Merge branch 'V2' into activeUsers

# Description of Changes
<img width="1521" height="1041" alt="image"
src="https://github.com/user-attachments/assets/2644bf70-0a9b-4c91-9046-02f555314608"
/>

<img width="1162" height="1598" alt="image"
src="https://github.com/user-attachments/assets/36d693f7-6fdd-4f2b-9db1-39ac336d9055"
/>

<img width="1220" height="1625" alt="image"
src="https://github.com/user-attachments/assets/4d4c19ea-0020-45fb-b15a-9f6ad377856c"
/>

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.

.dockerignore

@@ -0,0 +1,74 @@
+# Node modules and build artifacts
+node_modules
+frontend/node_modules
+frontend/dist
+frontend/build
+frontend/.vite
+frontend/.tauri
+
+# Gradle build artifacts
+.gradle
+build
+bin
+target
+out
+
+# Git
+.git
+.gitignore
+
+# IDE
+.vscode
+.idea
+*.iml
+*.iws
+*.ipr
+
+# Logs
+*.log
+logs
+
+# Environment files
+.env
+.env.*
+!.env.example
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Java compiled files
+*.class
+*.jar
+*.war
+*.ear
+
+# Test reports
+test-results
+coverage
+
+# Docker
+docker-compose.override.yml
+.dockerignore
+
+# Temporary files
+tmp
+temp
+*.tmp
+*.swp
+*~
+
+# Runtime database and config files (locked by running app)
+app/core/configs/**
+stirling/**
+stirling-pdf-DB*.mv.db
+stirling-pdf-DB*.trace.db
+
+# Documentation
+*.md
+!README.md
+docs
+
+# CI/CD
+.github
+.gitlab-ci.yml

.github/workflows/tauri-build.yml

@@ -17,18 +17,11 @@ on:
     branches: [main, V2]
     paths:
       - 'frontend/src-tauri/**'
-      - 'frontend/src/**'
-      - 'frontend/package.json'
-      - 'frontend/package-lock.json'
+      - 'frontend/src/desktop/**'
+      - 'frontend/tsconfig.desktop.json'
       - '.github/workflows/tauri-build.yml'
   push:
     branches: [main, V2]
-    paths:
-      - 'frontend/src-tauri/**'
-      - 'frontend/src/**'
-      - 'frontend/package.json'
-      - 'frontend/package-lock.json'
-      - '.github/workflows/tauri-build.yml'
 
 permissions:
   contents: read
@@ -47,21 +40,19 @@ jobs:
               "windows")
                 echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
-              # "macos")
-              #   echo 'matrix={"include":[{"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-              #   ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
               "linux")
                 echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
               *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                # Disabled Mac builds: {"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
             esac
           else
             # For PR/push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-            # Disabled Mac builds: {"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
           fi
 
   build:
@@ -96,7 +87,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-latest' || matrix.platform == 'macos-13') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
 
 
@@ -183,80 +174,96 @@ jobs:
         working-directory: ./frontend
         run: npm install
 
-      # Disabled Mac builds - Import Apple Developer Certificate
-      # - name: Import Apple Developer Certificate
-      #   if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13'
-      #   env:
-      #     APPLE_ID: ${{ secrets.APPLE_ID }}
-      #     APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-      #     APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-      #     APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-      #     KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-      #   run: |
-      #     echo "Importing Apple Developer Certificate..."
-      #     echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-      #     security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
-      #     security default-keychain -s build.keychain
-      #     security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
-      #     security set-keychain-settings -t 3600 -u build.keychain
-      #     security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
-      #     security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
-      #     security find-identity -v -p codesigning build.keychain
-      # - name: Verify Certificate
-      #   if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13'
-      #   run: |
-      #     echo "Verifying Apple Developer Certificate..."
-      #     CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
-      #     echo "Certificate Info: $CERT_INFO"
-      #     CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-      #     echo "Certificate ID: $CERT_ID"
-      #     echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
-      #     echo "Certificate imported."
+      - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
 
-      # - name: Check DMG creation dependencies (macOS only)
-      #   if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13'
-      #   run: |
-      #     echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
-      #     echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
-      #     echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
-      #     echo "Available disk space: $(df -h /tmp | tail -1)"
-      #     echo "macOS version: $(sw_vers -productVersion)"
-      #     echo "Available tools:"
-      #     ls -la /usr/bin/hd* || echo "No hd* tools found"
+      - name: Verify Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
 
-      - name: Build Tauri app 
+      - name: Check DMG creation dependencies (macOS only)
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
+          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
+          echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
+          echo "Available disk space: $(df -h /tmp | tail -1)"
+          echo "macOS version: $(sw_vers -productVersion)"
+          echo "Available tools:"
+          ls -la /usr/bin/hd* || echo "No hd* tools found"
+
+      - name: Build Tauri app
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           SIGN: 1
-          CI: true 
+          CI: true
         with:
           projectPath: ./frontend
           tauriScript: npx tauri
           args: ${{ matrix.args }}
-          
+
+      - name: Verify notarization (macOS only)
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "🔍 Verifying notarization status..."
+          cd ./frontend/src-tauri/target
+          DMG_FILE=$(find . -name "*.dmg" | head -1)
+          if [ -n "$DMG_FILE" ]; then
+            echo "Found DMG: $DMG_FILE"
+            echo "Checking notarization ticket..."
+            spctl -a -vvv -t install "$DMG_FILE" || echo "⚠️ Notarization check failed or not yet complete"
+            stapler validate "$DMG_FILE" || echo "⚠️ No notarization ticket attached"
+          else
+            echo "⚠️ No DMG file found to verify"
+          fi
+
       - name: Rename artifacts
         shell: bash
         run: |
           mkdir -p ./dist
           cd ./frontend/src-tauri/target
-          
+
           # Find and rename artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
             find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          # Disabled Mac builds
-          # elif [ "${{ matrix.platform }}" = "macos-latest" ] || [ "${{ matrix.platform }}" = "macos-13" ]; then
-          #   find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-          #   find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
           else
             find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
             find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
@@ -273,7 +280,7 @@ jobs:
         shell: bash
         run: |
           cd ./frontend/src-tauri/target
-          
+
           # Check for expected artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             echo "Checking for Windows artifacts..."
@@ -282,14 +289,13 @@ jobs:
               echo "❌ No Windows executable found"
               exit 1
             fi
-          # Disabled Mac builds
-          # elif [ "${{ matrix.platform }}" = "macos-latest" ] || [ "${{ matrix.platform }}" = "macos-13" ]; then
-          #   echo "Checking for macOS artifacts..."
-          #   find . -name "*.dmg" -o -name "*.app" | head -5
-          #   if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
-          #     echo "❌ No macOS artifacts found"
-          #     exit 1
-          #   fi
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            echo "Checking for macOS artifacts..."
+            find . -name "*.dmg" -o -name "*.app" | head -5
+            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
+              echo "❌ No macOS artifacts found"
+              exit 1
+            fi
           else
             echo "Checking for Linux artifacts..."
             find . -name "*.deb" -o -name "*.AppImage" | head -5
@@ -298,7 +304,7 @@ jobs:
               exit 1
             fi
           fi
-          
+
           echo "✅ Build artifacts found for ${{ matrix.name }}"
 
       - name: Test artifact sizes
@@ -331,4 +337,4 @@ jobs:
             echo "❌ Some Tauri builds failed."
             echo "Please check the logs and fix any issues."
             exit 1
-          fi
+          fi

README.md

@@ -115,46 +115,46 @@ Stirling-PDF currently supports 40 languages!
 
 | Language                                     | Progress                               |
 | -------------------------------------------- | -------------------------------------- |
-| Arabic (العربية) (ar_AR)                        | ![83%](https://geps.dev/progress/83)   |
-| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![32%](https://geps.dev/progress/32)   |
-| Basque (Euskara) (eu_ES)                     | ![18%](https://geps.dev/progress/18)   |
-| Bulgarian (Български) (bg_BG)                | ![35%](https://geps.dev/progress/35)   |
-| Catalan (Català) (ca_CA)                     | ![34%](https://geps.dev/progress/34)   |
-| Croatian (Hrvatski) (hr_HR)                  | ![31%](https://geps.dev/progress/31)   |
-| Czech (Česky) (cs_CZ)                        | ![34%](https://geps.dev/progress/34)   |
-| Danish (Dansk) (da_DK)                       | ![30%](https://geps.dev/progress/30)   |
-| Dutch (Nederlands) (nl_NL)                   | ![30%](https://geps.dev/progress/30)   |
+| Arabic (العربية) (ar_AR)                        | ![64%](https://geps.dev/progress/64)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![24%](https://geps.dev/progress/24)   |
+| Basque (Euskara) (eu_ES)                     | ![14%](https://geps.dev/progress/14)   |
+| Bulgarian (Български) (bg_BG)                | ![26%](https://geps.dev/progress/26)   |
+| Catalan (Català) (ca_CA)                     | ![26%](https://geps.dev/progress/26)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![24%](https://geps.dev/progress/24)   |
+| Czech (Česky) (cs_CZ)                        | ![26%](https://geps.dev/progress/26)   |
+| Danish (Dansk) (da_DK)                       | ![23%](https://geps.dev/progress/23)   |
+| Dutch (Nederlands) (nl_NL)                   | ![23%](https://geps.dev/progress/23)   |
 | English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
 | English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
-| French (Français) (fr_FR)                    | ![82%](https://geps.dev/progress/82)   |
-| German (Deutsch) (de_DE)                     | ![84%](https://geps.dev/progress/84)   |
-| Greek (Ελληνικά) (el_GR)                     | ![34%](https://geps.dev/progress/34)   |
-| Hindi (हिंदी) (hi_IN)                          | ![34%](https://geps.dev/progress/34)   |
-| Hungarian (Magyar) (hu_HU)                   | ![38%](https://geps.dev/progress/38)   |
-| Indonesian (Bahasa Indonesia) (id_ID)        | ![31%](https://geps.dev/progress/31)   |
-| Irish (Gaeilge) (ga_IE)                      | ![34%](https://geps.dev/progress/34)   |
-| Italian (Italiano) (it_IT)                   | ![84%](https://geps.dev/progress/84)   |
-| Japanese (日本語) (ja_JP)                    | ![62%](https://geps.dev/progress/62)   |
-| Korean (한국어) (ko_KR)                      | ![34%](https://geps.dev/progress/34)   |
-| Norwegian (Norsk) (no_NB)                    | ![32%](https://geps.dev/progress/32)   |
-| Persian (فارسی) (fa_IR)                      | ![34%](https://geps.dev/progress/34)   |
-| Polish (Polski) (pl_PL)                      | ![36%](https://geps.dev/progress/36)   |
-| Portuguese (Português) (pt_PT)               | ![34%](https://geps.dev/progress/34)   |
-| Portuguese Brazilian (Português) (pt_BR)     | ![83%](https://geps.dev/progress/83)   |
-| Romanian (Română) (ro_RO)                    | ![28%](https://geps.dev/progress/28)   |
-| Russian (Русский) (ru_RU)                    | ![83%](https://geps.dev/progress/83)   |
-| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![37%](https://geps.dev/progress/37)   |
-| Simplified Chinese (简体中文) (zh_CN)         | ![85%](https://geps.dev/progress/85)   |
-| Slovakian (Slovensky) (sk_SK)                | ![26%](https://geps.dev/progress/26)   |
-| Slovenian (Slovenščina) (sl_SI)              | ![36%](https://geps.dev/progress/36)   |
-| Spanish (Español) (es_ES)                    | ![84%](https://geps.dev/progress/84)   |
-| Swedish (Svenska) (sv_SE)                    | ![33%](https://geps.dev/progress/33)   |
-| Thai (ไทย) (th_TH)                           | ![31%](https://geps.dev/progress/31)   |
+| French (Français) (fr_FR)                    | ![63%](https://geps.dev/progress/63)   |
+| German (Deutsch) (de_DE)                     | ![64%](https://geps.dev/progress/64)   |
+| Greek (Ελληνικά) (el_GR)                     | ![26%](https://geps.dev/progress/26)   |
+| Hindi (हिंदी) (hi_IN)                          | ![26%](https://geps.dev/progress/26)   |
+| Hungarian (Magyar) (hu_HU)                   | ![29%](https://geps.dev/progress/29)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![24%](https://geps.dev/progress/24)   |
+| Irish (Gaeilge) (ga_IE)                      | ![26%](https://geps.dev/progress/26)   |
+| Italian (Italiano) (it_IT)                   | ![64%](https://geps.dev/progress/64)   |
+| Japanese (日本語) (ja_JP)                    | ![47%](https://geps.dev/progress/47)   |
+| Korean (한국어) (ko_KR)                      | ![26%](https://geps.dev/progress/26)   |
+| Norwegian (Norsk) (no_NB)                    | ![24%](https://geps.dev/progress/24)   |
+| Persian (فارسی) (fa_IR)                      | ![26%](https://geps.dev/progress/26)   |
+| Polish (Polski) (pl_PL)                      | ![27%](https://geps.dev/progress/27)   |
+| Portuguese (Português) (pt_PT)               | ![26%](https://geps.dev/progress/26)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![64%](https://geps.dev/progress/64)   |
+| Romanian (Română) (ro_RO)                    | ![22%](https://geps.dev/progress/22)   |
+| Russian (Русский) (ru_RU)                    | ![63%](https://geps.dev/progress/63)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![28%](https://geps.dev/progress/28)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![65%](https://geps.dev/progress/65)   |
+| Slovakian (Slovensky) (sk_SK)                | ![19%](https://geps.dev/progress/19)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![27%](https://geps.dev/progress/27)   |
+| Spanish (Español) (es_ES)                    | ![64%](https://geps.dev/progress/64)   |
+| Swedish (Svenska) (sv_SE)                    | ![25%](https://geps.dev/progress/25)   |
+| Thai (ไทย) (th_TH)                           | ![23%](https://geps.dev/progress/23)   |
 | Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
-| Traditional Chinese (繁體中文) (zh_TW)        | ![38%](https://geps.dev/progress/38)   |
-| Turkish (Türkçe) (tr_TR)                     | ![37%](https://geps.dev/progress/37)   |
-| Ukrainian (Українська) (uk_UA)               | ![36%](https://geps.dev/progress/36)   |
-| Vietnamese (Tiếng Việt) (vi_VN)              | ![28%](https://geps.dev/progress/28)   |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![29%](https://geps.dev/progress/29)   |
+| Turkish (Türkçe) (tr_TR)                     | ![28%](https://geps.dev/progress/28)   |
+| Ukrainian (Українська) (uk_UA)               | ![28%](https://geps.dev/progress/28)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![21%](https://geps.dev/progress/21)   |
 | Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
 
 ## Stirling PDF Enterprise

app/common/src/main/java/stirling/software/common/annotations/api/InviteApi.java

@@ -0,0 +1,37 @@
+package stirling.software.common.annotations.api;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+/**
+ * Combined annotation for Invite management controllers.
+ * Includes @RestController, @RequestMapping("/api/v1/invite"), and OpenAPI @Tag.
+ */
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@RestController
+@RequestMapping("/api/v1/invite")
+@Tag(
+        name = "Invite",
+        description =
+                """
+                Invite-link generation and acceptance endpoints for onboarding new users.
+
+                Provides the ability to issue invitation tokens, send optional email invites,
+                validate and accept invite links, and manage pending invitations for teams.
+
+                Typical use cases include:
+                • Admin workflows for issuing time-limited invitations to external users
+                • Self-service invite acceptance and team assignment
+                • License limit enforcement when provisioning new accounts
+
+                Target users: administrators and automation scripts orchestrating user onboarding.
+                """)
+public @interface InviteApi {}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -368,6 +368,10 @@ public class ApplicationProperties {
         private TempFileManagement tempFileManagement = new TempFileManagement();
         private DatabaseBackup databaseBackup = new DatabaseBackup();
         private List<String> corsAllowedOrigins = new ArrayList<>();
+        private String
+                frontendUrl; // Base URL for frontend (used for invite links, etc.). If not set,
+
+        // falls back to backend URL.
 
         public boolean isAnalyticsEnabled() {
             return this.getEnableAnalytics() != null && this.getEnableAnalytics();
@@ -501,10 +505,19 @@ public class ApplicationProperties {
     public static class Ui {
         private String appNameNavbar;
         private List<String> languages;
+        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
 
         public String getAppNameNavbar() {
             return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
         }
+
+        public String getLogoStyle() {
+            // Validate and return either "modern" or "classic"
+            if ("modern".equalsIgnoreCase(logoStyle)) {
+                return "modern";
+            }
+            return "classic"; // default
+        }
     }
 
     @Data
@@ -556,6 +569,7 @@ public class ApplicationProperties {
     public static class Mail {
         private boolean enabled;
         private boolean enableInvites = false;
+        private int inviteLinkExpiryHours = 72; // Default: 72 hours (3 days)
         private String host;
         private int port;
         private String username;

app/common/src/main/java/stirling/software/common/service/UserServiceInterface.java

@@ -8,4 +8,6 @@ public interface UserServiceInterface {
     long getTotalUsersCount();
 
     boolean isCurrentUserAdmin();
+
+    boolean isCurrentUserFirstLogin();
 }

app/common/src/main/java/stirling/software/common/util/FormUtils.java

@@ -1,658 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.IOException;
-import java.lang.reflect.Method;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDResources;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.font.PDType1Font;
-import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
-import org.apache.pdfbox.pdmodel.interactive.form.*;
-
-import lombok.extern.slf4j.Slf4j;
-
-@Slf4j
-public final class FormUtils {
-
-    private FormUtils() {}
-
-    public static boolean hasAnyRotatedPage(PDDocument document) {
-        try {
-            for (PDPage page : document.getPages()) {
-                int rot = page.getRotation();
-                int norm = ((rot % 360) + 360) % 360;
-                if (norm != 0) {
-                    return true;
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Failed to inspect page rotations: {}", e.getMessage(), e);
-        }
-        return false;
-    }
-
-    public static void copyAndTransformFormFields(
-            PDDocument sourceDocument,
-            PDDocument newDocument,
-            int totalPages,
-            int pagesPerSheet,
-            int cols,
-            int rows,
-            float cellWidth,
-            float cellHeight)
-            throws IOException {
-
-        PDDocumentCatalog sourceCatalog = sourceDocument.getDocumentCatalog();
-        PDAcroForm sourceAcroForm = sourceCatalog.getAcroForm();
-
-        if (sourceAcroForm == null || sourceAcroForm.getFields().isEmpty()) {
-            return;
-        }
-
-        PDDocumentCatalog newCatalog = newDocument.getDocumentCatalog();
-        PDAcroForm newAcroForm = new PDAcroForm(newDocument);
-        newCatalog.setAcroForm(newAcroForm);
-
-        PDResources dr = new PDResources();
-        PDType1Font helvetica = new PDType1Font(Standard14Fonts.FontName.HELVETICA);
-        PDType1Font zapfDingbats = new PDType1Font(Standard14Fonts.FontName.ZAPF_DINGBATS);
-        dr.put(COSName.getPDFName("Helv"), helvetica);
-        dr.put(COSName.getPDFName("ZaDb"), zapfDingbats);
-        newAcroForm.setDefaultResources(dr);
-        newAcroForm.setDefaultAppearance("/Helv 12 Tf 0 g");
-
-        // Do not mutate the source AcroForm; skip bad widgets during copy
-        newAcroForm.setNeedAppearances(true);
-
-        Map<String, Integer> fieldNameCounters = new HashMap<>();
-
-        // Build widget -> field map once for efficient lookups
-        Map<PDAnnotationWidget, PDField> widgetFieldMap = buildWidgetFieldMap(sourceAcroForm);
-
-        for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-            PDPage sourcePage = sourceDocument.getPage(pageIndex);
-            List<PDAnnotation> annotations = sourcePage.getAnnotations();
-
-            if (annotations.isEmpty()) {
-                continue;
-            }
-
-            int destinationPageIndex = pageIndex / pagesPerSheet;
-            int adjustedPageIndex = pageIndex % pagesPerSheet;
-            int rowIndex = adjustedPageIndex / cols;
-            int colIndex = adjustedPageIndex % cols;
-
-            if (destinationPageIndex >= newDocument.getNumberOfPages()) {
-                continue;
-            }
-
-            PDPage destinationPage = newDocument.getPage(destinationPageIndex);
-            PDRectangle sourceRect = sourcePage.getMediaBox();
-
-            float scaleWidth = cellWidth / sourceRect.getWidth();
-            float scaleHeight = cellHeight / sourceRect.getHeight();
-            float scale = Math.min(scaleWidth, scaleHeight);
-
-            float x = colIndex * cellWidth + (cellWidth - sourceRect.getWidth() * scale) / 2;
-            float y =
-                    destinationPage.getMediaBox().getHeight()
-                            - ((rowIndex + 1) * cellHeight
-                                    - (cellHeight - sourceRect.getHeight() * scale) / 2);
-
-            copyBasicFormFields(
-                    sourceAcroForm,
-                    newAcroForm,
-                    sourcePage,
-                    destinationPage,
-                    x,
-                    y,
-                    scale,
-                    pageIndex,
-                    fieldNameCounters,
-                    widgetFieldMap);
-        }
-
-        // Refresh appearances to ensure widgets render correctly across viewers
-        try {
-            // Use reflection to avoid compile-time dependency on PDFBox version
-            Method m = newAcroForm.getClass().getMethod("refreshAppearances");
-            m.invoke(newAcroForm);
-        } catch (NoSuchMethodException nsme) {
-            log.warn(
-                    "AcroForm.refreshAppearances() not available in this PDFBox version; relying on NeedAppearances.");
-        } catch (Throwable t) {
-            log.warn("Failed to refresh field appearances via AcroForm: {}", t.getMessage(), t);
-        }
-    }
-
-    private static void copyBasicFormFields(
-            PDAcroForm sourceAcroForm,
-            PDAcroForm newAcroForm,
-            PDPage sourcePage,
-            PDPage destinationPage,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters,
-            Map<PDAnnotationWidget, PDField> widgetFieldMap) {
-
-        try {
-            List<PDAnnotation> sourceAnnotations = sourcePage.getAnnotations();
-            List<PDAnnotation> destinationAnnotations = destinationPage.getAnnotations();
-
-            for (PDAnnotation annotation : sourceAnnotations) {
-                if (annotation instanceof PDAnnotationWidget widgetAnnotation) {
-                    if (widgetAnnotation.getRectangle() == null) {
-                        continue;
-                    }
-                    PDField sourceField =
-                            widgetFieldMap != null ? widgetFieldMap.get(widgetAnnotation) : null;
-                    if (sourceField == null) {
-                        continue; // skip widgets without a matching field
-                    }
-                    if (sourceField instanceof PDTextField pdtextfield) {
-                        createSimpleTextField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdtextfield,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDCheckBox pdCheckBox) {
-                        createSimpleCheckBoxField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdCheckBox,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDRadioButton pdRadioButton) {
-                        createSimpleRadioButtonField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdRadioButton,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDComboBox pdComboBox) {
-                        createSimpleComboBoxField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdComboBox,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDListBox pdlistbox) {
-                        createSimpleListBoxField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdlistbox,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDSignatureField pdSignatureField) {
-                        createSimpleSignatureField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdSignatureField,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDPushButton pdPushButton) {
-                        createSimplePushButtonField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdPushButton,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    }
-                }
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to copy basic form fields for page {}: {}",
-                    pageIndex,
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleTextField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDTextField sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDTextField newTextField = new PDTextField(newAcroForm);
-            newTextField.setDefaultAppearance("/Helv 12 Tf 0 g");
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newTextField,
-                            sourceField.getPartialName(),
-                            "textField",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getValueAsString() != null) {
-                newTextField.setValue(sourceField.getValueAsString());
-            }
-
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create text field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleCheckBoxField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDCheckBox sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDCheckBox newCheckBox = new PDCheckBox(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newCheckBox,
-                            sourceField.getPartialName(),
-                            "checkBox",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.isChecked()) {
-                newCheckBox.check();
-            } else {
-                newCheckBox.unCheck();
-            }
-
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create checkbox field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleRadioButtonField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDRadioButton sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDRadioButton newRadioButton = new PDRadioButton(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newRadioButton,
-                            sourceField.getPartialName(),
-                            "radioButton",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getExportValues() != null) {
-                newRadioButton.setExportValues(sourceField.getExportValues());
-            }
-            if (sourceField.getValue() != null) {
-                newRadioButton.setValue(sourceField.getValue());
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create radio button field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleComboBoxField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDComboBox sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDComboBox newComboBox = new PDComboBox(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newComboBox,
-                            sourceField.getPartialName(),
-                            "comboBox",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getOptions() != null) {
-                newComboBox.setOptions(sourceField.getOptions());
-            }
-            if (sourceField.getValue() != null && !sourceField.getValue().isEmpty()) {
-                newComboBox.setValue(sourceField.getValue());
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create combo box field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleListBoxField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDListBox sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDListBox newListBox = new PDListBox(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newListBox,
-                            sourceField.getPartialName(),
-                            "listBox",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getOptions() != null) {
-                newListBox.setOptions(sourceField.getOptions());
-            }
-            if (sourceField.getValue() != null && !sourceField.getValue().isEmpty()) {
-                newListBox.setValue(sourceField.getValue());
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create list box field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleSignatureField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDSignatureField sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDSignatureField newSignatureField = new PDSignatureField(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newSignatureField,
-                            sourceField.getPartialName(),
-                            "signature",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create signature field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimplePushButtonField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDPushButton sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDPushButton newPushButton = new PDPushButton(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newPushButton,
-                            sourceField.getPartialName(),
-                            "pushButton",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create push button field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static <T extends PDTerminalField> boolean initializeFieldWithWidget(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            T newField,
-            String originalName,
-            String fallbackName,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        String baseName = (originalName != null) ? originalName : fallbackName;
-        String newFieldName = generateUniqueFieldName(baseName, pageIndex, fieldNameCounters);
-        newField.setPartialName(newFieldName);
-
-        PDAnnotationWidget newWidget = new PDAnnotationWidget();
-        PDRectangle sourceRect = sourceWidget.getRectangle();
-        if (sourceRect == null) {
-            return false;
-        }
-
-        float newX = (sourceRect.getLowerLeftX() * scale) + offsetX;
-        float newY = (sourceRect.getLowerLeftY() * scale) + offsetY;
-        float newWidth = sourceRect.getWidth() * scale;
-        float newHeight = sourceRect.getHeight() * scale;
-        newWidget.setRectangle(new PDRectangle(newX, newY, newWidth, newHeight));
-        newWidget.setPage(destinationPage);
-
-        newField.getWidgets().add(newWidget);
-        newWidget.setParent(newField);
-        newAcroForm.getFields().add(newField);
-        destinationAnnotations.add(newWidget);
-        return true;
-    }
-
-    private static String generateUniqueFieldName(
-            String originalName, int pageIndex, Map<String, Integer> fieldNameCounters) {
-        String baseName = "page" + pageIndex + "_" + originalName;
-
-        Integer counter = fieldNameCounters.get(baseName);
-        if (counter == null) {
-            counter = 0;
-        } else {
-            counter++;
-        }
-        fieldNameCounters.put(baseName, counter);
-
-        return counter == 0 ? baseName : baseName + "_" + counter;
-    }
-
-    private static Map<PDAnnotationWidget, PDField> buildWidgetFieldMap(PDAcroForm acroForm) {
-        Map<PDAnnotationWidget, PDField> map = new HashMap<>();
-        if (acroForm == null) {
-            return map;
-        }
-        try {
-            for (PDField field : acroForm.getFieldTree()) {
-                List<PDAnnotationWidget> widgets = field.getWidgets();
-                if (widgets != null) {
-                    for (PDAnnotationWidget w : widgets) {
-                        if (w != null) {
-                            map.put(w, field);
-                        }
-                    }
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Failed to build widget->field map: {}", e.getMessage(), e);
-        }
-        return map;
-    }
-}

app/common/src/main/java/stirling/software/common/util/JarPathUtil.java

@@ -43,26 +43,45 @@ public class JarPathUtil {
     }
 
     /**
-     * Gets the path to the restart-helper.jar file Expected to be in the same directory as the main
-     * JAR
+     * Gets the path to the restart-helper.jar file. Checks multiple possible locations: 1. Same
+     * directory as the main JAR (production deployment) 2. ./build/libs/restart-helper.jar
+     * (development build) 3. app/common/build/libs/restart-helper.jar (multi-module build)
      *
      * @return Path to restart-helper.jar, or null if not found
      */
     public static Path restartHelperJar() {
         Path appJar = currentJar();
-        if (appJar == null) {
-            return null;
+
+        // Define possible locations to check (in order of preference)
+        Path[] possibleLocations = new Path[4];
+
+        // Location 1: Same directory as main JAR (production)
+        if (appJar != null) {
+            possibleLocations[0] = appJar.getParent().resolve("restart-helper.jar");
         }
 
-        Path helperJar = appJar.getParent().resolve("restart-helper.jar");
+        // Location 2: ./build/libs/ (development build)
+        possibleLocations[1] = Paths.get("build", "libs", "restart-helper.jar").toAbsolutePath();
 
-        if (Files.isRegularFile(helperJar)) {
-            log.debug("Restart helper JAR located at: {}", helperJar);
-            return helperJar;
-        } else {
-            log.warn("Restart helper JAR not found at: {}", helperJar);
-            return null;
+        // Location 3: app/common/build/libs/ (multi-module build)
+        possibleLocations[2] =
+                Paths.get("app", "common", "build", "libs", "restart-helper.jar").toAbsolutePath();
+
+        // Location 4: Current working directory
+        possibleLocations[3] = Paths.get("restart-helper.jar").toAbsolutePath();
+
+        // Check each location
+        for (Path location : possibleLocations) {
+            if (location != null && Files.isRegularFile(location)) {
+                log.info("Restart helper JAR found at: {}", location);
+                return location;
+            } else if (location != null) {
+                log.debug("Restart helper JAR not found at: {}", location);
+            }
         }
+
+        log.warn("Restart helper JAR not found in any expected location");
+        return null;
     }
 
     /**

app/common/src/main/java/stirling/software/common/util/RegexPatternUtils.java

@@ -1,5 +1,6 @@
 package stirling.software.common.util;
 
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Pattern;
 import java.util.regex.PatternSyntaxException;
@@ -241,6 +242,11 @@ public final class RegexPatternUtils {
         return getPattern("\\s+");
     }
 
+    /** Pattern for matching punctuation characters */
+    public Pattern getPunctuationPattern() {
+        return getPattern("[\\p{Punct}]+");
+    }
+
     /** Pattern for matching newlines (Windows and Unix style) */
     public Pattern getNewlinesPattern() {
         return getPattern("\\r?\\n");
@@ -286,6 +292,24 @@ public final class RegexPatternUtils {
         return getPattern("[^a-zA-Z0-9 ]");
     }
 
+    /** Pattern for removing bracketed indices like [0], [Child], etc. in field names */
+    public Pattern getFormFieldBracketPattern() {
+        return getPattern("\\[[^\\]]*\\]");
+    }
+
+    /** Pattern that replaces underscores or hyphens with spaces */
+    public Pattern getUnderscoreHyphenPattern() {
+        return getPattern("[-_]+");
+    }
+
+    /**
+     * Pattern that matches camelCase or alpha-numeric boundaries to allow inserting spaces.
+     * Examples: firstName -> first Name, field1 -> field 1, A5Size -> A5 Size
+     */
+    public Pattern getCamelCaseBoundaryPattern() {
+        return getPattern("(?<=[a-z])(?=[A-Z])|(?<=[A-Za-z])(?=\\d)|(?<=\\d)(?=[A-Za-z])");
+    }
+
     /** Pattern for removing angle brackets */
     public Pattern getAngleBracketsPattern() {
         return getPattern("[<>]");
@@ -335,6 +359,26 @@ public final class RegexPatternUtils {
         return getPattern("[1-9][0-9]{0,2}");
     }
 
+    /**
+     * Pattern for very simple generic field tokens such as "field", "text", "checkbox" with
+     * optional numeric suffix (e.g. "field 1"). Case-insensitive.
+     */
+    public Pattern getGenericFieldNamePattern() {
+        return getPattern(
+                "^(field|text|checkbox|radio|button|signature|name|value|option|select|choice)(\\s*\\d+)?$",
+                Pattern.CASE_INSENSITIVE);
+    }
+
+    /** Pattern for short identifiers like t1, f2, a10 etc. */
+    public Pattern getSimpleFormFieldPattern() {
+        return getPattern("^[A-Za-z]{1,2}\\s*\\d{1,3}$");
+    }
+
+    /** Pattern for optional leading 't' followed by digits, e.g., t1, 1, t 12. */
+    public Pattern getOptionalTNumericPattern() {
+        return getPattern("^(?:t\\s*)?\\d+$", Pattern.CASE_INSENSITIVE);
+    }
+
     /** Pattern for validating mathematical expressions */
     public Pattern getMathExpressionPattern() {
         return getPattern("[0-9n+\\-*/() ]+");
@@ -467,6 +511,11 @@ public final class RegexPatternUtils {
         return getPattern("/");
     }
 
+    /** Supported logical types when creating new fields programmatically */
+    public Set<String> getSupportedNewFieldTypes() {
+        return Set.of("text", "checkbox", "combobox", "listbox", "radio", "button", "signature");
+    }
+
     /**
      * Pre-compile commonly used patterns for immediate availability. This eliminates first-call
      * compilation overhead for frequent patterns.

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -75,7 +75,12 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith("/api/v1/auth/login")
                 || trimmedUri.startsWith("/api/v1/auth/refresh")
                 || trimmedUri.startsWith("/api/v1/auth/logout")
+                || trimmedUri.startsWith(
+                        "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
+                // enableLogin)
                 || trimmedUri.startsWith("/v1/api-docs")
+                || trimmedUri.startsWith("/api/v1/invite/validate")
+                || trimmedUri.startsWith("/api/v1/invite/accept")
                 || trimmedUri.contains("/v1/api-docs");
     }
 }

app/common/src/main/java/stirling/software/common/util/YamlHelper.java

@@ -10,6 +10,7 @@ import java.util.Arrays;
 import java.util.Deque;
 import java.util.LinkedHashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.function.Function;
@@ -135,6 +136,17 @@ public class YamlHelper {
                 } else if ("true".equals(newValue) || "false".equals(newValue)) {
                     newValueNode =
                             new ScalarNode(Tag.BOOL, String.valueOf(newValue), ScalarStyle.PLAIN);
+                } else if (newValue instanceof Map<?, ?> map) {
+                    // Handle Map objects - convert to MappingNode
+                    List<NodeTuple> mapTuples = new ArrayList<>();
+                    for (Map.Entry<?, ?> entry : map.entrySet()) {
+                        ScalarNode mapKeyNode =
+                                new ScalarNode(
+                                        Tag.STR, String.valueOf(entry.getKey()), ScalarStyle.PLAIN);
+                        Node mapValueNode = convertValueToNode(entry.getValue());
+                        mapTuples.add(new NodeTuple(mapKeyNode, mapValueNode));
+                    }
+                    newValueNode = new MappingNode(Tag.MAP, mapTuples, FlowStyle.BLOCK);
                 } else if (newValue instanceof List<?> list) {
                     List<Node> sequenceNodes = new ArrayList<>();
                     for (Object item : list) {
@@ -458,6 +470,43 @@ public class YamlHelper {
         return isInteger(object) || isShort(object) || isByte(object) || isLong(object);
     }
 
+    /**
+     * Converts a Java value to a YAML Node.
+     *
+     * @param value The value to convert.
+     * @return The corresponding YAML Node.
+     */
+    private Node convertValueToNode(Object value) {
+        if (value == null) {
+            return new ScalarNode(Tag.NULL, "null", ScalarStyle.PLAIN);
+        } else if (isAnyInteger(value)) {
+            return new ScalarNode(Tag.INT, String.valueOf(value), ScalarStyle.PLAIN);
+        } else if (isFloat(value)) {
+            Object floatValue = Float.valueOf(String.valueOf(value));
+            return new ScalarNode(Tag.FLOAT, String.valueOf(floatValue), ScalarStyle.PLAIN);
+        } else if (value instanceof Boolean || "true".equals(value) || "false".equals(value)) {
+            return new ScalarNode(Tag.BOOL, String.valueOf(value), ScalarStyle.PLAIN);
+        } else if (value instanceof Map<?, ?> map) {
+            // Recursively handle nested maps
+            List<NodeTuple> mapTuples = new ArrayList<>();
+            for (Map.Entry<?, ?> entry : map.entrySet()) {
+                ScalarNode mapKeyNode =
+                        new ScalarNode(Tag.STR, String.valueOf(entry.getKey()), ScalarStyle.PLAIN);
+                Node mapValueNode = convertValueToNode(entry.getValue());
+                mapTuples.add(new NodeTuple(mapKeyNode, mapValueNode));
+            }
+            return new MappingNode(Tag.MAP, mapTuples, FlowStyle.BLOCK);
+        } else if (value instanceof List<?> list) {
+            List<Node> sequenceNodes = new ArrayList<>();
+            for (Object item : list) {
+                sequenceNodes.add(convertValueToNode(item));
+            }
+            return new SequenceNode(Tag.SEQ, sequenceNodes, FlowStyle.FLOW);
+        } else {
+            return new ScalarNode(Tag.STR, String.valueOf(value), ScalarStyle.PLAIN);
+        }
+    }
+
     /**
      * Copies comments from an old node to a new one.
      *

app/core/src/main/java/stirling/software/SPDF/Factories/ReplaceAndInvertColorFactory.java

@@ -5,6 +5,7 @@ import org.springframework.web.multipart.MultipartFile;
 
 import lombok.RequiredArgsConstructor;
 
+import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.common.model.api.misc.HighContrastColorCombination;
 import stirling.software.common.model.api.misc.ReplaceAndInvert;
 import stirling.software.common.util.TempFileManager;
@@ -18,6 +19,7 @@ import stirling.software.common.util.misc.ReplaceAndInvertColorStrategy;
 public class ReplaceAndInvertColorFactory {
 
     private final TempFileManager tempFileManager;
+    private final EndpointConfiguration endpointConfiguration;
 
     public ReplaceAndInvertColorStrategy replaceAndInvert(
             MultipartFile file,
@@ -26,6 +28,13 @@ public class ReplaceAndInvertColorFactory {
             String backGroundColor,
             String textColor) {
 
+        // Check Ghostscript availability for CMYK conversion
+        if (replaceAndInvertOption == ReplaceAndInvert.COLOR_SPACE_CONVERSION
+                && !endpointConfiguration.isGroupEnabled("Ghostscript")) {
+            throw new IllegalStateException(
+                    "CMYK color space conversion requires Ghostscript, which is not available on this system");
+        }
+
         return switch (replaceAndInvertOption) {
             case CUSTOM_COLOR, HIGH_CONTRAST_COLOR ->
                     new CustomColorReplaceStrategy(

app/core/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -294,6 +294,12 @@ public class EndpointConfiguration {
         addEndpointToGroup("Other", "replace-and-invert-color-pdf");
         addEndpointToGroup("Other", "multi-tool");
 
+        // Adding form-related endpoints to "Other" group
+        addEndpointToGroup("Other", "fields");
+        addEndpointToGroup("Other", "modify-fields");
+        addEndpointToGroup("Other", "delete-fields");
+        addEndpointToGroup("Other", "fill");
+
         // Adding endpoints to "Advance" group
         addEndpointToGroup("Advance", "adjust-contrast");
         addEndpointToGroup("Advance", "compress-pdf");
@@ -403,8 +409,6 @@ public class EndpointConfiguration {
         /* Ghostscript */
         addEndpointToGroup("Ghostscript", "repair");
         addEndpointToGroup("Ghostscript", "compress-pdf");
-        addEndpointToGroup("Ghostscript", "crop");
-        addEndpointToGroup("Ghostscript", "replace-invert-pdf");
 
         /* tesseract */
         addEndpointToGroup("tesseract", "ocr-pdf");

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -28,6 +28,8 @@ public class InitialSetup {
 
     private final ApplicationProperties applicationProperties;
 
+    private static boolean isNewServer = false;
+
     @PostConstruct
     public void init() throws IOException {
         initUUIDKey();
@@ -88,6 +90,13 @@ public class InitialSetup {
     }
 
     public void initSetAppVersion() throws IOException {
+        // Check if this is a new server before setting the version
+        String existingVersion = applicationProperties.getAutomaticallyGenerated().getAppVersion();
+        isNewServer =
+                existingVersion == null
+                        || existingVersion.isEmpty()
+                        || existingVersion.equals("0.0.0");
+
         String appVersion = "0.0.0";
         Resource resource = new ClassPathResource("version.properties");
         Properties props = new Properties();
@@ -99,4 +108,8 @@ public class InitialSetup {
         GeneralUtils.saveKeyToSettings("AutomaticallyGenerated.appVersion", appVersion);
         applicationProperties.getAutomaticallyGenerated().setAppVersion(appVersion);
     }
+
+    public static boolean isNewServer() {
+        return isNewServer;
+    }
 }

app/core/src/main/java/stirling/software/SPDF/config/WAUTrackingFilter.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.config;
+
+import java.io.IOException;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
+
+/**
+ * Filter to track browser IDs for Weekly Active Users (WAU) counting.
+ * Only active when security is disabled (no-login mode).
+ */
+@Component
+@ConditionalOnProperty(name = "security.enableLogin", havingValue = "false")
+@RequiredArgsConstructor
+@Slf4j
+public class WAUTrackingFilter implements Filter {
+
+    private final WeeklyActiveUsersService wauService;
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        if (request instanceof HttpServletRequest httpRequest) {
+            // Extract browser ID from header
+            String browserId = httpRequest.getHeader("X-Browser-Id");
+
+            if (browserId != null && !browserId.trim().isEmpty()) {
+                // Record browser access
+                wauService.recordBrowserAccess(browserId);
+            }
+        }
+
+        // Continue the filter chain
+        chain.doFilter(request, response);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -46,8 +46,24 @@ public class WebMvcConfig implements WebMvcConfigurer {
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")
-                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
-                    .allowedHeaders("*")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
                     .allowCredentials(true)
                     .maxAge(3600);
         } else if (hasConfiguredOrigins) {
@@ -63,13 +79,53 @@ public class WebMvcConfig implements WebMvcConfigurer {
                             .toArray(new String[0]);
 
             registry.addMapping("/**")
-                    .allowedOrigins(allowedOrigins)
-                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
-                    .allowedHeaders("*")
+                    .allowedOriginPatterns(allowedOrigins)
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
+                    .allowCredentials(true)
+                    .maxAge(3600);
+        } else {
+            // Default to allowing all origins when nothing is configured
+            logger.info(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
+            registry.addMapping("/**")
+                    .allowedOriginPatterns("*")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
                     .allowCredentials(true)
                     .maxAge(3600);
         }
-        // If no origins are configured and not in Tauri mode, CORS is not enabled (secure by
-        // default)
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/CropController.java

@@ -22,6 +22,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.general.CropPdfForm;
 import stirling.software.common.annotations.AutoJobPostMapping;
@@ -37,6 +38,11 @@ import stirling.software.common.util.WebResponseUtils;
 public class CropController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final EndpointConfiguration endpointConfiguration;
+
+    private boolean isGhostscriptEnabled() {
+        return endpointConfiguration.isGroupEnabled("Ghostscript");
+    }
 
     @AutoJobPostMapping(value = "/crop", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @StandardPdfResponse
@@ -46,9 +52,13 @@ public class CropController {
                     "This operation takes an input PDF file and crops it according to the given"
                             + " coordinates. Input:PDF Output:PDF Type:SISO")
     public ResponseEntity<byte[]> cropPdf(@ModelAttribute CropPdfForm request) throws IOException {
-        if (request.isRemoveDataOutsideCrop()) {
+        if (request.isRemoveDataOutsideCrop() && isGhostscriptEnabled()) {
             return cropWithGhostscript(request);
         } else {
+            if (request.isRemoveDataOutsideCrop()) {
+                log.warn(
+                        "Ghostscript not available - 'removeDataOutsideCrop' option requires Ghostscript. Falling back to visual crop only.");
+            }
             return cropWithPDFBox(request);
         }
     }

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTableOfContentsController.java

@@ -29,7 +29,6 @@ import lombok.RequiredArgsConstructor;
 import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.SPDF.config.swagger.JsonDataResponse;
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.EditTableOfContentsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
@@ -49,13 +48,12 @@ public class EditTableOfContentsController {
     @AutoJobPostMapping(
             value = "/extract-bookmarks",
             consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
-    @JsonDataResponse
     @Operation(
             summary = "Extract PDF Bookmarks",
             description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
     @ResponseBody
-    public List<Map<String, Object>> extractBookmarks(@RequestParam("file") MultipartFile file)
-            throws Exception {
+    public ResponseEntity<List<Map<String, Object>>> extractBookmarks(
+            @RequestParam("file") MultipartFile file) throws Exception {
         PDDocument document = null;
         try {
             document = pdfDocumentFactory.load(file);
@@ -63,10 +61,10 @@ public class EditTableOfContentsController {
 
             if (outline == null) {
                 log.info("No outline/bookmarks found in PDF");
-                return new ArrayList<>();
+                return ResponseEntity.ok(new ArrayList<>());
             }
 
-            return extractBookmarkItems(document, outline);
+            return ResponseEntity.ok(extractBookmarkItems(document, outline));
         } finally {
             if (document != null) {
                 document.close();

app/core/src/main/java/stirling/software/SPDF/controller/api/MultiPageLayoutController.java

@@ -26,7 +26,6 @@ import stirling.software.SPDF.model.api.general.MergeMultiplePagesRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.util.FormUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;
 
@@ -137,26 +136,6 @@ public class MultiPageLayoutController {
 
         contentStream.close();
 
-        // If any source page is rotated, skip form copying/transformation entirely
-        boolean hasRotation = FormUtils.hasAnyRotatedPage(sourceDocument);
-        if (hasRotation) {
-            log.info("Source document has rotated pages; skipping form field copying.");
-        } else {
-            try {
-                FormUtils.copyAndTransformFormFields(
-                        sourceDocument,
-                        newDocument,
-                        totalPages,
-                        pagesPerSheet,
-                        cols,
-                        rows,
-                        cellWidth,
-                        cellHeight);
-            } catch (Exception e) {
-                log.warn("Failed to copy and transform form fields: {}", e.getMessage(), e);
-            }
-        }
-
         sourceDocument.close();
 
         ByteArrayOutputStream baos = new ByteArrayOutputStream();

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -10,7 +10,10 @@ import org.springframework.web.bind.annotation.RequestParam;
 
 import io.swagger.v3.oas.annotations.Hidden;
 
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.SPDF.config.EndpointConfiguration;
+import stirling.software.SPDF.config.InitialSetup;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
 import stirling.software.common.model.ApplicationProperties;
@@ -19,6 +22,7 @@ import stirling.software.common.service.UserServiceInterface;
 
 @ConfigApi
 @Hidden
+@Slf4j
 public class ConfigController {
 
     private final ApplicationProperties applicationProperties;
@@ -58,12 +62,20 @@ public class ConfigController {
             // Extract values from ApplicationProperties
             configData.put("appNameNavbar", applicationProperties.getUi().getAppNameNavbar());
             configData.put("languages", applicationProperties.getUi().getLanguages());
+            configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
 
             // Security settings
-            configData.put("enableLogin", applicationProperties.getSecurity().getEnableLogin());
+            // enableLogin requires both the config flag AND proprietary features to be loaded
+            // If userService is null, proprietary module isn't loaded
+            // (DISABLE_ADDITIONAL_FEATURES=true or DOCKER_ENABLE_SECURITY=false)
+            boolean enableLogin =
+                    applicationProperties.getSecurity().getEnableLogin() && userService != null;
+            configData.put("enableLogin", enableLogin);
 
-            // Mail settings
-            configData.put("enableEmailInvites", applicationProperties.getMail().isEnableInvites());
+            // Mail settings - check both SMTP enabled AND invites enabled
+            boolean smtpEnabled = applicationProperties.getMail().isEnabled();
+            boolean invitesEnabled = applicationProperties.getMail().isEnableInvites();
+            configData.put("enableEmailInvites", smtpEnabled && invitesEnabled);
 
             // Check if user is admin using UserServiceInterface
             boolean isAdmin = false;
@@ -76,6 +88,22 @@ public class ConfigController {
             }
             configData.put("isAdmin", isAdmin);
 
+            // Check if this is a new server (version was 0.0.0 before initialization)
+            configData.put("isNewServer", InitialSetup.isNewServer());
+
+            // Check if the current user is a first-time user
+            boolean isNewUser =
+                    false; // Default to false when security is disabled or user not found
+            if (userService != null) {
+                try {
+                    isNewUser = userService.isCurrentUserFirstLogin();
+                } catch (Exception e) {
+                    // If there's an error, assume not new user for safety
+                    isNewUser = false;
+                }
+            }
+            configData.put("isNewUser", isNewUser);
+
             // System settings
             configData.put(
                     "enableAlphaFunctionality",
@@ -126,6 +154,25 @@ public class ConfigController {
                 // EE features not available, continue without them
             }
 
+            // Add version and machine info for update checking
+            try {
+                if (applicationContext.containsBean("appVersion")) {
+                    configData.put(
+                            "appVersion", applicationContext.getBean("appVersion", String.class));
+                }
+                if (applicationContext.containsBean("machineType")) {
+                    configData.put(
+                            "machineType", applicationContext.getBean("machineType", String.class));
+                }
+                if (applicationContext.containsBean("activeSecurity")) {
+                    configData.put(
+                            "activeSecurity",
+                            applicationContext.getBean("activeSecurity", Boolean.class));
+                }
+            } catch (Exception e) {
+                // Version/machine info not available
+            }
+
             return ResponseEntity.ok(configData);
 
         } catch (Exception e) {

app/core/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java

@@ -23,6 +23,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointInspector;
 import stirling.software.SPDF.config.StartupApplicationListener;
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
 import stirling.software.common.annotations.api.InfoApi;
 import stirling.software.common.model.ApplicationProperties;
 
@@ -34,6 +35,7 @@ public class MetricsController {
     private final ApplicationProperties applicationProperties;
     private final MeterRegistry meterRegistry;
     private final EndpointInspector endpointInspector;
+    private final Optional<WeeklyActiveUsersService> wauService;
     private boolean metricsEnabled;
 
     @PostConstruct
@@ -352,6 +354,35 @@ public class MetricsController {
         return ResponseEntity.ok(formatDuration(uptime));
     }
 
+    @GetMapping("/wau")
+    @Operation(
+            summary = "Weekly Active Users statistics",
+            description =
+                    "Returns WAU (Weekly Active Users) count and total unique browsers. "
+                            + "Only available when security is disabled (no-login mode). "
+                            + "Tracks unique browsers via client-generated UUID in localStorage.")
+    public ResponseEntity<?> getWeeklyActiveUsers() {
+        if (!metricsEnabled) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("This endpoint is disabled.");
+        }
+
+        // Check if WAU service is available (only when security.enableLogin=false)
+        if (wauService.isEmpty()) {
+            return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                    .body("WAU tracking is only available when security is disabled (no-login mode)");
+        }
+
+        WeeklyActiveUsersService service = wauService.get();
+
+        Map<String, Object> wauStats = new HashMap<>();
+        wauStats.put("weeklyActiveUsers", service.getWeeklyActiveUsers());
+        wauStats.put("totalUniqueBrowsers", service.getTotalUniqueBrowsers());
+        wauStats.put("daysOnline", service.getDaysOnline());
+        wauStats.put("trackingSince", service.getStartTime().toString());
+
+        return ResponseEntity.ok(wauStats);
+    }
+
     private String formatDuration(Duration duration) {
         long days = duration.toDays();
         long hours = duration.toHoursPart();

app/core/src/main/java/stirling/software/SPDF/service/WeeklyActiveUsersService.java

@@ -0,0 +1,100 @@
+package stirling.software.SPDF.service;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Service for tracking Weekly Active Users (WAU) in no-login mode.
+ * Uses in-memory storage with automatic cleanup of old entries.
+ */
+@Service
+@Slf4j
+public class WeeklyActiveUsersService {
+
+    // Map of browser ID -> last seen timestamp
+    private final Map<String, Instant> activeBrowsers = new ConcurrentHashMap<>();
+
+    // Track total unique browsers seen (overall)
+    private long totalUniqueBrowsers = 0;
+
+    // Application start time
+    private final Instant startTime = Instant.now();
+
+    /**
+     * Records a browser access with the current timestamp
+     * @param browserId Unique browser identifier from X-Browser-Id header
+     */
+    public void recordBrowserAccess(String browserId) {
+        if (browserId == null || browserId.trim().isEmpty()) {
+            return;
+        }
+
+        boolean isNewBrowser = !activeBrowsers.containsKey(browserId);
+        activeBrowsers.put(browserId, Instant.now());
+
+        if (isNewBrowser) {
+            totalUniqueBrowsers++;
+            log.debug("New browser recorded: {} (Total: {})", browserId, totalUniqueBrowsers);
+        }
+    }
+
+    /**
+     * Gets the count of unique browsers seen in the last 7 days
+     * @return Weekly Active Users count
+     */
+    public long getWeeklyActiveUsers() {
+        cleanupOldEntries();
+        return activeBrowsers.size();
+    }
+
+    /**
+     * Gets the total count of unique browsers ever seen
+     * @return Total unique browsers count
+     */
+    public long getTotalUniqueBrowsers() {
+        return totalUniqueBrowsers;
+    }
+
+    /**
+     * Gets the number of days the service has been running
+     * @return Days online
+     */
+    public long getDaysOnline() {
+        return ChronoUnit.DAYS.between(startTime, Instant.now());
+    }
+
+    /**
+     * Gets the timestamp when tracking started
+     * @return Start time
+     */
+    public Instant getStartTime() {
+        return startTime;
+    }
+
+    /**
+     * Removes entries older than 7 days
+     */
+    private void cleanupOldEntries() {
+        Instant sevenDaysAgo = Instant.now().minus(7, ChronoUnit.DAYS);
+        activeBrowsers.entrySet().removeIf(entry -> entry.getValue().isBefore(sevenDaysAgo));
+    }
+
+    /**
+     * Manual cleanup trigger (can be called by scheduled task if needed)
+     */
+    public void performCleanup() {
+        int sizeBefore = activeBrowsers.size();
+        cleanupOldEntries();
+        int sizeAfter = activeBrowsers.size();
+
+        if (sizeBefore != sizeAfter) {
+            log.debug("Cleaned up {} old browser entries", sizeBefore - sizeAfter);
+        }
+    }
+}

app/core/src/main/resources/settings.yml.template

@@ -128,6 +128,7 @@ system:
   disableSanitize: false # set to true to disable Sanitize HTML; (can lead to injections in HTML)
   maxDPI: 500 # Maximum allowed DPI for PDF to image conversion
   corsAllowedOrigins: [] # List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS.
+  frontendUrl: '' # Base URL for frontend (e.g. 'https://pdf.example.com'). Used for generating invite links in emails. If empty, falls back to backend URL.
   serverCertificate:
     enabled: true # Enable server-side certificate for "Sign with Stirling-PDF" option
     organizationName: Stirling-PDF # Organization name for generated certificates
@@ -175,6 +176,7 @@ system:
 
 ui:
   appNameNavbar: '' # name displayed on the navigation bar
+  logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)
   languages: [] # If empty, all languages are enabled. To display only German and Polish ["de_DE", "pl_PL"]. British English is always enabled.
 
 endpoints:

app/core/src/main/resources/static/css/theme/theme.css

@@ -7,6 +7,8 @@
   --md-sys-color-surface-3: color-mix(in srgb, var(--md-sys-color-primary) 13%, rgba(0, 0, 255, 0.11) 5%);
   --md-sys-color-surface-4: color-mix(in srgb, var(--md-sys-color-primary) 13%, rgba(0, 0, 255, 0.12) 5%);
   --md-sys-color-surface-5: color-mix(in srgb, var(--md-sys-color-primary) 13%, rgba(0, 0, 255, 0.14) 5%);
+  /* Clear button disabled text color (default/light) */
+  --spdf-clear-disabled-text: var(--md-sys-color-primary);
   /* Icon fill */
   --md-sys-icon-fill-0: 'FILL' 0, 'wght' 500;
   --md-sys-icon-fill-1: 'FILL' 1, 'wght' 500;
@@ -25,6 +27,12 @@
   --md-sys-elevation-5: 0px 8px 10px -6px rgb(var(--md-elevation-shadow-color), 0.2), 0px 16px 24px 2px rgb(var(--md-elevation-shadow-color), 0.14), 0px 6px 30px 5px rgb(var(--md-elevation-shadow-color), 0.12);
 }
 
+/* Dark theme overrides */
+.dark-theme {
+  /* In dark mode, use a neutral grey for disabled Clear button text */
+  --spdf-clear-disabled-text: var(--mantine-color-gray-5, #9e9e9e);
+}
+
 .fill {
   font-variation-settings: var(--md-sys-icon-fill-1);
 }

app/core/src/test/java/stirling/software/SPDF/controller/api/EditTableOfContentsControllerTest.java

@@ -24,6 +24,7 @@ import org.mockito.ArgumentMatchers;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.mock.web.MockMultipartFile;
@@ -86,9 +87,13 @@ class EditTableOfContentsControllerTest {
         when(mockOutlineItem.getNextSibling()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertEquals(1, result.size());
 
@@ -108,9 +113,13 @@ class EditTableOfContentsControllerTest {
         when(mockCatalog.getDocumentOutline()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertTrue(result.isEmpty());
         verify(mockDocument).close();
@@ -142,9 +151,13 @@ class EditTableOfContentsControllerTest {
         when(childItem.getNextSibling()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertEquals(1, result.size());
 
@@ -178,9 +191,13 @@ class EditTableOfContentsControllerTest {
         when(mockOutlineItem.getNextSibling()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertEquals(1, result.size());
 

app/proprietary/src/main/java/stirling/software/proprietary/config/AuditJpaConfig.java

@@ -1,17 +1,15 @@
 package stirling.software.proprietary.config;
 
 import org.springframework.context.annotation.Configuration;
-import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
 import org.springframework.scheduling.annotation.EnableScheduling;
 import org.springframework.transaction.annotation.EnableTransactionManagement;
 
-/** Configuration to explicitly enable JPA repositories and scheduling for the audit system. */
+/** Configuration to enable scheduling for the audit system. */
 @Configuration
 @EnableTransactionManagement
-@EnableJpaRepositories(basePackages = "stirling.software.proprietary.repository")
 @EnableScheduling
 public class AuditJpaConfig {
-    // This configuration enables JPA repositories in the specified package
-    // and enables scheduling for audit cleanup tasks
+    // This configuration enables scheduling for audit cleanup tasks
+    // JPA repositories are now managed by DatabaseConfig to avoid conflicts
     // No additional beans or methods needed
 }

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AuditRestController.java

@@ -0,0 +1,434 @@
+package stirling.software.proprietary.controller.api;
+
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.*;
+import java.util.stream.Collectors;
+
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.domain.Sort;
+import org.springframework.format.annotation.DateTimeFormat;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.annotations.api.ProprietaryUiDataApi;
+import stirling.software.proprietary.audit.AuditEventType;
+import stirling.software.proprietary.model.security.PersistentAuditEvent;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
+import stirling.software.proprietary.security.config.EnterpriseEndpoint;
+
+/** REST API controller for audit data used by React frontend. */
+@Slf4j
+@ProprietaryUiDataApi
+@PreAuthorize("hasRole('ADMIN')")
+@RequiredArgsConstructor
+@EnterpriseEndpoint
+public class AuditRestController {
+
+    private final PersistentAuditEventRepository auditRepository;
+    private final ObjectMapper objectMapper;
+
+    /**
+     * Get audit events with pagination and filters. Maps to frontend's getEvents() call.
+     *
+     * @param page Page number (0-indexed)
+     * @param pageSize Number of items per page
+     * @param eventType Filter by event type
+     * @param username Filter by username (principal)
+     * @param startDate Filter start date
+     * @param endDate Filter end date
+     * @return Paginated audit events response
+     */
+    @GetMapping("/audit-events")
+    public ResponseEntity<AuditEventsResponse> getAuditEvents(
+            @RequestParam(value = "page", defaultValue = "0") int page,
+            @RequestParam(value = "pageSize", defaultValue = "30") int pageSize,
+            @RequestParam(value = "eventType", required = false) String eventType,
+            @RequestParam(value = "username", required = false) String username,
+            @RequestParam(value = "startDate", required = false)
+                    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
+                    LocalDate startDate,
+            @RequestParam(value = "endDate", required = false)
+                    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
+                    LocalDate endDate) {
+
+        Pageable pageable = PageRequest.of(page, pageSize, Sort.by("timestamp").descending());
+        Page<PersistentAuditEvent> events;
+
+        // Apply filters based on provided parameters
+        if (eventType != null && username != null && startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events =
+                    auditRepository.findByPrincipalAndTypeAndTimestampBetween(
+                            username, eventType, start, end, pageable);
+        } else if (eventType != null && username != null) {
+            events = auditRepository.findByPrincipalAndType(username, eventType, pageable);
+        } else if (eventType != null && startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events = auditRepository.findByTypeAndTimestampBetween(eventType, start, end, pageable);
+        } else if (username != null && startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events =
+                    auditRepository.findByPrincipalAndTimestampBetween(
+                            username, start, end, pageable);
+        } else if (startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events = auditRepository.findByTimestampBetween(start, end, pageable);
+        } else if (eventType != null) {
+            events = auditRepository.findByType(eventType, pageable);
+        } else if (username != null) {
+            events = auditRepository.findByPrincipal(username, pageable);
+        } else {
+            events = auditRepository.findAll(pageable);
+        }
+
+        // Convert to response format expected by frontend
+        List<AuditEventDto> eventDtos =
+                events.getContent().stream().map(this::convertToDto).collect(Collectors.toList());
+
+        AuditEventsResponse response =
+                AuditEventsResponse.builder()
+                        .events(eventDtos)
+                        .totalEvents((int) events.getTotalElements())
+                        .page(events.getNumber())
+                        .pageSize(events.getSize())
+                        .totalPages(events.getTotalPages())
+                        .build();
+
+        return ResponseEntity.ok(response);
+    }
+
+    /**
+     * Get chart data for dashboard. Maps to frontend's getChartsData() call.
+     *
+     * @param period Time period for charts (day/week/month)
+     * @return Chart data for events by type, user, and over time
+     */
+    @GetMapping("/audit-charts")
+    public ResponseEntity<AuditChartsData> getAuditCharts(
+            @RequestParam(value = "period", defaultValue = "week") String period) {
+
+        // Calculate days based on period
+        int days;
+        switch (period.toLowerCase()) {
+            case "day":
+                days = 1;
+                break;
+            case "month":
+                days = 30;
+                break;
+            case "week":
+            default:
+                days = 7;
+                break;
+        }
+
+        // Get events from the specified period
+        Instant startDate = Instant.now().minus(java.time.Duration.ofDays(days));
+        List<PersistentAuditEvent> events = auditRepository.findByTimestampAfter(startDate);
+
+        // Count events by type
+        Map<String, Long> eventsByType =
+                events.stream()
+                        .collect(
+                                Collectors.groupingBy(
+                                        PersistentAuditEvent::getType, Collectors.counting()));
+
+        // Count events by principal (user)
+        Map<String, Long> eventsByUser =
+                events.stream()
+                        .collect(
+                                Collectors.groupingBy(
+                                        PersistentAuditEvent::getPrincipal, Collectors.counting()));
+
+        // Count events by day
+        Map<String, Long> eventsByDay =
+                events.stream()
+                        .collect(
+                                Collectors.groupingBy(
+                                        e ->
+                                                LocalDateTime.ofInstant(
+                                                                e.getTimestamp(),
+                                                                ZoneId.systemDefault())
+                                                        .format(DateTimeFormatter.ISO_LOCAL_DATE),
+                                        Collectors.counting()));
+
+        // Convert to ChartData format
+        ChartData eventsByTypeChart =
+                ChartData.builder()
+                        .labels(new ArrayList<>(eventsByType.keySet()))
+                        .values(
+                                eventsByType.values().stream()
+                                        .map(Long::intValue)
+                                        .collect(Collectors.toList()))
+                        .build();
+
+        ChartData eventsByUserChart =
+                ChartData.builder()
+                        .labels(new ArrayList<>(eventsByUser.keySet()))
+                        .values(
+                                eventsByUser.values().stream()
+                                        .map(Long::intValue)
+                                        .collect(Collectors.toList()))
+                        .build();
+
+        // Sort events by day for time series
+        TreeMap<String, Long> sortedEventsByDay = new TreeMap<>(eventsByDay);
+        ChartData eventsOverTimeChart =
+                ChartData.builder()
+                        .labels(new ArrayList<>(sortedEventsByDay.keySet()))
+                        .values(
+                                sortedEventsByDay.values().stream()
+                                        .map(Long::intValue)
+                                        .collect(Collectors.toList()))
+                        .build();
+
+        AuditChartsData chartsData =
+                AuditChartsData.builder()
+                        .eventsByType(eventsByTypeChart)
+                        .eventsByUser(eventsByUserChart)
+                        .eventsOverTime(eventsOverTimeChart)
+                        .build();
+
+        return ResponseEntity.ok(chartsData);
+    }
+
+    /**
+     * Get available event types for filtering. Maps to frontend's getEventTypes() call.
+     *
+     * @return List of unique event types
+     */
+    @GetMapping("/audit-event-types")
+    public ResponseEntity<List<String>> getEventTypes() {
+        // Get distinct event types from the database
+        List<String> dbTypes = auditRepository.findDistinctEventTypes();
+
+        // Include standard enum types in case they're not in the database yet
+        List<String> enumTypes =
+                Arrays.stream(AuditEventType.values())
+                        .map(AuditEventType::name)
+                        .collect(Collectors.toList());
+
+        // Combine both sources, remove duplicates, and sort
+        Set<String> combinedTypes = new HashSet<>();
+        combinedTypes.addAll(dbTypes);
+        combinedTypes.addAll(enumTypes);
+
+        List<String> result = combinedTypes.stream().sorted().collect(Collectors.toList());
+
+        return ResponseEntity.ok(result);
+    }
+
+    /**
+     * Get list of users for filtering. Maps to frontend's getUsers() call.
+     *
+     * @return List of unique usernames
+     */
+    @GetMapping("/audit-users")
+    public ResponseEntity<List<String>> getUsers() {
+        // Use the countByPrincipal query to get unique principals
+        List<Object[]> principalCounts = auditRepository.countByPrincipal();
+
+        List<String> users =
+                principalCounts.stream()
+                        .map(arr -> (String) arr[0])
+                        .sorted()
+                        .collect(Collectors.toList());
+
+        return ResponseEntity.ok(users);
+    }
+
+    /**
+     * Export audit data in CSV or JSON format. Maps to frontend's exportData() call.
+     *
+     * @param format Export format (csv or json)
+     * @param eventType Filter by event type
+     * @param username Filter by username
+     * @param startDate Filter start date
+     * @param endDate Filter end date
+     * @return File download response
+     */
+    @GetMapping("/audit-export")
+    public ResponseEntity<byte[]> exportAuditData(
+            @RequestParam(value = "format", defaultValue = "csv") String format,
+            @RequestParam(value = "eventType", required = false) String eventType,
+            @RequestParam(value = "username", required = false) String username,
+            @RequestParam(value = "startDate", required = false)
+                    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
+                    LocalDate startDate,
+            @RequestParam(value = "endDate", required = false)
+                    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
+                    LocalDate endDate) {
+
+        // Get data with same filtering as getAuditEvents
+        List<PersistentAuditEvent> events;
+
+        if (eventType != null && username != null && startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events =
+                    auditRepository.findAllByPrincipalAndTypeAndTimestampBetweenForExport(
+                            username, eventType, start, end);
+        } else if (eventType != null && username != null) {
+            events = auditRepository.findAllByPrincipalAndTypeForExport(username, eventType);
+        } else if (eventType != null && startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events =
+                    auditRepository.findAllByTypeAndTimestampBetweenForExport(
+                            eventType, start, end);
+        } else if (username != null && startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events =
+                    auditRepository.findAllByPrincipalAndTimestampBetweenForExport(
+                            username, start, end);
+        } else if (startDate != null && endDate != null) {
+            Instant start = startDate.atStartOfDay(ZoneId.systemDefault()).toInstant();
+            Instant end = endDate.plusDays(1).atStartOfDay(ZoneId.systemDefault()).toInstant();
+            events = auditRepository.findAllByTimestampBetweenForExport(start, end);
+        } else if (eventType != null) {
+            events = auditRepository.findByTypeForExport(eventType);
+        } else if (username != null) {
+            events = auditRepository.findAllByPrincipalForExport(username);
+        } else {
+            events = auditRepository.findAll();
+        }
+
+        // Export based on format
+        if ("json".equalsIgnoreCase(format)) {
+            return exportAsJson(events);
+        } else {
+            return exportAsCsv(events);
+        }
+    }
+
+    // Helper methods
+
+    private AuditEventDto convertToDto(PersistentAuditEvent event) {
+        // Parse the JSON data field if present
+        Map<String, Object> details = new HashMap<>();
+        if (event.getData() != null && !event.getData().isEmpty()) {
+            try {
+                @SuppressWarnings("unchecked")
+                Map<String, Object> parsed = objectMapper.readValue(event.getData(), Map.class);
+                details = parsed;
+            } catch (JsonProcessingException e) {
+                log.warn("Failed to parse audit event data as JSON: {}", event.getData());
+                details.put("rawData", event.getData());
+            }
+        }
+
+        return AuditEventDto.builder()
+                .id(String.valueOf(event.getId()))
+                .timestamp(event.getTimestamp().toString())
+                .eventType(event.getType())
+                .username(event.getPrincipal())
+                .ipAddress((String) details.getOrDefault("ipAddress", "")) // Extract if available
+                .details(details)
+                .build();
+    }
+
+    private ResponseEntity<byte[]> exportAsCsv(List<PersistentAuditEvent> events) {
+        StringBuilder csv = new StringBuilder();
+        csv.append("ID,Principal,Type,Timestamp,Data\n");
+
+        DateTimeFormatter formatter = DateTimeFormatter.ISO_INSTANT;
+
+        for (PersistentAuditEvent event : events) {
+            csv.append(event.getId()).append(",");
+            csv.append(escapeCSV(event.getPrincipal())).append(",");
+            csv.append(escapeCSV(event.getType())).append(",");
+            csv.append(formatter.format(event.getTimestamp())).append(",");
+            csv.append(escapeCSV(event.getData())).append("\n");
+        }
+
+        byte[] csvBytes = csv.toString().getBytes();
+
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_OCTET_STREAM);
+        headers.setContentDispositionFormData("attachment", "audit_export.csv");
+
+        return ResponseEntity.ok().headers(headers).body(csvBytes);
+    }
+
+    private ResponseEntity<byte[]> exportAsJson(List<PersistentAuditEvent> events) {
+        try {
+            byte[] jsonBytes = objectMapper.writeValueAsBytes(events);
+
+            HttpHeaders headers = new HttpHeaders();
+            headers.setContentType(MediaType.APPLICATION_JSON);
+            headers.setContentDispositionFormData("attachment", "audit_export.json");
+
+            return ResponseEntity.ok().headers(headers).body(jsonBytes);
+        } catch (JsonProcessingException e) {
+            log.error("Error serializing audit events to JSON", e);
+            return ResponseEntity.internalServerError().build();
+        }
+    }
+
+    private String escapeCSV(String field) {
+        if (field == null) {
+            return "";
+        }
+        // Replace double quotes with two double quotes and wrap in quotes
+        return "\"" + field.replace("\"", "\"\"") + "\"";
+    }
+
+    // DTOs for response formatting
+
+    @lombok.Data
+    @lombok.Builder
+    public static class AuditEventsResponse {
+        private List<AuditEventDto> events;
+        private int totalEvents;
+        private int page;
+        private int pageSize;
+        private int totalPages;
+    }
+
+    @lombok.Data
+    @lombok.Builder
+    public static class AuditEventDto {
+        private String id;
+        private String timestamp;
+        private String eventType;
+        private String username;
+        private String ipAddress;
+        private Map<String, Object> details;
+    }
+
+    @lombok.Data
+    @lombok.Builder
+    public static class AuditChartsData {
+        private ChartData eventsByType;
+        private ChartData eventsByUser;
+        private ChartData eventsOverTime;
+    }
+
+    @lombok.Data
+    @lombok.Builder
+    public static class ChartData {
+        private List<String> labels;
+        private List<Integer> values;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java

@@ -39,6 +39,7 @@ import stirling.software.proprietary.audit.AuditLevel;
 import stirling.software.proprietary.config.AuditConfigurationProperties;
 import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.model.dto.TeamWithUserCountDTO;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
 import stirling.software.proprietary.security.config.EnterpriseEndpoint;
 import stirling.software.proprietary.security.database.repository.SessionRepository;
 import stirling.software.proprietary.security.database.repository.UserRepository;
@@ -50,6 +51,7 @@ import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrin
 import stirling.software.proprietary.security.service.DatabaseService;
 import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
 
 @Slf4j
 @ProprietaryUiDataApi
@@ -64,6 +66,8 @@ public class ProprietaryUIDataController {
     private final DatabaseService databaseService;
     private final boolean runningEE;
     private final ObjectMapper objectMapper;
+    private final UserLicenseSettingsService licenseSettingsService;
+    private final PersistentAuditEventRepository auditRepository;
 
     public ProprietaryUIDataController(
             ApplicationProperties applicationProperties,
@@ -74,7 +78,9 @@ public class ProprietaryUIDataController {
             SessionRepository sessionRepository,
             DatabaseService databaseService,
             ObjectMapper objectMapper,
-            @Qualifier("runningEE") boolean runningEE) {
+            @Qualifier("runningEE") boolean runningEE,
+            UserLicenseSettingsService licenseSettingsService,
+            PersistentAuditEventRepository auditRepository) {
         this.applicationProperties = applicationProperties;
         this.auditConfig = auditConfig;
         this.sessionPersistentRegistry = sessionPersistentRegistry;
@@ -84,6 +90,8 @@ public class ProprietaryUIDataController {
         this.databaseService = databaseService;
         this.objectMapper = objectMapper;
         this.runningEE = runningEE;
+        this.licenseSettingsService = licenseSettingsService;
+        this.auditRepository = auditRepository;
     }
 
     @GetMapping("/audit-dashboard")
@@ -108,6 +116,10 @@ public class ProprietaryUIDataController {
         LoginData data = new LoginData();
         Map<String, String> providerList = new HashMap<>();
         Security securityProps = applicationProperties.getSecurity();
+
+        // Add enableLogin flag so frontend doesn't need to call /app-config
+        data.setEnableLogin(securityProps.getEnableLogin());
+
         OAUTH2 oauth = securityProps.getOauth2();
 
         if (oauth != null && oauth.getEnabled()) {
@@ -262,6 +274,13 @@ public class ProprietaryUIDataController {
                         .filter(team -> !team.getName().equals(TeamService.INTERNAL_TEAM_NAME))
                         .toList();
 
+        // Calculate license limits
+        int maxAllowedUsers = licenseSettingsService.calculateMaxAllowedUsers();
+        long availableSlots = licenseSettingsService.getAvailableUserSlots();
+        int grandfatheredCount = licenseSettingsService.getDisplayGrandfatheredCount();
+        int licenseMaxUsers = licenseSettingsService.getSettings().getLicenseMaxUsers();
+        boolean premiumEnabled = applicationProperties.getPremium().isEnabled();
+
         AdminSettingsData data = new AdminSettingsData();
         data.setUsers(sortedUsers);
         data.setCurrentUsername(authentication.getName());
@@ -273,6 +292,11 @@ public class ProprietaryUIDataController {
         data.setDisabledUsers(disabledUsers);
         data.setTeams(allTeams);
         data.setMaxPaidUsers(applicationProperties.getPremium().getMaxUsers());
+        data.setMaxAllowedUsers(maxAllowedUsers);
+        data.setAvailableSlots(availableSlots);
+        data.setGrandfatheredUserCount(grandfatheredCount);
+        data.setLicenseMaxUsers(licenseMaxUsers);
+        data.setPremiumEnabled(premiumEnabled);
 
         return ResponseEntity.ok(data);
     }
@@ -428,6 +452,7 @@ public class ProprietaryUIDataController {
 
     @Data
     public static class LoginData {
+        private Boolean enableLogin;
         private Map<String, String> providerList;
         private String loginMethod;
         private boolean altLogin;
@@ -445,6 +470,11 @@ public class ProprietaryUIDataController {
         private int disabledUsers;
         private List<Team> teams;
         private int maxPaidUsers;
+        private int maxAllowedUsers;
+        private long availableSlots;
+        private int grandfatheredUserCount;
+        private int licenseMaxUsers;
+        private boolean premiumEnabled;
     }
 
     @Data

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/UsageRestController.java

@@ -0,0 +1,236 @@
+package stirling.software.proprietary.controller.api;
+
+import java.util.*;
+import java.util.stream.Collectors;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.annotations.api.ProprietaryUiDataApi;
+import stirling.software.proprietary.audit.AuditEventType;
+import stirling.software.proprietary.model.security.PersistentAuditEvent;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
+import stirling.software.proprietary.security.config.EnterpriseEndpoint;
+
+/** REST API controller for usage analytics data used by React frontend. */
+@Slf4j
+@ProprietaryUiDataApi
+@PreAuthorize("hasRole('ADMIN')")
+@RequiredArgsConstructor
+@EnterpriseEndpoint
+public class UsageRestController {
+
+    private final PersistentAuditEventRepository auditRepository;
+    private final ObjectMapper objectMapper;
+
+    /**
+     * Get endpoint statistics derived from audit events. This endpoint analyzes HTTP_REQUEST audit
+     * events to generate usage statistics.
+     *
+     * @param limit Optional limit on number of endpoints to return
+     * @param dataType Type of data to include: "all" (default), "api" (API endpoints excluding
+     *     auth), or "ui" (non-API endpoints)
+     * @return Endpoint statistics response
+     */
+    @GetMapping("/usage-endpoint-statistics")
+    public ResponseEntity<EndpointStatisticsResponse> getEndpointStatistics(
+            @RequestParam(value = "limit", required = false) Integer limit,
+            @RequestParam(value = "dataType", defaultValue = "all") String dataType) {
+
+        // Get all HTTP_REQUEST audit events
+        List<PersistentAuditEvent> httpEvents =
+                auditRepository.findByTypeForExport(AuditEventType.HTTP_REQUEST.name());
+
+        // Count visits per endpoint
+        Map<String, Long> endpointCounts = new HashMap<>();
+
+        for (PersistentAuditEvent event : httpEvents) {
+            String endpoint = extractEndpointFromAuditData(event.getData());
+            if (endpoint != null) {
+                // Apply data type filter
+                if (!shouldIncludeEndpoint(endpoint, dataType)) {
+                    continue;
+                }
+
+                endpointCounts.merge(endpoint, 1L, Long::sum);
+            }
+        }
+
+        // Calculate totals
+        long totalVisits = endpointCounts.values().stream().mapToLong(Long::longValue).sum();
+        int totalEndpoints = endpointCounts.size();
+
+        // Convert to list and sort by visit count (descending)
+        List<EndpointStatistic> statistics =
+                endpointCounts.entrySet().stream()
+                        .map(
+                                entry -> {
+                                    String endpoint = entry.getKey();
+                                    long visits = entry.getValue();
+                                    double percentage =
+                                            totalVisits > 0 ? (visits * 100.0 / totalVisits) : 0.0;
+
+                                    return EndpointStatistic.builder()
+                                            .endpoint(endpoint)
+                                            .visits((int) visits)
+                                            .percentage(Math.round(percentage * 10.0) / 10.0)
+                                            .build();
+                                })
+                        .sorted(Comparator.comparingInt(EndpointStatistic::getVisits).reversed())
+                        .collect(Collectors.toList());
+
+        // Apply limit if specified
+        if (limit != null && limit > 0 && statistics.size() > limit) {
+            statistics = statistics.subList(0, limit);
+        }
+
+        EndpointStatisticsResponse response =
+                EndpointStatisticsResponse.builder()
+                        .endpoints(statistics)
+                        .totalEndpoints(totalEndpoints)
+                        .totalVisits((int) totalVisits)
+                        .build();
+
+        return ResponseEntity.ok(response);
+    }
+
+    /**
+     * Extract the endpoint path from the audit event's data field. The data field contains JSON
+     * with an "endpoint" or "path" key.
+     *
+     * @param dataJson JSON string from audit event
+     * @return Endpoint path or null if not found
+     */
+    private String extractEndpointFromAuditData(String dataJson) {
+        if (dataJson == null || dataJson.isEmpty()) {
+            return null;
+        }
+
+        try {
+            @SuppressWarnings("unchecked")
+            Map<String, Object> data = objectMapper.readValue(dataJson, Map.class);
+
+            // Try common keys for endpoint path
+            Object endpoint = data.get("endpoint");
+            if (endpoint != null) {
+                return normalizeEndpoint(endpoint.toString());
+            }
+
+            Object path = data.get("path");
+            if (path != null) {
+                return normalizeEndpoint(path.toString());
+            }
+
+            // Fallback: check if there's a request-related key
+            Object requestUri = data.get("requestUri");
+            if (requestUri != null) {
+                return normalizeEndpoint(requestUri.toString());
+            }
+
+        } catch (JsonProcessingException e) {
+            log.debug("Failed to parse audit data JSON: {}", dataJson, e);
+        }
+
+        return null;
+    }
+
+    /**
+     * Normalize endpoint paths by removing query strings and standardizing format.
+     *
+     * @param endpoint Raw endpoint path
+     * @return Normalized endpoint path
+     */
+    private String normalizeEndpoint(String endpoint) {
+        if (endpoint == null) {
+            return null;
+        }
+
+        // Remove query string
+        int queryIndex = endpoint.indexOf('?');
+        if (queryIndex != -1) {
+            endpoint = endpoint.substring(0, queryIndex);
+        }
+
+        // Ensure it starts with /
+        if (!endpoint.startsWith("/")) {
+            endpoint = "/" + endpoint;
+        }
+
+        return endpoint;
+    }
+
+    /**
+     * Determine if an endpoint should be included based on the data type filter.
+     *
+     * @param endpoint The endpoint path to check
+     * @param dataType The filter type: "all", "api", or "ui"
+     * @return true if the endpoint should be included, false otherwise
+     */
+    private boolean shouldIncludeEndpoint(String endpoint, String dataType) {
+        if ("all".equalsIgnoreCase(dataType)) {
+            return true;
+        }
+
+        boolean isApiEndpoint = isApiEndpoint(endpoint);
+
+        if ("api".equalsIgnoreCase(dataType)) {
+            return isApiEndpoint;
+        } else if ("ui".equalsIgnoreCase(dataType)) {
+            return !isApiEndpoint;
+        }
+
+        // Default to including all if unrecognized type
+        return true;
+    }
+
+    /**
+     * Check if an endpoint is an API endpoint. API endpoints match /api/v1/* pattern but exclude
+     * /api/v1/auth/* paths.
+     *
+     * @param endpoint The endpoint path to check
+     * @return true if this is an API endpoint (excluding auth endpoints), false otherwise
+     */
+    private boolean isApiEndpoint(String endpoint) {
+        if (endpoint == null) {
+            return false;
+        }
+
+        // Check if it starts with /api/v1/
+        if (!endpoint.startsWith("/api/v1/")) {
+            return false;
+        }
+
+        // Exclude auth endpoints
+        if (endpoint.startsWith("/api/v1/auth/")) {
+            return false;
+        }
+
+        return true;
+    }
+
+    // DTOs for response formatting
+
+    @lombok.Data
+    @lombok.Builder
+    public static class EndpointStatisticsResponse {
+        private List<EndpointStatistic> endpoints;
+        private int totalEndpoints;
+        private int totalVisits;
+    }
+
+    @lombok.Data
+    @lombok.Builder
+    public static class EndpointStatistic {
+        private String endpoint;
+        private int visits;
+        private double percentage;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/form/FormFillController.java

@@ -0,0 +1,215 @@
+package stirling.software.proprietary.controller.api.form;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RequestPart;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.github.pixee.security.Filenames;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.WebResponseUtils;
+import stirling.software.proprietary.util.FormUtils;
+
+@RestController
+@RequestMapping("/api/v1/form")
+@Tag(name = "Forms", description = "PDF form APIs")
+@RequiredArgsConstructor
+public class FormFillController {
+
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final ObjectMapper objectMapper;
+
+    private static ResponseEntity<byte[]> saveDocument(PDDocument document, String baseName)
+            throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        document.save(baos);
+        return WebResponseUtils.bytesToWebResponse(baos.toByteArray(), baseName + ".pdf");
+    }
+
+    private static String buildBaseName(MultipartFile file, String suffix) {
+        String original = Filenames.toSimpleFileName(file.getOriginalFilename());
+        if (original == null || original.isBlank()) {
+            original = "document";
+        }
+        if (!original.toLowerCase().endsWith(".pdf")) {
+            return original + "_" + suffix;
+        }
+        String withoutExtension = original.substring(0, original.length() - 4);
+        return withoutExtension + "_" + suffix;
+    }
+
+    private static void requirePdf(MultipartFile file) {
+        if (file == null || file.isEmpty()) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.fileFormatRequired", "{0} must be in PDF format", "file");
+        }
+    }
+
+    private static String decodePart(byte[] payload) {
+        if (payload == null || payload.length == 0) {
+            return null;
+        }
+        return new String(payload, StandardCharsets.UTF_8);
+    }
+
+    @PostMapping(value = "/fields", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Inspect PDF form fields",
+            description = "Returns metadata describing each field in the provided PDF form")
+    public ResponseEntity<FormUtils.FormFieldExtraction> listFields(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file)
+            throws IOException {
+
+        requirePdf(file);
+        try (PDDocument document = pdfDocumentFactory.load(file, true)) {
+            FormUtils.FormFieldExtraction extraction =
+                    FormUtils.extractFieldsWithTemplate(document);
+            return ResponseEntity.ok(extraction);
+        }
+    }
+
+    @PostMapping(value = "/modify-fields", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Modify existing form fields",
+            description =
+                    "Updates existing fields in the provided PDF and returns the updated file")
+    public ResponseEntity<byte[]> modifyFields(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file,
+            @RequestPart(value = "updates", required = false) byte[] updatesPayload)
+            throws IOException {
+
+        String rawUpdates = decodePart(updatesPayload);
+        List<FormUtils.ModifyFormFieldDefinition> modifications =
+                FormPayloadParser.parseModificationDefinitions(objectMapper, rawUpdates);
+        if (modifications.isEmpty()) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.dataRequired",
+                    "{0} must contain at least one definition",
+                    "updates payload");
+        }
+
+        return processSingleFile(
+                file, "updated", document -> FormUtils.modifyFormFields(document, modifications));
+    }
+
+    @PostMapping(value = "/delete-fields", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Delete form fields",
+            description = "Removes the specified fields from the PDF and returns the updated file")
+    public ResponseEntity<byte[]> deleteFields(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file,
+            @Parameter(
+                            description =
+                                    "JSON array of field names or objects with a name property,"
+                                            + " matching the /fields response format",
+                            example = "[{\"name\":\"Field1\"}]")
+                    @RequestPart(value = "names", required = false)
+                    byte[] namesPayload)
+            throws IOException {
+
+        String rawNames = decodePart(namesPayload);
+        List<String> names = FormPayloadParser.parseNameList(objectMapper, rawNames);
+        if (names.isEmpty()) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.dataRequired", "{0} must contain at least one value", "names payload");
+        }
+
+        return processSingleFile(
+                file, "updated", document -> FormUtils.deleteFormFields(document, names));
+    }
+
+    @PostMapping(value = "/fill", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Fill PDF form fields",
+            description =
+                    "Populates the supplied PDF form using values from the provided JSON payload"
+                            + " and returns the filled PDF")
+    public ResponseEntity<byte[]> fillForm(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file,
+            @Parameter(
+                            description = "JSON object of field-value pairs to apply",
+                            example = "{\"field\":\"value\"}")
+                    @RequestPart(value = "data", required = false)
+                    byte[] valuesPayload,
+            @RequestParam(value = "flatten", defaultValue = "false") boolean flatten)
+            throws IOException {
+
+        String rawValues = decodePart(valuesPayload);
+        Map<String, Object> values = FormPayloadParser.parseValueMap(objectMapper, rawValues);
+
+        return processSingleFile(
+                file,
+                "filled",
+                document -> FormUtils.applyFieldValues(document, values, flatten, true));
+    }
+
+    private ResponseEntity<byte[]> processSingleFile(
+            MultipartFile file, String suffix, DocumentProcessor processor) throws IOException {
+        requirePdf(file);
+
+        String baseName = buildBaseName(file, suffix);
+        try (PDDocument document = pdfDocumentFactory.load(file)) {
+            processor.accept(document);
+            return saveDocument(document, baseName);
+        }
+    }
+
+    @FunctionalInterface
+    private interface DocumentProcessor {
+        void accept(PDDocument document) throws IOException;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/form/FormPayloadParser.java

@@ -0,0 +1,295 @@
+package stirling.software.proprietary.controller.api.form;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.proprietary.util.FormUtils;
+
+final class FormPayloadParser {
+
+    private static final String KEY_FIELDS = "fields";
+    private static final String KEY_NAME = "name";
+    private static final String KEY_TARGET_NAME = "targetName";
+    private static final String KEY_FIELD_NAME = "fieldName";
+    private static final String KEY_FIELD = "field";
+    private static final String KEY_VALUE = "value";
+    private static final String KEY_DEFAULT_VALUE = "defaultValue";
+
+    private static final TypeReference<Map<String, Object>> MAP_TYPE = new TypeReference<>() {};
+    private static final TypeReference<List<FormUtils.ModifyFormFieldDefinition>>
+            MODIFY_FIELD_LIST_TYPE = new TypeReference<>() {};
+    private static final TypeReference<List<String>> STRING_LIST_TYPE = new TypeReference<>() {};
+
+    private FormPayloadParser() {}
+
+    static Map<String, Object> parseValueMap(ObjectMapper objectMapper, String json)
+            throws IOException {
+        if (json == null || json.isBlank()) {
+            return Map.of();
+        }
+
+        JsonNode root;
+        try {
+            root = objectMapper.readTree(json);
+        } catch (IOException e) {
+            // Fallback to legacy direct map parse (will throw again if invalid)
+            return objectMapper.readValue(json, MAP_TYPE);
+        }
+        if (root == null || root.isNull()) {
+            return Map.of();
+        }
+
+        // 1. If payload already a flat object with no special wrapping, keep legacy behavior
+        if (root.isObject()) {
+            // a) Prefer explicit 'template' object if present (new combined /fields response)
+            JsonNode templateNode = root.get("template");
+            if (templateNode != null && templateNode.isObject()) {
+                return objectToLinkedMap(templateNode);
+            }
+            // b) Accept an inline 'fields' array of field definitions (build map from them)
+            JsonNode fieldsNode = root.get(KEY_FIELDS);
+            if (fieldsNode != null && fieldsNode.isArray()) {
+                Map<String, Object> record = extractFieldInfoArray(fieldsNode);
+                if (!record.isEmpty()) {
+                    return record;
+                }
+            }
+            // c) Fallback: treat entire object as the value map (legacy behavior)
+            return objectToLinkedMap(root);
+        }
+
+        // 2. If an array was supplied to /fill (non-standard), treat first element as record
+        if (root.isArray()) {
+            if (root.isEmpty()) {
+                return Map.of();
+            }
+            JsonNode first = root.get(0);
+            if (first != null && first.isObject()) {
+                if (first.has(KEY_NAME) || first.has(KEY_VALUE) || first.has(KEY_DEFAULT_VALUE)) {
+                    return extractFieldInfoArray(root);
+                }
+                return objectToLinkedMap(first);
+            }
+            return Map.of();
+        }
+
+        // 3. Anything else: fallback to strict map parse
+        return objectMapper.readValue(json, MAP_TYPE);
+    }
+
+    static List<FormUtils.ModifyFormFieldDefinition> parseModificationDefinitions(
+            ObjectMapper objectMapper, String json) throws IOException {
+        if (json == null || json.isBlank()) {
+            return List.of();
+        }
+        return objectMapper.readValue(json, MODIFY_FIELD_LIST_TYPE);
+    }
+
+    static List<String> parseNameList(ObjectMapper objectMapper, String json) throws IOException {
+        if (json == null || json.isBlank()) {
+            return List.of();
+        }
+
+        final JsonNode root = objectMapper.readTree(json);
+        if (root == null || root.isNull()) {
+            return List.of();
+        }
+
+        final Set<String> names = new LinkedHashSet<>();
+
+        if (root.isArray()) {
+            collectNames(root, names);
+        } else if (root.isObject()) {
+            if (root.has(KEY_FIELDS) && root.get(KEY_FIELDS).isArray()) {
+                collectNames(root.get(KEY_FIELDS), names);
+            } else {
+                final String single = extractName(root);
+                if (nonBlank(single)) {
+                    names.add(single);
+                }
+            }
+        } else if (root.isTextual()) {
+            final String single = trimToNull(root.asText());
+            if (single != null) {
+                names.add(single);
+            }
+        }
+
+        if (!names.isEmpty()) {
+            return List.copyOf(names);
+        }
+
+        try {
+            return objectMapper.readValue(json, STRING_LIST_TYPE);
+        } catch (IOException e) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidFormat",
+                    "Invalid {0} format: {1}",
+                    "names payload",
+                    "expected array of strings or objects with 'name'-like properties");
+        }
+    }
+
+    private static Map<String, Object> extractFieldInfoArray(JsonNode fieldsNode) {
+        final Map<String, Object> record = new LinkedHashMap<>();
+        if (fieldsNode == null || fieldsNode.isNull() || !fieldsNode.isArray()) {
+            return record;
+        }
+
+        for (JsonNode fieldNode : fieldsNode) {
+            if (fieldNode == null || !fieldNode.isObject()) {
+                continue;
+            }
+
+            final String name = extractName(fieldNode);
+            if (!nonBlank(name)) {
+                continue;
+            }
+
+            JsonNode valueNode = fieldNode.get(KEY_VALUE);
+            if ((valueNode == null || valueNode.isNull())
+                    && fieldNode.hasNonNull(KEY_DEFAULT_VALUE)) {
+                valueNode = fieldNode.get(KEY_DEFAULT_VALUE);
+            }
+
+            final String normalized = normalizeFieldValue(valueNode);
+            record.put(name, normalized == null ? "" : normalized);
+        }
+
+        return record;
+    }
+
+    private static String normalizeFieldValue(JsonNode valueNode) {
+        if (valueNode == null || valueNode.isNull()) {
+            return null;
+        }
+
+        if (valueNode.isArray()) {
+            final List<String> values = new ArrayList<>();
+            for (JsonNode element : valueNode) {
+                final String text = coerceScalarToString(element);
+                if (text != null) {
+                    values.add(text);
+                }
+            }
+            return String.join(",", values);
+        }
+
+        if (valueNode.isObject()) {
+            // Preserve object as JSON string
+            return valueNode.toString();
+        }
+
+        // Scalar (text/number/boolean)
+        return coerceScalarToString(valueNode);
+    }
+
+    private static String coerceScalarToString(JsonNode node) {
+        if (node == null || node.isNull()) {
+            return null;
+        }
+        if (node.isTextual()) {
+            return trimToEmpty(node.asText());
+        }
+        if (node.isNumber()) {
+            return node.numberValue().toString();
+        }
+        if (node.isBoolean()) {
+            return Boolean.toString(node.booleanValue());
+        }
+        // Fallback for other scalar-like nodes
+        return trimToEmpty(node.asText());
+    }
+
+    private static void collectNames(JsonNode arrayNode, Set<String> sink) {
+        if (arrayNode == null || !arrayNode.isArray()) {
+            return;
+        }
+        for (JsonNode node : arrayNode) {
+            final String name = extractName(node);
+            if (nonBlank(name)) {
+                sink.add(name);
+            }
+        }
+    }
+
+    private static String extractName(JsonNode node) {
+        if (node == null || node.isNull()) {
+            return null;
+        }
+
+        if (node.isTextual()) {
+            return trimToNull(node.asText());
+        }
+
+        if (node.isObject()) {
+            final String direct = textProperty(node, KEY_NAME, KEY_TARGET_NAME, KEY_FIELD_NAME);
+            if (nonBlank(direct)) {
+                return direct;
+            }
+            final JsonNode field = node.get(KEY_FIELD);
+            if (field != null && field.isObject()) {
+                final String nested =
+                        textProperty(field, KEY_NAME, KEY_TARGET_NAME, KEY_FIELD_NAME);
+                if (nonBlank(nested)) {
+                    return nested;
+                }
+            }
+        }
+
+        return null;
+    }
+
+    private static String textProperty(JsonNode node, String... keys) {
+        for (String key : keys) {
+            final JsonNode valueNode = node.get(key);
+            final String value = coerceScalarToString(valueNode);
+            if (nonBlank(value)) {
+                return value;
+            }
+        }
+        return null;
+    }
+
+    private static Map<String, Object> objectToLinkedMap(JsonNode objectNode) {
+        final Map<String, Object> result = new LinkedHashMap<>();
+        objectNode
+                .fieldNames()
+                .forEachRemaining(
+                        key -> {
+                            final JsonNode v = objectNode.get(key);
+                            if (v == null || v.isNull()) {
+                                result.put(key, null);
+                            } else if (v.isTextual() || v.isNumber() || v.isBoolean()) {
+                                result.put(key, coerceScalarToString(v));
+                            } else {
+                                result.put(key, v.toString());
+                            }
+                        });
+        return result;
+    }
+
+    private static boolean nonBlank(String s) {
+        return s != null && !s.isBlank();
+    }
+
+    private static String trimToNull(String s) {
+        if (s == null) return null;
+        final String t = s.trim();
+        return t.isEmpty() ? null : t;
+    }
+
+    private static String trimToEmpty(String s) {
+        return s == null ? "" : s.trim();
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/UserLicenseSettings.java

@@ -0,0 +1,65 @@
+package stirling.software.proprietary.model;
+
+import java.io.Serializable;
+
+import jakarta.persistence.*;
+
+import lombok.*;
+
+/**
+ * Entity to store user license settings in the database. This is a singleton entity (only one row
+ * should exist). Tracks grandfathered user counts and license limits.
+ */
+@Entity
+@Table(name = "user_license_settings")
+@NoArgsConstructor
+@AllArgsConstructor
+@Getter
+@Setter
+@ToString
+public class UserLicenseSettings implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    public static final Long SINGLETON_ID = 1L;
+
+    @Id
+    @Column(name = "id")
+    private Long id = SINGLETON_ID;
+
+    /**
+     * The number of users that existed in the database when grandfathering was initialized. This
+     * value is set once during initial setup and should NEVER be modified afterwards.
+     */
+    @Column(name = "grandfathered_user_count", nullable = false)
+    private int grandfatheredUserCount = 0;
+
+    /**
+     * Flag to indicate that grandfathering has been initialized and locked. Once true, the
+     * grandfatheredUserCount should never change. This prevents manipulation by deleting/recreating
+     * the table.
+     */
+    @Column(name = "grandfathering_locked", nullable = false)
+    private boolean grandfatheringLocked = false;
+
+    /**
+     * Maximum number of users allowed by the current license. This is updated when the license key
+     * is validated.
+     */
+    @Column(name = "license_max_users", nullable = false)
+    private int licenseMaxUsers = 0;
+
+    /**
+     * Random salt used when generating signatures. Makes it harder to recompute the signature when
+     * manually editing the table.
+     */
+    @Column(name = "integrity_salt", nullable = false, length = 64)
+    private String integritySalt = "";
+
+    /**
+     * Signed representation of {@code grandfatheredUserCount}. Stores the original value alongside
+     * a secret-backed HMAC so we can detect tampering and restore the correct count.
+     */
+    @Column(name = "grandfathered_user_signature", nullable = false, length = 256)
+    private String grandfatheredUserSignature = "";
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/InitialSecuritySetup.java

@@ -21,6 +21,7 @@ import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.DatabaseServiceInterface;
 import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
 
 @Slf4j
 @Component
@@ -34,6 +35,7 @@ public class InitialSecuritySetup {
     private final TeamService teamService;
     private final ApplicationProperties applicationProperties;
     private final DatabaseServiceInterface databaseService;
+    private final UserLicenseSettingsService licenseSettingsService;
 
     @PostConstruct
     public void init() {
@@ -50,12 +52,18 @@ public class InitialSecuritySetup {
             configureJWTSettings();
             assignUsersToDefaultTeamIfMissing();
             initializeInternalApiUser();
+            initializeUserLicenseSettings();
         } catch (IllegalArgumentException | SQLException | UnsupportedProviderException e) {
             log.error("Failed to initialize security setup.", e);
             System.exit(1);
         }
     }
 
+    private void initializeUserLicenseSettings() {
+        licenseSettingsService.initializeGrandfatheredCount();
+        licenseSettingsService.updateLicenseMaxUsers();
+    }
+
     private void configureJWTSettings() {
         ApplicationProperties.Security.Jwt jwtProperties =
                 applicationProperties.getSecurity().getJwt();

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java

@@ -25,7 +25,8 @@ import stirling.software.common.model.exception.UnsupportedProviderException;
 @EnableJpaRepositories(
         basePackages = {
             "stirling.software.proprietary.security.database.repository",
-            "stirling.software.proprietary.security.repository"
+            "stirling.software.proprietary.security.repository",
+            "stirling.software.proprietary.repository"
         })
 @EntityScan({"stirling.software.proprietary.security.model", "stirling.software.proprietary.model"})
 public class DatabaseConfig {

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -129,61 +129,53 @@ public class SecurityConfiguration {
 
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
-        // Read CORS allowed origins from settings
-        if (applicationProperties.getSystem() != null
-                && applicationProperties.getSystem().getCorsAllowedOrigins() != null
-                && !applicationProperties.getSystem().getCorsAllowedOrigins().isEmpty()) {
+        List<String> configuredOrigins = null;
+        if (applicationProperties.getSystem() != null) {
+            configuredOrigins = applicationProperties.getSystem().getCorsAllowedOrigins();
+        }
 
-            List<String> allowedOrigins = applicationProperties.getSystem().getCorsAllowedOrigins();
-
-            CorsConfiguration cfg = new CorsConfiguration();
-
-            // Use setAllowedOriginPatterns for better wildcard and port support
-            cfg.setAllowedOriginPatterns(allowedOrigins);
+        CorsConfiguration cfg = new CorsConfiguration();
+        if (configuredOrigins != null && !configuredOrigins.isEmpty()) {
+            cfg.setAllowedOriginPatterns(configuredOrigins);
             log.debug(
                     "CORS configured with allowed origin patterns from settings.yml: {}",
-                    allowedOrigins);
-
-            // Set allowed methods explicitly (including OPTIONS for preflight)
-            cfg.setAllowedMethods(List.of("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
-
-            // Set allowed headers explicitly
-            cfg.setAllowedHeaders(
-                    List.of(
-                            "Authorization",
-                            "Content-Type",
-                            "X-Requested-With",
-                            "Accept",
-                            "Origin",
-                            "X-API-KEY",
-                            "X-CSRF-TOKEN"));
-
-            // Set exposed headers (headers that the browser can access)
-            cfg.setExposedHeaders(
-                    List.of(
-                            "WWW-Authenticate",
-                            "X-Total-Count",
-                            "X-Page-Number",
-                            "X-Page-Size",
-                            "Content-Disposition",
-                            "Content-Type"));
-
-            // Allow credentials (cookies, authorization headers)
-            cfg.setAllowCredentials(true);
-
-            // Set max age for preflight cache
-            cfg.setMaxAge(3600L);
-
-            UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-            source.registerCorsConfiguration("/**", cfg);
-            return source;
+                    configuredOrigins);
         } else {
-            // No CORS origins configured - return null to disable CORS processing entirely
-            // This avoids empty CORS policy that unexpectedly rejects preflights
+            // Default to allowing all origins when nothing is configured
+            cfg.setAllowedOriginPatterns(List.of("*"));
             log.info(
-                    "CORS is disabled - no allowed origins configured in settings.yml (system.corsAllowedOrigins)");
-            return null;
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
         }
+
+        // Explicitly configure supported HTTP methods (include OPTIONS for preflight)
+        cfg.setAllowedMethods(List.of("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
+
+        cfg.setAllowedHeaders(
+                List.of(
+                        "Authorization",
+                        "Content-Type",
+                        "X-Requested-With",
+                        "Accept",
+                        "Origin",
+                        "X-API-KEY",
+                        "X-CSRF-TOKEN",
+                        "X-XSRF-TOKEN"));
+
+        cfg.setExposedHeaders(
+                List.of(
+                        "WWW-Authenticate",
+                        "X-Total-Count",
+                        "X-Page-Number",
+                        "X-Page-Size",
+                        "Content-Disposition",
+                        "Content-Type"));
+
+        cfg.setAllowCredentials(true);
+        cfg.setMaxAge(3600L);
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", cfg);
+        return source;
     }
 
     @Bean
@@ -315,7 +307,6 @@ public class SecurityConfiguration {
                                             req -> {
                                                 String uri = req.getRequestURI();
                                                 String contextPath = req.getContextPath();
-
                                                 // Check if it's a public auth endpoint or static
                                                 // resource
                                                 return RequestUriUtils.isStaticResource(

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/ee/LicenseKeyChecker.java

@@ -5,13 +5,20 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.context.event.EventListener;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Component;
 
+import jakarta.annotation.PostConstruct;
+
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.GeneralUtils;
 import stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier.License;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
 
 @Slf4j
 @Component
@@ -23,21 +30,36 @@ public class LicenseKeyChecker {
 
     private final ApplicationProperties applicationProperties;
 
+    private final UserLicenseSettingsService licenseSettingsService;
+
     private License premiumEnabledResult = License.NORMAL;
 
     public LicenseKeyChecker(
-            KeygenLicenseVerifier licenseService, ApplicationProperties applicationProperties) {
+            KeygenLicenseVerifier licenseService,
+            ApplicationProperties applicationProperties,
+            @Lazy UserLicenseSettingsService licenseSettingsService) {
         this.licenseService = licenseService;
         this.applicationProperties = applicationProperties;
-        this.checkLicense();
+        this.licenseSettingsService = licenseSettingsService;
+    }
+
+    @PostConstruct
+    public void init() {
+        evaluateLicense();
+    }
+
+    @EventListener(ApplicationReadyEvent.class)
+    public void onApplicationReady() {
+        synchronizeLicenseSettings();
     }
 
     @Scheduled(initialDelay = 604800000, fixedRate = 604800000) // 7 days in milliseconds
     public void checkLicensePeriodically() {
-        checkLicense();
+        evaluateLicense();
+        synchronizeLicenseSettings();
     }
 
-    private void checkLicense() {
+    private void evaluateLicense() {
         if (!applicationProperties.getPremium().isEnabled()) {
             premiumEnabledResult = License.NORMAL;
         } else {
@@ -58,6 +80,10 @@ public class LicenseKeyChecker {
         }
     }
 
+    private void synchronizeLicenseSettings() {
+        licenseSettingsService.updateLicenseMaxUsers();
+    }
+
     private String getLicenseKeyContent(String keyOrFilePath) {
         if (keyOrFilePath == null || keyOrFilePath.trim().isEmpty()) {
             log.error("License key is not specified");
@@ -85,6 +111,13 @@ public class LicenseKeyChecker {
         return keyOrFilePath;
     }
 
+    public void updateLicenseKey(String newKey) throws IOException {
+        applicationProperties.getPremium().setKey(newKey);
+        GeneralUtils.saveKeyToSettings("EnterpriseEdition.key", newKey);
+        evaluateLicense();
+        synchronizeLicenseSettings();
+    }
+
     public License getPremiumLicenseEnabledResult() {
         return premiumEnabledResult;
     }

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/InviteLinkController.java

@@ -0,0 +1,486 @@
+package stirling.software.proprietary.security.controller.api;
+
+import java.security.Principal;
+import java.time.LocalDateTime;
+import java.util.*;
+import java.util.stream.Collectors;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.*;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.annotations.api.InviteApi;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.model.InviteToken;
+import stirling.software.proprietary.security.repository.InviteTokenRepository;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.EmailService;
+import stirling.software.proprietary.security.service.TeamService;
+import stirling.software.proprietary.security.service.UserService;
+
+@InviteApi
+@Slf4j
+@RequiredArgsConstructor
+public class InviteLinkController {
+
+    private final InviteTokenRepository inviteTokenRepository;
+    private final TeamRepository teamRepository;
+    private final UserService userService;
+    private final ApplicationProperties applicationProperties;
+    private final Optional<EmailService> emailService;
+
+    /**
+     * Generate a new invite link (admin only)
+     *
+     * @param email The email address to invite
+     * @param role The role to assign (default: ROLE_USER)
+     * @param teamId The team to assign (optional, uses default team if not provided)
+     * @param expiryHours Custom expiry hours (optional, uses default from config)
+     * @param sendEmail Whether to send the invite link via email (default: false)
+     * @param principal The authenticated admin user
+     * @param request The HTTP request
+     * @return ResponseEntity with the invite link or error
+     */
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/generate")
+    public ResponseEntity<?> generateInviteLink(
+            @RequestParam(name = "email", required = false) String email,
+            @RequestParam(name = "role", defaultValue = "ROLE_USER") String role,
+            @RequestParam(name = "teamId", required = false) Long teamId,
+            @RequestParam(name = "expiryHours", required = false) Integer expiryHours,
+            @RequestParam(name = "sendEmail", defaultValue = "false") boolean sendEmail,
+            Principal principal,
+            HttpServletRequest request) {
+
+        try {
+            // Check if email invites are enabled
+            if (!applicationProperties.getMail().isEnableInvites()) {
+                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                        .body(Map.of("error", "Email invites are not enabled"));
+            }
+
+            // If email is provided, validate and check for conflicts
+            if (email != null && !email.trim().isEmpty()) {
+                // Validate email format
+                if (!email.contains("@")) {
+                    return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                            .body(Map.of("error", "Invalid email address"));
+                }
+
+                email = email.trim().toLowerCase();
+
+                // Check if user already exists
+                if (userService.usernameExistsIgnoreCase(email)) {
+                    return ResponseEntity.status(HttpStatus.CONFLICT)
+                            .body(Map.of("error", "User already exists"));
+                }
+
+                // Check if there's already an active invite for this email
+                Optional<InviteToken> existingInvite = inviteTokenRepository.findByEmail(email);
+                if (existingInvite.isPresent() && existingInvite.get().isValid()) {
+                    return ResponseEntity.status(HttpStatus.CONFLICT)
+                            .body(
+                                    Map.of(
+                                            "error",
+                                            "An active invite already exists for this email address"));
+                }
+
+                // If sendEmail is requested but no email provided, reject
+                if (sendEmail) {
+                    // Email will be sent
+                }
+            } else {
+                // No email provided - this is a general invite link
+                email = null; // Ensure it's null, not empty string
+
+                // Cannot send email if no email address provided
+                if (sendEmail) {
+                    return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                            .body(Map.of("error", "Cannot send email without an email address"));
+                }
+            }
+
+            // Check license limits
+            if (applicationProperties.getPremium().isEnabled()) {
+                long currentUserCount = userService.getTotalUsersCount();
+                long activeInvites = inviteTokenRepository.countActiveInvites(LocalDateTime.now());
+                int maxUsers = applicationProperties.getPremium().getMaxUsers();
+
+                if (currentUserCount + activeInvites >= maxUsers) {
+                    return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                            .body(
+                                    Map.of(
+                                            "error",
+                                            "License limit reached ("
+                                                    + (currentUserCount + activeInvites)
+                                                    + "/"
+                                                    + maxUsers
+                                                    + " users). Contact your administrator to upgrade your license."));
+                }
+            }
+
+            // Validate role
+            try {
+                Role roleEnum = Role.fromString(role);
+                if (roleEnum == Role.INTERNAL_API_USER) {
+                    return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                            .body(Map.of("error", "Cannot assign INTERNAL_API_USER role"));
+                }
+            } catch (IllegalArgumentException e) {
+                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                        .body(Map.of("error", "Invalid role specified"));
+            }
+
+            // Determine team
+            Long effectiveTeamId = teamId;
+            if (effectiveTeamId == null) {
+                Team defaultTeam =
+                        teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME).orElse(null);
+                if (defaultTeam != null) {
+                    effectiveTeamId = defaultTeam.getId();
+                }
+            } else {
+                Team selectedTeam = teamRepository.findById(effectiveTeamId).orElse(null);
+                if (selectedTeam != null
+                        && TeamService.INTERNAL_TEAM_NAME.equals(selectedTeam.getName())) {
+                    return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                            .body(Map.of("error", "Cannot assign users to Internal team"));
+                }
+            }
+
+            // Generate token
+            String token = UUID.randomUUID().toString();
+
+            // Determine expiry time
+            int effectiveExpiryHours =
+                    (expiryHours != null && expiryHours > 0)
+                            ? expiryHours
+                            : applicationProperties.getMail().getInviteLinkExpiryHours();
+            LocalDateTime expiresAt = LocalDateTime.now().plusHours(effectiveExpiryHours);
+
+            // Create invite token
+            InviteToken inviteToken = new InviteToken();
+            inviteToken.setToken(token);
+            inviteToken.setEmail(email);
+            inviteToken.setRole(role);
+            inviteToken.setTeamId(effectiveTeamId);
+            inviteToken.setExpiresAt(expiresAt);
+            inviteToken.setCreatedBy(principal.getName());
+
+            inviteTokenRepository.save(inviteToken);
+
+            // Build invite URL
+            // Use configured frontend URL if available, otherwise fall back to backend URL
+            String baseUrl;
+            String configuredFrontendUrl = applicationProperties.getSystem().getFrontendUrl();
+            if (configuredFrontendUrl != null && !configuredFrontendUrl.trim().isEmpty()) {
+                // Use configured frontend URL (remove trailing slash if present)
+                baseUrl =
+                        configuredFrontendUrl.endsWith("/")
+                                ? configuredFrontendUrl.substring(
+                                        0, configuredFrontendUrl.length() - 1)
+                                : configuredFrontendUrl;
+            } else {
+                // Fall back to backend URL from request
+                baseUrl =
+                        request.getScheme()
+                                + "://"
+                                + request.getServerName()
+                                + (request.getServerPort() != 80 && request.getServerPort() != 443
+                                        ? ":" + request.getServerPort()
+                                        : "");
+            }
+            String inviteUrl = baseUrl + "/invite?token=" + token;
+
+            log.info("Generated invite link for {} by {}", email, principal.getName());
+
+            // Optionally send email
+            boolean emailSent = false;
+            String emailError = null;
+            if (sendEmail) {
+                if (!emailService.isPresent()) {
+                    emailError = "Email service is not configured";
+                    log.warn("Cannot send invite email: Email service not configured");
+                } else {
+                    try {
+                        emailService
+                                .get()
+                                .sendInviteLinkEmail(email, inviteUrl, expiresAt.toString());
+                        emailSent = true;
+                        log.info("Sent invite link email to: {}", email);
+                    } catch (Exception emailEx) {
+                        emailError = emailEx.getMessage();
+                        log.error(
+                                "Failed to send invite email to {}: {}",
+                                email,
+                                emailEx.getMessage());
+                    }
+                }
+            }
+
+            Map<String, Object> response = new HashMap<>();
+            response.put("token", token);
+            response.put("inviteUrl", inviteUrl);
+            response.put("email", email);
+            response.put("expiresAt", expiresAt.toString());
+            response.put("expiryHours", effectiveExpiryHours);
+            if (sendEmail) {
+                response.put("emailSent", emailSent);
+                if (emailError != null) {
+                    response.put("emailError", emailError);
+                }
+            }
+
+            return ResponseEntity.ok(response);
+
+        } catch (Exception e) {
+            log.error("Failed to generate invite link: {}", e.getMessage(), e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(Map.of("error", "Failed to generate invite link: " + e.getMessage()));
+        }
+    }
+
+    /**
+     * List all active invite links (admin only)
+     *
+     * @return List of active invite tokens
+     */
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @GetMapping("/list")
+    public ResponseEntity<?> listInviteLinks() {
+        try {
+            List<InviteToken> activeInvites =
+                    inviteTokenRepository.findByUsedFalseAndExpiresAtAfter(LocalDateTime.now());
+
+            List<Map<String, Object>> inviteList =
+                    activeInvites.stream()
+                            .map(
+                                    invite -> {
+                                        Map<String, Object> inviteMap = new HashMap<>();
+                                        inviteMap.put("id", invite.getId());
+                                        inviteMap.put("email", invite.getEmail());
+                                        inviteMap.put("role", invite.getRole());
+                                        inviteMap.put("teamId", invite.getTeamId());
+                                        inviteMap.put("createdBy", invite.getCreatedBy());
+                                        inviteMap.put(
+                                                "createdAt", invite.getCreatedAt().toString());
+                                        inviteMap.put(
+                                                "expiresAt", invite.getExpiresAt().toString());
+                                        return inviteMap;
+                                    })
+                            .collect(Collectors.toList());
+
+            return ResponseEntity.ok(Map.of("invites", inviteList));
+
+        } catch (Exception e) {
+            log.error("Failed to list invite links: {}", e.getMessage(), e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(Map.of("error", "Failed to list invite links"));
+        }
+    }
+
+    /**
+     * Revoke an invite link (admin only)
+     *
+     * @param inviteId The invite token ID to revoke
+     * @return Success or error response
+     */
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @DeleteMapping("/revoke/{inviteId}")
+    public ResponseEntity<?> revokeInviteLink(@PathVariable Long inviteId) {
+        try {
+            Optional<InviteToken> inviteOpt = inviteTokenRepository.findById(inviteId);
+            if (inviteOpt.isEmpty()) {
+                return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                        .body(Map.of("error", "Invite not found"));
+            }
+
+            inviteTokenRepository.deleteById(inviteId);
+            log.info("Revoked invite link ID: {}", inviteId);
+
+            return ResponseEntity.ok(Map.of("message", "Invite link revoked successfully"));
+
+        } catch (Exception e) {
+            log.error("Failed to revoke invite link: {}", e.getMessage(), e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(Map.of("error", "Failed to revoke invite link"));
+        }
+    }
+
+    /**
+     * Clean up expired invite tokens (admin only)
+     *
+     * @return Number of deleted tokens
+     */
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/cleanup")
+    public ResponseEntity<?> cleanupExpiredInvites() {
+        try {
+            List<InviteToken> expiredInvites =
+                    inviteTokenRepository.findAll().stream()
+                            .filter(invite -> !invite.isValid())
+                            .collect(Collectors.toList());
+
+            int count = expiredInvites.size();
+            inviteTokenRepository.deleteAll(expiredInvites);
+
+            log.info("Cleaned up {} expired invite tokens", count);
+
+            return ResponseEntity.ok(Map.of("deletedCount", count));
+
+        } catch (Exception e) {
+            log.error("Failed to cleanup expired invites: {}", e.getMessage(), e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(Map.of("error", "Failed to cleanup expired invites"));
+        }
+    }
+
+    /**
+     * Validate an invite token (public endpoint)
+     *
+     * @param token The invite token to validate
+     * @return Invite details if valid, error otherwise
+     */
+    @GetMapping("/validate/{token}")
+    public ResponseEntity<?> validateInviteToken(@PathVariable String token) {
+        try {
+            Optional<InviteToken> inviteOpt = inviteTokenRepository.findByToken(token);
+
+            if (inviteOpt.isEmpty()) {
+                return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                        .body(Map.of("error", "Invalid invite link"));
+            }
+
+            InviteToken invite = inviteOpt.get();
+
+            if (invite.isUsed()) {
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .body(Map.of("error", "This invite link has already been used"));
+            }
+
+            if (invite.isExpired()) {
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .body(Map.of("error", "This invite link has expired"));
+            }
+
+            // Check if user already exists (only if email is pre-set)
+            if (invite.getEmail() != null
+                    && userService.usernameExistsIgnoreCase(invite.getEmail())) {
+                return ResponseEntity.status(HttpStatus.CONFLICT)
+                        .body(Map.of("error", "User already exists"));
+            }
+
+            Map<String, Object> response = new HashMap<>();
+            response.put("email", invite.getEmail());
+            response.put("role", invite.getRole());
+            response.put("expiresAt", invite.getExpiresAt().toString());
+            response.put("emailRequired", invite.getEmail() == null);
+
+            return ResponseEntity.ok(response);
+
+        } catch (Exception e) {
+            log.error("Failed to validate invite token: {}", e.getMessage(), e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(Map.of("error", "Failed to validate invite link"));
+        }
+    }
+
+    /**
+     * Accept an invite and create user account (public endpoint)
+     *
+     * @param token The invite token
+     * @param email The email address (required if not pre-set in invite)
+     * @param password The password to set for the new account
+     * @return Success or error response
+     */
+    @PostMapping("/accept/{token}")
+    public ResponseEntity<?> acceptInvite(
+            @PathVariable String token,
+            @RequestParam(name = "email", required = false) String email,
+            @RequestParam(name = "password") String password) {
+        try {
+            // Validate password
+            if (password == null || password.isEmpty()) {
+                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                        .body(Map.of("error", "Password is required"));
+            }
+
+            Optional<InviteToken> inviteOpt = inviteTokenRepository.findByToken(token);
+
+            if (inviteOpt.isEmpty()) {
+                return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                        .body(Map.of("error", "Invalid invite link"));
+            }
+
+            InviteToken invite = inviteOpt.get();
+
+            if (invite.isUsed()) {
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .body(Map.of("error", "This invite link has already been used"));
+            }
+
+            if (invite.isExpired()) {
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .body(Map.of("error", "This invite link has expired"));
+            }
+
+            // Determine the email to use
+            String effectiveEmail = invite.getEmail();
+            if (effectiveEmail == null) {
+                // Email not pre-set, must be provided by user
+                if (email == null || email.trim().isEmpty()) {
+                    return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                            .body(Map.of("error", "Email address is required"));
+                }
+
+                // Validate email format
+                if (!email.contains("@")) {
+                    return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                            .body(Map.of("error", "Invalid email address"));
+                }
+
+                effectiveEmail = email.trim().toLowerCase();
+            }
+
+            // Check if user already exists
+            if (userService.usernameExistsIgnoreCase(effectiveEmail)) {
+                return ResponseEntity.status(HttpStatus.CONFLICT)
+                        .body(Map.of("error", "User already exists"));
+            }
+
+            // Create the user account
+            userService.saveUser(
+                    effectiveEmail,
+                    password,
+                    invite.getTeamId(),
+                    invite.getRole(),
+                    false); // Don't force password change
+
+            // Mark invite as used
+            invite.setUsed(true);
+            invite.setUsedAt(LocalDateTime.now());
+            inviteTokenRepository.save(invite);
+
+            log.info(
+                    "User account created via invite link: {} with role: {}",
+                    effectiveEmail,
+                    invite.getRole());
+
+            return ResponseEntity.ok(
+                    Map.of("message", "Account created successfully", "username", effectiveEmail));
+
+        } catch (Exception e) {
+            log.error("Failed to accept invite: {}", e.getMessage(), e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(Map.of("error", "Failed to create account: " + e.getMessage()));
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UserController.java

@@ -43,6 +43,7 @@ import stirling.software.proprietary.security.service.EmailService;
 import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
 
 @UserApi
 @Slf4j
@@ -56,6 +57,7 @@ public class UserController {
     private final TeamRepository teamRepository;
     private final UserRepository userRepository;
     private final Optional<EmailService> emailService;
+    private final UserLicenseSettingsService licenseSettingsService;
 
     @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
     @PostMapping("/register")
@@ -80,10 +82,9 @@ public class UserController {
                         .body(Map.of("error", "Invalid username format"));
             }
 
-            if (usernameAndPass.getPassword() == null
-                    || usernameAndPass.getPassword().length() < 6) {
+            if (usernameAndPass.getPassword() == null || usernameAndPass.getPassword().isEmpty()) {
                 return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                        .body(Map.of("error", "Password must be at least 6 characters"));
+                        .body(Map.of("error", "Password is required"));
             }
 
             Team team = teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME).orElse(null);
@@ -316,11 +317,17 @@ public class UserController {
                                     "error",
                                     "Invalid username format. Username must be 3-50 characters."));
         }
-        if (applicationProperties.getPremium().isEnabled()
-                && applicationProperties.getPremium().getMaxUsers()
-                        <= userService.getTotalUsersCount()) {
+        if (licenseSettingsService.wouldExceedLimit(1)) {
+            long availableSlots = licenseSettingsService.getAvailableUserSlots();
+            int maxAllowed = licenseSettingsService.calculateMaxAllowedUsers();
             return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                    .body(Map.of("error", "Maximum number of users reached for your license."));
+                    .body(
+                            Map.of(
+                                    "error",
+                                    "Maximum number of users reached. Allowed: "
+                                            + maxAllowed
+                                            + ", Available slots: "
+                                            + availableSlots));
         }
         Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
         if (userOpt.isPresent()) {
@@ -413,20 +420,19 @@ public class UserController {
         }
 
         // Check license limits
-        if (applicationProperties.getPremium().isEnabled()) {
-            long currentUserCount = userService.getTotalUsersCount();
-            int maxUsers = applicationProperties.getPremium().getMaxUsers();
-            long availableSlots = maxUsers - currentUserCount;
-            if (availableSlots < emailArray.length) {
-                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                        .body(
-                                Map.of(
-                                        "error",
-                                        "Not enough user slots available. Available: "
-                                                + availableSlots
-                                                + ", Requested: "
-                                                + emailArray.length));
-            }
+        if (licenseSettingsService.wouldExceedLimit(emailArray.length)) {
+            long availableSlots = licenseSettingsService.getAvailableUserSlots();
+            int maxAllowed = licenseSettingsService.calculateMaxAllowedUsers();
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                    .body(
+                            Map.of(
+                                    "error",
+                                    "Not enough user slots available. Allowed: "
+                                            + maxAllowed
+                                            + ", Available: "
+                                            + availableSlots
+                                            + ", Requested: "
+                                            + emailArray.length));
         }
 
         // Validate role
@@ -736,4 +742,31 @@ public class UserController {
             return errorMessage;
         }
     }
+
+    @PostMapping("/complete-initial-setup")
+    public ResponseEntity<?> completeInitialSetup() {
+        try {
+            String username = userService.getCurrentUsername();
+            if (username == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body("User not authenticated");
+            }
+
+            Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
+            if (userOpt.isEmpty()) {
+                return ResponseEntity.status(HttpStatus.NOT_FOUND).body("User not found");
+            }
+
+            User user = userOpt.get();
+            user.setHasCompletedInitialSetup(true);
+            userRepository.save(user);
+
+            log.info("User {} completed initial setup", username);
+            return ResponseEntity.ok().body(Map.of("success", true));
+        } catch (Exception e) {
+            log.error("Error completing initial setup", e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body("Failed to complete initial setup");
+        }
+    }
 }

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java

@@ -107,7 +107,8 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             }
         }
 
-        // If we still don't have any authentication, check if it's a public endpoint. If not, deny the request
+        // If we still don't have any authentication, check if it's a public endpoint. If not, deny
+        // the request
         if (authentication == null || !authentication.isAuthenticated()) {
             String method = request.getMethod();
             String contextPath = request.getContextPath();
@@ -222,7 +223,8 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
                 || trimmedUri.startsWith("/saml2")
                 || trimmedUri.startsWith("/api/v1/auth/login")
                 || trimmedUri.startsWith("/api/v1/auth/refresh")
-                || trimmedUri.startsWith("/api/v1/auth/logout");
+                || trimmedUri.startsWith("/api/v1/auth/logout")
+                || trimmedUri.startsWith("/api/v1/proprietary/ui-data/login");
     }
 
     private enum UserLoginType {
@@ -251,6 +253,7 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
         String[] permitAllPatterns = {
             contextPath + "/login",
             contextPath + "/register",
+            contextPath + "/invite",
             contextPath + "/error",
             contextPath + "/images/",
             contextPath + "/public/",
@@ -263,6 +266,8 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             contextPath + "/api/v1/auth/login",
             contextPath + "/api/v1/auth/refresh",
             contextPath + "/api/v1/auth/me",
+            contextPath + "/api/v1/invite/validate",
+            contextPath + "/api/v1/invite/accept",
             contextPath + "/site.webmanifest"
         };
 

app/proprietary/src/main/java/stirling/software/proprietary/security/model/InviteToken.java

@@ -0,0 +1,62 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+import org.hibernate.annotations.CreationTimestamp;
+
+import jakarta.persistence.*;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+@Entity
+@Table(name = "invite_tokens")
+@NoArgsConstructor
+@Getter
+@Setter
+public class InviteToken implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "token", unique = true, nullable = false, length = 100)
+    private String token;
+
+    @Column(name = "email", nullable = true, length = 255)
+    private String email; // Optional - if not set, user can provide their own email
+
+    @Column(name = "role", nullable = false, length = 50)
+    private String role;
+
+    @Column(name = "team_id")
+    private Long teamId;
+
+    @Column(name = "expires_at", nullable = false)
+    private LocalDateTime expiresAt;
+
+    @Column(name = "used", nullable = false)
+    private boolean used = false;
+
+    @Column(name = "created_by", nullable = false, length = 255)
+    private String createdBy;
+
+    @CreationTimestamp
+    @Column(name = "created_at", updatable = false)
+    private LocalDateTime createdAt;
+
+    @Column(name = "used_at")
+    private LocalDateTime usedAt;
+
+    public boolean isExpired() {
+        return LocalDateTime.now().isAfter(expiresAt);
+    }
+
+    public boolean isValid() {
+        return !used && !isExpired();
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java

@@ -56,6 +56,9 @@ public class User implements UserDetails, Serializable {
     @Column(name = "isFirstLogin")
     private Boolean isFirstLogin = false;
 
+    @Column(name = "hasCompletedInitialSetup")
+    private Boolean hasCompletedInitialSetup = false;
+
     @Column(name = "roleName")
     private String roleName;
 
@@ -103,6 +106,14 @@ public class User implements UserDetails, Serializable {
         this.isFirstLogin = isFirstLogin;
     }
 
+    public boolean hasCompletedInitialSetup() {
+        return hasCompletedInitialSetup != null && hasCompletedInitialSetup;
+    }
+
+    public void setHasCompletedInitialSetup(boolean hasCompletedInitialSetup) {
+        this.hasCompletedInitialSetup = hasCompletedInitialSetup;
+    }
+
     public void setAuthenticationType(AuthenticationType authenticationType) {
         this.authenticationType = authenticationType.toString().toLowerCase();
     }

app/proprietary/src/main/java/stirling/software/proprietary/security/repository/InviteTokenRepository.java

@@ -0,0 +1,32 @@
+package stirling.software.proprietary.security.repository;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import stirling.software.proprietary.security.model.InviteToken;
+
+@Repository
+public interface InviteTokenRepository extends JpaRepository<InviteToken, Long> {
+
+    Optional<InviteToken> findByToken(String token);
+
+    Optional<InviteToken> findByEmail(String email);
+
+    List<InviteToken> findByUsedFalseAndExpiresAtAfter(LocalDateTime now);
+
+    List<InviteToken> findByCreatedBy(String createdBy);
+
+    @Modifying
+    @Query("DELETE FROM InviteToken it WHERE it.expiresAt < :now")
+    void deleteExpiredTokens(@Param("now") LocalDateTime now);
+
+    @Query("SELECT COUNT(it) FROM InviteToken it WHERE it.used = false AND it.expiresAt > :now")
+    long countActiveInvites(@Param("now") LocalDateTime now);
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/repository/UserLicenseSettingsRepository.java

@@ -0,0 +1,21 @@
+package stirling.software.proprietary.security.repository;
+
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import stirling.software.proprietary.model.UserLicenseSettings;
+
+@Repository
+public interface UserLicenseSettingsRepository extends JpaRepository<UserLicenseSettings, Long> {
+
+    /**
+     * Finds the singleton UserLicenseSettings record.
+     *
+     * @return Optional containing the settings if they exist
+     */
+    default Optional<UserLicenseSettings> findSettings() {
+        return findById(UserLicenseSettings.SINGLETON_ID);
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/EmailService.java

@@ -159,4 +159,58 @@ public class EmailService {
 
         sendPlainEmail(to, subject, body, true);
     }
+
+    /**
+     * Sends an invitation link email to a new user.
+     *
+     * @param to The recipient email address
+     * @param inviteUrl The full URL for accepting the invite
+     * @param expiresAt The expiration timestamp
+     * @throws MessagingException If there is an issue with creating or sending the email.
+     */
+    @Async
+    public void sendInviteLinkEmail(String to, String inviteUrl, String expiresAt)
+            throws MessagingException {
+        String subject = "You've been invited to Stirling PDF";
+
+        String body =
+                """
+                <html><body style="margin: 0; padding: 0;">
+                <div style="font-family: Arial, sans-serif; background-color: #f8f9fa; padding: 20px;">
+                  <div style="max-width: 600px; margin: auto; background-color: #ffffff; border-radius: 8px; overflow: hidden; border: 1px solid #e0e0e0;">
+                    <!-- Logo -->
+                    <div style="text-align: center; padding: 20px; background-color: #222;">
+                      <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling-transparent.svg" alt="Stirling PDF" style="max-height: 60px;">
+                    </div>
+                    <!-- Content -->
+                    <div style="padding: 30px; color: #333;">
+                      <h2 style="color: #222; margin-top: 0;">Welcome to Stirling PDF!</h2>
+                      <p>Hi there,</p>
+                      <p>You have been invited to join the Stirling PDF workspace. Click the button below to set up your account:</p>
+                      <!-- CTA Button -->
+                      <div style="text-align: center; margin: 30px 0;">
+                        <a href="%s" style="display: inline-block; background-color: #007bff; color: #ffffff; padding: 14px 28px; text-decoration: none; border-radius: 5px; font-weight: bold;">Accept Invitation</a>
+                      </div>
+                      <p style="font-size: 14px; color: #666;">Or copy and paste this link in your browser:</p>
+                      <div style="background-color: #f8f9fa; padding: 12px; margin: 15px 0; border-radius: 4px; word-break: break-all; font-size: 13px; color: #555;">
+                        %s
+                      </div>
+                      <div style="background-color: #fff3cd; border-left: 4px solid #ffc107; padding: 15px; margin: 20px 0; border-radius: 4px;">
+                        <p style="margin: 0; color: #856404; font-size: 14px;"><strong>⚠️ Important:</strong> This invitation link will expire on %s. Please complete your registration before then.</p>
+                      </div>
+                      <p>If you didn't expect this invitation, you can safely ignore this email.</p>
+                      <p style="margin-bottom: 0;">— The Stirling PDF Team</p>
+                    </div>
+                    <!-- Footer -->
+                    <div style="text-align: center; padding: 15px; font-size: 12px; color: #777; background-color: #f0f0f0;">
+                      &copy; 2025 Stirling PDF. All rights reserved.
+                    </div>
+                  </div>
+                </div>
+                </body></html>
+                """
+                        .formatted(inviteUrl, inviteUrl, expiresAt);
+
+        sendPlainEmail(to, subject, body, true);
+    }
 }

app/proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java

@@ -663,6 +663,21 @@ public class UserService implements UserServiceInterface {
         return false;
     }
 
+    public boolean isCurrentUserFirstLogin() {
+        try {
+            String username = getCurrentUsername();
+            if (username != null) {
+                Optional<User> userOpt = findByUsernameIgnoreCase(username);
+                if (userOpt.isPresent()) {
+                    return !userOpt.get().hasCompletedInitialSetup();
+                }
+            }
+        } catch (Exception e) {
+            log.debug("Error checking first login status", e);
+        }
+        return false;
+    }
+
     @Transactional
     public void syncCustomApiUser(String customApiKey) {
         if (customApiKey == null || customApiKey.trim().isBlank()) {

app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java

@@ -0,0 +1,411 @@
+package stirling.software.proprietary.service;
+
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.Base64;
+import java.util.Optional;
+import java.util.UUID;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.model.UserLicenseSettings;
+import stirling.software.proprietary.security.repository.UserLicenseSettingsRepository;
+import stirling.software.proprietary.security.service.UserService;
+
+/**
+ * Service for managing user license settings and grandfathering logic.
+ *
+ * <p>User limit calculation:
+ *
+ * <ul>
+ *   <li>Default limit: 5 users
+ *   <li>Grandfathered limit: max(5, existing user count at initialization)
+ *   <li>With pro license: grandfathered limit + license maxUsers
+ *   <li>Without pro license: grandfathered limit
+ * </ul>
+ */
+@Service
+@Slf4j
+@RequiredArgsConstructor
+public class UserLicenseSettingsService {
+
+    private static final int DEFAULT_USER_LIMIT = 5;
+    private static final String SIGNATURE_SEPARATOR = ":";
+    private static final String DEFAULT_INTEGRITY_SECRET = "stirling-pdf-user-license-guard";
+
+    private final UserLicenseSettingsRepository settingsRepository;
+    private final UserService userService;
+    private final ApplicationProperties applicationProperties;
+
+    /**
+     * Gets the current user license settings, creating them if they don't exist.
+     *
+     * @return The current settings
+     */
+    @Transactional
+    public UserLicenseSettings getOrCreateSettings() {
+        return settingsRepository
+                .findSettings()
+                .orElseGet(
+                        () -> {
+                            log.info("Initializing user license settings");
+                            UserLicenseSettings settings = new UserLicenseSettings();
+                            settings.setId(UserLicenseSettings.SINGLETON_ID);
+                            settings.setGrandfatheredUserCount(0);
+                            settings.setLicenseMaxUsers(0);
+                            settings.setGrandfatheringLocked(false);
+                            settings.setIntegritySalt(UUID.randomUUID().toString());
+                            settings.setGrandfatheredUserSignature("");
+                            return settingsRepository.save(settings);
+                        });
+    }
+
+    /**
+     * Initializes the grandfathered user count if not already set. This should be called on
+     * application startup.
+     *
+     * <p>IMPORTANT: Once grandfathering is locked, this value can NEVER be changed. This prevents
+     * manipulation by deleting the settings table.
+     *
+     * <p>Logic:
+     *
+     * <ul>
+     *   <li>If grandfatheringLocked is true: Skip initialization (already set permanently)
+     *   <li>If users exist in database: Set to max(5, current user count) - this is an existing
+     *       installation
+     *   <li>If no users exist: Set to 5 (default) - this is a fresh installation
+     *   <li>Lock grandfathering immediately after setting
+     * </ul>
+     */
+    @Transactional
+    public void initializeGrandfatheredCount() {
+        UserLicenseSettings settings = getOrCreateSettings();
+
+        boolean changed = ensureIntegritySalt(settings);
+
+        // CRITICAL: Never change grandfathering once it's locked
+        if (settings.isGrandfatheringLocked()) {
+            if (settings.getGrandfatheredUserSignature() == null
+                    || settings.getGrandfatheredUserSignature().isBlank()) {
+                settings.setGrandfatheredUserSignature(
+                        generateSignature(settings.getGrandfatheredUserCount(), settings));
+                changed = true;
+            }
+            if (changed) {
+                settingsRepository.save(settings);
+            }
+            log.debug(
+                    "Grandfathering is locked. Current grandfathered count: {}",
+                    settings.getGrandfatheredUserCount());
+            return;
+        }
+
+        // Determine if this is an existing installation or fresh install
+        long currentUserCount = userService.getTotalUsersCount();
+        boolean isExistingInstallation = currentUserCount > 0;
+
+        int grandfatheredCount;
+        if (isExistingInstallation) {
+            // Existing installation (v2.0+ or has users) - grandfather current user count
+            grandfatheredCount = Math.max(DEFAULT_USER_LIMIT, (int) currentUserCount);
+            log.info(
+                    "Existing installation detected. Grandfathering {} users (current: {}, minimum:"
+                            + " {})",
+                    grandfatheredCount,
+                    currentUserCount,
+                    DEFAULT_USER_LIMIT);
+        } else {
+            // Fresh installation - set to default
+            grandfatheredCount = DEFAULT_USER_LIMIT;
+            log.info(
+                    "Fresh installation detected. Setting default grandfathered limit: {}",
+                    grandfatheredCount);
+        }
+
+        // Set and LOCK the grandfathering permanently
+        settings.setGrandfatheredUserCount(grandfatheredCount);
+        settings.setGrandfatheringLocked(true);
+        settings.setGrandfatheredUserSignature(generateSignature(grandfatheredCount, settings));
+        settingsRepository.save(settings);
+
+        log.warn(
+                "GRANDFATHERING LOCKED: {} users. This value can never be changed.",
+                grandfatheredCount);
+    }
+
+    /**
+     * Updates the license max users from the application properties. This should be called when the
+     * license is validated.
+     */
+    @Transactional
+    public void updateLicenseMaxUsers() {
+        UserLicenseSettings settings = getOrCreateSettings();
+
+        int licenseMaxUsers = 0;
+        if (applicationProperties.getPremium().isEnabled()) {
+            licenseMaxUsers = applicationProperties.getPremium().getMaxUsers();
+        }
+
+        if (settings.getLicenseMaxUsers() != licenseMaxUsers) {
+            settings.setLicenseMaxUsers(licenseMaxUsers);
+            settingsRepository.save(settings);
+            log.info("Updated license max users to: {}", licenseMaxUsers);
+        }
+    }
+
+    /**
+     * Validates and enforces the integrity of license settings. This ensures that even if someone
+     * manually modifies the database, the grandfathering rules are still enforced.
+     */
+    @Transactional
+    public void validateSettingsIntegrity() {
+        UserLicenseSettings settings = getOrCreateSettings();
+        boolean changed = ensureIntegritySalt(settings);
+
+        Optional<Integer> signedCountOpt = extractSignedCount(settings);
+        boolean signatureValid =
+                signedCountOpt.isPresent()
+                        && signatureMatches(
+                                signedCountOpt.get(),
+                                settings.getGrandfatheredUserSignature(),
+                                settings);
+
+        int targetCount = settings.getGrandfatheredUserCount();
+        String targetSignature = settings.getGrandfatheredUserSignature();
+
+        if (!signatureValid) {
+            int restoredCount =
+                    signedCountOpt.orElseGet(
+                            () ->
+                                    Math.max(
+                                            DEFAULT_USER_LIMIT,
+                                            (int) userService.getTotalUsersCount()));
+            log.error(
+                    "Grandfathered user signature invalid or missing. Restoring locked count to {}.",
+                    restoredCount);
+            targetCount = restoredCount;
+            targetSignature = generateSignature(targetCount, settings);
+            changed = true;
+        } else {
+            int signedCount = signedCountOpt.get();
+            if (targetCount != signedCount) {
+                log.error(
+                        "Grandfathered user count ({}) was modified without signature update. Restoring to {}.",
+                        targetCount,
+                        signedCount);
+                targetCount = signedCount;
+                targetSignature = generateSignature(targetCount, settings);
+                changed = true;
+            }
+        }
+
+        if (targetCount < DEFAULT_USER_LIMIT) {
+            if (targetCount != DEFAULT_USER_LIMIT) {
+                log.warn(
+                        "Grandfathered count ({}) is below minimum ({}). Enforcing minimum.",
+                        targetCount,
+                        DEFAULT_USER_LIMIT);
+            }
+            targetCount = DEFAULT_USER_LIMIT;
+            targetSignature = generateSignature(targetCount, settings);
+            changed = true;
+        }
+
+        if (targetSignature == null || targetSignature.isBlank()) {
+            targetSignature = generateSignature(targetCount, settings);
+            changed = true;
+        }
+
+        if (changed
+                || settings.getGrandfatheredUserCount() != targetCount
+                || (targetSignature != null
+                        && !targetSignature.equals(settings.getGrandfatheredUserSignature()))) {
+            settings.setGrandfatheredUserCount(targetCount);
+            settings.setGrandfatheredUserSignature(targetSignature);
+            settingsRepository.save(settings);
+        }
+    }
+
+    /**
+     * Calculates the maximum allowed users based on grandfathering rules.
+     *
+     * <p>Logic:
+     *
+     * <ul>
+     *   <li>Grandfathered limit = max(5, existing user count at initialization)
+     *   <li>If premium enabled: total limit = grandfathered limit + license maxUsers
+     *   <li>If premium disabled: total limit = grandfathered limit
+     * </ul>
+     *
+     * @return Maximum number of users allowed
+     */
+    public int calculateMaxAllowedUsers() {
+        validateSettingsIntegrity();
+        UserLicenseSettings settings = getOrCreateSettings();
+
+        int grandfatheredLimit = settings.getGrandfatheredUserCount();
+        if (grandfatheredLimit == 0) {
+            // Fallback if not initialized yet - should not happen with validation
+            log.warn("Grandfathered limit is 0, using default: {}", DEFAULT_USER_LIMIT);
+            grandfatheredLimit = DEFAULT_USER_LIMIT;
+        }
+
+        int totalLimit = grandfatheredLimit;
+
+        if (applicationProperties.getPremium().isEnabled()) {
+            totalLimit = grandfatheredLimit + settings.getLicenseMaxUsers();
+        }
+
+        log.debug(
+                "Calculated max allowed users: {} (grandfathered: {}, license: {}, premium enabled: {})",
+                totalLimit,
+                grandfatheredLimit,
+                settings.getLicenseMaxUsers(),
+                applicationProperties.getPremium().isEnabled());
+
+        return totalLimit;
+    }
+
+    /**
+     * Checks if adding new users would exceed the limit.
+     *
+     * @param newUsersCount Number of new users to add
+     * @return true if the addition would exceed the limit
+     */
+    public boolean wouldExceedLimit(int newUsersCount) {
+        long currentUserCount = userService.getTotalUsersCount();
+        int maxAllowed = calculateMaxAllowedUsers();
+        return (currentUserCount + newUsersCount) > maxAllowed;
+    }
+
+    /**
+     * Gets the number of available user slots.
+     *
+     * @return Number of users that can still be added
+     */
+    public long getAvailableUserSlots() {
+        long currentUserCount = userService.getTotalUsersCount();
+        int maxAllowed = calculateMaxAllowedUsers();
+        return Math.max(0, maxAllowed - currentUserCount);
+    }
+
+    /**
+     * Gets the grandfathered user count for display purposes. Returns only the excess users beyond
+     * the base limit (5).
+     *
+     * <p>Examples:
+     *
+     * <ul>
+     *   <li>If grandfathered = 5: returns 0 (base amount, nothing special)
+     *   <li>If grandfathered = 10: returns 5 (5 extra users)
+     *   <li>If grandfathered = 15: returns 10 (10 extra users)
+     * </ul>
+     *
+     * @return Number of grandfathered users beyond the base limit
+     */
+    public int getDisplayGrandfatheredCount() {
+        UserLicenseSettings settings = getOrCreateSettings();
+        int totalGrandfathered = settings.getGrandfatheredUserCount();
+        return Math.max(0, totalGrandfathered - DEFAULT_USER_LIMIT);
+    }
+
+    /** Gets the current settings. */
+    public UserLicenseSettings getSettings() {
+        return getOrCreateSettings();
+    }
+
+    private boolean ensureIntegritySalt(UserLicenseSettings settings) {
+        if (settings.getIntegritySalt() == null || settings.getIntegritySalt().isBlank()) {
+            settings.setIntegritySalt(UUID.randomUUID().toString());
+            return true;
+        }
+        return false;
+    }
+
+    private Optional<Integer> extractSignedCount(UserLicenseSettings settings) {
+        String signature = settings.getGrandfatheredUserSignature();
+        if (signature == null || signature.isBlank()) {
+            return Optional.empty();
+        }
+
+        String[] parts = signature.split(SIGNATURE_SEPARATOR, 2);
+        if (parts.length != 2) {
+            log.warn("Invalid grandfathered user signature format detected");
+            return Optional.empty();
+        }
+
+        try {
+            return Optional.of(Integer.parseInt(parts[0]));
+        } catch (NumberFormatException ex) {
+            log.warn("Unable to parse grandfathered user signature count", ex);
+            return Optional.empty();
+        }
+    }
+
+    private boolean signatureMatches(int count, String signature, UserLicenseSettings settings) {
+        if (signature == null || signature.isBlank()) {
+            return false;
+        }
+        return generateSignature(count, settings).equals(signature);
+    }
+
+    private String generateSignature(int count, UserLicenseSettings settings) {
+        if (settings.getIntegritySalt() == null || settings.getIntegritySalt().isBlank()) {
+            throw new IllegalStateException("Integrity salt must be initialized before signing.");
+        }
+        String payload = buildSignaturePayload(count, settings.getIntegritySalt());
+        String secret = deriveIntegritySecret();
+        String digest = computeHmac(payload, secret);
+        return count + SIGNATURE_SEPARATOR + digest;
+    }
+
+    private String buildSignaturePayload(int count, String salt) {
+        return count + SIGNATURE_SEPARATOR + salt;
+    }
+
+    private String deriveIntegritySecret() {
+        StringBuilder builder = new StringBuilder();
+        appendIfPresent(builder, applicationProperties.getAutomaticallyGenerated().getKey());
+        appendIfPresent(builder, applicationProperties.getAutomaticallyGenerated().getUUID());
+        appendIfPresent(builder, applicationProperties.getPremium().getKey());
+
+        if (builder.length() == 0) {
+            builder.append(DEFAULT_INTEGRITY_SECRET);
+        }
+
+        return builder.toString();
+    }
+
+    private void appendIfPresent(StringBuilder builder, String value) {
+        if (value != null && !value.isBlank()) {
+            if (builder.length() > 0) {
+                builder.append(SIGNATURE_SEPARATOR);
+            }
+            builder.append(value);
+        }
+    }
+
+    private String computeHmac(String payload, String secret) {
+        try {
+            Mac mac = Mac.getInstance("HmacSHA256");
+            SecretKeySpec keySpec =
+                    new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
+            mac.init(keySpec);
+            byte[] digest = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
+            return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("Failed to compute grandfathered user signature", e);
+        } catch (InvalidKeyException e) {
+            throw new IllegalStateException("Invalid key for grandfathered user signature", e);
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/util/FormCopyUtils.java

@@ -0,0 +1,345 @@
+package stirling.software.proprietary.util;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDResources;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDType1Font;
+import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
+import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
+import org.apache.pdfbox.pdmodel.interactive.form.PDField;
+import org.apache.pdfbox.pdmodel.interactive.form.PDTerminalField;
+
+import lombok.experimental.UtilityClass;
+import lombok.extern.slf4j.Slf4j;
+
+@Slf4j
+@UtilityClass
+public class FormCopyUtils {
+
+    public boolean hasAnyRotatedPage(PDDocument document) {
+        try {
+            for (PDPage page : document.getPages()) {
+                int rot = page.getRotation();
+                int norm = ((rot % 360) + 360) % 360;
+                if (norm != 0) {
+                    return true;
+                }
+            }
+        } catch (Exception e) {
+            log.warn("Failed to inspect page rotations: {}", e.getMessage(), e);
+        }
+        return false;
+    }
+
+    public void copyAndTransformFormFields(
+            PDDocument sourceDocument,
+            PDDocument newDocument,
+            int totalPages,
+            int pagesPerSheet,
+            int cols,
+            int rows,
+            float cellWidth,
+            float cellHeight)
+            throws IOException {
+
+        PDDocumentCatalog sourceCatalog = sourceDocument.getDocumentCatalog();
+        PDAcroForm sourceAcroForm = sourceCatalog.getAcroForm();
+
+        if (sourceAcroForm == null || sourceAcroForm.getFields().isEmpty()) {
+            return;
+        }
+
+        PDDocumentCatalog newCatalog = newDocument.getDocumentCatalog();
+        PDAcroForm newAcroForm = new PDAcroForm(newDocument);
+        newCatalog.setAcroForm(newAcroForm);
+
+        PDResources dr = new PDResources();
+        PDType1Font helvetica = new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+        PDType1Font zapfDingbats = new PDType1Font(Standard14Fonts.FontName.ZAPF_DINGBATS);
+        dr.put(COSName.getPDFName("Helv"), helvetica);
+        dr.put(COSName.getPDFName("ZaDb"), zapfDingbats);
+        newAcroForm.setDefaultResources(dr);
+        newAcroForm.setDefaultAppearance("/Helv 12 Tf 0 g");
+
+        // Temporarily set NeedAppearances to true during field creation
+        newAcroForm.setNeedAppearances(true);
+
+        Map<String, Integer> fieldNameCounters = new HashMap<>();
+
+        // Build widget -> field map once for efficient lookups
+        Map<PDAnnotationWidget, PDField> widgetFieldMap = buildWidgetFieldMap(sourceAcroForm);
+
+        for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
+            PDPage sourcePage = sourceDocument.getPage(pageIndex);
+            List<PDAnnotation> annotations = sourcePage.getAnnotations();
+
+            if (annotations.isEmpty()) {
+                continue;
+            }
+
+            int destinationPageIndex = pageIndex / pagesPerSheet;
+            int adjustedPageIndex = pageIndex % pagesPerSheet;
+            int rowIndex = adjustedPageIndex / cols;
+            int colIndex = adjustedPageIndex % cols;
+
+            if (rowIndex >= rows) {
+                continue;
+            }
+
+            if (destinationPageIndex >= newDocument.getNumberOfPages()) {
+                continue;
+            }
+
+            PDPage destinationPage = newDocument.getPage(destinationPageIndex);
+            PDRectangle sourceRect = sourcePage.getMediaBox();
+
+            float scaleWidth = cellWidth / sourceRect.getWidth();
+            float scaleHeight = cellHeight / sourceRect.getHeight();
+            float scale = Math.min(scaleWidth, scaleHeight);
+
+            float x = colIndex * cellWidth + (cellWidth - sourceRect.getWidth() * scale) / 2;
+            float y =
+                    destinationPage.getMediaBox().getHeight()
+                            - ((rowIndex + 1) * cellHeight
+                                    - (cellHeight - sourceRect.getHeight() * scale) / 2);
+
+            copyBasicFormFields(
+                    sourceAcroForm,
+                    newAcroForm,
+                    sourcePage,
+                    destinationPage,
+                    x,
+                    y,
+                    scale,
+                    pageIndex,
+                    fieldNameCounters,
+                    widgetFieldMap);
+        }
+
+        // Generate appearance streams and embed them authoritatively
+        boolean appearancesGenerated = false;
+        try {
+            newAcroForm.refreshAppearances();
+            appearancesGenerated = true;
+        } catch (NoSuchMethodError nsme) {
+            log.warn(
+                    "AcroForm.refreshAppearances() not available in this PDFBox version; "
+                            + "leaving NeedAppearances=true for viewer-side rendering.");
+        } catch (Exception t) {
+            log.warn(
+                    "Failed to refresh field appearances via AcroForm: {}. "
+                            + "Leaving NeedAppearances=true as fallback.",
+                    t.getMessage(),
+                    t);
+        }
+
+        // After successful appearance generation, set NeedAppearances to false
+        // to signal that appearance streams are now embedded authoritatively
+        if (appearancesGenerated) {
+            try {
+                newAcroForm.setNeedAppearances(false);
+            } catch (Exception e) {
+                log.debug(
+                        "Failed to set NeedAppearances to false: {}. "
+                                + "Appearances were generated but flag could not be updated.",
+                        e.getMessage());
+            }
+        }
+    }
+
+    private void copyBasicFormFields(
+            PDAcroForm sourceAcroForm,
+            PDAcroForm newAcroForm,
+            PDPage sourcePage,
+            PDPage destinationPage,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters,
+            Map<PDAnnotationWidget, PDField> widgetFieldMap) {
+
+        try {
+            List<PDAnnotation> sourceAnnotations = sourcePage.getAnnotations();
+            List<PDAnnotation> destinationAnnotations = destinationPage.getAnnotations();
+
+            for (PDAnnotation annotation : sourceAnnotations) {
+                if (annotation instanceof PDAnnotationWidget widgetAnnotation) {
+                    if (widgetAnnotation.getRectangle() == null) {
+                        continue;
+                    }
+                    PDField sourceField =
+                            widgetFieldMap != null ? widgetFieldMap.get(widgetAnnotation) : null;
+                    if (sourceField == null) {
+                        continue; // skip widgets without a matching field
+                    }
+                    if (!(sourceField instanceof PDTerminalField terminalField)) {
+                        continue;
+                    }
+
+                    FormFieldTypeSupport handler = FormFieldTypeSupport.forField(terminalField);
+                    if (handler == null) {
+                        log.debug(
+                                "Skipping unsupported field type '{}' for widget '{}'",
+                                sourceField.getClass().getSimpleName(),
+                                Optional.ofNullable(sourceField.getFullyQualifiedName())
+                                        .orElseGet(sourceField::getPartialName));
+                        continue;
+                    }
+
+                    copyFieldUsingHandler(
+                            handler,
+                            terminalField,
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            widgetAnnotation,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+                }
+            }
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to copy basic form fields for page {}: {}",
+                    pageIndex,
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private void copyFieldUsingHandler(
+            FormFieldTypeSupport handler,
+            PDTerminalField sourceField,
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDTerminalField newField = handler.createField(newAcroForm);
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newField,
+                            sourceField.getPartialName(),
+                            handler.fallbackWidgetName(),
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+            if (!initialized) {
+                return;
+            }
+
+            handler.copyFromOriginal(sourceField, newField);
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to copy {} field '{}': {}",
+                    handler.typeName(),
+                    Optional.ofNullable(sourceField.getFullyQualifiedName())
+                            .orElseGet(sourceField::getPartialName),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private <T extends PDTerminalField> boolean initializeFieldWithWidget(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            T newField,
+            String originalName,
+            String fallbackName,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        String baseName = (originalName != null) ? originalName : fallbackName;
+        String newFieldName = generateUniqueFieldName(baseName, pageIndex, fieldNameCounters);
+        newField.setPartialName(newFieldName);
+
+        PDAnnotationWidget newWidget = new PDAnnotationWidget();
+        PDRectangle sourceRect = sourceWidget.getRectangle();
+        if (sourceRect == null) {
+            return false;
+        }
+
+        float newX = (sourceRect.getLowerLeftX() * scale) + offsetX;
+        float newY = (sourceRect.getLowerLeftY() * scale) + offsetY;
+        float newWidth = sourceRect.getWidth() * scale;
+        float newHeight = sourceRect.getHeight() * scale;
+        newWidget.setRectangle(new PDRectangle(newX, newY, newWidth, newHeight));
+        newWidget.setPage(destinationPage);
+
+        newField.getWidgets().add(newWidget);
+        newWidget.setParent(newField);
+        newAcroForm.getFields().add(newField);
+        destinationAnnotations.add(newWidget);
+        return true;
+    }
+
+    private String generateUniqueFieldName(
+            String originalName, int pageIndex, Map<String, Integer> fieldNameCounters) {
+        String baseName = "page" + pageIndex + "_" + originalName;
+
+        Integer counter = fieldNameCounters.get(baseName);
+        if (counter == null) {
+            counter = 0;
+        } else {
+            counter++;
+        }
+        fieldNameCounters.put(baseName, counter);
+
+        return counter == 0 ? baseName : baseName + "_" + counter;
+    }
+
+    private Map<PDAnnotationWidget, PDField> buildWidgetFieldMap(PDAcroForm acroForm) {
+        Map<PDAnnotationWidget, PDField> map = new HashMap<>();
+        if (acroForm == null) {
+            return map;
+        }
+        try {
+            for (PDField field : acroForm.getFieldTree()) {
+                List<PDAnnotationWidget> widgets = field.getWidgets();
+                if (widgets == null) {
+                    continue;
+                }
+                for (PDAnnotationWidget widget : widgets) {
+                    if (widget != null) {
+                        map.put(widget, field);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.warn("Failed to build widget->field map: {}", e.getMessage(), e);
+        }
+        return map;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/util/FormFieldTypeSupport.java

@@ -0,0 +1,368 @@
+package stirling.software.proprietary.util;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdmodel.graphics.color.PDColor;
+import org.apache.pdfbox.pdmodel.graphics.color.PDDeviceRGB;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAppearanceCharacteristicsDictionary;
+import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
+import org.apache.pdfbox.pdmodel.interactive.form.PDCheckBox;
+import org.apache.pdfbox.pdmodel.interactive.form.PDChoice;
+import org.apache.pdfbox.pdmodel.interactive.form.PDComboBox;
+import org.apache.pdfbox.pdmodel.interactive.form.PDField;
+import org.apache.pdfbox.pdmodel.interactive.form.PDListBox;
+import org.apache.pdfbox.pdmodel.interactive.form.PDPushButton;
+import org.apache.pdfbox.pdmodel.interactive.form.PDRadioButton;
+import org.apache.pdfbox.pdmodel.interactive.form.PDSignatureField;
+import org.apache.pdfbox.pdmodel.interactive.form.PDTerminalField;
+import org.apache.pdfbox.pdmodel.interactive.form.PDTextField;
+
+import lombok.extern.slf4j.Slf4j;
+
+@Slf4j
+public enum FormFieldTypeSupport {
+    TEXT("text", "textField", PDTextField.class) {
+        @Override
+        PDTerminalField createField(PDAcroForm acroForm) {
+            PDTextField textField = new PDTextField(acroForm);
+            textField.setDefaultAppearance("/Helv 12 Tf 0 g");
+            return textField;
+        }
+
+        @Override
+        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
+            PDTextField src = (PDTextField) source;
+            PDTextField dst = (PDTextField) target;
+            String value = src.getValueAsString();
+            if (value != null) {
+                dst.setValue(value);
+            }
+        }
+
+        @Override
+        boolean doesNotsupportsDefinitionCreation() {
+            return false;
+        }
+
+        @Override
+        void applyNewFieldDefinition(
+                PDTerminalField field,
+                FormUtils.NewFormFieldDefinition definition,
+                List<String> options)
+                throws IOException {
+            PDTextField textField = (PDTextField) field;
+            String defaultValue = Optional.ofNullable(definition.defaultValue()).orElse("");
+            if (!defaultValue.isBlank()) {
+                FormUtils.setTextValue(textField, defaultValue);
+            }
+        }
+    },
+    CHECKBOX("checkbox", "checkBox", PDCheckBox.class) {
+        @Override
+        PDTerminalField createField(PDAcroForm acroForm) {
+            return new PDCheckBox(acroForm);
+        }
+
+        @Override
+        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
+            PDCheckBox src = (PDCheckBox) source;
+            PDCheckBox dst = (PDCheckBox) target;
+            if (src.isChecked()) {
+                dst.check();
+            } else {
+                dst.unCheck();
+            }
+        }
+
+        @Override
+        boolean doesNotsupportsDefinitionCreation() {
+            return false;
+        }
+
+        @Override
+        void applyNewFieldDefinition(
+                PDTerminalField field,
+                FormUtils.NewFormFieldDefinition definition,
+                List<String> options)
+                throws IOException {
+            PDCheckBox checkBox = (PDCheckBox) field;
+
+            if (!options.isEmpty()) {
+                checkBox.setExportValues(options);
+            }
+
+            ensureCheckBoxAppearance(checkBox);
+
+            if (FormUtils.isChecked(definition.defaultValue())) {
+                checkBox.check();
+            } else {
+                checkBox.unCheck();
+            }
+        }
+
+        private static void ensureCheckBoxAppearance(PDCheckBox checkBox) {
+            try {
+                if (checkBox.getWidgets().isEmpty()) {
+                    return;
+                }
+
+                PDAnnotationWidget widget = checkBox.getWidgets().get(0);
+
+                PDAppearanceCharacteristicsDictionary appearanceChars =
+                        widget.getAppearanceCharacteristics();
+                if (appearanceChars == null) {
+                    appearanceChars =
+                            new PDAppearanceCharacteristicsDictionary(widget.getCOSObject());
+                    widget.setAppearanceCharacteristics(appearanceChars);
+                }
+
+                appearanceChars.setBorderColour(
+                        new PDColor(new float[] {0, 0, 0}, PDDeviceRGB.INSTANCE));
+                appearanceChars.setBackground(
+                        new PDColor(new float[] {1, 1, 1}, PDDeviceRGB.INSTANCE));
+
+                appearanceChars.setNormalCaption("4");
+
+                widget.setPrinted(true);
+                widget.setReadOnly(false);
+                widget.setHidden(false);
+
+            } catch (Exception e) {
+                log.debug("Unable to set checkbox appearance characteristics: {}", e.getMessage());
+            }
+        }
+    },
+    RADIO("radio", "radioButton", PDRadioButton.class) {
+        @Override
+        PDTerminalField createField(PDAcroForm acroForm) {
+            return new PDRadioButton(acroForm);
+        }
+
+        @Override
+        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
+            PDRadioButton src = (PDRadioButton) source;
+            PDRadioButton dst = (PDRadioButton) target;
+            if (src.getExportValues() != null) {
+                dst.setExportValues(src.getExportValues());
+            }
+            if (src.getValue() != null) {
+                dst.setValue(src.getValue());
+            }
+        }
+    },
+    COMBOBOX("combobox", "comboBox", PDComboBox.class) {
+        @Override
+        PDTerminalField createField(PDAcroForm acroForm) {
+            return new PDComboBox(acroForm);
+        }
+
+        @Override
+        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
+            PDComboBox src = (PDComboBox) source;
+            PDComboBox dst = (PDComboBox) target;
+            copyChoiceCharacteristics(src, dst);
+            if (src.getOptions() != null) {
+                dst.setOptions(src.getOptions());
+            }
+            if (src.getValue() != null && !src.getValue().isEmpty()) {
+                dst.setValue(src.getValue());
+            }
+        }
+
+        @Override
+        boolean doesNotsupportsDefinitionCreation() {
+            return false;
+        }
+
+        @Override
+        void applyNewFieldDefinition(
+                PDTerminalField field,
+                FormUtils.NewFormFieldDefinition definition,
+                List<String> options)
+                throws IOException {
+            PDComboBox comboBox = (PDComboBox) field;
+            if (!options.isEmpty()) {
+                comboBox.setOptions(options);
+            }
+            List<String> allowedOptions = FormUtils.resolveOptions(comboBox);
+            String comboName =
+                    Optional.ofNullable(comboBox.getFullyQualifiedName())
+                            .orElseGet(comboBox::getPartialName);
+            String defaultValue = definition.defaultValue();
+            if (defaultValue != null && !defaultValue.isBlank()) {
+                String filtered =
+                        FormUtils.filterSingleChoiceSelection(
+                                defaultValue, allowedOptions, comboName);
+                if (filtered != null) {
+                    comboBox.setValue(filtered);
+                }
+            }
+        }
+    },
+    LISTBOX("listbox", "listBox", PDListBox.class) {
+        @Override
+        PDTerminalField createField(PDAcroForm acroForm) {
+            return new PDListBox(acroForm);
+        }
+
+        @Override
+        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
+            PDListBox src = (PDListBox) source;
+            PDListBox dst = (PDListBox) target;
+            copyChoiceCharacteristics(src, dst);
+            if (src.getOptions() != null) {
+                dst.setOptions(src.getOptions());
+            }
+            if (src.getValue() != null && !src.getValue().isEmpty()) {
+                dst.setValue(src.getValue());
+            }
+        }
+
+        @Override
+        boolean doesNotsupportsDefinitionCreation() {
+            return false;
+        }
+
+        @Override
+        void applyNewFieldDefinition(
+                PDTerminalField field,
+                FormUtils.NewFormFieldDefinition definition,
+                List<String> options)
+                throws IOException {
+            PDListBox listBox = (PDListBox) field;
+            listBox.setMultiSelect(Boolean.TRUE.equals(definition.multiSelect()));
+            if (!options.isEmpty()) {
+                listBox.setOptions(options);
+            }
+            List<String> allowedOptions = FormUtils.collectChoiceAllowedValues(listBox);
+            String listBoxName =
+                    Optional.ofNullable(listBox.getFullyQualifiedName())
+                            .orElseGet(listBox::getPartialName);
+            String defaultValue = definition.defaultValue();
+            if (defaultValue != null && !defaultValue.isBlank()) {
+                if (Boolean.TRUE.equals(definition.multiSelect())) {
+                    List<String> selections = FormUtils.parseMultiChoiceSelections(defaultValue);
+                    List<String> filtered =
+                            FormUtils.filterChoiceSelections(
+                                    selections, allowedOptions, listBoxName);
+                    if (!filtered.isEmpty()) {
+                        listBox.setValue(filtered);
+                    }
+                } else {
+                    String filtered =
+                            FormUtils.filterSingleChoiceSelection(
+                                    defaultValue, allowedOptions, listBoxName);
+                    if (filtered != null) {
+                        listBox.setValue(filtered);
+                    }
+                }
+            }
+        }
+    },
+    SIGNATURE("signature", "signature", PDSignatureField.class) {
+        @Override
+        PDTerminalField createField(PDAcroForm acroForm) {
+            return new PDSignatureField(acroForm);
+        }
+    },
+    BUTTON("button", "pushButton", PDPushButton.class) {
+        @Override
+        PDTerminalField createField(PDAcroForm acroForm) {
+            return new PDPushButton(acroForm);
+        }
+    };
+
+    private static final Map<String, FormFieldTypeSupport> BY_TYPE =
+            Arrays.stream(values())
+                    .collect(
+                            Collectors.toUnmodifiableMap(
+                                    FormFieldTypeSupport::typeName, Function.identity()));
+
+    private final String typeName;
+    private final String fallbackWidgetName;
+    private final Class<? extends PDTerminalField> fieldClass;
+
+    FormFieldTypeSupport(
+            String typeName,
+            String fallbackWidgetName,
+            Class<? extends PDTerminalField> fieldClass) {
+        this.typeName = typeName;
+        this.fallbackWidgetName = fallbackWidgetName;
+        this.fieldClass = fieldClass;
+    }
+
+    public static FormFieldTypeSupport forField(PDField field) {
+        if (field == null) {
+            return null;
+        }
+        for (FormFieldTypeSupport handler : values()) {
+            if (handler.fieldClass.isInstance(field)) {
+                return handler;
+            }
+        }
+        return null;
+    }
+
+    public static FormFieldTypeSupport forTypeName(String typeName) {
+        if (typeName == null) {
+            return null;
+        }
+        return BY_TYPE.get(typeName);
+    }
+
+    private static void copyChoiceCharacteristics(PDChoice sourceField, PDChoice targetField) {
+        if (sourceField == null || targetField == null) {
+            return;
+        }
+
+        try {
+            int flags = sourceField.getCOSObject().getInt(COSName.FF);
+            targetField.getCOSObject().setInt(COSName.FF, flags);
+        } catch (Exception e) {
+            // ignore and continue
+        }
+
+        if (sourceField instanceof PDListBox sourceList
+                && targetField instanceof PDListBox targetList) {
+            try {
+                targetList.setMultiSelect(sourceList.isMultiSelect());
+            } catch (Exception ignored) {
+                // ignore
+            }
+        }
+    }
+
+    String typeName() {
+        return typeName;
+    }
+
+    String fallbackWidgetName() {
+        return fallbackWidgetName;
+    }
+
+    abstract PDTerminalField createField(PDAcroForm acroForm);
+
+    void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
+        // default no-op
+    }
+
+    boolean doesNotsupportsDefinitionCreation() {
+        return true;
+    }
+
+    void applyNewFieldDefinition(
+            PDTerminalField field,
+            FormUtils.NewFormFieldDefinition definition,
+            List<String> options)
+            throws IOException {
+        // default no-op
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/security/configuration/ee/LicenseKeyCheckerTest.java

@@ -17,11 +17,13 @@ import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
 
 @ExtendWith(MockitoExtension.class)
 class LicenseKeyCheckerTest {
 
     @Mock private KeygenLicenseVerifier verifier;
+    @Mock private UserLicenseSettingsService userLicenseSettingsService;
 
     @Test
     void premiumDisabled_skipsVerification() {
@@ -29,7 +31,9 @@ class LicenseKeyCheckerTest {
         props.getPremium().setEnabled(false);
         props.getPremium().setKey("dummy");
 
-        LicenseKeyChecker checker = new LicenseKeyChecker(verifier, props);
+        LicenseKeyChecker checker =
+                new LicenseKeyChecker(verifier, props, userLicenseSettingsService);
+        checker.init();
 
         assertEquals(License.NORMAL, checker.getPremiumLicenseEnabledResult());
         verifyNoInteractions(verifier);
@@ -42,7 +46,9 @@ class LicenseKeyCheckerTest {
         props.getPremium().setKey("abc");
         when(verifier.verifyLicense("abc")).thenReturn(License.PRO);
 
-        LicenseKeyChecker checker = new LicenseKeyChecker(verifier, props);
+        LicenseKeyChecker checker =
+                new LicenseKeyChecker(verifier, props, userLicenseSettingsService);
+        checker.init();
 
         assertEquals(License.PRO, checker.getPremiumLicenseEnabledResult());
         verify(verifier).verifyLicense("abc");
@@ -58,7 +64,9 @@ class LicenseKeyCheckerTest {
         props.getPremium().setKey("file:" + file.toString());
         when(verifier.verifyLicense("filekey")).thenReturn(License.ENTERPRISE);
 
-        LicenseKeyChecker checker = new LicenseKeyChecker(verifier, props);
+        LicenseKeyChecker checker =
+                new LicenseKeyChecker(verifier, props, userLicenseSettingsService);
+        checker.init();
 
         assertEquals(License.ENTERPRISE, checker.getPremiumLicenseEnabledResult());
         verify(verifier).verifyLicense("filekey");
@@ -71,7 +79,9 @@ class LicenseKeyCheckerTest {
         props.getPremium().setEnabled(true);
         props.getPremium().setKey("file:" + file.toString());
 
-        LicenseKeyChecker checker = new LicenseKeyChecker(verifier, props);
+        LicenseKeyChecker checker =
+                new LicenseKeyChecker(verifier, props, userLicenseSettingsService);
+        checker.init();
 
         assertEquals(License.NORMAL, checker.getPremiumLicenseEnabledResult());
         verifyNoInteractions(verifier);

app/proprietary/src/test/java/stirling/software/proprietary/util/FormUtilsTest.java

@@ -0,0 +1,114 @@
+package stirling.software.proprietary.util;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDResources;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
+import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
+import org.apache.pdfbox.pdmodel.interactive.form.PDCheckBox;
+import org.apache.pdfbox.pdmodel.interactive.form.PDTextField;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
+
+@Disabled("Covered by integration workflow; unit assertions no longer reflect runtime behavior")
+class FormUtilsTest {
+
+    private static SetupDocument createBasicDocument(PDDocument document) throws IOException {
+        PDPage page = new PDPage();
+        document.addPage(page);
+
+        PDAcroForm acroForm = new PDAcroForm(document);
+        acroForm.setDefaultResources(new PDResources());
+        acroForm.setNeedAppearances(true);
+        document.getDocumentCatalog().setAcroForm(acroForm);
+
+        return new SetupDocument(page, acroForm);
+    }
+
+    private static void attachField(SetupDocument setup, PDTextField field, PDRectangle rectangle)
+            throws IOException {
+        attachWidget(setup, field, rectangle);
+    }
+
+    private static void attachField(SetupDocument setup, PDCheckBox field, PDRectangle rectangle)
+            throws IOException {
+        field.setExportValues(List.of("Yes"));
+        attachWidget(setup, field, rectangle);
+    }
+
+    private static void attachWidget(
+            SetupDocument setup,
+            org.apache.pdfbox.pdmodel.interactive.form.PDTerminalField field,
+            PDRectangle rectangle)
+            throws IOException {
+        PDAnnotationWidget widget = new PDAnnotationWidget();
+        widget.setRectangle(rectangle);
+        widget.setPage(setup.page);
+        List<PDAnnotationWidget> widgets = field.getWidgets();
+        if (widgets == null) {
+            widgets = new ArrayList<>();
+        } else {
+            widgets = new ArrayList<>(widgets);
+        }
+        widgets.add(widget);
+        field.setWidgets(widgets);
+        setup.acroForm.getFields().add(field);
+        setup.page.getAnnotations().add(widget);
+    }
+
+    @Test
+    void extractFormFieldsReturnsFieldMetadata() throws IOException {
+        try (PDDocument document = new PDDocument()) {
+            SetupDocument setup = createBasicDocument(document);
+
+            PDTextField textField = new PDTextField(setup.acroForm);
+            textField.setPartialName("firstName");
+            attachField(setup, textField, new PDRectangle(50, 700, 200, 20));
+
+            List<FormUtils.FormFieldInfo> fields = FormUtils.extractFormFields(document);
+            assertEquals(1, fields.size());
+            FormUtils.FormFieldInfo info = fields.get(0);
+            assertEquals("firstName", info.name());
+            assertEquals("text", info.type());
+            assertEquals(0, info.pageIndex());
+            assertEquals("", info.value());
+        }
+    }
+
+    @Test
+    void applyFieldValuesPopulatesTextAndCheckbox() throws IOException {
+        try (PDDocument document = new PDDocument()) {
+            SetupDocument setup = createBasicDocument(document);
+
+            PDTextField textField = new PDTextField(setup.acroForm);
+            textField.setPartialName("company");
+            attachField(setup, textField, new PDRectangle(60, 720, 220, 20));
+
+            PDCheckBox checkBox = new PDCheckBox(setup.acroForm);
+            checkBox.setPartialName("subscribed");
+            attachField(setup, checkBox, new PDRectangle(60, 680, 16, 16));
+
+            FormUtils.applyFieldValues(
+                    document, Map.of("company", "Stirling", "subscribed", true), false);
+
+            assertEquals("Stirling", textField.getValueAsString());
+            assertTrue(checkBox.isChecked());
+
+            FormUtils.applyFieldValues(document, Map.of("subscribed", false), false);
+            assertFalse(checkBox.isChecked());
+            assertEquals("Off", checkBox.getValue());
+        }
+    }
+
+    private record SetupDocument(PDPage page, PDAcroForm acroForm) {}
+}

build.gradle

@@ -57,7 +57,7 @@ repositories {
 
 allprojects {
     group = 'stirling.software'
-    version = '1.4.0'
+    version = '2.0.0'
 
     configurations.configureEach {
         exclude group: 'commons-logging', module: 'commons-logging'

docker/Dockerfile.unified

@@ -10,7 +10,7 @@ COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci
 
 COPY frontend .
-RUN npm run build
+RUN DISABLE_ADDITIONAL_FEATURES=false npm run build
 
 # Stage 2: Build Backend
 FROM gradle:8.14-jdk21 AS backend-build

docker/unified/nginx.conf

@@ -1,3 +1,6 @@
+# Run nginx as non-root user
+pid /tmp/nginx.pid;
+
 events {
     worker_connections 1024;
 }

frontend/package-lock.json

@@ -10,24 +10,25 @@
       "license": "SEE LICENSE IN https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/refs/heads/main/proprietary/LICENSE",
       "dependencies": {
         "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
-        "@embedpdf/core": "^1.3.14",
-        "@embedpdf/engines": "^1.3.14",
-        "@embedpdf/plugin-annotation": "^1.3.14",
-        "@embedpdf/plugin-export": "^1.3.14",
-        "@embedpdf/plugin-history": "^1.3.14",
-        "@embedpdf/plugin-interaction-manager": "^1.3.14",
-        "@embedpdf/plugin-loader": "^1.3.14",
-        "@embedpdf/plugin-pan": "^1.3.14",
-        "@embedpdf/plugin-render": "^1.3.14",
-        "@embedpdf/plugin-rotate": "^1.3.14",
-        "@embedpdf/plugin-scroll": "^1.3.14",
-        "@embedpdf/plugin-search": "^1.3.14",
-        "@embedpdf/plugin-selection": "^1.3.14",
-        "@embedpdf/plugin-spread": "^1.3.14",
-        "@embedpdf/plugin-thumbnail": "^1.3.14",
-        "@embedpdf/plugin-tiling": "^1.3.14",
-        "@embedpdf/plugin-viewport": "^1.3.14",
-        "@embedpdf/plugin-zoom": "^1.3.14",
+        "@dnd-kit/core": "^6.3.1",
+        "@embedpdf/core": "^1.4.1",
+        "@embedpdf/engines": "^1.4.1",
+        "@embedpdf/plugin-annotation": "^1.4.1",
+        "@embedpdf/plugin-export": "^1.4.1",
+        "@embedpdf/plugin-history": "^1.4.1",
+        "@embedpdf/plugin-interaction-manager": "^1.4.1",
+        "@embedpdf/plugin-loader": "^1.4.1",
+        "@embedpdf/plugin-pan": "^1.4.1",
+        "@embedpdf/plugin-render": "^1.4.1",
+        "@embedpdf/plugin-rotate": "^1.4.1",
+        "@embedpdf/plugin-scroll": "^1.4.1",
+        "@embedpdf/plugin-search": "^1.4.1",
+        "@embedpdf/plugin-selection": "^1.4.1",
+        "@embedpdf/plugin-spread": "^1.4.1",
+        "@embedpdf/plugin-thumbnail": "^1.4.1",
+        "@embedpdf/plugin-tiling": "^1.4.1",
+        "@embedpdf/plugin-viewport": "^1.4.1",
+        "@embedpdf/plugin-zoom": "^1.4.1",
         "@emotion/react": "^11.14.0",
         "@emotion/styled": "^11.14.1",
         "@iconify/react": "^6.0.2",
@@ -441,7 +442,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -488,7 +488,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -507,12 +506,68 @@
         "node": ">=18"
       }
     },
+    "node_modules/@dnd-kit/accessibility": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/accessibility/-/accessibility-3.1.1.tgz",
+      "integrity": "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/accessibility/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@dnd-kit/core": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/core/-/core-6.3.1.tgz",
+      "integrity": "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@dnd-kit/accessibility": "^3.1.1",
+        "@dnd-kit/utilities": "^3.2.2",
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/core/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@dnd-kit/utilities": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/utilities/-/utilities-3.2.2.tgz",
+      "integrity": "sha512-+MKAJEOfaBe5SmV6t34p80MMKhjvUz0vRrvVJbPT0WElzaOJ/1xs+D+KDv+tD/NE5ujfrChEcshd4fLn0wpiqg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/utilities/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
     "node_modules/@embedpdf/core": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/@embedpdf/core/-/core-1.4.1.tgz",
       "integrity": "sha512-TGpxn2CvAKRnOJWJ3bsK+dKBiCp75ehxftRUmv7wAmPomhnG5XrDfoWJungvO+zbbqAwso6PocdeXINVt3hlAw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/engines": "1.4.1",
         "@embedpdf/models": "1.4.1"
@@ -596,7 +651,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-history/-/plugin-history-1.4.1.tgz",
       "integrity": "sha512-5WLDiNMH6tACkLGGv/lJtNsDeozOhSbrh0mjD1btHun8u7Yscu/Vf8tdJRUOsd+nULivo2nQ2NFNKu0OTbVo8w==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.4.1"
       },
@@ -613,7 +667,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-interaction-manager/-/plugin-interaction-manager-1.4.1.tgz",
       "integrity": "sha512-Ng02S9SFIAi9JZS5rI+NXSnZZ1Yk9YYRw4MlN2pig49qOyivZdz0oScZaYxQPewo8ccJkLeghjdeWswOBW/6cA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.4.1"
       },
@@ -631,7 +684,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-loader/-/plugin-loader-1.4.1.tgz",
       "integrity": "sha512-m3ZOk8JygsLxoa4cZ+0BVB5pfRWuBCg2/gPqjhoFZNKTqAFw4J6HGUrhYKg94GRYe+w1cTJl/NbTBYuU5DOrsA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.4.1"
       },
@@ -668,7 +720,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-render/-/plugin-render-1.4.1.tgz",
       "integrity": "sha512-gKCdNKw6WBHBEpTc2DLBWIWOxzsNnaNbpfeY6C4f2Bum0EO+XW3Hl2oIx1uaRHjIhhnXso1J3QweqelsPwDGwg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.4.1"
       },
@@ -703,7 +754,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-scroll/-/plugin-scroll-1.4.1.tgz",
       "integrity": "sha512-Y9O+matB4j4fLim5s/jn7qIi+lMC9vmDJRpJhiWe8bvD9oYLP2xfD/DdhFgAjRKcNhPoxC+j8q8QN5BMeGAv2Q==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.4.1"
       },
@@ -740,7 +790,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-selection/-/plugin-selection-1.4.1.tgz",
       "integrity": "sha512-lo5Ytk1PH0PrRKv6zKVupm4t02VGsqIrnSIeP6NO8Ujx0wfqEhj//sqIuO/EwfFVJD8lcQIP9UUo9y8baCrEog==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.4.1"
       },
@@ -816,7 +865,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-viewport/-/plugin-viewport-1.4.1.tgz",
       "integrity": "sha512-+TgFHKPCLTBiDYe2DdsmTS37hwQgcZ3dYIc7bE0l5cp+GVwouu1h0MTmjL+90loizeWwCiu10E/zXR6hz+CUaQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.4.1"
       },
@@ -972,7 +1020,6 @@
       "resolved": "https://registry.npmjs.org/@emotion/react/-/react-11.14.0.tgz",
       "integrity": "sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.18.3",
         "@emotion/babel-plugin": "^11.13.5",
@@ -1016,7 +1063,6 @@
       "resolved": "https://registry.npmjs.org/@emotion/styled/-/styled-11.14.1.tgz",
       "integrity": "sha512-qEEJt42DuToa3gurlH4Qqc1kVpNq8wO8cJtDzU46TjlzWjDlsVyevtYCRijVq3SrHsROS+gVQ8Fnea108GnKzw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.18.3",
         "@emotion/babel-plugin": "^11.13.5",
@@ -2047,7 +2093,6 @@
       "resolved": "https://registry.npmjs.org/@mantine/core/-/core-8.3.5.tgz",
       "integrity": "sha512-PdVNLMgOS2vFhOujRi6/VC9ic8w3UDyKX7ftwDeJ7yQT8CiepUxfbWWYpVpnq23bdWh/7fIT2Pn1EY8r8GOk7g==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@floating-ui/react": "^0.27.16",
         "clsx": "^2.1.1",
@@ -2098,7 +2143,6 @@
       "resolved": "https://registry.npmjs.org/@mantine/hooks/-/hooks-8.3.5.tgz",
       "integrity": "sha512-0Wf08eWLKi3WkKlxnV1W5vfuN6wcvAV2VbhQlOy0R9nrWorGTtonQF6qqBE3PnJFYF1/ZE+HkYZQ/Dr7DmYSMQ==",
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "react": "^18.x || ^19.x"
       }
@@ -2166,7 +2210,6 @@
       "resolved": "https://registry.npmjs.org/@mui/material/-/material-7.3.4.tgz",
       "integrity": "sha512-gEQL9pbJZZHT7lYJBKQCS723v1MGys2IFc94COXbUIyCTWa+qC77a7hUax4Yjd5ggEm35dk4AyYABpKKWC4MLw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.28.4",
         "@mui/core-downloads-tracker": "^7.3.4",
@@ -3850,7 +3893,6 @@
       "integrity": "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.10.4",
         "@babel/runtime": "^7.12.5",
@@ -4174,7 +4216,6 @@
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.2.tgz",
       "integrity": "sha512-6mDvHUFSjyT2B2yeNx2nUgMxh9LtOWvkhIU3uePn2I2oyNymUAX1NIsdgviM4CH+JSrp2D2hsMvJOkxY+0wNRA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "csstype": "^3.0.2"
       }
@@ -4185,7 +4226,6 @@
       "integrity": "sha512-9KQPoO6mZCi7jcIStSnlOWn2nEF3mNmyr3rIAsGnAbQKYbRLyqmeSc39EVgtxXVia+LMT8j3knZLAZAh+xLmrw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "@types/react": "^19.2.0"
       }
@@ -4246,7 +4286,6 @@
       "integrity": "sha512-BnOroVl1SgrPLywqxyqdJ4l3S2MsKVLDVxZvjI1Eoe8ev2r3kGDo+PcMihNmDE+6/KjkTubSJnmqGZZjQSBq/g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.46.2",
         "@typescript-eslint/types": "8.46.2",
@@ -4960,6 +4999,7 @@
       "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.22.tgz",
       "integrity": "sha512-f2Wux4v/Z2pqc9+4SmgZC1p73Z53fyD90NFWXiX9AKVnVBEvLFOWCEgJD3GdGnlxPZt01PSlfmLqbLYzY/Fw4A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/shared": "3.5.22"
       }
@@ -4969,6 +5009,7 @@
       "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.22.tgz",
       "integrity": "sha512-EHo4W/eiYeAzRTN5PCextDUZ0dMs9I8mQ2Fy+OkzvRPUYQEyK9yAjbasrMCXbLNhF7P0OUyivLjIy0yc6VrLJQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/reactivity": "3.5.22",
         "@vue/shared": "3.5.22"
@@ -4979,6 +5020,7 @@
       "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.22.tgz",
       "integrity": "sha512-Av60jsryAkI023PlN7LsqrfPvwfxOd2yAwtReCjeuugTJTkgrksYJJstg1e12qle0NarkfhfFu1ox2D+cQotww==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/reactivity": "3.5.22",
         "@vue/runtime-core": "3.5.22",
@@ -4991,6 +5033,7 @@
       "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.22.tgz",
       "integrity": "sha512-gXjo+ao0oHYTSswF+a3KRHZ1WszxIqO7u6XwNHqcqb9JfyIL/pbWrrh/xLv7jeDqla9u+LK7yfZKHih1e1RKAQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/compiler-ssr": "3.5.22",
         "@vue/shared": "3.5.22"
@@ -5017,7 +5060,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5702,7 +5744,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.8.19",
         "caniuse-lite": "^1.0.30001751",
@@ -6748,8 +6789,7 @@
       "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1508733.tgz",
       "integrity": "sha512-QJ1R5gtck6nDcdM+nlsaJXcelPEI7ZxSMw1ujHpO1c4+9l+Nue5qlebi9xO1Z2MGr92bFOQTW7/rrheh5hHxDg==",
       "dev": true,
-      "license": "BSD-3-Clause",
-      "peer": true
+      "license": "BSD-3-Clause"
     },
     "node_modules/dezalgo": {
       "version": "1.0.4",
@@ -7144,7 +7184,6 @@
       "integrity": "sha512-t5aPOpmtJcZcz5UJyY2GbvpDlsK5E8JqRqoKtfiKE3cNh437KIqfJr3A3AKf5k64NPx6d0G3dno6XDY05PqPtw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -7315,7 +7354,6 @@
       "integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@rtsao/scc": "^1.1.0",
         "array-includes": "^3.1.9",
@@ -8638,7 +8676,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.27.6"
       },
@@ -9446,7 +9483,6 @@
       "integrity": "sha512-SNSQteBL1IlV2zqhwwolaG9CwhIhTvVHWg3kTss/cLE7H/X4644mtPQqYvCfsSrGQWt9hSZcgOXX8bOZaMN+kA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@asamuzakjp/dom-selector": "^6.7.2",
         "cssstyle": "^5.3.1",
@@ -11223,7 +11259,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -11503,7 +11538,6 @@
       "resolved": "https://registry.npmjs.org/preact/-/preact-10.27.2.tgz",
       "integrity": "sha512-5SYSgFKSyhCbk6SrXyMpqjb5+MQBgfvEKE/OC+PujcY34sOpqtr+0AZQtPYx5IA6VxynQ7rUPCtKzyovpj9Bpg==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/preact"
@@ -11876,7 +11910,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.0.tgz",
       "integrity": "sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -11886,7 +11919,6 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.0.tgz",
       "integrity": "sha512-UlbRu4cAiGaIewkPyiRGJk0imDN2T3JjieT6spoL2UeSf5od4n5LB/mQ4ejmxhCFT1tYe8IvaFulzynWovsEFQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -13321,9 +13353,9 @@
       }
     },
     "node_modules/svelte": {
-      "version": "5.42.3",
-      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.42.3.tgz",
-      "integrity": "sha512-+8dUmdJGvKSWEfbAgIaUmpD97s1bBAGxEf6s7wQonk+HNdMmrBZtpStzRypRqrYBFUmmhaUgBHUjraE8gLqWAw==",
+      "version": "5.43.0",
+      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.43.0.tgz",
+      "integrity": "sha512-1sRxVbgJAB+UGzwkc3GUoiBSzEOf0jqzccMaVoI2+pI+kASUe9qubslxace8+Mzhqw19k4syTA5niCIJwfXpOA==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -13557,7 +13589,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -13859,7 +13890,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -13942,7 +13972,6 @@
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "napi-postinstall": "^0.3.0"
       },
@@ -14147,7 +14176,6 @@
       "integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -14299,7 +14327,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -14313,7 +14340,6 @@
       "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/chai": "^5.2.2",
         "@vitest/expect": "3.2.4",

frontend/package.json

@@ -6,24 +6,25 @@
   "proxy": "http://localhost:8080",
   "dependencies": {
     "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
-    "@embedpdf/core": "^1.3.14",
-    "@embedpdf/engines": "^1.3.14",
-    "@embedpdf/plugin-annotation": "^1.3.14",
-    "@embedpdf/plugin-export": "^1.3.14",
-    "@embedpdf/plugin-history": "^1.3.14",
-    "@embedpdf/plugin-interaction-manager": "^1.3.14",
-    "@embedpdf/plugin-loader": "^1.3.14",
-    "@embedpdf/plugin-pan": "^1.3.14",
-    "@embedpdf/plugin-render": "^1.3.14",
-    "@embedpdf/plugin-rotate": "^1.3.14",
-    "@embedpdf/plugin-scroll": "^1.3.14",
-    "@embedpdf/plugin-search": "^1.3.14",
-    "@embedpdf/plugin-selection": "^1.3.14",
-    "@embedpdf/plugin-spread": "^1.3.14",
-    "@embedpdf/plugin-thumbnail": "^1.3.14",
-    "@embedpdf/plugin-tiling": "^1.3.14",
-    "@embedpdf/plugin-viewport": "^1.3.14",
-    "@embedpdf/plugin-zoom": "^1.3.14",
+    "@dnd-kit/core": "^6.3.1",
+    "@embedpdf/core": "^1.4.1",
+    "@embedpdf/engines": "^1.4.1",
+    "@embedpdf/plugin-annotation": "^1.4.1",
+    "@embedpdf/plugin-export": "^1.4.1",
+    "@embedpdf/plugin-history": "^1.4.1",
+    "@embedpdf/plugin-interaction-manager": "^1.4.1",
+    "@embedpdf/plugin-loader": "^1.4.1",
+    "@embedpdf/plugin-pan": "^1.4.1",
+    "@embedpdf/plugin-render": "^1.4.1",
+    "@embedpdf/plugin-rotate": "^1.4.1",
+    "@embedpdf/plugin-scroll": "^1.4.1",
+    "@embedpdf/plugin-search": "^1.4.1",
+    "@embedpdf/plugin-selection": "^1.4.1",
+    "@embedpdf/plugin-spread": "^1.4.1",
+    "@embedpdf/plugin-thumbnail": "^1.4.1",
+    "@embedpdf/plugin-tiling": "^1.4.1",
+    "@embedpdf/plugin-viewport": "^1.4.1",
+    "@embedpdf/plugin-zoom": "^1.4.1",
     "@emotion/react": "^11.14.0",
     "@tauri-apps/api": "^2.5.0",
     "@tauri-apps/plugin-fs": "^2.4.0",
@@ -66,6 +67,7 @@
     "preview": "vite preview",
     "tauri-dev": "tauri dev --no-watch",
     "tauri-build": "tauri build",
+    "tauri-clean": "cd src-tauri && cargo clean && cd .. && rm -rf dist build",
     "typecheck": "npm run typecheck:proprietary",
     "typecheck:core": "tsc --noEmit --project tsconfig.core.json",
     "typecheck:proprietary": "tsc --noEmit --project tsconfig.proprietary.json",

frontend/public/branding/old/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 512 512" style="enable-background:new 0 0 512 512" xml:space="preserve"><defs id="defs173"><linearGradient id="XMLID_5_" x1="304.496" x2="316.036" y1="422.91" y2="326.263" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#dcf1f3" id="stop156"/><stop offset="1" style="stop-color:#c2c2c9" id="stop158"/></linearGradient></defs><style id="style150" type="text/css">.st1{fill:#c02223}.st2{fill:#882425}.st3{fill:url(#XMLID_5_)}.st4{fill:url(#XMLID_7_)}</style><g id="XMLID_4_"><path id="XMLID_131_" d="M 347.01402,14.355825 98.978019,69.02261 C 73.825483,74.547445 55.942464,96.792175 55.942464,122.52628 v 315.06096 c 0,22.39012 16.719895,41.14548 38.819234,43.76251 L 224.8861,498.36042 339.48636,384.26465 455.76603,265.15425 453.73057,84.870162 C 453.43979,62.916214 433.08513,46.632491 411.71274,51.284984 l -28.78729,6.251786 0.14539,-13.666697 C 383.36162,24.678542 365.62399,10.284894 347.01402,14.355825 Z" class="st1" style="stroke-width:1.45391"/><path id="XMLID_117_" d="m 383.21622,57.53677 v 285.8375 L 456.05681,265.00885 454.02135,78.763767 C 453.87595,59.863016 436.28372,45.905539 417.81914,49.97647 Z" class="st2" style="stroke-width:1.45391"/><polygon id="XMLID_18_" points="234.7 422.6 368.5 387.7 393.5 262.2" class="st3" style="fill:url(#XMLID_5_)" transform="matrix(1.4556308,0,0,1.4548265,-116.73161,-116.45231)"/><linearGradient id="XMLID_7_" x1="223.084" x2="241.417" y1="372.756" y2="114.557" gradientTransform="matrix(1.4539039,0,0,1.4539039,-116.19976,-116.20474)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#dcf1f3" id="stop163"/><stop offset="1" style="stop-color:#c2c2c9" id="stop165"/></linearGradient><path id="XMLID_6_" d="m 282.89686,214.84917 c 0,0 -22.24473,-28.93269 -38.67384,-36.78377 -10.46811,-4.94327 -26.02489,-6.83335 -38.23768,-0.72695 -18.02841,9.0142 -19.91848,34.31213 -3.34397,44.34406 3.92553,2.47165 9.15959,4.50711 15.99294,6.10641 36.63838,8.43264 97.12077,25.87949 89.70587,96.10304 0,0 -4.21633,65.86185 -73.56753,73.42215 -12.2128,1.30851 -24.57098,0.43617 -36.493,-2.32625 -16.42911,-3.63476 -45.50719,-11.04967 -59.75545,-19.91849 l -2.61703,-75.16682 h 6.97875 c 0,0 13.81208,33.43978 53.06749,49.57812 7.26952,2.90781 15.26599,4.07093 22.97168,2.90781 9.74116,-1.45391 21.22699,-6.68796 25.87949,-22.53551 0,0 7.85108,-23.11707 -32.85823,-35.76604 -32.56744,-10.17733 -63.24481,-20.64543 -75.89378,-54.95757 -5.961,-16.28371 -6.97874,-34.31212 -2.90781,-51.61358 5.37944,-22.53551 20.79082,-54.23062 64.40794,-67.89732 0,0 57.28381,-15.55677 96.53922,5.52484 l -1.74468,89.70587 z" class="st4" style="fill:url(#XMLID_7_);stroke-width:1.45391"/></g></svg>