v7](https://reactrouter.com/) - Framework
+- [Hono](https://hono.dev/) - Server
 - [Prisma](https://www.prisma.io/) - ORM
-- [Tailwind](https://tailwindcss.com/) - CSS
-- [shadcn/ui](https://ui.shadcn.com/) - Component Library
+- [Tailwind CSS](https://tailwindcss.com/) - CSS
+- [shadcn/ui](https://ui.shadcn.com/) + [Radix UI](https://www.radix-ui.com/) - Component Library
 - [react-email](https://react.email/) - Email Templates
+- [Lingui](https://lingui.dev/) - Internationalization
 - [tRPC](https://trpc.io/) - API
-- [@documenso/pdf-sign](https://www.npmjs.com/package/@documenso/pdf-sign) - PDF Signatures
-- [React-PDF](https://github.com/wojtekmaj/react-pdf) - Viewing PDFs
-- [PDF-Lib](https://github.com/Hopding/pdf-lib) - PDF manipulation
+- [@libpdf/core](https://www.npmjs.com/package/@libpdf/core) - PDF Signing and Manipulation
+- [pdf.js](https://mozilla.github.io/pdf.js/) - Viewing PDFs
 - [Stripe](https://stripe.com/) - Payments
 
 <div className="mt-16 flex items-center justify-center gap-4">

apps/docs/content/docs/self-hosting/configuration/email.mdx

@@ -278,7 +278,9 @@ Test your email configuration by creating an account or resetting a password. Th
 
 ### Using a Test SMTP Server
 
-For development or testing, use a local SMTP server like [Mailhog](https://github.com/mailhog/MailHog) or [Mailpit](https://github.com/axllent/mailpit):
+For development or testing, use a local SMTP server like [Inbucket](https://www.inbucket.org/), [Mailpit](https://github.com/axllent/mailpit), or [Mailhog](https://github.com/mailhog/MailHog). The default development setup (`docker/development/compose.yml`) already runs Inbucket, with its web UI on port 9000 and SMTP on port 2500.
+
+To run one standalone instead:
 
 ```bash
 # Using Docker

apps/docs/content/docs/self-hosting/configuration/environment.mdx

@@ -86,6 +86,21 @@ Callback URL: `https://<your-domain>/api/auth/callback/microsoft`
 | `NEXT_PRIVATE_OIDC_SKIP_VERIFY`    | `false` | Skip email verification for OIDC accounts          |
 | `NEXT_PRIVATE_OIDC_PROMPT`         | `login` | OIDC prompt parameter. Set to empty string to omit |
 
+### Webhooks
+
+| Variable                                | Default | Description                                                              |
+| --------------------------------------- | ------- | ------------------------------------------------------------------------ |
+| `NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS` | -       | Comma-separated hostnames or IPs allowed to resolve to private addresses |
+
+Before delivering a webhook, Documenso checks whether the target resolves to a
+private or loopback address and blocks it if so. This check is best-effort and
+fails open. Use `NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS` to allow specific
+internal hosts, for example when delivering to a service on your own network:
+
+```bash
+NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS="hooks.internal.example,10.0.0.5"
+```
+
 ---
 
 ## Email Configuration

apps/docs/content/docs/self-hosting/deployment/kubernetes.mdx

@@ -235,7 +235,7 @@ spec:
 ```
 
 <Callout type="info">
-  Pin to a specific image tag (e.g., `documenso/documenso:1.5.0`) in production instead of `latest`
+  Pin to a specific image tag (e.g., `documenso/documenso:<version>`) in production instead of `latest`
   to ensure predictable deployments.
 </Callout>
 

apps/docs/content/docs/self-hosting/deployment/manual.mdx

@@ -14,8 +14,8 @@ import { Step, Steps } from 'fumadocs-ui/components/steps';
 
 ## Prerequisites
 
-- Node.js 20 or later
-- npm
+- Node.js 22 or later
+- npm 11 or later
 - PostgreSQL 14 or later
 - A Linux server (for systemd service setup)
 

apps/docs/content/docs/self-hosting/getting-started/quick-start.mdx

@@ -124,12 +124,16 @@ docker compose -f docker/development/compose.yml exec database \
 
 The quick start setup runs the following containers:
 
-| Container   | Purpose                          | Port  |
-| ----------- | -------------------------------- | ----- |
-| `documenso` | Main application                 | 3000  |
-| `database`  | PostgreSQL database              | 54320 |
-| `maildev`   | Local email testing server       | 2500  |
-| `minio`     | S3-compatible storage (optional) | 9000  |
+| Container   | Purpose                              | Port                          |
+| ----------- | ------------------------------------ | ----------------------------- |
+| `documenso` | Main application                     | 3000                          |
+| `database`  | PostgreSQL database                  | 54320                         |
+| `inbucket`  | Local email testing server           | 9000 (web UI), 2500 (SMTP)    |
+| `redis`     | Cache and background job queue       | 63790                         |
+| `minio`     | S3-compatible storage                | 9002 (API), 9001 (console)    |
+| `gotenberg` | Document conversion (optional)       | 3005                          |
+
+The local email server is [Inbucket](https://www.inbucket.org/). Open its web UI at [http://localhost:9000](http://localhost:9000) to view emails Documenso sends during development. For your own deployment you can use any SMTP-compatible mailserver, such as Inbucket, [Mailpit](https://github.com/axllent/mailpit), or [Mailhog](https://github.com/mailhog/MailHog).
 
 ## Useful Commands
 

apps/docs/content/docs/self-hosting/getting-started/requirements.mdx

@@ -141,8 +141,8 @@ If building from source (not using Docker images):
 
 | Requirement | Version |
 | ----------- | ------- |
-| Node.js     | 18+     |
-| npm         | 8+      |
+| Node.js     | 22+     |
+| npm         | 11+     |
 
 ---
 
@@ -169,7 +169,7 @@ Documenso runs on:
 | MySQL/MariaDB  | PostgreSQL-specific features required |
 | SQLite         | Not suitable for production workloads |
 | MongoDB        | Relational database required          |
-| Node.js < 18   | Modern JavaScript features required   |
+| Node.js < 22   | Modern JavaScript features required   |
 
 ---
 

apps/docs/content/docs/self-hosting/getting-started/tips.mdx

@@ -92,7 +92,7 @@ Use a specific version tag in production:
 
 ```bash
 # Good — predictable, reproducible
-docker pull documenso/documenso:1.8.0
+docker pull documenso/documenso:<version>
 
 # Risky — may pull breaking changes
 docker pull documenso/documenso:latest

apps/docs/content/docs/self-hosting/index.mdx

@@ -27,6 +27,14 @@ import { Callout } from 'fumadocs-ui/components/callout';
   Please see all the [requirements](/docs/self-hosting/getting-started/requirements) before proceeding.
 </Callout>
 
+<Callout type="warn">
+  **You are responsible for your own network security.** Documenso applies best-effort, non-exhaustive
+  checks to outbound requests such as webhooks, but these are not a complete SSRF mitigation and they
+  fail open. A self-hosted instance can reach internal addresses on your network. Restricting outbound
+  traffic, egress filtering, and blocking access to internal services and cloud metadata endpoints is
+  your responsibility through your firewall and network configuration.
+</Callout>
+
 ---
 
 ## Deployment Options

apps/docs/content/docs/self-hosting/maintenance/upgrades.mdx

@@ -165,10 +165,10 @@ See [Backups](/docs/self-hosting/maintenance/backups) for automated backup strat
 ### Pull the new image
 
 ```bash
-docker pull documenso/documenso:1.6.0
+docker pull documenso/documenso:<version>
 ```
 
-Replace `1.6.0` with your target version.
+Replace `<version>` with your target version.
 
 </Step>
 <Step>
@@ -189,7 +189,7 @@ docker run -d \
   -p 3000:3000 \
   --env-file .env \
   -v /path/to/cert.p12:/opt/documenso/cert.p12:ro \
-  documenso/documenso:1.6.0
+  documenso/documenso:<version>
 ```
 
 </Step>
@@ -223,14 +223,14 @@ Edit `compose.yml` or your `.env` file to specify the new version:
 ```yaml
 services:
   documenso:
-    image: documenso/documenso:1.6.0
+    image: documenso/documenso:<version>
 ```
 
 Or if using environment variable substitution:
 
 ```bash
 # In .env
-DOCUMENSO_VERSION=1.6.0
+DOCUMENSO_VERSION=<version>
 ```
 
 ```yaml
@@ -283,7 +283,7 @@ Edit the deployment directly:
 
 ```bash
 kubectl set image deployment/documenso \
-  documenso=documenso/documenso:1.6.0 \
+  documenso=documenso/documenso:<version> \
   -n documenso
 ```
 
@@ -295,7 +295,7 @@ spec:
     spec:
       containers:
         - name: documenso
-          image: documenso/documenso:1.6.0
+          image: documenso/documenso:<version>
 ```
 
 Then apply:
@@ -421,12 +421,12 @@ To run migrations manually before upgrading:
 
 ```bash
 # Pull the new image
-docker pull documenso/documenso:1.6.0
+docker pull documenso/documenso:<version>
 
 # Run migrations only
 docker run --rm \
   -e NEXT_PRIVATE_DATABASE_URL="postgresql://user:password@host:5432/documenso" \
-  documenso/documenso:1.6.0 \
+  documenso/documenso:<version> \
   npx prisma migrate deploy
 ```
 
@@ -516,7 +516,7 @@ docker run -d \
   -p 3000:3000 \
   --env-file .env \
   -v /path/to/cert.p12:/opt/documenso/cert.p12:ro \
-  documenso/documenso:1.5.0
+  documenso/documenso:<previous-version>
 ```
 
 </Tab>

apps/remix/Dockerfile

@@ -1,22 +0,0 @@
-FROM node:20-alpine AS development-dependencies-env
-COPY . /app
-WORKDIR /app
-RUN npm ci
-
-FROM node:20-alpine AS production-dependencies-env
-COPY ./package.json package-lock.json /app/
-WORKDIR /app
-RUN npm ci --omit=dev
-
-FROM node:20-alpine AS build-env
-COPY . /app/
-COPY --from=development-dependencies-env /app/node_modules /app/node_modules
-WORKDIR /app
-RUN npm run build
-
-FROM node:20-alpine
-COPY ./package.json package-lock.json /app/
-COPY --from=production-dependencies-env /app/node_modules /app/node_modules
-COPY --from=build-env /app/build /app/build
-WORKDIR /app
-CMD ["npm", "run", "start"]

apps/remix/README.md

@@ -1,100 +1,14 @@
-# Welcome to React Router!
+# @documenso/remix
 
-A modern, production-ready template for building full-stack React applications using React Router.
+The main Documenso web application. Built with [React Router v7](https://reactrouter.com/) and served by a [Hono](https://hono.dev/) server.
 
-[![Open in StackBlitz](https://developer.stackblitz.com/img/open_in_stackblitz.svg)](https://stackblitz.com/github/remix-run/react-router-templates/tree/main/default)
+This package is part of the Documenso monorepo and is not meant to be run standalone. Use the root scripts instead.
 
-## Features
-
-- 🚀 Server-side rendering
-- ⚡️ Hot Module Replacement (HMR)
-- 📦 Asset bundling and optimization
-- 🔄 Data loading and mutations
-- 🔒 TypeScript by default
-- 🎉 TailwindCSS for styling
-- 📖 [React Router docs](https://reactrouter.com/)
-
-## Getting Started
-
-### Installation
-
-Install the dependencies:
-
-```bash
-npm install
-```
-
-### Development
-
-Start the development server with HMR:
+- Local development: see the [root README](../../README.md) and the [Local Development docs](https://docs.documenso.com/docs/developers/local-development).
+- Self-hosting and deployment: see the [Self-Hosting docs](https://docs.documenso.com/docs/self-hosting).
+- Architecture overview: see [ARCHITECTURE.md](../../ARCHITECTURE.md).
 
 ```bash
+# From the monorepo root
 npm run dev
 ```
-
-Your application will be available at `http://localhost:5173`.
-
-## Building for Production
-
-Create a production build:
-
-```bash
-npm run build
-```
-
-## Deployment
-
-### Docker Deployment
-
-This template includes three Dockerfiles optimized for different package managers:
-
-- `Dockerfile` - for npm
-- `Dockerfile.pnpm` - for pnpm
-- `Dockerfile.bun` - for bun
-
-To build and run using Docker:
-
-```bash
-# For npm
-docker build -t my-app .
-
-# For pnpm
-docker build -f Dockerfile.pnpm -t my-app .
-
-# For bun
-docker build -f Dockerfile.bun -t my-app .
-
-# Run the container
-docker run -p 3000:3000 my-app
-```
-
-The containerized application can be deployed to any platform that supports Docker, including:
-
-- AWS ECS
-- Google Cloud Run
-- Azure Container Apps
-- Digital Ocean App Platform
-- Fly.io
-- Railway
-
-### DIY Deployment
-
-If you're familiar with deploying Node applications, the built-in app server is production-ready.
-
-Make sure to deploy the output of `npm run build`
-
-```
-├── package.json
-├── package-lock.json (or pnpm-lock.yaml, or bun.lockb)
-├── build/
-│   ├── client/    # Static assets
-│   └── server/    # Server-side code
-```
-
-## Styling
-
-This template comes with [Tailwind CSS](https://tailwindcss.com/) already configured for a simple default starting experience. You can use whatever CSS framework you prefer.
-
----
-
-Built with ❤️ using React Router.

apps/remix/app/components/dialogs/document-move-to-folder-dialog.tsx

@@ -1,243 +0,0 @@
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { FolderType } from '@documenso/lib/types/folder-type';
-import { formatDocumentsPath } from '@documenso/lib/utils/teams';
-import { trpc } from '@documenso/trpc/react';
-import { Button } from '@documenso/ui/primitives/button';
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from '@documenso/ui/primitives/dialog';
-import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '@documenso/ui/primitives/form/form';
-import { Input } from '@documenso/ui/primitives/input';
-import { useToast } from '@documenso/ui/primitives/use-toast';
-import { zodResolver } from '@hookform/resolvers/zod';
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import type * as DialogPrimitive from '@radix-ui/react-dialog';
-import { FolderIcon, HomeIcon, Loader2, Search } from 'lucide-react';
-import { useEffect, useState } from 'react';
-import { useForm } from 'react-hook-form';
-import { useNavigate } from 'react-router';
-import { z } from 'zod';
-
-import { useCurrentTeam } from '~/providers/team';
-
-export type DocumentMoveToFolderDialogProps = {
-  documentId: number;
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-  currentFolderId?: string;
-} & Omit<DialogPrimitive.DialogProps, 'children'>;
-
-const ZMoveDocumentFormSchema = z.object({
-  folderId: z.string().nullable().optional(),
-});
-
-type TMoveDocumentFormSchema = z.infer<typeof ZMoveDocumentFormSchema>;
-
-export const DocumentMoveToFolderDialog = ({
-  documentId,
-  open,
-  onOpenChange,
-  currentFolderId,
-  ...props
-}: DocumentMoveToFolderDialogProps) => {
-  const { _ } = useLingui();
-  const { toast } = useToast();
-
-  const navigate = useNavigate();
-  const team = useCurrentTeam();
-
-  const [searchTerm, setSearchTerm] = useState('');
-
-  const form = useForm<TMoveDocumentFormSchema>({
-    resolver: zodResolver(ZMoveDocumentFormSchema),
-    defaultValues: {
-      folderId: currentFolderId,
-    },
-  });
-
-  const { data: folders, isLoading: isFoldersLoading } = trpc.folder.findFoldersInternal.useQuery(
-    {
-      parentId: currentFolderId,
-      type: FolderType.DOCUMENT,
-    },
-    {
-      enabled: open,
-    },
-  );
-
-  const { mutateAsync: updateDocument } = trpc.document.update.useMutation();
-
-  useEffect(() => {
-    if (!open) {
-      form.reset();
-      setSearchTerm('');
-    } else {
-      form.reset({ folderId: currentFolderId });
-    }
-  }, [open, currentFolderId, form]);
-
-  const onSubmit = async (data: TMoveDocumentFormSchema) => {
-    try {
-      await updateDocument({
-        documentId,
-        data: {
-          folderId: data.folderId ?? null,
-        },
-      });
-
-      const documentsPath = formatDocumentsPath(team.url);
-
-      if (data.folderId) {
-        await navigate(`${documentsPath}/f/${data.folderId}`);
-      } else {
-        await navigate(documentsPath);
-      }
-
-      toast({
-        title: _(msg`Document moved`),
-        description: _(msg`The document has been moved successfully.`),
-        variant: 'default',
-      });
-
-      onOpenChange(false);
-    } catch (err) {
-      const error = AppError.parseError(err);
-
-      if (error.code === AppErrorCode.NOT_FOUND) {
-        toast({
-          title: _(msg`Error`),
-          description: _(msg`The folder you are trying to move the document to does not exist.`),
-          variant: 'destructive',
-        });
-
-        return;
-      }
-
-      if (error.code === AppErrorCode.UNAUTHORIZED) {
-        toast({
-          title: _(msg`Error`),
-          description: _(msg`You are not allowed to move this document.`),
-          variant: 'destructive',
-        });
-
-        return;
-      }
-
-      toast({
-        title: _(msg`Error`),
-        description: _(msg`An error occurred while moving the document.`),
-        variant: 'destructive',
-      });
-    }
-  };
-
-  const filteredFolders = folders?.data.filter((folder) =>
-    folder.name.toLowerCase().includes(searchTerm.toLowerCase()),
-  );
-
-  return (
-    <Dialog {...props} open={open} onOpenChange={onOpenChange}>
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>
-            <Trans>Move Document to Folder</Trans>
-          </DialogTitle>
-
-          <DialogDescription>
-            <Trans>Select a folder to move this document to.</Trans>
-          </DialogDescription>
-        </DialogHeader>
-
-        <div className="relative">
-          <Search className="absolute top-3 left-2 h-4 w-4 text-muted-foreground" />
-          <Input
-            placeholder={_(msg`Search folders...`)}
-            value={searchTerm}
-            onChange={(e) => setSearchTerm(e.target.value)}
-            className="pl-8"
-          />
-        </div>
-
-        <Form {...form}>
-          <form onSubmit={form.handleSubmit(onSubmit)} className="flex flex-col gap-y-4">
-            <FormField
-              control={form.control}
-              name="folderId"
-              render={({ field }) => (
-                <FormItem>
-                  <FormLabel>
-                    <Trans>Folder</Trans>
-                  </FormLabel>
-
-                  <FormControl>
-                    <div className="max-h-96 space-y-2 overflow-y-auto">
-                      {isFoldersLoading ? (
-                        <div className="flex h-10 items-center justify-center">
-                          <Loader2 className="h-4 w-4 animate-spin" />
-                        </div>
-                      ) : (
-                        <>
-                          <Button
-                            type="button"
-                            variant={field.value === null ? 'default' : 'outline'}
-                            className="w-full justify-start"
-                            onClick={() => field.onChange(null)}
-                            disabled={currentFolderId === null}
-                          >
-                            <HomeIcon className="mr-2 h-4 w-4" />
-                            <Trans>Home (No Folder)</Trans>
-                          </Button>
-
-                          {filteredFolders?.map((folder) => (
-                            <Button
-                              key={folder.id}
-                              type="button"
-                              variant={field.value === folder.id ? 'default' : 'outline'}
-                              className="w-full justify-start"
-                              onClick={() => field.onChange(folder.id)}
-                              disabled={currentFolderId === folder.id}
-                            >
-                              <FolderIcon className="mr-2 h-4 w-4" />
-                              {folder.name}
-                            </Button>
-                          ))}
-
-                          {searchTerm && filteredFolders?.length === 0 && (
-                            <div className="px-2 py-2 text-center text-muted-foreground text-sm">
-                              <Trans>No folders found</Trans>
-                            </div>
-                          )}
-                        </>
-                      )}
-                    </div>
-                  </FormControl>
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-
-            <DialogFooter>
-              <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
-                <Trans>Cancel</Trans>
-              </Button>
-
-              <Button
-                type="submit"
-                disabled={isFoldersLoading || form.formState.isSubmitting || currentFolderId === null}
-              >
-                <Trans>Move</Trans>
-              </Button>
-            </DialogFooter>
-          </form>
-        </Form>
-      </DialogContent>
-    </Dialog>
-  );
-};

apps/remix/app/components/dialogs/document-preferences-reset-dialog.tsx

@@ -0,0 +1,144 @@
+import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
+import { Button } from '@documenso/ui/primitives/button';
+import {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@documenso/ui/primitives/dialog';
+import { Trans } from '@lingui/react/macro';
+import { useState } from 'react';
+
+export type DocumentPreferencesResetDialogProps = {
+  disabled?: boolean;
+  isSubmitting: boolean;
+  onReset: () => Promise<void>;
+  showAiFeatures?: boolean;
+  showDocumentVisibility?: boolean;
+  showIncludeSenderDetails?: boolean;
+  trigger?: React.ReactNode;
+};
+
+export const DocumentPreferencesResetDialog = ({
+  disabled = false,
+  isSubmitting,
+  onReset,
+  showAiFeatures = false,
+  showDocumentVisibility = false,
+  showIncludeSenderDetails = false,
+  trigger,
+}: DocumentPreferencesResetDialogProps) => {
+  const [open, setOpen] = useState(false);
+  const [isResetting, setIsResetting] = useState(false);
+
+  const isLoading = isSubmitting || isResetting;
+
+  const handleResetToDefaults = async () => {
+    setIsResetting(true);
+
+    try {
+      await onReset();
+      setOpen(false);
+    } finally {
+      setIsResetting(false);
+    }
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={(value) => !isLoading && setOpen(value)}>
+      <DialogTrigger asChild>
+        {trigger ?? (
+          <Button variant="destructive" type="button" disabled={disabled || isLoading}>
+            <Trans>Reset</Trans>
+          </Button>
+        )}
+      </DialogTrigger>
+
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>
+            <Trans>Reset document preferences</Trans>
+          </DialogTitle>
+
+          <DialogDescription>
+            <Trans>
+              This will reset all document preferences to their default values and save the changes immediately.
+            </Trans>
+          </DialogDescription>
+        </DialogHeader>
+
+        <Alert variant="warning">
+          <AlertDescription>
+            <p>
+              <Trans>Once confirmed, the following will be reset:</Trans>
+            </p>
+
+            <ul className="mt-0.5 list-inside list-disc">
+              {showDocumentVisibility && (
+                <li>
+                  <Trans>Default document visibility</Trans>
+                </li>
+              )}
+              <li>
+                <Trans>Default document language</Trans>
+              </li>
+              <li>
+                <Trans>Default date format</Trans>
+              </li>
+              <li>
+                <Trans>Default time zone</Trans>
+              </li>
+              <li>
+                <Trans>Default signature settings</Trans>
+              </li>
+              {showIncludeSenderDetails && (
+                <li>
+                  <Trans>Send on behalf of team</Trans>
+                </li>
+              )}
+              <li>
+                <Trans>Include the signing certificate in the document</Trans>
+              </li>
+              <li>
+                <Trans>Include the audit logs in the document</Trans>
+              </li>
+              <li>
+                <Trans>Default recipients</Trans>
+              </li>
+              <li>
+                <Trans>Delegate document ownership</Trans>
+              </li>
+              <li>
+                <Trans>Default envelope expiration</Trans>
+              </li>
+              <li>
+                <Trans>Default signing reminders</Trans>
+              </li>
+              {showAiFeatures && (
+                <li>
+                  <Trans>AI features</Trans>
+                </li>
+              )}
+            </ul>
+          </AlertDescription>
+        </Alert>
+
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button type="button" variant="secondary" disabled={isLoading}>
+              <Trans>Cancel</Trans>
+            </Button>
+          </DialogClose>
+
+          <Button type="button" variant="destructive" loading={isLoading} onClick={() => void handleResetToDefaults()}>
+            <Trans>Reset to defaults</Trans>
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};

apps/remix/app/components/dialogs/document-resend-dialog.tsx

@@ -1,203 +0,0 @@
-import { useSession } from '@documenso/lib/client-only/providers/session';
-import { getRecipientType } from '@documenso/lib/client-only/recipient-type';
-import { AppError } from '@documenso/lib/errors/app-error';
-import type { TRecipientLite } from '@documenso/lib/types/recipient';
-import { recipientAbbreviation } from '@documenso/lib/utils/recipient-formatter';
-import type { Document } from '@documenso/prisma/types/document-legacy-schema';
-import { trpc as trpcReact } from '@documenso/trpc/react';
-import { cn } from '@documenso/ui/lib/utils';
-import { Button } from '@documenso/ui/primitives/button';
-import { Checkbox } from '@documenso/ui/primitives/checkbox';
-import {
-  Dialog,
-  DialogClose,
-  DialogContent,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-  DialogTrigger,
-} from '@documenso/ui/primitives/dialog';
-import { DropdownMenuItem } from '@documenso/ui/primitives/dropdown-menu';
-import { Form, FormControl, FormField, FormItem, FormLabel } from '@documenso/ui/primitives/form/form';
-import { useToast } from '@documenso/ui/primitives/use-toast';
-import { zodResolver } from '@hookform/resolvers/zod';
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import { SigningStatus, type Team, type User } from '@prisma/client';
-import { History } from 'lucide-react';
-import { useState } from 'react';
-import { useForm, useWatch } from 'react-hook-form';
-import * as z from 'zod';
-
-import { useCurrentTeam } from '~/providers/team';
-import { getDistributeErrorMessage } from '~/utils/toast-error-messages';
-
-import { StackAvatar } from '../general/stack-avatar';
-
-const FORM_ID = 'resend-email';
-
-export type DocumentResendDialogProps = {
-  document: Pick<Document, 'id' | 'userId' | 'teamId' | 'status'> & {
-    user: Pick<User, 'id' | 'name' | 'email'>;
-    recipients: TRecipientLite[];
-    team: Pick<Team, 'id' | 'url'> | null;
-  };
-  recipients: TRecipientLite[];
-};
-
-export const ZResendDocumentFormSchema = z.object({
-  recipients: z.array(z.number()).min(1, {
-    message: 'You must select at least one item.',
-  }),
-});
-
-export type TResendDocumentFormSchema = z.infer<typeof ZResendDocumentFormSchema>;
-
-export const DocumentResendDialog = ({ document, recipients }: DocumentResendDialogProps) => {
-  const { user } = useSession();
-  const team = useCurrentTeam();
-
-  const { toast } = useToast();
-  const { _ } = useLingui();
-
-  const [isOpen, setIsOpen] = useState(false);
-  const isOwner = document.userId === user.id;
-  const isCurrentTeamDocument = team && document.team?.url === team.url;
-
-  const isDisabled =
-    (!isOwner && !isCurrentTeamDocument) ||
-    document.status !== 'PENDING' ||
-    !recipients.some((r) => r.signingStatus === SigningStatus.NOT_SIGNED);
-
-  const { mutateAsync: resendDocument } = trpcReact.document.redistribute.useMutation();
-
-  const form = useForm<TResendDocumentFormSchema>({
-    resolver: zodResolver(ZResendDocumentFormSchema),
-    defaultValues: {
-      recipients: [],
-    },
-  });
-
-  const {
-    handleSubmit,
-    formState: { isSubmitting },
-  } = form;
-
-  const selectedRecipients = useWatch({
-    control: form.control,
-    name: 'recipients',
-  });
-
-  const onFormSubmit = async ({ recipients }: TResendDocumentFormSchema) => {
-    try {
-      await resendDocument({ documentId: document.id, recipients });
-
-      toast({
-        title: _(msg`Document re-sent`),
-        description: _(msg`Your document has been re-sent successfully.`),
-        duration: 5000,
-      });
-
-      setIsOpen(false);
-    } catch (err) {
-      const error = AppError.parseError(err);
-      const errorMessage = getDistributeErrorMessage(error.code);
-
-      toast({
-        title: _(errorMessage.title),
-        description: _(errorMessage.description),
-        variant: 'destructive',
-        duration: 7500,
-      });
-    }
-  };
-
-  return (
-    <Dialog open={isOpen} onOpenChange={setIsOpen}>
-      <DialogTrigger asChild>
-        <DropdownMenuItem disabled={isDisabled} onSelect={(e) => e.preventDefault()}>
-          <History className="mr-2 h-4 w-4" />
-          <Trans>Resend</Trans>
-        </DropdownMenuItem>
-      </DialogTrigger>
-
-      <DialogContent className="sm:max-w-sm" hideClose>
-        <DialogHeader>
-          <DialogTitle asChild>
-            <h1 className="text-center text-xl">
-              <Trans>Who do you want to remind?</Trans>
-            </h1>
-          </DialogTitle>
-        </DialogHeader>
-
-        <Form {...form}>
-          <form id={FORM_ID} onSubmit={handleSubmit(onFormSubmit)} className="px-3">
-            <FormField
-              control={form.control}
-              name="recipients"
-              render={({ field: { value, onChange } }) => (
-                <>
-                  {recipients.map((recipient) => (
-                    <FormItem key={recipient.id} className="flex flex-row items-center justify-between gap-x-3">
-                      <FormLabel
-                        className={cn('my-2 flex items-center gap-2 font-normal', {
-                          'opacity-50': !value.includes(recipient.id),
-                        })}
-                      >
-                        <StackAvatar
-                          key={recipient.id}
-                          type={getRecipientType(recipient)}
-                          fallbackText={recipientAbbreviation(recipient)}
-                        />
-                        {recipient.email}
-                      </FormLabel>
-
-                      <FormControl>
-                        <Checkbox
-                          className="h-5 w-5 rounded-full border border-neutral-400"
-                          value={recipient.id}
-                          checked={value.includes(recipient.id)}
-                          onCheckedChange={(checked: boolean) =>
-                            checked
-                              ? onChange([...value, recipient.id])
-                              : onChange(value.filter((v) => v !== recipient.id))
-                          }
-                        />
-                      </FormControl>
-                    </FormItem>
-                  ))}
-                </>
-              )}
-            />
-          </form>
-        </Form>
-
-        <DialogFooter>
-          <div className="flex w-full flex-1 flex-nowrap gap-4">
-            <DialogClose asChild>
-              <Button
-                type="button"
-                className="flex-1 bg-black/5 hover:bg-black/10 dark:bg-muted dark:hover:bg-muted/80"
-                variant="secondary"
-                disabled={isSubmitting}
-              >
-                <Trans>Cancel</Trans>
-              </Button>
-            </DialogClose>
-
-            <Button
-              className="flex-1"
-              loading={isSubmitting}
-              type="submit"
-              form={FORM_ID}
-              disabled={isSubmitting || selectedRecipients.length === 0}
-            >
-              <Trans>Send reminder</Trans>
-            </Button>
-          </div>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  );
-};

apps/remix/app/components/dialogs/envelope-distribute-dialog.tsx

@@ -3,12 +3,13 @@ import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/org
 import { DO_NOT_INVALIDATE_QUERY_ON_MUTATION } from '@documenso/lib/constants/trpc';
 import { AppError } from '@documenso/lib/errors/app-error';
 import { extractDocumentAuthMethods } from '@documenso/lib/utils/document-auth';
+import { hasOverlappingFields } from '@documenso/lib/utils/fields-overlap';
 import { getRecipientsWithMissingFields } from '@documenso/lib/utils/recipients';
 import { zEmail } from '@documenso/lib/utils/zod';
 import { trpc, trpc as trpcReact } from '@documenso/trpc/react';
 import { DocumentSendEmailMessageHelper } from '@documenso/ui/components/document/document-send-email-message-helper';
 import { cn } from '@documenso/ui/lib/utils';
-import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
+import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
 import { Button } from '@documenso/ui/primitives/button';
 import {
   Dialog,
@@ -32,7 +33,7 @@ import { zodResolver } from '@hookform/resolvers/zod';
 import { Trans, useLingui } from '@lingui/react/macro';
 import { DocumentDistributionMethod, DocumentStatus, EnvelopeType } from '@prisma/client';
 import { AnimatePresence, motion } from 'framer-motion';
-import { InfoIcon } from 'lucide-react';
+import { AlertTriangleIcon, InfoIcon } from 'lucide-react';
 import { useEffect, useMemo, useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { useNavigate } from 'react-router';
@@ -138,6 +139,27 @@ export const EnvelopeDistributeDialog = ({
     });
   }, [recipientsWithIndex, envelope.authOptions]);
 
+  /**
+   * Whether any fields significantly overlap each other. This is surfaced as a
+   * non-blocking warning since overlapping fields still allow sending, but can
+   * complicate the signing process or cause fields to behave unexpectedly.
+   */
+  const hasOverlappingEnvelopeFields = useMemo(
+    () =>
+      hasOverlappingFields(
+        envelope.fields.map((field) => ({
+          id: field.id,
+          envelopeItemId: field.envelopeItemId,
+          page: field.page,
+          positionX: Number(field.positionX),
+          positionY: Number(field.positionY),
+          width: Number(field.width),
+          height: Number(field.height),
+        })),
+      ),
+    [envelope.fields],
+  );
+
   const invalidEnvelopeCode = useMemo(() => {
     if (recipientsMissingSignatureFields.length > 0) {
       return 'MISSING_SIGNATURES';
@@ -206,6 +228,11 @@ export const EnvelopeDistributeDialog = ({
   };
 
   useEffect(() => {
+    // Default the distribution method tab to the envelope's configured setting.
+    if (isOpen && envelope.documentMeta) {
+      setValue('meta.distributionMethod', envelope.documentMeta.distributionMethod);
+    }
+
     // Resync the whole envelope if the envelope is mid saving.
     if (isOpen && (isAutosaving || autosaveError)) {
       void handleSync();
@@ -235,6 +262,24 @@ export const EnvelopeDistributeDialog = ({
           <Form {...form}>
             <form onSubmit={handleSubmit(onFormSubmit)}>
               <fieldset disabled={isSubmitting}>
+                {hasOverlappingEnvelopeFields && (
+                  <Alert variant="warning" className="mb-4 flex flex-row items-start gap-3">
+                    <AlertTriangleIcon className="mt-0.5 h-5 w-5 flex-shrink-0" />
+
+                    <div className="flex flex-col gap-1">
+                      <AlertTitle>
+                        <Trans>Overlapping fields detected</Trans>
+                      </AlertTitle>
+                      <AlertDescription>
+                        <Trans>
+                          Some fields are placed on top of each other. This may complicate the signing process or cause
+                          fields to not work as expected.
+                        </Trans>
+                      </AlertDescription>
+                    </div>
+                  </Alert>
+                )}
+
                 <Tabs
                   onValueChange={(value) =>
                     // eslint-disable-next-line @typescript-eslint/consistent-type-assertions

apps/remix/app/components/dialogs/envelope-duplicate-dialog.tsx

@@ -1,6 +1,7 @@
 import { formatDocumentsPath, formatTemplatesPath } from '@documenso/lib/utils/teams';
 import { trpc } from '@documenso/trpc/react';
 import { Button } from '@documenso/ui/primitives/button';
+import { Checkbox } from '@documenso/ui/primitives/checkbox';
 import {
   Dialog,
   DialogClose,
@@ -11,10 +12,12 @@ import {
   DialogTitle,
   DialogTrigger,
 } from '@documenso/ui/primitives/dialog';
+import { Label } from '@documenso/ui/primitives/label';
 import { useToast } from '@documenso/ui/primitives/use-toast';
 import { Trans, useLingui } from '@lingui/react/macro';
 import { EnvelopeType } from '@prisma/client';
 import { useState } from 'react';
+import { Controller, useForm } from 'react-hook-form';
 import { useNavigate } from 'react-router';
 
 import { useCurrentTeam } from '~/providers/team';
@@ -37,6 +40,15 @@ export const EnvelopeDuplicateDialog = ({ envelopeId, envelopeType, trigger }: E
 
   const isDocument = envelopeType === EnvelopeType.DOCUMENT;
 
+  const form = useForm({
+    defaultValues: {
+      includeRecipients: true,
+      includeFields: true,
+    },
+  });
+
+  const includeRecipients = form.watch('includeRecipients');
+
   const { mutateAsync: duplicateEnvelope, isPending: isDuplicating } = trpc.envelope.duplicate.useMutation({
     onSuccess: async ({ id }) => {
       toast({
@@ -55,8 +67,14 @@ export const EnvelopeDuplicateDialog = ({ envelopeId, envelopeType, trigger }: E
   });
 
   const onDuplicate = async () => {
+    const { includeRecipients, includeFields } = form.getValues();
+
     try {
-      await duplicateEnvelope({ envelopeId });
+      await duplicateEnvelope({
+        envelopeId,
+        includeRecipients,
+        includeFields: includeRecipients && includeFields,
+      });
     } catch {
       toast({
         title: t`Something went wrong`,
@@ -70,7 +88,20 @@ export const EnvelopeDuplicateDialog = ({ envelopeId, envelopeType, trigger }: E
   };
 
   return (
-    <Dialog open={open} onOpenChange={(value) => !isDuplicating && setOpen(value)}>
+    <Dialog
+      open={open}
+      onOpenChange={(value) => {
+        if (isDuplicating) {
+          return;
+        }
+
+        setOpen(value);
+
+        if (!value) {
+          form.reset();
+        }
+      }}
+    >
       {trigger && <DialogTrigger asChild>{trigger}</DialogTrigger>}
 
       <DialogContent>
@@ -87,6 +118,49 @@ export const EnvelopeDuplicateDialog = ({ envelopeId, envelopeType, trigger }: E
           </DialogDescription>
         </DialogHeader>
 
+        <div className="space-y-4">
+          <Controller
+            control={form.control}
+            name="includeRecipients"
+            render={({ field }) => (
+              <div className="flex items-center space-x-2">
+                <Checkbox
+                  id="envelopeDuplicateIncludeRecipients"
+                  checked={field.value}
+                  onCheckedChange={(checked) => {
+                    field.onChange(checked === true);
+
+                    if (!checked) {
+                      form.setValue('includeFields', false);
+                    }
+                  }}
+                />
+                <Label htmlFor="envelopeDuplicateIncludeRecipients">
+                  <Trans>Include Recipients</Trans>
+                </Label>
+              </div>
+            )}
+          />
+
+          <Controller
+            control={form.control}
+            name="includeFields"
+            render={({ field }) => (
+              <div className="flex items-center space-x-2">
+                <Checkbox
+                  id="envelopeDuplicateIncludeFields"
+                  checked={field.value}
+                  disabled={!includeRecipients}
+                  onCheckedChange={(checked) => field.onChange(checked === true)}
+                />
+                <Label htmlFor="envelopeDuplicateIncludeFields" className={!includeRecipients ? 'opacity-50' : ''}>
+                  <Trans>Include Fields</Trans>
+                </Label>
+              </div>
+            )}
+          />
+        </div>
+
         <DialogFooter>
           <DialogClose asChild>
             <Button type="button" variant="secondary" disabled={isDuplicating}>

apps/remix/app/components/dialogs/envelope-redistribute-dialog.tsx

@@ -25,14 +25,16 @@ import { Trans, useLingui } from '@lingui/react/macro';
 import { DocumentStatus, EnvelopeType, SigningStatus } from '@prisma/client';
 import { useEffect, useState } from 'react';
 import { useForm } from 'react-hook-form';
+import { match } from 'ts-pattern';
 import * as z from 'zod';
 import { getDistributeErrorMessage } from '~/utils/toast-error-messages';
 import { StackAvatar } from '../general/stack-avatar';
 
 export type EnvelopeRedistributeDialogProps = {
-  envelope: Pick<TEnvelope, 'id' | 'userId' | 'teamId' | 'status' | 'type' | 'documentMeta'> & {
+  envelope: Pick<TEnvelope, 'id' | 'status' | 'type'> & {
     recipients: TEnvelopeRecipientLite[];
   };
+  envelopeType?: EnvelopeType;
   trigger?: React.ReactNode;
 };
 
@@ -44,7 +46,7 @@ export const ZEnvelopeRedistributeFormSchema = z.object({
 
 export type TEnvelopeRedistributeFormSchema = z.infer<typeof ZEnvelopeRedistributeFormSchema>;
 
-export const EnvelopeRedistributeDialog = ({ envelope, trigger }: EnvelopeRedistributeDialogProps) => {
+export const EnvelopeRedistributeDialog = ({ envelope, envelopeType, trigger }: EnvelopeRedistributeDialogProps) => {
   const recipients = envelope.recipients;
 
   const { toast } = useToast();
@@ -70,9 +72,23 @@ export const EnvelopeRedistributeDialog = ({ envelope, trigger }: EnvelopeRedist
     try {
       await redistributeEnvelope({ envelopeId: envelope.id, recipients });
 
+      const successMessage = match(envelopeType)
+        .with(EnvelopeType.DOCUMENT, () => ({
+          title: t`Document resent`,
+          description: t`Your document has been resent successfully.`,
+        }))
+        .with(EnvelopeType.TEMPLATE, () => ({
+          title: t`Template resent`,
+          description: t`Your template has been resent successfully.`,
+        }))
+        .otherwise(() => ({
+          title: t`Envelope resent`,
+          description: t`Your envelope has been resent successfully.`,
+        }));
+
       toast({
-        title: t`Envelope resent`,
-        description: t`Your envelope has been resent successfully.`,
+        title: successMessage.title,
+        description: successMessage.description,
         duration: 5000,
       });
 

apps/remix/app/components/dialogs/envelopes-bulk-move-dialog.tsx

@@ -28,7 +28,7 @@ export type EnvelopesBulkMoveDialogProps = {
   open: boolean;
   onOpenChange: (open: boolean) => void;
   currentFolderId?: string;
-  onSuccess?: () => void;
+  onSuccess?: (folderId: string | null) => Promise<void> | void;
 } & Omit<DialogPrimitive.DialogProps, 'children'>;
 
 const ZBulkMoveFormSchema = z.object({
@@ -99,11 +99,12 @@ export const EnvelopesBulkMoveDialog = ({
         await trpcUtils.template.findTemplates.invalidate();
       }
 
+      await onSuccess?.(data.folderId);
+
       toast({
         description: t`Selected items have been moved.`,
       });
 
-      onSuccess?.();
       onOpenChange(false);
     } catch (err) {
       const error = AppError.parseError(err);

apps/remix/app/components/dialogs/team-member-delete-dialog.tsx

@@ -16,6 +16,17 @@ import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
 import { useState } from 'react';
+import { match } from 'ts-pattern';
+
+/**
+ * The reason a team member cannot be removed from the team. When set, the delete
+ * dialog explains the reason instead of offering a confirm button.
+ */
+export type TeamMemberDeleteDisableReason =
+  | 'TEAM_OWNER'
+  | 'HIGHER_ROLE'
+  | 'INHERIT_MEMBER_ENABLED'
+  | 'INHERITED_MEMBER';
 
 export type TeamMemberDeleteDialogProps = {
   teamId: number;
@@ -23,7 +34,7 @@ export type TeamMemberDeleteDialogProps = {
   memberId: string;
   memberName: string;
   memberEmail: string;
-  isInheritMemberEnabled: boolean | null;
+  disableReason?: TeamMemberDeleteDisableReason | null;
   trigger?: React.ReactNode;
 };
 
@@ -34,7 +45,7 @@ export const TeamMemberDeleteDialog = ({
   memberId,
   memberName,
   memberEmail,
-  isInheritMemberEnabled,
+  disableReason,
 }: TeamMemberDeleteDialogProps) => {
   const [open, setOpen] = useState(false);
 
@@ -86,10 +97,19 @@ export const TeamMemberDeleteDialog = ({
           </DialogDescription>
         </DialogHeader>
 
-        {isInheritMemberEnabled ? (
+        {disableReason ? (
           <Alert variant="neutral">
             <AlertDescription>
-              <Trans>You cannot remove members from this team if the inherit member feature is enabled.</Trans>
+              {match(disableReason)
+                .with('TEAM_OWNER', () => <Trans>You cannot remove the organisation owner from the team.</Trans>)
+                .with('HIGHER_ROLE', () => <Trans>You cannot remove a member with a role higher than your own.</Trans>)
+                .with('INHERIT_MEMBER_ENABLED', () => (
+                  <Trans>You cannot remove members from this team while the inherit member feature is enabled.</Trans>
+                ))
+                .with('INHERITED_MEMBER', () => (
+                  <Trans>This member is inherited from a group and cannot be removed from the team directly.</Trans>
+                ))
+                .exhaustive()}
             </AlertDescription>
           </Alert>
         ) : (
@@ -109,11 +129,10 @@ export const TeamMemberDeleteDialog = ({
               <Trans>Close</Trans>
             </Button>
 
-            {!isInheritMemberEnabled && (
+            {!disableReason && (
               <Button
                 type="submit"
                 variant="destructive"
-                disabled={Boolean(isInheritMemberEnabled)}
                 loading={isDeletingTeamMember}
                 onClick={async () => deleteTeamMember({ teamId, memberId })}
               >

apps/remix/app/components/dialogs/template-move-to-folder-dialog.tsx

@@ -1,232 +0,0 @@
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { FolderType } from '@documenso/lib/types/folder-type';
-import { formatTemplatesPath } from '@documenso/lib/utils/teams';
-import { trpc } from '@documenso/trpc/react';
-import { Button } from '@documenso/ui/primitives/button';
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from '@documenso/ui/primitives/dialog';
-import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '@documenso/ui/primitives/form/form';
-import { Input } from '@documenso/ui/primitives/input';
-import { useToast } from '@documenso/ui/primitives/use-toast';
-import { zodResolver } from '@hookform/resolvers/zod';
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import type * as DialogPrimitive from '@radix-ui/react-dialog';
-import { FolderIcon, HomeIcon, Loader2, Search } from 'lucide-react';
-import { useEffect, useState } from 'react';
-import { useForm } from 'react-hook-form';
-import { useNavigate } from 'react-router';
-import { z } from 'zod';
-
-import { useCurrentTeam } from '~/providers/team';
-
-export type TemplateMoveToFolderDialogProps = {
-  templateId: number;
-  templateTitle: string;
-  isOpen: boolean;
-  onOpenChange: (open: boolean) => void;
-  currentFolderId?: string | null;
-} & Omit<DialogPrimitive.DialogProps, 'children'>;
-
-const ZMoveTemplateFormSchema = z.object({
-  folderId: z.string().nullable().optional(),
-});
-
-type TMoveTemplateFormSchema = z.infer<typeof ZMoveTemplateFormSchema>;
-
-export function TemplateMoveToFolderDialog({
-  templateId,
-  templateTitle,
-  isOpen,
-  onOpenChange,
-  currentFolderId,
-  ...props
-}: TemplateMoveToFolderDialogProps) {
-  const { _ } = useLingui();
-  const { toast } = useToast();
-
-  const navigate = useNavigate();
-  const team = useCurrentTeam();
-
-  const [searchTerm, setSearchTerm] = useState('');
-
-  const form = useForm<TMoveTemplateFormSchema>({
-    resolver: zodResolver(ZMoveTemplateFormSchema),
-    defaultValues: {
-      folderId: currentFolderId ?? null,
-    },
-  });
-
-  const { data: folders, isLoading: isFoldersLoading } = trpc.folder.findFoldersInternal.useQuery(
-    {
-      parentId: currentFolderId ?? null,
-      type: FolderType.TEMPLATE,
-    },
-    {
-      enabled: isOpen,
-    },
-  );
-
-  const { mutateAsync: updateTemplate } = trpc.template.updateTemplate.useMutation();
-
-  useEffect(() => {
-    if (!isOpen) {
-      form.reset();
-      setSearchTerm('');
-    } else {
-      form.reset({ folderId: currentFolderId ?? null });
-    }
-  }, [isOpen, currentFolderId, form]);
-
-  const onSubmit = async (data: TMoveTemplateFormSchema) => {
-    try {
-      await updateTemplate({
-        templateId,
-        data: {
-          folderId: data.folderId ?? null,
-        },
-      });
-
-      toast({
-        title: _(msg`Template moved`),
-        description: _(msg`The template has been moved successfully.`),
-        variant: 'default',
-      });
-
-      onOpenChange(false);
-
-      const templatesPath = formatTemplatesPath(team.url);
-
-      if (data.folderId) {
-        void navigate(`${templatesPath}/f/${data.folderId}`);
-      } else {
-        void navigate(templatesPath);
-      }
-    } catch (err) {
-      const error = AppError.parseError(err);
-
-      if (error.code === AppErrorCode.NOT_FOUND) {
-        toast({
-          title: _(msg`Error`),
-          description: _(msg`The folder you are trying to move the template to does not exist.`),
-          variant: 'destructive',
-        });
-
-        return;
-      }
-
-      toast({
-        title: _(msg`Error`),
-        description: _(msg`An error occurred while moving the template.`),
-        variant: 'destructive',
-      });
-    }
-  };
-
-  const filteredFolders = folders?.data?.filter((folder) =>
-    folder.name.toLowerCase().includes(searchTerm.toLowerCase()),
-  );
-
-  return (
-    <Dialog {...props} open={isOpen} onOpenChange={onOpenChange}>
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>
-            <Trans>Move Template to Folder</Trans>
-          </DialogTitle>
-
-          <DialogDescription>
-            <Trans>Move &quot;{templateTitle}&quot; to a folder</Trans>
-          </DialogDescription>
-        </DialogHeader>
-
-        <div className="relative">
-          <Search className="absolute top-3 left-2 h-4 w-4 text-muted-foreground" />
-          <Input
-            placeholder={_(msg`Search folders...`)}
-            value={searchTerm}
-            onChange={(e) => setSearchTerm(e.target.value)}
-            className="pl-8"
-          />
-        </div>
-
-        <Form {...form}>
-          <form onSubmit={form.handleSubmit(onSubmit)} className="mt-4 flex flex-col gap-y-4">
-            <FormField
-              control={form.control}
-              name="folderId"
-              render={({ field }) => (
-                <FormItem>
-                  <FormLabel>
-                    <Trans>Folder</Trans>
-                  </FormLabel>
-
-                  <FormControl>
-                    <div className="max-h-96 space-y-2 overflow-y-auto">
-                      {isFoldersLoading ? (
-                        <div className="flex h-10 items-center justify-center">
-                          <Loader2 className="h-4 w-4 animate-spin" />
-                        </div>
-                      ) : (
-                        <>
-                          <Button
-                            type="button"
-                            variant={field.value === null ? 'default' : 'outline'}
-                            className="w-full justify-start"
-                            onClick={() => field.onChange(null)}
-                            disabled={currentFolderId === null}
-                          >
-                            <HomeIcon className="mr-2 h-4 w-4" />
-                            <Trans>Home (No Folder)</Trans>
-                          </Button>
-
-                          {filteredFolders?.map((folder) => (
-                            <Button
-                              key={folder.id}
-                              type="button"
-                              variant={field.value === folder.id ? 'default' : 'outline'}
-                              className="w-full justify-start"
-                              onClick={() => field.onChange(folder.id)}
-                              disabled={currentFolderId === folder.id}
-                            >
-                              <FolderIcon className="mr-2 h-4 w-4" />
-                              {folder.name}
-                            </Button>
-                          ))}
-
-                          {searchTerm && filteredFolders?.length === 0 && (
-                            <div className="px-2 py-2 text-center text-muted-foreground text-sm">
-                              <Trans>No folders found</Trans>
-                            </div>
-                          )}
-                        </>
-                      )}
-                    </div>
-                  </FormControl>
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-
-            <DialogFooter>
-              <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
-                <Trans>Cancel</Trans>
-              </Button>
-
-              <Button type="submit" disabled={isFoldersLoading || form.formState.isSubmitting}>
-                <Trans>Move</Trans>
-              </Button>
-            </DialogFooter>
-          </form>
-        </Form>
-      </DialogContent>
-    </Dialog>
-  );
-}

apps/remix/app/components/forms/document-preferences-form.tsx

@@ -11,10 +11,10 @@ import { isValidLanguageCode, SUPPORTED_LANGUAGE_CODES, SUPPORTED_LANGUAGES } fr
 import { TIME_ZONES } from '@documenso/lib/constants/time-zones';
 import type { TDefaultRecipients } from '@documenso/lib/types/default-recipients';
 import { ZDefaultRecipientsSchema } from '@documenso/lib/types/default-recipients';
-import { type TDocumentMetaDateFormat, ZDocumentMetaTimezoneSchema } from '@documenso/lib/types/document-meta';
-import { isPersonalLayout } from '@documenso/lib/utils/organisations';
+import { type TDocumentMetaDateFormat, ZDocumentMetaDateFormatSchema } from '@documenso/lib/types/document-meta';
+import { generateDefaultOrganisationSettings, isPersonalLayout } from '@documenso/lib/utils/organisations';
 import { recipientAbbreviation } from '@documenso/lib/utils/recipient-formatter';
-import { extractTeamSignatureSettings } from '@documenso/lib/utils/teams';
+import { extractTeamSignatureSettings, generateDefaultTeamSettings } from '@documenso/lib/utils/teams';
 import { DocumentSignatureSettingsTooltip } from '@documenso/ui/components/document/document-signature-settings-tooltip';
 import { ExpirationPeriodPicker } from '@documenso/ui/components/document/expiration-period-picker';
 import { ReminderSettingsPicker } from '@documenso/ui/components/document/reminder-settings-picker';
@@ -38,11 +38,11 @@ import { zodResolver } from '@hookform/resolvers/zod';
 import { msg, t } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
-import type { TeamGlobalSettings } from '@prisma/client';
-import { DocumentVisibility, OrganisationType, type RecipientRole } from '@prisma/client';
+import { DocumentVisibility, OrganisationType, type RecipientRole, type TeamGlobalSettings } from '@prisma/client';
 import { useForm } from 'react-hook-form';
 import { z } from 'zod';
 
+import { DocumentPreferencesResetDialog } from '~/components/dialogs/document-preferences-reset-dialog';
 import { useOptionalCurrentTeam } from '~/providers/team';
 
 import { DefaultRecipientsMultiSelectCombobox } from '../general/default-recipients-multiselect-combobox';
@@ -93,6 +93,26 @@ export type DocumentPreferencesFormProps = {
   onFormSubmit: (data: TDocumentPreferencesFormSchema) => Promise<void>;
 };
 
+const getDocumentPreferencesFormValues = (settings: SettingsSubset): TDocumentPreferencesFormSchema => {
+  const parsedDocumentDateFormat = ZDocumentMetaDateFormatSchema.safeParse(settings.documentDateFormat);
+
+  return {
+    documentVisibility: settings.documentVisibility,
+    documentLanguage: isValidLanguageCode(settings.documentLanguage) ? settings.documentLanguage : null,
+    documentTimezone: settings.documentTimezone,
+    documentDateFormat: parsedDocumentDateFormat.success ? parsedDocumentDateFormat.data : null,
+    includeSenderDetails: settings.includeSenderDetails,
+    includeSigningCertificate: settings.includeSigningCertificate,
+    includeAuditLog: settings.includeAuditLog,
+    signatureTypes: extractTeamSignatureSettings({ ...settings }),
+    defaultRecipients: settings.defaultRecipients ? ZDefaultRecipientsSchema.parse(settings.defaultRecipients) : null,
+    delegateDocumentOwnership: settings.delegateDocumentOwnership,
+    aiFeaturesEnabled: settings.aiFeaturesEnabled,
+    envelopeExpirationPeriod: settings.envelopeExpirationPeriod ?? null,
+    reminderSettings: settings.reminderSettings ?? null,
+  };
+};
+
 export const DocumentPreferencesForm = ({
   settings,
   onFormSubmit,
@@ -113,7 +133,7 @@ export const DocumentPreferencesForm = ({
     documentVisibility: z.nativeEnum(DocumentVisibility).nullable(),
     documentLanguage: z.enum(SUPPORTED_LANGUAGE_CODES).nullable(),
     documentTimezone: z.string().nullable(),
-    documentDateFormat: ZDocumentMetaTimezoneSchema.nullable(),
+    documentDateFormat: ZDocumentMetaDateFormatSchema.nullable(),
     includeSenderDetails: z.boolean().nullable(),
     includeSigningCertificate: z.boolean().nullable(),
     includeAuditLog: z.boolean().nullable(),
@@ -127,26 +147,27 @@ export const DocumentPreferencesForm = ({
     reminderSettings: ZEnvelopeReminderSettings.nullable(),
   });
 
+  const defaultValues = getDocumentPreferencesFormValues(settings);
+  const defaultSettings = canInherit ? generateDefaultTeamSettings() : generateDefaultOrganisationSettings();
+  const baseResetValues = getDocumentPreferencesFormValues(defaultSettings);
+  const resetValues = {
+    ...baseResetValues,
+    aiFeaturesEnabled: isAiFeaturesConfigured ? baseResetValues.aiFeaturesEnabled : defaultValues.aiFeaturesEnabled,
+  };
+
   const form = useForm<TDocumentPreferencesFormSchema>({
-    defaultValues: {
-      documentVisibility: settings.documentVisibility,
-      documentLanguage: isValidLanguageCode(settings.documentLanguage) ? settings.documentLanguage : null,
-      documentTimezone: settings.documentTimezone,
-      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-      documentDateFormat: settings.documentDateFormat as TDocumentMetaDateFormat | null,
-      includeSenderDetails: settings.includeSenderDetails,
-      includeSigningCertificate: settings.includeSigningCertificate,
-      includeAuditLog: settings.includeAuditLog,
-      signatureTypes: extractTeamSignatureSettings({ ...settings }),
-      defaultRecipients: settings.defaultRecipients ? ZDefaultRecipientsSchema.parse(settings.defaultRecipients) : null,
-      delegateDocumentOwnership: settings.delegateDocumentOwnership,
-      aiFeaturesEnabled: settings.aiFeaturesEnabled,
-      envelopeExpirationPeriod: settings.envelopeExpirationPeriod ?? null,
-      reminderSettings: settings.reminderSettings ?? null,
-    },
+    defaultValues,
     resolver: zodResolver(ZDocumentPreferencesFormSchema),
   });
 
+  const currentValues = form.watch();
+  const isResetDisabled = !form.formState.isDirty && JSON.stringify(currentValues) === JSON.stringify(resetValues);
+
+  const handleResetToDefaults = async () => {
+    await onFormSubmit(resetValues);
+    form.reset(resetValues);
+  };
+
   return (
     <Form {...form}>
       <form onSubmit={form.handleSubmit(onFormSubmit)}>
@@ -760,6 +781,14 @@ export const DocumentPreferencesForm = ({
             <Button type="submit" loading={form.formState.isSubmitting}>
               <Trans>Update</Trans>
             </Button>
+            <DocumentPreferencesResetDialog
+              disabled={isResetDisabled}
+              isSubmitting={form.formState.isSubmitting}
+              onReset={handleResetToDefaults}
+              showAiFeatures={isAiFeaturesConfigured}
+              showDocumentVisibility={!isPersonalLayoutMode}
+              showIncludeSenderDetails={!isPersonalLayoutMode && !isPersonalOrganisation}
+            />
           </div>
         </fieldset>
       </form>

apps/remix/app/components/general/document/document-audit-log-download-button.tsx

@@ -11,10 +11,10 @@ import { DownloadIcon } from 'lucide-react';
 
 export type DocumentAuditLogDownloadButtonProps = {
   className?: string;
-  documentId: number;
+  envelopeId: string;
 };
 
-export const DocumentAuditLogDownloadButton = ({ className, documentId }: DocumentAuditLogDownloadButtonProps) => {
+export const DocumentAuditLogDownloadButton = ({ className, envelopeId }: DocumentAuditLogDownloadButtonProps) => {
   const { toast } = useToast();
   const { _ } = useLingui();
 
@@ -22,7 +22,7 @@ export const DocumentAuditLogDownloadButton = ({ className, documentId }: Docume
 
   const onDownloadAuditLogsClick = async () => {
     try {
-      const { data, envelopeTitle } = await downloadAuditLogs({ documentId });
+      const { data, envelopeTitle } = await downloadAuditLogs({ envelopeId });
 
       const buffer = new Uint8Array(base64.decode(data));
       const blob = new Blob([buffer], { type: 'application/pdf' });

apps/remix/app/components/general/document/document-certificate-download-button.tsx

@@ -13,13 +13,13 @@ import { DownloadIcon } from 'lucide-react';
 
 export type DocumentCertificateDownloadButtonProps = {
   className?: string;
-  documentId: number;
+  envelopeId: string;
   documentStatus: DocumentStatus;
 };
 
 export const DocumentCertificateDownloadButton = ({
   className,
-  documentId,
+  envelopeId,
   documentStatus,
 }: DocumentCertificateDownloadButtonProps) => {
   const { toast } = useToast();
@@ -29,7 +29,7 @@ export const DocumentCertificateDownloadButton = ({
 
   const onDownloadCertificatesClick = async () => {
     try {
-      const { data, envelopeTitle } = await downloadCertificate({ documentId });
+      const { data, envelopeTitle } = await downloadCertificate({ envelopeId });
 
       const buffer = new Uint8Array(base64.decode(data));
       const blob = new Blob([buffer], { type: 'application/pdf' });

apps/remix/app/components/general/document/document-page-view-dropdown.tsx

@@ -19,6 +19,7 @@ import {
   Download,
   Edit,
   FileOutputIcon,
+  History,
   Loader,
   MoreHorizontal,
   Pencil,
@@ -29,10 +30,10 @@ import {
 import { useState } from 'react';
 import { Link, useNavigate } from 'react-router';
 
-import { DocumentResendDialog } from '~/components/dialogs/document-resend-dialog';
 import { EnvelopeDeleteDialog } from '~/components/dialogs/envelope-delete-dialog';
 import { EnvelopeDownloadDialog } from '~/components/dialogs/envelope-download-dialog';
 import { EnvelopeDuplicateDialog } from '~/components/dialogs/envelope-duplicate-dialog';
+import { EnvelopeRedistributeDialog } from '~/components/dialogs/envelope-redistribute-dialog';
 import { EnvelopeRenameDialog } from '~/components/dialogs/envelope-rename-dialog';
 import { EnvelopeSaveAsTemplateDialog } from '~/components/dialogs/envelope-save-as-template-dialog';
 import { DocumentRecipientLinkCopyDialog } from '~/components/general/document/document-recipient-link-copy-dialog';
@@ -67,8 +68,6 @@ export const DocumentPageViewDropdown = ({ envelope }: DocumentPageViewDropdownP
 
   const documentsPath = formatDocumentsPath(team.url);
 
-  const nonSignedRecipients = envelope.recipients.filter((item) => item.signingStatus !== 'SIGNED');
-
   return (
     <DropdownMenu>
       <DropdownMenuTrigger data-testid="document-page-view-action-btn">
@@ -172,13 +171,20 @@ export const DocumentPageViewDropdown = ({ envelope }: DocumentPageViewDropdownP
           />
         )}
 
-        <DocumentResendDialog
-          document={{
-            ...envelope,
-            id: mapSecondaryIdToDocumentId(envelope.secondaryId),
-          }}
-          recipients={nonSignedRecipients}
-        />
+        {canManageDocument && (
+          <EnvelopeRedistributeDialog
+            envelope={envelope}
+            envelopeType={EnvelopeType.DOCUMENT}
+            trigger={
+              <DropdownMenuItem asChild onSelect={(e) => e.preventDefault()}>
+                <div>
+                  <History className="mr-2 h-4 w-4" />
+                  <Trans>Resend</Trans>
+                </div>
+              </DropdownMenuItem>
+            }
+          />
+        )}
 
         <DocumentShareButton
           documentId={mapSecondaryIdToDocumentId(envelope.secondaryId)}

apps/remix/app/components/general/envelope-editor/envelope-editor-fields-page-renderer.tsx

@@ -1,3 +1,4 @@
+import { useDebouncedValue } from '@documenso/lib/client-only/hooks/use-debounced-value';
 import type { TLocalField } from '@documenso/lib/client-only/hooks/use-editor-fields';
 import { usePageRenderer } from '@documenso/lib/client-only/hooks/use-page-renderer';
 import { useCurrentEnvelopeEditor } from '@documenso/lib/client-only/providers/envelope-editor-provider';
@@ -13,6 +14,7 @@ import {
 } from '@documenso/lib/universal/field-renderer/field-renderer';
 import { renderField } from '@documenso/lib/universal/field-renderer/render-field';
 import { getClientSideFieldTranslations } from '@documenso/lib/utils/fields';
+import { getOverlappingFieldPairs } from '@documenso/lib/utils/fields-overlap';
 import { canRecipientFieldsBeModified } from '@documenso/lib/utils/recipients';
 import {
   Command,
@@ -62,6 +64,36 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
     [editorFields.localFields, pageNumber, currentEnvelopeItem?.id],
   );
 
+  /**
+   * Debounce the fields used for overlap highlighting so we don't recompute on every
+   * small drag/resize tick. Overlaps only occur within the same page and envelope
+   * item, so computing from this page's fields alone is sufficient.
+   */
+  const debouncedPageFields = useDebouncedValue(localPageFields, 300);
+
+  const overlappingFieldFormIds = useMemo(() => {
+    const formIds = new Set<string>();
+
+    const pairs = getOverlappingFieldPairs(
+      debouncedPageFields.map((field) => ({
+        id: field.formId,
+        envelopeItemId: field.envelopeItemId,
+        page: field.page,
+        positionX: field.positionX,
+        positionY: field.positionY,
+        width: field.width,
+        height: field.height,
+      })),
+    );
+
+    for (const pair of pairs) {
+      formIds.add(pair.fieldA.id);
+      formIds.add(pair.fieldB.id);
+    }
+
+    return formIds;
+  }, [debouncedPageFields]);
+
   const handleResizeOrMove = (event: KonvaEventObject<Event>) => {
     const isDragEvent = event.type === 'dragend';
 
@@ -113,6 +145,62 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
     pageLayer.current?.batchDraw();
   };
 
+  /**
+   * Draws (or removes) a dashed warning outline over a field that significantly
+   * overlaps another field. The highlight is a child of the field group so it moves
+   * and resizes with the field, and sits on top of the field's own rect (which is
+   * re-styled on every render and would otherwise clobber a direct stroke change).
+   */
+  const syncOverlapHighlight = (fieldGroup: Konva.Group, isOverlapping: boolean) => {
+    const existingHighlight = fieldGroup.findOne('.field-overlap-highlight');
+
+    // Skip while a field is actively being dragged/resized. The highlight is driven
+    // by debounced field data, so it would lag behind and distort during the gesture.
+    // It is repainted once the gesture settles (the effect re-runs on isFieldChanging).
+    if (isFieldChanging) {
+      existingHighlight?.destroy();
+      return;
+    }
+
+    if (!isOverlapping) {
+      existingHighlight?.destroy();
+      return;
+    }
+
+    const fieldRect = fieldGroup.findOne('.field-rect');
+
+    if (!fieldRect) {
+      return;
+    }
+
+    const highlightAttrs = {
+      x: 0,
+      y: 0,
+      width: fieldRect.width(),
+      height: fieldRect.height(),
+      stroke: '#f59e0b',
+      strokeWidth: 2,
+      dash: [6, 4],
+      cornerRadius: 2,
+      strokeScaleEnabled: false,
+      listening: false,
+    } satisfies Partial<Konva.RectConfig>;
+
+    if (existingHighlight instanceof Konva.Rect) {
+      existingHighlight.setAttrs(highlightAttrs);
+      existingHighlight.moveToTop();
+      return;
+    }
+
+    const highlight = new Konva.Rect({
+      name: 'field-overlap-highlight',
+      ...highlightAttrs,
+    });
+
+    fieldGroup.add(highlight);
+    highlight.moveToTop();
+  };
+
   const unsafeRenderFieldOnLayer = (field: TLocalField) => {
     if (!pageLayer.current) {
       return;
@@ -139,6 +227,8 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
       mode: 'edit',
     });
 
+    syncOverlapHighlight(fieldGroup, overlappingFieldFormIds.has(field.formId));
+
     if (!isFieldEditable) {
       return;
     }
@@ -435,7 +525,7 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
     interactiveTransformer.current?.forceUpdate();
 
     pageLayer.current.batchDraw();
-  }, [localPageFields, selectedKonvaFieldGroups]);
+  }, [localPageFields, selectedKonvaFieldGroups, overlappingFieldFormIds, isFieldChanging]);
 
   const setSelectedFields = (nodes: Konva.Node[]) => {
     // eslint-disable-next-line @typescript-eslint/consistent-type-assertions

apps/remix/app/components/general/envelope-editor/envelope-editor-fields-page.tsx

@@ -1,3 +1,4 @@
+import { useDebouncedValue } from '@documenso/lib/client-only/hooks/use-debounced-value';
 import { useCurrentEnvelopeEditor } from '@documenso/lib/client-only/providers/envelope-editor-provider';
 import { useCurrentEnvelopeRender } from '@documenso/lib/client-only/providers/envelope-render-provider';
 import { PDF_VIEWER_ERROR_MESSAGES } from '@documenso/lib/constants/pdf-viewer-i18n';
@@ -17,6 +18,7 @@ import {
   type TTextFieldMeta,
 } from '@documenso/lib/types/field-meta';
 import { getEnvelopeItemPermissions } from '@documenso/lib/utils/envelope';
+import { getOverlappingFieldPairs } from '@documenso/lib/utils/fields-overlap';
 import { canRecipientFieldsBeModified } from '@documenso/lib/utils/recipients';
 import { AnimateGenericFadeInOut } from '@documenso/ui/components/animate/animate-generic-fade-in-out';
 import { cn } from '@documenso/ui/lib/utils';
@@ -28,7 +30,7 @@ import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
 import { DocumentStatus, FieldType, RecipientRole } from '@prisma/client';
-import { FileTextIcon, PencilIcon, SparklesIcon } from 'lucide-react';
+import { AlertTriangleIcon, FileTextIcon, PencilIcon, SparklesIcon } from 'lucide-react';
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { useRevalidator, useSearchParams } from 'react-router';
 import { isDeepEqual } from 'remeda';
@@ -78,7 +80,7 @@ export const EnvelopeEditorFieldsPage = () => {
 
   const { envelope, editorFields, navigateToStep, editorConfig } = useCurrentEnvelopeEditor();
 
-  const { currentEnvelopeItem } = useCurrentEnvelopeRender();
+  const { currentEnvelopeItem, setCurrentEnvelopeItem } = useCurrentEnvelopeRender();
 
   const { _ } = useLingui();
 
@@ -93,6 +95,53 @@ export const EnvelopeEditorFieldsPage = () => {
 
   const selectedField = useMemo(() => structuredClone(editorFields.selectedField), [editorFields.selectedField]);
 
+  /**
+   * Debounce the fields used for overlap detection so we don't recompute on every
+   * small drag/resize movement, which is expensive on large field counts and can
+   * bog down lower-end devices.
+   */
+  const debouncedLocalFields = useDebouncedValue(editorFields.localFields, 300);
+
+  /**
+   * Fields that significantly overlap each other. Overlapping fields render poorly in
+   * the editor and can behave unexpectedly during signing, so we warn the author here.
+   */
+  const overlappingFieldPairs = useMemo(
+    () =>
+      getOverlappingFieldPairs(
+        debouncedLocalFields.map((field) => ({
+          id: field.formId,
+          envelopeItemId: field.envelopeItemId,
+          page: field.page,
+          positionX: field.positionX,
+          positionY: field.positionY,
+          width: field.width,
+          height: field.height,
+        })),
+      ),
+    [debouncedLocalFields],
+  );
+
+  const handleReviewOverlappingField = () => {
+    const firstPair = overlappingFieldPairs[0];
+
+    if (!firstPair) {
+      return;
+    }
+
+    const targetField = editorFields.localFields.find((field) => field.formId === firstPair.fieldA.id);
+
+    if (!targetField) {
+      return;
+    }
+
+    if (targetField.envelopeItemId !== currentEnvelopeItem?.id) {
+      setCurrentEnvelopeItem(targetField.envelopeItemId);
+    }
+
+    editorFields.setSelectedField(targetField.formId);
+  };
+
   const updateSelectedFieldMeta = (fieldMeta: TFieldMetaSchema) => {
     if (!selectedField) {
       return;
@@ -211,6 +260,29 @@ export const EnvelopeEditorFieldsPage = () => {
             </Alert>
           )}
 
+          {overlappingFieldPairs.length > 0 && (
+            <Alert
+              variant="warning"
+              className="mt-20 mb-4 flex w-full max-w-[800px] flex-row items-center justify-between space-y-0 rounded-sm"
+            >
+              <div className="flex flex-row items-start gap-3">
+                <AlertTriangleIcon className="mt-0.5 h-5 w-5 flex-shrink-0" />
+
+                <div className="flex flex-col gap-1">
+                  <AlertTitle>
+                    <Trans>Overlapping fields detected</Trans>
+                  </AlertTitle>
+                  <AlertDescription>
+                    <Trans>
+                      Some fields are placed on top of each other. This may complicate the signing process or cause
+                      fields to not work as expected.
+                    </Trans>
+                  </AlertDescription>
+                </div>
+              </div>
+            </Alert>
+          )}
+
           {currentEnvelopeItem !== null ? (
             <EnvelopePdfViewer
               customPageRenderer={EnvelopeEditorFieldsPageRenderer}

apps/remix/app/components/tables/documents-table-action-dropdown.tsx

@@ -25,6 +25,7 @@ import {
   EyeIcon,
   FileOutputIcon,
   FolderInput,
+  History,
   Loader,
   MoreHorizontal,
   Pencil,
@@ -35,10 +36,10 @@ import {
 import { useState } from 'react';
 import { Link } from 'react-router';
 
-import { DocumentResendDialog } from '~/components/dialogs/document-resend-dialog';
 import { EnvelopeCancelDialog } from '~/components/dialogs/envelope-cancel-dialog';
 import { EnvelopeDeleteDialog } from '~/components/dialogs/envelope-delete-dialog';
 import { EnvelopeDuplicateDialog } from '~/components/dialogs/envelope-duplicate-dialog';
+import { EnvelopeRedistributeDialog } from '~/components/dialogs/envelope-redistribute-dialog';
 import { EnvelopeSaveAsTemplateDialog } from '~/components/dialogs/envelope-save-as-template-dialog';
 import { DocumentRecipientLinkCopyDialog } from '~/components/general/document/document-recipient-link-copy-dialog';
 import { useCurrentTeam } from '~/providers/team';
@@ -95,8 +96,6 @@ export const DocumentsTableActionDropdown = ({ row, onMoveDocument }: DocumentsT
   const documentsPath = formatDocumentsPath(team.url);
   const formatPath = `${documentsPath}/${row.envelopeId}/edit`;
 
-  const nonSignedRecipients = row.recipients.filter((item) => item.signingStatus !== 'SIGNED');
-
   return (
     <DropdownMenu>
       <DropdownMenuTrigger data-testid="document-table-action-btn">
@@ -244,7 +243,25 @@ export const DocumentsTableActionDropdown = ({ row, onMoveDocument }: DocumentsT
           />
         )}
 
-        <DocumentResendDialog document={row} recipients={nonSignedRecipients} />
+        {canManageDocument && (
+          <EnvelopeRedistributeDialog
+            envelope={{
+              id: row.envelopeId,
+              status: row.status,
+              type: EnvelopeType.DOCUMENT,
+              recipients: row.recipients,
+            }}
+            envelopeType={EnvelopeType.DOCUMENT}
+            trigger={
+              <DropdownMenuItem asChild onSelect={(e) => e.preventDefault()}>
+                <div>
+                  <History className="mr-2 h-4 w-4" />
+                  <Trans>Resend</Trans>
+                </div>
+              </DropdownMenuItem>
+            }
+          />
+        )}
 
         <DocumentShareButton
           documentId={row.id}

apps/remix/app/components/tables/documents-table.tsx

@@ -29,7 +29,7 @@ export type DocumentsTableProps = {
   data?: TFindDocumentsResponse;
   isLoading?: boolean;
   isLoadingError?: boolean;
-  onMoveDocument?: (documentId: number) => void;
+  onMoveDocument?: (envelopeId: string) => void;
   enableSelection?: boolean;
   rowSelection?: RowSelectionState;
   onRowSelectionChange?: (selection: RowSelectionState) => void;
@@ -117,7 +117,7 @@ export const DocumentsTable = ({
               <DocumentsTableActionButton row={row.original} />
               <DocumentsTableActionDropdown
                 row={row.original}
-                onMoveDocument={onMoveDocument ? () => onMoveDocument(row.original.id) : undefined}
+                onMoveDocument={onMoveDocument ? () => onMoveDocument(row.original.envelopeId) : undefined}
               />
             </div>
           ),

apps/remix/app/components/tables/team-members-table.tsx

@@ -29,7 +29,7 @@ import { useSearchParams } from 'react-router';
 
 import { useCurrentTeam } from '~/providers/team';
 
-import { TeamMemberDeleteDialog } from '../dialogs/team-member-delete-dialog';
+import { TeamMemberDeleteDialog, type TeamMemberDeleteDisableReason } from '../dialogs/team-member-delete-dialog';
 import { TeamMemberUpdateDialog } from '../dialogs/team-member-update-dialog';
 import { TeamInheritMemberAlert } from '../general/teams/team-inherit-member-alert';
 
@@ -86,6 +86,39 @@ export const TeamMembersTable = () => {
   );
 
   const columns = useMemo(() => {
+    // A member is a direct team member when they belong to one of the team's
+    // INTERNAL_TEAM groups. Otherwise they are inherited from an organisation or
+    // custom group and cannot be managed directly from this team.
+    const isMemberPartOfInternalTeamGroup = (memberId: string) =>
+      groups.some(
+        (group) =>
+          group.organisationGroupType === OrganisationGroupType.INTERNAL_TEAM &&
+          group.members.some((member) => member.id === memberId),
+      );
+
+    // Determine why a member can't be removed from the team (if at all). The delete
+    // dialog uses this to explain the reason instead of attempting a removal that
+    // would fail.
+    const getDeleteDisableReason = (member: (typeof results)['data'][number]): TeamMemberDeleteDisableReason | null => {
+      if (organisation.ownerUserId === member.userId) {
+        return 'TEAM_OWNER';
+      }
+
+      if (!isTeamRoleWithinUserHierarchy(team.currentTeamRole, member.teamRole)) {
+        return 'HIGHER_ROLE';
+      }
+
+      if (memberAccessTeamGroup !== undefined) {
+        return 'INHERIT_MEMBER_ENABLED';
+      }
+
+      if (!isMemberPartOfInternalTeamGroup(member.id)) {
+        return 'INHERITED_MEMBER';
+      }
+
+      return null;
+    };
+
     return [
       {
         header: _(msg`Team Member`),
@@ -111,15 +144,7 @@ export const TeamMembersTable = () => {
       },
       {
         header: _(msg`Source`),
-        cell: ({ row }) => {
-          const internalTeamGroupFound = groups.find(
-            (group) =>
-              group.organisationGroupType === OrganisationGroupType.INTERNAL_TEAM &&
-              group.members.some((member) => member.id === row.original.id),
-          );
-
-          return internalTeamGroupFound ? _(msg`Member`) : _(msg`Group`);
-        },
+        cell: ({ row }) => (isMemberPartOfInternalTeamGroup(row.original.id) ? _(msg`Member`) : _(msg`Group`)),
       },
       {
         header: _(msg`Actions`),
@@ -161,16 +186,9 @@ export const TeamMembersTable = () => {
                 memberId={row.original.id}
                 memberName={row.original.name ?? ''}
                 memberEmail={row.original.email}
-                isInheritMemberEnabled={memberAccessTeamGroup !== undefined}
+                disableReason={getDeleteDisableReason(row.original)}
                 trigger={
-                  <DropdownMenuItem
-                    onSelect={(e) => e.preventDefault()}
-                    disabled={
-                      organisation.ownerUserId === row.original.userId ||
-                      !isTeamRoleWithinUserHierarchy(team.currentTeamRole, row.original.teamRole)
-                    }
-                    title={_(msg`Remove team member`)}
-                  >
+                  <DropdownMenuItem onSelect={(e) => e.preventDefault()} title={_(msg`Remove team member`)}>
                     <Trash2Icon className="mr-2 h-4 w-4" />
                     <Trans>Remove</Trans>
                   </DropdownMenuItem>

apps/remix/app/components/tables/templates-table-action-dropdown.tsx

@@ -11,15 +11,15 @@ import { Trans } from '@lingui/react/macro';
 import { DocumentStatus, EnvelopeType, type TemplateDirectLink } from '@prisma/client';
 import { Copy, Download, Edit, FolderIcon, MoreHorizontal, Pencil, Share2Icon, Trash2, Upload } from 'lucide-react';
 import { useState } from 'react';
-import { Link } from 'react-router';
+import { Link, useNavigate } from 'react-router';
 
 import { EnvelopeDeleteDialog } from '../dialogs/envelope-delete-dialog';
 import { EnvelopeDownloadDialog } from '../dialogs/envelope-download-dialog';
 import { EnvelopeDuplicateDialog } from '../dialogs/envelope-duplicate-dialog';
 import { EnvelopeRenameDialog } from '../dialogs/envelope-rename-dialog';
+import { EnvelopesBulkMoveDialog } from '../dialogs/envelopes-bulk-move-dialog';
 import { TemplateBulkSendDialog } from '../dialogs/template-bulk-send-dialog';
 import { TemplateDirectLinkDialog } from '../dialogs/template-direct-link-dialog';
-import { TemplateMoveToFolderDialog } from '../dialogs/template-move-to-folder-dialog';
 
 export type TemplatesTableActionDropdownProps = {
   row: {
@@ -44,6 +44,7 @@ export const TemplatesTableActionDropdown = ({
   onDelete,
 }: TemplatesTableActionDropdownProps) => {
   const trpcUtils = trpcReact.useUtils();
+  const navigate = useNavigate();
 
   const [isRenameDialogOpen, setRenameDialogOpen] = useState(false);
   const [isMoveToFolderDialogOpen, setMoveToFolderDialogOpen] = useState(false);
@@ -153,12 +154,13 @@ export const TemplatesTableActionDropdown = ({
         )}
       </DropdownMenuContent>
 
-      <TemplateMoveToFolderDialog
-        templateId={row.id}
-        templateTitle={row.title}
-        isOpen={isMoveToFolderDialogOpen}
+      <EnvelopesBulkMoveDialog
+        envelopeIds={[row.envelopeId]}
+        envelopeType={EnvelopeType.TEMPLATE}
+        open={isMoveToFolderDialogOpen}
         onOpenChange={setMoveToFolderDialogOpen}
-        currentFolderId={row.folderId}
+        currentFolderId={row.folderId ?? undefined}
+        onSuccess={(folderId) => navigate(folderId ? `${templateRootPath}/f/${folderId}` : templateRootPath)}
       />
 
       <EnvelopeRenameDialog

apps/remix/app/routes/_authenticated+/t.$teamUrl+/documents.$id.logs.tsx

@@ -153,11 +153,11 @@ export default function DocumentsLogsPage({ loaderData }: Route.ComponentProps)
           <div className="mt-4 flex w-full flex-row sm:mt-0 sm:w-auto sm:self-end">
             <DocumentCertificateDownloadButton
               className="mr-2"
-              documentId={document.id}
+              envelopeId={document.envelopeId}
               documentStatus={document.status}
             />
 
-            <DocumentAuditLogDownloadButton documentId={document.id} />
+            <DocumentAuditLogDownloadButton envelopeId={document.envelopeId} />
           </div>
         </div>
       </div>

apps/remix/app/routes/_authenticated+/t.$teamUrl+/documents._index.tsx

@@ -16,10 +16,9 @@ import { msg } from '@lingui/core/macro';
 import { Trans } from '@lingui/react/macro';
 import { EnvelopeType, FolderType, OrganisationType } from '@prisma/client';
 import { useEffect, useMemo, useState } from 'react';
-import { Link, useParams, useSearchParams } from 'react-router';
+import { Link, useNavigate, useParams, useSearchParams } from 'react-router';
 import { z } from 'zod';
 
-import { DocumentMoveToFolderDialog } from '~/components/dialogs/document-move-to-folder-dialog';
 import { EnvelopesBulkCancelDialog } from '~/components/dialogs/envelopes-bulk-cancel-dialog';
 import { EnvelopesBulkDeleteDialog } from '~/components/dialogs/envelopes-bulk-delete-dialog';
 import { EnvelopesBulkMoveDialog } from '~/components/dialogs/envelopes-bulk-move-dialog';
@@ -55,9 +54,12 @@ export default function DocumentsPage() {
 
   const { folderId } = useParams();
   const [searchParams] = useSearchParams();
+  const navigate = useNavigate();
+
+  const documentsPath = formatDocumentsPath(team.url);
 
   const [isMovingDocument, setIsMovingDocument] = useState(false);
-  const [documentToMove, setDocumentToMove] = useState<number | null>(null);
+  const [documentToMove, setDocumentToMove] = useState<string | null>(null);
 
   const [rowSelection, setRowSelection] = useSessionStorage<RowSelectionState>('documents-bulk-selection', {});
   const [isBulkMoveDialogOpen, setIsBulkMoveDialogOpen] = useState(false);
@@ -200,8 +202,8 @@ export default function DocumentsPage() {
                 data={data}
                 isLoading={isLoading}
                 isLoadingError={isLoadingError}
-                onMoveDocument={(documentId) => {
-                  setDocumentToMove(documentId);
+                onMoveDocument={(envelopeId) => {
+                  setDocumentToMove(envelopeId);
                   setIsMovingDocument(true);
                 }}
                 enableSelection
@@ -213,8 +215,9 @@ export default function DocumentsPage() {
         </div>
 
         {documentToMove && (
-          <DocumentMoveToFolderDialog
-            documentId={documentToMove}
+          <EnvelopesBulkMoveDialog
+            envelopeIds={[documentToMove]}
+            envelopeType={EnvelopeType.DOCUMENT}
             open={isMovingDocument}
             currentFolderId={folderId}
             onOpenChange={(open) => {
@@ -224,6 +227,9 @@ export default function DocumentsPage() {
                 setDocumentToMove(null);
               }
             }}
+            onSuccess={(destinationFolderId) =>
+              navigate(destinationFolderId ? `${documentsPath}/f/${destinationFolderId}` : documentsPath)
+            }
           />
         )}
 

apps/remix/public/.well-known/security.txt

@@ -1,7 +1,14 @@
-# General Issues
+# Report security vulnerabilities privately via GitHub Security Advisories (preferred).
+Contact: https://github.com/documenso/documenso/security/advisories/new
+
+# Alternatively, report critical issues privately by email.
+Contact: mailto:security@documenso.com
+
+# Security policy
+Policy: https://github.com/documenso/documenso/security/policy
+
+# General (non-security) issues
 Contact: https://github.com/documenso/documenso/issues/new?assignees=&labels=bug&projects=&template=bug-report.yml
 
-# Report critical issues privately to let us take appropriate action before publishing.
-Contact: mailto:security@documenso.com
 Preferred-Languages: en
-Canonical: https://documenso.com/.well-known/security.txt
+Canonical: https://documenso.com/.well-known/security.txt

apps/remix/server/api/download/download.ts

@@ -1,20 +1,52 @@
+import { PDF_SIZE_A4_72PPI } from '@documenso/lib/constants/pdf';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { getEnvelopeById } from '@documenso/lib/server-only/envelope/get-envelope-by-id';
+import { getEnvelopeById, getEnvelopeWhereInput } from '@documenso/lib/server-only/envelope/get-envelope-by-id';
+import { generateAuditLogPdf } from '@documenso/lib/server-only/pdf/generate-audit-log-pdf';
+import { generateCertificatePdf } from '@documenso/lib/server-only/pdf/generate-certificate-pdf';
 import { getApiTokenByToken } from '@documenso/lib/server-only/public-api/get-api-token-by-token';
+import { isDocumentCompleted } from '@documenso/lib/utils/document';
 import { buildTeamWhereQuery } from '@documenso/lib/utils/teams';
 import { prisma } from '@documenso/prisma';
 import { sValidator } from '@hono/standard-validator';
-import { EnvelopeType } from '@prisma/client';
+import { DocumentStatus, EnvelopeType } from '@prisma/client';
+import contentDisposition from 'content-disposition';
 import { Hono } from 'hono';
 
 import type { HonoEnv } from '../../router';
 import { handleEnvelopeItemFileRequest } from '../files/files.helpers';
 import {
   ZDownloadDocumentRequestParamsSchema,
+  ZDownloadEnvelopeAuditLogPdfRequestParamsSchema,
+  ZDownloadEnvelopeCertificatePdfRequestParamsSchema,
   ZDownloadEnvelopeItemRequestParamsSchema,
   ZDownloadEnvelopeItemRequestQuerySchema,
 } from './download.types';
 
+/**
+ * Resolve and validate an API token from the Authorization header.
+ *
+ * Supports both "Authorization: Bearer api_xxx" and "Authorization: api_xxx".
+ */
+const resolveApiToken = async (authorizationHeader: string | undefined) => {
+  const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);
+
+  if (!token) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'API token was not provided',
+    });
+  }
+
+  const apiToken = await getApiTokenByToken({ token });
+
+  if (apiToken.user.disabled) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'User is disabled',
+    });
+  }
+
+  return apiToken;
+};
+
 export const downloadRoute = new Hono<HonoEnv>()
   /**
    * Download an envelope item by its ID.
@@ -30,24 +62,8 @@ export const downloadRoute = new Hono<HonoEnv>()
       try {
         const { envelopeItemId } = c.req.valid('param');
         const { version } = c.req.valid('query');
-        const authorizationHeader = c.req.header('authorization');
 
-        // Support for both "Authorization: Bearer api_xxx" and "Authorization: api_xxx"
-        const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);
-
-        if (!token) {
-          throw new AppError(AppErrorCode.UNAUTHORIZED, {
-            message: 'API token was not provided',
-          });
-        }
-
-        const apiToken = await getApiTokenByToken({ token });
-
-        if (apiToken.user.disabled) {
-          throw new AppError(AppErrorCode.UNAUTHORIZED, {
-            message: 'User is disabled',
-          });
-        }
+        const apiToken = await resolveApiToken(c.req.header('authorization'));
 
         logger.info({
           auth: 'api',
@@ -125,6 +141,180 @@ export const downloadRoute = new Hono<HonoEnv>()
       }
     },
   )
+  /**
+   * Download the audit log for a document as a PDF.
+   * Requires API key authentication via Authorization header.
+   */
+  .get(
+    '/envelope/:envelopeId/audit-log/pdf',
+    sValidator('param', ZDownloadEnvelopeAuditLogPdfRequestParamsSchema),
+    async (c) => {
+      const logger = c.get('logger');
+
+      try {
+        const { envelopeId } = c.req.valid('param');
+
+        const apiToken = await resolveApiToken(c.req.header('authorization'));
+
+        logger.info({
+          auth: 'api',
+          source: 'apiV2',
+          path: c.req.path,
+          userId: apiToken.user.id,
+          apiTokenId: apiToken.id,
+          envelopeId,
+        });
+
+        const envelope = await getEnvelopeById({
+          id: {
+            type: 'envelopeId',
+            id: envelopeId,
+          },
+          type: EnvelopeType.DOCUMENT,
+          userId: apiToken.user.id,
+          teamId: apiToken.teamId,
+        }).catch(() => null);
+
+        if (!envelope) {
+          return c.json({ error: 'Document not found' }, 404);
+        }
+
+        const auditLogPdf = await generateAuditLogPdf({
+          envelope,
+          recipients: envelope.recipients,
+          fields: envelope.fields,
+          language: envelope.documentMeta.language,
+          envelopeOwner: {
+            email: envelope.user.email,
+            name: envelope.user.name || '',
+          },
+          envelopeItems: envelope.envelopeItems.map((item) => item.title),
+          pageWidth: PDF_SIZE_A4_72PPI.width,
+          pageHeight: PDF_SIZE_A4_72PPI.height,
+        });
+
+        const result = await auditLogPdf.save();
+
+        const baseTitle = envelope.title.replace(/\.pdf$/i, '');
+
+        c.header('Content-Type', 'application/pdf');
+        c.header('Content-Disposition', contentDisposition(`${baseTitle}_audit-log.pdf`));
+        c.header('Cache-Control', 'no-cache, no-store, must-revalidate');
+
+        return c.body(result);
+      } catch (error) {
+        logger.error(error);
+
+        if (error instanceof AppError) {
+          const { status, body } = AppError.toRestAPIError(error);
+
+          return c.json({ error: body.message, code: error.code }, status);
+        }
+
+        return c.json({ error: 'Internal server error' }, 500);
+      }
+    },
+  )
+  /**
+   * Download the signing certificate for a completed document as a PDF.
+   * Requires API key authentication via Authorization header.
+   */
+  .get(
+    '/envelope/:envelopeId/certificate/pdf',
+    sValidator('param', ZDownloadEnvelopeCertificatePdfRequestParamsSchema),
+    async (c) => {
+      const logger = c.get('logger');
+
+      try {
+        const { envelopeId } = c.req.valid('param');
+
+        const apiToken = await resolveApiToken(c.req.header('authorization'));
+
+        logger.info({
+          auth: 'api',
+          source: 'apiV2',
+          path: c.req.path,
+          userId: apiToken.user.id,
+          apiTokenId: apiToken.id,
+          envelopeId,
+        });
+
+        const { envelopeWhereInput } = await getEnvelopeWhereInput({
+          id: {
+            type: 'envelopeId',
+            id: envelopeId,
+          },
+          type: EnvelopeType.DOCUMENT,
+          userId: apiToken.user.id,
+          teamId: apiToken.teamId,
+        });
+
+        const envelope = await prisma.envelope.findFirst({
+          where: envelopeWhereInput,
+          include: {
+            recipients: true,
+            fields: {
+              include: {
+                signature: true,
+              },
+            },
+            documentMeta: true,
+            user: {
+              select: {
+                email: true,
+                name: true,
+              },
+            },
+          },
+        });
+
+        if (!envelope) {
+          return c.json({ error: 'Document not found' }, 404);
+        }
+
+        // A cancelled document was never sealed/completed, so a signing certificate
+        // must not be generated for it.
+        if (!isDocumentCompleted(envelope.status) || envelope.status === DocumentStatus.CANCELLED) {
+          throw new AppError('DOCUMENT_NOT_COMPLETE', {
+            message: 'Document is not complete',
+          });
+        }
+
+        const certificatePdf = await generateCertificatePdf({
+          envelope,
+          recipients: envelope.recipients,
+          fields: envelope.fields,
+          language: envelope.documentMeta.language,
+          envelopeOwner: {
+            email: envelope.user.email,
+            name: envelope.user.name || '',
+          },
+          pageWidth: PDF_SIZE_A4_72PPI.width,
+          pageHeight: PDF_SIZE_A4_72PPI.height,
+        });
+
+        const result = await certificatePdf.save();
+
+        const baseTitle = envelope.title.replace(/\.pdf$/i, '');
+
+        c.header('Content-Type', 'application/pdf');
+        c.header('Content-Disposition', contentDisposition(`${baseTitle}_certificate.pdf`));
+        c.header('Cache-Control', 'no-cache, no-store, must-revalidate');
+
+        return c.body(result);
+      } catch (error) {
+        logger.error(error);
+
+        if (error instanceof AppError) {
+          const { status, body } = AppError.toRestAPIError(error);
+
+          return c.json({ error: body.message, code: error.code }, status);
+        }
+
+        return c.json({ error: 'Internal server error' }, 500);
+      }
+    },
+  )
   /**
    * Download a document by its ID.
    * Requires API key authentication via Authorization header.
@@ -134,24 +324,8 @@ export const downloadRoute = new Hono<HonoEnv>()
 
     try {
       const { documentId, version } = c.req.valid('param');
-      const authorizationHeader = c.req.header('authorization');
 
-      // Support for both "Authorization: Bearer api_xxx" and "Authorization: api_xxx"
-      const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);
-
-      if (!token) {
-        throw new AppError(AppErrorCode.UNAUTHORIZED, {
-          message: 'API token was not provided',
-        });
-      }
-
-      const apiToken = await getApiTokenByToken({ token });
-
-      if (apiToken.user.disabled) {
-        throw new AppError(AppErrorCode.UNAUTHORIZED, {
-          message: 'User is disabled',
-        });
-      }
+      const apiToken = await resolveApiToken(c.req.header('authorization'));
 
       logger.info({
         auth: 'api',
@@ -200,11 +374,9 @@ export const downloadRoute = new Hono<HonoEnv>()
       logger.error(error);
 
       if (error instanceof AppError) {
-        if (error.code === AppErrorCode.UNAUTHORIZED) {
-          return c.json({ error: error.message }, 401);
-        }
+        const { status, body } = AppError.toRestAPIError(error);
 
-        return c.json({ error: error.message }, 400);
+        return c.json({ error: body.message, code: error.code }, status);
       }
 
       return c.json({ error: 'Internal server error' }, 500);

apps/remix/server/api/download/download.types.ts

@@ -30,3 +30,17 @@ export const ZDownloadDocumentRequestParamsSchema = z.object({
 });
 
 export type TDownloadDocumentRequestParams = z.infer<typeof ZDownloadDocumentRequestParamsSchema>;
+
+export const ZDownloadEnvelopeAuditLogPdfRequestParamsSchema = z.object({
+  envelopeId: z.string().describe('The ID of the envelope to download the audit log for.'),
+});
+
+export type TDownloadEnvelopeAuditLogPdfRequestParams = z.infer<typeof ZDownloadEnvelopeAuditLogPdfRequestParamsSchema>;
+
+export const ZDownloadEnvelopeCertificatePdfRequestParamsSchema = z.object({
+  envelopeId: z.string().describe('The ID of the envelope to download the certificate for.'),
+});
+
+export type TDownloadEnvelopeCertificatePdfRequestParams = z.infer<
+  typeof ZDownloadEnvelopeCertificatePdfRequestParamsSchema
+>;

package.json

@@ -35,7 +35,6 @@
     "with:env": "dotenv -e .env -e .env.local --",
     "reset:hard": "npm run clean && npm i && npm run prisma:generate",
     "precommit": "npm install && git add package.json package-lock.json",
-    "trigger:dev": "npm run with:env -- npx trigger-cli dev --handler-path=\"/api/jobs\"",
     "inngest:dev": "inngest dev -u http://localhost:3000/api/jobs",
     "make:version": "npm version --workspace @documenso/remix --include-workspace-root --no-git-tag-version -m \"v%s\"",
     "translate": "npm run translate:extract && npm run translate:compile",

packages/app-tests/e2e/api/v2/redistribute-send-status.spec.ts

@@ -0,0 +1,64 @@
+import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
+import { createApiToken } from '@documenso/lib/server-only/public-api/create-api-token';
+import { mapSecondaryIdToDocumentId } from '@documenso/lib/utils/envelope';
+import { prisma } from '@documenso/prisma';
+import { SendStatus, SigningStatus } from '@documenso/prisma/client';
+import { seedPendingDocument } from '@documenso/prisma/seed/documents';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, test } from '@playwright/test';
+import type { Team, User } from '@prisma/client';
+
+const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
+const baseUrl = `${WEBAPP_BASE_URL}/api/v2-beta`;
+
+test.describe.configure({
+  mode: 'parallel',
+});
+
+test.describe('Redistribute updates recipient send status', () => {
+  let user: User, team: Team, token: string;
+
+  test.beforeEach(async () => {
+    ({ user, team } = await seedUser());
+    ({ token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'test',
+      expiresIn: null,
+    }));
+  });
+
+  test('marks a NOT_SENT signer as SENT after a successful resend', async ({ request }) => {
+    const document = await seedPendingDocument(user, team.id, ['recipient@test.documenso.com']);
+
+    const [recipient] = document.recipients;
+
+    // Simulate a recipient that is stuck at NOT_SENT on a pending document
+    // (e.g. the initial send did not dispatch an email for them).
+    await prisma.recipient.update({
+      where: { id: recipient.id },
+      data: {
+        sendStatus: SendStatus.NOT_SENT,
+        signingStatus: SigningStatus.NOT_SIGNED,
+        sentAt: null,
+      },
+    });
+
+    const res = await request.post(`${baseUrl}/document/redistribute`, {
+      headers: { Authorization: `Bearer ${token}` },
+      data: {
+        documentId: mapSecondaryIdToDocumentId(document.secondaryId),
+        recipients: [recipient.id],
+      },
+    });
+
+    expect(res.ok(), `redistribute should succeed: ${await res.text()}`).toBeTruthy();
+
+    const updatedRecipient = await prisma.recipient.findFirstOrThrow({
+      where: { id: recipient.id },
+    });
+
+    expect(updatedRecipient.sendStatus).toBe(SendStatus.SENT);
+    expect(updatedRecipient.sentAt).not.toBeNull();
+  });
+});

packages/app-tests/e2e/api/v2/reject-recipient-on-behalf-of.spec.ts

@@ -0,0 +1,260 @@
+import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
+import { createApiToken } from '@documenso/lib/server-only/public-api/create-api-token';
+import { prisma } from '@documenso/prisma';
+import { DocumentVisibility, SigningStatus, TeamMemberRole } from '@documenso/prisma/client';
+import { seedPendingDocument } from '@documenso/prisma/seed/documents';
+import { seedTeam, seedTeamMember } from '@documenso/prisma/seed/teams';
+import { seedUser } from '@documenso/prisma/seed/users';
+import type { TRejectEnvelopeRecipientOnBehalfOfRequest } from '@documenso/trpc/server/envelope-router/envelope-recipients/reject-envelope-recipient-on-behalf-of.types';
+import { type APIRequestContext, expect, test } from '@playwright/test';
+import type { Team, User } from '@prisma/client';
+
+const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
+const baseUrl = `${WEBAPP_BASE_URL}/api/v2-beta`;
+
+test.describe.configure({
+  mode: 'parallel',
+});
+
+const rejectRecipient = (
+  request: APIRequestContext,
+  authToken: string,
+  envelopeId: string,
+  recipientId: number,
+  reason: string,
+  actAsEmail?: string,
+) => {
+  return request.post(`${baseUrl}/envelope/recipient/${recipientId}/reject`, {
+    headers: { Authorization: `Bearer ${authToken}`, 'Content-Type': 'application/json' },
+    data: {
+      envelopeId,
+      recipientId,
+      reason,
+      actAsEmail,
+    } satisfies TRejectEnvelopeRecipientOnBehalfOfRequest,
+  });
+};
+
+test.describe('Reject recipient on behalf of', () => {
+  let user: User;
+  let team: Team;
+  let token: string;
+
+  test.beforeEach(async () => {
+    ({ user, team } = await seedUser());
+    ({ token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'test-reject-recipient',
+      expiresIn: null,
+    }));
+  });
+
+  test('should reject a recipient and record an external rejection audit log', async ({ request }) => {
+    const envelope = await seedPendingDocument(user, team.id, ['recipient@test.documenso.com']);
+    const recipient = envelope.recipients[0];
+
+    const res = await rejectRecipient(request, token, envelope.id, recipient.id, 'Declined out of band');
+
+    expect(res.ok()).toBeTruthy();
+    expect(res.status()).toBe(200);
+
+    const updatedRecipient = await prisma.recipient.findUniqueOrThrow({
+      where: { id: recipient.id },
+    });
+
+    expect(updatedRecipient.signingStatus).toBe(SigningStatus.REJECTED);
+    expect(updatedRecipient.rejectionReason).toBe('Declined out of band');
+
+    const auditLog = await prisma.documentAuditLog.findFirst({
+      where: {
+        envelopeId: envelope.id,
+        type: 'DOCUMENT_RECIPIENT_REJECTED',
+      },
+      orderBy: { createdAt: 'desc' },
+    });
+
+    expect(auditLog).not.toBeNull();
+
+    const auditData = auditLog!.data as Record<string, unknown>;
+
+    expect(auditData.recipientId).toBe(recipient.id);
+    expect(auditData.recipientEmail).toBe(recipient.email);
+    expect(auditData.reason).toBe('Declined out of band');
+    expect(auditData.isExternal).toBe(true);
+
+    // No actAsEmail supplied - the rejection defaults to the API user.
+    expect(auditLog!.userId).toBe(user.id);
+    expect(auditLog!.email).toBe(user.email);
+    expect(auditData.onBehalfOfUserEmail).toBeUndefined();
+  });
+
+  test('should attribute the rejection to the elected team member when actAsEmail is supplied', async ({ request }) => {
+    const member = await seedTeamMember({ teamId: team.id });
+
+    const envelope = await seedPendingDocument(user, team.id, ['recipient@test.documenso.com']);
+    const recipient = envelope.recipients[0];
+
+    const res = await rejectRecipient(request, token, envelope.id, recipient.id, 'Declined out of band', member.email);
+
+    expect(res.ok()).toBeTruthy();
+    expect(res.status()).toBe(200);
+
+    const auditLog = await prisma.documentAuditLog.findFirstOrThrow({
+      where: {
+        envelopeId: envelope.id,
+        type: 'DOCUMENT_RECIPIENT_REJECTED',
+      },
+      orderBy: { createdAt: 'desc' },
+    });
+
+    // The audit log actor must be the elected member, not the API user.
+    expect(auditLog.userId).toBe(member.id);
+    expect(auditLog.email).toBe(member.email);
+
+    const auditData = auditLog.data as Record<string, unknown>;
+
+    expect(auditData.isExternal).toBe(true);
+    expect(auditData.onBehalfOfUserEmail).toBe(member.email);
+  });
+
+  test('should reject when actAsEmail is not a member of the team', async ({ request }) => {
+    // A user that exists but belongs to a different team.
+    const { user: outsider } = await seedUser();
+
+    const envelope = await seedPendingDocument(user, team.id, ['recipient@test.documenso.com']);
+    const recipient = envelope.recipients[0];
+
+    const res = await rejectRecipient(
+      request,
+      token,
+      envelope.id,
+      recipient.id,
+      'Declined out of band',
+      outsider.email,
+    );
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(401);
+
+    // The recipient must remain untouched.
+    const untouchedRecipient = await prisma.recipient.findUniqueOrThrow({
+      where: { id: recipient.id },
+    });
+
+    expect(untouchedRecipient.signingStatus).toBe(SigningStatus.NOT_SIGNED);
+    expect(untouchedRecipient.rejectionReason).toBeNull();
+  });
+
+  test('should deny rejecting a recipient that has already actioned the document', async ({ request }) => {
+    const envelope = await seedPendingDocument(user, team.id, ['recipient@test.documenso.com']);
+    const recipient = envelope.recipients[0];
+
+    // Reject once - succeeds.
+    const firstRes = await rejectRecipient(request, token, envelope.id, recipient.id, 'First rejection');
+    expect(firstRes.ok()).toBeTruthy();
+
+    // Reject again - the recipient is no longer NOT_SIGNED.
+    const secondRes = await rejectRecipient(request, token, envelope.id, recipient.id, 'Second rejection');
+
+    expect(secondRes.ok()).toBeFalsy();
+    expect(secondRes.status()).toBe(400);
+
+    // The original rejection reason must remain unchanged.
+    const updatedRecipient = await prisma.recipient.findUniqueOrThrow({
+      where: { id: recipient.id },
+    });
+
+    expect(updatedRecipient.rejectionReason).toBe('First rejection');
+  });
+
+  test('should not allow rejecting a recipient in another team', async ({ request }) => {
+    // Seed a separate team/user that owns the document.
+    const { user: otherUser, team: otherTeam } = await seedUser();
+
+    const envelope = await seedPendingDocument(otherUser, otherTeam.id, ['recipient@test.documenso.com']);
+    const recipient = envelope.recipients[0];
+
+    // Use the original team's token - it must not be able to reject.
+    const res = await rejectRecipient(request, token, envelope.id, recipient.id, 'Should not work');
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(404);
+
+    // The recipient must remain untouched.
+    const untouchedRecipient = await prisma.recipient.findUniqueOrThrow({
+      where: { id: recipient.id },
+    });
+
+    expect(untouchedRecipient.signingStatus).toBe(SigningStatus.NOT_SIGNED);
+    expect(untouchedRecipient.rejectionReason).toBeNull();
+  });
+
+  test('should return 404 for a non-existent recipient', async ({ request }) => {
+    const envelope = await seedPendingDocument(user, team.id, ['recipient@test.documenso.com']);
+
+    const res = await rejectRecipient(request, token, envelope.id, 999999999, 'No such recipient');
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(404);
+  });
+
+  test('should return 404 when the recipient does not belong to the supplied envelope', async ({ request }) => {
+    const targetEnvelope = await seedPendingDocument(user, team.id, ['recipient@test.documenso.com']);
+    const otherEnvelope = await seedPendingDocument(user, team.id, ['other-recipient@test.documenso.com']);
+
+    const recipient = targetEnvelope.recipients[0];
+
+    // Valid recipient ID, but paired with the wrong envelope ID.
+    const res = await rejectRecipient(request, token, otherEnvelope.id, recipient.id, 'Mismatched envelope');
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(404);
+
+    // The recipient must remain untouched.
+    const untouchedRecipient = await prisma.recipient.findUniqueOrThrow({
+      where: { id: recipient.id },
+    });
+
+    expect(untouchedRecipient.signingStatus).toBe(SigningStatus.NOT_SIGNED);
+    expect(untouchedRecipient.rejectionReason).toBeNull();
+  });
+
+  test('should enforce document visibility: manager cannot reject on an ADMIN-only document', async ({ request }) => {
+    // The API token belongs to a MANAGER, who cannot see ADMIN-visibility docs.
+    const { team: visTeam, owner } = await seedTeam();
+    const manager = await seedTeamMember({ teamId: visTeam.id, role: TeamMemberRole.MANAGER });
+
+    const { token: managerToken } = await createApiToken({
+      userId: manager.id,
+      teamId: visTeam.id,
+      tokenName: 'manager-reject-token',
+      expiresIn: null,
+    });
+
+    // ADMIN-visibility document owned by the team owner.
+    const envelope = await seedPendingDocument(owner, visTeam.id, ['recipient@test.documenso.com'], {
+      createDocumentOptions: { visibility: DocumentVisibility.ADMIN },
+    });
+    const recipient = envelope.recipients[0];
+
+    const res = await rejectRecipient(
+      request,
+      managerToken,
+      envelope.id,
+      recipient.id,
+      'Should be hidden by visibility',
+    );
+
+    // Visibility failure surfaces as not-found, matching the canonical checks.
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(404);
+
+    const untouchedRecipient = await prisma.recipient.findUniqueOrThrow({
+      where: { id: recipient.id },
+    });
+
+    expect(untouchedRecipient.signingStatus).toBe(SigningStatus.NOT_SIGNED);
+    expect(untouchedRecipient.rejectionReason).toBeNull();
+  });
+});

packages/app-tests/e2e/envelope-editor-v2/envelope-actions.spec.ts

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
 import { createApiToken } from '@documenso/lib/server-only/public-api/create-api-token';
 import { prisma } from '@documenso/prisma';
+import { seedDraftDocument } from '@documenso/prisma/seed/documents';
 import { seedTemplate } from '@documenso/prisma/seed/templates';
 import { seedUser } from '@documenso/prisma/seed/users';
 import type {
@@ -302,6 +303,95 @@ test.describe('document editor', () => {
     expect(envelopes.length).toBeGreaterThanOrEqual(2);
   });
 
+  test('duplicate document without recipients excludes recipients and fields', async ({ page }) => {
+    const { user, team } = await seedUser();
+
+    // Seed a draft document that has a recipient with a field.
+    const document = await seedDraftDocument(user, team.id, ['signer@test.documenso.com'], {
+      key: `dup-exclude-recipients-${Date.now()}`,
+      internalVersion: 2,
+    });
+
+    await apiSignin({
+      page,
+      email: user.email,
+      redirectPath: `/t/${team.url}/documents/${document.id}/edit`,
+    });
+
+    await expect(page.getByRole('heading', { name: 'Documents' })).toBeVisible();
+
+    // Open the duplicate dialog.
+    await page.locator('button[title="Duplicate Envelope"]').click();
+    await expect(page.getByRole('heading', { name: 'Duplicate Document' })).toBeVisible();
+
+    // Uncheck "Include Recipients" — this also disables and unchecks "Include Fields".
+    await page.getByLabel('Include Recipients').click();
+    await expect(page.getByLabel('Include Fields')).toBeDisabled();
+
+    // Duplicate.
+    await page.getByRole('button', { name: 'Duplicate' }).click();
+    await expectToastTextToBeVisible(page, 'Document Duplicated');
+    await expect(page).toHaveURL(/\/documents\/.*\/edit/);
+
+    // The duplicate should have neither recipients nor fields.
+    const duplicate = await prisma.envelope.findFirstOrThrow({
+      where: {
+        teamId: team.id,
+        type: EnvelopeType.DOCUMENT,
+        id: { not: document.id },
+      },
+      include: { recipients: true, fields: true },
+      orderBy: { createdAt: 'desc' },
+    });
+
+    expect(duplicate.recipients).toHaveLength(0);
+    expect(duplicate.fields).toHaveLength(0);
+  });
+
+  test('duplicate document without fields keeps recipients but excludes fields', async ({ page }) => {
+    const { user, team } = await seedUser();
+
+    // Seed a draft document that has a recipient with a field.
+    const document = await seedDraftDocument(user, team.id, ['signer@test.documenso.com'], {
+      key: `dup-exclude-fields-${Date.now()}`,
+      internalVersion: 2,
+    });
+
+    await apiSignin({
+      page,
+      email: user.email,
+      redirectPath: `/t/${team.url}/documents/${document.id}/edit`,
+    });
+
+    await expect(page.getByRole('heading', { name: 'Documents' })).toBeVisible();
+
+    // Open the duplicate dialog.
+    await page.locator('button[title="Duplicate Envelope"]').click();
+    await expect(page.getByRole('heading', { name: 'Duplicate Document' })).toBeVisible();
+
+    // Uncheck only "Include Fields" (recipients stay included).
+    await page.getByLabel('Include Fields').click();
+
+    // Duplicate.
+    await page.getByRole('button', { name: 'Duplicate' }).click();
+    await expectToastTextToBeVisible(page, 'Document Duplicated');
+    await expect(page).toHaveURL(/\/documents\/.*\/edit/);
+
+    // The duplicate should keep the recipient but have no fields.
+    const duplicate = await prisma.envelope.findFirstOrThrow({
+      where: {
+        teamId: team.id,
+        type: EnvelopeType.DOCUMENT,
+        id: { not: document.id },
+      },
+      include: { recipients: true, fields: true },
+      orderBy: { createdAt: 'desc' },
+    });
+
+    expect(duplicate.recipients).toHaveLength(1);
+    expect(duplicate.fields).toHaveLength(0);
+  });
+
   test('download PDF dialog shows envelope items', async ({ page }) => {
     await openDocumentEnvelopeEditor(page);
 

packages/app-tests/e2e/envelopes/envelope-expiration-send.spec.ts

@@ -270,7 +270,7 @@ test('[ENVELOPE_EXPIRATION]: resending refreshes expiresAt', async ({ page }) =>
   await page.getByLabel('test.documenso.com').first().click();
   await page.getByRole('button', { name: 'Send reminder' }).click();
 
-  await expect(page.getByText('Document re-sent', { exact: true })).toBeVisible({
+  await expect(page.getByText('Document resent', { exact: true })).toBeVisible({
     timeout: 10_000,
   });
 

packages/app-tests/e2e/organisations/organisation-permission-hierarchy.spec.ts

@@ -0,0 +1,342 @@
+import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
+import { generateDatabaseId, nanoid } from '@documenso/lib/universal/id';
+import { prisma } from '@documenso/prisma';
+import { seedOrganisationMembers } from '@documenso/prisma/seed/organisations';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, type Page, test } from '@playwright/test';
+import { OrganisationGroupType, type OrganisationMemberRole } from '@prisma/client';
+
+import { apiSignin } from '../fixtures/authentication';
+
+const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
+
+/**
+ * Calls a tRPC mutation directly using the cookies of whoever is currently
+ * signed in on the page context. This deliberately bypasses the UI: the
+ * authorisation checks under test live on the server, and the UI may simply
+ * hide a button rather than reject the request, which would mask a backend gap.
+ */
+const trpcMutation = async (page: Page, procedure: string, input: Record<string, unknown>) => {
+  return await page.request.post(`${WEBAPP_BASE_URL}/api/trpc/${procedure}`, {
+    headers: { 'content-type': 'application/json' },
+    data: JSON.stringify({ json: input }),
+  });
+};
+
+const getOrganisationMember = async (userId: number, organisationId: string) => {
+  return await prisma.organisationMember.findFirstOrThrow({
+    where: {
+      userId,
+      organisationId,
+    },
+  });
+};
+
+const createCustomGroup = async (organisationId: string, organisationRole: OrganisationMemberRole) => {
+  return await prisma.organisationGroup.create({
+    data: {
+      id: generateDatabaseId('org_group'),
+      organisationId,
+      name: `custom-${organisationRole}-${nanoid()}`,
+      type: OrganisationGroupType.CUSTOM,
+      organisationRole,
+    },
+  });
+};
+
+const createPendingInvite = async (organisationId: string, organisationRole: OrganisationMemberRole) => {
+  return await prisma.organisationMemberInvite.create({
+    data: {
+      id: generateDatabaseId('member_invite'),
+      email: `invite-${nanoid()}@test.documenso.com`,
+      token: nanoid(32),
+      organisationId,
+      organisationRole,
+    },
+  });
+};
+
+test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: member deletion', () => {
+  test('a manager cannot delete an admin via member.delete', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser, adminUser] = await seedOrganisationMembers({
+      members: [
+        { name: 'Manager', organisationRole: 'MANAGER' },
+        { name: 'Admin', organisationRole: 'ADMIN' },
+      ],
+      organisationId: organisation.id,
+    });
+
+    const adminMember = await getOrganisationMember(adminUser.id, organisation.id);
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.member.delete', {
+      organisationId: organisation.id,
+      organisationMemberId: adminMember.id,
+    });
+
+    expect(res.ok()).toBeFalsy();
+
+    // The admin must still be a member of the organisation.
+    const stillExists = await prisma.organisationMember.findFirst({
+      where: { id: adminMember.id },
+    });
+
+    expect(stillExists).not.toBeNull();
+  });
+
+  test('a manager cannot delete an admin via member.deleteMany', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser, adminUser] = await seedOrganisationMembers({
+      members: [
+        { name: 'Manager', organisationRole: 'MANAGER' },
+        { name: 'Admin', organisationRole: 'ADMIN' },
+      ],
+      organisationId: organisation.id,
+    });
+
+    const adminMember = await getOrganisationMember(adminUser.id, organisation.id);
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
+      organisationId: organisation.id,
+      organisationMemberIds: [adminMember.id],
+    });
+
+    expect(res.ok()).toBeFalsy();
+
+    const stillExists = await prisma.organisationMember.findFirst({
+      where: { id: adminMember.id },
+    });
+
+    expect(stillExists).not.toBeNull();
+  });
+
+  test('a manager cannot delete the organisation owner', async ({ page }) => {
+    const { user: ownerUser, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser] = await seedOrganisationMembers({
+      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
+      organisationId: organisation.id,
+    });
+
+    const ownerMember = await getOrganisationMember(ownerUser.id, organisation.id);
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
+      organisationId: organisation.id,
+      organisationMemberIds: [ownerMember.id],
+    });
+
+    expect(res.ok()).toBeFalsy();
+
+    const stillExists = await prisma.organisationMember.findFirst({
+      where: { id: ownerMember.id },
+    });
+
+    expect(stillExists).not.toBeNull();
+  });
+
+  test('an admin cannot delete the organisation owner', async ({ page }) => {
+    const { user: ownerUser, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [adminUser] = await seedOrganisationMembers({
+      members: [{ name: 'Admin', organisationRole: 'ADMIN' }],
+      organisationId: organisation.id,
+    });
+
+    const ownerMember = await getOrganisationMember(ownerUser.id, organisation.id);
+
+    await apiSignin({ page, email: adminUser.email });
+
+    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
+      organisationId: organisation.id,
+      organisationMemberIds: [ownerMember.id],
+    });
+
+    expect(res.ok()).toBeFalsy();
+
+    const stillExists = await prisma.organisationMember.findFirst({
+      where: { id: ownerMember.id },
+    });
+
+    expect(stillExists).not.toBeNull();
+  });
+
+  test('a manager can still delete a regular member (positive control)', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser, memberUser] = await seedOrganisationMembers({
+      members: [
+        { name: 'Manager', organisationRole: 'MANAGER' },
+        { name: 'Member', organisationRole: 'MEMBER' },
+      ],
+      organisationId: organisation.id,
+    });
+
+    const member = await getOrganisationMember(memberUser.id, organisation.id);
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
+      organisationId: organisation.id,
+      organisationMemberIds: [member.id],
+    });
+
+    expect(res.ok()).toBeTruthy();
+
+    const deleted = await prisma.organisationMember.findFirst({
+      where: { id: member.id },
+    });
+
+    expect(deleted).toBeNull();
+  });
+});
+
+test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: group deletion', () => {
+  test('a manager cannot delete an admin-role group', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser] = await seedOrganisationMembers({
+      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
+      organisationId: organisation.id,
+    });
+
+    const adminGroup = await createCustomGroup(organisation.id, 'ADMIN');
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.group.delete', {
+      organisationId: organisation.id,
+      groupId: adminGroup.id,
+    });
+
+    expect(res.ok()).toBeFalsy();
+
+    const stillExists = await prisma.organisationGroup.findFirst({
+      where: { id: adminGroup.id },
+    });
+
+    expect(stillExists).not.toBeNull();
+  });
+
+  test('a manager can delete a member-role group (positive control)', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser] = await seedOrganisationMembers({
+      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
+      organisationId: organisation.id,
+    });
+
+    const memberGroup = await createCustomGroup(organisation.id, 'MEMBER');
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.group.delete', {
+      organisationId: organisation.id,
+      groupId: memberGroup.id,
+    });
+
+    expect(res.ok()).toBeTruthy();
+
+    const deleted = await prisma.organisationGroup.findFirst({
+      where: { id: memberGroup.id },
+    });
+
+    expect(deleted).toBeNull();
+  });
+});
+
+test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: invite resend', () => {
+  test('a manager cannot resend an admin-role invite', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser] = await seedOrganisationMembers({
+      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
+      organisationId: organisation.id,
+    });
+
+    const adminInvite = await createPendingInvite(organisation.id, 'ADMIN');
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.member.invite.resend', {
+      organisationId: organisation.id,
+      invitationId: adminInvite.id,
+    });
+
+    expect(res.ok()).toBeFalsy();
+  });
+
+  test('a manager can resend a member-role invite (positive control)', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [managerUser] = await seedOrganisationMembers({
+      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
+      organisationId: organisation.id,
+    });
+
+    const memberInvite = await createPendingInvite(organisation.id, 'MEMBER');
+
+    await apiSignin({ page, email: managerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.member.invite.resend', {
+      organisationId: organisation.id,
+      invitationId: memberInvite.id,
+    });
+
+    expect(res.ok()).toBeTruthy();
+  });
+});
+
+test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: leaving an organisation', () => {
+  test('the owner cannot leave without transferring ownership first', async ({ page }) => {
+    const { user: ownerUser, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const ownerMember = await getOrganisationMember(ownerUser.id, organisation.id);
+
+    await apiSignin({ page, email: ownerUser.email });
+
+    const res = await trpcMutation(page, 'organisation.leave', {
+      organisationId: organisation.id,
+    });
+
+    expect(res.ok()).toBeFalsy();
+
+    const stillExists = await prisma.organisationMember.findFirst({
+      where: { id: ownerMember.id },
+    });
+
+    expect(stillExists).not.toBeNull();
+  });
+
+  test('a non-owner member can still leave (positive control)', async ({ page }) => {
+    const { organisation } = await seedUser({ isPersonalOrganisation: false });
+
+    const [memberUser] = await seedOrganisationMembers({
+      members: [{ name: 'Member', organisationRole: 'MEMBER' }],
+      organisationId: organisation.id,
+    });
+
+    const member = await getOrganisationMember(memberUser.id, organisation.id);
+
+    await apiSignin({ page, email: memberUser.email });
+
+    const res = await trpcMutation(page, 'organisation.leave', {
+      organisationId: organisation.id,
+    });
+
+    expect(res.ok()).toBeTruthy();
+
+    const deleted = await prisma.organisationMember.findFirst({
+      where: { id: member.id },
+    });
+
+    expect(deleted).toBeNull();
+  });
+});

packages/app-tests/e2e/teams/team-documents.spec.ts

@@ -238,7 +238,7 @@ test('[TEAMS]: resend pending team document', async ({ page }) => {
   await page.getByLabel('test.documenso.com').first().click();
   await page.getByRole('button', { name: 'Send reminder' }).click();
 
-  await expectToastTextToBeVisible(page, 'Document re-sent');
+  await expectToastTextToBeVisible(page, 'Document resent');
 });
 
 test('[TEAMS]: delete draft team document', async ({ page }) => {

packages/app-tests/e2e/teams/team-members.spec.ts

@@ -0,0 +1,105 @@
+import { seedOrganisationMembers } from '@documenso/prisma/seed/organisations';
+import { seedTeamMember } from '@documenso/prisma/seed/teams';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, test } from '@playwright/test';
+import { OrganisationMemberRole, TeamMemberRole } from '@prisma/client';
+
+import { apiSignin } from '../fixtures/authentication';
+import { openDropdownMenu } from '../fixtures/generic';
+
+/**
+ * Reproduces the "Team has no internal team groups" bug.
+ *
+ * When a team has member inheritance turned OFF, organisation admins/managers are
+ * still inherited into the team as team admins (shown with the "Group" source).
+ * These members are not part of the team's INTERNAL_TEAM group, so they cannot be
+ * removed via the team members page - attempting to do so threw a 500 ("Team has no
+ * internal team groups").
+ *
+ * Instead of crashing, the delete dialog must explain why the inherited member can't
+ * be removed and not offer a confirm button.
+ */
+test('[TEAMS]: explains why an inherited organisation member cannot be removed', async ({ page }) => {
+  // Team created with member inheritance OFF.
+  const { user: owner, organisation, team } = await seedUser({ inheritMembers: false });
+
+  const inheritedAdminEmail = `inherited-admin-${team.url}@test.documenso.com`;
+
+  // A second organisation admin is inherited into the team as a team admin (source "Group").
+  await seedOrganisationMembers({
+    organisationId: organisation.id,
+    members: [
+      {
+        name: 'Inherited Admin',
+        email: inheritedAdminEmail,
+        organisationRole: OrganisationMemberRole.ADMIN,
+      },
+    ],
+  });
+
+  await apiSignin({
+    page,
+    email: owner.email,
+    redirectPath: `/t/${team.url}/settings/members`,
+  });
+
+  const inheritedMemberRow = page.getByRole('row').filter({ hasText: inheritedAdminEmail });
+
+  // Sanity check: the member is inherited from a group, not a direct team member.
+  await expect(inheritedMemberRow).toBeVisible();
+  await expect(inheritedMemberRow).toContainText('Group');
+
+  await openDropdownMenu(page, inheritedMemberRow.getByRole('button').last());
+
+  // The action stays enabled - opening it shows a dialog explaining why the inherited
+  // member can't be removed, rather than triggering the 500.
+  const removeMenuItem = page.getByRole('menuitem', { name: 'Remove' });
+  await expect(removeMenuItem).toBeEnabled();
+  await removeMenuItem.click();
+
+  await expect(page.getByText('inherited from a group').first()).toBeVisible();
+
+  // No confirm button is offered, so the broken removal can never be triggered.
+  await expect(page.getByRole('button', { name: 'Remove' })).toHaveCount(0);
+});
+
+/**
+ * Guards against over-disabling the remove action: a direct team member (one that
+ * belongs to the team's INTERNAL_TEAM group) must still be removable.
+ */
+test('[TEAMS]: can remove a direct team member', async ({ page }) => {
+  const { user: owner, team } = await seedUser({ inheritMembers: false });
+
+  const directMember = await seedTeamMember({
+    teamId: team.id,
+    name: 'Direct Member',
+    role: TeamMemberRole.MEMBER,
+  });
+
+  await apiSignin({
+    page,
+    email: owner.email,
+    redirectPath: `/t/${team.url}/settings/members`,
+  });
+
+  const directMemberRow = page.getByRole('row').filter({ hasText: directMember.email });
+
+  await expect(directMemberRow).toBeVisible();
+
+  await openDropdownMenu(page, directMemberRow.getByRole('button').last());
+
+  const removeMenuItem = page.getByRole('menuitem', { name: 'Remove' });
+
+  // The "Remove" action is enabled for direct members and removing them succeeds.
+  await expect(removeMenuItem).toBeEnabled();
+  await removeMenuItem.click();
+
+  await page.getByRole('button', { name: 'Remove' }).click();
+
+  await expect(page.getByText('You have successfully removed this user from the team.').first()).toBeVisible();
+
+  // The member is actually gone after reloading the members list.
+  await page.reload();
+  await expect(page.getByRole('row').filter({ hasText: owner.email })).toBeVisible();
+  await expect(page.getByRole('row').filter({ hasText: directMember.email })).toHaveCount(0);
+});

packages/ee/server-only/signing/csc/execute-tsp-sign.ts

@@ -1,6 +1,5 @@
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { jobs } from '@documenso/lib/jobs/client';
-import { sendPendingEmail } from '@documenso/lib/server-only/document/send-pending-email';
 import { getRecipientByToken } from '@documenso/lib/server-only/recipient/get-recipient-by-token';
 import { triggerWebhook } from '@documenso/lib/server-only/webhooks/trigger/trigger-webhook';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
@@ -474,9 +473,12 @@ export const executeTspSign = async (opts: ExecuteTspSignOptions): Promise<Execu
   });
 
   if (pendingRecipients.length > 0) {
-    await sendPendingEmail({
-      id: { type: 'envelopeId', id: envelope.id },
-      recipientId: recipient.id,
+    await jobs.triggerJob({
+      name: 'send.document.pending.email',
+      payload: {
+        envelopeId: envelope.id,
+        recipientId: recipient.id,
+      },
     });
 
     // TSP envelopes are forced SEQUENTIAL at send-time; this branch always

packages/email/package.json

@@ -12,12 +12,13 @@
     "index.ts"
   ],
   "scripts": {
-    "dev": "email dev --port 3002 --dir templates",
+    "dev": "react-router dev --config preview/vite.config.ts",
+    "preview:build": "react-router build --config preview/vite.config.ts",
     "clean": "rimraf node_modules"
   },
   "dependencies": {
-    "@documenso/tailwind-config": "*",
     "@documenso/nodemailer-resend": "4.0.0",
+    "@documenso/tailwind-config": "*",
     "@react-email/body": "0.2.0",
     "@react-email/button": "0.2.0",
     "@react-email/code-block": "0.2.0",

packages/email/preview/.gitignore

@@ -0,0 +1,2 @@
+/.react-router/
+/build/

packages/email/preview/app/app.css

@@ -0,0 +1,9 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+html,
+body {
+  margin: 0;
+  padding: 0;
+}

packages/email/preview/app/components/playground.tsx

@@ -0,0 +1,337 @@
+import { SUPPORTED_LANGUAGE_CODES } from '@documenso/lib/constants/locales';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { useNavigate } from 'react-router';
+
+import type { FieldConfig } from '../lib/templates';
+import { templates } from '../lib/templates';
+import { viewports } from '../lib/viewports';
+import { PropFields } from './prop-fields';
+
+type Theme = 'light' | 'dark';
+
+const GROUP_ORDER = ['Documents', 'Recipients', 'Organisations', 'Teams', 'Account', 'Admin'] as const;
+
+const LANGUAGE_LABELS: Record<string, string> = {
+  en: 'English',
+  de: 'German',
+  fr: 'French',
+  es: 'Spanish',
+  it: 'Italian',
+  nl: 'Dutch',
+  pl: 'Polish',
+  'pt-BR': 'Portuguese (Brazil)',
+  ja: 'Japanese',
+  ko: 'Korean',
+  zh: 'Chinese',
+};
+
+const DEFAULT_COLORS = {
+  primary: '#a2e771',
+  primaryForeground: '#162c07',
+  background: '#ffffff',
+  foreground: '#0f172a',
+};
+
+type PlaygroundProps = {
+  slug: string;
+  fields: Record<string, FieldConfig>;
+  defaultProps: Record<string, unknown>;
+};
+
+export const EmailPlayground = ({ slug, fields, defaultProps }: PlaygroundProps) => {
+  const navigate = useNavigate();
+
+  const [props, setProps] = useState(defaultProps);
+  const [html, setHtml] = useState('');
+  const [loading, setLoading] = useState(false);
+
+  const [theme, setTheme] = useState<Theme>('light');
+  const [viewportIndex, setViewportIndex] = useState(2);
+  const [lang, setLang] = useState('en');
+
+  const [brandingEnabled, setBrandingEnabled] = useState(false);
+  const [colors, setColors] = useState(DEFAULT_COLORS);
+
+  const debounceRef = useRef<ReturnType<typeof setTimeout>>(undefined);
+
+  const groupedTemplates = useMemo(() => {
+    const entries = Object.entries(templates);
+
+    return GROUP_ORDER.map((group) => ({
+      group,
+      entries: entries.filter(([, def]) => def.group === group),
+    })).filter((section) => section.entries.length > 0);
+  }, []);
+
+  const fetchHtml = useCallback(
+    async (currentProps: Record<string, unknown>, currentLang: string, brandColors: typeof colors | null) => {
+      setLoading(true);
+
+      try {
+        const response = await fetch('/api/render', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            slug,
+            props: currentProps,
+            lang: currentLang,
+            colors: brandColors,
+            assetBaseUrl: window.location.origin,
+          }),
+        });
+
+        if (response.ok) {
+          setHtml(await response.text());
+        }
+      } finally {
+        setLoading(false);
+      }
+    },
+    [slug],
+  );
+
+  // Reset props when navigating to a different template.
+  useEffect(() => {
+    setProps(defaultProps);
+  }, [defaultProps]);
+
+  // Re-render on any input change (debounced).
+  useEffect(() => {
+    clearTimeout(debounceRef.current);
+
+    debounceRef.current = setTimeout(() => {
+      void fetchHtml(props, lang, brandingEnabled ? colors : null);
+    }, 250);
+
+    return () => clearTimeout(debounceRef.current);
+  }, [props, lang, brandingEnabled, colors, fetchHtml]);
+
+  const handlePropChange = (key: string, value: unknown) => {
+    setProps((prev) => ({ ...prev, [key]: value }));
+  };
+
+  const handleColorChange = (key: keyof typeof colors, value: string) => {
+    setColors((prev) => ({ ...prev, [key]: value }));
+  };
+
+  // Force dark mode inside the iframe by neutralising the prefers-color-scheme
+  // media query (color-scheme alone doesn't trigger it inside an iframe).
+  const displayHtml = theme === 'dark' && html ? html.replaceAll(/prefers-color-scheme:\s*dark/g, 'min-width:0') : html;
+
+  const viewport = viewports[viewportIndex];
+
+  return (
+    <div className="flex h-screen w-screen overflow-hidden bg-neutral-100 font-sans text-neutral-900">
+      {/* Sidebar */}
+      <aside className="flex h-full w-60 flex-shrink-0 flex-col overflow-y-auto border-neutral-200 border-r bg-white">
+        <div className="border-neutral-200 border-b px-4 py-3">
+          <h1 className="font-semibold text-sm">Email Preview</h1>
+          <p className="text-neutral-500 text-xs">{Object.keys(templates).length} templates</p>
+        </div>
+
+        <nav className="flex-1 px-2 py-2">
+          {groupedTemplates.map((section) => (
+            <div key={section.group} className="mb-3">
+              <div className="px-2 py-1 font-medium text-neutral-400 text-xs uppercase tracking-wide">
+                {section.group}
+              </div>
+
+              {section.entries.map(([id, def]) => (
+                <button
+                  key={id}
+                  type="button"
+                  onClick={() => navigate(`/${id}`)}
+                  className={`block w-full rounded-md px-2 py-1.5 text-left text-sm transition-colors ${
+                    slug === id ? 'bg-neutral-900 text-white' : 'text-neutral-700 hover:bg-neutral-100'
+                  }`}
+                >
+                  {def.name}
+                </button>
+              ))}
+            </div>
+          ))}
+        </nav>
+      </aside>
+
+      {/* Props panel */}
+      <section className="flex h-full w-72 flex-shrink-0 flex-col overflow-y-auto border-neutral-200 border-r bg-white px-4 py-3">
+        <h2 className="mb-3 font-medium text-neutral-500 text-xs uppercase tracking-wide">Props</h2>
+        <PropFields fields={fields} values={props} onChange={handlePropChange} />
+      </section>
+
+      {/* Main */}
+      <main className="flex h-full flex-1 flex-col overflow-hidden">
+        <Toolbar
+          theme={theme}
+          setTheme={setTheme}
+          viewportIndex={viewportIndex}
+          setViewportIndex={setViewportIndex}
+          lang={lang}
+          setLang={setLang}
+          brandingEnabled={brandingEnabled}
+          setBrandingEnabled={setBrandingEnabled}
+          colors={colors}
+          onColorChange={handleColorChange}
+          loading={loading}
+        />
+
+        <div
+          className={`flex flex-1 items-start justify-center overflow-auto p-6 ${
+            theme === 'dark' ? 'bg-neutral-800' : 'bg-neutral-200'
+          }`}
+        >
+          <div
+            className="flex-shrink-0 overflow-hidden rounded-lg bg-white shadow-lg"
+            style={{ width: viewport.width }}
+          >
+            <iframe
+              title={`${viewport.name} ${theme}`}
+              srcDoc={displayHtml}
+              className="h-[calc(100vh-8rem)] w-full border-0"
+              style={{ colorScheme: theme }}
+            />
+          </div>
+        </div>
+      </main>
+    </div>
+  );
+};
+
+type ToolbarProps = {
+  theme: Theme;
+  setTheme: (theme: Theme) => void;
+  viewportIndex: number;
+  setViewportIndex: (index: number) => void;
+  lang: string;
+  setLang: (lang: string) => void;
+  brandingEnabled: boolean;
+  setBrandingEnabled: (enabled: boolean) => void;
+  colors: typeof DEFAULT_COLORS;
+  onColorChange: (key: keyof typeof DEFAULT_COLORS, value: string) => void;
+  loading: boolean;
+};
+
+const Toolbar = (props: ToolbarProps) => {
+  return (
+    <div className="flex flex-wrap items-center gap-4 border-neutral-200 border-b bg-white px-4 py-2">
+      <SegmentedControl
+        label="Theme"
+        value={props.theme}
+        options={[
+          { value: 'light', label: 'Light' },
+          { value: 'dark', label: 'Dark' },
+        ]}
+        onChange={(value) => props.setTheme(value as Theme)}
+      />
+
+      <SegmentedControl
+        label="Viewport"
+        value={String(props.viewportIndex)}
+        options={viewports.map((viewport, index) => ({ value: String(index), label: viewport.name }))}
+        onChange={(value) => props.setViewportIndex(Number(value))}
+      />
+
+      <label className="flex items-center gap-1.5 text-neutral-600 text-xs">
+        <span className="font-medium">Language</span>
+        <select
+          value={props.lang}
+          onChange={(event) => props.setLang(event.target.value)}
+          className="rounded-md border border-neutral-300 bg-white px-2 py-1 text-neutral-900 text-xs"
+        >
+          {SUPPORTED_LANGUAGE_CODES.map((code) => (
+            <option key={code} value={code}>
+              {LANGUAGE_LABELS[code] ?? code}
+            </option>
+          ))}
+        </select>
+      </label>
+
+      <label className="flex items-center gap-1.5 text-neutral-600 text-xs">
+        <input
+          type="checkbox"
+          checked={props.brandingEnabled}
+          onChange={(event) => props.setBrandingEnabled(event.target.checked)}
+        />
+        <span className="font-medium">Brand colours</span>
+      </label>
+
+      {props.brandingEnabled && (
+        <div className="flex items-center gap-3">
+          <ColorInput
+            label="Primary"
+            value={props.colors.primary}
+            onChange={(value) => props.onColorChange('primary', value)}
+          />
+          <ColorInput
+            label="On primary"
+            value={props.colors.primaryForeground}
+            onChange={(value) => props.onColorChange('primaryForeground', value)}
+          />
+          <ColorInput
+            label="Background"
+            value={props.colors.background}
+            onChange={(value) => props.onColorChange('background', value)}
+          />
+          <ColorInput
+            label="Text"
+            value={props.colors.foreground}
+            onChange={(value) => props.onColorChange('foreground', value)}
+          />
+        </div>
+      )}
+
+      <span className="ml-auto text-neutral-400 text-xs">{props.loading ? 'Rendering…' : ''}</span>
+    </div>
+  );
+};
+
+type SegmentedControlProps = {
+  label: string;
+  value: string;
+  options: { value: string; label: string }[];
+  onChange: (value: string) => void;
+};
+
+const SegmentedControl = (props: SegmentedControlProps) => {
+  return (
+    <div className="flex items-center gap-1.5">
+      <span className="font-medium text-neutral-600 text-xs">{props.label}</span>
+      <div className="flex overflow-hidden rounded-md border border-neutral-300">
+        {props.options.map((option) => (
+          <button
+            key={option.value}
+            type="button"
+            onClick={() => props.onChange(option.value)}
+            className={`px-2.5 py-1 text-xs transition-colors ${
+              props.value === option.value
+                ? 'bg-neutral-900 text-white'
+                : 'bg-white text-neutral-700 hover:bg-neutral-100'
+            }`}
+          >
+            {option.label}
+          </button>
+        ))}
+      </div>
+    </div>
+  );
+};
+
+type ColorInputProps = {
+  label: string;
+  value: string;
+  onChange: (value: string) => void;
+};
+
+const ColorInput = (props: ColorInputProps) => {
+  return (
+    <label className="flex items-center gap-1 text-neutral-600 text-xs">
+      <span>{props.label}</span>
+      <input
+        type="color"
+        value={props.value}
+        onChange={(event) => props.onChange(event.target.value)}
+        className="h-6 w-6 cursor-pointer rounded border border-neutral-300 bg-white p-0"
+      />
+    </label>
+  );
+};

packages/email/preview/app/components/prop-fields.tsx

@@ -0,0 +1,113 @@
+import type { FieldConfig } from '../lib/templates';
+
+type PropFieldsProps = {
+  fields: Record<string, FieldConfig>;
+  values: Record<string, unknown>;
+  onChange: (key: string, value: unknown) => void;
+};
+
+export const PropFields = ({ fields, values, onChange }: PropFieldsProps) => {
+  const entries = Object.entries(fields);
+
+  if (entries.length === 0) {
+    return <p className="text-neutral-400 text-xs">No editable props.</p>;
+  }
+
+  return (
+    <div className="grid gap-3">
+      {entries.map(([key, field]) => (
+        <PropField key={key} name={key} field={field} value={values[key]} onChange={(value) => onChange(key, value)} />
+      ))}
+    </div>
+  );
+};
+
+type PropFieldProps = {
+  name: string;
+  field: FieldConfig;
+  value: unknown;
+  onChange: (value: unknown) => void;
+};
+
+const inputClass =
+  'w-full rounded-md border border-neutral-300 bg-white px-2 py-1 text-neutral-900 text-xs focus:border-neutral-500 focus:outline-none';
+
+const PropField = ({ name, field, value, onChange }: PropFieldProps) => {
+  const id = `prop-${name}`;
+
+  return (
+    <div className="grid gap-1">
+      <label htmlFor={id} className="font-medium text-neutral-600 text-xs">
+        {field.label}
+      </label>
+
+      {field.type === 'text' && (
+        <input
+          id={id}
+          className={inputClass}
+          value={String(value ?? '')}
+          placeholder={field.placeholder}
+          onChange={(event) => onChange(event.target.value)}
+        />
+      )}
+
+      {field.type === 'textarea' && (
+        <textarea
+          id={id}
+          className={`${inputClass} min-h-16 resize-y font-mono`}
+          value={String(value ?? '')}
+          placeholder={field.placeholder}
+          onChange={(event) => onChange(event.target.value)}
+        />
+      )}
+
+      {field.type === 'number' && (
+        <input
+          id={id}
+          type="number"
+          className={inputClass}
+          value={value === undefined || value === null ? '' : String(value)}
+          placeholder={field.placeholder}
+          onChange={(event) => onChange(event.target.value === '' ? undefined : Number(event.target.value))}
+        />
+      )}
+
+      {field.type === 'boolean' && (
+        <input
+          id={id}
+          type="checkbox"
+          className="h-4 w-4"
+          checked={Boolean(value)}
+          onChange={(event) => onChange(event.target.checked)}
+        />
+      )}
+
+      {field.type === 'list' && (
+        <textarea
+          id={id}
+          className={`${inputClass} min-h-16 resize-y font-mono`}
+          value={Array.isArray(value) ? value.join('\n') : ''}
+          placeholder={field.placeholder}
+          onChange={(event) => onChange(event.target.value === '' ? [] : event.target.value.split('\n'))}
+        />
+      )}
+
+      {field.type === 'select' && field.options && (
+        <select
+          id={id}
+          className={inputClass}
+          value={String(value ?? '')}
+          onChange={(event) => onChange(event.target.value)}
+        >
+          {field.options.map((option) => (
+            <option key={option.value} value={option.value}>
+              {option.label}
+            </option>
+          ))}
+        </select>
+      )}
+
+      {field.description && <p className="text-neutral-400 text-xs">{field.description}</p>}
+    </div>
+  );
+};

packages/email/preview/app/entry.client.tsx

@@ -0,0 +1,12 @@
+import { StrictMode, startTransition } from 'react';
+import { hydrateRoot } from 'react-dom/client';
+import { HydratedRouter } from 'react-router/dom';
+
+startTransition(() => {
+  hydrateRoot(
+    document,
+    <StrictMode>
+      <HydratedRouter />
+    </StrictMode>,
+  );
+});

packages/email/preview/app/entry.server.tsx

@@ -0,0 +1,56 @@
+import { PassThrough } from 'node:stream';
+import { createReadableStreamFromReadable } from '@react-router/node';
+import { isbot } from 'isbot';
+import type { RenderToPipeableStreamOptions } from 'react-dom/server';
+import { renderToPipeableStream } from 'react-dom/server';
+import type { AppLoadContext, EntryContext } from 'react-router';
+import { ServerRouter } from 'react-router';
+
+export const streamTimeout = 5_000;
+
+export default function handleRequest(
+  request: Request,
+  responseStatusCode: number,
+  responseHeaders: Headers,
+  routerContext: EntryContext,
+  _loadContext: AppLoadContext,
+) {
+  return new Promise((resolve, reject) => {
+    let shellRendered = false;
+    const userAgent = request.headers.get('user-agent');
+
+    const readyOption: keyof RenderToPipeableStreamOptions =
+      (userAgent && isbot(userAgent)) || routerContext.isSpaMode ? 'onAllReady' : 'onShellReady';
+
+    const { pipe, abort } = renderToPipeableStream(<ServerRouter context={routerContext} url={request.url} />, {
+      [readyOption]() {
+        shellRendered = true;
+        const body = new PassThrough();
+        const stream = createReadableStreamFromReadable(body);
+
+        responseHeaders.set('Content-Type', 'text/html');
+
+        resolve(
+          new Response(stream, {
+            headers: responseHeaders,
+            status: responseStatusCode,
+          }),
+        );
+
+        pipe(body);
+      },
+      onShellError(error: unknown) {
+        reject(error);
+      },
+      onError(error: unknown) {
+        responseStatusCode = 500;
+
+        if (shellRendered) {
+          console.error(error);
+        }
+      },
+    });
+
+    setTimeout(abort, streamTimeout + 1000);
+  });
+}

packages/email/preview/app/lib/templates.tsx

@@ -0,0 +1,407 @@
+import type { ComponentType } from 'react';
+
+import { AccessAuth2FAEmailTemplate } from '../../../templates/access-auth-2fa';
+import { AdminUserCreatedTemplate } from '../../../templates/admin-user-created';
+import { BulkSendCompleteEmail } from '../../../templates/bulk-send-complete';
+import { ConfirmEmailTemplate } from '../../../templates/confirm-email';
+import { ConfirmTeamEmailTemplate } from '../../../templates/confirm-team-email';
+import { DocumentCancelTemplate } from '../../../templates/document-cancel';
+import { DocumentCompletedEmailTemplate } from '../../../templates/document-completed';
+import { DocumentCreatedFromDirectTemplateEmailTemplate } from '../../../templates/document-created-from-direct-template';
+import { DocumentInviteEmailTemplate } from '../../../templates/document-invite';
+import { DocumentPendingEmailTemplate } from '../../../templates/document-pending';
+import { DocumentRecipientSignedEmailTemplate } from '../../../templates/document-recipient-signed';
+import { DocumentRejectedEmail } from '../../../templates/document-rejected';
+import { DocumentRejectionConfirmedEmail } from '../../../templates/document-rejection-confirmed';
+import { DocumentReminderEmailTemplate } from '../../../templates/document-reminder';
+import { DocumentSelfSignedEmailTemplate } from '../../../templates/document-self-signed';
+import { DocumentSuperDeleteEmailTemplate } from '../../../templates/document-super-delete';
+import { ForgotPasswordTemplate } from '../../../templates/forgot-password';
+import { OrganisationAccountLinkConfirmationTemplate } from '../../../templates/organisation-account-link-confirmation';
+import { OrganisationDeleteEmailTemplate } from '../../../templates/organisation-delete';
+import { OrganisationInviteEmailTemplate } from '../../../templates/organisation-invite';
+import { OrganisationJoinEmailTemplate } from '../../../templates/organisation-join';
+import { OrganisationLeaveEmailTemplate } from '../../../templates/organisation-leave';
+import { OrganisationLimitAlertEmailTemplate } from '../../../templates/organisation-limit-alert';
+import { RecipientExpiredTemplate } from '../../../templates/recipient-expired';
+import { RecipientRemovedFromDocumentTemplate } from '../../../templates/recipient-removed-from-document';
+import { ResetPasswordTemplate } from '../../../templates/reset-password';
+import { TeamDeleteEmailTemplate } from '../../../templates/team-delete';
+import { TeamEmailRemovedTemplate } from '../../../templates/team-email-removed';
+
+export type FieldType = 'text' | 'textarea' | 'number' | 'boolean' | 'select' | 'list';
+
+export type FieldConfig = {
+  type: FieldType;
+  label: string;
+  description?: string;
+  placeholder?: string;
+  default: unknown;
+  options?: { label: string; value: string }[];
+};
+
+export type TemplateDefinition = {
+  /** Human label for the sidebar. */
+  name: string;
+  /** Loose grouping for the sidebar. */
+  group: 'Documents' | 'Recipients' | 'Organisations' | 'Teams' | 'Account' | 'Admin';
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  component: ComponentType<any>;
+  /** Editable props surfaced in the preview UI. */
+  fields: Record<string, FieldConfig>;
+};
+
+// --- Reusable field presets ---
+
+const documentNameField: FieldConfig = {
+  type: 'text',
+  label: 'Document name',
+  default: 'Open Source Pledge.pdf',
+};
+
+const recipientNameField: FieldConfig = {
+  type: 'text',
+  label: 'Recipient name',
+  default: 'Lucas Smith',
+};
+
+const roleField: FieldConfig = {
+  type: 'select',
+  label: 'Recipient role',
+  default: 'SIGNER',
+  options: [
+    { label: 'Signer', value: 'SIGNER' },
+    { label: 'Viewer', value: 'VIEWER' },
+    { label: 'Approver', value: 'APPROVER' },
+    { label: 'CC', value: 'CC' },
+    { label: 'Assistant', value: 'ASSISTANT' },
+  ],
+};
+
+/**
+ * Explicit template registry. Each entry maps a slug → component + editable
+ * `fields`. The slug is the route param (`/:slug`) and matches the source
+ * filename (sans extension).
+ *
+ * `fields` drives both the default preview values AND the editable inputs in
+ * the UI, so production templates stay free of preview-only defaults.
+ */
+export const templates: Record<string, TemplateDefinition> = {
+  // ---- Documents ----
+  'document-invite': {
+    name: 'Document invite',
+    group: 'Documents',
+    component: DocumentInviteEmailTemplate,
+    fields: {
+      inviterName: { type: 'text', label: 'Inviter name', default: 'Lucas Smith' },
+      inviterEmail: { type: 'text', label: 'Inviter email', default: 'lucas@documenso.com' },
+      documentName: documentNameField,
+      role: roleField,
+      customBody: {
+        type: 'textarea',
+        label: 'Custom message',
+        default: '',
+        description: 'Leave blank to use the default invite copy.',
+      },
+    },
+  },
+  'document-completed': {
+    name: 'Document completed',
+    group: 'Documents',
+    component: DocumentCompletedEmailTemplate,
+    fields: {
+      documentName: documentNameField,
+      customBody: { type: 'textarea', label: 'Custom message', default: '' },
+    },
+  },
+  'document-self-signed': {
+    name: 'Document self-signed',
+    group: 'Documents',
+    component: DocumentSelfSignedEmailTemplate,
+    fields: {
+      documentName: documentNameField,
+    },
+  },
+  'document-pending': {
+    name: 'Document pending',
+    group: 'Documents',
+    component: DocumentPendingEmailTemplate,
+    fields: {
+      documentName: documentNameField,
+    },
+  },
+  'document-reminder': {
+    name: 'Document reminder',
+    group: 'Documents',
+    component: DocumentReminderEmailTemplate,
+    fields: {
+      recipientName: recipientNameField,
+      documentName: documentNameField,
+      role: roleField,
+      customBody: { type: 'textarea', label: 'Custom message', default: '' },
+    },
+  },
+  'document-cancel': {
+    name: 'Document cancelled',
+    group: 'Documents',
+    component: DocumentCancelTemplate,
+    fields: {
+      inviterName: { type: 'text', label: 'Inviter name', default: 'Lucas Smith' },
+      documentName: documentNameField,
+      cancellationReason: {
+        type: 'textarea',
+        label: 'Cancellation reason',
+        default: '',
+        description: 'Optional. Blank renders no reason block.',
+      },
+    },
+  },
+  'document-rejected': {
+    name: 'Document rejected',
+    group: 'Documents',
+    component: DocumentRejectedEmail,
+    fields: {
+      recipientName: recipientNameField,
+      documentName: documentNameField,
+      documentUrl: { type: 'text', label: 'Document URL', default: 'https://documenso.com' },
+      rejectionReason: {
+        type: 'textarea',
+        label: 'Rejection reason',
+        default: 'The pledge amount is incorrect.',
+        description: 'Optional in production; blank renders no reason block.',
+      },
+    },
+  },
+  'document-rejection-confirmed': {
+    name: 'Document rejection confirmed',
+    group: 'Documents',
+    component: DocumentRejectionConfirmedEmail,
+    fields: {
+      recipientName: recipientNameField,
+      documentName: documentNameField,
+      documentOwnerName: { type: 'text', label: 'Document owner', default: 'Timur Ercan' },
+      reason: {
+        type: 'textarea',
+        label: 'Rejection reason',
+        default: 'The pledge amount is incorrect.',
+        description: 'Optional in production; blank renders no reason block.',
+      },
+    },
+  },
+  'document-created-from-direct-template': {
+    name: 'Document created (direct template)',
+    group: 'Documents',
+    component: DocumentCreatedFromDirectTemplateEmailTemplate,
+    fields: {
+      documentName: documentNameField,
+    },
+  },
+  'document-super-delete': {
+    name: 'Document deleted (admin)',
+    group: 'Documents',
+    component: DocumentSuperDeleteEmailTemplate,
+    fields: {
+      documentName: documentNameField,
+    },
+  },
+  'bulk-send-complete': {
+    name: 'Bulk send complete',
+    group: 'Documents',
+    component: BulkSendCompleteEmail,
+    fields: {
+      userName: { type: 'text', label: 'User name', default: 'Lucas Smith' },
+      templateName: { type: 'text', label: 'Template name', default: 'NDA Template' },
+      totalProcessed: { type: 'number', label: 'Total processed', default: 50 },
+      successCount: { type: 'number', label: 'Success count', default: 48 },
+      failedCount: { type: 'number', label: 'Failed count', default: 2 },
+      errors: {
+        type: 'list',
+        label: 'Errors',
+        default: ['Row 12: invalid email', 'Row 30: missing name'],
+        description: 'One error per line. Rendered when failed count > 0.',
+      },
+    },
+  },
+
+  // ---- Recipients ----
+  'document-recipient-signed': {
+    name: 'Recipient signed',
+    group: 'Recipients',
+    component: DocumentRecipientSignedEmailTemplate,
+    fields: {
+      documentName: documentNameField,
+      recipientName: recipientNameField,
+    },
+  },
+  'recipient-expired': {
+    name: 'Recipient expired',
+    group: 'Recipients',
+    component: RecipientExpiredTemplate,
+    fields: {
+      documentName: documentNameField,
+      recipientName: recipientNameField,
+    },
+  },
+  'recipient-removed-from-document': {
+    name: 'Recipient removed',
+    group: 'Recipients',
+    component: RecipientRemovedFromDocumentTemplate,
+    fields: {
+      documentName: documentNameField,
+    },
+  },
+
+  // ---- Organisations ----
+  'organisation-invite': {
+    name: 'Organisation invite',
+    group: 'Organisations',
+    component: OrganisationInviteEmailTemplate,
+    fields: {
+      senderName: { type: 'text', label: 'Sender name', default: 'Lucas Smith' },
+      organisationName: { type: 'text', label: 'Organisation name', default: 'Documenso' },
+    },
+  },
+  'organisation-join': {
+    name: 'Organisation join',
+    group: 'Organisations',
+    component: OrganisationJoinEmailTemplate,
+    fields: {
+      memberName: { type: 'text', label: 'Member name', default: 'Lucas Smith' },
+      organisationName: { type: 'text', label: 'Organisation name', default: 'Documenso' },
+    },
+  },
+  'organisation-leave': {
+    name: 'Organisation leave',
+    group: 'Organisations',
+    component: OrganisationLeaveEmailTemplate,
+    fields: {
+      memberName: { type: 'text', label: 'Member name', default: 'Lucas Smith' },
+      organisationName: { type: 'text', label: 'Organisation name', default: 'Documenso' },
+    },
+  },
+  'organisation-delete': {
+    name: 'Organisation delete',
+    group: 'Organisations',
+    component: OrganisationDeleteEmailTemplate,
+    fields: {
+      organisationName: { type: 'text', label: 'Organisation name', default: 'Documenso' },
+    },
+  },
+  'organisation-limit-alert': {
+    name: 'Organisation limit alert',
+    group: 'Organisations',
+    component: OrganisationLimitAlertEmailTemplate,
+    fields: {
+      organisationName: { type: 'text', label: 'Organisation name', default: 'Documenso' },
+    },
+  },
+  'organisation-account-link-confirmation': {
+    name: 'Account link confirmation',
+    group: 'Organisations',
+    component: OrganisationAccountLinkConfirmationTemplate,
+    fields: {
+      organisationName: { type: 'text', label: 'Organisation name', default: 'Documenso' },
+    },
+  },
+
+  // ---- Teams ----
+  'confirm-team-email': {
+    name: 'Confirm team email',
+    group: 'Teams',
+    component: ConfirmTeamEmailTemplate,
+    fields: {
+      teamName: { type: 'text', label: 'Team name', default: 'Documenso' },
+    },
+  },
+  'team-delete': {
+    name: 'Team delete',
+    group: 'Teams',
+    component: TeamDeleteEmailTemplate,
+    fields: {},
+  },
+  'team-email-removed': {
+    name: 'Team email removed',
+    group: 'Teams',
+    component: TeamEmailRemovedTemplate,
+    fields: {
+      teamName: { type: 'text', label: 'Team name', default: 'Documenso' },
+      teamEmail: { type: 'text', label: 'Team email', default: 'team@documenso.com' },
+    },
+  },
+
+  // ---- Account ----
+  'confirm-email': {
+    name: 'Confirm email',
+    group: 'Account',
+    component: ConfirmEmailTemplate,
+    fields: {
+      confirmationLink: {
+        type: 'text',
+        label: 'Confirmation link',
+        default: 'https://documenso.com/confirm',
+      },
+    },
+  },
+  'forgot-password': {
+    name: 'Forgot password',
+    group: 'Account',
+    component: ForgotPasswordTemplate,
+    fields: {
+      resetPasswordLink: {
+        type: 'text',
+        label: 'Reset link',
+        default: 'https://documenso.com/reset',
+      },
+    },
+  },
+  'reset-password': {
+    name: 'Reset password',
+    group: 'Account',
+    component: ResetPasswordTemplate,
+    fields: {
+      userName: { type: 'text', label: 'User name', default: 'Lucas Smith' },
+      userEmail: { type: 'text', label: 'User email', default: 'lucas@documenso.com' },
+    },
+  },
+  'access-auth-2fa': {
+    name: 'Access auth 2FA',
+    group: 'Account',
+    component: AccessAuth2FAEmailTemplate,
+    fields: {
+      documentTitle: { type: 'text', label: 'Document title', default: 'Open Source Pledge.pdf' },
+      code: { type: 'text', label: 'Code', default: '123456' },
+      userEmail: { type: 'text', label: 'User email', default: 'lucas@documenso.com' },
+      userName: { type: 'text', label: 'User name', default: 'Lucas Smith' },
+      expiresInMinutes: { type: 'number', label: 'Expires in (min)', default: 10 },
+    },
+  },
+
+  // ---- Admin ----
+  'admin-user-created': {
+    name: 'Admin user created',
+    group: 'Admin',
+    component: AdminUserCreatedTemplate,
+    fields: {
+      resetPasswordLink: {
+        type: 'text',
+        label: 'Reset link',
+        default: 'https://documenso.com/reset',
+      },
+    },
+  },
+};
+
+export type TemplateId = keyof typeof templates;
+
+/** Extract the default prop values from a template's field config. */
+export const getDefaultProps = (fields: Record<string, FieldConfig>): Record<string, unknown> => {
+  const props: Record<string, unknown> = {};
+
+  for (const [key, field] of Object.entries(fields)) {
+    props[key] = field.default;
+  }
+
+  return props;
+};
+
+export const getTemplate = (slug: string): TemplateDefinition | undefined => templates[slug];

packages/email/preview/app/lib/viewports.ts

@@ -0,0 +1,10 @@
+export type Viewport = {
+  name: string;
+  width: number;
+};
+
+export const viewports: Viewport[] = [
+  { name: 'Mobile', width: 390 },
+  { name: 'Tablet', width: 768 },
+  { name: 'Desktop', width: 1024 },
+];

packages/email/preview/app/root.tsx

@@ -0,0 +1,30 @@
+import { Links, Meta, Outlet, Scripts, ScrollRestoration } from 'react-router';
+
+import type { Route } from './+types/root';
+import stylesheet from './app.css?url';
+
+export const links: Route.LinksFunction = () => [{ rel: 'stylesheet', href: stylesheet }];
+
+export const Layout = ({ children }: { children: React.ReactNode }) => {
+  return (
+    <html lang="en">
+      <head>
+        <meta charSet="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <Meta />
+        <Links />
+      </head>
+      <body>
+        {children}
+        <ScrollRestoration />
+        <Scripts />
+      </body>
+    </html>
+  );
+};
+
+const App = () => {
+  return <Outlet />;
+};
+
+export default App;

packages/email/preview/app/routes.ts

@@ -0,0 +1,7 @@
+import { index, type RouteConfig, route } from '@react-router/dev/routes';
+
+export default [
+  index('routes/_index.tsx'),
+  route('api/render', 'routes/api.render.tsx'),
+  route(':slug', 'routes/$slug.tsx'),
+] satisfies RouteConfig;

packages/email/preview/app/routes/$slug.tsx

@@ -0,0 +1,35 @@
+import { data } from 'react-router';
+
+import { EmailPlayground } from '../components/playground';
+import { getDefaultProps, getTemplate } from '../lib/templates';
+import type { Route } from './+types/$slug';
+
+export const loader = ({ params }: Route.LoaderArgs) => {
+  const { slug } = params;
+  const template = getTemplate(slug);
+
+  if (!template) {
+    throw data(`Unknown template: ${slug}`, { status: 404 });
+  }
+
+  return {
+    slug,
+    templateName: template.name,
+    fields: template.fields,
+    defaultProps: getDefaultProps(template.fields),
+  };
+};
+
+export const meta = ({ data: loaderData }: Route.MetaArgs) => {
+  if (!loaderData) {
+    return [{ title: 'Not found — Email Preview' }];
+  }
+
+  return [{ title: `${loaderData.templateName} — Email Preview` }];
+};
+
+const TemplatePage = ({ loaderData }: Route.ComponentProps) => {
+  return <EmailPlayground slug={loaderData.slug} fields={loaderData.fields} defaultProps={loaderData.defaultProps} />;
+};
+
+export default TemplatePage;

packages/email/preview/app/routes/_index.tsx

@@ -0,0 +1,13 @@
+import { redirect } from 'react-router';
+
+import { templates } from '../lib/templates';
+
+/**
+ * The index has no UI of its own — redirect to the first template so the
+ * preview always opens on something.
+ */
+export const loader = () => {
+  const firstSlug = Object.keys(templates)[0];
+
+  return redirect(`/${firstSlug}`);
+};

packages/email/preview/app/routes/api.render.tsx

@@ -0,0 +1,61 @@
+import { resolveEmailBrandingColors } from '@documenso/lib/utils/email-branding-colors';
+import { renderEmailWithI18N } from '@documenso/lib/utils/render-email-with-i18n';
+
+import { getTemplate } from '../lib/templates';
+import type { Route } from './+types/api.render';
+
+type RenderRequestBody = {
+  slug: string;
+  props: Record<string, unknown>;
+  lang?: string;
+  colors?: Record<string, string> | null;
+  assetBaseUrl: string;
+};
+
+/**
+ * POST /api/render — render an email template to HTML via the REAL production
+ * pipeline (`renderEmailWithI18N`), so i18n and brand-colour injection match a
+ * live send. Returns `text/html` for the client to drop into an iframe srcDoc.
+ */
+export const action = async ({ request }: Route.ActionArgs) => {
+  const body = (await request.json()) as RenderRequestBody;
+
+  const template = getTemplate(body.slug);
+
+  if (!template) {
+    return new Response(JSON.stringify({ error: `Unknown template: ${body.slug}` }), {
+      status: 404,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+
+  // Resolve brand colours through the same resolver production uses, so the
+  // preview applies the same per-token fallbacks as a live send.
+  const brandingColors =
+    body.colors && Object.keys(body.colors).length > 0 ? resolveEmailBrandingColors(body.colors) : null;
+
+  const Component = template.component;
+  const element = <Component {...body.props} assetBaseUrl={body.assetBaseUrl} />;
+
+  const html = await renderEmailWithI18N(element, {
+    lang: body.lang ?? 'en',
+    branding: brandingColors
+      ? {
+          brandingEnabled: true,
+          brandingUrl: '',
+          brandingLogo: '',
+          brandingCompanyDetails: '',
+          brandingHidePoweredBy: false,
+          brandingColors,
+        }
+      : undefined,
+  });
+
+  return new Response(html, {
+    status: 200,
+    headers: {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Cache-Control': 'no-store',
+    },
+  });
+};

packages/email/preview/postcss.config.cjs

@@ -0,0 +1,6 @@
+module.exports = {
+  plugins: {
+    tailwindcss: { config: './tailwind.config.cjs' },
+    autoprefixer: {},
+  },
+};

packages/email/preview/react-router.config.ts

@@ -0,0 +1,6 @@
+import type { Config } from '@react-router/dev/config';
+
+export default {
+  appDirectory: 'app',
+  ssr: true,
+} satisfies Config;

packages/email/preview/tailwind.config.cjs

@@ -0,0 +1,24 @@
+const path = require('node:path');
+
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: [path.join(__dirname, 'app/**/*.{ts,tsx}')],
+  theme: {
+    extend: {
+      fontFamily: {
+        sans: [
+          'Inter',
+          'ui-sans-serif',
+          'system-ui',
+          '-apple-system',
+          'Segoe UI',
+          'Roboto',
+          'Helvetica Neue',
+          'Arial',
+          'sans-serif',
+        ],
+      },
+    },
+  },
+  plugins: [],
+};

packages/email/preview/tsconfig.json

@@ -0,0 +1,30 @@
+{
+  "include": ["**/*", ".react-router/types/**/*"],
+  "compilerOptions": {
+    "lib": ["DOM", "DOM.Iterable", "ES2022"],
+    "types": ["node", "vite/client"],
+    "target": "ES2022",
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "rootDirs": [".", "./.react-router/types"],
+    "baseUrl": ".",
+    "paths": {
+      "@documenso/email/*": ["../*"],
+      "@documenso/lib": ["../../lib"],
+      "@documenso/lib/*": ["../../lib/*"],
+      "@documenso/prisma": ["../../prisma"],
+      "@documenso/tailwind-config": ["../../tailwind-config"],
+      "@documenso/ui": ["../../ui"]
+    },
+    "esModuleInterop": true,
+    "verbatimModuleSyntax": true,
+    "noEmit": true,
+    "moduleDetection": "force",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "useUnknownInCatchVariables": false
+  }
+}

packages/email/preview/vite.config.ts

@@ -0,0 +1,72 @@
+import path from 'node:path';
+import { lingui } from '@lingui/vite-plugin';
+import { reactRouter } from '@react-router/dev/vite';
+import autoprefixer from 'autoprefixer';
+import tailwindcss from 'tailwindcss';
+import { defineConfig } from 'vite';
+import macrosPlugin from 'vite-plugin-babel-macros';
+import { viteStaticCopy } from 'vite-plugin-static-copy';
+import tsconfigPaths from 'vite-tsconfig-paths';
+
+/**
+ * Standalone Vite app for previewing Documenso emails.
+ *
+ * Emails render server-side through the real `renderEmailWithI18N` pipeline
+ * (see `app/routes/preview.tsx`), so the SSR config mirrors the main Remix app:
+ * Prisma, the tailwind config, and native modules stay external.
+ */
+export default defineConfig({
+  root: __dirname,
+  css: {
+    postcss: {
+      plugins: [tailwindcss(path.join(__dirname, 'tailwind.config.cjs')), autoprefixer],
+    },
+  },
+  server: {
+    port: parseInt(process.env.PORT || '3002', 10),
+    strictPort: true,
+  },
+  plugins: [
+    // Serve the email static assets (logo, icons) under `/static` so templates'
+    // `assetBaseUrl="/static"` resolves to the same images production uses.
+    viteStaticCopy({
+      targets: [
+        {
+          src: path.join(__dirname, '../static') + '/*',
+          dest: 'static',
+        },
+      ],
+    }),
+    reactRouter(),
+    macrosPlugin(),
+    lingui(),
+    tsconfigPaths(),
+  ],
+  ssr: {
+    noExternal: ['@documenso/email'],
+    external: [
+      '@napi-rs/canvas',
+      '@node-rs/bcrypt',
+      '@prisma/client',
+      '@documenso/tailwind-config',
+      'playwright',
+      'playwright-core',
+      '@playwright/browser-chromium',
+      'pdfjs-dist',
+      '@google-cloud/kms',
+      '@google-cloud/secret-manager',
+    ],
+  },
+  optimizeDeps: {
+    exclude: [
+      '@napi-rs/canvas',
+      '@node-rs/bcrypt',
+      'sharp',
+      'playwright',
+      'playwright-core',
+      '@playwright/browser-chromium',
+      'lightningcss',
+      'fsevents',
+    ],
+  },
+});

packages/email/providers/branding.tsx

@@ -1,3 +1,4 @@
+import type { EmailBrandingColors } from '@documenso/lib/utils/email-branding-colors';
 import { createContext, useContext } from 'react';
 
 type BrandingContextValue = {
@@ -6,6 +7,7 @@ type BrandingContextValue = {
   brandingLogo: string;
   brandingCompanyDetails: string;
   brandingHidePoweredBy: boolean;
+  brandingColors?: EmailBrandingColors;
 };
 
 const BrandingContext = createContext<BrandingContextValue | undefined>(undefined);

packages/email/render.tsx

@@ -1,4 +1,6 @@
-import config from '@documenso/tailwind-config';
+import { DEFAULT_BRAND_COLORS } from '@documenso/lib/constants/theme';
+import type { EmailBrandingColors } from '@documenso/lib/utils/email-branding-colors';
+import { resolveEmailBrandingColors } from '@documenso/lib/utils/email-branding-colors';
 import type { I18n } from '@lingui/core';
 import { I18nProvider } from '@lingui/react';
 import * as ReactEmail from '@react-email/render';
@@ -11,19 +13,62 @@ export type RenderOptions = ReactEmail.Options & {
   i18n?: I18n;
 };
 
-// eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-const colors = (config.theme?.extend?.colors || {}) as Record<string, string>;
+/**
+ * The default email token set: the shadcn theme tokens, sourced as hex from
+ * `DEFAULT_BRAND_COLORS` (which mirrors `theme.css`). Emails can't use CSS
+ * variables, so these are concrete hex values baked into the Tailwind config.
+ *
+ * Resolved through the same `resolveEmailBrandingColors` pipeline as tenant
+ * colours so the default values live in exactly one place (`DEFAULT_BRAND_COLORS`)
+ * and the default + tenant paths can't drift. Used when a tenant has no
+ * (entitled) brand colours.
+ */
+const DEFAULT_EMAIL_BRANDING_COLORS: EmailBrandingColors =
+  resolveEmailBrandingColors(DEFAULT_BRAND_COLORS) ?? DEFAULT_BRAND_COLORS;
+
+/**
+ * Map the resolved colour set to flat semantic Tailwind tokens. Templates use
+ * these directly (`bg-primary`, `text-muted-foreground`, `border-border`, …),
+ * mirroring the app's shadcn tokens, instead of bespoke `slate-*`/`documenso-*`
+ * scale classes.
+ *
+ * Always defined: falls back to `DEFAULT_EMAIL_BRANDING_COLORS` when no tenant
+ * colours are supplied, so the tokens resolve whether or not custom branding is
+ * in play.
+ */
+const buildEmailColors = (brandingColors?: EmailBrandingColors): Record<string, string> => {
+  const c = brandingColors ?? DEFAULT_EMAIL_BRANDING_COLORS;
+
+  return {
+    background: c.background,
+    foreground: c.foreground,
+    muted: c.muted,
+    'muted-foreground': c.mutedForeground,
+    primary: c.primary,
+    'primary-foreground': c.primaryForeground,
+    secondary: c.secondary,
+    'secondary-foreground': c.secondaryForeground,
+    accent: c.accent,
+    'accent-foreground': c.accentForeground,
+    destructive: c.destructive,
+    'destructive-foreground': c.destructiveForeground,
+    warning: c.warning,
+    border: c.border,
+  };
+};
 
 export const render = async (element: React.ReactNode, options?: RenderOptions) => {
   const { branding, ...otherOptions } = options ?? {};
 
+  const tailwindColors = buildEmailColors(branding?.brandingColors);
+
   return ReactEmail.render(
     <BrandingProvider branding={branding}>
       <Tailwind
         config={{
           theme: {
             extend: {
-              colors,
+              colors: tailwindColors,
             },
           },
         }}
@@ -42,6 +87,8 @@ export const renderWithI18N = async (element: React.ReactNode, options?: RenderO
     throw new Error('i18n is required');
   }
 
+  const tailwindColors = buildEmailColors(branding?.brandingColors);
+
   return ReactEmail.render(
     <I18nProvider i18n={i18n}>
       <BrandingProvider branding={branding}>
@@ -49,7 +96,7 @@ export const renderWithI18N = async (element: React.ReactNode, options?: RenderO
           config={{
             theme: {
               extend: {
-                colors,
+                colors: tailwindColors,
               },
             },
           }}

packages/email/template-components/template-access-auth-2fa.tsx

@@ -27,24 +27,24 @@ export const TemplateAccessAuth2FA = ({
       <Img src={getAssetUrl('/static/document.png')} alt="Document" className="mx-auto h-12 w-12" />
 
       <Section className="mt-8">
-        <Heading className="text-center font-semibold text-lg text-slate-900">
+        <Heading className="text-center font-semibold text-foreground text-lg">
           <Trans>Verification Code Required</Trans>
         </Heading>
 
-        <Text className="mt-2 text-center text-slate-700">
+        <Text className="mt-2 text-center text-foreground">
           <Trans>
             Hi {userName}, you need to enter a verification code to complete the document "{documentTitle}".
           </Trans>
         </Text>
 
-        <Section className="mt-6 rounded-lg bg-slate-50 p-6 text-center">
-          <Text className="mb-2 font-medium text-slate-600 text-sm">
+        <Section className="mt-6 rounded-lg bg-muted p-6 text-center">
+          <Text className="mb-2 font-medium text-muted-foreground text-sm">
             <Trans>Your verification code:</Trans>
           </Text>
-          <Text className="font-bold text-2xl text-slate-900 tracking-wider">{code}</Text>
+          <Text className="font-bold text-2xl text-foreground tracking-wider">{code}</Text>
         </Section>
 
-        <Text className="mt-4 text-center text-slate-600 text-sm">
+        <Text className="mt-4 text-center text-muted-foreground text-sm">
           <Plural
             value={expiresInMinutes}
             one="This code will expire in # minute."
@@ -52,7 +52,7 @@ export const TemplateAccessAuth2FA = ({
           />
         </Text>
 
-        <Text className="mt-4 text-center text-slate-500 text-sm">
+        <Text className="mt-4 text-center text-muted-foreground text-sm">
           <Trans>If you didn't request this verification code, you can safely ignore this email.</Trans>
         </Text>
       </Section>

packages/email/template-components/template-admin-user-created.tsx

@@ -14,26 +14,26 @@ export const TemplateAdminUserCreated = ({ resetPasswordLink, assetBaseUrl }: Te
       <TemplateDocumentImage className="mt-6" assetBaseUrl={assetBaseUrl} />
 
       <Section className="flex-row items-center justify-center">
-        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-lg text-primary">
+        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-foreground text-lg">
           <Trans>Welcome to Documenso!</Trans>
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           <Trans>An administrator has created a Documenso account for you.</Trans>
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           <Trans>To get started, please set your password by clicking the button below:</Trans>
         </Text>
 
         <Section className="mt-8 mb-6 text-center">
           <Button
-            className="inline-flex items-center justify-center rounded-lg bg-documenso-500 px-6 py-3 text-center font-medium text-black text-sm no-underline"
+            className="inline-flex items-center justify-center rounded-lg bg-primary px-6 py-3 text-center font-medium text-primary-foreground text-sm no-underline"
             href={resetPasswordLink}
           >
             <Trans>Set Password</Trans>
           </Button>
-          <Text className="mt-8 text-center text-slate-400 text-sm italic">
+          <Text className="mt-8 text-center text-muted-foreground text-sm italic">
             <Trans>
               You can also copy and paste this link into your browser: {resetPasswordLink} (link expires in 24 hours)
             </Trans>
@@ -41,10 +41,10 @@ export const TemplateAdminUserCreated = ({ resetPasswordLink, assetBaseUrl }: Te
         </Section>
 
         <Section className="mt-8">
-          <Text className="text-center text-slate-400 text-sm">
+          <Text className="text-center text-muted-foreground text-sm">
             <Trans>
               If you didn't expect this account or have any questions, please{' '}
-              <Link href="mailto:support@documenso.com" className="text-documenso-500">
+              <Link href="mailto:support@documenso.com" className="text-primary">
                 contact support
               </Link>
               .

packages/email/template-components/template-confirmation-email.tsx

@@ -14,22 +14,22 @@ export const TemplateConfirmationEmail = ({ confirmationLink, assetBaseUrl }: Te
       <TemplateDocumentImage className="mt-6" assetBaseUrl={assetBaseUrl} />
 
       <Section className="flex-row items-center justify-center">
-        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-lg text-primary">
+        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-foreground text-lg">
           <Trans>Welcome to Documenso!</Trans>
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           <Trans>Before you get started, please confirm your email address by clicking the button below:</Trans>
         </Text>
 
         <Section className="mt-8 mb-6 text-center">
           <Button
-            className="inline-flex items-center justify-center rounded-lg bg-documenso-500 px-6 py-3 text-center font-medium text-black text-sm no-underline"
+            className="inline-flex items-center justify-center rounded-lg bg-primary px-6 py-3 text-center font-medium text-primary-foreground text-sm no-underline"
             href={confirmationLink}
           >
             <Trans>Confirm email</Trans>
           </Button>
-          <Text className="mt-8 text-center text-slate-400 text-sm italic">
+          <Text className="mt-8 text-center text-muted-foreground text-sm italic">
             <Trans>
               You can also copy and paste this link into your browser: {confirmationLink} (link expires in 1 hour)
             </Trans>

packages/email/template-components/template-custom-message-body.tsx

@@ -18,7 +18,7 @@ export const TemplateCustomMessageBody = ({ text }: TemplateCustomMessageBodyPro
   const paragraphs = normalized.split('\n\n');
 
   return paragraphs.map((paragraph, i) => (
-    <p key={`p-${i}`} className="whitespace-pre-line break-words font-sans text-base text-slate-400">
+    <p key={`p-${i}`} className="whitespace-pre-line break-words font-sans text-base text-muted-foreground">
       {paragraph.split('\n').map((line, j) => (
         <React.Fragment key={`line-${i}-${j}`}>
           {j > 0 && <br />}

packages/email/template-components/template-document-cancel.tsx

@@ -22,18 +22,18 @@ export const TemplateDocumentCancel = ({
       <TemplateDocumentImage className="mt-6" assetBaseUrl={assetBaseUrl} />
 
       <Section>
-        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-lg text-primary">
+        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-foreground text-lg">
           <Trans>
             {inviterName} has cancelled the document
             <br />"{documentName}"
           </Trans>
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           <Trans>All signatures have been voided.</Trans>
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           <Trans>You don't need to sign it anymore.</Trans>
         </Text>
 

packages/email/template-components/template-document-completed.tsx

@@ -27,24 +27,24 @@ export const TemplateDocumentCompleted = ({
       <Section>
         <Section className="mb-4">
           <Column align="center">
-            <Text className="font-semibold text-[#7AC455] text-base">
+            <Text className="font-semibold text-base text-foreground">
               <Img src={getAssetUrl('/static/completed.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Completed</Trans>
             </Text>
           </Column>
         </Section>
 
-        <Text className="mb-0 text-center font-semibold text-lg text-primary">
+        <Text className="mb-0 text-center font-semibold text-foreground text-lg">
           {customBody || <Trans>“{documentName}” was signed by all signers</Trans>}
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           <Trans>Continue by downloading the document.</Trans>
         </Text>
 
         <Section className="mt-8 mb-6 text-center">
           <Button
-            className="rounded-lg border border-slate-200 border-solid px-4 py-2 text-center font-medium text-black text-sm no-underline"
+            className="rounded-lg border border-border border-solid px-4 py-2 text-center font-medium text-foreground text-sm no-underline"
             href={downloadLink}
           >
             <Img src={getAssetUrl('/static/download.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" />

packages/email/template-components/template-document-invite.tsx

@@ -40,7 +40,7 @@ export const TemplateDocumentInvite = ({
       <TemplateDocumentImage className="mt-6" assetBaseUrl={assetBaseUrl} />
 
       <Section>
-        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-lg text-primary">
+        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-foreground text-lg">
           {match({ selfSigner, organisationType, includeSenderDetails, teamName })
             .with({ selfSigner: true }, () => (
               <Trans>
@@ -75,7 +75,7 @@ export const TemplateDocumentInvite = ({
             ))}
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           {match(role)
             .with(RecipientRole.SIGNER, () => <Trans>Continue by signing the document.</Trans>)
             .with(RecipientRole.VIEWER, () => <Trans>Continue by viewing the document.</Trans>)
@@ -87,7 +87,7 @@ export const TemplateDocumentInvite = ({
 
         <Section className="mt-8 mb-6 text-center">
           <Button
-            className="inline-flex items-center justify-center rounded-lg bg-documenso-500 px-6 py-3 text-center font-medium text-black text-sbase no-underline"
+            className="inline-flex items-center justify-center rounded-lg bg-primary px-6 py-3 text-center font-medium text-primary-foreground text-sbase no-underline"
             href={signDocumentLink}
           >
             {match(role)

packages/email/template-components/template-document-pending.tsx

@@ -20,18 +20,18 @@ export const TemplateDocumentPending = ({ documentName, assetBaseUrl }: Template
       <Section>
         <Section className="mb-4">
           <Column align="center">
-            <Text className="font-semibold text-base text-blue-500">
+            <Text className="font-semibold text-base text-foreground">
               <Img src={getAssetUrl('/static/clock.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Waiting for others</Trans>
             </Text>
           </Column>
         </Section>
 
-        <Text className="mb-0 text-center font-semibold text-lg text-primary">
+        <Text className="mb-0 text-center font-semibold text-foreground text-lg">
           <Trans>“{documentName}” has been signed</Trans>
         </Text>
 
-        <Text className="mx-auto mt-1 mb-6 max-w-[80%] text-center text-base text-slate-400">
+        <Text className="mx-auto mt-1 mb-6 max-w-[80%] text-center text-base text-muted-foreground">
           <Trans>
             We're still waiting for other signers to sign this document.
             <br />

packages/email/template-components/template-document-recipient-signed.tsx

@@ -29,20 +29,20 @@ export const TemplateDocumentRecipientSigned = ({
       <Section>
         <Section className="mb-4">
           <Column align="center">
-            <Text className="font-semibold text-[#7AC455] text-base">
+            <Text className="font-semibold text-base text-foreground">
               <Img src={getAssetUrl('/static/completed.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Completed</Trans>
             </Text>
           </Column>
         </Section>
 
-        <Text className="mb-0 text-center font-semibold text-lg text-primary">
+        <Text className="mb-0 text-center font-semibold text-foreground text-lg">
           <Trans>
             {recipientReference} has signed "{documentName}"
           </Trans>
         </Text>
 
-        <Text className="mx-auto mt-1 mb-6 max-w-[80%] text-center text-base text-slate-400">
+        <Text className="mx-auto mt-1 mb-6 max-w-[80%] text-center text-base text-muted-foreground">
           <Trans>{recipientReference} has completed signing the document.</Trans>
         </Text>
       </Section>

packages/email/template-components/template-document-rejected.tsx

@@ -17,7 +17,7 @@ export function TemplateDocumentRejected({
 }: TemplateDocumentRejectedProps) {
   return (
     <div className="mt-4">
-      <Heading className="mb-4 text-center font-semibold text-2xl text-slate-800">
+      <Heading className="mb-4 text-center font-semibold text-2xl text-foreground">
         <Trans>Document Rejected</Trans>
       </Heading>
 
@@ -28,7 +28,7 @@ export function TemplateDocumentRejected({
       </Text>
 
       {rejectionReason && (
-        <Text className="mb-4 text-base text-slate-400">
+        <Text className="mb-4 text-base text-muted-foreground">
           <Trans>Reason for rejection: {rejectionReason}</Trans>
         </Text>
       )}
@@ -39,7 +39,7 @@ export function TemplateDocumentRejected({
 
       <Button
         href={documentUrl}
-        className="inline-flex items-center justify-center rounded-lg bg-documenso-500 px-6 py-3 text-center font-medium text-black text-sm no-underline"
+        className="inline-flex items-center justify-center rounded-lg bg-primary px-6 py-3 text-center font-medium text-primary-foreground text-sm no-underline"
       >
         <Trans>View Document</Trans>
       </Button>

packages/email/template-components/template-document-rejection-confirmed.tsx

@@ -22,7 +22,7 @@ export function TemplateDocumentRejectionConfirmed({
           <Trans>Rejection Confirmed</Trans>
         </Heading>
 
-        <Text className="text-base text-primary">
+        <Text className="text-base text-foreground">
           <Trans>
             This email confirms that you have rejected the document{' '}
             <strong className="font-bold">"{documentName}"</strong> sent by {documentOwnerName}.
@@ -30,7 +30,7 @@ export function TemplateDocumentRejectionConfirmed({
         </Text>
 
         {reason && (
-          <Text className="font-medium text-base text-slate-400">
+          <Text className="font-medium text-base text-muted-foreground">
             <Trans>Rejection reason: {reason}</Trans>
           </Text>
         )}

packages/email/template-components/template-document-reminder.tsx

@@ -31,18 +31,18 @@ export const TemplateDocumentReminder = ({
       <TemplateDocumentImage className="mt-6" assetBaseUrl={assetBaseUrl} />
 
       <Section>
-        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-lg text-primary">
+        <Text className="mx-auto mb-0 max-w-[80%] text-center font-semibold text-foreground text-lg">
           <Trans>
             Reminder: Please {_(actionVerb).toLowerCase()} your document
             <br />"{documentName}"
           </Trans>
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           <Trans>Hi {recipientName},</Trans>
         </Text>
 
-        <Text className="my-1 text-center text-base text-slate-400">
+        <Text className="my-1 text-center text-base text-muted-foreground">
           {match(role)
             .with(RecipientRole.SIGNER, () => <Trans>Continue by signing the document.</Trans>)
             .with(RecipientRole.VIEWER, () => <Trans>Continue by viewing the document.</Trans>)
@@ -54,7 +54,7 @@ export const TemplateDocumentReminder = ({
 
         <Section className="mt-8 mb-6 text-center">
           <Button
-            className="inline-flex items-center justify-center rounded-lg bg-documenso-500 px-6 py-3 text-center font-medium text-black text-sm no-underline"
+            className="inline-flex items-center justify-center rounded-lg bg-primary px-6 py-3 text-center font-medium text-primary-foreground text-sm no-underline"
             href={signDocumentLink}
           >
             {match(role)

packages/email/template-components/template-document-self-signed.tsx

@@ -25,25 +25,21 @@ export const TemplateDocumentSelfSigned = ({ documentName, assetBaseUrl }: Templ
       <Section className="flex-row items-center justify-center">
         <Section>
           <Column align="center">
-            <Text className="font-semibold text-[#7AC455] text-base">
+            <Text className="font-semibold text-base text-foreground">
               <Img src={getAssetUrl('/static/completed.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Completed</Trans>
             </Text>
           </Column>
         </Section>
 
-        <Text className="mt-6 mb-0 text-center font-semibold text-lg text-primary">
+        <Text className="mt-6 mb-0 text-center font-semibold text-foreground text-lg">
           <Trans>You have signed “{documentName}”</Trans>
         </Text>
 
-        <Text className="mx-auto mt-1 mb-6 max-w-[80%] text-center text-base text-slate-400">
+        <Text className="mx-auto mt-1 mb-6 max-w-[80%] text-center text-base text-muted-foreground">
           <Trans>
             Create a{' '}
-            <Link
-              href={signUpUrl}
-              target="_blank"
-              className="whitespace-nowrap text-documenso-700 hover:text-documenso-600"
-            >
+            <Link href={signUpUrl} target="_blank" className="whitespace-nowrap text-primary hover:text-primary">
               free account
             </Link>{' '}
             to access your signed documents at any time.
@@ -53,14 +49,14 @@ export const TemplateDocumentSelfSigned = ({ documentName, assetBaseUrl }: Templ
         <Section className="mt-8 mb-6 text-center">
           <Button
             href={signUpUrl}
-            className="mr-4 rounded-lg border border-slate-200 border-solid px-4 py-2 text-center font-medium text-black text-sm no-underline"
+            className="mr-4 rounded-lg border border-border border-solid px-4 py-2 text-center font-medium text-foreground text-sm no-underline"
           >
             <Img src={getAssetUrl('/static/user-plus.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" />
             <Trans>Create account</Trans>
           </Button>
 
           <Button
-            className="rounded-lg border border-slate-200 border-solid px-4 py-2 text-center font-medium text-black text-sm no-underline"
+            className="rounded-lg border border-border border-solid px-4 py-2 text-center font-medium text-foreground text-sm no-underline"
             href="https://documenso.com/pricing"
           >
             <Img src={getAssetUrl('/static/review.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" />

packages/email/template-components/template-document-super-delete.tsx

@@ -15,26 +15,26 @@ export const TemplateDocumentDelete = ({ reason, documentName, assetBaseUrl }: T
       <TemplateDocumentImage className="mt-6" assetBaseUrl={assetBaseUrl} />
 
       <Section>
-        <Text className="mt-6 mb-0 text-left font-semibold text-lg text-primary">
+        <Text className="mt-6 mb-0 text-left font-semibold text-foreground text-lg">
           <Trans>Your document has been deleted by an admin!</Trans>
         </Text>
 
-        <Text className="mx-auto mt-1 mb-6 text-left text-base text-slate-400">
+        <Text className="mx-auto mt-1 mb-6 text-left text-base text-muted-foreground">
           <Trans>"{documentName}" has been deleted by an admin.</Trans>
         </Text>
 
-        <Text className="mx-auto mt-1 mb-6 text-left text-base text-slate-400">
+        <Text className="mx-auto mt-1 mb-6 text-left text-base text-muted-foreground">
           <Trans>
             This document can not be recovered, if you would like to dispute the reason for future documents please
             contact support.
           </Trans>
         </Text>
 
-        <Text className="mx-auto mt-1 text-left text-base text-slate-400">
+        <Text className="mx-auto mt-1 text-left text-base text-muted-foreground">
           <Trans>The reason provided for deletion is the following:</Trans>
         </Text>
 
-        <Text className="mx-auto mt-1 mb-6 text-left text-base text-slate-400 italic">{reason}</Text>
+        <Text className="mx-auto mt-1 mb-6 text-left text-base text-muted-foreground italic">{reason}</Text>
       </Section>
     </>
   );

packages/email/template-components/template-footer.tsx

@@ -1,4 +1,5 @@
 import { Trans } from '@lingui/react/macro';
+import { Fragment } from 'react';
 
 import { Link, Section, Text } from '../components';
 import { useBranding } from '../providers/branding';
@@ -17,10 +18,10 @@ export const TemplateFooter = ({ isDocument = true, reportUrl }: TemplateFooterP
   return (
     <Section>
       {reportUrl && (
-        <Text className="my-4 text-base text-slate-400">
+        <Text className="my-4 text-base text-muted-foreground">
           <Trans>
             Did not expect this email?{' '}
-            <Link className="text-[#7AC455]" href={reportUrl}>
+            <Link className="text-primary" href={reportUrl}>
               Click here to report the sender
             </Link>
             . Never sign a document you don't recognize or weren't expecting.
@@ -29,10 +30,10 @@ export const TemplateFooter = ({ isDocument = true, reportUrl }: TemplateFooterP
       )}
 
       {isDocument && !branding.brandingHidePoweredBy && (
-        <Text className="my-4 text-base text-slate-400">
+        <Text className="my-4 text-base text-muted-foreground">
           <Trans>
             This document was sent using{' '}
-            <Link className="text-[#7AC455]" href="https://documen.so/mail-footer">
+            <Link className="text-primary" href="https://documen.so/mail-footer">
               Documenso
             </Link>
             .
@@ -41,20 +42,20 @@ export const TemplateFooter = ({ isDocument = true, reportUrl }: TemplateFooterP
       )}
 
       {branding.brandingEnabled && branding.brandingCompanyDetails && (
-        <Text className="my-8 text-slate-400 text-sm">
+        <Text className="my-8 text-muted-foreground text-sm">
           {branding.brandingCompanyDetails.split('\n').map((line, idx) => {
             return (
-              <>
+              <Fragment key={idx}>
                 {idx > 0 && <br />}
                 {line}
-              </>
+              </Fragment>
             );
           })}
         </Text>
       )}
 
       {branding.brandingEnabled && safeBrandingUrl && (
-        <Text className="my-8 text-slate-400 text-sm">
+        <Text className="my-8 text-muted-foreground text-sm">
           <Link href={safeBrandingUrl} target="_blank">
             {safeBrandingUrl}
           </Link>
@@ -62,7 +63,7 @@ export const TemplateFooter = ({ isDocument = true, reportUrl }: TemplateFooterP
       )}
 
       {!branding.brandingEnabled && (
-        <Text className="my-8 text-slate-400 text-sm">
+        <Text className="my-8 text-muted-foreground text-sm">
           Documenso, Inc.
           <br />
           2261 Market Street, #5211, San Francisco, CA 94114, USA