v2.9.1

.github/actions/node-install/action.yml

@@ -12,6 +12,10 @@ runs:
       with:
         node-version: ${{ inputs.node_version }}
 
+    - name: Enable corepack
+      shell: bash
+      run: corepack enable npm
+
     - name: Cache npm
       uses: actions/cache@v3
       with:

.gitignore

@@ -71,3 +71,6 @@ scripts/bench-*
 
 # tmp
 tmp/
+
+# opencode
+.opencode/package-lock.json

.npmrc

@@ -1,2 +1,3 @@
 legacy-peer-deps = true
-prefer-dedupe = true
+prefer-dedupe = true
+min-release-age = 7

apps/docs/package.json

@@ -16,7 +16,7 @@
     "fumadocs-ui": "16.5.0",
     "lucide-react": "^0.563.0",
     "mermaid": "^11.12.2",
-    "next": "16.1.6",
+    "next": "16.2.4",
     "next-plausible": "^3.12.5",
     "next-themes": "^0.4.6",
     "react": "^19.2.4",

apps/openpage-api/package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@documenso/prisma": "*",
     "luxon": "^3.7.2",
-    "next": "15.5.12"
+    "next": "16.2.4"
   },
   "devDependencies": {
     "@types/node": "^20",

apps/openpage-api/tsconfig.json

@@ -11,7 +11,7 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "incremental": true,
     "plugins": [
       {
@@ -22,6 +22,12 @@
       "@/*": ["./*"]
     }
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
   "exclude": ["node_modules"]
 }

apps/remix/app/components/dialogs/admin-organisation-member-delete-dialog.tsx

@@ -0,0 +1,136 @@
+import { useState } from 'react';
+
+import { msg } from '@lingui/core/macro';
+import { useLingui } from '@lingui/react';
+import { Trans } from '@lingui/react/macro';
+import { useNavigate } from 'react-router';
+
+import { AppError } from '@documenso/lib/errors/app-error';
+import { trpc } from '@documenso/trpc/react';
+import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
+import { AvatarWithText } from '@documenso/ui/primitives/avatar';
+import { Button } from '@documenso/ui/primitives/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@documenso/ui/primitives/dialog';
+import { useToast } from '@documenso/ui/primitives/use-toast';
+
+export type AdminOrganisationMemberDeleteDialogProps = {
+  organisationId: string;
+  organisationName: string;
+  organisationMemberId: string;
+  organisationMemberName: string;
+  organisationMemberEmail: string;
+};
+
+export const AdminOrganisationMemberDeleteDialog = ({
+  organisationId,
+  organisationName,
+  organisationMemberId,
+  organisationMemberName,
+  organisationMemberEmail,
+}: AdminOrganisationMemberDeleteDialogProps) => {
+  const { _ } = useLingui();
+  const { toast } = useToast();
+  const navigate = useNavigate();
+
+  const [open, setOpen] = useState(false);
+
+  const { mutateAsync: deleteOrganisationMember, isPending } =
+    trpc.admin.organisationMember.delete.useMutation({
+      onSuccess: async () => {
+        toast({
+          title: _(msg`Success`),
+          description: _(msg`Member has been removed from the organisation.`),
+          duration: 5000,
+        });
+
+        setOpen(false);
+
+        // Refresh the page to show updated data
+        await navigate(0);
+      },
+      onError: (err) => {
+        const error = AppError.parseError(err);
+
+        console.error(error);
+
+        toast({
+          title: _(msg`An error occurred`),
+          description: _(msg`We couldn't remove this member. Please try again later.`),
+          variant: 'destructive',
+          duration: 10000,
+        });
+      },
+    });
+
+  return (
+    <Dialog open={open} onOpenChange={(value) => !isPending && setOpen(value)}>
+      <DialogTrigger asChild>
+        <Button variant="destructive">
+          <Trans>Remove</Trans>
+        </Button>
+      </DialogTrigger>
+
+      <DialogContent>
+        <DialogHeader className="space-y-4">
+          <DialogTitle>
+            <Trans>Remove Organisation Member</Trans>
+          </DialogTitle>
+
+          <Alert variant="destructive">
+            <AlertDescription className="selection:bg-red-100">
+              <Trans>This action is not reversible. Please be certain.</Trans>
+            </AlertDescription>
+          </Alert>
+        </DialogHeader>
+
+        <div>
+          <DialogDescription>
+            <Trans>
+              You are about to remove the following user from the organisation{' '}
+              <span className="font-semibold">{organisationName}</span>:
+            </Trans>
+          </DialogDescription>
+
+          <Alert className="mt-4" variant="neutral" padding="tight">
+            <AvatarWithText
+              avatarClass="h-12 w-12"
+              avatarFallback={organisationMemberName.slice(0, 1).toUpperCase()}
+              primaryText={<span className="font-semibold">{organisationMemberName}</span>}
+              secondaryText={organisationMemberEmail}
+            />
+          </Alert>
+        </div>
+
+        <fieldset disabled={isPending}>
+          <DialogFooter>
+            <Button type="button" variant="secondary" onClick={() => setOpen(false)}>
+              <Trans>Cancel</Trans>
+            </Button>
+
+            <Button
+              type="submit"
+              variant="destructive"
+              loading={isPending}
+              onClick={async () =>
+                deleteOrganisationMember({
+                  organisationId,
+                  organisationMemberId,
+                })
+              }
+            >
+              <Trans>Remove member</Trans>
+            </Button>
+          </DialogFooter>
+        </fieldset>
+      </DialogContent>
+    </Dialog>
+  );
+};

apps/remix/app/components/dialogs/admin-team-member-delete-dialog.tsx

@@ -0,0 +1,130 @@
+import { useState } from 'react';
+
+import { msg } from '@lingui/core/macro';
+import { useLingui } from '@lingui/react';
+import { Trans } from '@lingui/react/macro';
+import { useNavigate } from 'react-router';
+
+import { AppError } from '@documenso/lib/errors/app-error';
+import { trpc } from '@documenso/trpc/react';
+import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
+import { AvatarWithText } from '@documenso/ui/primitives/avatar';
+import { Button } from '@documenso/ui/primitives/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@documenso/ui/primitives/dialog';
+import { useToast } from '@documenso/ui/primitives/use-toast';
+
+export type AdminTeamMemberDeleteDialogProps = {
+  teamId: number;
+  teamName: string;
+  memberId: string;
+  memberName: string;
+  memberEmail: string;
+};
+
+export const AdminTeamMemberDeleteDialog = ({
+  teamId,
+  teamName,
+  memberId,
+  memberName,
+  memberEmail,
+}: AdminTeamMemberDeleteDialogProps) => {
+  const { _ } = useLingui();
+  const { toast } = useToast();
+  const navigate = useNavigate();
+
+  const [open, setOpen] = useState(false);
+
+  const { mutateAsync: deleteTeamMember, isPending } = trpc.admin.teamMember.delete.useMutation({
+    onSuccess: async () => {
+      toast({
+        title: _(msg`Success`),
+        description: _(msg`Member has been removed from the team.`),
+        duration: 5000,
+      });
+
+      setOpen(false);
+
+      // Refresh the page to show updated data
+      await navigate(0);
+    },
+    onError: (err) => {
+      const error = AppError.parseError(err);
+
+      console.error(error);
+
+      toast({
+        title: _(msg`An error occurred`),
+        description: _(msg`We couldn't remove this member. Please try again later.`),
+        variant: 'destructive',
+        duration: 10000,
+      });
+    },
+  });
+
+  return (
+    <Dialog open={open} onOpenChange={(value) => !isPending && setOpen(value)}>
+      <DialogTrigger asChild>
+        <Button variant="destructive">
+          <Trans>Remove</Trans>
+        </Button>
+      </DialogTrigger>
+
+      <DialogContent>
+        <DialogHeader className="space-y-4">
+          <DialogTitle>
+            <Trans>Remove Team Member</Trans>
+          </DialogTitle>
+
+          <Alert variant="destructive">
+            <AlertDescription className="selection:bg-red-100">
+              <Trans>This action is not reversible. Please be certain.</Trans>
+            </AlertDescription>
+          </Alert>
+        </DialogHeader>
+
+        <div>
+          <DialogDescription>
+            <Trans>
+              You are about to remove the following user from the team{' '}
+              <span className="font-semibold">{teamName}</span>:
+            </Trans>
+          </DialogDescription>
+
+          <Alert className="mt-4" variant="neutral" padding="tight">
+            <AvatarWithText
+              avatarClass="h-12 w-12"
+              avatarFallback={memberName.slice(0, 1).toUpperCase()}
+              primaryText={<span className="font-semibold">{memberName}</span>}
+              secondaryText={memberEmail}
+            />
+          </Alert>
+        </div>
+
+        <fieldset disabled={isPending}>
+          <DialogFooter>
+            <Button type="button" variant="secondary" onClick={() => setOpen(false)}>
+              <Trans>Cancel</Trans>
+            </Button>
+
+            <Button
+              type="submit"
+              variant="destructive"
+              loading={isPending}
+              onClick={async () => deleteTeamMember({ teamId, memberId })}
+            >
+              <Trans>Remove member</Trans>
+            </Button>
+          </DialogFooter>
+        </fieldset>
+      </DialogContent>
+    </Dialog>
+  );
+};

apps/remix/app/components/dialogs/template-use-dialog.tsx

@@ -8,6 +8,7 @@ import { DocumentDistributionMethod, DocumentSigningOrder } from '@prisma/client
 import { FileTextIcon, InfoIcon, Plus, UploadCloudIcon, X } from 'lucide-react';
 import { useFieldArray, useForm } from 'react-hook-form';
 import { useNavigate } from 'react-router';
+import { match } from 'ts-pattern';
 import * as z from 'zod';
 
 import { APP_DOCUMENT_UPLOAD_SIZE_LIMIT } from '@documenso/lib/constants/app';
@@ -19,7 +20,7 @@ import {
   DO_NOT_INVALIDATE_QUERY_ON_MUTATION,
   SKIP_QUERY_BATCH_META,
 } from '@documenso/lib/constants/trpc';
-import { AppError } from '@documenso/lib/errors/app-error';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { type TRecipientLite, ZRecipientEmailSchema } from '@documenso/lib/types/recipient';
 import { putPdfFile } from '@documenso/lib/universal/upload/put-file';
 import { trpc } from '@documenso/trpc/react';
@@ -47,7 +48,6 @@ import {
 import { Input } from '@documenso/ui/primitives/input';
 import { SpinnerBox } from '@documenso/ui/primitives/spinner';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@documenso/ui/primitives/tooltip';
-import type { Toast } from '@documenso/ui/primitives/use-toast';
 import { useToast } from '@documenso/ui/primitives/use-toast';
 
 const ZAddRecipientsForNewDocumentSchema = z.object({
@@ -201,19 +201,32 @@ export function TemplateUseDialog({
     } catch (err) {
       const error = AppError.parseError(err);
 
-      const toastPayload: Toast = {
+      const errorMessage = match(error.code)
+        .with(
+          'DOCUMENT_SEND_FAILED',
+          () => msg`The document was created but could not be sent to recipients.`,
+        )
+        .with(
+          AppErrorCode.INVALID_BODY,
+          AppErrorCode.INVALID_REQUEST,
+          () =>
+            msg`The document could not be created because of missing or invalid information. Please review the template's recipients and fields.`,
+        )
+        .with(
+          AppErrorCode.NOT_FOUND,
+          () => msg`The template or one of its recipients could not be found.`,
+        )
+        .with(
+          AppErrorCode.LIMIT_EXCEEDED,
+          () => msg`You have reached your document limit for this plan.`,
+        )
+        .otherwise(() => msg`An error occurred while creating document from template.`);
+
+      toast({
         title: _(msg`Error`),
-        description: _(msg`An error occurred while creating document from template.`),
+        description: _(errorMessage),
         variant: 'destructive',
-      };
-
-      if (error.code === 'DOCUMENT_SEND_FAILED') {
-        toastPayload.description = _(
-          msg`The document was created but could not be sent to recipients.`,
-        );
-      }
-
-      toast(toastPayload);
+      });
     }
   };
 

apps/remix/app/components/forms/signin.tsx

@@ -400,7 +400,8 @@ export const SignInForm = ({
               onSuccess={setCaptchaToken}
               onExpire={() => setCaptchaToken(null)}
               options={{
-                size: 'invisible',
+                size: 'flexible',
+                appearance: 'interaction-only',
               }}
             />
           )}

apps/remix/app/routes/_authenticated+/admin+/organisations.$id.tsx

@@ -44,6 +44,7 @@ import { Input } from '@documenso/ui/primitives/input';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@documenso/ui/primitives/tooltip';
 import { useToast } from '@documenso/ui/primitives/use-toast';
 
+import { AdminOrganisationMemberDeleteDialog } from '~/components/dialogs/admin-organisation-member-delete-dialog';
 import { AdminOrganisationMemberUpdateDialog } from '~/components/dialogs/admin-organisation-member-update-dialog';
 import { DetailsCard, DetailsValue } from '~/components/general/admin-details';
 import { AdminGlobalSettingsSection } from '~/components/general/admin-global-settings-section';
@@ -135,6 +136,10 @@ export default function OrganisationGroupSettingsPage({
   }, [i18n, t]);
 
   const organisationMembersColumns = useMemo(() => {
+    if (!organisation) {
+      return [];
+    }
+
     return [
       {
         header: t`Member`,
@@ -164,10 +169,6 @@ export default function OrganisationGroupSettingsPage({
       {
         header: t`Role`,
         cell: ({ row }) => {
-          if (!organisation) {
-            return null;
-          }
-
           const isOwner = row.original.userId === organisation.ownerUserId;
 
           if (isOwner) {
@@ -201,7 +202,9 @@ export default function OrganisationGroupSettingsPage({
       {
         header: t`Actions`,
         cell: ({ row }) => {
-          const isOwner = row.original.userId === organisation?.ownerUserId;
+          const isOwner = row.original.userId === organisation.ownerUserId;
+
+          const memberName = row.original.user.name ?? row.original.user.email;
 
           return (
             <div className="flex justify-end space-x-2">
@@ -215,6 +218,16 @@ export default function OrganisationGroupSettingsPage({
                 organisationMember={row.original}
                 isOwner={isOwner}
               />
+
+              {!isOwner && (
+                <AdminOrganisationMemberDeleteDialog
+                  organisationId={organisationId}
+                  organisationName={organisation.name}
+                  organisationMemberId={row.original.id}
+                  organisationMemberName={memberName}
+                  organisationMemberEmail={row.original.user.email}
+                />
+              )}
             </div>
           );
         },

apps/remix/app/routes/_authenticated+/admin+/teams.$id.tsx

@@ -22,6 +22,7 @@ import { DataTable, type DataTableColumnDef } from '@documenso/ui/primitives/dat
 import { SpinnerBox } from '@documenso/ui/primitives/spinner';
 import { useToast } from '@documenso/ui/primitives/use-toast';
 
+import { AdminTeamMemberDeleteDialog } from '~/components/dialogs/admin-team-member-delete-dialog';
 import { DetailsCard, DetailsValue } from '~/components/general/admin-details';
 import { AdminGlobalSettingsSection } from '~/components/general/admin-global-settings-section';
 import { GenericErrorLayout } from '~/components/general/generic-error-layout';
@@ -53,6 +54,10 @@ export default function AdminTeamPage({ params }: Route.ComponentProps) {
   };
 
   const teamMembersColumns = useMemo(() => {
+    if (!team) {
+      return [];
+    }
+
     return [
       {
         header: _(msg`Member`),
@@ -87,7 +92,7 @@ export default function AdminTeamPage({ params }: Route.ComponentProps) {
         header: _(msg`Organisation role`),
         accessorKey: 'organisationRole',
         cell: ({ row }) => {
-          const isOwner = row.original.userId === team?.organisation.ownerUserId;
+          const isOwner = row.original.userId === team.organisation.ownerUserId;
 
           if (isOwner) {
             return <Badge>{_(msg`Owner`)}</Badge>;
@@ -105,6 +110,30 @@ export default function AdminTeamPage({ params }: Route.ComponentProps) {
         accessorKey: 'createdAt',
         cell: ({ row }) => i18n.date(row.original.createdAt),
       },
+      {
+        header: _(msg`Actions`),
+        cell: ({ row }) => {
+          const isOwner = row.original.userId === team.organisation.ownerUserId;
+
+          if (isOwner) {
+            return null;
+          }
+
+          const memberName = row.original.user.name ?? row.original.user.email;
+
+          return (
+            <div className="flex justify-end">
+              <AdminTeamMemberDeleteDialog
+                teamId={team.id}
+                teamName={team.name}
+                memberId={row.original.id}
+                memberName={memberName}
+                memberEmail={row.original.user.email}
+              />
+            </div>
+          );
+        },
+      },
     ] satisfies DataTableColumnDef<TGetAdminTeamResponse['teamMembers'][number]>[];
   }, [team, _, i18n]);
 

apps/remix/package.json

@@ -45,7 +45,7 @@
     "colord": "^2.9.3",
     "content-disposition": "^1.0.1",
     "framer-motion": "^12.23.24",
-    "hono": "^4.12.5",
+    "hono": "^4.12.14",
     "hono-react-router-adapter": "^0.6.5",
     "input-otp": "^1.4.2",
     "isbot": "^5.1.32",
@@ -106,5 +106,5 @@
     "vite-plugin-babel-macros": "^1.0.6",
     "vite-tsconfig-paths": "^5.1.4"
   },
-  "version": "2.9.0"
+  "version": "2.9.1"
 }

package.json

@@ -5,7 +5,7 @@
     "apps/*",
     "packages/*"
   ],
-  "version": "2.9.0",
+  "version": "2.9.1",
   "scripts": {
     "postinstall": "patch-package",
     "build": "turbo run build",
@@ -41,9 +41,9 @@
     "translate:extract": "lingui extract --clean",
     "translate:compile": "lingui compile"
   },
-  "packageManager": "npm@10.7.0",
+  "packageManager": "npm@11.11.0",
   "engines": {
-    "npm": ">=10.7.0",
+    "npm": ">=11.11.0",
     "node": ">=22.0.0"
   },
   "devDependencies": {
@@ -62,10 +62,11 @@
     "dotenv-cli": "^11.0.0",
     "eslint": "^8.57.0",
     "husky": "^9.1.7",
-    "inngest-cli": "^1.16.1",
+    "inngest": "^3.54.0",
+    "inngest-cli": "^1.17.9",
     "lint-staged": "^16.2.7",
     "nanoid": "^5.1.6",
-    "nodemailer": "^7.0.10",
+    "nodemailer": "^8.0.5",
     "pdfjs-dist": "5.4.296",
     "pino": "^9.14.0",
     "pino-pretty": "^13.1.2",
@@ -102,7 +103,7 @@
     "zod": "^3.25.76"
   },
   "overrides": {
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "pdfjs-dist": "5.4.296",
     "typescript": "5.6.2",
     "zod": "$zod",

packages/auth/package.json

@@ -17,7 +17,7 @@
     "@oslojs/encoding": "^1.1.0",
     "@simplewebauthn/server": "^13.2.2",
     "arctic": "^3.7.0",
-    "hono": "^4.12.5",
+    "hono": "^4.12.14",
     "luxon": "^3.7.2",
     "nanoid": "^5.1.6",
     "ts-pattern": "^5.9.0",

packages/ee/server-only/stripe/update-subscription-item-quantity.ts

@@ -50,55 +50,88 @@ export const updateSubscriptionItemQuantity = async ({
 };
 
 /**
- * Checks whether the member count should be synced with a given Stripe subscription.
+ * Asserts that a proposed member count does not exceed the organisation's cap.
  *
- * If the subscription is not "seat" based, it will be ignored.
+ * Only enforced for non-seats-based plans, since seats-based plans meter usage
+ * via Stripe rather than enforcing a hard cap. A `memberCount` of `0` on the
+ * organisation claim represents unlimited seats.
  *
- * @param subscription - The subscription to sync the member count with.
- * @param organisationClaim - The organisation claim
- * @param quantity - The amount to sync the Stripe item with
- * @returns
+ * Should only be called from grow paths (invite/add). Reducing operations
+ * must never be gated by this check.
+ *
+ * @param subscription - The organisation's Stripe subscription.
+ * @param organisationClaim - The organisation claim.
+ * @param quantity - The proposed total member + pending invite count.
  */
-export const syncMemberCountWithStripeSeatPlan = async (
+export const assertMemberCountWithinCap = async (
   subscription: Subscription,
   organisationClaim: OrganisationClaim,
   quantity: number,
 ) => {
   const maximumMemberCount = organisationClaim.memberCount;
 
-  // Infinite seats means no sync needed.
+  // 0 = unlimited.
   if (maximumMemberCount === 0) {
     return;
   }
 
-  const syncMemberCountWithStripe = await isPriceSeatsBased(subscription.priceId);
+  // Seats-based plans don't have a hard cap; Stripe meters the usage.
+  const isSeatsBased = await isPriceSeatsBased(subscription.priceId);
 
-  // Throw error if quantity exceeds maximum member count and the subscription is not seats based.
-  if (quantity > maximumMemberCount && !syncMemberCountWithStripe) {
+  if (isSeatsBased) {
+    return;
+  }
+
+  if (quantity > maximumMemberCount) {
     throw new AppError(AppErrorCode.LIMIT_EXCEEDED, {
       message: 'Maximum member count reached',
     });
   }
-
-  // Bill the user with the new quantity.
-  if (syncMemberCountWithStripe) {
-    appLog('BILLING', 'Updating seat based plan');
-
-    await updateSubscriptionItemQuantity({
-      priceId: subscription.priceId,
-      subscriptionId: subscription.planId,
-      quantity,
-    });
-
-    // This should be automatically updated after the Stripe webhook is fired
-    // but we just manually adjust it here as well to avoid any race conditions.
-    await prisma.organisationClaim.update({
-      where: {
-        id: organisationClaim.id,
-      },
-      data: {
-        memberCount: quantity,
-      },
-    });
-  }
+};
+
+/**
+ * Syncs the organisation's member count with the Stripe subscription quantity.
+ *
+ * No-ops for plans that are not seats-based, and for organisations with
+ * unlimited seats (`organisationClaim.memberCount === 0`). Safe to call from
+ * both grow and shrink paths.
+ *
+ * @param subscription - The subscription to sync the member count with.
+ * @param organisationClaim - The organisation claim.
+ * @param quantity - The new total member + pending invite count to sync.
+ */
+export const syncMemberCountWithStripeSeatPlan = async (
+  subscription: Subscription,
+  organisationClaim: OrganisationClaim,
+  quantity: number,
+) => {
+  // Infinite seats means no sync needed.
+  if (organisationClaim.memberCount === 0) {
+    return;
+  }
+
+  const isSeatsBased = await isPriceSeatsBased(subscription.priceId);
+
+  if (!isSeatsBased) {
+    return;
+  }
+
+  appLog('BILLING', 'Updating seat based plan');
+
+  await updateSubscriptionItemQuantity({
+    priceId: subscription.priceId,
+    subscriptionId: subscription.planId,
+    quantity,
+  });
+
+  // This should be automatically updated after the Stripe webhook is fired
+  // but we just manually adjust it here as well to avoid any race conditions.
+  await prisma.organisationClaim.update({
+    where: {
+      id: organisationClaim.id,
+    },
+    data: {
+      memberCount: quantity,
+    },
+  });
 };

packages/email/package.json

@@ -37,12 +37,12 @@
     "@react-email/section": "0.0.16",
     "@react-email/tailwind": "^2.0.1",
     "@react-email/text": "0.1.5",
-    "nodemailer": "^7.0.10",
+    "nodemailer": "^8.0.5",
     "react-email": "^5.0.6",
     "resend": "^6.5.2"
   },
   "devDependencies": {
     "@documenso/tsconfig": "*",
-    "@types/nodemailer": "^7.0.4"
+    "@types/nodemailer": "^8.0.0"
   }
 }

packages/email/transports/mailchannels.ts

@@ -54,13 +54,11 @@ export class MailChannelsTransport implements Transport<SentMessageInfo> {
     const mailCc = this.toMailChannelsAddresses(mail.data.cc);
     const mailBcc = this.toMailChannelsAddresses(mail.data.bcc);
 
-    const from: MailChannelsAddress =
-      typeof mail.data.from === 'string'
-        ? { email: mail.data.from }
-        : {
-            email: mail.data.from?.address,
-            name: mail.data.from?.name,
-          };
+    const [from] = this.toMailChannelsAddresses(mail.data.from);
+
+    if (!from) {
+      return callback(new Error('Missing required field "from"'), null);
+    }
 
     const requestHeaders: Record<string, string> = {
       'Content-Type': 'application/json',

packages/eslint-config/index.cjs

@@ -1,5 +1,5 @@
 module.exports = {
-  extends: ['next', 'turbo', 'eslint:recommended', 'plugin:@typescript-eslint/recommended'],
+  extends: ['turbo', 'eslint:recommended', 'plugin:@typescript-eslint/recommended'],
 
   plugins: ['unused-imports'],
 
@@ -22,8 +22,7 @@ module.exports = {
   },
 
   rules: {
-    '@next/next/no-html-link-for-pages': 'off',
-    'react/no-unescaped-entities': 'off',
+    // 'react/no-unescaped-entities': 'off',
 
     '@typescript-eslint/no-unused-vars': 'off',
     'unused-imports/no-unused-imports': 'warn',

packages/eslint-config/package.json

@@ -10,11 +10,10 @@
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "eslint": "^8.57.0",
-    "eslint-config-next": "^15",
     "eslint-config-turbo": "^1.13.4",
     "eslint-plugin-package-json": "^0.85.0",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-unused-imports": "^4.3.0",
     "typescript": "5.6.2"
   }
-}
+}

packages/lib/package.json

@@ -46,11 +46,11 @@
     "ai": "^5.0.104",
     "bullmq": "^5.71.1",
     "csv-parse": "^6.1.0",
-    "inngest": "^3.45.1",
+    "inngest": "^3.54.0",
     "ioredis": "^5.10.1",
     "jose": "^6.1.2",
     "konva": "^10.0.9",
-    "kysely": "0.28.8",
+    "kysely": "0.28.16",
     "luxon": "^3.7.2",
     "nanoid": "^5.1.6",
     "oslo": "^0.17.0",

packages/lib/server-only/organisation/create-organisation-member-invites.ts

@@ -5,7 +5,10 @@ import type { Organisation, Prisma } from '@prisma/client';
 import { OrganisationMemberInviteStatus } from '@prisma/client';
 import { nanoid } from 'nanoid';
 
-import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
+import {
+  assertMemberCountWithinCap,
+  syncMemberCountWithStripeSeatPlan,
+} from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
 import { mailer } from '@documenso/email/mailer';
 import { OrganisationInviteEmailTemplate } from '@documenso/email/templates/organisation-invite';
 import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
@@ -127,8 +130,10 @@ export const createOrganisationMemberInvites = async ({
   const totalMemberCountWithInvites =
     numberOfCurrentMembers + numberOfCurrentInvites + numberOfNewInvites;
 
-  // Handle billing for seat based plans.
+  // Enforce the seat cap and sync billing for seat based plans.
   if (subscription) {
+    await assertMemberCountWithinCap(subscription, organisationClaim, totalMemberCountWithInvites);
+
     await syncMemberCountWithStripeSeatPlan(
       subscription,
       organisationClaim,

packages/lib/server-only/webhooks/trigger-test-webhook.ts

@@ -32,7 +32,7 @@ export const triggerTestWebhook = async ({
   try {
     await triggerWebhook({
       event,
-      data: samplePayload,
+      data: samplePayload.payload,
       userId,
       teamId,
     });

packages/lib/types/webhook-payload.ts

@@ -1,4 +1,4 @@
-import type { DocumentMeta, Envelope, Recipient, WebhookTriggerEvents } from '@prisma/client';
+import type { DocumentMeta, Envelope, Recipient } from '@prisma/client';
 import {
   DocumentDistributionMethod,
   DocumentSigningOrder,
@@ -10,6 +10,7 @@ import {
   RecipientRole,
   SendStatus,
   SigningStatus,
+  WebhookTriggerEvents,
 } from '@prisma/client';
 import { z } from 'zod';
 
@@ -25,10 +26,10 @@ export const ZWebhookRecipientSchema = z.object({
   email: z.string(),
   name: z.string(),
   token: z.string(),
-  documentDeletedAt: z.date().nullable(),
-  expiresAt: z.date().nullable(),
-  expirationNotifiedAt: z.date().nullable(),
-  signedAt: z.date().nullable(),
+  documentDeletedAt: z.coerce.date().nullable(),
+  expiresAt: z.coerce.date().nullable(),
+  expirationNotifiedAt: z.coerce.date().nullable(),
+  signedAt: z.coerce.date().nullable(),
   authOptions: z.any().nullable(),
   signingOrder: z.number().nullable(),
   rejectionReason: z.string().nullable(),
@@ -70,10 +71,10 @@ export const ZWebhookDocumentSchema = z.object({
   visibility: z.nativeEnum(DocumentVisibility),
   title: z.string(),
   status: z.nativeEnum(DocumentStatus),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  completedAt: z.date().nullable(),
-  deletedAt: z.date().nullable(),
+  createdAt: z.coerce.date(),
+  updatedAt: z.coerce.date(),
+  completedAt: z.coerce.date().nullable(),
+  deletedAt: z.coerce.date().nullable(),
   teamId: z.number().nullable(),
   templateId: z.number().nullable(),
   source: z.nativeEnum(DocumentSource),
@@ -86,15 +87,20 @@ export const ZWebhookDocumentSchema = z.object({
   Recipient: z.array(ZWebhookRecipientSchema),
 });
 
+/**
+ * Schema for the full webhook delivery envelope (what receivers see on the wire
+ * and what is persisted to `WebhookCall.requestBody`).
+ */
+export const ZWebhookPayloadSchema = z.object({
+  event: z.nativeEnum(WebhookTriggerEvents),
+  payload: ZWebhookDocumentSchema,
+  createdAt: z.string(),
+  webhookEndpoint: z.string(),
+});
+
 export type TWebhookRecipient = z.infer<typeof ZWebhookRecipientSchema>;
 export type TWebhookDocument = z.infer<typeof ZWebhookDocumentSchema>;
-
-export type WebhookPayload = {
-  event: WebhookTriggerEvents;
-  payload: TWebhookDocument;
-  createdAt: string;
-  webhookEndpoint: string;
-};
+export type WebhookPayload = z.infer<typeof ZWebhookPayloadSchema>;
 
 export const mapEnvelopeToWebhookDocumentPayload = (
   envelope: Envelope & {

packages/prisma/package.json

@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@prisma/client": "^6.19.0",
-    "kysely": "0.28.8",
+    "kysely": "0.28.16",
     "nanoid": "^5.1.6",
     "prisma": "^6.19.0",
     "prisma-extension-kysely": "^3.0.0",

packages/trpc/server/admin-router/delete-organisation-member.ts

@@ -0,0 +1,126 @@
+import { OrganisationMemberInviteStatus } from '@prisma/client';
+
+import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { jobs } from '@documenso/lib/jobs/client';
+import { prisma } from '@documenso/prisma';
+
+import { adminProcedure } from '../trpc';
+import {
+  ZDeleteAdminOrganisationMemberRequestSchema,
+  ZDeleteAdminOrganisationMemberResponseSchema,
+} from './delete-organisation-member.types';
+
+export const deleteAdminOrganisationMemberRoute = adminProcedure
+  .input(ZDeleteAdminOrganisationMemberRequestSchema)
+  .output(ZDeleteAdminOrganisationMemberResponseSchema)
+  .mutation(async ({ ctx, input }) => {
+    const { organisationId, organisationMemberId } = input;
+
+    ctx.logger.info({
+      input: {
+        organisationId,
+        organisationMemberId,
+      },
+    });
+
+    const organisation = await prisma.organisation.findUnique({
+      where: {
+        id: organisationId,
+      },
+      include: {
+        subscription: true,
+        organisationClaim: true,
+        teams: {
+          select: {
+            id: true,
+          },
+        },
+        members: {
+          select: {
+            id: true,
+            userId: true,
+          },
+        },
+        invites: {
+          where: {
+            status: OrganisationMemberInviteStatus.PENDING,
+          },
+          select: {
+            id: true,
+          },
+        },
+      },
+    });
+
+    if (!organisation) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Organisation not found',
+      });
+    }
+
+    const memberToDelete = organisation.members.find(
+      (member) => member.id === organisationMemberId,
+    );
+
+    if (!memberToDelete) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Member not found in this organisation',
+      });
+    }
+
+    if (memberToDelete.userId === organisation.ownerUserId) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST, {
+        message: 'Cannot remove the organisation owner. Transfer ownership first.',
+      });
+    }
+
+    const newMemberCount = organisation.members.length + organisation.invites.length - 1;
+
+    // Removing a member is a reducing operation, so we don't gate it on the
+    // subscription being present. Sync Stripe only when one exists.
+    if (organisation.subscription) {
+      await syncMemberCountWithStripeSeatPlan(
+        organisation.subscription,
+        organisation.organisationClaim,
+        newMemberCount,
+      );
+    }
+
+    const teamIds = organisation.teams.map((team) => team.id);
+
+    await prisma.$transaction(async (tx) => {
+      // Removing an OrganisationMember cascades the user out of every team in
+      // the org via OrganisationGroupMember, but their authored Envelope rows
+      // still reference them. Reassign those to the org owner so they remain
+      // reachable after the member loses access (mirrors delete-user.ts).
+      if (teamIds.length > 0) {
+        await tx.envelope.updateMany({
+          where: {
+            userId: memberToDelete.userId,
+            teamId: {
+              in: teamIds,
+            },
+          },
+          data: {
+            userId: organisation.ownerUserId,
+          },
+        });
+      }
+
+      await tx.organisationMember.delete({
+        where: {
+          id: organisationMemberId,
+          organisationId,
+        },
+      });
+    });
+
+    await jobs.triggerJob({
+      name: 'send.organisation-member-left.email',
+      payload: {
+        organisationId,
+        memberUserId: memberToDelete.userId,
+      },
+    });
+  });

packages/trpc/server/admin-router/delete-organisation-member.types.ts

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+
+export const ZDeleteAdminOrganisationMemberRequestSchema = z.object({
+  organisationId: z.string().min(1),
+  organisationMemberId: z.string().min(1),
+});
+
+export const ZDeleteAdminOrganisationMemberResponseSchema = z.void();
+
+export type TDeleteAdminOrganisationMemberRequest = z.infer<
+  typeof ZDeleteAdminOrganisationMemberRequestSchema
+>;
+export type TDeleteAdminOrganisationMemberResponse = z.infer<
+  typeof ZDeleteAdminOrganisationMemberResponseSchema
+>;

packages/trpc/server/admin-router/delete-team-member.ts

@@ -0,0 +1,106 @@
+import { OrganisationGroupType } from '@prisma/client';
+
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+import { adminProcedure } from '../trpc';
+import {
+  ZDeleteAdminTeamMemberRequestSchema,
+  ZDeleteAdminTeamMemberResponseSchema,
+} from './delete-team-member.types';
+
+export const deleteAdminTeamMemberRoute = adminProcedure
+  .input(ZDeleteAdminTeamMemberRequestSchema)
+  .output(ZDeleteAdminTeamMemberResponseSchema)
+  .mutation(async ({ ctx, input }) => {
+    const { teamId, memberId } = input;
+
+    ctx.logger.info({
+      input: {
+        teamId,
+        memberId,
+      },
+    });
+
+    const team = await prisma.team.findUnique({
+      where: {
+        id: teamId,
+      },
+      include: {
+        organisation: {
+          select: {
+            ownerUserId: true,
+          },
+        },
+        teamGroups: {
+          where: {
+            organisationGroup: {
+              type: OrganisationGroupType.INTERNAL_TEAM,
+              organisationGroupMembers: {
+                some: {
+                  organisationMember: {
+                    id: memberId,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    if (!team) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Team not found',
+      });
+    }
+
+    const teamGroupToRemoveMemberFrom = team.teamGroups[0];
+
+    if (!teamGroupToRemoveMemberFrom) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message:
+          'Member is not directly assigned to this team. Inherited members cannot be removed here.',
+      });
+    }
+
+    const member = await prisma.organisationMember.findUnique({
+      where: {
+        id: memberId,
+      },
+      select: {
+        userId: true,
+      },
+    });
+
+    if (!member) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Member not found',
+      });
+    }
+
+    await prisma.$transaction(async (tx) => {
+      // Removing a user from a single team drops their INTERNAL_TEAM
+      // OrganisationGroupMember link, but Envelope rows they authored in this
+      // team still point at their userId. Reassign to the org owner so those
+      // envelopes remain reachable after the member loses team access.
+      await tx.envelope.updateMany({
+        where: {
+          userId: member.userId,
+          teamId,
+        },
+        data: {
+          userId: team.organisation.ownerUserId,
+        },
+      });
+
+      await tx.organisationGroupMember.delete({
+        where: {
+          organisationMemberId_groupId: {
+            organisationMemberId: memberId,
+            groupId: teamGroupToRemoveMemberFrom.organisationGroupId,
+          },
+        },
+      });
+    });
+  });

packages/trpc/server/admin-router/delete-team-member.types.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+
+export const ZDeleteAdminTeamMemberRequestSchema = z.object({
+  teamId: z.number().min(1),
+  memberId: z.string().min(1),
+});
+
+export const ZDeleteAdminTeamMemberResponseSchema = z.void();
+
+export type TDeleteAdminTeamMemberRequest = z.infer<typeof ZDeleteAdminTeamMemberRequestSchema>;
+export type TDeleteAdminTeamMemberResponse = z.infer<typeof ZDeleteAdminTeamMemberResponseSchema>;

packages/trpc/server/admin-router/router.ts

@@ -3,7 +3,9 @@ import { createAdminOrganisationRoute } from './create-admin-organisation';
 import { createStripeCustomerRoute } from './create-stripe-customer';
 import { createSubscriptionClaimRoute } from './create-subscription-claim';
 import { deleteDocumentRoute } from './delete-document';
+import { deleteAdminOrganisationMemberRoute } from './delete-organisation-member';
 import { deleteSubscriptionClaimRoute } from './delete-subscription-claim';
+import { deleteAdminTeamMemberRoute } from './delete-team-member';
 import { deleteUserRoute } from './delete-user';
 import { disableUserRoute } from './disable-user';
 import { downloadDocumentAuditLogsRoute } from './download-document-audit-logs';
@@ -44,6 +46,7 @@ export const adminRouter = router({
   organisationMember: {
     promoteToOwner: promoteMemberToOwnerRoute,
     updateRole: updateOrganisationMemberRoleRoute,
+    delete: deleteAdminOrganisationMemberRoute,
   },
   claims: {
     find: findSubscriptionClaimsRoute,
@@ -86,5 +89,8 @@ export const adminRouter = router({
   team: {
     get: getAdminTeamRoute,
   },
+  teamMember: {
+    delete: deleteAdminTeamMemberRoute,
+  },
   updateSiteSetting: updateSiteSettingRoute,
 });

packages/trpc/server/organisation-router/delete-organisation-member-invites.ts

@@ -2,7 +2,6 @@ import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/str
 import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/organisations';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { getMemberOrganisationRole } from '@documenso/lib/server-only/team/get-member-roles';
-import { validateIfSubscriptionIsRequired } from '@documenso/lib/utils/billing';
 import {
   buildOrganisationWhereQuery,
   isOrganisationRoleWithinUserHierarchy,
@@ -93,15 +92,15 @@ export const deleteOrganisationMemberInvitesRoute = authenticatedProcedure
 
     const { organisationClaim } = organisation;
 
-    const subscription = validateIfSubscriptionIsRequired(organisation.subscription);
-
     const numberOfCurrentMembers = organisation.members.length;
     const numberOfCurrentInvites = organisation.invites.length;
     const totalMemberCountWithInvites = numberOfCurrentMembers + numberOfCurrentInvites - 1;
 
-    if (subscription) {
+    // Removing pending invites is a reducing operation, so we don't gate it on
+    // the subscription being present. Sync Stripe only when one exists.
+    if (organisation.subscription) {
       await syncMemberCountWithStripeSeatPlan(
-        subscription,
+        organisation.subscription,
         organisationClaim,
         totalMemberCountWithInvites,
       );

packages/trpc/server/organisation-router/delete-organisation-members.ts

@@ -2,7 +2,6 @@ import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/str
 import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/organisations';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { jobs } from '@documenso/lib/jobs/client';
-import { validateIfSubscriptionIsRequired } from '@documenso/lib/utils/billing';
 import { buildOrganisationWhereQuery } from '@documenso/lib/utils/organisations';
 import { prisma } from '@documenso/prisma';
 import { OrganisationMemberInviteStatus } from '@documenso/prisma/client';
@@ -55,6 +54,11 @@ export const deleteOrganisationMembers = async ({
     include: {
       subscription: true,
       organisationClaim: true,
+      teams: {
+        select: {
+          id: true,
+        },
+      },
       members: {
         select: {
           id: true,
@@ -82,16 +86,43 @@ export const deleteOrganisationMembers = async ({
     organisationMemberIds.includes(member.id),
   );
 
-  const subscription = validateIfSubscriptionIsRequired(organisation.subscription);
-
   const inviteCount = organisation.invites.length;
   const newMemberCount = organisation.members.length + inviteCount - membersToDelete.length;
 
-  if (subscription) {
-    await syncMemberCountWithStripeSeatPlan(subscription, organisationClaim, newMemberCount);
+  // Removing members is a reducing operation, so we don't gate it on the
+  // subscription being present. Sync Stripe only when one exists.
+  if (organisation.subscription) {
+    await syncMemberCountWithStripeSeatPlan(
+      organisation.subscription,
+      organisationClaim,
+      newMemberCount,
+    );
   }
 
+  const removedUserIds = membersToDelete.map((member) => member.userId);
+  const teamIds = organisation.teams.map((team) => team.id);
+
   await prisma.$transaction(async (tx) => {
+    // Removing an OrganisationMember cascades the user out of every team in
+    // the org via OrganisationGroupMember, but their authored Envelope rows
+    // still reference them. Reassign those to the org owner so they remain
+    // reachable after the member loses access (mirrors delete-user.ts).
+    if (removedUserIds.length > 0 && teamIds.length > 0) {
+      await tx.envelope.updateMany({
+        where: {
+          userId: {
+            in: removedUserIds,
+          },
+          teamId: {
+            in: teamIds,
+          },
+        },
+        data: {
+          userId: organisation.ownerUserId,
+        },
+      });
+    }
+
     await tx.organisationMember.deleteMany({
       where: {
         id: {

packages/trpc/server/organisation-router/leave-organisation.ts

@@ -1,7 +1,6 @@
 import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { jobs } from '@documenso/lib/jobs/client';
-import { validateIfSubscriptionIsRequired } from '@documenso/lib/utils/billing';
 import { buildOrganisationWhereQuery } from '@documenso/lib/utils/organisations';
 import { prisma } from '@documenso/prisma';
 import { OrganisationMemberInviteStatus } from '@documenso/prisma/client';
@@ -30,6 +29,11 @@ export const leaveOrganisationRoute = authenticatedProcedure
       include: {
         organisationClaim: true,
         subscription: true,
+        teams: {
+          select: {
+            id: true,
+          },
+        },
         invites: {
           where: {
             status: OrganisationMemberInviteStatus.PENDING,
@@ -52,22 +56,48 @@ export const leaveOrganisationRoute = authenticatedProcedure
 
     const { organisationClaim } = organisation;
 
-    const subscription = validateIfSubscriptionIsRequired(organisation.subscription);
-
     const inviteCount = organisation.invites.length;
     const newMemberCount = organisation.members.length + inviteCount - 1;
 
-    if (subscription) {
-      await syncMemberCountWithStripeSeatPlan(subscription, organisationClaim, newMemberCount);
+    // Leaving is a reducing operation, so we don't gate it on the subscription
+    // being present. Sync Stripe only when one exists.
+    if (organisation.subscription) {
+      await syncMemberCountWithStripeSeatPlan(
+        organisation.subscription,
+        organisationClaim,
+        newMemberCount,
+      );
     }
 
-    await prisma.organisationMember.delete({
-      where: {
-        userId_organisationId: {
-          userId,
-          organisationId,
+    const teamIds = organisation.teams.map((team) => team.id);
+
+    await prisma.$transaction(async (tx) => {
+      // Leaving the org cascades the user out of every team via
+      // OrganisationGroupMember, but their authored Envelope rows still
+      // reference them. Reassign those to the org owner so they remain
+      // reachable after the member loses access (mirrors delete-user.ts).
+      if (teamIds.length > 0) {
+        await tx.envelope.updateMany({
+          where: {
+            userId,
+            teamId: {
+              in: teamIds,
+            },
+          },
+          data: {
+            userId: organisation.ownerUserId,
+          },
+        });
+      }
+
+      await tx.organisationMember.delete({
+        where: {
+          userId_organisationId: {
+            userId,
+            organisationId,
+          },
         },
-      },
+      });
     });
 
     await jobs.triggerJob({

packages/trpc/server/team-router/delete-team-member.ts

@@ -34,6 +34,11 @@ export const deleteTeamMemberRoute = authenticatedProcedure
         roles: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
       }),
       include: {
+        organisation: {
+          select: {
+            ownerUserId: true,
+          },
+        },
         teamGroups: {
           where: {
             organisationGroup: {
@@ -106,12 +111,39 @@ export const deleteTeamMemberRoute = authenticatedProcedure
       });
     }
 
-    await prisma.organisationGroupMember.delete({
-      where: {
-        organisationMemberId_groupId: {
-          organisationMemberId: memberId,
-          groupId: teamGroupToRemoveMemberFrom.organisationGroupId,
+    const removedMember =
+      teamGroupToRemoveMemberFrom.organisationGroup.organisationGroupMembers.find(
+        (ogm) => ogm.organisationMember.id === memberId,
+      );
+
+    if (!removedMember) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Member not found in this team',
+      });
+    }
+
+    await prisma.$transaction(async (tx) => {
+      // Removing a user from a single team drops their INTERNAL_TEAM
+      // OrganisationGroupMember link, but Envelope rows they authored in this
+      // team still point at their userId. Reassign to the org owner so those
+      // envelopes remain reachable after the member loses team access.
+      await tx.envelope.updateMany({
+        where: {
+          userId: removedMember.organisationMember.userId,
+          teamId,
         },
-      },
+        data: {
+          userId: team.organisation.ownerUserId,
+        },
+      });
+
+      await tx.organisationGroupMember.delete({
+        where: {
+          organisationMemberId_groupId: {
+            organisationMemberId: memberId,
+            groupId: teamGroupToRemoveMemberFrom.organisationGroupId,
+          },
+        },
+      });
     });
   });

packages/trpc/server/template-router/router.ts

@@ -602,6 +602,10 @@ export const templateRouter = router({
         }).catch((err) => {
           console.error(err);
 
+          if (err instanceof AppError) {
+            throw err;
+          }
+
           throw new AppError('DOCUMENT_SEND_FAILED');
         });
       }

packages/trpc/server/webhook-router/resend-webhook-call.ts

@@ -1,6 +1,7 @@
 import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { jobs } from '@documenso/lib/jobs/client';
+import { ZWebhookPayloadSchema } from '@documenso/lib/types/webhook-payload';
 import { buildTeamWhereQuery } from '@documenso/lib/utils/teams';
 import { prisma } from '@documenso/prisma';
 
@@ -39,12 +40,16 @@ export const resendWebhookCallRoute = authenticatedProcedure
       throw new AppError(AppErrorCode.NOT_FOUND);
     }
 
+    // `requestBody` stores the full delivery envelope; unwrap to the inner
+    // document so the handler doesn't wrap it a second time.
+    const { payload: data } = ZWebhookPayloadSchema.parse(webhookCall.requestBody);
+
     await jobs.triggerJob({
       name: 'internal.execute-webhook',
       payload: {
         event: webhookCall.event,
         webhookId,
-        data: webhookCall.requestBody,
+        data,
       },
     });
   });