Merge from docusealco/wip

add counters
fix autocomplete
2026-08-07 07:14:43 +00:00 · 2026-08-03 12:53:50 +03:00 · 2026-08-03 10:05:09 +03:00 · 2026-08-03 09:41:08 +03:00 · 2026-08-03 08:19:35 +03:00 · 2026-08-03 07:42:53 +03:00
380 changed files with 18573 additions and 5050 deletions
@@ -12,7 +12,7 @@ jobs:
      - name: Install Ruby
        uses: ruby/setup-ruby@v1
        with:
-          ruby-version: 4.0.1
+          ruby-version: 4.0.5
      - name: Cache gems
        uses: actions/cache@v4
        with:
@@ -37,7 +37,7 @@ jobs:
      - name: Install Ruby
        uses: ruby/setup-ruby@v1
        with:
-          ruby-version: 4.0.1
+          ruby-version: 4.0.5
      - name: Cache gems
        uses: actions/cache@v4
        with:
@@ -89,7 +89,7 @@ jobs:
      - name: Install Ruby
        uses: ruby/setup-ruby@v1
        with:
-          ruby-version: 4.0.1
+          ruby-version: 4.0.5
      - name: Cache gems
        uses: actions/cache@v4
        with:
@@ -104,7 +104,7 @@ jobs:
          bundle install --jobs 4 --retry 4
          yarn install
          sudo apt-get update
-          sudo apt-get install libvips
+          sudo apt-get install libvips liblept5
      - name: Run Brakeman
        run: bundle exec brakeman -q --exit-on-warn

@@ -132,7 +132,7 @@ jobs:
      - name: Install Ruby
        uses: ruby/setup-ruby@v1
        with:
-          ruby-version: 4.0.1
+          ruby-version: 4.0.5
      - name: Set up Node
        uses: actions/setup-node@v1
        with:
@@ -162,8 +162,8 @@ jobs:
          bundle install --jobs 4 --retry 4
          yarn install
          sudo apt-get update
-          sudo apt-get install -y libvips
-          wget -O pdfium-linux.tgz "https://github.com/docusealco/pdfium-binaries/releases/latest/download/pdfium-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tgz"
+          sudo apt-get install -y libvips liblept5
+          wget -O pdfium-linux.tgz "https://github.com/bblanchon/pdfium-binaries/releases/latest/download/pdfium-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tgz"
          sudo tar -xzf pdfium-linux.tgz --strip-components=1 -C /usr/lib lib/libpdfium.so
          rm -f pdfium-linux.tgz
      - name: Run
@@ -30,7 +30,9 @@ jobs:
      uses: docker/setup-buildx-action@v3

    - name: Create .version file
-      run: echo ${{ github.ref_name }} > .version
+      env:
+        REF_NAME: ${{ github.ref_name }}
+      run: echo "$REF_NAME" > .version

    - name: Login to Docker Hub
      uses: docker/login-action@v3
@@ -1,19 +1,23 @@
-FROM ruby:4.0.1-alpine AS download
+FROM ruby:4.0.5-alpine AS download

 WORKDIR /fonts

-RUN apk --no-cache add wget && \
+RUN apk --no-cache add wget unzip && \
    wget https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Regular.ttf && \
    wget https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Bold.ttf && \
    wget https://github.com/impallari/DancingScript/raw/master/fonts/DancingScript-Regular.otf && \
    wget https://raw.githubusercontent.com/impallari/DancingScript/master/OFL.txt && \
    wget https://raw.githubusercontent.com/notofonts/noto-fonts/refs/heads/main/LICENSE && \
    wget -O /model.onnx "https://github.com/docusealco/fields-detection/releases/download/2.0.0/model_704_int8.onnx" && \
-    wget -O pdfium-linux.tgz "https://github.com/bblanchon/pdfium-binaries/releases/latest/download/pdfium-linux-musl-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tgz" && \
+    wget -O pdfium-linux.zip "https://github.com/docusealco/pdfium-binaries/releases/download/20260613/pdfium-musl-$(uname -m).zip" && \
+    case "$(uname -m)" in \
+      x86_64)  echo "2c953ff72ee2dda07e7fc577e25841cc3d6464468a7c5adfaea574efcbc3b90b  pdfium-linux.zip" ;; \
+      aarch64) echo "23bbe287d2753fdb05741c7660647eb0ef0d2e4da2ce0722bfa9d9d455bd64e2  pdfium-linux.zip" ;; \
+    esac | sha256sum -c - && \
    mkdir -p /pdfium-linux && \
-    tar -xzf pdfium-linux.tgz -C /pdfium-linux
+    unzip -q pdfium-linux.zip -d /pdfium-linux

-FROM ruby:4.0.1-alpine AS webpack
+FROM ruby:4.0.5-alpine AS webpack

 ENV RAILS_ENV=production
 ENV NODE_ENV=production
@@ -40,7 +44,7 @@ COPY ./app/views ./app/views

 RUN echo "gem 'shakapacker'" > Gemfile && ./bin/shakapacker

-FROM ruby:4.0.1-alpine AS app
+FROM ruby:4.0.5-alpine AS app

 ENV RAILS_ENV=production
 ENV BUNDLE_WITHOUT="development:test"
@@ -48,7 +52,8 @@ ENV OPENSSL_CONF=/etc/openssl_legacy.cnf

 WORKDIR /app

-RUN apk add --no-cache libpq vips redis vips-heif onnxruntime
+RUN apk add --no-cache libpq vips redis onnxruntime leptonica && \
+    rm -f /usr/bin/onnx_test_runner /usr/bin/onnxruntime_test

 RUN addgroup -g 2000 docuseal && adduser -u 2000 -G docuseal -s /bin/sh -D -h /home/docuseal docuseal

@@ -81,7 +86,7 @@ COPY --chown=docuseal:docuseal .version ./public/version

 COPY --chown=docuseal:docuseal --from=download /fonts/GoNotoKurrent-Regular.ttf /fonts/GoNotoKurrent-Bold.ttf /fonts/DancingScript-Regular.otf /fonts/OFL.txt /fonts/LICENSE /fonts/
 COPY --from=download /pdfium-linux/lib/libpdfium.so /usr/lib/libpdfium.so
-COPY --from=download /pdfium-linux/licenses/pdfium.txt /usr/lib/libpdfium-LICENSE.txt
+COPY --from=download /pdfium-linux/licenses/ /usr/lib/libpdfium-licenses/
 COPY --chown=docuseal:docuseal --from=download /model.onnx /app/tmp/model.onnx
 COPY --chown=docuseal:docuseal --from=webpack /app/public/packs ./public/packs

@@ -94,6 +99,7 @@ WORKDIR /data/docuseal
 ENV HOME=/home/docuseal
 ENV WORKDIR=/data/docuseal
 ENV VIPS_MAX_COORD=17000
+ENV VIPS_BLOCK_UNTRUSTED=1

 EXPOSE 3000
 CMD ["/app/bin/bundle", "exec", "puma", "-C", "/app/config/puma.rb", "--dir", "/app"]
@@ -2,7 +2,7 @@

 source 'https://rubygems.org'

-ruby '4.0.1'
+ruby '4.0.5'

 gem 'addressable'
 gem 'arabic-letter-connector', require: false
@@ -21,11 +21,9 @@ gem 'faraday'
 gem 'faraday-follow_redirects'
 gem 'google-cloud-storage', require: false
 gem 'hexapdf'
-gem 'image_processing'
 gem 'jwt', require: false
 gem 'lograge'
 gem 'numo-narray-alt', require: false
-gem 'oj'
 gem 'onnxruntime', require: false
 gem 'pagy'
 gem 'pg', require: false
@@ -1,31 +1,31 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    action_text-trix (2.1.18)
+    action_text-trix (2.1.19)
      railties
-    actioncable (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
-    actionmailer (8.1.3)
-      actionpack (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
      rails-dom-testing (~> 2.2)
-    actionpack (8.1.3)
-      actionview (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nokogiri (>= 1.8.5)
      rack (>= 2.2.4)
      rack-session (>= 1.0.1)
@@ -33,36 +33,36 @@ GEM
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
      useragent (~> 0.16)
-    actiontext (8.1.3)
+    actiontext (8.1.3.1)
      action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (8.1.3)
-      activesupport (= 8.1.3)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    activejob (8.1.3)
-      activesupport (= 8.1.3)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.3.6)
-    activemodel (8.1.3)
-      activesupport (= 8.1.3)
-    activerecord (8.1.3)
-      activemodel (= 8.1.3)
-      activesupport (= 8.1.3)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      timeout (>= 0.4.0)
-    activestorage (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activesupport (= 8.1.3)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      marcel (~> 1.0)
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
      base64
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -116,7 +116,7 @@ GEM
      erubi (~> 1.4)
      parser (>= 2.4)
      smart_properties
-    bigdecimal (4.1.0)
+    bigdecimal (4.1.2)
    bindex (0.8.1)
    bootsnap (1.23.0)
      msgpack (~> 1.2)
@@ -144,12 +144,12 @@ GEM
    cldr-plurals-runtime-rb (1.1.0)
    cmdparse (3.0.7)
    coderay (1.1.3)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
    connection_pool (3.0.2)
    crack (1.0.1)
      bigdecimal
      rexml
-    crass (1.0.6)
+    crass (1.0.7)
    csv (3.3.5)
    csv-safe (3.3.1)
      csv (~> 3.0)
@@ -161,7 +161,7 @@ GEM
      irb (~> 1.10)
      reline (>= 0.3.8)
    declarative (0.0.20)
-    devise (5.0.3)
+    devise (5.0.4)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 7.0)
@@ -179,7 +179,7 @@ GEM
    dotenv (3.2.0)
    drb (2.2.3)
    email_typo (0.2.3)
-    erb (6.0.4)
+    erb (6.0.6)
    erb_lint (0.9.0)
      activesupport
      better_html (>= 2.0.1)
@@ -195,13 +195,13 @@ GEM
      railties (>= 6.1.0)
    faker (3.6.1)
      i18n (>= 1.8.11, < 2)
-    faraday (2.14.1)
+    faraday (2.14.3)
      faraday-net_http (>= 2.0, < 3.5)
      json
      logger
    faraday-follow_redirects (0.5.0)
      faraday (>= 1, < 3)
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
      net-http (~> 0.5)
    ferrum (0.17.2)
      addressable (~> 2.5)
@@ -217,7 +217,7 @@ GEM
    foreman (0.90.0)
      thor (~> 1.4)
    geom2d (0.4.1)
-    globalid (1.3.0)
+    globalid (1.4.0)
      activesupport (>= 6.1)
    google-apis-core (1.0.2)
      addressable (~> 2.8, >= 2.8.7)
@@ -257,25 +257,22 @@ GEM
      os (>= 0.9, < 2.0)
      signet (>= 0.16, < 2.a)
    hashdiff (1.2.1)
-    hexapdf (1.6.0)
+    hexapdf (1.7.0)
      cmdparse (~> 3.0, >= 3.0.3)
      geom2d (~> 0.4, >= 0.4.1)
      openssl (>= 2.2.1)
      strscan (>= 3.1.2)
-    i18n (1.14.8)
+    i18n (1.15.2)
      concurrent-ruby (~> 1.0)
-    image_processing (1.14.0)
-      mini_magick (>= 4.9.5, < 6)
-      ruby-vips (>= 2.0.17, < 3)
    io-console (0.8.2)
-    irb (1.17.0)
+    irb (1.18.0)
      pp (>= 0.6.0)
      prism (>= 1.3.0)
      rdoc (>= 4.0.0)
      reline (>= 0.4.2)
    jmespath (1.6.2)
-    json (2.19.3)
-    jwt (3.1.2)
+    json (2.21.1)
+    jwt (3.2.0)
      base64
    language_server-protocol (3.17.0.5)
    launchy (3.1.1)
@@ -296,29 +293,27 @@ GEM
      activesupport (>= 4)
      railties (>= 4)
      request_store (~> 1.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
      logger
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
      net-smtp
-    marcel (1.1.0)
+    marcel (1.2.1)
    matrix (0.4.3)
    method_source (1.1.0)
-    mini_magick (5.3.1)
-      logger
    mini_mime (1.1.5)
-    minitest (6.0.3)
+    minitest (6.0.6)
      drb (~> 2.0)
      prism (~> 1.5)
-    msgpack (1.8.0)
+    msgpack (1.8.4)
    multi_json (1.19.1)
    net-http (0.9.1)
      uri (>= 0.11.1)
-    net-imap (0.6.3)
+    net-imap (0.6.6)
      date
      net-protocol
    net-pop (0.1.2)
@@ -328,20 +323,17 @@ GEM
    net-smtp (0.5.1)
      net-protocol
    nio4r (2.7.5)
-    nokogiri (1.19.2-aarch64-linux-gnu)
+    nokogiri (1.19.4-aarch64-linux-gnu)
      racc (~> 1.4)
-    nokogiri (1.19.2-aarch64-linux-musl)
+    nokogiri (1.19.4-aarch64-linux-musl)
      racc (~> 1.4)
-    nokogiri (1.19.2-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-linux-musl)
+    nokogiri (1.19.4-x86_64-linux-musl)
      racc (~> 1.4)
    numo-narray-alt (0.10.3)
-    oj (3.16.16)
-      bigdecimal (>= 3.0)
-      ostruct (>= 0.2)
    onnxruntime (0.10.1-aarch64-linux)
      ffi
    onnxruntime (0.10.1-arm64-darwin)
@@ -351,9 +343,8 @@ GEM
    openssl (4.0.1)
    orm_adapter (0.5.0)
    os (1.1.4)
-    ostruct (0.6.3)
    package_json (0.2.0)
-    pagy (43.4.4)
+    pagy (43.6.1)
      json
      uri
      yaml
@@ -366,7 +357,7 @@ GEM
    pg (1.6.3-arm64-darwin)
    pg (1.6.3-x86_64-linux)
    pg (1.6.3-x86_64-linux-musl)
-    pp (0.6.3)
+    pp (0.6.4)
      prettyprint
    pretender (1.0.0)
      actionpack (>= 7.2)
@@ -378,11 +369,8 @@ GEM
      reline (>= 0.6.0)
    pry-rails (0.3.11)
      pry (>= 0.13.0)
-    psych (5.3.1)
-      date
-      stringio
    public_suffix (7.0.5)
-    puma (7.2.0)
+    puma (8.0.2)
      nio4r (~> 2.0)
    racc (1.8.1)
    rack (3.2.6)
@@ -395,33 +383,33 @@ GEM
      rack (>= 1.3)
    rackup (2.3.1)
      rack (>= 3)
-    rails (8.1.3)
-      actioncable (= 8.1.3)
-      actionmailbox (= 8.1.3)
-      actionmailer (= 8.1.3)
-      actionpack (= 8.1.3)
-      actiontext (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activemodel (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      bundler (>= 1.15.0)
-      railties (= 8.1.3)
+      railties (= 8.1.3.1)
    rails-dom-testing (2.3.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
    rails-i18n (8.1.0)
      i18n (>= 0.7, < 2)
      railties (>= 8.0.0, < 9)
-    railties (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      irb (~> 1.13)
      rackup (>= 1.0.0)
      rake (>= 12.2)
@@ -429,12 +417,17 @@ GEM
      tsort (>= 0.2)
      zeitwerk (~> 2.6)
    rainbow (3.1.1)
-    rake (13.3.1)
-    rdoc (7.2.0)
-      erb
-      psych (>= 4.0.0)
+    rake (13.4.2)
+    rbs (4.1.0)
+      logger
+      prism (>= 1.6.0)
      tsort
-    redis-client (0.28.0)
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    redis-client (0.29.0)
      connection_pool
    regexp_parser (2.11.3)
    reline (0.6.3)
@@ -516,12 +509,12 @@ GEM
      rack-proxy (>= 0.6.1)
      railties (>= 5.2)
      semantic_range (>= 2.3.0)
-    sidekiq (8.1.2)
+    sidekiq (8.1.6)
      connection_pool (>= 3.0.0)
      json (>= 2.16.0)
      logger (>= 1.7.0)
      rack (>= 3.2.0)
-      redis-client (>= 0.26.0)
+      redis-client (>= 0.29.0)
    signet (0.21.0)
      addressable (~> 2.8)
      faraday (>= 0.17.5, < 3.a)
@@ -534,12 +527,11 @@ GEM
    simplecov-html (0.13.2)
    simplecov_json_formatter (0.1.4)
    smart_properties (1.17.0)
-    sqlite3 (2.9.2-aarch64-linux-gnu)
-    sqlite3 (2.9.2-aarch64-linux-musl)
-    sqlite3 (2.9.2-arm64-darwin)
-    sqlite3 (2.9.2-x86_64-linux-gnu)
-    sqlite3 (2.9.2-x86_64-linux-musl)
-    stringio (3.2.0)
+    sqlite3 (2.9.5-aarch64-linux-gnu)
+    sqlite3 (2.9.5-aarch64-linux-musl)
+    sqlite3 (2.9.5-arm64-darwin)
+    sqlite3 (2.9.5-x86_64-linux-gnu)
+    sqlite3 (2.9.5-x86_64-linux-musl)
    strip_attributes (2.0.1)
      activemodel (>= 3.0, < 9.0)
    strscan (3.1.8)
@@ -579,14 +571,14 @@ GEM
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
    webrick (1.9.2)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
    xpath (3.2.0)
      nokogiri (~> 1.8)
    yaml (0.4.0)
-    zeitwerk (2.7.5)
+    zeitwerk (2.8.2)

 PLATFORMS
  aarch64-linux
@@ -624,12 +616,10 @@ DEPENDENCIES
  foreman
  google-cloud-storage
  hexapdf
-  image_processing
  jwt
  letter_opener_web
  lograge
  numo-narray-alt
-  oj
  onnxruntime
  pagy
  pg
@@ -662,7 +652,7 @@ DEPENDENCIES
  webmock

 RUBY VERSION
-  ruby 4.0.1
+  ruby 4.0.5

 BUNDLED WITH
  4.0.3
@@ -50,7 +50,7 @@ DocuSeal is an open source platform that provides secure and efficient digital d
 - Company logo and white-label
 - User roles
 - Automated reminders
- Invitation and identify verification via SMS
+- Invitation and identity verification via SMS
 - Conditional fields and formulas
 - Bulk send with CSV, XLSX spreadsheet import
 - SSO / SAML
@@ -74,7 +74,7 @@ DocuSeal is an open source platform that provides secure and efficient digital d
 docker run --name docuseal -p 3000:3000 -v.:/data docuseal/docuseal
 ```

-By default DocuSeal docker container uses an SQLite database to store data and configurations. Alternatively, it is possible use PostgreSQL or MySQL databases by specifying the `DATABASE_URL` env variable.
+By default DocuSeal docker container uses an SQLite database to store data and configurations. Alternatively, it is possible to use PostgreSQL or MySQL databases by specifying the `DATABASE_URL` env variable.

 #### Docker Compose

@@ -37,7 +37,7 @@ class AccountConfigsController < ApplicationController
  end

  def destroy
-    raise InvalidKey unless allowed_keys.include?(@account_config.key)
+    raise InvalidKey unless allowed_destroy_keys.include?(@account_config.key)

    @account_config.destroy!

@@ -50,6 +50,10 @@ class AccountConfigsController < ApplicationController
    ALLOWED_KEYS
  end

+  def allowed_destroy_keys
+    ALLOWED_KEYS
+  end
+
  def load_account_config
    raise InvalidKey unless allowed_keys.include?(account_config_params[:key])

@@ -9,7 +9,9 @@ module Api

    before_action :set_cors_headers
    before_action :set_noindex_headers
+    before_action :set_security_headers

+    # rubocop:disable Metrics
    def show
      blob_uuid, purp, exp = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid])

@@ -21,6 +23,12 @@ module Api

      blob = ActiveStorage::Blob.find_by!(uuid: blob_uuid)

+      if Submitters::DANGEROUS_EXTENSIONS.include?(blob.filename.extension.to_s.downcase)
+        Rollbar.error('Dangerous extension') if defined?(Rollbar)
+
+        return head :unprocessable_content
+      end
+
      attachment = blob.attachments.take

      @record = attachment.record
@@ -33,12 +41,19 @@ module Api
      else
        http_cache_forever public: true do
          response.headers['Accept-Ranges'] = 'bytes'
-          response.headers['Content-Length'] = blob.byte_size.to_s

-          send_blob_stream blob, disposition: params[:disposition]
+          if request.head?
+            response.headers['Content-Type'] = blob.content_type_for_serving
+            head :ok
+          else
+            send_blob_stream blob, disposition: params[:disposition]
+          end
+
+          response.headers['Content-Length'] = blob.byte_size.to_s
        end
      end
    end
+    # rubocop:enable Metrics

    private

@@ -57,8 +72,6 @@ module Api
        return if !require_ttl && !require_auth
      end

-      Rollbar.error('Blob unauthorized') if defined?(Rollbar)
-
      raise CanCan::AccessDenied
    end
  end
@@ -9,6 +9,7 @@ module Api

    before_action :set_cors_headers
    before_action :set_noindex_headers
+    before_action :set_security_headers

    # rubocop:disable Metrics
    def show
@@ -18,6 +19,12 @@ module Api

      return head :not_found unless blob

+      if Submitters::DANGEROUS_EXTENSIONS.include?(blob.filename.extension.to_s.downcase)
+        Rollbar.error('Dangerous extension') if defined?(Rollbar)
+
+        return head :unprocessable_content
+      end
+
      is_permitted = blob.attachments.any? do |a|
        (current_user && a.record.account.id == current_user.account_id) ||
          a.record.account.account_configs.any? { |e| e.key == 'legacy_blob_proxy' } ||
@@ -102,6 +102,10 @@ module Api
      headers['X-Robots-Tag'] = 'noindex'
    end

+    def set_security_headers
+      response.headers['X-Content-Type-Options'] = 'nosniff'
+    end
+
    def set_cors_headers
      headers['Access-Control-Allow-Origin'] = '*'
      headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, PATCH, DELETE, OPTIONS'
@@ -8,35 +8,37 @@ module Api
    COOKIE_STORE_LIMIT = 10

    def create
-      submitter = Submitter.find_by!(slug: params[:submitter_slug])
-
-      unless can_upload?(submitter)
-        Rollbar.error("Can't upload: #{submitter.id}") if defined?(Rollbar)
+      @submitter = Submitter.find_by!(slug: params[:submitter_slug])

+      unless can_upload?(@submitter)
        return render json: { error: I18n.t('form_has_been_archived') }, status: :unprocessable_content
      end

+      file = params[:file]
+
      if params[:type].in?(%w[initials signature])
-        image = Vips::Image.new_from_file(params[:file].path)
+        image = ImageUtils.load_vips(file.read, content_type: file.content_type)

        if ImageUtils.blank?(image)
-          Rollbar.error("Empty signature: #{submitter.id}") if defined?(Rollbar)
+          Rollbar.error("Empty signature: #{@submitter.id}") if defined?(Rollbar)

          return render json: { error: "#{params[:type]} is empty" }, status: :unprocessable_content
        end

        if ImageUtils.error?(image)
-          Rollbar.error("Error signature: #{submitter.id}") if defined?(Rollbar)
+          Rollbar.error("Error signature: #{@submitter.id}") if defined?(Rollbar)

          return render json: { error: "#{params[:type]} error, try to sign on another device" },
                        status: :unprocessable_content
        end
+
+        metadata = { analyzed: true, identified: true, width: image.width, height: image.height }
      end

-      attachment = Submitters.create_attachment!(submitter, params)
+      attachment = Submitters.create_attachment!(@submitter, file, metadata:)

-      if params[:remember_signature] == 'true' && submitter.email.present?
-        cookies.encrypted[:signature_uuids] = build_new_cookie_signatures_json(submitter, attachment)
+      if params[:remember_signature] == 'true' && @submitter.email.present?
+        cookies.encrypted[:signature_uuids] = build_new_cookie_signatures_json(@submitter, attachment)
      end

      render json: attachment.as_json(only: %i[uuid created_at], methods: %i[url filename content_type])
@@ -9,7 +9,7 @@ module Api
                 (@submission.schema_documents || @submission.template.schema_documents).size > 1

      documents =
-        if @submission.submitters.all?(&:completed_at?)
+        if @submission.completed_at?
          build_completed_documents(@submission, merge: is_merge)
        else
          build_preview_documents(@submission, merge: is_merge)
@@ -30,7 +30,7 @@ module Api
    private

    def build_completed_documents(submission, merge: false)
-      last_submitter = submission.submitters.max_by(&:completed_at)
+      last_submitter = submission.submitters.select(&:completed_at?).max_by(&:completed_at)

      if merge
        if submission.merged_document_attachment.blank?
@@ -5,7 +5,7 @@ module Api
    load_and_authorize_resource :submission, parent: false

    def index
-      submissions = build_completed_query(@submissions)
+      submissions = @submissions.active.where.not(completed_at: nil)

      params[:after] = Time.zone.at(params[:after].to_i) if params[:after].present?
      params[:before] = Time.zone.at(params[:before].to_i) if params[:before].present?
@@ -36,20 +36,5 @@ module Api
        }
      }
    end
-
-    private
-
-    def build_completed_query(submissions)
-      submissions = submissions.where(
-        Submitter.where(completed_at: nil).where(
-          Submitter.arel_table[:submission_id].eq(Submission.arel_table[:id])
-        ).select(1).arel.exists.not
-      )
-
-      submissions.joins(:submitters)
-                 .group(:id)
-                 .select(Submission.arel_table[Arel.star],
-                         Submitter.arel_table[:completed_at].maximum.as('completed_at'))
-    end
  end
 end
@@ -2,21 +2,39 @@

 module Api
  class SubmissionsController < ApiBaseController
+    SUBMISSION_COLUMNS = %i[id name slug source submitters_order expire_at completed_at created_at updated_at
+                            archived_at variables template_id template_submitters created_by_user_id].freeze
+    TEMPLATE_COLUMNS = %i[id name external_id created_at updated_at folder_id submitters].freeze
+
    load_and_authorize_resource :template, only: :create
-    load_and_authorize_resource :submission, only: %i[show index destroy]
+    load_and_authorize_resource :submission, only: %i[show index update destroy]

    before_action only: :create do
      authorize!(:create, Submission)
    end

+    before_action :maybe_return_template_error, only: :create
+
    def index
      submissions = Submissions.search(current_user, @submissions, params[:q])
      submissions = filter_submissions(submissions, params)

-      submissions = paginate(submissions.preload(:created_by_user, :submitters,
-                                                 template: { folder: :parent_folder },
-                                                 combined_document_attachment: :blob,
-                                                 audit_trail_attachment: :blob))
+      with_fields = params[:include].to_s.include?('fields') || params[:include].to_s.include?('combined_document_url')
+
+      submissions = paginate(
+        submissions.select(with_fields ? nil : SUBMISSION_COLUMNS)
+                   .preload(:created_by_user, :submitters, combined_document_attachment: :blob,
+                                                           audit_trail_attachment: :blob)
+      )
+
+      ActiveRecord::Associations::Preloader.new(
+        records: submissions,
+        associations: :template,
+        scope: with_fields ? nil : Template.select(TEMPLATE_COLUMNS)
+      ).call
+
+      ActiveRecord::Associations::Preloader.new(records: submissions.filter_map(&:template),
+                                                associations: { folder: :parent_folder }).call

      expires_at = Accounts.link_expires_at(current_account)

@@ -42,7 +60,7 @@ module Api
        end
      end

-      if @submission.audit_trail_attachment.blank? && submitters.all?(&:completed_at?)
+      if @submission.audit_trail_attachment.blank? && @submission.completed_at?
        @submission.audit_trail_attachment = Submissions::EnsureAuditGenerated.call(@submission)
      end

@@ -52,14 +70,6 @@ module Api
    def create
      Params::SubmissionCreateValidator.call(params)

-      return render json: { error: 'Template not found' }, status: :unprocessable_content if @template.nil?
-
-      if @template.fields.blank?
-        Rollbar.warning("Template does not contain fields: #{@template.id}") if defined?(Rollbar)
-
-        return render json: { error: 'Template does not contain fields' }, status: :unprocessable_content
-      end
-
      params[:send_email] = true unless params.key?(:send_email)
      params[:send_sms] = false unless params.key?(:send_sms)

@@ -70,10 +80,17 @@ module Api
      Submissions.send_signature_requests(submissions)

      submissions.each do |submission|
+        if submission.submitters.all? { |s| s.viewer? || s.completed_at? } &&
+           Submissions.maybe_update_completed_at(submission)
+          last_submitter = submission.submitters.reject(&:viewer?).max_by(&:completed_at)
+        end
+
        submission.submitters.each do |submitter|
          next unless submitter.completed_at?

-          ProcessSubmitterCompletionJob.perform_async('submitter_id' => submitter.id, 'send_invitation_email' => false)
+          ProcessSubmitterCompletionJob.perform_async('submitter_id' => submitter.id,
+                                                      'is_last' => submitter == last_submitter,
+                                                      'send_invitation_email' => false)
        end
      end

@@ -87,6 +104,25 @@ module Api
      render json: { error: e.message }, status: :unprocessable_content
    end

+    def update
+      @submission = assign_submission_attrs(@submission, submission_params)
+
+      @submission.save!
+
+      if @submission.saved_change_to_archived_at? && @submission.archived_at?
+        WebhookUrls.enqueue_events(@submission, 'submission.archived')
+      end
+
+      if @submission.saved_change_to_expire_at? && @submission.expire_at?
+        ProcessSubmissionExpiredJob.perform_at(@submission.expire_at, 'submission_id' => @submission.id,
+                                                                      'expire_at' => @submission.expire_at.to_i)
+      end
+
+      SearchEntries.enqueue_reindex(@submission) if @submission.saved_change_to_name?
+
+      render json: Submissions::SerializeForApi.call(@submission, nil, params, with_events: false)
+    end
+
    def destroy
      if params[:permanently].in?(['true', true])
        @submission.destroy!
@@ -101,6 +137,41 @@ module Api

    private

+    def assign_submission_attrs(submission, attrs)
+      archived = attrs.key?(:archived) ? attrs[:archived] : attrs[:archived_at]
+
+      if archived.in?([true, false, 'true', 'false']) && current_ability.can?(:destroy, submission)
+        submission.archived_at = archived.in?(Submitters::TRUE_VALUES) ? Time.current : nil
+      end
+
+      submission.name = attrs[:name] if attrs.key?(:name)
+      submission.expire_at = attrs[:expire_at].presence if attrs.key?(:expire_at)
+
+      submission
+    end
+
+    def submission_params
+      submission_params = params.key?(:submission) ? params.require(:submission) : params
+
+      submission_params.permit(:name, :expire_at, :archived, :archived_at)
+    end
+
+    def maybe_return_template_error
+      return render json: { error: 'Template not found' }, status: :unprocessable_content if @template.nil?
+
+      if @template.archived_at?
+        Rollbar.warning("Archived template submission: #{@template.id}") if defined?(Rollbar)
+
+        return render json: { error: 'Template has been archived' }, status: :unprocessable_content
+      end
+
+      return if @template.fields.present?
+
+      Rollbar.warning("Template does not contain fields: #{@template.id}") if defined?(Rollbar)
+
+      render json: { error: 'Template does not contain fields' }, status: :unprocessable_content
+    end
+
    def filter_submissions(submissions, params)
      submissions = submissions.where(template_id: params[:template_id]) if params[:template_id].present?
      submissions = submissions.where(slug: params[:slug]) if params[:slug].present?
@@ -4,6 +4,8 @@ module Api
  class SubmittersController < ApiBaseController
    load_and_authorize_resource :submitter

+    before_action :maybe_return_submitter_error, only: :update
+
    def index
      submitters = Submitters.search(current_user, @submitters, params[:q])

@@ -36,14 +38,6 @@ module Api

    # rubocop:disable Metrics/MethodLength
    def update
-      if @submitter.completed_at?
-        return render json: { error: 'Submitter has already completed the submission.' }, status: :unprocessable_content
-      end
-
-      if @submitter.declined_at?
-        return render json: { error: 'Submitter has already declined the submission.' }, status: :unprocessable_content
-      end
-
      submission = @submitter.submission
      role = submission.template_submitters.find { |e| e['uuid'] == @submitter.uuid }['name']

@@ -73,7 +67,9 @@ module Api
      end

      if @submitter.completed_at?
-        ProcessSubmitterCompletionJob.perform_async('submitter_id' => @submitter.id)
+        is_last = Submissions.maybe_update_completed_at(@submitter.submission)
+
+        ProcessSubmitterCompletionJob.perform_async('submitter_id' => @submitter.id, 'is_last' => is_last)
      elsif normalized_params[:send_email] || normalized_params[:send_sms]
        Submitters.send_signature_requests([@submitter])
      end
@@ -104,7 +100,17 @@ module Api

    private

-    def maybe_filder_by_completed_at(submitters, params)
+    def maybe_return_submitter_error
+      if @submitter.completed_at? || @submitter.submission.completed_at?
+        return render json: { error: 'Submitter has already completed the submission.' }, status: :unprocessable_content
+      end
+
+      return unless @submitter.declined_at?
+
+      render json: { error: 'Submitter has already declined the submission.' }, status: :unprocessable_content
+    end
+
+    def maybe_filter_by_completed_at(submitters, params)
      if params[:completed_after].present?
        submitters = submitters.where(completed_at: Time.zone.parse(params[:completed_after])..)
      end
@@ -177,7 +183,7 @@ module Api
        submitters = submitters.joins(:submission).where(submissions: { template_id: params[:template_id] })
      end

-      maybe_filder_by_completed_at(submitters, params)
+      maybe_filter_by_completed_at(submitters, params)
    end

    def assign_external_id(submitter, attrs)
@@ -203,10 +209,15 @@ module Api

      submitter.preferences['send_sms'] = submitter_preferences['send_sms'] if submitter_preferences.key?('send_sms')
      submitter.preferences['reply_to'] = submitter_preferences['reply_to'] if submitter_preferences.key?('reply_to')
+
      if submitter_preferences.key?('require_phone_2fa')
        submitter.preferences['require_phone_2fa'] = submitter_preferences['require_phone_2fa']
      end

+      if submitter_preferences.key?('require_email_2fa')
+        submitter.preferences['require_email_2fa'] = submitter_preferences['require_email_2fa']
+      end
+
      if submitter_preferences.key?('go_to_last')
        submitter.preferences['go_to_last'] = submitter_preferences['go_to_last']
      end
@@ -5,24 +5,13 @@ module Api
    load_and_authorize_resource :template

    def index
+      @templates = Templates.shared(current_user) if params[:shared].in?(['true', true])
+
      templates = filter_templates(@templates, params)

      templates = paginate(templates.preload(:author, folder: :parent_folder))

-      schema_documents =
-        ActiveStorage::Attachment.where(record_id: templates.map(&:id),
-                                        record_type: 'Template',
-                                        name: :documents,
-                                        uuid: templates.flat_map { |t| t.schema.pluck('attachment_uuid') })
-                                 .preload(:blob)
-
-      preview_image_attachments =
-        ActiveStorage::Attachment.joins(:blob)
-                                 .where(blob: { filename: ['0.png', '0.jpg'] })
-                                 .where(record_id: schema_documents.map(&:id),
-                                        record_type: 'ActiveStorage::Attachment',
-                                        name: :preview_images)
-                                 .preload(:blob)
+      schema_documents, dynamic_documents, preview_image_attachments = preload_relations(templates)

      expires_at = Accounts.link_expires_at(current_account)

@@ -30,6 +19,7 @@ module Api
        data: templates.map do |t|
          Templates::SerializeForApi.call(t,
                                          schema_documents: schema_documents.select { |e| e.record_id == t.id },
+                                          dynamic_documents:,
                                          preview_image_attachments:,
                                          expires_at:)
        end,
@@ -60,16 +50,19 @@ module Api

      archived = params.key?(:archived) ? params[:archived] : params.dig(:template, :archived)

-      if archived.in?([true, false])
+      if archived.in?([true, false]) && current_ability.can?(:destroy, @template)
        @template.archived_at = archived == true ? Time.current : nil
      end

      @template.update!(template_params)

-      SearchEntries.enqueue_reindex(@template)
+      SearchEntries.enqueue_reindex(@template) if @template.saved_change_to_name?

      WebhookUrls.enqueue_events(@template, 'template.updated')
-      WebhookUrls.enqueue_events(@template, 'template.archived') if archived == true
+
+      if @template.saved_change_to_archived_at? && @template.archived_at?
+        WebhookUrls.enqueue_events(@template, 'template.archived')
+      end

      render json: @template.as_json(only: %i[id updated_at])
    end
@@ -88,8 +81,49 @@ module Api

    private

+    def preload_relations(templates)
+      schema_documents =
+        ActiveStorage::Attachment.where(record_id: templates.map(&:id),
+                                        record_type: 'Template',
+                                        name: :documents,
+                                        uuid: templates.flat_map { |t| t.schema.pluck('attachment_uuid') })
+                                 .preload(:blob)
+
+      dynamic_document_uuids =
+        templates.flat_map { |t| t.schema.select { |item| item['dynamic'] }.pluck('attachment_uuid') }
+
+      dynamic_documents =
+        if dynamic_document_uuids.present?
+          DynamicDocument.where(template: templates.map(&:id))
+                         .where(uuid: dynamic_document_uuids)
+                         .preload(current_version: { document_attachment: :blob })
+                         .select(:id, :uuid, :template_id, :sha1, :created_at, :updated_at)
+        else
+          DynamicDocument.none
+        end
+
+      preview_attachment_ids =
+        schema_documents.map(&:id) + dynamic_documents.filter_map { |d| d.current_version&.document_attachment&.id }
+
+      preview_image_attachments =
+        ActiveStorage::Attachment.joins(:blob)
+                                 .where(blob: { filename: ['0.png', '0.jpg'] })
+                                 .where(record_id: preview_attachment_ids,
+                                        record_type: 'ActiveStorage::Attachment',
+                                        name: :preview_images)
+                                 .preload(:blob)
+
+      [schema_documents, dynamic_documents, preview_image_attachments]
+    end
+
    def filter_templates(templates, params)
-      templates = Templates.search(current_user, templates, params[:q])
+      templates =
+        if params[:shared].in?(['true', true])
+          Templates.search_shared(current_user, templates, params[:q])
+        else
+          Templates.search(current_user, templates, params[:q])
+        end
+
      templates = params[:archived].in?(['true', true]) ? templates.archived : templates.active
      templates = templates.where(external_id: params[:application_key]) if params[:application_key].present?
      templates = templates.where(external_id: params[:external_id]) if params[:external_id].present?
@@ -3,7 +3,7 @@
 class EmailSmtpSettingsController < ApplicationController
  before_action :load_encrypted_config
  authorize_resource :encrypted_config, only: :index
-  authorize_resource :encrypted_config, parent: false, only: :create
+  authorize_resource :encrypted_config, parent: false, only: %i[create destroy]

  def index; end

@@ -23,6 +23,12 @@ class EmailSmtpSettingsController < ApplicationController
    render :index, status: :unprocessable_content
  end

+  def destroy
+    @encrypted_config.destroy!
+
+    redirect_to settings_email_index_path, notice: I18n.t('smtp_settings_have_been_reset')
+  end
+
  private

  def load_encrypted_config
@@ -14,8 +14,7 @@ class EsignSettingsController < ApplicationController
  prepend_before_action :maybe_redirect_com, only: %i[show]

  before_action :load_encrypted_config
-  authorize_resource :encrypted_config, parent: false, only: %i[new create]
-  authorize_resource :encrypted_config, only: %i[update destroy show]
+  authorize_resource :encrypted_config, parent: false

  def show
    cert_data = @encrypted_config.value || {}
@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module Mcp
+  class CreateTemplateController < McpBaseController
+    SCHEMA = {
+      name: 'create_template',
+      title: 'Create Template',
+      description: 'Create a document template. Provide a URL to upload a PDF/DOCX file, or provide only a name ' \
+                   'to create an empty template and receive an edit URL where the file can be uploaded via the UI.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: {
+            type: 'string',
+            description: 'Template name (used as the template name and required when url is not provided)'
+          },
+          url: {
+            type: 'string',
+            description: 'Optional URL of a PDF or DOCX file to upload. If omitted, an empty template is ' \
+                         'created and the returned edit_url can be used to upload a file via the UI.'
+          }
+        },
+        required: %w[name]
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    }.freeze
+
+    # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+    def call
+      account = current_user.account
+
+      @template = Template.new(
+        account:,
+        author: current_user,
+        folder: account.default_template_folder,
+        source: :mcp,
+        name: mcp_params['name'].to_s.presence || 'New Template',
+        fields: [],
+        schema: []
+      )
+
+      authorize!(:create, @template)
+
+      if mcp_params['url'].present?
+        tempfile = Tempfile.new
+        tempfile.binmode
+        tempfile.write(DownloadUtils.call(mcp_params['url'], validate: true).body)
+        tempfile.rewind
+
+        filename = File.basename(URI.decode_www_form_component(mcp_params['url']))
+
+        file = ActionDispatch::Http::UploadedFile.new(
+          tempfile:,
+          filename:,
+          type: Marcel::MimeType.for(tempfile)
+        )
+
+        @template.name = mcp_params['name'].presence || File.basename(filename, '.*')
+        @template.save!
+
+        documents, = Templates::CreateAttachments.call(@template, { files: [file] }, extract_fields: true)
+        schema = documents.map { |doc| { attachment_uuid: doc.uuid, name: doc.filename.base } }
+
+        if @template.fields.blank?
+          @template.fields = Templates::ProcessDocument.normalize_attachment_fields(@template, documents)
+        end
+
+        @template.update!(schema:)
+      else
+        @template.save!
+      end
+
+      WebhookUrls.enqueue_events(@template, 'template.created')
+
+      SearchEntries.enqueue_reindex(@template)
+
+      render_tool_result(
+        id: @template.id,
+        name: @template.name,
+        edit_url: edit_template_url(@template)
+      )
+    end
+    # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
+  end
+end
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Mcp
+  class LoadTemplateController < McpBaseController
+    SCHEMA = {
+      name: 'load_template',
+      title: 'Load Template',
+      description: 'Load a template with its fields. Each field includes name, type, and the signing role name.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          template_id: {
+            type: 'integer',
+            description: 'Template identifier'
+          }
+        },
+        required: %w[template_id]
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    }.freeze
+
+    def call
+      @template = Template.accessible_by(current_ability).find(mcp_params['template_id'])
+
+      authorize!(:read, @template)
+
+      submitters_index = @template.submitters.index_by { |s| s['uuid'] }
+
+      roles = @template.submitters.pluck('name')
+
+      fields = @template.fields.filter_map do |field|
+        next if field['name'].blank?
+
+        {
+          name: field['name'],
+          type: field['type'],
+          role: submitters_index[field['submitter_uuid']]&.dig('name')
+        }
+      end
+
+      render_tool_result(
+        id: @template.id,
+        name: @template.name,
+        roles: roles,
+        fields: fields
+      )
+    end
+  end
+end
@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Mcp
+  class McpBaseController < ActionController::API
+    wrap_parameters false
+
+    before_action :authenticate_user!
+    before_action :verify_mcp_enabled!
+    check_authorization
+
+    before_action do
+      raise CanCan::AccessDenied unless can?(:manage, :mcp)
+    end
+
+    rescue_from CanCan::AccessDenied do
+      render_error(-32_603, 'Forbidden', status: :forbidden)
+    end
+
+    rescue_from ActiveRecord::RecordNotFound do
+      render_tool_error('Not found')
+    end
+
+    private
+
+    def default_url_options
+      Docuseal.default_url_options
+    end
+
+    def mcp_body
+      request.request_parameters
+    end
+
+    def mcp_params
+      mcp_body.dig('params', 'arguments') || {}
+    end
+
+    def render_result(result)
+      render json: { jsonrpc: '2.0', id: mcp_body['id'], result: }
+    end
+
+    def render_error(code, message, id: nil, status: :ok)
+      render json: { jsonrpc: '2.0', id:, error: { code:, message: } }, status:
+    end
+
+    def render_tool_result(data)
+      render_result(content: [{ type: 'text', text: data.to_json }])
+    end
+
+    def render_tool_error(message)
+      render_result(content: [{ type: 'text', text: message }], isError: true)
+    end
+
+    def authenticate_user!
+      render json: { error: 'Not authenticated' }, status: :unauthorized unless current_user
+    end
+
+    def verify_mcp_enabled!
+      return if Docuseal.multitenant?
+
+      return if AccountConfig.exists?(account_id: current_user.account_id,
+                                      key: AccountConfig::ENABLE_MCP_KEY,
+                                      value: true)
+
+      render json: { error: 'MCP is disabled' }, status: :forbidden
+    end
+
+    def current_user
+      @current_user ||= user_from_api_key
+    end
+
+    def user_from_api_key
+      token = request.headers['Authorization'].to_s[/\ABearer\s+(.+)\z/, 1]
+
+      return if token.blank?
+
+      sha256 = Digest::SHA256.hexdigest(token)
+
+      User.joins(:mcp_tokens).active.find_by(mcp_tokens: { sha256:, archived_at: nil })
+    end
+  end
+end
@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Mcp
+  class ProtocolController < McpBaseController
+    skip_authorization_check
+
+    def ok
+      head :ok
+    end
+
+    def initialize_request
+      render_result(
+        protocolVersion: '2025-11-25',
+        serverInfo: {
+          name: 'DocuSeal',
+          version: Docuseal.version.to_s
+        },
+        capabilities: {
+          tools: {
+            listChanged: false
+          }
+        }
+      )
+    end
+
+    def initialized_notification
+      head :accepted
+    end
+
+    def ping
+      render_result({})
+    end
+
+    def tools_list
+      render_result(tools: McpController::TOOLS)
+    end
+
+    def method_not_found
+      render_error(-32_601, "Method not found: #{mcp_body['method']}", id: mcp_body['id'])
+    end
+
+    def tool_not_found
+      render_error(-32_602, "Unknown tool: #{mcp_body.dig('params', 'name')}", id: mcp_body['id'])
+    end
+
+    def parse_error
+      render_error(-32_700, 'Parse error', status: :bad_request)
+    end
+  end
+end
@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Mcp
+  class SearchDocumentsController < McpBaseController
+    SCHEMA = {
+      name: 'search_documents',
+      title: 'Search Documents',
+      description: 'Search signed or pending documents by submitter name, email, phone, or template name',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          q: {
+            type: 'string',
+            description: 'Search by submitter name, email, phone, or template name'
+          },
+          limit: {
+            type: 'integer',
+            description: 'The number of results to return (default 10)'
+          }
+        },
+        required: %w[q]
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    }.freeze
+
+    def call
+      authorize!(:read, Submission)
+
+      submissions = Submissions.search(current_user, Submission.accessible_by(current_ability).active,
+                                       mcp_params['q'], search_template: true)
+
+      limit = mcp_params.fetch('limit', 10).to_i
+      limit = 10 if limit <= 0
+      limit = [limit, 100].min
+      submissions = submissions.preload(:submitters, :template)
+                               .order(id: :desc)
+                               .limit(limit)
+
+      data = submissions.map do |submission|
+        {
+          id: submission.id,
+          template_name: submission.template&.name,
+          status: Submissions::SerializeForApi.build_status(submission, submission.submitters),
+          submitters: submission.submitters.map do |s|
+            { email: s.email, name: s.name, phone: s.phone, status: s.status }
+          end,
+          documents_url: submission_url(submission.id)
+        }
+      end
+
+      render_tool_result(data)
+    end
+  end
+end
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Mcp
+  class SearchTemplatesController < McpBaseController
+    SCHEMA = {
+      name: 'search_templates',
+      title: 'Search Templates',
+      description: 'Search document templates by name',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          q: {
+            type: 'string',
+            description: 'Search query to filter templates by name'
+          },
+          limit: {
+            type: 'integer',
+            description: 'The number of templates to return (default 10)'
+          }
+        },
+        required: %w[q]
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    }.freeze
+
+    def call
+      authorize!(:read, Template)
+
+      templates = Templates.search(current_user, Template.accessible_by(current_ability).active, mcp_params['q'])
+
+      limit = mcp_params.fetch('limit', 10).to_i
+      limit = 10 if limit <= 0
+      limit = [limit, 100].min
+      templates = templates.order(id: :desc).limit(limit)
+
+      render_tool_result(templates.map { |t| { id: t.id, name: t.name } })
+    end
+  end
+end
@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+module Mcp
+  class SendDocumentsController < McpBaseController
+    SCHEMA = {
+      name: 'send_documents',
+      title: 'Send Documents',
+      description: 'Send a document template for signing to specified submitters',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          template_id: {
+            type: 'integer',
+            description: 'Template identifier'
+          },
+          submitters: {
+            type: 'array',
+            description: 'The list of submitters (signers)',
+            items: {
+              type: 'object',
+              properties: {
+                email: {
+                  type: 'string',
+                  description: 'Submitter email address'
+                },
+                name: {
+                  type: 'string',
+                  description: 'Submitter name'
+                },
+                phone: {
+                  type: 'string',
+                  description: 'Submitter phone number in E.164 format'
+                },
+                role: {
+                  type: 'string',
+                  description: 'Signing role name from the template'
+                },
+                fields: {
+                  type: 'array',
+                  description: 'Prefill field values for this submitter (fields become readonly)',
+                  items: {
+                    type: 'object',
+                    properties: {
+                      name: {
+                        type: 'string',
+                        description: 'Field name'
+                      },
+                      value: {
+                        description: 'Prefilled value for the field'
+                      }
+                    },
+                    required: %w[name value]
+                  }
+                }
+              }
+            }
+          }
+        },
+        required: %w[template_id submitters]
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    }.freeze
+
+    # rubocop:disable Metrics
+    def call
+      @template = Template.accessible_by(current_ability).find(mcp_params['template_id'])
+
+      authorize!(:read, @template)
+
+      return render_tool_error('Template has been archived') if @template.archived_at?
+
+      authorize!(:create, Submission.new(template: @template, account_id: current_user.account_id))
+
+      return render_tool_error('Template has no fields') if @template.fields.blank?
+
+      submitters = (mcp_params['submitters'] || []).map do |s|
+        attrs = s.slice('email', 'name', 'role', 'phone').compact_blank
+
+        fields = Array.wrap(s['fields']).filter_map do |f|
+          next if f['name'].blank?
+
+          { 'name' => f['name'], 'default_value' => f['value'], 'readonly' => true }
+        end
+
+        attrs['fields'] = fields if fields.present?
+
+        attrs.with_indifferent_access
+      end
+
+      submissions = Submissions.create_from_submitters(
+        template: @template,
+        user: current_user,
+        source: :mcp,
+        submitters_order: @template.preferences['submitters_order'].presence || 'random',
+        submissions_attrs: { submitters: },
+        params: { 'send_email' => true, 'submitters' => submitters }
+      )
+
+      return render_tool_error('No valid submitters provided') if submissions.blank?
+
+      WebhookUrls.enqueue_events(submissions, 'submission.created')
+
+      Submissions.send_signature_requests(submissions)
+
+      SearchEntries.enqueue_reindex(submissions)
+
+      submission = submissions.first
+
+      render_tool_result(id: submission.id, status: 'pending')
+    rescue Submissions::CreateFromSubmitters::BaseError => e
+      render_tool_error(e.message)
+    end
+    # rubocop:enable Metrics
+  end
+end
@@ -1,58 +1,44 @@
 # frozen_string_literal: true

-class McpController < ActionController::API
-  before_action :authenticate_user!
-  before_action :verify_mcp_enabled!
+class McpController < ActionController::Metal
+  TOOL_CONTROLLERS = {
+    'search_templates' => Mcp::SearchTemplatesController,
+    'load_template' => Mcp::LoadTemplateController,
+    'create_template' => Mcp::CreateTemplateController,
+    'send_documents' => Mcp::SendDocumentsController,
+    'search_documents' => Mcp::SearchDocumentsController
+  }.freeze

-  before_action do
-    authorize!(:manage, :mcp)
-  end
+  TOOLS = TOOL_CONTROLLERS.map { |_, controller| controller::SCHEMA }.freeze

  def call
-    return head :ok if request.raw_post.blank?
+    return Mcp::ProtocolController.dispatch(:ok, request, response) if request.raw_post.blank?

    body = JSON.parse(request.raw_post)
+    body = nil unless body.is_a?(Hash)

-    result = Mcp::HandleRequest.call(body, current_user, current_ability)
+    request.request_parameters = body || {}

-    if result
-      render json: result
-    else
-      head :accepted
-    end
-  rescue CanCan::AccessDenied
-    render json: { jsonrpc: '2.0', id: nil, error: { code: -32_603, message: 'Forbidden' } }, status: :forbidden
+    action =
+      case body&.dig('method')
+      when 'initialize' then :initialize_request
+      when 'notifications/initialized' then :initialized_notification
+      when 'ping' then :ping
+      when 'tools/list' then :tools_list
+      when 'tools/call'
+        tool = TOOL_CONTROLLERS[body.dig('params', 'name')]
+
+        return tool.dispatch(:call, request, response) if tool
+
+        :tool_not_found
+      else
+        :method_not_found
+      end
+
+    Mcp::ProtocolController.dispatch(action, request, response)
  rescue JSON::ParserError
-    render json: { jsonrpc: '2.0', id: nil, error: { code: -32_700, message: 'Parse error' } }, status: :bad_request
-  end
+    request.request_parameters = {}

-  private
-
-  def authenticate_user!
-    render json: { error: 'Not authenticated' }, status: :unauthorized unless current_user
-  end
-
-  def verify_mcp_enabled!
-    return if Docuseal.multitenant?
-
-    return if AccountConfig.exists?(account_id: current_user.account_id,
-                                    key: AccountConfig::ENABLE_MCP_KEY,
-                                    value: true)
-
-    render json: { error: 'MCP is disabled' }, status: :forbidden
-  end
-
-  def current_user
-    @current_user ||= user_from_api_key
-  end
-
-  def user_from_api_key
-    token = request.headers['Authorization'].to_s[/\ABearer\s+(.+)\z/, 1]
-
-    return if token.blank?
-
-    sha256 = Digest::SHA256.hexdigest(token)
-
-    User.joins(:mcp_tokens).active.find_by(mcp_tokens: { sha256:, archived_at: nil })
+    Mcp::ProtocolController.dispatch(:parse_error, request, response)
  end
 end
@@ -20,6 +20,8 @@ class MfaSetupController < ApplicationController

      redirect_to settings_profile_index_path, notice: I18n.t('2fa_has_been_configured')
    else
+      RateLimit.call("mfa-setup-otp-#{current_user.id}", limit: 5, ttl: 5.minutes, enabled: true)
+
      @provision_url = current_user.otp_provisioning_uri(current_user.email, issuer: Docuseal.product_name)

      @error_message = I18n.t('code_is_invalid')
@@ -34,6 +36,8 @@ class MfaSetupController < ApplicationController

      redirect_to settings_profile_index_path, notice: I18n.t('2fa_has_been_removed')
    else
+      RateLimit.call("mfa-setup-otp-#{current_user.id}", limit: 5, ttl: 5.minutes, enabled: true)
+
      @error_message = I18n.t('code_is_invalid')

      render turbo_stream: turbo_stream.replace(:modal, template: 'mfa_setup/edit'), status: :unprocessable_content
@@ -25,7 +25,10 @@ class PreviewDocumentPageController < ActionController::API
    preview_image = attachment.preview_images.joins(:blob)
                              .find_by(blob: { filename: ["#{params[:id]}.png", "#{params[:id]}.jpg"] })

-    return redirect_to preview_image.url, allow_other_host: true if preview_image
+    if preview_image
+      return redirect_to preview_image.url(time: ActiveStorage::Attachment.service_url_time),
+                         allow_other_host: true
+    end

    file_path =
      if attachment.service.name == :disk
@@ -37,11 +40,11 @@ class PreviewDocumentPageController < ActionController::API
    preview_image =
      Templates::ProcessDocument.generate_pdf_preview_from_file(attachment, file_path, params[:id].to_i)

-    redirect_to preview_image.url, allow_other_host: true
+    redirect_to preview_image.url(time: ActiveStorage::Attachment.service_url_time), allow_other_host: true
  end

  def find_or_create_document_tempfile_path(attachment)
-    file_path = "#{Dir.tmpdir}/#{attachment.uuid}"
+    file_path = "#{Dir.tmpdir}/attachment-#{Digest::SHA1.hexdigest("#{attachment.id}-#{attachment.uuid}")}"

    File.open(file_path, File::RDWR | File::CREAT, 0o644) do |f|
      f.flock(File::LOCK_EX)
@@ -1,6 +1,14 @@
 # frozen_string_literal: true

 class RevealAccessTokenController < ApplicationController
+  rate_limit to: 4, within: 1.minute, only: %i[create], by: -> { current_user.id }, with: lambda {
+    Rollbar.error('Rate limit api key') if defined?(Rollbar)
+
+    render turbo_stream: turbo_stream.replace(:modal, template: 'reveal_access_token/show',
+                                                      locals: { error_message: I18n.t(:too_many_attempts) }),
+           status: :unprocessable_content
+  }
+
  def show
    authorize!(:manage, current_user.access_token)
  end
@@ -14,22 +14,22 @@ class SendSubmissionEmailController < ApplicationController
      template = Template.find_by!(slug: params[:template_slug])

      @submitter =
-        Submitter.completed.where(submission: template.submissions).find_by!(email: params[:email].to_s.downcase)
+        Submitter.completed.where(submission: template.submissions).find_by(email: params[:email].to_s.downcase)
    elsif params[:submission_slug]
-      submission = Submission.find_by(slug: params[:submission_slug])
+      submission = Submission.find_by!(slug: params[:submission_slug])

-      if submission
-        @submitter = Submitter.completed.find_by(submission: submission, email: params[:email].to_s.downcase)
-      end
+      @submitter = submission.submitters.order(:completed_at).find_by(email: params[:email].to_s.downcase)

      return redirect_to submissions_preview_completed_path(params[:submission_slug], status: :error) unless @submitter
    else
-      @submitter = Submitter.completed.find_by!(slug: params[:submitter_slug])
+      @submitter = Submitter.find_by!(slug: params[:submitter_slug])
    end

-    RateLimit.call("send-email-#{@submitter.id}", limit: 2, ttl: 5.minutes)
+    if @submitter && completed_submitter?(@submitter)
+      RateLimit.call("send-email-#{@submitter.id}", limit: 2, ttl: 5.minutes)

-    SubmitterMailer.documents_copy_email(@submitter, sig: true).deliver_later! if can_send?(@submitter)
+      SubmitterMailer.documents_copy_email(@submitter, sig: true).deliver_later! if can_send?(@submitter)
+    end

    respond_to do |f|
      f.html { render :success }
@@ -39,6 +39,10 @@ class SendSubmissionEmailController < ApplicationController

  private

+  def completed_submitter?(submitter)
+    submitter.completed_at? || (submitter.viewer? && submitter.submission.completed_at?)
+  end
+
  def can_send?(submitter)
    return false if submitter.account.archived_at?
    return false if EmailEvent.exists?(tag: :submitter_documents_copy, email: submitter.email, emailable: submitter,
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class SettingsController < ApplicationController
+  skip_authorization_check
+
+  def index; end
+end
@@ -93,20 +93,34 @@ class StartFormController < ApplicationController

    SearchEntries.enqueue_reindex(submitter)

-    return unless submitter.submission.expire_at?
+    expire_at = submitter.submission.expire_at

-    ProcessSubmissionExpiredJob.perform_at(submitter.submission.expire_at, 'submission_id' => submitter.submission_id)
+    return unless expire_at
+
+    ProcessSubmissionExpiredJob.perform_at(expire_at, 'submission_id' => submitter.submission_id,
+                                                      'expire_at' => expire_at.to_i)
  end

  def load_resubmit_submitter
    @resubmit_submitter =
      if params[:resubmit].present? && !params[:resubmit].in?([true, 'true'])
-        Submitter.find_by(slug: params[:resubmit])
+        submitter = Submitter.find_by(slug: params[:resubmit])
+
+        submitter if submitter && can_resubmit?(submitter)
      end
  end

+  def can_resubmit?(submitter)
+    submitter.completed_at? && submitter.completed_at > 14.days.ago &&
+      %w[api embed mcp].exclude?(submitter.submission.source) &&
+      submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false
+  end
+
  def authorize_start!
-    return redirect_to start_form_path(@template.slug) if @template.archived_at?
+    is_archived = @template.archived_at? || @template.account.archived_at?
+
+    return redirect_to submit_form_path(@resubmit_submitter.slug) if @resubmit_submitter && is_archived
+    return redirect_to start_form_path(@template.slug) if is_archived

    return if @resubmit_submitter
    return if @template.shared_link? || (current_user && current_ability.can?(:read, @template))
@@ -127,8 +141,7 @@ class StartFormController < ApplicationController

    submitter ||=
      Submitter
-      .where(submission: template.submissions.where(expire_at: Time.current..)
-                                 .or(template.submissions.where(expire_at: nil)).where(archived_at: nil))
+      .where(submission: template.submissions.non_expired.active)
      .order(id: :desc)
      .where(declined_at: nil)
      .where(external_id: nil)
@@ -136,6 +149,8 @@ class StartFormController < ApplicationController
      .then { |rel| params[:resubmit].present? || params[:selfsign].present? ? rel.where(completed_at: nil) : rel }
      .find_or_initialize_by(find_params)

+    submitter = Submitter.new(find_params) if submitter.submission&.completed_at? && submitter.viewer?
+
    submitter.name = required_params['name'] if submitter.new_record?

    unless @resubmit_submitter
@@ -24,5 +24,7 @@ class SubmissionEventsController < ApplicationController

  load_and_authorize_resource :submission

-  def index; end
+  def index
+    render :index, layout: 'plain'
+  end
 end
@@ -7,17 +7,27 @@ class SubmissionsArchivedController < ApplicationController
    @submissions = @submissions.left_joins(:template)
    @submissions = @submissions.where.not(archived_at: nil)
                               .or(@submissions.where.not(templates: { archived_at: nil }))
-                               .preload(:template_accesses, :created_by_user, template: :author)
+                               .preload(:template_accesses, :created_by_user)

    @submissions = Submissions.search(current_user, @submissions, params[:q], search_template: true)
    @submissions = Submissions::Filter.call(@submissions, current_user, params)

-    @submissions = if params[:completed_at_from].present? || params[:completed_at_to].present?
-                     @submissions.order(Submitter.arel_table[:completed_at].maximum.desc)
-                   else
-                     @submissions.order(id: :desc)
-                   end
+    @submissions =
+      if params[:status] == 'completed' || params[:completed_at_from].present? || params[:completed_at_to].present?
+        @submissions.order(completed_at: :desc)
+      else
+        @submissions.order(id: :desc)
+      end

-    @pagy, @submissions = pagy_auto(@submissions.preload(submitters: :start_form_submission_events))
+    @pagy, @submissions = pagy_auto(@submissions.select_for_list.preload(submitters: :start_form_submission_events))
+
+    template_scope = @submissions.all?(&:template_submitters) ? Template.select_for_list : nil
+
+    ActiveRecord::Associations::Preloader.new(records: @submissions,
+                                              associations: :template,
+                                              scope: template_scope).call
+
+    ActiveRecord::Associations::Preloader.new(records: @submissions.filter_map(&:template),
+                                              associations: :author).call
  end
 end
@@ -1,9 +1,7 @@
 # frozen_string_literal: true

 class SubmissionsController < ApplicationController
-  before_action :load_template, only: %i[new create]
-  authorize_resource :template, only: %i[new create]
-
+  load_and_authorize_resource :template, only: %i[new create]
  load_and_authorize_resource :submission, only: %i[show destroy]

  prepend_before_action :maybe_redirect_com, only: %i[show]
@@ -23,7 +21,7 @@ class SubmissionsController < ApplicationController
  def show
    @submission = Submissions.preload_with_pages(@submission)

-    unless @submission.submitters.all?(&:completed_at?)
+    unless @submission.completed_at?
      ActiveRecord::Associations::Preloader.new(
        records: [@submission],
        associations: [{ submitters: :start_form_submission_events }]
@@ -35,9 +33,13 @@ class SubmissionsController < ApplicationController

  def new
    authorize!(:new, Submission)
+
+    render :new, layout: 'plain'
  end

  def create
+    return redirect_to template_path(@template), alert: I18n.t('template_has_been_archived') if @template.archived_at?
+
    save_template_message(@template, params) if params[:save_message] == '1'

    [params.delete(:subject), params.delete(:body)] if params[:is_custom_message] != '1'
@@ -87,6 +89,8 @@ class SubmissionsController < ApplicationController
  private

  def create_submissions(template, submissions_params, params)
+    normalize_message_submitter_uuids!(params)
+
    submissions_attrs = submissions_params[:submission].to_h.values

    submissions_attrs, _, new_fields =
@@ -112,7 +116,22 @@ class SubmissionsController < ApplicationController
    params.permit(submission: { submitters: [:uuid, :email, :phone, :name, { values: {} }] })
  end

-  def load_template
-    @template = Template.accessible_by(current_ability).find(params[:template_id])
+  def normalize_message_submitter_uuids!(params)
+    return if params[:request_email_per_submitter] == '1'
+
+    uuids = params[:email_message_submitter_uuids]
+
+    return if uuids.blank?
+    return if params[:subject].blank? && params[:body].blank?
+
+    params[:submitter_preferences] =
+      Array.wrap(uuids).index_with { { 'subject' => params[:subject], 'body' => params[:body] } }
+
+    params[:request_email_per_submitter] = '1'
+
+    params.delete(:subject)
+    params.delete(:body)
+
+    params
  end
 end
@@ -8,17 +8,27 @@ class SubmissionsDashboardController < ApplicationController

    @submissions = @submissions.where(archived_at: nil)
                               .where(templates: { archived_at: nil })
-                               .preload(:template_accesses, :created_by_user, template: :author)
+                               .preload(:template_accesses, :created_by_user)

    @submissions = Submissions.search(current_user, @submissions, params[:q], search_template: true)
    @submissions = Submissions::Filter.call(@submissions, current_user, params)

-    @submissions = if params[:completed_at_from].present? || params[:completed_at_to].present?
-                     @submissions.order(Submitter.arel_table[:completed_at].maximum.desc)
-                   else
-                     @submissions.order(id: :desc)
-                   end
+    @submissions =
+      if params[:status] == 'completed' || params[:completed_at_from].present? || params[:completed_at_to].present?
+        @submissions.order(completed_at: :desc)
+      else
+        @submissions.order(id: :desc)
+      end

-    @pagy, @submissions = pagy_auto(@submissions.preload(submitters: :start_form_submission_events))
+    @pagy, @submissions = pagy_auto(@submissions.select_for_list.preload(submitters: :start_form_submission_events))
+
+    template_scope = @submissions.all?(&:template_submitters) ? Template.select_for_list : nil
+
+    ActiveRecord::Associations::Preloader.new(records: @submissions,
+                                              associations: :template,
+                                              scope: template_scope).call
+
+    ActiveRecord::Associations::Preloader.new(records: @submissions.filter_map(&:template),
+                                              associations: :author).call
  end
 end
@@ -25,7 +25,7 @@ class SubmissionsPreviewController < ApplicationController

    raise ActionController::RoutingError, I18n.t('not_found') if @submission.account.archived_at?

-    if !@submission.submitters.all?(&:completed_at?) && !signature_valid &&
+    if !@submission.completed_at? && !signature_valid &&
       (!current_user || !current_ability.can?(:read, @submission))
      raise ActionController::RoutingError, I18n.t('not_found')
    end
@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+class SubmissionsResendEmailController < ApplicationController
+  load_and_authorize_resource :submission
+
+  before_action do
+    authorize!(:manage, :resend_all)
+    authorize!(:update, @submission)
+  end
+
+  def create
+    submitters = @submission.submitters.reject(&:completed_at?).select { |s| s.email.present? && !s.declined_at? }
+
+    if Docuseal.multitenant?
+      recent_submitter_ids =
+        SubmissionEvent.where(submitter_id: submitters.map(&:id),
+                              event_type: 'send_email',
+                              created_at: 10.hours.ago..Time.current).pluck(:submitter_id).to_set
+
+      submitters = submitters.reject { |s| recent_submitter_ids.include?(s.id) }
+    end
+
+    submitters.each do |submitter|
+      SendSubmitterInvitationEmailJob.perform_async('submitter_id' => submitter.id)
+
+      submitter.sent_at ||= Time.current
+      submitter.save!
+    end
+
+    notice =
+      if submitters.empty?
+        I18n.t('email_has_been_sent_already')
+      else
+        I18n.t('emails_have_been_sent_to_n_recipients', count: submitters.size)
+      end
+
+    redirect_back(fallback_location: submission_path(@submission), notice:)
+  end
+end
@@ -4,6 +4,8 @@ class SubmissionsUnarchiveController < ApplicationController
  load_and_authorize_resource :submission

  def create
+    authorize!(:destroy, @submission)
+
    @submission.update!(archived_at: nil)

    redirect_to submission_path(@submission), notice: I18n.t('submission_has_been_unarchived')
@@ -19,7 +19,7 @@ class SubmitFormCompletedDownloadController < ApplicationController

    @submitter ||= Submitter.find_by!(slug: submitter_slug)

-    Submissions::EnsureResultGenerated.call(@submitter)
+    Submissions::EnsureResultGenerated.call(@submitter) if @submitter.completed_at?

    last_submitter = @submitter.submission.submitters.where.not(completed_at: nil).order(:completed_at).last

@@ -28,11 +28,7 @@ class SubmitFormCompletedDownloadController < ApplicationController
    Submissions::EnsureResultGenerated.call(last_submitter)

    if !signature_valid && !current_user_submitter?(last_submitter)
-      unless Submitters::AuthorizedForForm.call(@submitter, current_user, request)
-        Rollbar.info("2FA download error: #{last_submitter.id}") if defined?(Rollbar)
-
-        return head :not_found
-      end
+      return head :not_found unless Submitters::AuthorizedForForm.call(@submitter, current_user, request)

      if last_submitter.completed_at < TTL.ago
        Rollbar.info("TTL: #{last_submitter.id}") if defined?(Rollbar)
@@ -18,7 +18,10 @@ class SubmitFormController < ApplicationController
    submission = @submitter.submission

    return render :email_2fa unless Submitters::AuthorizedForForm.pass_email_2fa?(@submitter, request)
-    return redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at?
+
+    if @submitter.completed_at? || submission.completed_at?
+      return redirect_to submit_form_completed_path(@submitter.slug)
+    end

    @form_configs = Submitters::FormConfigs.call(@submitter, CONFIG_KEYS)

@@ -71,6 +74,12 @@ class SubmitFormController < ApplicationController
                    status: :unprocessable_content
    end

+    if @submitter.viewer?
+      Rollbar.warning("Submit viewer: #{@submitter.id}") if defined?(Rollbar)
+
+      return render json: { error: I18n.t('form_is_view_only') }, status: :unprocessable_content
+    end
+
    Submitters::SubmitValues.call(@submitter, params, request)

    head :ok
@@ -7,11 +7,13 @@ class SubmitFormDeclineController < ApplicationController
  before_action :load_submitter

  def create
-    return redirect_to submit_form_path(@submitter.slug) if @submitter.declined_at? ||
+    return redirect_to submit_form_path(@submitter.slug) if declining_disabled? ||
+                                                            @submitter.declined_at? ||
                                                            @submitter.completed_at? ||
                                                            @submitter.submission.archived_at? ||
                                                            @submitter.submission.expired? ||
                                                            @submitter.submission.template&.archived_at? ||
+                                                            @submitter.viewer? ||
                                                            !Submitters::AuthorizedForForm.call(@submitter,
                                                                                                current_user,
                                                                                                request)
@@ -35,6 +37,10 @@ class SubmitFormDeclineController < ApplicationController

  private

+  def declining_disabled?
+    @submitter.account.account_configs.find_by(key: AccountConfig::ALLOW_TO_DECLINE_KEY)&.value == false
+  end
+
  def load_submitter
    @submitter = Submitter.find_by!(slug: params[:submit_form_slug])
  end
@@ -12,6 +12,7 @@ class SubmitFormDelegateController < ApplicationController
                                                            @submitter.submission.archived_at? ||
                                                            @submitter.submission.expired? ||
                                                            @submitter.submission.template&.archived_at? ||
+                                                            @submitter.viewer? ||
                                                            !Submitters::AuthorizedForForm.call(@submitter,
                                                                                                current_user,
                                                                                                request)
@@ -14,6 +14,7 @@ class SubmitFormDownloadController < ApplicationController
    return head :unprocessable_content if @submitter.declined_at? ||
                                          @submitter.submission.archived_at? ||
                                          @submitter.submission.expired? ||
+                                          @submitter.submission.completed_at? ||
                                          @submitter.submission.template&.archived_at? ||
                                          AccountConfig.exists?(account_id: @submitter.account_id,
                                                                key: AccountConfig::ALLOW_TO_PARTIAL_DOWNLOAD_KEY,
@@ -12,6 +12,8 @@ class SubmitFormDrawSignatureController < ApplicationController

    return redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at?

+    return redirect_to submit_form_path(@submitter.slug) if @submitter.viewer?
+
    if @submitter.submission.template&.archived_at? || @submitter.submission.archived_at? ||
       !Submitters::AuthorizedForForm.call(@submitter, current_user, request)
      return redirect_to submit_form_path(@submitter.slug)
@@ -5,12 +5,12 @@ class SubmitFormInviteController < ApplicationController
  skip_authorization_check

  def create
-    submitter = Submitter.find_by!(slug: params[:submit_form_slug])
+    @submitter = Submitter.find_by!(slug: params[:submit_form_slug])

-    return head :unprocessable_content unless can_invite?(submitter)
+    return head :unprocessable_content unless can_invite?(@submitter)

-    invite_submitters = filter_invite_submitters(submitter, 'invite_by_uuid')
-    optional_invite_submitters = filter_invite_submitters(submitter, 'optional_invite_by_uuid')
+    invite_submitters = filter_invite_submitters(@submitter, 'invite_by_uuid')
+    optional_invite_submitters = filter_invite_submitters(@submitter, 'optional_invite_by_uuid')

    ApplicationRecord.transaction do
      (invite_submitters + optional_invite_submitters).each do |item|
@@ -21,18 +21,18 @@ class SubmitFormInviteController < ApplicationController

        email = Submissions.normalize_email(attrs[:email])

-        submitter.submission.submitters.create!(uuid: attrs[:uuid], email:, account_id: submitter.account_id)
+        @submitter.submission.submitters.create!(uuid: attrs[:uuid], email:, account_id: @submitter.account_id)

-        SubmissionEvents.create_with_tracking_data(submitter, 'invite_party', request, { uuid: submitter.uuid })
+        SubmissionEvents.create_with_tracking_data(@submitter, 'invite_party', request, { uuid: @submitter.uuid })
      end

-      submitter.submission.update!(submitters_order: :preserved)
+      @submitter.submission.update!(submitters_order: :preserved)
    end

-    submitter.submission.submitters.reload
+    @submitter.submission.submitters.reload

-    if invite_submitters.all? { |s| submitter.submission.submitters.any? { |e| e.uuid == s['uuid'] } }
-      Submitters::SubmitValues.call(submitter, ActionController::Parameters.new(completed: 'true'), request)
+    if invite_submitters.all? { |s| @submitter.submission.submitters.any? { |e| e.uuid == s['uuid'] } }
+      Submitters::SubmitValues.call(@submitter, ActionController::Parameters.new(completed: 'true'), request)

      head :ok
    else
@@ -48,6 +48,7 @@ class SubmitFormInviteController < ApplicationController
      !submitter.submission.archived_at? &&
      !submitter.submission.expired? &&
      !submitter.submission.template&.archived_at? &&
+      !submitter.viewer? &&
      Submitters::AuthorizedForForm.call(submitter, current_user, request)
  end

@@ -5,19 +5,13 @@ class SubmitFormMetadataController < ApplicationController
  skip_authorization_check

  def index
-    submitter = Submitter.find_by!(slug: params[:submit_form_slug])
+    @submitter = Submitter.find_by!(slug: params[:submit_form_slug])

-    return head :not_found if submitter.declined_at? ||
-                              submitter.completed_at? ||
-                              submitter.submission.archived_at? ||
-                              submitter.submission.expired? ||
-                              submitter.submission.template&.archived_at? ||
-                              submitter.account.archived_at? ||
-                              !Submitters::AuthorizedForForm.call(submitter, current_user, request)
+    return head :not_found unless authorized_submitter?(@submitter)

-    submission = submitter.submission
+    submission = @submitter.submission
    values = submission.submitters.reduce({}) { |acc, sub| acc.merge(sub.values) }
-    schema = Submissions.filtered_conditions_schema(submission, values:, include_submitter_uuid: submitter.uuid)
+    schema = Submissions.filtered_conditions_schema(submission, values:, include_submitter_uuid: @submitter.uuid)

    documents = schema.filter_map do |item|
      submission.schema_documents.find { |a| a.uuid == item['attachment_uuid'] }
@@ -34,4 +28,17 @@ class SubmitFormMetadataController < ApplicationController

    render json: { text_runs: }
  end
+
+  private
+
+  def authorized_submitter?(submitter)
+    !submitter.declined_at? &&
+      !submitter.completed_at? &&
+      !submitter.submission.archived_at? &&
+      !submitter.submission.completed_at? &&
+      !submitter.submission.expired? &&
+      !submitter.submission.template&.archived_at? &&
+      !submitter.account.archived_at? &&
+      Submitters::AuthorizedForForm.call(submitter, current_user, request)
+  end
 end
@@ -5,21 +5,21 @@ class SubmitFormValuesController < ApplicationController
  skip_authorization_check

  def index
-    submitter = Submitter.find_by!(slug: params[:submit_form_slug])
+    @submitter = Submitter.find_by!(slug: params[:submit_form_slug])

-    return render json: {} if submitter.completed_at? ||
-                              submitter.declined_at? ||
-                              submitter.submission.template&.archived_at? ||
-                              submitter.submission.archived_at? ||
-                              submitter.submission.expired? ||
-                              !Submitters::AuthorizedForForm.call(submitter, current_user, request)
+    return render json: {} if @submitter.completed_at? ||
+                              @submitter.declined_at? ||
+                              @submitter.submission.template&.archived_at? ||
+                              @submitter.submission.archived_at? ||
+                              @submitter.submission.expired? ||
+                              !Submitters::AuthorizedForForm.call(@submitter, current_user, request)

-    value = submitter.values[params['field_uuid']]
-    attachment = submitter.attachments.where(created_at: params[:after]..).find_by(uuid: value) if value.present?
+    value = @submitter.values[params['field_uuid']]
+    attachment = @submitter.attachments.where(created_at: params[:after]..).find_by(uuid: value) if value.present?

    render json: {
      value:,
      attachment: attachment&.as_json(only: %i[uuid created_at], methods: %i[url filename content_type])
-    }, head: :ok
+    }
  end
 end
@@ -8,12 +8,14 @@ class SubmittersController < ApplicationController
      if @submitter.preferences['email_message_uuid'].present?
        @submitter.account.email_messages.find_by(uuid: @submitter.preferences['email_message_uuid'])
      end
+
+    render :edit, layout: 'plain'
  end

  def update
    submission = @submitter.submission

-    if @submitter.submission_events.exists?(event_type: 'start_form') || submission.archived_at? || submission.expired?
+    unless submitter_editable?(submission)
      return redirect_back fallback_location: submission_path(submission), alert: I18n.t('submitter_cannot_be_updated')
    end

@@ -48,11 +50,17 @@ class SubmittersController < ApplicationController

  private

+  def submitter_editable?(submission)
+    !@submitter.submission_events.exists?(event_type: 'start_form') &&
+      !@submitter.completed_at? && !@submitter.declined_at? && !submission.completed_at? &&
+      !submission.archived_at? && !submission.expired? && !submission.template&.archived_at?
+  end
+
  def maybe_resend_email_sms(submitter, params)
    if params[:send_email] == '1' && submitter.email.present?
      is_sent_recently = Docuseal.multitenant? &&
                         EmailEvent.exists?(email: submitter.email,
-                                            tag: 'submitter_invitation',
+                                            tag: %w[submitter_invitation submitter_view_invitation],
                                            emailable: submitter,
                                            event_type: 'send',
                                            created_at: 4.hours.ago..Time.current)
@@ -5,6 +5,8 @@ class SubmittersResubmitController < ApplicationController

  def update
    return redirect_to submit_form_path(slug: @submitter.slug) if @submitter.email != current_user.email
+    return redirect_to submit_form_path(slug: @submitter.slug) if @submitter.completed_at.blank? ||
+                                                                  @submitter.completed_at < 1.month.ago

    submission = @submitter.account.submissions.new(created_by_user: current_user,
                                                    submitters_order: :preserved,
@@ -4,6 +4,8 @@ class SubmittersSendEmailController < ApplicationController
  load_and_authorize_resource :submitter

  def create
+    authorize!(:update, @submitter)
+
    if Docuseal.multitenant? && SubmissionEvent.exists?(submitter: @submitter,
                                                        event_type: 'send_email',
                                                        created_at: 10.hours.ago..Time.current)
@@ -10,6 +10,8 @@ class TemplateDocumentsController < ApplicationController
  end

  def create
+    authorize!(:update, @template)
+
    if params[:blobs].blank? && params[:files].blank?
      return render json: { error: I18n.t('file_is_missing') }, status: :unprocessable_content
    end
@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+class TemplateDocumentsCropController < ApplicationController
+  load_and_authorize_resource :template
+  before_action :load_attachment
+
+  rescue_from Leptonica::LeptonicaError do
+    render json: { error: I18n.t(:unable_to_save) }, status: :unprocessable_content
+  end
+
+  def index
+    render json: { corners: Leptonica.detect_document_corners(@attachment.download) }
+  end
+
+  def create
+    authorize!(:update, @template)
+
+    document = Templates::CreateDocumentCrop.call(@template, @attachment, crop_params)
+
+    render json: {
+      document: document.as_json(
+        methods: %i[metadata signed_key],
+        include: {
+          preview_images: { methods: %i[url metadata filename] }
+        }
+      )
+    }
+  end
+
+  private
+
+  def load_attachment
+    @attachment = @template.documents_attachments.find_by!(uuid: params[:attachment_uuid])
+  end
+
+  def crop_params
+    params.permit(:scan, :rotate, :flip_h, :flip_v, corners: [%i[x y]])
+  end
+end
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+class TemplateDocumentsModifyController < ApplicationController
+  load_and_authorize_resource :template
+
+  def create
+    authorize!(:update, @template)
+
+    documents_layout =
+      params.require(:documents).map do |item|
+        item.permit(:attachment_uuid,
+                    pages: [:attachment_uuid, :page, :rotate,
+                            { redact: [%i[x y w h color]], replaced_page: %i[attachment_uuid page] }]).to_h
+      end
+
+    Templates::ModifyDocuments.call(@template, documents_layout)
+
+    render json: {
+      schema: @template.schema,
+      fields: @template.fields,
+      submitters: @template.submitters,
+      documents: @template.schema_documents.reload.preload(:blob, preview_images_attachments: :blob).as_json(
+        methods: %i[metadata signed_key],
+        include: {
+          preview_images: { methods: %i[url metadata filename] }
+        }
+      )
+    }
+  rescue Templates::ModifyDocuments::InvalidLayout
+    render json: { error: I18n.t(:unable_to_save) }, status: :unprocessable_content
+  end
+end
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class TemplateDocumentsPageObjectsController < ApplicationController
+  load_and_authorize_resource :template
+
+  def index
+    attachment = @template.documents_attachments.find_by!(uuid: params[:attachment_uuid])
+
+    render json: Templates::ModifyDocuments.page_objects(attachment, params[:page].to_i)
+  end
+end
@@ -30,9 +30,11 @@ class TemplateFoldersController < ApplicationController
          (@template_folders.size < 7 ? 9 : 6)
        end

-      @pagy, @templates = pagy_auto(@templates, limit:)
+      @pagy, @templates = pagy_auto(@templates.select_for_list, limit:)

-      load_related_submissions if params[:q].present? && @templates.blank?
+      if params[:q].present? && @templates.blank?
+        @related_submissions_pagy, @related_submissions = load_related_submissions(@template_folder)
+      end
    else
      @pagy, @template_folders = pagy(@template_folders, limit: FOLDERS_PER_PAGE)

@@ -55,11 +57,10 @@ class TemplateFoldersController < ApplicationController

  def selected_order
    @selected_order ||=
-      if cookies.permanent[:dashboard_templates_order].blank? ||
-         (cookies.permanent[:dashboard_templates_order] == 'used_at' && can?(:manage, :countless))
+      if can?(:manage, :countless)
        'created_at'
      else
-        cookies.permanent[:dashboard_templates_order]
+        cookies.permanent[:dashboard_templates_order].presence || 'created_at'
      end
  end

@@ -67,20 +68,20 @@ class TemplateFoldersController < ApplicationController
    params.require(:template_folder).permit(:name)
  end

-  def load_related_submissions
-    @related_submissions =
+  def load_related_submissions(template_folder)
+    related_submissions =
      Submission.accessible_by(current_ability)
                .where(archived_at: nil)
                .where(template_id: current_account.templates.active
-                                                   .where(folder: [@template_folder, *@template_folder.subfolders])
+                                                   .where(folder: [template_folder, *template_folder.subfolders])
                                                   .select(:id))
                .preload(:template_accesses, :created_by_user,
                         template: :author,
                         submitters: :start_form_submission_events)

-    @related_submissions = Submissions.search(current_user, @related_submissions, params[:q])
-                                      .order(id: :desc)
+    related_submissions = Submissions.search(current_user, related_submissions, params[:q])
+                                     .order(id: :desc)

-    @related_submissions_pagy, @related_submissions = pagy_auto(@related_submissions, limit: 5)
+    pagy_auto(related_submissions.select_for_list, limit: 5)
  end
 end
@@ -10,11 +10,17 @@ class TemplatesArchivedController < ApplicationController

    @templates = Templates.search(current_user, @templates, params[:q])

-    @pagy, @templates = pagy_auto(@templates, limit: 12)
+    @pagy, @templates = pagy_auto(@templates.select_for_list, limit: 12)

    return unless params[:q].present? && @templates.blank?

-    @related_submissions =
+    @related_submissions_pagy, @related_submissions = load_related_submissions
+  end
+
+  private
+
+  def load_related_submissions
+    related_submissions =
      Submission.accessible_by(current_ability)
                .joins(:template)
                .where.not(templates: { archived_at: nil })
@@ -22,9 +28,9 @@ class TemplatesArchivedController < ApplicationController
                         template: :author,
                         submitters: :start_form_submission_events)

-    @related_submissions = Submissions.search(current_user, @related_submissions, params[:q])
-                                      .order(id: :desc)
+    related_submissions = Submissions.search(current_user, related_submissions, params[:q])
+                                     .order(id: :desc)

-    @related_submissions_pagy, @related_submissions = pagy_auto(@related_submissions, limit: 5)
+    pagy_auto(related_submissions.select_for_list, limit: 5)
  end
 end
@@ -10,12 +10,12 @@ class TemplatesArchivedSubmissionsController < ApplicationController
    @submissions = Submissions::Filter.call(@submissions, current_user, params)

    @submissions = if params[:completed_at_from].present? || params[:completed_at_to].present?
-                     @submissions.order(Submitter.arel_table[:completed_at].maximum.desc)
+                     @submissions.order(completed_at: :desc)
                   else
                     @submissions.order(id: :desc)
                   end

-    @pagy, @submissions = pagy_auto(@submissions.preload(submitters: :start_form_submission_events))
+    @pagy, @submissions = pagy_auto(@submissions.select_for_list.preload(submitters: :start_form_submission_events))
  rescue ActiveRecord::RecordNotFound
    redirect_to root_path
  end
@@ -13,6 +13,9 @@ class TemplatesCloneAndReplaceController < ApplicationController

    cloned_template = Templates::Clone.call(@template, author: current_user)
    cloned_template.name = File.basename(params[:files].first.original_filename, '.*')
+
+    authorize!(:create, cloned_template)
+
    cloned_template.save!

    documents = Templates::ReplaceAttachments.call(cloned_template, params, extract_fields: true)
@@ -14,31 +14,23 @@ class TemplatesController < ApplicationController
    submissions = Submissions::Filter.filter_by_status(submissions, params)

    submissions = if params[:completed_at_from].present? || params[:completed_at_to].present?
-                    submissions.order(Submitter.arel_table[:completed_at].maximum.desc)
+                    submissions.order(completed_at: :desc)
                  else
                    submissions.order(id: :desc)
                  end

-    @pagy, @submissions = pagy_auto(submissions.preload(:template_accesses, submitters: :start_form_submission_events))
+    @pagy, @submissions =
+      pagy_auto(submissions.select_for_list.preload(:template_accesses, submitters: :start_form_submission_events))
  rescue ActiveRecord::RecordNotFound
    redirect_to root_path
  end

-  def new; end
+  def new
+    render :new, layout: 'plain'
+  end

  def edit
-    ActiveRecord::Associations::Preloader.new(
-      records: [@template],
-      associations: [{ schema_documents: [:blob, { preview_images_attachments: :blob }] }]
-    ).call
-
-    @template_data =
-      @template.as_json.merge(
-        documents: @template.schema_documents.as_json(
-          methods: %i[metadata signed_key],
-          include: { preview_images: { methods: %i[url metadata filename] } }
-        )
-      ).to_json
+    @template_data = Templates.serialize_for_builder(@template)

    render :edit, layout: 'plain'
  end
@@ -11,86 +11,126 @@ class TemplatesDashboardController < ApplicationController
  helper_method :selected_order

  def index
+    @default_folder = current_account.default_template_folder
+
    @template_folders =
      TemplateFolders.filter_active_folders(@template_folders.where(parent_folder_id: nil), @templates)

+    @template_folders = @template_folders.where.not(id: @default_folder.id) if params[:q].blank?
+
    @template_folders = TemplateFolders.search(@template_folders, params[:q])
    @template_folders = TemplateFolders.sort(@template_folders, current_user, selected_order)

-    @pagy, @template_folders = pagy(
-      @template_folders,
-      limit: FOLDERS_PER_PAGE,
-      page: @template_folders.count > SHOW_TEMPLATES_FOLDERS_THRESHOLD ? params[:page] : 1
-    )
+    @shared_templates = Templates.shared(current_user).active
+
+    @pagy, @template_folders, @show_default_folder, @show_shared_folder, @show_shared_inline =
+      load_folders(@template_folders, @templates, @shared_templates)

    if @pagy.count > SHOW_TEMPLATES_FOLDERS_THRESHOLD
      @templates = @templates.none
    else
-      @template_folders = @template_folders.reject { |e| e.name == TemplateFolder::DEFAULT_NAME }
-      @templates = filter_templates(@templates).preload(:author, :template_accesses)
-      @templates = Templates::Order.call(@templates, current_user, selected_order)
+      if @show_shared_inline
+        @templates = @shared_templates.preload(:template_sharings)
+      else
+        @templates = @templates.active
+        @templates = @templates.where(folder_id: @default_folder.id) if params[:q].blank?
+      end

-      limit =
-        if @template_folders.size < 4
-          TEMPLATES_PER_PAGE
-        else
-          (@template_folders.size < 7 ? 9 : 6)
-        end
+      @pagy, @templates = load_templates(@templates.select_for_list, @pagy.count,
+                                         show_shared_inline: @show_shared_inline)

-      @pagy, @templates = pagy_auto(@templates, limit:)
-
-      load_related_submissions if params[:q].present? && @templates.blank?
+      if params[:q].present? && @templates.blank?
+        @related_submissions_pagy, @related_submissions = load_related_submissions
+      end
    end
  end

  private

-  def filter_templates(templates)
-    rel = templates.active
+  def load_templates(templates, folders_count, show_shared_inline: false)
+    templates = templates.preload(:author, :template_accesses)

-    if params[:q].blank?
-      if Docuseal.multitenant? ? current_account.testing? : current_account.linked_account_account
-        shared_account_ids = [current_user.account_id]
-        shared_account_ids << TemplateSharing::ALL_ID if !Docuseal.multitenant? && !current_account.testing?
-
-        shared_template_ids = TemplateSharing.where(account_id: shared_account_ids).select(:template_id)
-
-        rel = Template.where(
-          Template.arel_table[:id].in(
-            rel.where(folder_id: current_account.default_template_folder.id).select(:id).arel
-               .union(:all, shared_template_ids.arel)
-          )
-        )
+    templates =
+      if show_shared_inline
+        Templates.search_shared(current_user, templates, params[:q])
      else
-        rel = rel.where(folder_id: current_account.default_template_folder.id)
+        Templates.search(current_user, templates, params[:q])
      end
-    end

-    Templates.search(current_user, rel, params[:q])
+    templates = Templates::Order.call(templates, current_user, selected_order)
+
+    limit =
+      if folders_count < 4
+        TEMPLATES_PER_PAGE
+      else
+        (folders_count < 7 ? 9 : 6)
+      end
+
+    pagy_auto(templates, limit:)
+  end
+
+  def load_folders(template_folders, templates, shared_templates)
+    if params[:q].present?
+      pagy(template_folders, limit: FOLDERS_PER_PAGE,
+                             page: template_folders.count > SHOW_TEMPLATES_FOLDERS_THRESHOLD ? params[:page] : 1)
+    else
+      load_folders_with_pinned(template_folders, templates, shared_templates)
+    end
+  end
+
+  def load_folders_with_pinned(template_folders, templates, shared_templates)
+    folders_count = template_folders.count
+
+    shared_exists = shared_templates.exists?
+    default_has_templates = templates.active.exists?(folder_id: current_account.default_template_folder.id)
+
+    show_inline_folders =
+      folders_count + (shared_exists && default_has_templates ? 1 : 0) <= SHOW_TEMPLATES_FOLDERS_THRESHOLD
+
+    show_shared_inline = shared_exists && !default_has_templates && show_inline_folders
+
+    show_shared_in_grid = shared_exists && !show_shared_inline
+    show_default_in_grid = !show_inline_folders && default_has_templates
+
+    pinned_count = (show_default_in_grid ? 1 : 0) + (show_shared_in_grid ? 1 : 0)
+
+    pagy = Pagy::Offset.new(count: folders_count + pinned_count,
+                            page: show_inline_folders ? 1 : [params[:page].to_s.to_i, 1].max,
+                            limit: FOLDERS_PER_PAGE,
+                            raise_range_error: true)
+
+    show_default_folder = show_default_in_grid && pagy.page == 1
+    show_shared_folder = show_shared_in_grid && pagy.page == 1
+
+    folder_offset = pagy.page == 1 ? 0 : pagy.offset - pinned_count
+    folder_limit = pagy.page == 1 ? FOLDERS_PER_PAGE - pinned_count : FOLDERS_PER_PAGE
+
+    template_folders = template_folders.offset(folder_offset).limit(folder_limit)
+
+    [pagy, template_folders, show_default_folder, show_shared_folder, show_shared_inline]
  end

  def selected_order
    @selected_order ||=
-      if cookies.permanent[:dashboard_templates_order].blank? ||
-         (cookies.permanent[:dashboard_templates_order] == 'used_at' && can?(:manage, :countless))
+      if can?(:manage, :countless)
        'created_at'
      else
-        cookies.permanent[:dashboard_templates_order]
+        cookies.permanent[:dashboard_templates_order].presence || 'created_at'
      end
  end

  def load_related_submissions
-    @related_submissions = Submission.accessible_by(current_ability)
-                                     .left_joins(:template)
-                                     .where(archived_at: nil)
-                                     .where(templates: { archived_at: nil })
-                                     .preload(:template_accesses, :created_by_user,
-                                              template: :author,
-                                              submitters: :start_form_submission_events)
+    related_submissions = Submission.accessible_by(current_ability)
+                                    .left_joins(:template)
+                                    .where(archived_at: nil)
+                                    .where(templates: { archived_at: nil })
+                                    .preload(:template_accesses, :created_by_user,
+                                             template: :author,
+                                             submitters: :start_form_submission_events)

-    @related_submissions = Submissions.search(current_user, @related_submissions, params[:q])
-                                      .order(id: :desc)
+    related_submissions = Submissions.search(current_user, related_submissions, params[:q])
+                                     .order(id: :desc)

-    @related_submissions_pagy, @related_submissions = pagy_auto(@related_submissions, limit: 5)
+    pagy_auto(related_submissions.select_for_list, limit: 5)
  end
 end
@@ -16,7 +16,12 @@ class TemplatesDetectFieldsController < ApplicationController
    page_number = params[:page].presence&.to_i

    documents.each do |document|
-      io = StringIO.new(document.download)
+      io =
+        if document.image?
+          StringIO.new(document.preview_images.joins(:blob).find_by(blob: { filename: ['0.png', '0.jpg'] }).download)
+        else
+          StringIO.new(document.download)
+        end

      Templates::DetectFields.call(io, attachment: document, page_number:) do |(attachment_uuid, page, fields)|
        sse.write({ attachment_uuid:, page:, fields: })
@@ -6,6 +6,8 @@ class TemplatesFoldersController < ApplicationController
  def edit; end

  def update
+    authorize!(:update, @template)
+
    name = [params[:parent_name], params[:name]].compact_blank.join(' / ')

    @template.folder = TemplateFolders.find_or_create_by_name(current_user, name)
@@ -13,11 +13,13 @@ class TemplatesFormPreviewController < ApplicationController

    @submitter.submission.submitters = @template.submitters.map { |item| Submitter.new(uuid: item['uuid']) }

+    Submissions::CreateFromSubmitters.maybe_set_dynamic_documents(@submitter.submission, preview: true)
+
    Submissions.preload_with_pages(@submitter.submission)

    @attachments_index = ActiveStorage::Attachment.where(record: @submitter.submission.submitters, name: :attachments)
                                                  .preload(:blob).index_by(&:uuid)

-    @form_configs = Submitters::FormConfigs.call(@submitter)
+    @form_configs = Submitters::FormConfigs.call(@submitter, SubmitFormController::CONFIG_KEYS)
  end
 end
@@ -5,6 +5,8 @@ class TemplatesPreferencesController < ApplicationController

  RESETTABLE_PREFERENCE_KEYS = {
    AccountConfig::SUBMITTER_INVITATION_EMAIL_KEY => %w[request_email_subject request_email_body submitters],
+    AccountConfig::SUBMITTER_VIEW_INVITATION_EMAIL_KEY => %w[invitation_view_email_subject
+                                                             invitation_view_email_body],
    AccountConfig::SUBMITTER_INVITATION_REMINDER_EMAIL_KEY => %w[invitation_reminder_email_subject
                                                                 invitation_reminder_email_body],
    AccountConfig::SUBMITTER_DOCUMENTS_COPY_EMAIL_KEY => %w[documents_copy_email_subject documents_copy_email_body],
@@ -12,7 +14,9 @@ class TemplatesPreferencesController < ApplicationController
                                                       completed_notification_email_body]
  }.freeze

-  def show; end
+  def show
+    render :show, layout: 'plain'
+  end

  def create
    authorize!(:update, @template)
@@ -48,12 +52,12 @@ class TemplatesPreferencesController < ApplicationController
  def template_params
    params.require(:template).permit(
      preferences: %i[bcc_completed request_email_subject request_email_body
+                      invitation_view_email_subject invitation_view_email_body
                      invitation_reminder_email_subject invitation_reminder_email_body
                      documents_copy_email_subject documents_copy_email_body
                      documents_copy_email_enabled documents_copy_email_attach_audit
                      documents_copy_email_attach_documents documents_copy_email_reply_to
-                      completed_notification_email_attach_documents
-                      completed_redirect_url validate_unique_submitters
+                      completed_notification_email_attach_documents completed_redirect_url validate_unique_submitters
                      require_all_submitters submitters_order require_phone_2fa require_email_2fa
                      default_expire_at_duration shared_link_2fa default_expire_at request_email_enabled
                      completed_notification_email_subject completed_notification_email_body
@@ -4,18 +4,7 @@ class TemplatesPreviewController < ApplicationController
  load_and_authorize_resource :template

  def show
-    ActiveRecord::Associations::Preloader.new(
-      records: [@template],
-      associations: [{ schema_documents: { preview_images_attachments: :blob } }]
-    ).call
-
-    @template_data =
-      @template.as_json.merge(
-        documents: @template.schema_documents.as_json(
-          methods: %i[metadata signed_key],
-          include: { preview_images: { methods: %i[url metadata filename] } }
-        )
-      ).to_json
+    @template_data = Templates.serialize_for_builder(@template)

    render :show, layout: 'plain'
  end
@@ -4,6 +4,8 @@ class TemplatesRestoreController < ApplicationController
  load_and_authorize_resource :template

  def create
+    authorize!(:destroy, @template)
+
    @template.update!(archived_at: nil)

    WebhookUrls.enqueue_events(@template, 'template.updated')
@@ -3,7 +3,9 @@
 class TemplatesShareLinkController < ApplicationController
  load_and_authorize_resource :template

-  def show; end
+  def show
+    render :show, layout: 'plain'
+  end

  def create
    authorize!(:update, @template)
@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+class TemplatesSharedController < ApplicationController
+  def index
+    authorize!(:read, Template)
+
+    @is_archived = params[:archived] == 'true'
+
+    @templates = Templates.shared(current_user)
+
+    @has_archived = !@is_archived && @templates.archived.exists?
+
+    @templates = @is_archived ? @templates.archived : @templates.active
+
+    @templates = @templates.preload(:author, :template_accesses, :template_sharings)
+                           .order(id: :desc)
+
+    @templates = Templates.search_shared(current_user, @templates, params[:q])
+
+    @pagy, @templates = pagy_auto(@templates.select_for_list, limit: 12)
+
+    return unless params[:q].present? && @templates.blank?
+
+    @related_submissions_pagy, @related_submissions = load_related_submissions(is_archived: @is_archived)
+  end
+
+  private
+
+  def load_related_submissions(is_archived:)
+    shared_templates = Templates.shared(current_user)
+    shared_templates = is_archived ? shared_templates.archived : shared_templates.active
+
+    related_submissions =
+      Submission.accessible_by(current_ability)
+                .where(template_id: shared_templates.select(:id))
+                .preload(:template_accesses, :created_by_user,
+                         template: :author,
+                         submitters: :start_form_submission_events)
+
+    related_submissions = related_submissions.where(archived_at: nil) unless is_archived
+
+    related_submissions = Submissions.search(current_user, related_submissions, params[:q])
+                                     .order(id: :desc)
+
+    pagy_auto(related_submissions.select_for_list, limit: 5)
+  end
+end
@@ -5,7 +5,9 @@ class TemplatesUploadsController < ApplicationController

  layout 'plain'

-  def show; end
+  def show
+    redirect_to root_path if params[:url].blank?
+  end

  def create
    url_params = create_file_params_from_url if params[:url].present?
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class TemplatesVersionsController < ApplicationController
+  load_and_authorize_resource :template
+
+  def index
+    versions = @template.template_versions.order(id: :desc).preload(:author)
+
+    render json: versions.as_json(TemplateVersions::SERIALIZE_PARAMS)
+  end
+
+  def show
+    version = @template.template_versions.find(params[:id])
+
+    render json: TemplateVersions.serialize(version)
+  end
+
+  def create
+    authorize!(:update, @template)
+
+    TemplateVersions.find_or_create_for(@template, author: current_user)
+
+    head :ok
+  end
+end
@@ -3,7 +3,7 @@
 class TestingAccountsController < ApplicationController
  skip_authorization_check only: :destroy

-  def show
+  def create
    authorize!(:manage, current_account)
    authorize!(:manage, current_user)

@@ -11,6 +11,12 @@ class UserInitialsController < ApplicationController

    return redirect_to settings_profile_index_path, notice: I18n.t('unable_to_save_initials') if file.blank?

+    extension = File.extname(file.original_filename).delete_prefix('.').downcase
+
+    if Submitters::DANGEROUS_EXTENSIONS.include?(extension)
+      raise Submitters::MaliciousFileExtension, "File type '.#{extension}' is not allowed."
+    end
+
    blob = ActiveStorage::Blob.create_and_upload!(io: file.open,
                                                  filename: file.original_filename,
                                                  content_type: file.content_type)
@@ -11,6 +11,12 @@ class UserSignaturesController < ApplicationController

    return redirect_to settings_profile_index_path, notice: I18n.t('unable_to_save_signature') if file.blank?

+    extension = File.extname(file.original_filename).delete_prefix('.').downcase
+
+    if Submitters::DANGEROUS_EXTENSIONS.include?(extension)
+      raise Submitters::MaliciousFileExtension, "File type '.#{extension}' is not allowed."
+    end
+
    blob = ActiveStorage::Blob.create_and_upload!(io: file.open,
                                                  filename: file.original_filename,
                                                  content_type: file.content_type)
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class WebhookHmacController < ApplicationController
+  load_and_authorize_resource :webhook_url, parent: false
+
+  def show; end
+end
@@ -21,6 +21,7 @@ import SubmittersAutocomplete from './elements/submitter_autocomplete'
 import FolderAutocomplete from './elements/folder_autocomplete'
 import SignatureForm from './elements/signature_form'
 import SubmitForm from './elements/submit_form'
+import ConvertUpload from './elements/convert_upload'
 import PromptPassword from './elements/prompt_password'
 import EmailsTextarea from './elements/emails_textarea'
 import ToggleSubmit from './elements/toggle_submit'
@@ -41,19 +42,23 @@ import RequiredCheckboxGroup from './elements/required_checkbox_group'
 import PageContainer from './elements/page_container'
 import EmailEditor from './elements/email_editor'
 import MarkdownEditor from './elements/markdown_editor'
+import HtmlEditor from './elements/html_editor'
 import MountOnClick from './elements/mount_on_click'
 import RemoveOnEvent from './elements/remove_on_event'
 import ScrollTo from './elements/scroll_to'
 import SetValue from './elements/set_value'
 import ReviewForm from './elements/review_form'
 import ShowOnValue from './elements/show_on_value'
-import CustomValidation from './elements/custom_validation'
 import ToggleClasses from './elements/toggle_classes'
 import AutosizeField from './elements/autosize_field'
 import GoogleDriveFilePicker from './elements/google_drive_file_picker'
 import OpenModal from './elements/open_modal'
 import BarChart from './elements/bar_chart'
 import FieldCondition from './elements/field_condition'
+import ConfirmUpload from './elements/confirm_upload'
+import ScrollFade from './elements/scroll_fade'
+import OpenModalMobile from './elements/open_modal_mobile'
+import HistoryBack from './elements/history_back'

 import * as TurboInstantClick from './lib/turbo_instant_click'

@@ -112,6 +117,7 @@ safeRegisterElement('submitters-autocomplete', SubmittersAutocomplete)
 safeRegisterElement('folder-autocomplete', FolderAutocomplete)
 safeRegisterElement('signature-form', SignatureForm)
 safeRegisterElement('submit-form', SubmitForm)
+safeRegisterElement('convert-upload', ConvertUpload)
 safeRegisterElement('prompt-password', PromptPassword)
 safeRegisterElement('emails-textarea', EmailsTextarea)
 safeRegisterElement('toggle-cookies', ToggleCookies)
@@ -133,23 +139,28 @@ safeRegisterElement('required-checkbox-group', RequiredCheckboxGroup)
 safeRegisterElement('page-container', PageContainer)
 safeRegisterElement('email-editor', EmailEditor)
 safeRegisterElement('markdown-editor', MarkdownEditor)
+safeRegisterElement('html-editor', HtmlEditor)
 safeRegisterElement('mount-on-click', MountOnClick)
 safeRegisterElement('remove-on-event', RemoveOnEvent)
 safeRegisterElement('scroll-to', ScrollTo)
 safeRegisterElement('set-value', SetValue)
 safeRegisterElement('review-form', ReviewForm)
 safeRegisterElement('show-on-value', ShowOnValue)
-safeRegisterElement('custom-validation', CustomValidation)
 safeRegisterElement('toggle-classes', ToggleClasses)
 safeRegisterElement('autosize-field', AutosizeField)
 safeRegisterElement('google-drive-file-picker', GoogleDriveFilePicker)
 safeRegisterElement('open-modal', OpenModal)
 safeRegisterElement('bar-chart', BarChart)
 safeRegisterElement('field-condition', FieldCondition)
+safeRegisterElement('confirm-upload', ConfirmUpload)
+safeRegisterElement('scroll-fade', ScrollFade)
+safeRegisterElement('open-modal-mobile', OpenModalMobile)
+safeRegisterElement('history-back', HistoryBack)

 safeRegisterElement('template-builder', class extends HTMLElement {
  connectedCallback () {
    document.addEventListener('turbo:submit-end', this.onSubmit)
+    document.addEventListener('turbo:before-cache', this.onBeforeCache)

    this.appElem = document.createElement('div')

@@ -160,6 +171,7 @@ safeRegisterElement('template-builder', class extends HTMLElement {
    this.app = createApp(TemplateBuilder, {
      template,
      customFields: reactive(JSON.parse(this.dataset.customFields || '[]')),
+      dateFormats: JSON.parse(this.dataset.dateFormats || '[]'),
      dynamicDocuments: reactive(JSON.parse(this.dataset.dynamicDocuments || '[]')),
      backgroundColor: '#faf7f5',
      locale: this.dataset.locale,
@@ -170,11 +182,16 @@ safeRegisterElement('template-builder', class extends HTMLElement {
      withLogo: this.dataset.withLogo !== 'false',
      withFieldsDetection: this.dataset.withFieldsDetection === 'true',
      withDetectExistingFields: this.dataset.withDetectExistingFields === 'true',
+      withRevisions: true,
+      withRevisionsMenu: this.dataset.withRevisionsMenu === 'true',
      editable: this.dataset.editable !== 'false',
      authenticityToken: document.querySelector('meta[name="csrf-token"]')?.content,
      withCustomFields: true,
      withPayment: this.dataset.withPayment === 'true',
-      isPaymentConnected: this.dataset.isPaymentConnected === 'true',
+      isStripeConnected: this.dataset.isPaymentConnected === 'true' || this.dataset.isStripeConnected === 'true',
+      withStripe: this.dataset.withStripe !== 'false',
+      withPaypal: this.dataset.withPaypal === 'true',
+      isPaypalConnected: this.dataset.isPaypalConnected === 'true',
      withFormula: this.dataset.withFormula === 'true',
      withSendButton: this.dataset.withSendButton !== 'false',
      withSignYourselfButton: this.dataset.withSignYourselfButton !== 'false',
@@ -195,15 +212,46 @@ safeRegisterElement('template-builder', class extends HTMLElement {
  }

  onSubmit = (e) => {
-    if (e.detail.success && e.detail?.formSubmission?.formElement?.id === 'submitters_form') {
-      e.detail.fetchResponse.response.json().then((data) => {
-        this.component.template.submitters = data.submitters
-      })
+    if (e.detail.success) {
+      if (e.detail?.formSubmission?.formElement?.id === 'submitters_form') {
+        e.detail.fetchResponse.response.json().then((data) => {
+          this.component.template.submitters = data.submitters
+        })
+      }
+
+      if (e.detail?.formSubmission?.formElement?.action?.endsWith('/prefillable_fields')) {
+        e.detail.fetchResponse.response.text().then((data) => {
+          const doc = new DOMParser().parseFromString(data, 'text/html')
+          const fragment = doc.querySelector('turbo-stream template').content
+
+          const prefillableUuidsIndex = {}
+
+          fragment.querySelectorAll('[name="field_uuid"]').forEach((field) => {
+            prefillableUuidsIndex[field.value] = true
+          })
+
+          this.component.template.fields.forEach((field) => {
+            if (prefillableUuidsIndex[field.uuid]) {
+              field.prefillable = true
+              field.readonly = true
+            } else if (field.prefillable) {
+              delete field.prefillable
+              delete field.readonly
+            }
+          })
+        })
+      }
    }
  }

+  onBeforeCache = () => {
+    this.app?.unmount()
+    this.appElem?.remove()
+  }
+
  disconnectedCallback () {
    document.removeEventListener('turbo:submit-end', this.onSubmit)
+    document.removeEventListener('turbo:before-cache', this.onBeforeCache)

    this.app?.unmount()
    this.appElem?.remove()
@@ -212,6 +260,8 @@ safeRegisterElement('template-builder', class extends HTMLElement {

 safeRegisterElement('import-list', class extends HTMLElement {
  connectedCallback () {
+    document.addEventListener('turbo:before-cache', this.onBeforeCache)
+
    this.appElem = document.createElement('div')

    this.app = createApp(ImportList, {
@@ -226,7 +276,14 @@ safeRegisterElement('import-list', class extends HTMLElement {
    this.appendChild(this.appElem)
  }

+  onBeforeCache = () => {
+    this.app?.unmount()
+    this.appElem?.remove()
+  }
+
  disconnectedCallback () {
+    document.removeEventListener('turbo:before-cache', this.onBeforeCache)
+
    this.app?.unmount()
    this.appElem?.remove()
  }
@@ -114,6 +114,13 @@ button[disabled] .enabled, button.btn-disabled .enabled {
  bottom: auto;
 }

+@media (hover: none), (pointer: coarse) {
+  .tooltip-no-touch:before,
+  .tooltip-no-touch:after {
+    display: none;
+  }
+}
+
 .autocomplete {
  background: white;
  z-index: 1000;
@@ -11,6 +11,7 @@ window.customElements.define('draw-signature', class extends HTMLElement {
    this.resizeObserver = new ResizeObserver(() => {
      requestAnimationFrame(() => {
        if (!this.canvas) return
+        if (!this.canvas.parentNode?.clientWidth) return

        const { width, height } = this.canvas

@@ -89,7 +90,7 @@ window.customElements.define('draw-signature', class extends HTMLElement {
  }

  redrawCanvas (oldWidth, oldHeight) {
-    if (this.pad && !this.pad.isEmpty() && oldWidth > 0 && oldHeight > 0) {
+    if (this.pad && !this.pad.isEmpty() && oldWidth > 0 && oldHeight > 0 && this.canvas.width > 0 && this.canvas.height > 0) {
      const sx = this.canvas.width / oldWidth
      const sy = this.canvas.height / oldHeight

@@ -0,0 +1,27 @@
+import { target, targetable } from '@github/catalyst/lib/targetable'
+
+export default targetable(class extends HTMLElement {
+  static [target.static] = [
+    'prompt',
+    'processing',
+    'logo'
+  ]
+
+  connectedCallback () {
+    this.form.addEventListener('submit', this.onSubmit)
+  }
+
+  disconnectedCallback () {
+    this.form.removeEventListener('submit', this.onSubmit)
+  }
+
+  onSubmit = () => {
+    this.prompt.classList.add('hidden')
+    this.processing.classList.remove('hidden')
+    this.logo.classList.add('animate-bounce')
+  }
+
+  get form () {
+    return this.querySelector('form')
+  }
+})
@@ -0,0 +1,73 @@
+export function convertImage (sourceFile, targetType, quality) {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader()
+
+    reader.onload = function (event) {
+      const img = new Image()
+
+      img.onload = function () {
+        const canvas = document.createElement('canvas')
+        const ctx = canvas.getContext('2d')
+
+        canvas.width = img.width
+        canvas.height = img.height
+        ctx.drawImage(img, 0, 0)
+        canvas.toBlob(function (blob) {
+          const ext = targetType === 'image/jpeg' ? '.jpg' : '.png'
+          const newFile = new File([blob], sourceFile.name.replace(/\.\w+$/, ext), { type: targetType })
+          resolve(newFile)
+        }, targetType, quality)
+      }
+
+      img.onerror = () => reject(new Error(`browser cannot decode ${sourceFile.type || sourceFile.name}`))
+
+      img.src = event.target.result
+    }
+    reader.onerror = reject
+    reader.readAsDataURL(sourceFile)
+  })
+}
+
+export async function convertImagesInInput (input) {
+  if (!input.files || input.files.length === 0) return
+
+  const dt = new DataTransfer()
+  let didConvert = false
+
+  for (const file of Array.from(input.files)) {
+    let converted = file
+
+    try {
+      if (['image/bmp', 'image/vnd.microsoft.icon', 'image/svg+xml', 'image/gif'].includes(file.type)) {
+        converted = await convertImage(file, 'image/png')
+        didConvert = true
+      } else if (['image/heic', 'image/heif', 'image/heic-sequence', 'image/heif-sequence', 'image/avif', 'image/avif-sequence', 'image/webp'].includes(file.type)) {
+        converted = await convertImage(file, 'image/jpeg', 0.9)
+        didConvert = true
+      }
+    } catch (e) {
+      alert(e.message)
+    }
+
+    dt.items.add(converted)
+  }
+
+  if (didConvert) {
+    input.files = dt.files
+  }
+}
+
+export default class extends HTMLElement {
+  connectedCallback () {
+    const input = this.querySelector('input[type="file"]')
+    const form = input.form
+
+    input.addEventListener('change', async () => {
+      await convertImagesInInput(input)
+
+      form.querySelector('[type="submit"]')?.setAttribute('disabled', true)
+
+      form.requestSubmit()
+    })
+  }
+}
@@ -1,14 +0,0 @@
-export default class extends HTMLElement {
-  connectedCallback () {
-    const input = this.querySelector('input')
-    const invalidMessage = this.dataset.invalidMessage || ''
-
-    input.addEventListener('invalid', () => {
-      input.setCustomValidity(input.value ? invalidMessage : '')
-    })
-
-    input.addEventListener('input', () => {
-      input.setCustomValidity('')
-    })
-  }
-}
@@ -1,4 +1,5 @@
 import { target, targets, targetable } from '@github/catalyst/lib/targetable'
+import { convertImagesInInput } from './convert_upload'

 const loadingIconHtml = `<svg xmlns="http://www.w3.org/2000/svg" class="animate-spin" width="44" height="44" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
  <path stroke="none" d="M0 0h24v24H0z" fill="none" />
@@ -150,12 +151,16 @@ export default targetable(class extends HTMLElement {
    if (!this.isLoading) this.hideDraghover()
  }

-  uploadFiles (files, url) {
+  async uploadFiles (files, url) {
    this.isLoading = true

    this.form.action = url

-    this.form.querySelector('[type="file"]').files = files
+    const input = this.form.querySelector('[type="file"]')
+
+    input.files = files
+
+    await convertImagesInInput(input)

    this.form.querySelector('[type="submit"]').click()
  }
@@ -9,8 +9,9 @@ function loadCodeMirror () {
      import(/* webpackChunkName: "email-editor" */ '@codemirror/commands'),
      import(/* webpackChunkName: "email-editor" */ '@codemirror/language'),
      import(/* webpackChunkName: "email-editor" */ '@codemirror/lang-html'),
+      import(/* webpackChunkName: "email-editor" */ '@codemirror/lint'),
      import(/* webpackChunkName: "email-editor" */ '@specious/htmlflow')
-    ]).then(([view, commands, language, html, htmlflow]) => {
+    ]).then(([view, commands, language, html, lint, htmlflow]) => {
      return {
        minimalSetup: [
          commands.history(),
@@ -19,6 +20,8 @@ function loadCodeMirror () {
        ],
        EditorView: view.EditorView,
        html: html.html,
+        htmlLanguage: html.htmlLanguage,
+        linter: lint.linter,
        htmlflow: htmlflow.default || htmlflow
      }
    })
@@ -46,6 +49,70 @@ export default targetable(class extends HTMLElement {

    this.previewViewTab.addEventListener('click', this.showPreviewView)
    this.codeViewTab.addEventListener('click', this.showCodeView)
+
+    this.form = this.closest('form')
+    this.form?.addEventListener('submit', this.validateOnSubmit)
+  }
+
+  disconnectedCallback () {
+    this.form?.removeEventListener('submit', this.validateOnSubmit)
+  }
+
+  validateOnSubmit = (e) => {
+    if (!this.htmlLanguage) return
+
+    const bodyType = this.form.querySelector('input[name$="[body_type]"]:checked')?.value
+
+    if (bodyType && bodyType !== 'html') return
+
+    const diagnostics = this.buildDiagnostics(this.input.value)
+
+    if (diagnostics.length === 0) return
+
+    e.preventDefault()
+
+    this.showCodeView()
+
+    const pos = Math.min(diagnostics[0].from, this.editorView.state.doc.length)
+
+    this.editorView.dispatch({ selection: { anchor: pos }, scrollIntoView: true })
+    this.editorView.focus()
+
+    alert(diagnostics[0].message)
+  }
+
+  buildDiagnostics (value) {
+    const diagnostics = []
+
+    if (!value.trim()) return diagnostics
+
+    if (!/^\s*(<!doctype[^>]*>\s*)?<html/i.test(value)) {
+      diagnostics.push({
+        from: 0,
+        to: Math.min(5, value.length),
+        severity: 'error',
+        message: 'The email template must start with the <html> tag'
+      })
+    }
+
+    const seen = new Set()
+
+    this.htmlLanguage.parser.parse(value).iterate({
+      enter: (node) => {
+        if (!node.type.isError || seen.has(node.from) || seen.size >= 20) return
+
+        seen.add(node.from)
+
+        diagnostics.push({
+          from: node.from,
+          to: Math.min(node.to + 1, value.length),
+          severity: 'error',
+          message: 'The email template contains invalid HTML'
+        })
+      }
+    })
+
+    return diagnostics
  }

  showCodeView = () => {
@@ -76,7 +143,9 @@ export default targetable(class extends HTMLElement {
    this.input = this.querySelector('input[type="hidden"]')
    this.input.style.display = 'none'

-    const { EditorView, minimalSetup, html, htmlflow } = await loadCodeMirror()
+    const { EditorView, minimalSetup, html, htmlLanguage, linter, htmlflow } = await loadCodeMirror()
+
+    this.htmlLanguage = htmlLanguage

    this.editorView = new EditorView({
      doc: this.input.value,
@@ -85,8 +154,11 @@ export default targetable(class extends HTMLElement {
        html(),
        minimalSetup,
        EditorView.lineWrapping,
+        linter((view) => this.buildDiagnostics(view.state.doc.toString()), { delay: 600 }),
        EditorView.updateListener.of(update => {
-          if (update.docChanged) this.input.value = update.state.doc.toString()
+          if (update.docChanged) {
+            this.input.value = update.state.doc.toString()
+          }
        }),
        EditorView.theme({
          '&': {
@@ -1,5 +1,6 @@
 import { actionable } from '@github/catalyst/lib/actionable'
 import { target, targetable } from '@github/catalyst/lib/targetable'
+import { convertImagesInInput } from './convert_upload'

 export default actionable(targetable(class extends HTMLElement {
  static [target.static] = [
@@ -38,17 +39,21 @@ export default actionable(targetable(class extends HTMLElement {
    this.classList.add('border-base-300', 'hover:bg-base-200/30')
  }

-  onDrop (e) {
+  async onDrop (e) {
    e.preventDefault()

    this.input.files = e.dataTransfer.files

-    this.uploadFiles(e.dataTransfer.files)
+    await convertImagesInInput(this.input)
+
+    this.uploadFiles(this.input.files)
  }

-  onSelectFiles (e) {
+  async onSelectFiles (e) {
    e.preventDefault()

+    await convertImagesInInput(this.input)
+
    this.uploadFiles(this.input.files)
  }

@@ -0,0 +1,15 @@
+export default class extends HTMLElement {
+  connectedCallback () {
+    this.addEventListener('click', this.onClick)
+  }
+
+  disconnectedCallback () {
+    this.removeEventListener('click', this.onClick)
+  }
+
+  onClick = (e) => {
+    e.preventDefault()
+
+    window.history.back()
+  }
+}
@@ -0,0 +1,667 @@
+import { target, targetable } from '@github/catalyst/lib/targetable'
+import { actionable } from '@github/catalyst/lib/actionable'
+import { LinkTooltip } from './markdown_editor'
+
+async function loadTiptap () {
+  const [core, document, text, hardBreak, gapcursor, dropcursor, extensions, pmState, pmView] = await Promise.all([
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/core'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/extension-document'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/extension-text'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/extension-hard-break'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/extension-gapcursor'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/extension-dropcursor'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/extensions'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/pm/state'),
+    import(/* webpackChunkName: "markdown-editor" */ '@tiptap/pm/view')
+  ])
+
+  return {
+    Editor: core.Editor,
+    Extension: core.Extension,
+    Node: core.Node,
+    Mark: core.Mark,
+    Document: document.default || document,
+    Text: text.default || text,
+    HardBreak: hardBreak.default || hardBreak,
+    Gapcursor: gapcursor.default || gapcursor,
+    Dropcursor: dropcursor.default || dropcursor,
+    UndoRedo: extensions.UndoRedo,
+    Plugin: pmState.Plugin,
+    Decoration: pmView.Decoration,
+    DecorationSet: pmView.DecorationSet
+  }
+}
+
+const editorStylesheet = new CSSStyleSheet()
+
+editorStylesheet.replaceSync(`
+:host {
+  display: block;
+  max-height: 360px;
+  overflow: auto;
+  border-radius: 0 0 1rem 1rem;
+}
+
+.ProseMirror {
+  word-wrap: break-word;
+  -webkit-font-variant-ligatures: none;
+  font-variant-ligatures: none;
+  font-feature-settings: "liga" 0;
+  outline: none;
+  min-height: 220px;
+  padding: 12px;
+}
+
+img.ProseMirror-separator {
+  display: inline !important;
+  border: none !important;
+  margin: 0 !important;
+  width: 0 !important;
+  height: 0 !important;
+}
+
+.ProseMirror-gapcursor {
+  display: none;
+  pointer-events: none;
+  position: absolute;
+  margin: 0;
+}
+
+.ProseMirror-gapcursor:after {
+  content: "";
+  display: block;
+  position: absolute;
+  top: -2px;
+  width: 20px;
+  border-top: 1px solid black;
+  animation: ProseMirror-cursor-blink 1.1s steps(2, start) infinite;
+}
+
+@keyframes ProseMirror-cursor-blink {
+  to {
+    visibility: hidden;
+  }
+}
+
+.ProseMirror-hideselection *::selection {
+  background: transparent;
+}
+
+.ProseMirror-hideselection *::-moz-selection {
+  background: transparent;
+}
+
+.ProseMirror-hideselection * {
+  caret-color: transparent;
+}
+
+.ProseMirror-focused .ProseMirror-gapcursor {
+  display: block;
+}
+
+.variable-highlight {
+  background-color: #fef3c7;
+  padding: 1px 2px;
+  border-radius: 4px;
+}
+`)
+
+const DROP_ATTRS = [
+  'srcdoc', 'xlink:href', 'srcset', 'action', 'formaction', 'poster',
+  'background', 'data', 'cite', 'ping', 'longdesc', 'manifest', 'profile'
+]
+
+const SAFE_URL_REGEXP = /^(?:https?:\/\/|data:image\/|blob:|mailto:|tel:|\{|#)/i
+
+function isSafeAttr (name, value) {
+  const lowerName = name.toLowerCase()
+
+  if (lowerName.startsWith('on') || DROP_ATTRS.includes(lowerName)) return false
+  if ((lowerName === 'href' || lowerName === 'src') && !SAFE_URL_REGEXP.test(value.trim())) return false
+
+  return true
+}
+
+function collectDomAttrs (dom) {
+  const attrs = {}
+
+  for (let i = 0; i < dom.attributes.length; i++) {
+    const { name, value } = dom.attributes[i]
+
+    if (isSafeAttr(name, value)) attrs[name] = value
+  }
+
+  return { htmlAttrs: attrs }
+}
+
+function collectSpanDomAttrs (dom) {
+  const result = collectDomAttrs(dom)
+
+  if (result.htmlAttrs.style) {
+    const temp = document.createElement('span')
+
+    temp.style.cssText = result.htmlAttrs.style
+
+    if (['bold', '700'].includes(temp.style.fontWeight)) {
+      temp.style.removeProperty('font-weight')
+    }
+
+    if (temp.style.fontStyle === 'italic') {
+      temp.style.removeProperty('font-style')
+    }
+
+    if (temp.style.textDecoration === 'underline') {
+      temp.style.removeProperty('text-decoration')
+    }
+
+    if (temp.style.cssText) {
+      result.htmlAttrs.style = temp.style.cssText
+    } else {
+      delete result.htmlAttrs.style
+    }
+  }
+
+  return result
+}
+
+function buildExtensions ({ Node, Mark, Extension, Plugin, Decoration, DecorationSet }) {
+  const blockNode = (name, tag, content, extra = {}) => Node.create({
+    name,
+    group: 'block',
+    content: content || 'block+',
+    ...extra,
+    addAttributes () {
+      return { htmlAttrs: { default: {} } }
+    },
+    parseHTML () {
+      return [{ tag, getAttrs: collectDomAttrs }]
+    },
+    renderHTML ({ node }) {
+      return [tag, node.attrs.htmlAttrs, 0]
+    }
+  })
+
+  const attrsMark = (name, tag) => Mark.create({
+    name,
+    addAttributes () {
+      return { htmlAttrs: { default: {} } }
+    },
+    parseHTML () {
+      return [{ tag, getAttrs: collectDomAttrs }]
+    },
+    renderHTML ({ mark }) {
+      return [tag, mark.attrs.htmlAttrs, 0]
+    }
+  })
+
+  const SpanMark = Mark.create({
+    name: 'span',
+    excludes: '',
+    addAttributes () {
+      return { htmlAttrs: { default: {} } }
+    },
+    parseHTML () {
+      return [{ tag: 'span', getAttrs: collectSpanDomAttrs }]
+    },
+    renderHTML ({ mark }) {
+      return ['span', mark.attrs.htmlAttrs, 0]
+    }
+  })
+
+  const toggleMark = (name, renderTag, parseRules, shortcuts) => Mark.create({
+    name,
+    parseHTML () {
+      return parseRules
+    },
+    renderHTML () {
+      return [renderTag, 0]
+    },
+    addCommands () {
+      const commandName = `toggle${name[0].toUpperCase()}${name.slice(1)}`
+
+      return {
+        [commandName]: () => ({ commands }) => commands.toggleMark(name)
+      }
+    },
+    addKeyboardShortcuts () {
+      return {
+        [shortcuts]: () => this.editor.commands.toggleMark(name)
+      }
+    }
+  })
+
+  const Heading = Node.create({
+    name: 'heading',
+    group: 'block',
+    content: 'inline*',
+    addAttributes () {
+      return {
+        htmlAttrs: { default: {} },
+        level: { default: 1 }
+      }
+    },
+    parseHTML () {
+      return [1, 2, 3, 4, 5, 6].map((level) => ({
+        tag: `h${level}`,
+        getAttrs: (dom) => ({ ...collectDomAttrs(dom), level })
+      }))
+    },
+    renderHTML ({ node }) {
+      return [`h${node.attrs.level}`, node.attrs.htmlAttrs, 0]
+    }
+  })
+
+  const ImageNode = Node.create({
+    name: 'image',
+    inline: true,
+    group: 'inline',
+    draggable: true,
+    addAttributes () {
+      return { htmlAttrs: { default: {} } }
+    },
+    parseHTML () {
+      return [{ tag: 'img', getAttrs: collectDomAttrs }]
+    },
+    renderHTML ({ node }) {
+      return ['img', node.attrs.htmlAttrs]
+    }
+  })
+
+  const HrNode = Node.create({
+    name: 'horizontalRule',
+    group: 'block',
+    atom: true,
+    addAttributes () {
+      return { htmlAttrs: { default: {} } }
+    },
+    parseHTML () {
+      return [{ tag: 'hr', getAttrs: collectDomAttrs }]
+    },
+    renderHTML ({ node }) {
+      return ['hr', node.attrs.htmlAttrs]
+    }
+  })
+
+  const StyleNode = Node.create({
+    name: 'style',
+    group: 'block',
+    atom: true,
+    selectable: false,
+    addAttributes () {
+      return {
+        htmlAttrs: { default: {} },
+        css: { default: '' }
+      }
+    },
+    parseHTML () {
+      return [{ tag: 'style', getAttrs: (dom) => ({ ...collectDomAttrs(dom), css: dom.textContent }) }]
+    },
+    renderHTML ({ node }) {
+      return ['style', node.attrs.htmlAttrs, node.attrs.css]
+    }
+  })
+
+  const EmptySpanNode = Node.create({
+    name: 'emptySpan',
+    inline: true,
+    group: 'inline',
+    atom: true,
+    addAttributes () {
+      return { htmlAttrs: { default: {} } }
+    },
+    parseHTML () {
+      return [{
+        tag: 'span',
+        priority: 60,
+        getAttrs (dom) {
+          if (dom.childNodes.length === 0 && dom.attributes.length > 0) {
+            return collectDomAttrs(dom)
+          }
+
+          return false
+        }
+      }]
+    },
+    renderHTML ({ node }) {
+      return ['span', node.attrs.htmlAttrs]
+    }
+  })
+
+  const LinkMark = Mark.create({
+    name: 'link',
+    inclusive: true,
+    addAttributes () {
+      return { htmlAttrs: { default: {} } }
+    },
+    parseHTML () {
+      return [{ tag: 'a', getAttrs: collectDomAttrs }]
+    },
+    renderHTML ({ mark }) {
+      return ['a', mark.attrs.htmlAttrs, 0]
+    },
+    addCommands () {
+      return {
+        setLink: ({ href }) => ({ editor, commands }) => {
+          const htmlAttrs = { ...(editor.getAttributes('link').htmlAttrs || {}), href }
+
+          return commands.setMark('link', { htmlAttrs })
+        },
+        unsetLink: () => ({ commands }) => commands.unsetMark('link', { extendEmptyMarkRange: true })
+      }
+    }
+  })
+
+  const buildDecorations = (doc) => {
+    const decorations = []
+    const regex = /\{\{?[a-zA-Z0-9_.-]+\}\}?/g
+
+    doc.descendants((node, pos) => {
+      if (!node.isText) return
+
+      let match
+
+      while ((match = regex.exec(node.text)) !== null) {
+        decorations.push(
+          Decoration.inline(pos + match.index, pos + match.index + match[0].length, {
+            class: 'variable-highlight'
+          })
+        )
+      }
+    })
+
+    return DecorationSet.create(doc, decorations)
+  }
+
+  const VariableHighlight = Extension.create({
+    name: 'variableHighlight',
+    addProseMirrorPlugins () {
+      return [new Plugin({
+        state: {
+          init (_, { doc }) {
+            return buildDecorations(doc)
+          },
+          apply (tr, oldSet) {
+            return tr.docChanged ? buildDecorations(tr.doc) : oldSet
+          }
+        },
+        props: {
+          decorations (state) {
+            return this.getState(state)
+          }
+        }
+      })]
+    }
+  })
+
+  return [
+    blockNode('paragraph', 'p', 'inline*'),
+    Heading,
+    blockNode('section', 'section'),
+    blockNode('article', 'article', null, { isolating: true }),
+    blockNode('header', 'header', null, { isolating: true }),
+    blockNode('footer', 'footer', null, { isolating: true }),
+    blockNode('div', 'div'),
+    blockNode('center', 'center'),
+    blockNode('blockquote', 'blockquote'),
+    blockNode('pre', 'pre'),
+    blockNode('orderedList', 'ol', '(listItem | block)+'),
+    blockNode('bulletList', 'ul', '(listItem | block)+'),
+    blockNode('listItem', 'li', 'block+', { group: null }),
+    blockNode('table', 'table', '(colgroup | tableHead | tableBody | tableFoot | tableRow)+'),
+    blockNode('tableHead', 'thead', 'tableRow+', { group: null }),
+    blockNode('tableBody', 'tbody', 'tableRow+', { group: null }),
+    blockNode('tableFoot', 'tfoot', 'tableRow+', { group: null }),
+    blockNode('tableRow', 'tr', '(tableCell | tableHeader)+', { group: null }),
+    blockNode('tableCell', 'td', 'block*', { group: null }),
+    blockNode('tableHeader', 'th', 'block*', { group: null }),
+    blockNode('colgroup', 'colgroup', 'col*', { group: null }),
+    Node.create({
+      name: 'col',
+      atom: true,
+      addAttributes () {
+        return { htmlAttrs: { default: {} } }
+      },
+      parseHTML () {
+        return [{ tag: 'col', getAttrs: collectDomAttrs }]
+      },
+      renderHTML ({ node }) {
+        return ['col', node.attrs.htmlAttrs]
+      }
+    }),
+    ImageNode,
+    HrNode,
+    StyleNode,
+    EmptySpanNode,
+    SpanMark,
+    LinkMark,
+    toggleMark('bold', 'strong', [{ tag: 'strong' }, { tag: 'b' }, { style: 'font-weight=bold' }, { style: 'font-weight=700' }], 'Mod-b'),
+    toggleMark('italic', 'em', [{ tag: 'em' }, { tag: 'i' }, { style: 'font-style=italic' }], 'Mod-i'),
+    toggleMark('underline', 'u', [{ tag: 'u' }, { style: 'text-decoration=underline' }], 'Mod-u'),
+    toggleMark('strike', 's', [{ tag: 's' }, { tag: 'del' }, { tag: 'strike' }, { style: 'text-decoration=line-through' }], 'Mod-Shift-s'),
+    attrsMark('subscript', 'sub'),
+    attrsMark('superscript', 'sup'),
+    VariableHighlight
+  ]
+}
+
+export default actionable(targetable(class extends HTMLElement {
+  static [target.static] = [
+    'textarea',
+    'editorElement',
+    'boldButton',
+    'italicButton',
+    'underlineButton',
+    'linkButton',
+    'linkTooltipTemplate'
+  ]
+
+  async connectedCallback () {
+    if (!this.textarea || !this.editorElement) return
+
+    this.textarea.style.display = 'none'
+    this.adjustShortcutsForPlatform()
+
+    const tiptap = await loadTiptap()
+
+    const { Editor, Extension, Document, Text, HardBreak, UndoRedo, Gapcursor, Dropcursor } = tiptap
+
+    this.emailDocument = new DOMParser().parseFromString(this.textarea.value, 'text/html')
+
+    const shadow = this.editorElement.attachShadow({ mode: 'open' })
+
+    shadow.adoptedStyleSheets = [editorStylesheet]
+
+    this.emailDocument.head.querySelectorAll('style').forEach((style) => {
+      shadow.appendChild(style.cloneNode(true))
+    })
+
+    const container = document.createElement('div')
+    const bodyStyle = this.emailDocument.body.getAttribute('style')
+
+    if (bodyStyle) container.setAttribute('style', bodyStyle)
+
+    shadow.appendChild(container)
+
+    const LinkShortcut = Extension.create({
+      name: 'linkShortcut',
+      addKeyboardShortcuts: () => ({
+        'Mod-k': () => {
+          this.toggleLink()
+
+          return true
+        }
+      })
+    })
+
+    this.editor = new Editor({
+      element: container,
+      extensions: [
+        Document,
+        Text,
+        HardBreak,
+        UndoRedo,
+        Gapcursor,
+        Dropcursor,
+        ...buildExtensions(tiptap),
+        LinkShortcut
+      ],
+      content: this.emailDocument.body.innerHTML,
+      injectCSS: false,
+      editorProps: {
+        attributes: {
+          dir: 'auto'
+        },
+        handleDOMEvents: {
+          click: (_, event) => {
+            if (event.target.closest('a')) event.preventDefault()
+
+            return false
+          }
+        }
+      },
+      onUpdate: ({ editor }) => {
+        this.emailDocument.body.innerHTML = editor.getHTML()
+
+        this.textarea.value = this.emailDocument.documentElement.outerHTML
+        this.textarea.dispatchEvent(new Event('input', { bubbles: true }))
+      },
+      onSelectionUpdate: ({ editor }) => {
+        this.updateToolbarState()
+        this.handleLinkTooltip(editor)
+      },
+      onBlur: () => {
+        setTimeout(() => {
+          if (!this.linkTooltip.tooltip.contains(document.activeElement)) {
+            this.linkTooltip.hide()
+          }
+        }, 0)
+      }
+    })
+
+    this.linkTooltip = new LinkTooltip(this, this.editor, this.linkTooltipTemplate)
+  }
+
+  adjustShortcutsForPlatform () {
+    if ((navigator.userAgentData?.platform)?.toLowerCase()?.includes('mac')) {
+      this.querySelectorAll('.tooltip[data-tip]').forEach(tooltip => {
+        const tip = tooltip.getAttribute('data-tip')
+
+        if (tip && tip.includes('Ctrl')) {
+          tooltip.setAttribute('data-tip', tip.replace(/Ctrl/g, '⌘'))
+        }
+      })
+    }
+  }
+
+  bold (e) {
+    e.preventDefault()
+
+    this.editor.chain().focus().toggleBold().run()
+    this.updateToolbarState()
+  }
+
+  italic (e) {
+    e.preventDefault()
+
+    this.editor.chain().focus().toggleItalic().run()
+    this.updateToolbarState()
+  }
+
+  underline (e) {
+    e.preventDefault()
+
+    this.editor.chain().focus().toggleUnderline().run()
+    this.updateToolbarState()
+  }
+
+  linkSelection (e) {
+    e.preventDefault()
+
+    this.toggleLink()
+    this.updateToolbarState()
+  }
+
+  undo (e) {
+    e.preventDefault()
+
+    this.editor.chain().focus().undo().run()
+    this.updateToolbarState()
+  }
+
+  redo (e) {
+    e.preventDefault()
+
+    this.editor.chain().focus().redo().run()
+    this.updateToolbarState()
+  }
+
+  updateToolbarState () {
+    this.boldButton.classList.toggle('bg-base-200', this.editor.isActive('bold'))
+    this.italicButton.classList.toggle('bg-base-200', this.editor.isActive('italic'))
+    this.underlineButton.classList.toggle('bg-base-200', this.editor.isActive('underline'))
+    this.linkButton.classList.toggle('bg-base-200', this.editor.isActive('link'))
+  }
+
+  handleLinkTooltip (editor) {
+    const { from } = editor.state.selection
+    const mark = editor.state.doc.resolve(from).marks().find(m => m.type.name === 'link')
+
+    if (!mark) {
+      if (this.linkTooltip.isVisible()) this.linkTooltip.hide()
+
+      return
+    }
+
+    if (this.linkTooltip.isVisible() && this.linkTooltip.currentMark === mark) return
+
+    let linkStart = from
+    const start = editor.state.doc.resolve(from).start()
+
+    for (let i = from - 1; i >= start; i--) {
+      if (editor.state.doc.resolve(i).marks().some(m => m.eq(mark))) {
+        linkStart = i
+      } else {
+        break
+      }
+    }
+
+    this.linkTooltip.hide()
+    this.linkTooltip.show(mark.attrs.htmlAttrs?.href, linkStart > start ? linkStart - 1 : linkStart)
+    this.linkTooltip.currentMark = mark
+  }
+
+  toggleLink () {
+    if (this.editor.isActive('link')) {
+      this.linkTooltip.hide()
+      this.editor.chain().focus().extendMarkRange('link').unsetLink().run()
+      this.updateToolbarState()
+    } else {
+      const { from } = this.editor.state.selection
+
+      this.linkTooltip.hide()
+      this.linkTooltip.show(this.editor.getAttributes('link').htmlAttrs?.href, from, { focus: true })
+    }
+  }
+
+  insertVariable (e) {
+    const variable = e.target.closest('[data-variable]')?.dataset.variable
+
+    if (variable) {
+      const { from, to } = this.editor.state.selection
+
+      if (variable.includes('link') && from !== to) {
+        this.editor.chain().focus().setLink({ href: `{${variable}}` }).run()
+      } else {
+        this.editor.chain().focus().insertContent(`{${variable}}`).run()
+      }
+    }
+  }
+
+  disconnectedCallback () {
+    this.linkTooltip?.hide()
+
+    if (this.editor) {
+      this.editor.destroy()
+    }
+  }
+}))
@@ -35,7 +35,7 @@ function loadTiptap () {
  }))
 }

-class LinkTooltip {
+export class LinkTooltip {
  constructor (container, editor, templateEl) {
    this.container = container
    this.editor = editor
@@ -0,0 +1,17 @@
+export default class extends HTMLElement {
+  connectedCallback () {
+    if (this.dataset.disabled === 'true') return
+    if (!this.isMobile()) return
+    if (window.innerWidth >= 768) return
+
+    this.querySelectorAll('a[data-turbo-frame]').forEach((link) => {
+      link.dataset.turboFrame = '_top'
+    })
+  }
+
+  isMobile () {
+    const isTouchWebkit = 'ontouchstart' in window && navigator.maxTouchPoints > 0 && /AppleWebKit|android/i.test(navigator.userAgent)
+
+    return isTouchWebkit || /iPhone|iPad|iPod/i.test(navigator.userAgent)
+  }
+}
@@ -0,0 +1,40 @@
+export default class extends HTMLElement {
+  connectedCallback () {
+    this.addEventListener('scroll', this.updateFade, { passive: true })
+    window.addEventListener('resize', this.updateFade)
+
+    this.updateFade()
+  }
+
+  disconnectedCallback () {
+    window.removeEventListener('resize', this.updateFade)
+  }
+
+  updateFade = () => {
+    const maxScroll = this.scrollWidth - this.clientWidth
+    const fadeGradient = {
+      right: 'linear-gradient(to right, black calc(100% - 24px), transparent)',
+      left: 'linear-gradient(to right, transparent, black 24px)',
+      both: 'linear-gradient(to right, transparent, black 24px, black calc(100% - 24px), transparent)'
+    }
+
+    let state = 'none'
+
+    if (maxScroll > 4) {
+      if (this.scrollLeft <= 4) {
+        state = 'right'
+      } else if (this.scrollLeft >= maxScroll - 4) {
+        state = 'left'
+      } else {
+        state = 'both'
+      }
+    }
+
+    this.applyFade(fadeGradient[state] || '')
+  }
+
+  applyFade (gradient) {
+    this.style.maskImage = gradient
+    this.style.webkitMaskImage = gradient
+  }
+}
@@ -1,19 +1,5 @@
 export default class extends HTMLElement {
  connectedCallback () {
-    this.input.addEventListener('focus', () => {
-      if (this.title) {
-        this.title.classList.add('hidden', 'md:block')
-        this.input.classList.add('w-60')
-      }
-    })
-
-    this.input.addEventListener('blur', (e) => {
-      if (this.title && !e.target.value) {
-        this.title.classList.remove('hidden')
-        this.input.classList.remove('w-60')
-      }
-    })
-
    this.button.addEventListener('click', (event) => {
      if (!this.input.value && document.activeElement !== this.input) {
        event.preventDefault()
@@ -21,16 +7,22 @@ export default class extends HTMLElement {
        this.input.focus()
      }
    })
+
+    document.addEventListener('turbo:before-cache', this.onBeforeCache)
+  }
+
+  disconnectedCallback () {
+    document.removeEventListener('turbo:before-cache', this.onBeforeCache)
+  }
+
+  onBeforeCache = () => {
+    this.input.value = this.input.getAttribute('value') || ''
  }

  get input () {
    return this.querySelector('input')
  }

-  get title () {
-    return document.querySelector(this.dataset.title)
-  }
-
  get button () {
    return this.querySelector('button')
  }
@@ -14,6 +14,7 @@ export default targetable(class extends HTMLElement {
    this.resizeObserver = new ResizeObserver(() => {
      requestAnimationFrame(() => {
        if (!this.canvas) return
+        if (!this.canvas.parentNode?.clientWidth) return

        const { width, height } = this.canvas

@@ -80,7 +81,7 @@ export default targetable(class extends HTMLElement {
  }

  redrawCanvas (oldWidth, oldHeight) {
-    if (this.pad && !this.pad.isEmpty() && oldWidth > 0 && oldHeight > 0) {
+    if (this.pad && !this.pad.isEmpty() && oldWidth > 0 && oldHeight > 0 && this.canvas.width > 0 && this.canvas.height > 0) {
      const sx = this.canvas.width / oldWidth
      const sy = this.canvas.height / oldHeight

@@ -6,7 +6,7 @@ export default actionable(class extends HTMLElement {

    document.addEventListener('keyup', this.onEscKey)

-    document.addEventListener('turbo:before-cache', this.close)
+    document.addEventListener('turbo:before-cache', this.onBeforeCache)

    if (this.dataset.closeAfterSubmit !== 'false') {
      document.addEventListener('turbo:submit-end', this.onSubmit)
@@ -18,7 +18,7 @@ export default actionable(class extends HTMLElement {

    document.removeEventListener('keyup', this.onEscKey)
    document.removeEventListener('turbo:submit-end', this.onSubmit)
-    document.removeEventListener('turbo:before-cache', this.close)
+    document.removeEventListener('turbo:before-cache', this.onBeforeCache)
  }

  onSubmit = (e) => {
@@ -33,6 +33,12 @@ export default actionable(class extends HTMLElement {
    }
  }

+  onBeforeCache = () => {
+    if (this.closest('turbo-frame')?.src) {
+      this.remove()
+    }
+  }
+
  close = (e) => {
    e?.preventDefault()

@@ -35,6 +35,7 @@ safeRegisterElement('submission-form', class extends HTMLElement {
      scrollPadding: this.dataset.scrollPadding || '-80px',
      signatureText: this.dataset.signatureText,
      language: this.dataset.language,
+      paymentProvider: this.dataset.paymentProvider,
      dryRun: this.dataset.dryRun === 'true',
      expand: ['true', 'false'].includes(this.dataset.expand) ? this.dataset.expand === 'true' : null,
      withSignatureId: this.dataset.withSignatureId === 'true',
@@ -52,7 +53,9 @@ safeRegisterElement('submission-form', class extends HTMLElement {
      completedMessage: JSON.parse(this.dataset.completedMessage || '{}'),
      completedRedirectUrl: this.dataset.completedRedirectUrl,
      attachments: reactive(JSON.parse(this.dataset.attachments)),
-      fields: JSON.parse(this.dataset.fields)
+      fields: JSON.parse(this.dataset.fields),
+      completeButtonContainer: document.getElementById('complete_button_container'),
+      completeButtonScrollContainer: document.getElementById('complete_button_container_scroll')
    })

    this.app.mount(this.appElem)
@@ -69,8 +69,8 @@
              :attachments-index="attachmentsIndex"
            />
            <FieldArea
-              v-else-if="item.type === 'formula_area' && isMathLoaded"
-              :model-value="calculateFormula(item.field)"
+              v-else-if="item.type === 'formula_area' && (isMathLoaded || item.field.type === 'text')"
+              :model-value="item.field.type === 'text' ? evalTextFormula(item.field) : calculateFormula(item.field)"
              :is-inline-size="isInlineSize"
              :field="item.field"
              :area="item.area"
@@ -289,6 +289,7 @@ export default {
  methods: {
    normalizeFormula: FormulaAreas.methods.normalizeFormula,
    calculateFormula: FormulaAreas.methods.calculateFormula,
+    evalTextFormula: FormulaAreas.methods.evalTextFormula,
    scrollInContainer: FieldAreas.methods.scrollInContainer,
    scrollIntoArea: FieldAreas.methods.scrollIntoArea,
    scrollIntoField: FieldAreas.methods.scrollIntoField,
@@ -42,10 +42,25 @@ export default {
      const areas = {}

      this.field.areas?.forEach((area) => {
-        areas[area.attachment_uuid + area.page] ||= area
+        areas[area.attachment_uuid] ||= []
+        areas[area.attachment_uuid].push(area)
      })

-      return Object.values(areas).slice(0, 6)
+      const sortedAreas = Object.values(areas).reduce((acc, group) => {
+        const seen = {}
+        const sortedGroup = [...group].sort((a, b) => a.page - b.page)
+
+        sortedGroup.forEach((area) => {
+          if (!seen[area.page]) {
+            seen[area.page] = true
+            acc.push(area)
+          }
+        })
+
+        return acc
+      }, [])
+
+      return sortedAreas.slice(0, 6)
    }
  }
 }
@@ -528,7 +528,7 @@ export default {
          return this.formatDate(
            this.modelValue === '{{date}}' ? new Date() : new Date(this.modelValue),
            this.field.preferences?.format || (this.locale.endsWith('-US') ? 'MM/DD/YYYY' : 'DD/MM/YYYY'),
-            { withTimePlaceholders: this.modelValue === '{{date}}' }
+            { withTimePlaceholders: this.modelValue === '{{date}}', utc: this.modelValue !== '{{date}}' }
          )
        } catch {
          return this.modelValue
@@ -643,11 +643,15 @@ export default {
        return new Intl.NumberFormat('de-DE').format(number)
      } else if (format === 'space') {
        return new Intl.NumberFormat('fr-FR').format(number)
+      } else if (format === 'percent') {
+        return `${number}%`
+      } else if (format === 'percent_space') {
+        return `${String(number).replace('.', ',')} %`
      } else {
        return number
      }
    },
-    formatDate (date, format, { withTimePlaceholders = false } = {}) {
+    formatDate (date, format, { withTimePlaceholders = false, utc = true } = {}) {
      const monthFormats = { M: 'numeric', MM: '2-digit', MMM: 'short', MMMM: 'long' }
      const dayFormats = { D: 'numeric', DD: '2-digit' }
      const yearFormats = { YYYY: 'numeric', YYY: 'numeric', YY: '2-digit' }
@@ -669,7 +673,7 @@ export default {
      if (format.match(/m+/)) opts.minute = minuteFormats[format.match(/m+/)[0]]
      if (format.match(/s+/)) opts.second = secondFormats[format.match(/s+/)[0]]
      if (/z/.test(format)) opts.timeZoneName = 'short'
-      if (!hasTime) opts.timeZone = 'UTC'
+      if (!hasTime && utc) opts.timeZone = 'UTC'

      const partTypes = {
        M: 'month',
@@ -27,6 +27,7 @@
      </label>
      <button
        v-if="withToday"
+        type="button"
        class="btn btn-outline btn-sm !normal-case font-normal set-current-date-button"
        @click.prevent="[setCurrentDate(), $emit('focus')]"
      >
@@ -51,6 +51,36 @@
 <script>
 import { IconCloudUpload, IconInnerShadowTop } from '@tabler/icons-vue'

+function convertImage (sourceFile, targetType, quality) {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader()
+
+    reader.onload = function (event) {
+      const img = new Image()
+
+      img.onload = function () {
+        const canvas = document.createElement('canvas')
+        const ctx = canvas.getContext('2d')
+
+        canvas.width = img.width
+        canvas.height = img.height
+        ctx.drawImage(img, 0, 0)
+        canvas.toBlob(function (blob) {
+          const ext = targetType === 'image/jpeg' ? '.jpg' : '.png'
+          const newFile = new File([blob], sourceFile.name.replace(/\.\w+$/, ext), { type: targetType })
+          resolve(newFile)
+        }, targetType, quality)
+      }
+
+      img.onerror = () => reject(new Error(`browser cannot decode ${sourceFile.type || sourceFile.name}`))
+
+      img.src = event.target.result
+    }
+    reader.onerror = reject
+    reader.readAsDataURL(sourceFile)
+  })
+}
+
 export default {
  name: 'FileDropzone',
  components: {
@@ -153,8 +183,14 @@ export default {
              }
            })
          } else {
-            if (file.type === 'image/bmp' || file.type === 'image/vnd.microsoft.icon') {
-              file = await this.convertBmpToPng(file)
+            try {
+              if (['image/bmp', 'image/vnd.microsoft.icon', 'image/svg+xml', 'image/gif'].includes(file.type)) {
+                file = await convertImage(file, 'image/png')
+              } else if (['image/heic', 'image/heif', 'image/heic-sequence', 'image/heif-sequence', 'image/avif', 'image/avif-sequence', 'image/webp'].includes(file.type)) {
+                file = await convertImage(file, 'image/jpeg', 0.9)
+              }
+            } catch (e) {
+              alert(e.message)
            }

            formData.append('file', file)
@@ -181,32 +217,6 @@ export default {
      }).finally(() => {
        this.isLoading = false
      })
-    },
-    convertBmpToPng (bmpFile) {
-      return new Promise((resolve, reject) => {
-        const reader = new FileReader()
-
-        reader.onload = function (event) {
-          const img = new Image()
-
-          img.onload = function () {
-            const canvas = document.createElement('canvas')
-            const ctx = canvas.getContext('2d')
-
-            canvas.width = img.width
-            canvas.height = img.height
-            ctx.drawImage(img, 0, 0)
-            canvas.toBlob(function (blob) {
-              const newFile = new File([blob], bmpFile.name.replace(/\.\w+$/, '.png'), { type: 'image/png' })
-              resolve(newFile)
-            }, 'image/png')
-          }
-
-          img.src = event.target.result
-        }
-        reader.onerror = reject
-        reader.readAsDataURL(bmpFile)
-      })
    }
  }
 }
@@ -95,7 +95,7 @@
      v-else
      id="complete_form_button"
      class="btn btn-sm btn-neutral text-white px-4 w-full flex justify-center"
-      form="steps_form"
+      form="complete_form"
      type="submit"
      name="completed"
      value="true"
@@ -113,8 +113,41 @@
      </span>
    </button>
  </Teleport>
+  <Teleport
+    v-for="ref in (showCompleteButton ? [completeButtonContainer, completeButtonScrollContainer].filter(Boolean) : [])"
+    :key="ref"
+    :to="ref"
+  >
+    <button
+      class="complete-button btn btn-sm btn-neutral text-white px-4"
+      form="complete_form"
+      type="submit"
+      name="completed"
+      value="true"
+      :disabled="isSubmittingComplete"
+    >
+      <span class="flex items-center">
+        <IconInnerShadowTop
+          v-if="isSubmittingComplete"
+          class="mr-1 animate-spin w-5 h-5"
+          aria-hidden="true"
+        />
+        <span>
+          {{ t('complete') }}
+        </span>
+      </span>
+    </button>
+  </Teleport>
+  <form
+    v-if="!isCompleted && !isInvite"
+    id="complete_form"
+    class="hidden"
+    :action="submitPath"
+    method="post"
+    @submit.prevent="submitStep"
+  />
  <button
-    v-if="!isFormVisible"
+    v-if="!isFormVisible && currentField"
    id="expand_form_button"
    class="btn btn-neutral flex text-white absolute bottom-0 w-full mb-3 expand-form-button text-base"
    style="width: 96%; margin-left: 2%"
@@ -141,6 +174,7 @@
    />
  </button>
  <div
+    v-if="currentField"
    v-show="isFormVisible"
    id="form_container"
    class="shadow-md bg-base-100 absolute bottom-0 w-full border-base-200 border p-4 rounded form-container overflow-hidden"
@@ -256,6 +290,7 @@
              :id="currentField.uuid"
              dir="auto"
              :required="currentField.required"
+              :aria-label="showFieldNames && (currentField.name || currentField.title) ? undefined : (currentField.name || currentField.title || t('select_your_option'))"
              :aria-describedby="currentField.description ? currentField.uuid + '-desc' : undefined"
              class="select base-input !text-2xl w-full text-center font-normal"
              :class="{ 'text-gray-300': !values[currentField.uuid] }"
@@ -284,7 +319,7 @@
          <div v-else-if="currentField.type === 'radio'">
            <label
              v-if="showFieldNames && (currentField.name || currentField.title)"
-              :for="currentField.uuid"
+              :id="currentField.uuid + '-radio-label'"
              dir="auto"
              class="label text-xl sm:text-2xl py-0 mb-2 sm:mb-3.5 field-name-label"
              :class="{ 'mb-2': !currentField.description }"
@@ -323,6 +358,8 @@
              </div>
              <div
                class="space-y-3.5 mx-auto"
+                role="radiogroup"
+                :aria-labelledby="(currentField.name || currentField.title) ? currentField.uuid + '-radio-label' : null"
                :class="{ hidden: !showFieldNames || (currentField.options.every((e) => !e.value) && currentField.options.length > 4) }"
              >
                <div
@@ -523,6 +560,7 @@
            :fields="formulaFields"
            :values="values"
            :readonly-values="readonlyFieldValues"
+            :provider="paymentProvider"
            @attached="attachments.push($event)"
            @focus="scrollIntoField(currentField)"
            @submit="!isSubmitting && submitStep()"
@@ -791,6 +829,16 @@ export default {
      required: false,
      default: null
    },
+    completeButtonContainer: {
+      type: Object,
+      required: false,
+      default: null
+    },
+    completeButtonScrollContainer: {
+      type: Object,
+      required: false,
+      default: null
+    },
    schema: {
      type: Array,
      required: false,
@@ -953,6 +1001,11 @@ export default {
      required: false,
      default: ''
    },
+    paymentProvider: {
+      type: String,
+      required: false,
+      default: ''
+    },
    values: {
      type: Object,
      required: false,
@@ -1008,6 +1061,7 @@ export default {
      isSubmitting: false,
      isSubmittingComplete: false,
      submittedValues: {},
+      isFormStarted: false,
      recalculateButtonDisabledKey: '',
      isAccessibilityMode: false
    }
@@ -1056,6 +1110,10 @@ export default {
        })
      })
    },
+    showCompleteButton () {
+      return this.completeButtonContainer && !this.isCompleted && !this.isInvite && this.isFormStarted &&
+        !this.stepFields.find((fields) => fields.some((f) => f.required && isEmpty(this.submittedValues[f.uuid])))
+    },
    submitButtonText () {
      if (this.alwaysMinimize) {
        return this.t('submit')
@@ -1121,7 +1179,11 @@ export default {
      }
    },
    isAnonymousChecboxes () {
-      return this.currentField.type === 'checkbox' && this.currentStepFields.every((e) => !e.name && !e.required) && this.currentStepFields.length > 4
+      if (this.currentField) {
+        return this.currentField.type === 'checkbox' && this.currentStepFields.every((e) => !e.name && !e.required) && this.currentStepFields.length > 4
+      } else {
+        return false
+      }
    },
    isButtonDisabled () {
      if (this.recalculateButtonDisabledKey) {
@@ -1519,6 +1581,7 @@ export default {
      }
    },
    goToStep (stepIndex, scrollToArea = false, clickUpload = false) {
+      this.isInvite = false
      this.currentStep = stepIndex
      this.showFillAllRequiredFields = false

@@ -1543,6 +1606,10 @@ export default {
      })
    },
    saveStep (formData) {
+      if (!formData && !this.$refs.form) {
+        return
+      }
+
      const currentFieldUuids = this.currentStepFields.map((f) => f.uuid)
      const currentFieldType = this.currentField.type

@@ -1657,6 +1724,8 @@ export default {
            return Promise.reject(new Error(data.error))
          }

+          this.isFormStarted = true
+
          const nextStep = (isLastStep && emptyRequiredField) || (forceComplete ? null : this.findNextStep(submitStepIndex))

          if (nextStep) {
@@ -1693,6 +1762,7 @@ export default {
    },
    async performComplete (resp) {
      this.isCompleted = true
+      this.isFormVisible = true

      if (resp?.text) {
        const respData = await resp.text()
@@ -12,8 +12,8 @@
        :to="findPageElementForArea(area)"
      >
        <FieldArea
-          v-if="isMathLoaded"
-          :model-value="calculateFormula(field)"
+          v-if="isMathLoaded || field.type === 'text'"
+          :model-value="field.type === 'text' ? evalTextFormula(field) : calculateFormula(field)"
          :is-inline-size="isInlineSize"
          :field="field"
          :area="area"
@@ -95,6 +95,25 @@ export default {
      })

      return this.math.evaluate(transformedFormula.toLowerCase())
+    },
+    evalTextFormula (field, depth = 0) {
+      if (depth > 10) return ''
+
+      return field.preferences.formula.replace(/{{(.*?)}}/g, (match, uuid) => {
+        const formulaField = this.fieldsUuidIndex[uuid]
+
+        if (formulaField?.preferences?.formula) {
+          if (formulaField.type === 'text') {
+            return this.evalTextFormula(formulaField, depth + 1)
+          } else if (this.isMathLoaded) {
+            return this.calculateFormula(formulaField)
+          }
+        }
+
+        const value = this.readonlyValues[uuid] ?? this.values[uuid]
+
+        return Array.isArray(value) ? value.join(', ') : (value ?? '')
+      })
    }
  }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Alex Turchyn	a2d8b85549	Merge from docusealco/wip	2026-08-03 12:53:50 +03:00
Pete Matsyburka	4d68783b82	add counters	2026-08-03 10:05:09 +03:00
Pete Matsyburka	b05c3b2030	fix autocomplete	2026-08-03 09:41:08 +03:00
Pete Matsyburka	784ae9aa4b	fix dynamic document preview	2026-08-03 08:19:35 +03:00
Pete Matsyburka	03b5956cbc	bcc limit	2026-08-03 07:42:53 +03:00
Pete Matsyburka	2876c9a18e	adjust pagination	2026-08-01 08:38:49 +03:00
Pete Matsyburka	c4b7be3925	fix mobile tabs	2026-07-31 12:46:34 +03:00
Pete Matsyburka	e2ffbdac1d	update gem	2026-07-31 11:43:40 +03:00
Pete Matsyburka	0d197bb2eb	fix mobile modal	2026-07-31 10:57:37 +03:00
Pete Matsyburka	55089bee7f	adjust pagination	2026-07-31 10:53:34 +03:00
Pete Matsyburka	b96fe74db1	adjust filters	2026-07-31 10:46:24 +03:00
Pete Matsyburka	2fc1ba3037	fix layout	2026-07-31 09:23:18 +03:00
Pete Matsyburka	c67d37207e	update deps	2026-07-30 20:51:46 +03:00
Pete Matsyburka	dba50cd1bf	mobile fixes	2026-07-30 20:21:40 +03:00
Pete Matsyburka	edf2c0d9ed	update gem	2026-07-30 18:47:44 +03:00
Pete Matsyburka	35f7c36f28	rename settings index	2026-07-30 18:13:55 +03:00
Pete Matsyburka	3a24ecac63	Revert "break long names in template and folder titles" This reverts commit `59fe8a7917`.	2026-07-30 18:13:55 +03:00
Pete Matsyburka	50ec7682b5	fix open modal mobile	2026-07-30 18:13:54 +03:00
Pete Matsyburka	3667993caf	center settings footer	2026-07-30 16:54:36 +03:00
Alex Turchyn	68e8cd1188	fix settings nav offset	2026-07-30 16:45:56 +03:00
Alex Turchyn	3eebf6d2cf	unify tooltip and breakpoint classes	2026-07-30 16:45:56 +03:00
Alex Turchyn	34d0e00910	use numeric keyboard for otp code inputs	2026-07-30 16:45:56 +03:00
Alex Turchyn	b8ab7190d2	use dvh for modal and drawer	2026-07-30 16:45:56 +03:00
Alex Turchyn	59fe8a7917	break long names in template and folder titles	2026-07-30 16:45:56 +03:00
Alex Turchyn	d56070827b	fix broken svg	2026-07-30 16:45:56 +03:00
Alex Turchyn	74dbd4bed3	fix trusted signature text	2026-07-30 16:45:56 +03:00
Alex Turchyn	807e82b21e	open modals as pages on mobile devices	2026-07-30 16:45:56 +03:00
Alex Turchyn	66862e93c8	unify breakpoint classes	2026-07-30 16:45:56 +03:00
Alex Turchyn	270461ad3b	add mobile filters	2026-07-30 16:45:56 +03:00
Alex Turchyn	3edd1ab32d	fix invalid classes and html attributes	2026-07-30 16:45:56 +03:00
Alex Turchyn	e77998e53c	scale down settings titles on mobile	2026-07-30 16:45:56 +03:00
Alex Turchyn	1421bc2bce	fix horizontal scroll from preferences tooltip	2026-07-30 16:45:56 +03:00
Alex Turchyn	cbbbfdda80	add mobile settings navigation	2026-07-30 16:45:56 +03:00
Alex Turchyn	2d510081be	fix esign signature row layout	2026-07-30 16:45:56 +03:00
Alex Turchyn	704893ee1d	show view archived link in mobile pagination	2026-07-30 16:45:56 +03:00
Alex Turchyn	88612913a6	wrap smtp security radios on small screens	2026-07-30 16:45:56 +03:00
Alex Turchyn	ce6823ed38	hide tooltip wrappers with hidden content	2026-07-30 16:45:56 +03:00
Alex Turchyn	9074d23b3c	fix uneven template action buttons	2026-07-30 16:45:56 +03:00
Alex Turchyn	76d0e76fd5	no touch tooltips on nav elements	2026-07-30 16:45:56 +03:00
Pete Matsyburka	5ec8e4ccc7	text formula	2026-07-30 11:55:59 +03:00
Alex Turchyn	b8c29324b8	paypal configs Co-authored-by: Pete Matsyburka <pete@docuseal.com>	2026-07-30 07:56:07 +03:00
Pete Matsyburka	972f38242e	update rails	2026-07-29 21:53:03 +03:00
Alex Turchyn	7ce6c29f4d	Merge from docusealco/wip	2026-07-27 15:56:18 +03:00
Pete Matsyburka	2c6ddd7f90	rate limit remove 2fa	2026-07-27 15:48:04 +03:00
Pete Matsyburka	ae50b2e323	add i18n	2026-07-27 14:56:08 +03:00
Pete Matsyburka	152cbc11a6	fix specs	2026-07-26 17:44:01 +03:00
Pete Matsyburka	3a406de655	adjust release tag	2026-07-26 09:37:03 +03:00
Pete Matsyburka	2e31cda08c	adjust url pattern	2026-07-26 08:26:32 +03:00
Pete Matsyburka	094b7f47bd	set forwarded priority	2026-07-25 20:12:18 +03:00
Pete Matsyburka	99ac349ecc	sanitize dynamic document attributes	2026-07-25 19:46:41 +03:00
Pete Matsyburka	8830e03cf3	adjust cert config	2026-07-25 14:46:45 +03:00
Pete Matsyburka	706f3d6d65	fix image load	2026-07-25 13:51:55 +03:00
Pete Matsyburka	12b49f5fa7	log os	2026-07-25 10:53:41 +03:00
Pete Matsyburka	85327760b9	refactor mcp	2026-07-25 10:04:44 +03:00
Pete Matsyburka	c94ed9c3d4	update gem	2026-07-24 23:05:57 +03:00
Pete Matsyburka	bc50735d2a	update gem	2026-07-23 14:13:55 +03:00
Pete Matsyburka	d05e125fa9	use :has selectors for search input	2026-07-23 11:13:10 +03:00
Alex Turchyn	48d595ca81	full width search input on mobile devices	2026-07-23 10:36:45 +03:00
Pete Matsyburka	a156de5e75	optional initials	2026-07-22 08:45:20 +03:00
Pete Matsyburka	a7003bf4d0	bump stars	2026-07-21 13:10:36 +03:00
Alex Turchyn	5fe75c84ff	Merge from docusealco/wip	2026-07-20 14:01:14 +03:00
Alex Turchyn	4549a04fc5	disable turbo on sign out form	2026-07-18 14:27:45 +03:00
Pete Matsyburka	0ea6b912a3	file download variables	2026-07-17 12:30:15 +03:00
Pete Matsyburka	9b86fa3d40	add date formats config	2026-07-17 11:27:44 +03:00
Pete Matsyburka	374f66c59f	send view only	2026-07-17 11:12:47 +03:00
Pete Matsyburka	da43d881f1	edit message per 10 parties	2026-07-17 09:34:43 +03:00
Pete Matsyburka	9cbfa3a0ba	fix condition on complete	2026-07-17 00:30:06 +03:00
Pete Matsyburka	77a925f33b	fix invite form return to fields	2026-07-16 15:55:21 +03:00
Pete Matsyburka	3f7d7beedd	fix sharing toggle	2026-07-15 10:55:04 +03:00
Pete Matsyburka	40d91df732	Revert "adjust shared query" This reverts commit `56da326709`.	2026-07-15 10:49:09 +03:00
Pete Matsyburka	c8e783a210	multi select context menu readonly and required	2026-07-14 17:30:41 +03:00
Pete Matsyburka	61fc24d35d	add with signature id completed config	2026-07-14 12:47:38 +03:00
Pete Matsyburka	73734b0de7	add variables_schema response	2026-07-13 19:34:09 +03:00
Pete Matsyburka	09bd831d54	adjust submission.name variable	2026-07-13 19:13:46 +03:00
Pete Matsyburka	2c9f1b999e	update icon	2026-07-13 17:16:42 +03:00
Alex Turchyn	6a3a185310	Merge from docusealco/wip	2026-07-13 13:23:35 +03:00
Pete Matsyburka	7d381b7aee	add reset smtp action	2026-07-13 10:58:08 +03:00
Alex Turchyn	bba5626dea	add ability to edit html email	2026-07-10 21:57:23 +03:00
Pete Matsyburka	bdf5e58929	fix autocomplete index use	2026-07-10 10:32:04 +03:00
Pete Matsyburka	035168230e	match generated font frontend	2026-07-09 15:44:34 +03:00
Pete Matsyburka	28168f082d	adjust view only	2026-07-09 12:46:38 +03:00
Pete Matsyburka	a29e09ed2f	add submission update api	2026-07-08 11:16:56 +03:00
Pete Matsyburka	e88874e757	view only party	2026-07-07 17:34:23 +03:00
Pete Matsyburka	b6fb7c6977	fix find blob by checksum	2026-07-07 09:50:11 +03:00
Pete Matsyburka	8a60f17d13	optimize created_at filter	2026-07-07 09:41:37 +03:00
Pete Matsyburka	e1d860a42c	add submission created_at index	2026-07-07 09:14:15 +03:00
Pete Matsyburka	56da326709	adjust shared query	2026-07-06 18:45:37 +03:00
Pete Matsyburka	672008f8af	add shared templates index param	2026-07-06 17:56:35 +03:00
Alex Turchyn	d86b16de6b	Merge from docusealco/wip	2026-07-06 13:25:54 +03:00
Pete Matsyburka	d41710f507	fix spec	2026-07-04 10:12:08 +03:00
Pete Matsyburka	2b53166763	add completed check	2026-07-04 09:59:35 +03:00
Pete Matsyburka	4e56a16a58	adjust filters	2026-07-04 09:59:35 +03:00
Pete Matsyburka	ac7cc77017	use submission completed_at	2026-07-04 09:59:35 +03:00
Pete Matsyburka	9194879c43	populate completed_at	2026-07-04 09:58:56 +03:00
Pete Matsyburka	1902cdaa55	submission completed_at	2026-07-04 09:58:56 +03:00
Alex Turchyn	6314987e69	make possible to unarchive completed submission	2026-07-04 09:57:29 +03:00
Pete Matsyburka	65bcbd7737	adjust authorize	2026-07-04 09:30:43 +03:00
Pete Matsyburka	9b25b8538e	radio group font settings	2026-07-02 10:14:43 +03:00
Pete Matsyburka	bbf8bb2a94	fix autocomplete index use	2026-07-01 13:06:00 +03:00
Pete Matsyburka	2085227cd9	fix dynamic document areas	2026-06-30 17:55:28 +03:00
Alex Turchyn	93e0730210	update docs	2026-06-30 13:31:31 +03:00
Pete Matsyburka	25c5c11ab3	change footer url	2026-06-30 08:39:26 +03:00
Pete Matsyburka	6ed5b5d35d	extract email assets	2026-06-29 13:21:03 +03:00
Alex Turchyn	673cc1e0df	Merge from docusealco/wip	2026-06-29 13:13:29 +03:00
Pete Matsyburka	065dcf6f9f	fix include combined_document_url	2026-06-29 10:28:59 +03:00
Pete Matsyburka	a66b16ce1c	fix rubocop	2026-06-28 19:35:34 +03:00
Pete Matsyburka	e4c0b30284	fix dedup email messages	2026-06-28 17:03:36 +03:00
Pete Matsyburka	3cb37748e9	optimize select	2026-06-28 11:21:04 +03:00
Pete Matsyburka	e54d76f0e2	redact and crop on touchscreen	2026-06-27 19:28:20 +03:00
Pete Matsyburka	f19e037011	fix input mode	2026-06-27 19:02:18 +03:00
Pete Matsyburka	ee3f47d918	adjust edit condition	2026-06-27 17:21:55 +03:00
Pete Matsyburka	a49a645022	fix completed_at index	2026-06-27 11:40:02 +03:00
Pete Matsyburka	cf30441ac6	mcp use template submitters order	2026-06-27 09:08:23 +03:00
Pete Matsyburka	c9bcf866ab	optimize query	2026-06-26 21:33:43 +03:00
Pete Matsyburka	506609f3cd	optimize search	2026-06-25 20:26:33 +03:00
Pete Matsyburka	721172c980	adjust accessibility	2026-06-25 15:53:15 +03:00
Pete Matsyburka	b183db5b80	fix rubocop	2026-06-25 10:35:48 +03:00
Pete Matsyburka	c7f277f404	fix search pagination	2026-06-25 10:28:02 +03:00
Pete Matsyburka	8ac03a9f8a	fix template archived send event	2026-06-25 10:04:54 +03:00
Pete Matsyburka	dc1c386d7e	adjust search	2026-06-25 09:27:59 +03:00
Pete Matsyburka	1eaf4e5bab	fix email stats	2026-06-25 08:48:34 +03:00
Pete Matsyburka	3c0f1c2e73	default order if countless	2026-06-25 08:07:06 +03:00
Pete Matsyburka	b2790776ef	show archived shared templates	2026-06-24 19:29:07 +03:00
Pete Matsyburka	2840359396	adjust shared tag	2026-06-24 17:20:20 +03:00
Pete Matsyburka	c18ddb99a8	optimize queries	2026-06-24 17:20:20 +03:00
Pete Matsyburka	432435aa23	adjust shared templates	2026-06-24 17:20:19 +03:00
Pete Matsyburka	90c1a6f4ad	fix can send emails	2026-06-24 14:42:49 +03:00
Pete Matsyburka	0e8f478c2e	optimize query	2026-06-24 11:31:15 +03:00
Pete Matsyburka	5f23d5a5ab	optimize query	2026-06-23 18:51:24 +03:00
Pete Matsyburka	76821a4c2d	fix opt email footer	2026-06-23 17:40:40 +03:00
Pete Matsyburka	e4a8cca90a	update deps	2026-06-23 09:24:27 +03:00
Pete Matsyburka	6024ed4cd1	adjust accessibility	2026-06-23 09:09:31 +03:00
Pete Matsyburka	3811f8bbb8	fix submission nil name	2026-06-23 08:48:49 +03:00
Pete Matsyburka	306218e5df	update gem	2026-06-22 13:11:04 +03:00
Alex Turchyn	cabfe45608	Merge from docusealco/wip	2026-06-22 13:06:54 +03:00
Pete Matsyburka	4ade6a5911	update gem	2026-06-22 09:26:49 +03:00
Pete Matsyburka	10d45c3e20	add checks	2026-06-22 09:26:48 +03:00
Pete Matsyburka	6fb247ec06	adjust can resubmit	2026-06-21 07:58:23 +03:00
Pete Matsyburka	1546258529	add service url time	2026-06-19 19:20:21 +03:00
Pete Matsyburka	7ec83b8af6	adjust upload url	2026-06-19 08:40:39 +03:00
Pete Matsyburka	21d0a87c17	adjust replace button	2026-06-18 18:31:29 +03:00
Pete Matsyburka	528f59c1bf	disable previewers	2026-06-17 10:46:47 +03:00
Pete Matsyburka	d1535c4cd8	add redact color	2026-06-15 14:45:06 +03:00
Alex Turchyn	da44d51a3b	Merge from docusealco/wip	2026-06-15 13:37:25 +03:00
Pete Matsyburka	73ce10b26a	add cleanup document helper	2026-06-15 12:05:50 +03:00
Pete Matsyburka	13874b8830	add documents editor	2026-06-15 10:21:23 +03:00
Pete Matsyburka	ac66809a05	fix date tz	2026-06-12 14:03:20 +03:00
Pete Matsyburka	f5229d5dec	fix zoom	2026-06-12 12:47:23 +03:00
Pete Matsyburka	222291d11d	update gem	2026-06-09 21:51:06 +03:00
Pete Matsyburka	28f47e1093	handle template archived	2026-06-09 19:49:12 +03:00
Pete Matsyburka	7784346a97	update gem	2026-06-09 12:11:16 +03:00
Alex Turchyn	ed46af8418	Merge from docusealco/wip	2026-06-08 11:56:14 +03:00
Pete Matsyburka	095f25a6e9	adjust image type	2026-06-08 09:31:38 +03:00
Pete Matsyburka	3cdab30dc8	remove oj	2026-06-05 16:55:55 +03:00
Pete Matsyburka	8e462047ba	fix upload callback	2026-06-05 14:45:22 +03:00
Pete Matsyburka	b7f8b65d9d	adjust button style	2026-06-05 09:55:21 +03:00
Alex Turchyn	da21c37254	add Google Drive replace option	2026-06-05 09:55:21 +03:00
Pete Matsyburka	a89aef4a89	adjust zoom	2026-06-04 14:39:02 +03:00
Alex Turchyn	dd6516fd11	add cmd+scroll zooming to template builder	2026-06-04 08:20:38 +03:00
Pete Matsyburka	344a3ce198	adjust sanitize	2026-06-03 13:24:08 +03:00
Pete Matsyburka	62f8283587	adjust html to text	2026-06-02 13:44:52 +03:00
Alex Turchyn	1f89accac3	Merge from docusealco/wip	2026-06-01 14:58:06 +03:00
Pete Matsyburka	9fcaef4cf7	use new_from_memory_copy	2026-05-31 14:28:35 +03:00
Pete Matsyburka	d5738a0631	disable variant_processor	2026-05-31 12:51:52 +03:00
Pete Matsyburka	8bf7a1f95a	adjust image detect fields	2026-05-31 09:20:51 +03:00
Pete Matsyburka	04cf36891e	fix complete button press enter	2026-05-31 09:09:57 +03:00
Pete Matsyburka	b2d9948c30	remove active storage analyzers	2026-05-31 08:06:52 +03:00
Pete Matsyburka	a2c9ac1707	remove image_processing	2026-05-30 21:37:00 +03:00
Pete Matsyburka	46a6bd0108	fix stamp	2026-05-30 12:04:23 +03:00
Pete Matsyburka	5f069e7a40	use load vips	2026-05-30 07:49:40 +03:00
Pete Matsyburka	ff57e5c6ae	fix pdfa	2026-05-29 15:31:32 +03:00
Alex Turchyn	f65b6e2d76	add confirm prompt for template upload via URL	2026-05-29 09:29:21 +03:00
Pete Matsyburka	58fd180ae0	update gem	2026-05-29 08:04:53 +03:00
Pete Matsyburka	cd6503c4c3	adjust image size	2026-05-28 15:37:20 +03:00
Pete Matsyburka	e8b36c2b6d	update gh stars	2026-05-28 14:38:34 +03:00
Pete Matsyburka	51743f1359	fix spec	2026-05-28 10:18:45 +03:00
Pete Matsyburka	504c42646b	refactor template builder data	2026-05-28 10:06:47 +03:00
Pete Matsyburka	c61e84d1b4	adjust archive	2026-05-28 08:40:05 +03:00
Pete Matsyburka	b8ab01c46c	add dynamic documents to template response	2026-05-28 08:29:10 +03:00
Pete Matsyburka	9558060bde	check resubmit config	2026-05-28 08:29:09 +03:00
Pete Matsyburka	0741c879f1	use expires_at with file links	2026-05-27 22:19:18 +03:00
Pete Matsyburka	2e6dd2867e	file url ttl env var	2026-05-26 21:54:59 +03:00
Pete Matsyburka	9f3fcccb61	optimize build	2026-05-26 16:50:10 +03:00
Pete Matsyburka	ae08d7abad	adjust opacity_layer	2026-05-26 13:11:15 +03:00
Pete Matsyburka	16808a7ec6	use pngload_buffer	2026-05-26 13:11:15 +03:00
Pete Matsyburka	b1dfcd6283	fix email typo	2026-05-26 13:11:15 +03:00
Pete Matsyburka	369f4c0f08	sync prefillable field changes	2026-05-26 13:11:15 +03:00
Pete Matsyburka	827de03579	fix result generatrion	2026-05-26 08:57:30 +03:00
Alex Turchyn	0c7f4e5b43	fix sidekiq embedded redis connection	2026-05-25 21:52:34 +03:00
Alex Turchyn	9c700a3fb6	Merge from docusealco/wip	2026-05-25 12:28:05 +03:00
Pete Matsyburka	89bf83febb	adjust autorot	2026-05-23 11:43:28 +03:00
Pete Matsyburka	d44b35cf0a	convert images on upload	2026-05-23 08:25:04 +03:00
Pete Matsyburka	891833e273	refactor process doc	2026-05-22 14:06:04 +03:00
Pete Matsyburka	29d3a80d3f	fix rubocop	2026-05-21 21:55:30 +03:00
Pete Matsyburka	90fef58684	ruby 4.0.5	2026-05-21 21:46:27 +03:00
Pete Matsyburka	07841722ac	adjust image load	2026-05-21 21:44:13 +03:00
Pete Matsyburka	9e4da5948b	convert images on upload	2026-05-21 14:50:30 +03:00
Pete Matsyburka	dc6e4313a1	fix ci	2026-05-20 16:15:15 +03:00
Pete Matsyburka	a68cc0b689	convert images on upload	2026-05-20 15:23:42 +03:00
Pete Matsyburka	d057fb0f67	content type priority	2026-05-19 13:27:16 +03:00
Pete Matsyburka	7e8f045a29	cleanup	2026-05-19 11:42:14 +03:00
Pete Matsyburka	5249d8d18d	update gem	2026-05-19 11:02:15 +03:00
Pete Matsyburka	f0fafbadd4	isolate editor nodes	2026-05-19 10:52:48 +03:00
Pete Matsyburka	8b51079dcc	update gem	2026-05-18 18:42:04 +03:00
Pete Matsyburka	354bccd6e8	handle dangerous extensions	2026-05-18 18:05:16 +03:00
Pete Matsyburka	6806772346	add security headers	2026-05-18 16:47:19 +03:00
Alex Turchyn	60082655d4	Merge from docusealco/wip	2026-05-18 13:45:07 +03:00
Pete Matsyburka	7fe56941fd	optimize pdf images	2026-05-17 19:55:03 +03:00
Pete Matsyburka	abd498dd33	adjust validation message	2026-05-16 08:15:02 +03:00
Pete Matsyburka	99ca0136ed	add percent format	2026-05-16 08:15:02 +03:00
Pete Matsyburka	e52830c9b4	add authorization checks	2026-05-16 08:15:01 +03:00
Pete Matsyburka	755decca27	adjust capture revision	2026-05-15 17:50:18 +03:00
Pete Matsyburka	41604008d1	clamp area box	2026-05-15 17:20:29 +03:00
Pete Matsyburka	5bddce8969	fix i18n	2026-05-14 12:16:36 +03:00
Pete Matsyburka	b25503f141	fix i18n	2026-05-13 10:08:13 +03:00
Pete Matsyburka	bdf1850448	resend emails	2026-05-13 09:59:06 +03:00
Pete Matsyburka	230d3ccf69	fix with download config	2026-05-13 08:52:41 +03:00
Pete Matsyburka	e378025a2d	fix refactor complete button	2026-05-12 22:24:09 +03:00
Alex Turchyn	04129ded90	add complete button to signing form header	2026-05-12 19:19:49 +03:00
Pete Matsyburka	a7891f89f8	do not override custom webhook header	2026-05-11 17:13:26 +03:00
Pete Matsyburka	37d4a8e834	update gem	2026-05-11 14:06:17 +03:00
Alex Turchyn	528a1216f8	Merge from docusealco/wip	2026-05-11 13:52:58 +03:00
Pete Matsyburka	f2479bd259	adjust open revisions	2026-05-11 11:11:16 +03:00
Pete Matsyburka	135f0826d2	fix style	2026-05-09 21:17:18 +03:00
Pete Matsyburka	5710f0177b	update gh stars	2026-05-09 19:25:42 +03:00
Pete Matsyburka	1a3a0528ba	fix i18n	2026-05-09 10:34:20 +03:00
Pete Matsyburka	59793ff374	adjust builder	2026-05-08 19:35:46 +03:00
Pete Matsyburka	3c4ed42419	fix i18n	2026-05-08 18:08:35 +03:00
Pete Matsyburka	6a17b61550	update gem	2026-05-08 16:25:11 +03:00
Pete Matsyburka	76659497b7	typos	2026-05-08 16:12:09 +03:00
Pete Matsyburka	ee50c957cb	update gem	2026-05-08 15:43:34 +03:00
Pete Matsyburka	a9dd200919	add pdfium rotate	2026-05-08 15:43:34 +03:00
Pete Matsyburka	1fa953104a	update gh stars	2026-05-08 15:43:34 +03:00
Pete Matsyburka	50eb5b070e	fix typo	2026-05-08 15:43:34 +03:00
Pete Matsyburka	10fd624bec	add revisions	2026-05-08 15:43:34 +03:00
Alex Turchyn	04ec2f8260	allow permanent delete submissions in archived templates	2026-05-08 15:43:34 +03:00
Pete Matsyburka	d828d79574	improve log	2026-05-08 15:43:34 +03:00
Pete Matsyburka	01dd3fefe5	retry webhooks in test mode	2026-05-08 15:43:34 +03:00
Pete Matsyburka	45ae954c0c	add hmac webhook secret	2026-05-08 15:43:34 +03:00
Pete Matsyburka	1304849b55	update gh stars	2026-05-08 15:43:34 +03:00
Pete Matsyburka	0875faa079	fix date preview	2026-05-08 15:43:34 +03:00
Pete Matsyburka	3aa15d6ea6	update gem	2026-05-08 15:43:34 +03:00
Pete Matsyburka	6557329e97	gh 13k	2026-05-08 15:43:34 +03:00
Pete Matsyburka	be27ce4161	Merge pull request #666 from aqilaziz/docs-fix-readme-typos docs: fix README typos	2026-05-08 14:02:33 +03:00
aqilaziz	a3391a970e	docs: fix README typos	2026-05-08 05:23:28 +07:00
Alex Turchyn	744d45d2c5	Merge from docusealco/wip	2026-05-04 13:55:19 +03:00
Pete Matsyburka	310b16f54a	use mcp source	2026-05-04 09:42:51 +03:00
Pete Matsyburka	6d3ad4a869	update gh stars	2026-05-03 18:37:56 +03:00
Alex Turchyn	1ce2448820	update create_template and send_documents annotations	2026-05-03 17:43:22 +03:00
Pete Matsyburka	07b4ada5be	optimize edit json	2026-05-03 16:32:37 +03:00
Pete Matsyburka	f70bf530ba	hide qr link	2026-05-03 08:19:58 +03:00
Pete Matsyburka	a26aa0f411	remove log	2026-05-03 07:27:24 +03:00
Pete Matsyburka	584577c21f	fix ed.jp email typo	2026-05-01 13:50:17 +03:00
Pete Matsyburka	1503375eed	respond to HEAD file proxy	2026-04-30 17:55:13 +03:00
Pete Matsyburka	2dec099f20	fix signature canvas minimize	2026-04-30 14:51:24 +03:00
Pete Matsyburka	bf6eed4ea2	fix canvas error	2026-04-30 14:42:22 +03:00
Pete Matsyburka	e0dc33cfb4	fix email domain search	2026-04-30 11:27:17 +03:00
Pete Matsyburka	9c9dc27537	fix new area order	2026-04-30 11:13:35 +03:00
Pete Matsyburka	7305637b8c	sort appears on	2026-04-30 10:32:51 +03:00
Pete Matsyburka	a6e22adf2e	fix preview	2026-04-29 18:00:47 +03:00
Pete Matsyburka	809c6b1aa8	fix modal open	2026-04-29 10:27:02 +03:00
Pete Matsyburka	1536ded2a6	redis error log	2026-04-28 19:30:51 +03:00
Pete Matsyburka	76d54971ce	fix test mode clone	2026-04-28 11:58:17 +03:00
Pete Matsyburka	6dec56198c	add require email 2fa to submitter update	2026-04-28 11:58:17 +03:00
Pete Matsyburka	d96d252df3	use post for test mode	2026-04-28 11:58:17 +03:00
Pete Matsyburka	3fca76a716	change state param	2026-04-28 11:58:17 +03:00
Pete Matsyburka	a184fa11f1	move auth links	2026-04-28 11:58:17 +03:00
Pete Matsyburka	e9c0b6a703	rate limit	2026-04-28 11:58:17 +03:00
Pete Matsyburka	ec7df08496	adjust send submission email	2026-04-28 11:58:17 +03:00
Pete Matsyburka	6627d7eac5	fix erblint	2026-04-27 15:34:57 +03:00
Pete Matsyburka	1f8945d710	fix expired filter	2026-04-27 15:31:29 +03:00
Pete Matsyburka	81a6a48d70	validate color	2026-04-26 15:13:19 +03:00