extra validations

codex/re-enable-tool-disabling-functionality

.github/workflows/tauri-build.yml

@@ -14,7 +14,7 @@ on:
           - macos
           - linux
   pull_request:
-    branches: [main, V2]
+    branches: [main, V2, V2-tauri-windows]
     paths:
       - 'frontend/src-tauri/**'
       - 'frontend/src/desktop/**'
@@ -61,6 +61,9 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
     runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
@@ -174,6 +177,84 @@ jobs:
         working-directory: ./frontend
         run: npm install
 
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
       - name: Import Apple Developer Certificate
         if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         env:
@@ -229,13 +310,174 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          SIGN: 1
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          SIGN: ${{ (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true
         with:
           projectPath: ./frontend
           tauriScript: npx tauri
           args: ${{ matrix.args }}
 
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # List available certificates and check if they have certificates attached
+          Write-Host "Checking for available certificates..."
+          $certList = & smctl keypair ls 2>&1
+          Write-Host "Keypair list output:"
+          Write-Host $certList
+          Write-Host ""
+
+          # Parse the output to check certificate status
+          $lines = $certList -split "`n"
+          $foundKeypair = $false
+          $hasCertificate = $false
+
+          foreach ($line in $lines) {
+            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
+              $foundKeypair = $true
+              Write-Host "[SUCCESS] Found keypair in list"
+
+              # Check if this line has certificate info (not just empty spaces after alias)
+              $parts = $line -split "\s+"
+              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
+                $hasCertificate = $true
+                Write-Host "[SUCCESS] Certificate is associated with keypair"
+              }
+            }
+          }
+
+          if (-not $foundKeypair) {
+            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
+            Write-Host "Available keypairs are listed above"
+            Write-Host ""
+            Write-Host "Please verify:"
+            Write-Host "  1. Keypair alias is correct in GitHub secret"
+            Write-Host "  2. API key has access to this keypair"
+            exit 1
+          }
+
+          if (-not $hasCertificate) {
+            Write-Host "[ERROR] No certificate associated with keypair"
+            Write-Host "This usually means:"
+            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
+            Write-Host "  2. Certificate is pending approval"
+            Write-Host "  3. Certificate needs to be attached to the keypair"
+            Write-Host ""
+            Write-Host "Try running in DigiCert ONE portal:"
+            Write-Host "  smctl keypair sync"
+            exit 1
+          }
+
+          Write-Host "[SUCCESS] Certificate check passed"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              Write-Host ""
+              Write-Host "Possible issues:"
+              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
+              Write-Host "  2. Incorrect keypair alias"
+              Write-Host "  3. API key lacks signing permissions"
+              Write-Host ""
+              Write-Host "Please verify in DigiCert ONE portal:"
+              Write-Host "  - Certificate status is 'Issued' (not Pending)"
+              Write-Host "  - Keypair status is 'Online'"
+              Write-Host "  - 'Can sign' is set to 'Yes'"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
       - name: Verify notarization (macOS only)
         if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         run: |
@@ -269,6 +511,66 @@ jobs:
             find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
           fi
 
+      - name: Verify Windows Code Signature
+        if: matrix.platform == 'windows-latest'
+        shell: pwsh
+        run: |
+          Write-Host "Verifying Windows code signatures..."
+
+          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
+          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
+
+          $allSigned = $true
+          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
+          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
+
+          # Check EXE signature
+          if (Test-Path $exePath) {
+            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
+            Write-Host "EXE Signature Status: $($exeSig.Status)"
+            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
+            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
+
+            if ($exeSig.Status -ne "Valid") {
+              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] EXE is properly signed"
+            }
+          }
+
+          # Check MSI signature
+          if (Test-Path $msiPath) {
+            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI Signature Status: $($msiSig.Status)"
+            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
+            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+
+            if ($msiSig.Status -ne "Valid") {
+              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] MSI is properly signed"
+            }
+          }
+
+          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
+            Write-Host "[ERROR] Code signing verification failed"
+            exit 1
+          } else {
+            Write-Host "[SUCCESS] Code signature verification completed"
+          }
+
       - name: Upload artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:

README.md

@@ -115,46 +115,46 @@ Stirling-PDF currently supports 40 languages!
 
 | Language                                     | Progress                               |
 | -------------------------------------------- | -------------------------------------- |
-| Arabic (العربية) (ar_AR)                        | ![64%](https://geps.dev/progress/64)   |
-| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![24%](https://geps.dev/progress/24)   |
-| Basque (Euskara) (eu_ES)                     | ![14%](https://geps.dev/progress/14)   |
-| Bulgarian (Български) (bg_BG)                | ![26%](https://geps.dev/progress/26)   |
-| Catalan (Català) (ca_CA)                     | ![26%](https://geps.dev/progress/26)   |
-| Croatian (Hrvatski) (hr_HR)                  | ![24%](https://geps.dev/progress/24)   |
-| Czech (Česky) (cs_CZ)                        | ![26%](https://geps.dev/progress/26)   |
-| Danish (Dansk) (da_DK)                       | ![23%](https://geps.dev/progress/23)   |
-| Dutch (Nederlands) (nl_NL)                   | ![23%](https://geps.dev/progress/23)   |
+| Arabic (العربية) (ar_AR)                        | ![94%](https://geps.dev/progress/94)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![93%](https://geps.dev/progress/93)   |
+| Basque (Euskara) (eu_ES)                     | ![93%](https://geps.dev/progress/93)   |
+| Bulgarian (Български) (bg_BG)                | ![94%](https://geps.dev/progress/94)   |
+| Catalan (Català) (ca_CA)                     | ![93%](https://geps.dev/progress/93)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![93%](https://geps.dev/progress/93)   |
+| Czech (Česky) (cs_CZ)                        | ![91%](https://geps.dev/progress/91)   |
+| Danish (Dansk) (da_DK)                       | ![92%](https://geps.dev/progress/92)   |
+| Dutch (Nederlands) (nl_NL)                   | ![93%](https://geps.dev/progress/93)   |
 | English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
 | English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
-| French (Français) (fr_FR)                    | ![63%](https://geps.dev/progress/63)   |
-| German (Deutsch) (de_DE)                     | ![64%](https://geps.dev/progress/64)   |
-| Greek (Ελληνικά) (el_GR)                     | ![26%](https://geps.dev/progress/26)   |
-| Hindi (हिंदी) (hi_IN)                          | ![26%](https://geps.dev/progress/26)   |
-| Hungarian (Magyar) (hu_HU)                   | ![29%](https://geps.dev/progress/29)   |
-| Indonesian (Bahasa Indonesia) (id_ID)        | ![24%](https://geps.dev/progress/24)   |
-| Irish (Gaeilge) (ga_IE)                      | ![26%](https://geps.dev/progress/26)   |
-| Italian (Italiano) (it_IT)                   | ![64%](https://geps.dev/progress/64)   |
-| Japanese (日本語) (ja_JP)                    | ![47%](https://geps.dev/progress/47)   |
-| Korean (한국어) (ko_KR)                      | ![26%](https://geps.dev/progress/26)   |
-| Norwegian (Norsk) (no_NB)                    | ![24%](https://geps.dev/progress/24)   |
-| Persian (فارسی) (fa_IR)                      | ![26%](https://geps.dev/progress/26)   |
-| Polish (Polski) (pl_PL)                      | ![27%](https://geps.dev/progress/27)   |
-| Portuguese (Português) (pt_PT)               | ![26%](https://geps.dev/progress/26)   |
-| Portuguese Brazilian (Português) (pt_BR)     | ![64%](https://geps.dev/progress/64)   |
-| Romanian (Română) (ro_RO)                    | ![22%](https://geps.dev/progress/22)   |
-| Russian (Русский) (ru_RU)                    | ![63%](https://geps.dev/progress/63)   |
-| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![28%](https://geps.dev/progress/28)   |
-| Simplified Chinese (简体中文) (zh_CN)         | ![65%](https://geps.dev/progress/65)   |
-| Slovakian (Slovensky) (sk_SK)                | ![19%](https://geps.dev/progress/19)   |
-| Slovenian (Slovenščina) (sl_SI)              | ![27%](https://geps.dev/progress/27)   |
-| Spanish (Español) (es_ES)                    | ![64%](https://geps.dev/progress/64)   |
-| Swedish (Svenska) (sv_SE)                    | ![25%](https://geps.dev/progress/25)   |
-| Thai (ไทย) (th_TH)                           | ![23%](https://geps.dev/progress/23)   |
+| French (Français) (fr_FR)                    | ![93%](https://geps.dev/progress/93)   |
+| German (Deutsch) (de_DE)                     | ![93%](https://geps.dev/progress/93)   |
+| Greek (Ελληνικά) (el_GR)                     | ![93%](https://geps.dev/progress/93)   |
+| Hindi (हिंदी) (hi_IN)                          | ![94%](https://geps.dev/progress/94)   |
+| Hungarian (Magyar) (hu_HU)                   | ![94%](https://geps.dev/progress/94)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![93%](https://geps.dev/progress/93)   |
+| Irish (Gaeilge) (ga_IE)                      | ![94%](https://geps.dev/progress/94)   |
+| Italian (Italiano) (it_IT)                   | ![93%](https://geps.dev/progress/93)   |
+| Japanese (日本語) (ja_JP)                    | ![94%](https://geps.dev/progress/94)   |
+| Korean (한국어) (ko_KR)                      | ![94%](https://geps.dev/progress/94)   |
+| Norwegian (Norsk) (no_NB)                    | ![93%](https://geps.dev/progress/93)   |
+| Persian (فارسی) (fa_IR)                      | ![94%](https://geps.dev/progress/94)   |
+| Polish (Polski) (pl_PL)                      | ![93%](https://geps.dev/progress/93)   |
+| Portuguese (Português) (pt_PT)               | ![93%](https://geps.dev/progress/93)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![93%](https://geps.dev/progress/93)   |
+| Romanian (Română) (ro_RO)                    | ![93%](https://geps.dev/progress/93)   |
+| Russian (Русский) (ru_RU)                    | ![94%](https://geps.dev/progress/94)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![93%](https://geps.dev/progress/93)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![94%](https://geps.dev/progress/94)   |
+| Slovakian (Slovensky) (sk_SK)                | ![93%](https://geps.dev/progress/93)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![94%](https://geps.dev/progress/94)   |
+| Spanish (Español) (es_ES)                    | ![94%](https://geps.dev/progress/94)   |
+| Swedish (Svenska) (sv_SE)                    | ![93%](https://geps.dev/progress/93)   |
+| Thai (ไทย) (th_TH)                           | ![93%](https://geps.dev/progress/93)   |
 | Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
-| Traditional Chinese (繁體中文) (zh_TW)        | ![29%](https://geps.dev/progress/29)   |
-| Turkish (Türkçe) (tr_TR)                     | ![28%](https://geps.dev/progress/28)   |
-| Ukrainian (Українська) (uk_UA)               | ![28%](https://geps.dev/progress/28)   |
-| Vietnamese (Tiếng Việt) (vi_VN)              | ![21%](https://geps.dev/progress/21)   |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![94%](https://geps.dev/progress/94)   |
+| Turkish (Türkçe) (tr_TR)                     | ![94%](https://geps.dev/progress/94)   |
+| Ukrainian (Українська) (uk_UA)               | ![94%](https://geps.dev/progress/94)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![93%](https://geps.dev/progress/93)   |
 | Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
 
 ## Stirling PDF Enterprise

WINDOWS_SIGNING.md

@@ -0,0 +1,258 @@
+# Windows Code Signing Setup Guide
+
+This guide explains how to set up Windows code signing for Stirling-PDF desktop application builds.
+
+## Overview
+
+Windows code signing is essential for:
+- Preventing Windows SmartScreen warnings
+- Building trust with users
+- Enabling Microsoft Store distribution
+- Professional application distribution
+
+## Certificate Types
+
+### OV Certificate (Organization Validated)
+- More affordable option
+- Requires business verification
+- May trigger SmartScreen warnings initially until reputation builds
+- Suitable for most independent software vendors
+
+### EV Certificate (Extended Validation)
+- Premium option with immediate SmartScreen reputation
+- Requires hardware security module (HSM) or cloud-based signing
+- Higher cost but provides immediate trust
+- Required since June 2023 for new certificates
+
+## Obtaining a Certificate
+
+### Certificate Authorities
+Popular certificate authorities for Windows code signing:
+- DigiCert
+- Sectigo (formerly Comodo)
+- GlobalSign
+- SSL.com
+
+### Certificate Format
+You'll receive a certificate in one of these formats:
+- `.pfx` or `.p12` (preferred - contains both certificate and private key)
+- `.cer` + private key (needs conversion to .pfx)
+
+### Converting to PFX (if needed)
+If you have separate certificate and private key files:
+
+```bash
+openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cer
+```
+
+## Setting Up GitHub Secrets
+
+### Required Secrets
+
+Navigate to your GitHub repository → Settings → Secrets and variables → Actions
+
+Add the following secrets:
+
+#### 1. `WINDOWS_CERTIFICATE`
+- **Description**: Base64-encoded .pfx certificate file
+- **How to create**:
+
+**On macOS/Linux:**
+```bash
+base64 -i certificate.pfx | pbcopy  # Copies to clipboard
+```
+
+**On Windows (PowerShell):**
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
+```
+
+Paste the entire base64 string into the GitHub secret.
+
+#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
+- **Description**: Password for the .pfx certificate
+- **Value**: The password you set when creating/exporting the .pfx file
+
+### Optional Secrets for Tauri Updater
+
+If you're using Tauri's built-in updater feature:
+
+#### `TAURI_SIGNING_PRIVATE_KEY`
+- Generated using Tauri CLI: `npm run tauri signer generate`
+- Used for update package verification
+
+#### `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
+- Password for the Tauri signing key
+
+## Configuration Files
+
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
+
+The Windows signing configuration is already set up:
+
+```json
+"windows": {
+  "certificateThumbprint": null,
+  "digestAlgorithm": "sha256",
+  "timestampUrl": "http://timestamp.digicert.com"
+}
+```
+
+**Configuration Options:**
+- `certificateThumbprint`: Automatically extracted from imported certificate (leave as `null`)
+- `digestAlgorithm`: Hashing algorithm - `sha256` is recommended
+- `timestampUrl`: Timestamp server to prove signing time (survives certificate expiration)
+
+**Alternative Timestamp Servers:**
+- DigiCert: `http://timestamp.digicert.com`
+- Sectigo: `http://timestamp.sectigo.com`
+- GlobalSign: `http://timestamp.globalsign.com`
+
+### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
+
+The workflow includes three Windows signing steps:
+
+1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
+2. **Build Tauri App**: Builds and signs the application using the imported certificate
+3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
+
+## Testing the Setup
+
+### 1. Local Testing (Windows Only)
+
+Before pushing to GitHub, test locally:
+
+```powershell
+# Set environment variables
+$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
+$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
+
+# Build the application
+cd frontend
+npm run tauri build
+
+# Verify the signature
+Get-AuthenticodeSignature "./src-tauri/target/release/bundle/msi/Stirling-PDF_*.msi"
+```
+
+### 2. GitHub Actions Testing
+
+1. Push your changes to a branch
+2. Manually trigger the workflow:
+   - Go to Actions → Build Tauri Applications
+   - Click "Run workflow"
+   - Select "windows" platform
+3. Check the build logs for:
+   - ✅ Certificate import success
+   - ✅ Build completion
+   - ✅ Signature verification
+
+### 3. Verifying Signed Binaries
+
+After downloading the built artifacts:
+
+**Windows (PowerShell):**
+```powershell
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.exe"
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.msi"
+```
+
+Look for:
+- Status: `Valid`
+- Signer: Your organization name
+- Timestamp: Recent date/time
+
+**Windows (GUI):**
+1. Right-click the .exe or .msi file
+2. Select "Properties"
+3. Go to "Digital Signatures" tab
+4. Verify signature details
+
+## Troubleshooting
+
+### "HashMismatch" Status
+- Certificate doesn't match the binary
+- Possible file corruption during download
+- Re-download and verify
+
+### "NotSigned" Status
+- Certificate wasn't imported correctly
+- Check GitHub secrets are set correctly
+- Verify base64 encoding is complete (no truncation)
+
+### "UnknownError" Status
+- Timestamp server unreachable
+- Try alternative timestamp URL in tauri.conf.json
+- Check network connectivity in GitHub Actions
+
+### SmartScreen Still Shows Warnings
+- Normal for OV certificates initially
+- Reputation builds over time with user downloads
+- Consider EV certificate for immediate reputation
+
+### Certificate Not Found During Build
+- Verify `WINDOWS_CERTIFICATE` secret is set
+- Check base64 encoding is correct (no extra whitespace)
+- Ensure password is correct
+
+## Security Best Practices
+
+1. **Never commit certificates to version control**
+   - Keep .pfx files secure and backed up
+   - Use GitHub secrets for CI/CD
+
+2. **Rotate certificates before expiration**
+   - Set calendar reminders
+   - Update GitHub secrets with new certificate
+
+3. **Use strong passwords**
+   - Certificate password should be complex
+   - Store securely (password manager)
+
+4. **Monitor certificate usage**
+   - Review GitHub Actions logs
+   - Set up notifications for failed builds
+
+5. **Limit access to secrets**
+   - Only repository admins should access secrets
+   - Audit secret access regularly
+
+## Certificate Lifecycle
+
+### Before Expiration
+1. Obtain new certificate from CA (typically annual renewal)
+2. Convert to .pfx format if needed
+3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
+4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
+5. Test build to verify new certificate works
+
+### Expired Certificates
+- Signed binaries remain valid (timestamp proves signing time)
+- New builds will fail until certificate is renewed
+- Users can still install previously signed versions
+
+## Cost Considerations
+
+### Certificate Costs (Annual, as of 2024)
+- **OV Certificate**: $100-400/year
+- **EV Certificate**: $400-1000/year
+
+### Choosing the Right Certificate
+- **Open source / early stage**: Start with OV
+- **Commercial / enterprise**: Consider EV for better trust
+- **Microsoft Store**: EV certificate required
+
+## Additional Resources
+
+- [Tauri Windows Signing Documentation](https://v2.tauri.app/distribute/sign/windows/)
+- [Microsoft Code Signing Overview](https://docs.microsoft.com/windows/win32/seccrypto/cryptography-tools)
+- [DigiCert Code Signing Guide](https://www.digicert.com/signing/code-signing-certificates)
+- [Windows SmartScreen FAQ](https://support.microsoft.com/windows/smartscreen-faq)
+
+## Support
+
+If you encounter issues with Windows code signing:
+1. Check GitHub Actions logs for detailed error messages
+2. Verify all secrets are set correctly
+3. Test certificate locally first (Windows environment required)
+4. Open an issue in the repository with relevant logs (remove sensitive data)

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -38,6 +38,7 @@ public class GeneralUtils {
             Set.of(
                     "OCR images.json",
                     "Prepare-pdfs-for-email.json",
+                    "Pre-publish-sanitization.json",
                     "split-rotate-auto-rename.json");
 
     private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";

app/core/src/main/java/stirling/software/SPDF/SPDFApplication.java

@@ -12,6 +12,8 @@ import java.util.Properties;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
 
@@ -198,6 +200,14 @@ public class SPDFApplication {
         // }
     }
 
+    @EventListener
+    public void onWebServerInitialized(WebServerInitializedEvent event) {
+        int actualPort = event.getWebServer().getPort();
+        serverPortStatic = String.valueOf(actualPort);
+        // Log the actual runtime port for Tauri to parse
+        log.info("Stirling-PDF running on port: {}", actualPort);
+    }
+
     private static void printStartupLogs() {
         log.info("Stirling-PDF Started.");
         String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;

app/core/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -18,11 +18,37 @@ import stirling.software.common.model.ApplicationProperties;
 @Slf4j
 public class EndpointConfiguration {
 
+    public enum DisableReason {
+        CONFIG,
+        DEPENDENCY,
+        UNKNOWN
+    }
+
+    public static class EndpointAvailability {
+        private final boolean enabled;
+        private final DisableReason reason;
+
+        public EndpointAvailability(boolean enabled, DisableReason reason) {
+            this.enabled = enabled;
+            this.reason = reason;
+        }
+
+        public boolean isEnabled() {
+            return enabled;
+        }
+
+        public DisableReason getReason() {
+            return reason;
+        }
+    }
+
     private static final String REMOVE_BLANKS = "remove-blanks";
     private final ApplicationProperties applicationProperties;
     @Getter private Map<String, Boolean> endpointStatuses = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointGroups = new ConcurrentHashMap<>();
     private Set<String> disabledGroups = new HashSet<>();
+    private Map<String, DisableReason> endpointDisableReasons = new ConcurrentHashMap<>();
+    private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
 
@@ -35,16 +61,31 @@ public class EndpointConfiguration {
         processEnvironmentConfigs();
     }
 
+    private String normalizeEndpoint(String endpoint) {
+        if (endpoint == null) {
+            return null;
+        }
+        return endpoint.startsWith("/") ? endpoint.substring(1) : endpoint;
+    }
+
     public void enableEndpoint(String endpoint) {
-        endpointStatuses.put(endpoint, true);
-        log.debug("Enabled endpoint: {}", endpoint);
+        String normalized = normalizeEndpoint(endpoint);
+        endpointStatuses.put(normalized, true);
+        endpointDisableReasons.remove(normalized);
+        log.debug("Enabled endpoint: {}", normalized);
     }
 
     public void disableEndpoint(String endpoint) {
-        if (!Boolean.FALSE.equals(endpointStatuses.get(endpoint))) {
-            log.debug("Disabling endpoint: {}", endpoint);
+        disableEndpoint(endpoint, DisableReason.CONFIG);
+    }
+
+    public void disableEndpoint(String endpoint, DisableReason reason) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (!Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            log.debug("Disabling endpoint: {}", normalized);
         }
-        endpointStatuses.put(endpoint, false);
+        endpointStatuses.put(normalized, false);
+        endpointDisableReasons.put(normalized, reason);
     }
 
     public boolean isEndpointEnabled(String endpoint) {
@@ -150,6 +191,10 @@ public class EndpointConfiguration {
     }
 
     public void disableGroup(String group) {
+        disableGroup(group, DisableReason.CONFIG);
+    }
+
+    public void disableGroup(String group, DisableReason reason) {
         if (disabledGroups.add(group)) {
             if (isToolGroup(group)) {
                 log.debug(
@@ -161,11 +206,12 @@ public class EndpointConfiguration {
                         group);
             }
         }
+        groupDisableReasons.put(group, reason);
         // Only cascade to endpoints for *functional* groups
         if (!isToolGroup(group)) {
             Set<String> endpoints = endpointGroups.get(group);
             if (endpoints != null) {
-                endpoints.forEach(this::disableEndpoint);
+                endpoints.forEach(endpoint -> disableEndpoint(endpoint, reason));
             }
         }
     }
@@ -174,12 +220,39 @@ public class EndpointConfiguration {
         if (disabledGroups.remove(group)) {
             log.debug("Enabling group: {}", group);
         }
+        groupDisableReasons.remove(group);
         Set<String> endpoints = endpointGroups.get(group);
         if (endpoints != null) {
             endpoints.forEach(this::enableEndpoint);
         }
     }
 
+    public EndpointAvailability getEndpointAvailability(String endpoint) {
+        boolean enabled = isEndpointEnabled(endpoint);
+        DisableReason reason = enabled ? null : determineDisableReason(endpoint);
+        return new EndpointAvailability(enabled, reason);
+    }
+
+    private DisableReason determineDisableReason(String endpoint) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            return endpointDisableReasons.getOrDefault(normalized, DisableReason.CONFIG);
+        }
+
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            Set<String> endpoints = entry.getValue();
+            if (!disabledGroups.contains(group) || endpoints == null) {
+                continue;
+            }
+            if (endpoints.contains(normalized)) {
+                return groupDisableReasons.getOrDefault(group, DisableReason.CONFIG);
+            }
+        }
+
+        return DisableReason.UNKNOWN;
+    }
+
     public Set<String> getDisabledGroups() {
         return new HashSet<>(disabledGroups);
     }
@@ -261,6 +334,8 @@ public class EndpointConfiguration {
         addEndpointToGroup("Convert", "pdf-to-csv");
         addEndpointToGroup("Convert", "pdf-to-markdown");
         addEndpointToGroup("Convert", "eml-to-pdf");
+        addEndpointToGroup("Convert", "cbz-to-pdf");
+        addEndpointToGroup("Convert", "pdf-to-cbz");
 
         // Adding endpoints to "Security" group
         addEndpointToGroup("Security", "add-password");
@@ -394,6 +469,8 @@ public class EndpointConfiguration {
         addEndpointToGroup("Java", "pdf-to-markdown");
         addEndpointToGroup("Java", "add-attachments");
         addEndpointToGroup("Java", "compress-pdf");
+        addEndpointToGroup("Java", "cbz-to-pdf");
+        addEndpointToGroup("Java", "pdf-to-cbz");
         addEndpointToGroup("rar", "pdf-to-cbr");
 
         // Javascript

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -12,6 +12,7 @@ import jakarta.annotation.PostConstruct;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.EndpointConfiguration.DisableReason;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.RegexPatternUtils;
 
@@ -97,7 +98,7 @@ public class ExternalAppDepConfig {
             if (affectedGroups != null) {
                 for (String group : affectedGroups) {
                     List<String> affectedFeatures = getAffectedFeatures(group);
-                    endpointConfiguration.disableGroup(group);
+                    endpointConfiguration.disableGroup(group, DisableReason.DEPENDENCY);
                     log.warn(
                             "Missing dependency: {} - Disabling group: {} (Affected features: {})",
                             command,
@@ -127,8 +128,8 @@ public class ExternalAppDepConfig {
         if (!pythonAvailable) {
             List<String> pythonFeatures = getAffectedFeatures("Python");
             List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-            endpointConfiguration.disableGroup("Python");
-            endpointConfiguration.disableGroup("OpenCV");
+            endpointConfiguration.disableGroup("Python", DisableReason.DEPENDENCY);
+            endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
             log.warn(
                     "Missing dependency: Python - Disabling Python features: {} and OpenCV features: {}",
                     String.join(", ", pythonFeatures),
@@ -146,14 +147,14 @@ public class ExternalAppDepConfig {
                 int exitCode = process.waitFor();
                 if (exitCode != 0) {
                     List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                    endpointConfiguration.disableGroup("OpenCV");
+                    endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                     log.warn(
                             "OpenCV not available in Python - Disabling OpenCV features: {}",
                             String.join(", ", openCVFeatures));
                 }
             } catch (Exception e) {
                 List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                endpointConfiguration.disableGroup("OpenCV");
+                endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                 log.warn(
                         "Error checking OpenCV: {} - Disabling OpenCV features: {}",
                         e.getMessage(),

app/core/src/main/java/stirling/software/SPDF/config/WAUTrackingFilter.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.config;
+
+import java.io.IOException;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
+
+/**
+ * Filter to track browser IDs for Weekly Active Users (WAU) counting. Only active when security is
+ * disabled (no-login mode).
+ */
+@Component
+@ConditionalOnProperty(name = "security.enableLogin", havingValue = "false")
+@RequiredArgsConstructor
+@Slf4j
+public class WAUTrackingFilter implements Filter {
+
+    private final WeeklyActiveUsersService wauService;
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        if (request instanceof HttpServletRequest httpRequest) {
+            // Extract browser ID from header
+            String browserId = httpRequest.getHeader("X-Browser-Id");
+
+            if (browserId != null && !browserId.trim().isEmpty()) {
+                // Record browser access
+                wauService.recordBrowserAccess(browserId);
+            }
+        }
+
+        // Continue the filter chain
+        chain.doFilter(request, response);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -46,8 +46,24 @@ public class WebMvcConfig implements WebMvcConfigurer {
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")
-                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
-                    .allowedHeaders("*")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
                     .allowCredentials(true)
                     .maxAge(3600);
         } else if (hasConfiguredOrigins) {
@@ -63,13 +79,53 @@ public class WebMvcConfig implements WebMvcConfigurer {
                             .toArray(new String[0]);
 
             registry.addMapping("/**")
-                    .allowedOrigins(allowedOrigins)
-                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
-                    .allowedHeaders("*")
+                    .allowedOriginPatterns(allowedOrigins)
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
+                    .allowCredentials(true)
+                    .maxAge(3600);
+        } else {
+            // Default to allowing all origins when nothing is configured
+            logger.info(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
+            registry.addMapping("/**")
+                    .allowedOriginPatterns("*")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
                     .allowCredentials(true)
                     .maxAge(3600);
         }
-        // If no origins are configured and not in Tauri mode, CORS is not enabled (secure by
-        // default)
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTableOfContentsController.java

@@ -29,7 +29,6 @@ import lombok.RequiredArgsConstructor;
 import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.SPDF.config.swagger.JsonDataResponse;
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.EditTableOfContentsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
@@ -49,13 +48,12 @@ public class EditTableOfContentsController {
     @AutoJobPostMapping(
             value = "/extract-bookmarks",
             consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
-    @JsonDataResponse
     @Operation(
             summary = "Extract PDF Bookmarks",
             description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
     @ResponseBody
-    public List<Map<String, Object>> extractBookmarks(@RequestParam("file") MultipartFile file)
-            throws Exception {
+    public ResponseEntity<List<Map<String, Object>>> extractBookmarks(
+            @RequestParam("file") MultipartFile file) throws Exception {
         PDDocument document = null;
         try {
             document = pdfDocumentFactory.load(file);
@@ -63,10 +61,10 @@ public class EditTableOfContentsController {
 
             if (outline == null) {
                 log.info("No outline/bookmarks found in PDF");
-                return new ArrayList<>();
+                return ResponseEntity.ok(new ArrayList<>());
             }
 
-            return extractBookmarkItems(document, outline);
+            return ResponseEntity.ok(extractBookmarkItems(document, outline));
         } finally {
             if (document != null) {
                 document.close();

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -1,6 +1,7 @@
 package stirling.software.SPDF.controller.api.misc;
 
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 import org.springframework.context.ApplicationContext;
@@ -10,9 +11,13 @@ import org.springframework.web.bind.annotation.RequestParam;
 
 import io.swagger.v3.oas.annotations.Hidden;
 
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointConfiguration;
+import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
 import stirling.software.SPDF.config.InitialSetup;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
@@ -154,6 +159,25 @@ public class ConfigController {
                 // EE features not available, continue without them
             }
 
+            // Add version and machine info for update checking
+            try {
+                if (applicationContext.containsBean("appVersion")) {
+                    configData.put(
+                            "appVersion", applicationContext.getBean("appVersion", String.class));
+                }
+                if (applicationContext.containsBean("machineType")) {
+                    configData.put(
+                            "machineType", applicationContext.getBean("machineType", String.class));
+                }
+                if (applicationContext.containsBean("activeSecurity")) {
+                    configData.put(
+                            "activeSecurity",
+                            applicationContext.getBean("activeSecurity", Boolean.class));
+                }
+            } catch (Exception e) {
+                // Version/machine info not available
+            }
+
             return ResponseEntity.ok(configData);
 
         } catch (Exception e) {
@@ -181,4 +205,19 @@ public class ConfigController {
         }
         return ResponseEntity.ok(result);
     }
+
+    @GetMapping("/endpoints-availability")
+    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
+            @RequestParam(name = "endpoints")
+                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
+                    List<@NotBlank String> endpoints) {
+        Map<String, EndpointAvailability> result = new HashMap<>();
+        for (String endpoint : endpoints) {
+            String trimmedEndpoint = endpoint.trim();
+            result.put(
+                    trimmedEndpoint,
+                    endpointConfiguration.getEndpointAvailability(trimmedEndpoint));
+        }
+        return ResponseEntity.ok(result);
+    }
 }

app/core/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java

@@ -23,6 +23,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointInspector;
 import stirling.software.SPDF.config.StartupApplicationListener;
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
 import stirling.software.common.annotations.api.InfoApi;
 import stirling.software.common.model.ApplicationProperties;
 
@@ -34,6 +35,7 @@ public class MetricsController {
     private final ApplicationProperties applicationProperties;
     private final MeterRegistry meterRegistry;
     private final EndpointInspector endpointInspector;
+    private final Optional<WeeklyActiveUsersService> wauService;
     private boolean metricsEnabled;
 
     @PostConstruct
@@ -352,6 +354,36 @@ public class MetricsController {
         return ResponseEntity.ok(formatDuration(uptime));
     }
 
+    @GetMapping("/wau")
+    @Operation(
+            summary = "Weekly Active Users statistics",
+            description =
+                    "Returns WAU (Weekly Active Users) count and total unique browsers. "
+                            + "Only available when security is disabled (no-login mode). "
+                            + "Tracks unique browsers via client-generated UUID in localStorage.")
+    public ResponseEntity<?> getWeeklyActiveUsers() {
+        if (!metricsEnabled) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("This endpoint is disabled.");
+        }
+
+        // Check if WAU service is available (only when security.enableLogin=false)
+        if (wauService.isEmpty()) {
+            return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                    .body(
+                            "WAU tracking is only available when security is disabled (no-login mode)");
+        }
+
+        WeeklyActiveUsersService service = wauService.get();
+
+        Map<String, Object> wauStats = new HashMap<>();
+        wauStats.put("weeklyActiveUsers", service.getWeeklyActiveUsers());
+        wauStats.put("totalUniqueBrowsers", service.getTotalUniqueBrowsers());
+        wauStats.put("daysOnline", service.getDaysOnline());
+        wauStats.put("trackingSince", service.getStartTime().toString());
+
+        return ResponseEntity.ok(wauStats);
+    }
+
     private String formatDuration(Duration duration) {
         long days = duration.toDays();
         long hours = duration.toHoursPart();

app/core/src/main/java/stirling/software/SPDF/service/WeeklyActiveUsersService.java

@@ -0,0 +1,101 @@
+package stirling.software.SPDF.service;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Service for tracking Weekly Active Users (WAU) in no-login mode. Uses in-memory storage with
+ * automatic cleanup of old entries.
+ */
+@Service
+@Slf4j
+public class WeeklyActiveUsersService {
+
+    // Map of browser ID -> last seen timestamp
+    private final Map<String, Instant> activeBrowsers = new ConcurrentHashMap<>();
+
+    // Track total unique browsers seen (overall)
+    private long totalUniqueBrowsers = 0;
+
+    // Application start time
+    private final Instant startTime = Instant.now();
+
+    /**
+     * Records a browser access with the current timestamp
+     *
+     * @param browserId Unique browser identifier from X-Browser-Id header
+     */
+    public void recordBrowserAccess(String browserId) {
+        if (browserId == null || browserId.trim().isEmpty()) {
+            return;
+        }
+
+        boolean isNewBrowser = !activeBrowsers.containsKey(browserId);
+        activeBrowsers.put(browserId, Instant.now());
+
+        if (isNewBrowser) {
+            totalUniqueBrowsers++;
+            log.debug("New browser recorded: {} (Total: {})", browserId, totalUniqueBrowsers);
+        }
+    }
+
+    /**
+     * Gets the count of unique browsers seen in the last 7 days
+     *
+     * @return Weekly Active Users count
+     */
+    public long getWeeklyActiveUsers() {
+        cleanupOldEntries();
+        return activeBrowsers.size();
+    }
+
+    /**
+     * Gets the total count of unique browsers ever seen
+     *
+     * @return Total unique browsers count
+     */
+    public long getTotalUniqueBrowsers() {
+        return totalUniqueBrowsers;
+    }
+
+    /**
+     * Gets the number of days the service has been running
+     *
+     * @return Days online
+     */
+    public long getDaysOnline() {
+        return ChronoUnit.DAYS.between(startTime, Instant.now());
+    }
+
+    /**
+     * Gets the timestamp when tracking started
+     *
+     * @return Start time
+     */
+    public Instant getStartTime() {
+        return startTime;
+    }
+
+    /** Removes entries older than 7 days */
+    private void cleanupOldEntries() {
+        Instant sevenDaysAgo = Instant.now().minus(7, ChronoUnit.DAYS);
+        activeBrowsers.entrySet().removeIf(entry -> entry.getValue().isBefore(sevenDaysAgo));
+    }
+
+    /** Manual cleanup trigger (can be called by scheduled task if needed) */
+    public void performCleanup() {
+        int sizeBefore = activeBrowsers.size();
+        cleanupOldEntries();
+        int sizeAfter = activeBrowsers.size();
+
+        if (sizeBefore != sizeAfter) {
+            log.debug("Cleaned up {} old browser entries", sizeBefore - sizeAfter);
+        }
+    }
+}

app/core/src/main/resources/static/pipeline/defaultWebUIConfigs/Pre-publish-sanitization.json

@@ -0,0 +1,54 @@
+{
+  "name": "Pre-publish-sanitization",
+  "pipeline": [
+    {
+      "operation": "/api/v1/security/sanitize-pdf",
+      "parameters": {
+        "removeJavaScript": true,
+        "removeEmbeddedFiles": true,
+        "removeXMPMetadata": true,
+        "removeMetadata": true,
+        "removeLinks": true,
+        "removeFonts": false
+      }
+    },
+    {
+      "operation": "/api/v1/misc/flatten",
+      "parameters": {
+        "flattenOnlyForms": true
+      }
+    },
+    {
+      "operation": "/api/v1/general/remove-annotations",
+      "parameters": {}
+    },
+    {
+      "operation": "/api/v1/misc/update-metadata",
+      "parameters": {
+        "deleteAll": true,
+        "author": "",
+        "creationDate": "",
+        "creator": "",
+        "keywords": "",
+        "modificationDate": "",
+        "producer": "",
+        "subject": "",
+        "title": "",
+        "trapped": ""
+      }
+    },
+    {
+      "operation": "/api/v1/misc/compress-pdf",
+      "parameters": {
+        "optimizeLevel": 3,
+        "expectedOutputSize": ""
+      }
+    }
+  ],
+  "_examples": {
+    "outputDir": "{outputFolder}/{folderName}",
+    "outputFileName": "{filename}-{pipelineName}-{date}-{time}"
+  },
+  "outputDir": "{outputFolder}",
+  "outputFileName": "pre_publish_{filename}.PDF"
+}

app/core/src/test/java/stirling/software/SPDF/controller/api/EditTableOfContentsControllerTest.java

@@ -24,6 +24,7 @@ import org.mockito.ArgumentMatchers;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.mock.web.MockMultipartFile;
@@ -86,9 +87,13 @@ class EditTableOfContentsControllerTest {
         when(mockOutlineItem.getNextSibling()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertEquals(1, result.size());
 
@@ -108,9 +113,13 @@ class EditTableOfContentsControllerTest {
         when(mockCatalog.getDocumentOutline()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertTrue(result.isEmpty());
         verify(mockDocument).close();
@@ -142,9 +151,13 @@ class EditTableOfContentsControllerTest {
         when(childItem.getNextSibling()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertEquals(1, result.size());
 
@@ -178,9 +191,13 @@ class EditTableOfContentsControllerTest {
         when(mockOutlineItem.getNextSibling()).thenReturn(null);
 
         // When
-        List<Map<String, Object>> result = editTableOfContentsController.extractBookmarks(mockFile);
+        ResponseEntity<List<Map<String, Object>>> response =
+                editTableOfContentsController.extractBookmarks(mockFile);
 
         // Then
+        assertNotNull(response);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        List<Map<String, Object>> result = response.getBody();
         assertNotNull(result);
         assertEquals(1, result.size());
 

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/ee/LicenseKeyChecker.java

@@ -113,7 +113,12 @@ public class LicenseKeyChecker {
 
     public void updateLicenseKey(String newKey) throws IOException {
         applicationProperties.getPremium().setKey(newKey);
-        GeneralUtils.saveKeyToSettings("EnterpriseEdition.key", newKey);
+        GeneralUtils.saveKeyToSettings("premium.key", newKey);
+        evaluateLicense();
+        synchronizeLicenseSettings();
+    }
+
+    public void resyncLicense() {
         evaluateLicense();
         synchronizeLicenseSettings();
     }

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminLicenseController.java

@@ -0,0 +1,245 @@
+package stirling.software.proprietary.security.controller.api;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.GeneralUtils;
+import stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier;
+import stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier.License;
+import stirling.software.proprietary.security.configuration.ee.LicenseKeyChecker;
+
+/**
+ * Admin controller for license management. Provides installation ID for Stripe checkout metadata
+ * and endpoints for managing license keys.
+ */
+@RestController
+@Slf4j
+@RequestMapping("/api/v1/admin")
+@PreAuthorize("hasRole('ROLE_ADMIN')")
+@Tag(name = "Admin License Management", description = "Admin-only License Management APIs")
+public class AdminLicenseController {
+
+    @Autowired(required = false)
+    private LicenseKeyChecker licenseKeyChecker;
+
+    @Autowired(required = false)
+    private KeygenLicenseVerifier keygenLicenseVerifier;
+
+    @Autowired private ApplicationProperties applicationProperties;
+
+    /**
+     * Get the installation ID (machine fingerprint) for this self-hosted instance. This ID is used
+     * as metadata in Stripe checkout to link licenses to specific installations.
+     *
+     * @return Map containing the installation ID
+     */
+    @GetMapping("/installation-id")
+    @Operation(
+            summary = "Get installation ID",
+            description =
+                    "Returns the unique installation ID (MAC-based fingerprint) for this"
+                            + " self-hosted instance")
+    public ResponseEntity<Map<String, String>> getInstallationId() {
+        try {
+            String installationId = GeneralUtils.generateMachineFingerprint();
+            log.info("Admin requested installation ID: {}", installationId);
+            return ResponseEntity.ok(Map.of("installationId", installationId));
+        } catch (Exception e) {
+            log.error("Failed to generate installation ID", e);
+            return ResponseEntity.internalServerError()
+                    .body(Map.of("error", "Failed to generate installation ID"));
+        }
+    }
+
+    /**
+     * Save and activate a license key. This endpoint accepts a license key from the frontend (e.g.,
+     * after Stripe checkout) and activates it on the backend.
+     *
+     * @param request Map containing the license key
+     * @return Response with success status, license type, and whether restart is required
+     */
+    @PostMapping("/license-key")
+    @Operation(
+            summary = "Save and activate license key",
+            description =
+                    "Accepts a license key and activates it on the backend. Returns the activated"
+                            + " license type.")
+    public ResponseEntity<Map<String, Object>> saveLicenseKey(
+            @RequestBody Map<String, String> request) {
+        String licenseKey = request.get("licenseKey");
+
+        // Reject null but allow empty string to clear license
+        if (licenseKey == null) {
+            return ResponseEntity.badRequest()
+                    .body(Map.of("success", false, "error", "License key is required"));
+        }
+
+        try {
+            if (licenseKeyChecker == null) {
+                return ResponseEntity.internalServerError()
+                        .body(Map.of("success", false, "error", "License checker not available"));
+            }
+            // assume premium enabled when setting license key
+            applicationProperties.getPremium().setEnabled(true);
+
+            // Use existing LicenseKeyChecker to update and validate license
+            // Empty string will be evaluated as NORMAL license (free tier)
+            licenseKeyChecker.updateLicenseKey(licenseKey.trim());
+
+            // Get current license status
+            License license = licenseKeyChecker.getPremiumLicenseEnabledResult();
+
+            // Auto-enable premium features if license is valid
+            if (license != License.NORMAL) {
+                GeneralUtils.saveKeyToSettings("premium.enabled", true);
+                // Enable premium features
+
+                // Save maxUsers from license metadata
+                Integer maxUsers = applicationProperties.getPremium().getMaxUsers();
+                if (maxUsers != null) {
+                    GeneralUtils.saveKeyToSettings("premium.maxUsers", maxUsers);
+                }
+            } else {
+                GeneralUtils.saveKeyToSettings("premium.enabled", false);
+                log.info("License key is not valid for premium features: type={}", license.name());
+            }
+
+            Map<String, Object> response = new HashMap<>();
+            response.put("success", true);
+            response.put("licenseType", license.name());
+            response.put("enabled", applicationProperties.getPremium().isEnabled());
+            response.put("maxUsers", applicationProperties.getPremium().getMaxUsers());
+            response.put("requiresRestart", false); // Dynamic evaluation works
+            response.put("message", "License key saved and activated");
+
+            log.info("License key saved and activated: type={}", license.name());
+
+            return ResponseEntity.ok(response);
+        } catch (Exception e) {
+            log.error("Failed to save license key", e);
+            return ResponseEntity.badRequest()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Failed to activate license: " + e.getMessage()));
+        }
+    }
+
+    /**
+     * Resync the current license with Keygen. This endpoint re-validates the existing license key
+     * and updates the max users setting. Used after subscription upgrades to sync the new license
+     * limits.
+     *
+     * @return Response with updated license information
+     */
+    @PostMapping("/license/resync")
+    @Operation(
+            summary = "Resync license with Keygen",
+            description =
+                    "Re-validates the existing license key with Keygen and updates local settings."
+                            + " Used after subscription upgrades.")
+    public ResponseEntity<Map<String, Object>> resyncLicense() {
+        try {
+            if (licenseKeyChecker == null) {
+                return ResponseEntity.internalServerError()
+                        .body(Map.of("success", false, "error", "License checker not available"));
+            }
+
+            String currentKey = applicationProperties.getPremium().getKey();
+            if (currentKey == null || currentKey.trim().isEmpty()) {
+                return ResponseEntity.badRequest()
+                        .body(Map.of("success", false, "error", "No license key configured"));
+            }
+
+            log.info("Resyncing license with Keygen");
+
+            // Re-validate license and sync settings
+            licenseKeyChecker.resyncLicense();
+
+            // Get updated license status
+            License license = licenseKeyChecker.getPremiumLicenseEnabledResult();
+            ApplicationProperties.Premium premium = applicationProperties.getPremium();
+
+            Map<String, Object> response = new HashMap<>();
+            response.put("success", true);
+            response.put("licenseType", license.name());
+            response.put("enabled", premium.isEnabled());
+            response.put("maxUsers", premium.getMaxUsers());
+            response.put("message", "License resynced successfully");
+
+            log.info(
+                    "License resynced: type={}, maxUsers={}",
+                    license.name(),
+                    premium.getMaxUsers());
+
+            return ResponseEntity.ok(response);
+        } catch (Exception e) {
+            log.error("Failed to resync license", e);
+            return ResponseEntity.internalServerError()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Failed to resync license: " + e.getMessage()));
+        }
+    }
+
+    /**
+     * Get information about the current license key status, including license type, enabled status,
+     * and max users.
+     *
+     * @return Map containing license information
+     */
+    @GetMapping("/license-info")
+    @Operation(
+            summary = "Get license information",
+            description =
+                    "Returns information about the current license including type, enabled status,"
+                            + " and max users")
+    public ResponseEntity<Map<String, Object>> getLicenseInfo() {
+        try {
+            Map<String, Object> response = new HashMap<>();
+
+            if (licenseKeyChecker != null) {
+                License license = licenseKeyChecker.getPremiumLicenseEnabledResult();
+                response.put("licenseType", license.name());
+            } else {
+                response.put("licenseType", License.NORMAL.name());
+            }
+
+            ApplicationProperties.Premium premium = applicationProperties.getPremium();
+            response.put("enabled", premium.isEnabled());
+            response.put("maxUsers", premium.getMaxUsers());
+            response.put("hasKey", premium.getKey() != null && !premium.getKey().trim().isEmpty());
+
+            // Include license key for upgrades (admin-only endpoint)
+            if (premium.getKey() != null && !premium.getKey().trim().isEmpty()) {
+                response.put("licenseKey", premium.getKey());
+            }
+
+            return ResponseEntity.ok(response);
+        } catch (Exception e) {
+            log.error("Failed to get license info", e);
+            return ResponseEntity.internalServerError()
+                    .body(Map.of("error", "Failed to retrieve license information"));
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java

@@ -299,6 +299,16 @@ public class AdminSettingsController {
                                         + String.join(", ", VALID_SECTION_NAMES));
             }
 
+            // Auto-enable premium features if license key is provided
+            if ("premium".equalsIgnoreCase(sectionName) && sectionData.containsKey("key")) {
+                Object keyValue = sectionData.get("key");
+                if (keyValue != null && !keyValue.toString().trim().isEmpty()) {
+                    // Automatically set enabled to true when a key is provided
+                    sectionData.put("enabled", true);
+                    log.info("Auto-enabling premium features because license key was provided");
+                }
+            }
+
             int updatedCount = 0;
             for (Map.Entry<String, Object> entry : sectionData.entrySet()) {
                 String propertyKey = entry.getKey();

app/proprietary/src/main/java/stirling/software/proprietary/security/service/JwtService.java

@@ -39,7 +39,7 @@ import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrin
 public class JwtService implements JwtServiceInterface {
 
     private static final String ISSUER = "https://stirling.com";
-    private static final long EXPIRATION = 3600000;
+    private static final long EXPIRATION = 43200000;
 
     private final KeyPersistenceServiceInterface keyPersistenceService;
     private final boolean v2Enabled;

frontend/package-lock.json

@@ -39,10 +39,14 @@
         "@mui/icons-material": "^7.3.2",
         "@mui/material": "^7.3.2",
         "@reactour/tour": "^3.8.0",
+        "@stripe/react-stripe-js": "^4.0.2",
+        "@stripe/stripe-js": "^7.9.0",
+        "@supabase/supabase-js": "^2.47.13",
         "@tailwindcss/postcss": "^4.1.13",
         "@tanstack/react-virtual": "^3.13.12",
         "@tauri-apps/api": "^2.5.0",
         "@tauri-apps/plugin-fs": "^2.4.0",
+        "@tauri-apps/plugin-http": "^2.5.4",
         "autoprefixer": "^10.4.21",
         "axios": "^1.12.2",
         "globals": "^16.4.0",
@@ -3120,6 +3124,138 @@
         "url": "https://github.com/sindresorhus/is?sponsor=1"
       }
     },
+    "node_modules/@stripe/react-stripe-js": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@stripe/react-stripe-js/-/react-stripe-js-4.0.2.tgz",
+      "integrity": "sha512-l2wau+8/LOlHl+Sz8wQ1oDuLJvyw51nQCsu6/ljT6smqzTszcMHifjAJoXlnMfcou3+jK/kQyVe04u/ufyTXgg==",
+      "license": "MIT",
+      "dependencies": {
+        "prop-types": "^15.7.2"
+      },
+      "peerDependencies": {
+        "@stripe/stripe-js": ">=1.44.1 <8.0.0",
+        "react": ">=16.8.0 <20.0.0",
+        "react-dom": ">=16.8.0 <20.0.0"
+      }
+    },
+    "node_modules/@stripe/stripe-js": {
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@stripe/stripe-js/-/stripe-js-7.9.0.tgz",
+      "integrity": "sha512-ggs5k+/0FUJcIgNY08aZTqpBTtbExkJMYMLSMwyucrhtWexVOEY1KJmhBsxf+E/Q15f5rbwBpj+t0t2AW2oCsQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.16"
+      }
+    },
+    "node_modules/@supabase/auth-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.81.1.tgz",
+      "integrity": "sha512-K20GgiSm9XeRLypxYHa5UCnybWc2K0ok0HLbqCej/wRxDpJxToXNOwKt0l7nO8xI1CyQ+GrNfU6bcRzvdbeopQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/auth-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/functions-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.81.1.tgz",
+      "integrity": "sha512-sYgSO3mlgL0NvBFS3oRfCK4OgKGQwuOWJLzfPyWg0k8MSxSFSDeN/JtrDJD5GQrxskP6c58+vUzruBJQY78AqQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/functions-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/postgrest-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.81.1.tgz",
+      "integrity": "sha512-DePpUTAPXJyBurQ4IH2e42DWoA+/Qmr5mbgY4B6ZcxVc/ZUKfTVK31BYIFBATMApWraFc8Q/Sg+yxtfJ3E0wSg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/postgrest-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/realtime-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.81.1.tgz",
+      "integrity": "sha512-ViQ+Kxm8BuUP/TcYmH9tViqYKGSD1LBjdqx2p5J+47RES6c+0QHedM0PPAjthMdAHWyb2LGATE9PD2++2rO/tw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/phoenix": "^1.6.6",
+        "@types/ws": "^8.18.1",
+        "tslib": "2.8.1",
+        "ws": "^8.18.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/realtime-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/storage-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.81.1.tgz",
+      "integrity": "sha512-UNmYtjnZnhouqnbEMC1D5YJot7y0rIaZx7FG2Fv8S3hhNjcGVvO+h9We/tggi273BFkiahQPS/uRsapo1cSapw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/storage-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/supabase-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.81.1.tgz",
+      "integrity": "sha512-KSdY7xb2L0DlLmlYzIOghdw/na4gsMcqJ8u4sD6tOQJr+x3hLujU9s4R8N3ob84/1bkvpvlU5PYKa1ae+OICnw==",
+      "license": "MIT",
+      "dependencies": {
+        "@supabase/auth-js": "2.81.1",
+        "@supabase/functions-js": "2.81.1",
+        "@supabase/postgrest-js": "2.81.1",
+        "@supabase/realtime-js": "2.81.1",
+        "@supabase/storage-js": "2.81.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/@sveltejs/acorn-typescript": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.6.tgz",
@@ -3887,6 +4023,15 @@
         "@tauri-apps/api": "^2.8.0"
       }
     },
+    "node_modules/@tauri-apps/plugin-http": {
+      "version": "2.5.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-http/-/plugin-http-2.5.4.tgz",
+      "integrity": "sha512-/i4U/9za3mrytTgfRn5RHneKubZE/dwRmshYwyMvNRlkWjvu1m4Ma72kcbVJMZFGXpkbl+qLyWMGrihtWB76Zg==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.8.0"
+      }
+    },
     "node_modules/@testing-library/dom": {
       "version": "10.4.1",
       "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",
@@ -4193,7 +4338,6 @@
       "version": "24.9.1",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.9.1.tgz",
       "integrity": "sha512-QoiaXANRkSXK6p0Duvt56W208du4P9Uye9hWLWgGMDTEoKPhuenzNcC4vGUmrNkiOKTlIrBoyNQYNpSwfEZXSg==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~7.16.0"
@@ -4205,6 +4349,12 @@
       "integrity": "sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==",
       "license": "MIT"
     },
+    "node_modules/@types/phoenix": {
+      "version": "1.6.6",
+      "resolved": "https://registry.npmjs.org/@types/phoenix/-/phoenix-1.6.6.tgz",
+      "integrity": "sha512-PIzZZlEppgrpoT2QgbnDU+MMzuR6BbCjllj0bM70lWoejMeNJAxCchxnv7J3XFkI8MpygtRpzXrIlmWUBclP5A==",
+      "license": "MIT"
+    },
     "node_modules/@types/prop-types": {
       "version": "15.7.15",
       "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
@@ -4239,6 +4389,15 @@
         "@types/react": "*"
       }
     },
+    "node_modules/@types/ws": {
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
+      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/yauzl": {
       "version": "2.10.3",
       "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz",
@@ -13952,7 +14111,6 @@
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
       "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/universalify": {
@@ -14823,7 +14981,6 @@
       "version": "8.18.3",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz",
       "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

frontend/package.json

@@ -26,19 +26,23 @@
     "@embedpdf/plugin-viewport": "^1.4.1",
     "@embedpdf/plugin-zoom": "^1.4.1",
     "@emotion/react": "^11.14.0",
-    "@tauri-apps/api": "^2.5.0",
-    "@tauri-apps/plugin-fs": "^2.4.0",
     "@emotion/styled": "^11.14.1",
     "@iconify/react": "^6.0.2",
     "@mantine/core": "^8.3.1",
     "@mantine/dates": "^8.3.1",
     "@mantine/dropzone": "^8.3.1",
     "@mantine/hooks": "^8.3.1",
+    "@stripe/react-stripe-js": "^4.0.2",
+    "@stripe/stripe-js": "^7.9.0",
+    "@supabase/supabase-js": "^2.47.13",
     "@mui/icons-material": "^7.3.2",
     "@mui/material": "^7.3.2",
     "@reactour/tour": "^3.8.0",
     "@tailwindcss/postcss": "^4.1.13",
     "@tanstack/react-virtual": "^3.13.12",
+    "@tauri-apps/api": "^2.5.0",
+    "@tauri-apps/plugin-fs": "^2.4.0",
+    "@tauri-apps/plugin-http": "^2.5.4",
     "autoprefixer": "^10.4.21",
     "axios": "^1.12.2",
     "globals": "^16.4.0",
@@ -110,11 +114,11 @@
     ]
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2.5.0",
     "@eslint/js": "^9.36.0",
     "@iconify-json/material-symbols": "^1.2.37",
     "@iconify/utils": "^3.0.2",
     "@playwright/test": "^1.55.0",
+    "@tauri-apps/cli": "^2.5.0",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.8.0",
     "@testing-library/react": "^16.3.0",

frontend/public/locales/en-GB/translation.json

@@ -17,6 +17,8 @@
       "comingSoon": "Coming soon:",
       "favorite": "Add to favourites",
       "favorites": "Favourites",
+      "unavailable": "Disabled by server administrator:",
+      "unavailableDependency": "Unavailable - required tool missing on server:",
       "heading": "All tools (fullscreen view)",
       "noResults": "Try adjusting your search or toggle descriptions to find what you need.",
       "recommended": "Recommended",
@@ -41,6 +43,30 @@
     "cancel": "Cancel",
     "confirm": "Extract"
   },
+  "defaultApp": {
+    "title": "Set as Default PDF App",
+    "message": "Would you like to set Stirling PDF as your default PDF editor?",
+    "description": "You can change this later in your system settings.",
+    "notNow": "Not Now",
+    "setDefault": "Set Default",
+    "dismiss": "Dismiss",
+    "prompt": {
+      "title": "Set as Default PDF Editor",
+      "message": "Make Stirling PDF your default application for opening PDF files."
+    },
+    "success": {
+      "title": "Default App Set",
+      "message": "Stirling PDF is now your default PDF editor"
+    },
+    "settingsOpened": {
+      "title": "Settings Opened",
+      "message": "Please select Stirling PDF in your system settings"
+    },
+    "error": {
+      "title": "Error",
+      "message": "Failed to set default PDF handler"
+    }
+  },
   "language": {
     "direction": "ltr"
   },
@@ -332,6 +358,20 @@
       "mode": {
         "fullscreen": "Fullscreen",
         "sidebar": "Sidebar"
+      },
+      "defaultPdfEditor": "Default PDF editor",
+      "defaultPdfEditorActive": "Stirling PDF is your default PDF editor",
+      "defaultPdfEditorInactive": "Another application is set as default",
+      "defaultPdfEditorChecking": "Checking...",
+      "defaultPdfEditorSet": "Already Default",
+      "setAsDefault": "Set as Default",
+      "updates": {
+        "title": "Software Updates",
+        "description": "Check for updates and view version information",
+        "currentVersion": "Current Version",
+        "latestVersion": "Latest Version",
+        "checkForUpdates": "Check for Updates",
+        "viewDetails": "View Details"
       }
     },
     "hotkeys": {
@@ -353,6 +393,37 @@
       "searchPlaceholder": "Search tools..."
     }
   },
+  "update": {
+    "modalTitle": "Update Available",
+    "current": "Current Version",
+    "latest": "Latest Version",
+    "latestStable": "Latest Stable",
+    "priorityLabel": "Priority",
+    "recommendedAction": "Recommended Action",
+    "breakingChangesDetected": "Breaking Changes Detected",
+    "breakingChangesMessage": "Some versions contain breaking changes. Please review the migration guides below before updating.",
+    "migrationGuides": "Migration Guides",
+    "viewGuide": "View Guide",
+    "loadingDetailedInfo": "Loading detailed information...",
+    "close": "Close",
+    "viewAllReleases": "View All Releases",
+    "downloadLatest": "Download Latest",
+    "availableUpdates": "Available Updates",
+    "unableToLoadDetails": "Unable to load detailed information.",
+    "version": "Version",
+    "urgentUpdateAvailable": "Urgent Update",
+    "updateAvailable": "Update Available",
+    "releaseNotes": "Release Notes",
+    "priority": {
+      "urgent": "Urgent",
+      "normal": "Normal",
+      "minor": "Minor",
+      "low": "Low"
+    },
+    "breakingChanges": "Breaking Changes",
+    "breakingChangesDefault": "This version contains breaking changes.",
+    "migrationGuide": "Migration Guide"
+  },
   "changeCreds": {
     "title": "Change Credentials",
     "header": "Update Your Account Details",
@@ -849,6 +920,11 @@
     },
     "error": {
       "failed": "An error occurred while merging the PDFs."
+    },
+    "tooltip": {
+      "header": {
+        "title": "Merge Settings Overview"
+      }
     }
   },
   "split": {
@@ -1397,6 +1473,93 @@
     },
     "submit": "Change"
   },
+  "editTableOfContents": {
+    "settings": {
+      "title": "Bookmarks & outline",
+      "replaceExisting": "Replace existing bookmarks (uncheck to append)",
+      "replaceExistingHint": "When disabled, the new outline is appended after the current bookmarks."
+    },
+    "actions": {
+      "source": "Load bookmarks",
+      "selectedFile": "Loaded from {{file}}",
+      "noFile": "Select a PDF to extract existing bookmarks.",
+      "loadFromPdf": "Load from selected PDF",
+      "importJson": "Import JSON",
+      "importClipboard": "Paste JSON from clipboard",
+      "export": "Export bookmarks",
+      "exportJson": "Download JSON",
+      "exportClipboard": "Copy JSON to clipboard",
+      "clipboardUnavailable": "Clipboard access is not available in this browser."
+    },
+    "info": {
+      "line1": "Each bookmark needs a descriptive title and the page it should open.",
+      "line2": "Use child bookmarks to build a hierarchy for chapters, sections, or subsections.",
+      "line3": "Import bookmarks from the selected PDF or from a JSON file to save time."
+    },
+    "workbench": {
+      "empty": {
+        "title": "Open the tool to start editing",
+        "description": "Select the Edit Table of Contents tool to load its workspace."
+      },
+      "tabTitle": "Outline workspace",
+      "subtitle": "Import bookmarks, build hierarchies, and apply the outline without cramped side panels.",
+      "noFile": "No PDF selected",
+      "fileLabel": "Changes will be applied to the currently selected PDF.",
+      "filePrompt": "Select a PDF from your library or upload a new one to begin.",
+      "changeFile": "Change PDF",
+      "selectFile": "Select PDF"
+    },
+    "editor": {
+      "heading": "Bookmark editor",
+      "description": "Add, nest, and reorder bookmarks to craft your PDF outline.",
+      "addTopLevel": "Add top-level bookmark",
+      "empty": {
+        "title": "No bookmarks yet",
+        "description": "Import existing bookmarks or start by adding your first entry.",
+        "action": "Add first bookmark"
+      },
+      "defaultTitle": "New bookmark",
+      "defaultChildTitle": "Child bookmark",
+      "defaultSiblingTitle": "New bookmark",
+      "untitled": "Untitled bookmark",
+      "childBadge": "Child",
+      "pagePreview": "Page {{page}}",
+      "field": {
+        "title": "Bookmark title",
+        "page": "Target page number"
+      },
+      "actions": {
+        "toggle": "Toggle children",
+        "addChild": "Add child bookmark",
+        "addSibling": "Add sibling bookmark",
+        "remove": "Remove bookmark"
+      },
+      "confirmRemove": "Remove this bookmark and all of its children?"
+    },
+    "messages": {
+      "loadedTitle": "Bookmarks extracted",
+      "loadedBody": "Existing bookmarks from the PDF were loaded into the editor.",
+      "noBookmarks": "No bookmarks were found in the selected PDF.",
+      "loadFailed": "Unable to extract bookmarks from the selected PDF.",
+      "imported": "Bookmarks imported",
+      "importedBody": "Your JSON outline replaced the current editor contents.",
+      "importedClipboard": "Clipboard data replaced the current bookmark list.",
+      "invalidJson": "Invalid JSON structure",
+      "invalidJsonBody": "Please provide a valid bookmark JSON file and try again.",
+      "exported": "JSON download ready",
+      "copied": "Copied to clipboard",
+      "copiedBody": "Bookmark JSON copied successfully.",
+      "copyFailed": "Copy failed"
+    },
+    "error": {
+      "failed": "Failed to update the table of contents"
+    },
+    "submit": "Apply table of contents",
+    "results": {
+      "title": "Updated PDF with bookmarks",
+      "subtitle": "Download the processed file or undo the operation below."
+    }
+  },
   "removePages": {
     "tags": "Remove pages,delete pages",
     "title": "Remove Pages",
@@ -1978,13 +2141,54 @@
       "title": "Draw your signature",
       "clear": "Clear"
     },
+    "canvas": {
+      "heading": "Draw your signature",
+      "clickToOpen": "Click to open the drawing canvas",
+      "modalTitle": "Draw your signature",
+      "colorLabel": "Colour",
+      "penSizeLabel": "Pen size",
+      "penSizePlaceholder": "Size",
+      "clear": "Clear canvas",
+      "colorPickerTitle": "Choose stroke colour"
+    },
     "text": {
       "name": "Signer Name",
-      "placeholder": "Enter your full name"
+      "placeholder": "Enter your full name",
+      "fontLabel": "Font",
+      "fontSizeLabel": "Font size",
+      "fontSizePlaceholder": "Type or select font size (8-200)",
+      "colorLabel": "Text colour"
     },
     "clear": "Clear",
     "add": "Add",
-    "saved": "Saved Signatures",
+    "saved": {
+      "heading": "Saved signatures",
+      "description": "Reuse saved signatures at any time.",
+      "emptyTitle": "No saved signatures yet",
+      "emptyDescription": "Draw, upload, or type a signature above, then use \"Save to library\" to keep up to {{max}} favourites ready to use.",
+      "type": {
+        "canvas": "Drawing",
+        "image": "Upload",
+        "text": "Text"
+      },
+      "limitTitle": "Limit reached",
+      "limitDescription": "Remove a saved signature before adding new ones (max {{max}}).",
+      "carouselPosition": "{{current}} of {{total}}",
+      "prev": "Previous",
+      "next": "Next",
+      "delete": "Remove",
+      "label": "Label",
+      "defaultLabel": "Signature",
+      "defaultCanvasLabel": "Drawing signature",
+      "defaultImageLabel": "Uploaded signature",
+      "defaultTextLabel": "Typed signature",
+      "saveButton": "Save signature",
+      "saveUnavailable": "Create a signature first to save it.",
+      "noChanges": "Current signature is already saved.",
+      "status": {
+        "saved": "Saved"
+      }
+    },
     "save": "Save Signature",
     "applySignatures": "Apply Signatures",
     "personalSigs": "Personal Signatures",
@@ -2003,12 +2207,18 @@
     "steps": {
       "configure": "Configure Signature"
     },
+    "step": {
+      "createDesc": "Choose how you want to create the signature",
+      "place": "Place & save",
+      "placeDesc": "Position the signature on your PDF"
+    },
     "type": {
       "title": "Signature Type",
       "draw": "Draw",
       "canvas": "Canvas",
       "image": "Image",
-      "text": "Text"
+      "text": "Text",
+      "saved": "Saved"
     },
     "image": {
       "label": "Upload signature image",
@@ -2019,11 +2229,17 @@
       "title": "How to add signature",
       "canvas": "After drawing your signature in the canvas, close the modal then click anywhere on the PDF to place it.",
       "image": "After uploading your signature image above, click anywhere on the PDF to place it.",
-      "text": "After entering your name above, click anywhere on the PDF to place your signature."
+      "saved": "Select a saved signature above, then click anywhere on the PDF to place it.",
+      "text": "After entering your name above, click anywhere on the PDF to place your signature.",
+      "paused": "Placement paused",
+      "resumeHint": "Resume placement to click and add your signature.",
+      "noSignature": "Create a signature above to enable placement tools."
     },
     "mode": {
       "move": "Move Signature",
-      "place": "Place Signature"
+      "place": "Place Signature",
+      "pause": "Pause placement",
+      "resume": "Resume placement"
     },
     "updateAndPlace": "Update and Place",
     "activate": "Activate Signature Placement",
@@ -2163,6 +2379,14 @@
       "title": "About Remove Annotations",
       "description": "This tool will remove all annotations (comments, highlights, notes, etc.) from your PDF documents."
     },
+    "tooltip": {
+      "header": {
+        "title": "About Remove Annotations"
+      },
+      "description": {
+        "title": "What it does"
+      }
+    },
     "error": {
       "failed": "An error occurred while removing annotations from the PDF."
     }
@@ -2206,7 +2430,7 @@
     },
     "cta": "Compare",
     "loading": "Comparing...",
-    
+
     "summary": {
       "baseHeading": "Original document",
       "comparisonHeading": "Edited document",
@@ -2262,7 +2486,7 @@
       "body": "This comparison is taking longer than usual. You can let it continue or cancel it.",
       "cancel": "Cancel comparison"
     },
-    
+
     "newLine": "new-line",
     "complex": {
       "message": "One or both of the provided documents are large files, accuracy of comparison may be reduced"
@@ -2625,6 +2849,9 @@
       "header": {
         "title": "How Auto-Rename Works"
       },
+      "description": {
+        "title": "What it does"
+      },
       "howItWorks": {
         "title": "Smart Renaming",
         "text": "Automatically finds the title from your PDF content and uses it as the filename.",
@@ -2632,6 +2859,9 @@
         "bullet2": "Creates a clean, valid filename from the detected title",
         "bullet3": "Keeps the original name if no suitable title is found"
       }
+    },
+    "settings": {
+      "title": "About"
     }
   },
   "adjust-contrast": {
@@ -4210,9 +4440,21 @@
         "title": "Premium & Enterprise",
         "description": "Configure your premium or enterprise license key.",
         "license": "License Configuration",
+        "licenseKey": {
+          "toggle": "Got a license key or certificate file?",
+          "info": "If you have a license key or certificate file from a direct purchase, you can enter it here to activate premium or enterprise features."
+        },
         "key": {
           "label": "License Key",
-          "description": "Enter your premium or enterprise license key"
+          "description": "Enter your premium or enterprise license key. Premium features will be automatically enabled when a key is provided.",
+          "success": "License Key Saved",
+          "successMessage": "Your license key has been activated successfully. No restart required.",
+          "overwriteWarning": {
+            "title": "⚠️ Warning: Existing License Detected",
+            "line1": "Overwriting your current license key cannot be undone.",
+            "line2": "Your previous license will be permanently lost unless you have backed it up elsewhere.",
+            "line3": "Important: Keep license keys private and secure. Never share them publicly."
+          }
         },
         "enabled": {
           "label": "Enable Premium Features",
@@ -4619,9 +4861,14 @@
       "secureWorkflow": "Security Workflow",
       "secureWorkflowDesc": "Secures PDF documents by removing potentially malicious content like JavaScript and embedded files, then adds password protection to prevent unauthorised access. Password is set to 'password' by default.",
       "processImages": "Process Images",
-      "processImagesDesc": "Converts multiple image files into a single PDF document, then applies OCR technology to extract searchable text from the images."
+      "processImagesDesc": "Converts multiple image files into a single PDF document, then applies OCR technology to extract searchable text from the images.",
+      "prePublishSanitization": "Pre-publish Sanitization",
+      "prePublishSanitizationDesc": "Sanitization workflow that removes all hidden metadata, JavaScript, embedded files, annotations, and flattens forms to prevent data leakage before publishing PDFs online."
     }
   },
+  "colorPicker": {
+    "title": "Choose colour"
+  },
   "common": {
     "previous": "Previous",
     "next": "Next",
@@ -4637,7 +4884,12 @@
     "used": "used",
     "available": "available",
     "cancel": "Cancel",
-    "preview": "Preview"
+    "preview": "Preview",
+    "close": "Close",
+    "done": "Done",
+    "loading": "Loading...",
+    "back": "Back",
+    "continue": "Continue"
   },
   "config": {
     "overview": {
@@ -4703,6 +4955,14 @@
     "addMoreFiles": "Add more files...",
     "selectedFiles": "Selected Files",
     "submit": "Add Attachments",
+    "tooltip": {
+      "header": {
+        "title": "About Add Attachments"
+      },
+      "description": {
+        "title": "What it does"
+      }
+    },
     "results": {
       "title": "Attachment Results"
     },
@@ -5055,6 +5315,14 @@
     "showComparison": "Compare All Features",
     "hideComparison": "Hide Feature Comparison",
     "featureComparison": "Feature Comparison",
+    "from": "From",
+    "perMonth": "/month",
+    "licensedSeats": "Licensed: {{count}} seats",
+    "includedInCurrent": "Included in Your Plan",
+    "selectPlan": "Select Plan",
+    "manageSubscription": {
+      "description": "Manage your subscription, billing, and payment methods"
+    },
     "activePlan": {
       "title": "Active Plan",
       "subtitle": "Your current subscription details"
@@ -5072,13 +5340,16 @@
       "upTo": "Up to"
     },
     "period": {
-      "month": "month"
+      "month": "month",
+      "perUserPerMonth": "/user/month"
     },
     "free": {
       "name": "Free",
       "highlight1": "Limited Tool Usage Per week",
       "highlight2": "Access to all tools",
-      "highlight3": "Community support"
+      "highlight3": "Community support",
+      "forever": "Forever free",
+      "included": "Included"
     },
     "pro": {
       "name": "Pro",
@@ -5120,13 +5391,44 @@
       "error": "Failed to open billing portal"
     }
   },
+  "upgradeBanner": {
+    "title": "Upgrade to Server Plan",
+    "message": "Get the most out of Stirling PDF with unlimited users and advanced features",
+    "upgradeButton": "Upgrade Now",
+    "dismiss": "Dismiss banner"
+  },
   "payment": {
     "preparing": "Preparing your checkout...",
     "upgradeTitle": "Upgrade to {{planName}}",
     "success": "Payment Successful!",
     "successMessage": "Your subscription has been activated successfully. You will receive a confirmation email shortly.",
     "autoClose": "This window will close automatically...",
-    "error": "Payment Error"
+    "error": "Payment Error",
+    "upgradeSuccess": "Payment successful! Your subscription has been upgraded. The license has been updated on your server. You will receive a confirmation email shortly.",
+    "paymentSuccess": "Payment successful! Retrieving your license key...",
+    "licenseActivated": "License activated! Your license key has been saved. A confirmation email has been sent to your registered email address.",
+    "licenseDelayed": "Payment successful! Your license is being generated. You will receive an email with your license key shortly. If you don't receive it within 10 minutes, please contact support.",
+    "licensePollingError": "Payment successful but we couldn't retrieve your license key automatically. Please check your email or contact support with your payment confirmation.",
+    "licenseRetrievalError": "Payment successful but license retrieval failed. You will receive your license key via email. Please contact support if you don't receive it within 10 minutes.",
+    "syncError": "Payment successful but license sync failed. Your license will be updated shortly. Please contact support if issues persist.",
+    "licenseSaveError": "Failed to save license key. Please contact support with your license key to complete activation.",
+    "paymentCanceled": "Payment was canceled. No charges were made.",
+    "syncingLicense": "Syncing your upgraded license...",
+    "generatingLicense": "Generating your license key...",
+    "upgradeComplete": "Upgrade Complete",
+    "upgradeCompleteMessage": "Your subscription has been upgraded successfully. Your existing license key has been updated.",
+    "stripeNotConfigured": "Stripe Not Configured",
+    "stripeNotConfiguredMessage": "Stripe payment integration is not configured. Please contact your administrator.",
+    "monthly": "Monthly",
+    "yearly": "Yearly",
+    "billingPeriod": "Billing Period",
+    "enterpriseNote": "Seats can be adjusted in checkout (1-1000).",
+    "installationId": "Installation ID",
+    "licenseKey": "Your License Key",
+    "licenseInstructions": "Enter this key in Settings → Admin Plan → License Key section",
+    "canCloseWindow": "You can now close this window.",
+    "licenseKeyProcessing": "License Key Processing",
+    "licenseDelayedMessage": "Your license key is being generated. Please check your email shortly or contact support."
   },
   "firstLogin": {
     "title": "First Time Login",
@@ -5285,5 +5587,164 @@
     "offline": "Backend Offline",
     "starting": "Backend starting up...",
     "wait": "Please wait for the backend to finish launching and try again."
+  },
+  "encryptedPdfUnlock": {
+    "unlockPrompt": "Unlock PDF to continue",
+    "title": "Remove password to continue",
+    "description": "This PDF is password protected. Enter the password so you can continue working with it.",
+    "password": {
+      "label": "PDF password",
+      "placeholder": "Enter the PDF password"
+    },
+    "skip": "Skip for now",
+    "unlock": "Unlock & Continue",
+    "incorrectPassword": "Incorrect password",
+    "missingFile": "The selected file is no longer available.",
+    "emptyResponse": "Password removal did not produce a file.",
+    "required": "Enter the password to continue.",
+    "successTitle": "Password removed",
+    "successBodyWithName": "Password removed from {{fileName}}",
+    "successBody": "Password removed successfully."
+  },
+  "setup": {
+    "welcome": "Welcome to Stirling PDF",
+    "description": "Get started by choosing how you want to use Stirling PDF",
+    "step1": {
+      "label": "Choose Mode",
+      "description": "Offline or Server"
+    },
+    "step2": {
+      "label": "Select Server",
+      "description": "Self-hosted server"
+    },
+    "step3": {
+      "label": "Login",
+      "description": "Enter credentials"
+    },
+    "mode": {
+      "offline": {
+        "title": "Use Offline",
+        "description": "Run locally without an internet connection"
+      },
+      "server": {
+        "title": "Connect to Server",
+        "description": "Connect to a remote Stirling PDF server"
+      }
+    },
+    "server": {
+      "title": "Connect to Server",
+      "subtitle": "Enter your self-hosted server URL",
+      "type": {
+        "saas": "Stirling PDF SaaS",
+        "selfhosted": "Self-hosted server"
+      },
+      "url": {
+        "label": "Server URL",
+        "description": "Enter the full URL of your self-hosted Stirling PDF server"
+      },
+      "error": {
+        "emptyUrl": "Please enter a server URL",
+        "unreachable": "Could not connect to server",
+        "testFailed": "Connection test failed"
+      },
+      "testing": "Testing connection..."
+    },
+    "login": {
+      "title": "Sign In",
+      "subtitle": "Enter your credentials to continue",
+      "connectingTo": "Connecting to:",
+      "username": {
+        "label": "Username",
+        "placeholder": "Enter your username"
+      },
+      "password": {
+        "label": "Password",
+        "placeholder": "Enter your password"
+      },
+      "error": {
+        "emptyUsername": "Please enter your username",
+        "emptyPassword": "Please enter your password"
+      },
+      "submit": "Login"
+    }
+  },
+  "settings": {
+    "connection": {
+      "title": "Connection Mode",
+      "mode": {
+        "offline": "Offline",
+        "server": "Server"
+      },
+      "server": "Server",
+      "user": "Logged in as",
+      "switchToServer": "Connect to Server",
+      "switchToOffline": "Switch to Offline",
+      "logout": "Logout",
+      "selectServer": "Select Server",
+      "login": "Login"
+    },
+    "general": {
+      "title": "General",
+      "description": "Configure general application preferences.",
+      "user": "User",
+      "logout": "Log out",
+      "enableFeatures": {
+        "dismiss": "Dismiss",
+        "title": "For System Administrators",
+        "intro": "Enable user authentication, team management, and workspace features for your organisation.",
+        "action": "Configure",
+        "and": "and",
+        "benefit": "Enables user roles, team collaboration, admin controls, and enterprise features.",
+        "learnMore": "Learn more in documentation"
+      },
+      "defaultToolPickerMode": "Default tool picker mode",
+      "defaultToolPickerModeDescription": "Choose whether the tool picker opens in fullscreen or sidebar by default",
+      "mode": {
+        "sidebar": "Sidebar",
+        "fullscreen": "Fullscreen"
+      },
+      "autoUnzipTooltip": "Automatically extract ZIP files returned from API operations. Disable to keep ZIP files intact. This does not affect automation workflows.",
+      "autoUnzip": "Auto-unzip API responses",
+      "autoUnzipDescription": "Automatically extract files from ZIP responses",
+      "autoUnzipFileLimitTooltip": "Only unzip if the ZIP contains this many files or fewer. Set higher to extract larger ZIPs.",
+      "autoUnzipFileLimit": "Auto-unzip file limit",
+      "autoUnzipFileLimitDescription": "Maximum number of files to extract from ZIP",
+      "defaultPdfEditor": "Default PDF editor",
+      "defaultPdfEditorActive": "Stirling PDF is your default PDF editor",
+      "defaultPdfEditorInactive": "Another application is set as default",
+      "defaultPdfEditorChecking": "Checking...",
+      "defaultPdfEditorSet": "Already Default",
+      "setAsDefault": "Set as Default",
+      "updates": {
+        "title": "Software Updates",
+        "description": "Check for updates and view version information",
+        "currentVersion": "Current Version",
+        "latestVersion": "Latest Version",
+        "checkForUpdates": "Check for Updates",
+        "viewDetails": "View Details"
+      },
+      "hideUnavailableTools": "Hide unavailable tools",
+      "hideUnavailableToolsDescription": "Remove tools that have been disabled by your server instead of showing them greyed out.",
+      "hideUnavailableConversions": "Hide unavailable conversions",
+      "hideUnavailableConversionsDescription": "Remove disabled conversion options in the Convert tool instead of showing them greyed out."
+    },
+    "hotkeys": {
+      "errorConflict": "Shortcut already used by {{tool}}.",
+      "searchPlaceholder": "Search tools...",
+      "none": "Not assigned",
+      "customBadge": "Custom",
+      "defaultLabel": "Default: {{shortcut}}",
+      "capturing": "Press keys… (Esc to cancel)",
+      "change": "Change shortcut",
+      "reset": "Reset",
+      "shortcut": "Shortcut",
+      "noShortcut": "No shortcut set"
+    }
+  },
+  "auth": {
+    "sessionExpired": "Session Expired",
+    "pleaseLoginAgain": "Please login again.",
+    "accessDenied": "Access Denied",
+    "insufficientPermissions": "You do not have permission to perform this action."
   }
 }

frontend/src-tauri/Cargo.lock

@@ -589,10 +589,29 @@ version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
 dependencies = [
+ "percent-encoding",
  "time",
  "version_check",
 ]
 
+[[package]]
+name = "cookie_store"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eac901828f88a5241ee0600950ab981148a18f2f756900ffba1b125ca6a3ef9"
+dependencies = [
+ "cookie",
+ "document-features",
+ "idna",
+ "log",
+ "publicsuffix",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "url",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -643,6 +662,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "core-services"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0aa845ab21b847ee46954be761815f18f16469b29ef3ba250241b1b8bab659a"
+dependencies = [
+ "core-foundation 0.10.1",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -758,6 +786,12 @@ dependencies = [
  "syn 2.0.108",
 ]
 
+[[package]]
+name = "data-url"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"
+
 [[package]]
 name = "deranged"
 version = "0.5.5"
@@ -862,6 +896,15 @@ dependencies = [
  "syn 2.0.108",
 ]
 
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
 [[package]]
 name = "dpi"
 version = "0.1.2"
@@ -1356,8 +1399,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1367,9 +1412,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi",
  "wasip2",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1539,6 +1586,25 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.3.1",
+ "indexmap 2.12.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -1668,7 +1734,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2",
+ "h2 0.3.27",
  "http 0.2.12",
  "http-body 0.4.6",
  "httparse",
@@ -1692,6 +1758,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
+ "h2 0.4.12",
  "http 1.3.1",
  "http-body 1.0.1",
  "httparse",
@@ -1703,6 +1770,23 @@ dependencies = [
  "want",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http 1.3.1",
+ "hyper 1.7.0",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
 [[package]]
 name = "hyper-tls"
 version = "0.5.0"
@@ -1735,9 +1819,11 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "socket2 0.6.1",
+ "system-configuration 0.6.1",
  "tokio",
  "tower-service",
  "tracing",
+ "windows-registry",
 ]
 
 [[package]]
@@ -2048,6 +2134,16 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "keyring"
+version = "3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
+dependencies = [
+ "log",
+ "zeroize",
+]
+
 [[package]]
 name = "kuchikiki"
 version = "0.8.8-speedreader"
@@ -2128,6 +2224,12 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
 
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -2146,6 +2248,12 @@ dependencies = [
  "value-bag",
 ]
 
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "mac"
 version = "0.1.1"
@@ -3083,6 +3191,12 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
 [[package]]
 name = "ptr_meta"
 version = "0.1.4"
@@ -3103,6 +3217,16 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "publicsuffix"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42ea446cab60335f76979ec15e12619a2165b5ae2c12166bef27d283a9fadf"
+dependencies = [
+ "idna",
+ "psl-types",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.38.3"
@@ -3112,6 +3236,61 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2 0.6.1",
+ "thiserror 2.0.17",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.17",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.6.1",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.41"
@@ -3158,6 +3337,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@@ -3178,6 +3367,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
+]
+
 [[package]]
 name = "rand_core"
 version = "0.5.1"
@@ -3196,6 +3395,15 @@ dependencies = [
  "getrandom 0.2.16",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
 [[package]]
 name = "rand_hc"
 version = "0.2.0"
@@ -3309,7 +3517,7 @@ dependencies = [
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2",
+ "h2 0.3.27",
  "http 0.2.12",
  "http-body 0.4.6",
  "hyper 0.14.32",
@@ -3327,7 +3535,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper 0.1.2",
- "system-configuration",
+ "system-configuration 0.5.1",
  "tokio",
  "tokio-native-tls",
  "tower-service",
@@ -3346,22 +3554,32 @@ checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
 dependencies = [
  "base64 0.22.1",
  "bytes",
+ "cookie",
+ "cookie_store",
+ "encoding_rs",
  "futures-core",
  "futures-util",
+ "h2 0.4.12",
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.7.0",
+ "hyper-rustls",
  "hyper-util",
  "js-sys",
  "log",
+ "mime",
  "percent-encoding",
  "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper 1.0.2",
  "tokio",
+ "tokio-rustls",
  "tokio-util",
  "tower",
  "tower-http",
@@ -3371,6 +3589,21 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.16",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3418,6 +3651,12 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -3440,6 +3679,20 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls-pemfile"
 version = "1.0.4"
@@ -3449,6 +3702,27 @@ dependencies = [
  "base64 0.21.7",
 ]
 
+[[package]]
+name = "rustls-pki-types"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94182ad936a0c91c324cd46c6511b9510ed16af436d7b5bab34beab0afd55f7a"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -3941,6 +4215,9 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 name = "stirling-pdf"
 version = "0.1.0"
 dependencies = [
+ "core-foundation 0.10.1",
+ "core-services",
+ "keyring",
  "log",
  "reqwest 0.11.27",
  "serde",
@@ -3948,9 +4225,11 @@ dependencies = [
  "tauri",
  "tauri-build",
  "tauri-plugin-fs",
+ "tauri-plugin-http",
  "tauri-plugin-log",
  "tauri-plugin-shell",
  "tauri-plugin-single-instance",
+ "tauri-plugin-store",
  "tokio",
 ]
 
@@ -3985,6 +4264,12 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "swift-rs"
 version = "1.0.7"
@@ -4052,7 +4337,18 @@ checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation 0.9.4",
- "system-configuration-sys",
+ "system-configuration-sys 0.5.0",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.9.4",
+ "system-configuration-sys 0.6.0",
 ]
 
 [[package]]
@@ -4065,6 +4361,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "system-deps"
 version = "6.2.2"
@@ -4294,6 +4600,30 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "tauri-plugin-http"
+version = "2.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c00685aceab12643cf024f712ab0448ba8fcadf86f2391d49d2e5aa732aacc70"
+dependencies = [
+ "bytes",
+ "cookie_store",
+ "data-url",
+ "http 1.3.1",
+ "regex",
+ "reqwest 0.12.24",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.17",
+ "tokio",
+ "url",
+ "urlpattern",
+]
+
 [[package]]
 name = "tauri-plugin-log"
 version = "2.7.1"
@@ -4352,6 +4682,22 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "tauri-plugin-store"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59a77036340a97eb5bbe1b3209c31e5f27f75e6f92a52fd9dd4b211ef08bf310"
+dependencies = [
+ "dunce",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "thiserror 2.0.17",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "tauri-runtime"
 version = "2.9.1"
@@ -4585,9 +4931,21 @@ dependencies = [
  "mio",
  "pin-project-lite",
  "socket2 0.6.1",
+ "tokio-macros",
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tokio-macros"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.108",
+]
+
 [[package]]
 name = "tokio-native-tls"
 version = "0.3.1"
@@ -4598,6 +4956,16 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.16"
@@ -4887,6 +5255,12 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.5.7"
@@ -5120,6 +5494,16 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "webkit2gtk"
 version = "2.0.1"
@@ -5164,6 +5548,15 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2878ef029c47c6e8cf779119f20fcf52bde7ad42a731b2a304bc221df17571e"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.38.0"
@@ -5349,6 +5742,17 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
+dependencies = [
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -5951,6 +6355,12 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
 [[package]]
 name = "zerotrie"
 version = "0.2.2"

frontend/src-tauri/Cargo.toml

@@ -28,6 +28,13 @@ tauri = { version = "2.9.0", features = [ "devtools"] }
 tauri-plugin-log = "2.0.0-rc"
 tauri-plugin-shell = "2.1.0"
 tauri-plugin-fs = "2.4.4"
+tauri-plugin-http = "2.4.4"
 tauri-plugin-single-instance = "2.0.1"
+tauri-plugin-store = "2.1.0"
+keyring = "3.6.1"
 tokio = { version = "1.0", features = ["time"] }
 reqwest = { version = "0.11", features = ["json"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+core-foundation = "0.10"
+core-services = "1.0"

frontend/src-tauri/capabilities/default.json

@@ -7,9 +7,18 @@
   ],
   "permissions": [
     "core:default",
-    { 
-    "identifier": "fs:allow-read-file",
-    "allow": [{ "path": "**" }]
-   }
+    "http:default",
+    {
+      "identifier": "http:allow-fetch",
+      "allow": [
+        { "url": "http://localhost:*" },
+        { "url": "http://127.0.0.1:*" },
+        { "url": "https://*" }
+      ]
+    },
+    {
+      "identifier": "fs:allow-read-file",
+      "allow": [{ "path": "**" }]
+    }
   ]
 }

frontend/src-tauri/src/commands/auth.rs

@@ -0,0 +1,215 @@
+use keyring::Entry;
+use serde::{Deserialize, Serialize};
+use tauri::AppHandle;
+use tauri_plugin_store::StoreExt;
+
+const STORE_FILE: &str = "connection.json";
+const USER_INFO_KEY: &str = "user_info";
+const KEYRING_SERVICE: &str = "stirling-pdf";
+const KEYRING_TOKEN_KEY: &str = "auth-token";
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub struct UserInfo {
+    pub username: String,
+    pub email: Option<String>,
+}
+
+fn get_keyring_entry() -> Result<Entry, String> {
+    Entry::new(KEYRING_SERVICE, KEYRING_TOKEN_KEY)
+        .map_err(|e| format!("Failed to access keyring: {}", e))
+}
+
+#[tauri::command]
+pub async fn save_auth_token(_app_handle: AppHandle, token: String) -> Result<(), String> {
+    log::info!("Saving auth token to keyring");
+
+    let entry = get_keyring_entry()?;
+
+    entry
+        .set_password(&token)
+        .map_err(|e| format!("Failed to save token to keyring: {}", e))?;
+
+    log::info!("Auth token saved successfully");
+    Ok(())
+}
+
+#[tauri::command]
+pub async fn get_auth_token(_app_handle: AppHandle) -> Result<Option<String>, String> {
+    log::debug!("Retrieving auth token from keyring");
+
+    let entry = get_keyring_entry()?;
+
+    match entry.get_password() {
+        Ok(token) => Ok(Some(token)),
+        Err(keyring::Error::NoEntry) => Ok(None),
+        Err(e) => Err(format!("Failed to retrieve token: {}", e)),
+    }
+}
+
+#[tauri::command]
+pub async fn clear_auth_token(_app_handle: AppHandle) -> Result<(), String> {
+    log::info!("Clearing auth token from keyring");
+
+    let entry = get_keyring_entry()?;
+
+    // Delete the token - ignore error if it doesn't exist
+    match entry.delete_credential() {
+        Ok(_) => {
+            log::info!("Auth token cleared successfully");
+            Ok(())
+        }
+        Err(keyring::Error::NoEntry) => {
+            log::info!("Auth token was already cleared");
+            Ok(())
+        }
+        Err(e) => Err(format!("Failed to clear token: {}", e)),
+    }
+}
+
+#[tauri::command]
+pub async fn save_user_info(
+    app_handle: AppHandle,
+    username: String,
+    email: Option<String>,
+) -> Result<(), String> {
+    log::info!("Saving user info for: {}", username);
+
+    let user_info = UserInfo { username, email };
+
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    store.set(
+        USER_INFO_KEY,
+        serde_json::to_value(&user_info)
+            .map_err(|e| format!("Failed to serialize user info: {}", e))?,
+    );
+
+    store
+        .save()
+        .map_err(|e| format!("Failed to save store: {}", e))?;
+
+    log::info!("User info saved successfully");
+    Ok(())
+}
+
+#[tauri::command]
+pub async fn get_user_info(app_handle: AppHandle) -> Result<Option<UserInfo>, String> {
+    log::debug!("Retrieving user info");
+
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    let user_info: Option<UserInfo> = store
+        .get(USER_INFO_KEY)
+        .and_then(|v| serde_json::from_value(v.clone()).ok());
+
+    Ok(user_info)
+}
+
+#[tauri::command]
+pub async fn clear_user_info(app_handle: AppHandle) -> Result<(), String> {
+    log::info!("Clearing user info");
+
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    store.delete(USER_INFO_KEY);
+
+    store
+        .save()
+        .map_err(|e| format!("Failed to save store: {}", e))?;
+
+    log::info!("User info cleared successfully");
+    Ok(())
+}
+
+// Response types for Spring Boot login
+#[derive(Debug, Deserialize)]
+struct SpringBootSession {
+    access_token: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct SpringBootUser {
+    username: String,
+    email: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct SpringBootLoginResponse {
+    session: SpringBootSession,
+    user: SpringBootUser,
+}
+
+#[derive(Debug, Serialize)]
+pub struct LoginResponse {
+    pub token: String,
+    pub username: String,
+    pub email: Option<String>,
+}
+
+/// Login command - makes HTTP request from Rust to bypass CORS
+/// Supports Spring Boot authentication (self-hosted)
+#[tauri::command]
+pub async fn login(
+    server_url: String,
+    username: String,
+    password: String,
+) -> Result<LoginResponse, String> {
+    log::info!("Login attempt for user: {} to server: {}", username, server_url);
+
+    // Build login URL
+    let login_url = format!("{}/api/v1/auth/login", server_url.trim_end_matches('/'));
+    log::debug!("Login URL: {}", login_url);
+
+    // Create HTTP client
+    let client = reqwest::Client::new();
+
+    // Make login request
+    let response = client
+        .post(&login_url)
+        .json(&serde_json::json!({
+            "username": username,
+            "password": password,
+        }))
+        .send()
+        .await
+        .map_err(|e| format!("Network error: {}", e))?;
+
+    let status = response.status();
+    log::debug!("Login response status: {}", status);
+
+    if !status.is_success() {
+        let error_text = response
+            .text()
+            .await
+            .unwrap_or_else(|_| "Unknown error".to_string());
+        log::error!("Login failed with status {}: {}", status, error_text);
+
+        return Err(if status.as_u16() == 401 {
+            "Invalid username or password".to_string()
+        } else if status.as_u16() == 403 {
+            "Access denied".to_string()
+        } else {
+            format!("Login failed: {}", status)
+        });
+    }
+
+    // Parse Spring Boot response format
+    let login_response: SpringBootLoginResponse = response
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse response: {}", e))?;
+
+    log::info!("Login successful for user: {}", login_response.user.username);
+
+    Ok(LoginResponse {
+        token: login_response.session.access_token,
+        username: login_response.user.username,
+        email: login_response.user.email,
+    })
+}

frontend/src-tauri/src/commands/backend.rs

@@ -3,10 +3,12 @@ use tauri::Manager;
 use std::sync::Mutex;
 use std::path::PathBuf;
 use crate::utils::add_log;
+use crate::state::connection_state::{AppConnectionState, ConnectionMode};
 
-// Store backend process handle globally
+// Store backend process handle and port globally
 static BACKEND_PROCESS: Mutex<Option<tauri_plugin_shell::process::CommandChild>> = Mutex::new(None);
 static BACKEND_STARTING: Mutex<bool> = Mutex::new(false);
+static BACKEND_PORT: Mutex<Option<u16>> = Mutex::new(None);
 
 // Helper function to reset starting flag
 fn reset_starting_flag() {
@@ -14,6 +16,20 @@ fn reset_starting_flag() {
     *starting_guard = false;
 }
 
+// Extract port number from "Stirling-PDF running on port: PORT" log line
+fn extract_port_from_running_log(log_line: &str) -> Option<u16> {
+    // Look for pattern: "running on port: PORT"
+    if let Some(start) = log_line.find("running on port: ") {
+        let after_prefix = &log_line[start + 17..]; // Skip "running on port: "
+        // Take digits until whitespace or end of line
+        let port_str: String = after_prefix.chars()
+            .take_while(|c| c.is_ascii_digit())
+            .collect();
+        return port_str.parse::<u16>().ok();
+    }
+    None
+}
+
 // Check if backend is already running or starting
 fn check_backend_status() -> Result<(), String> {
     // Check if backend is already running
@@ -24,7 +40,7 @@ fn check_backend_status() -> Result<(), String> {
             return Err("Backend already running".to_string());
         }
     }
-    
+
     // Check and set starting flag to prevent multiple simultaneous starts
     {
         let mut starting_guard = BACKEND_STARTING.lock().unwrap();
@@ -34,7 +50,7 @@ fn check_backend_status() -> Result<(), String> {
         }
         *starting_guard = true;
     }
-    
+
     Ok(())
 }
 
@@ -46,13 +62,13 @@ fn find_bundled_jre(resource_dir: &PathBuf) -> Result<PathBuf, String> {
     } else {
         jre_dir.join("bin").join("java")
     };
-    
+
     if !java_executable.exists() {
         let error_msg = format!("❌ Bundled JRE not found at: {:?}", java_executable);
         add_log(error_msg.clone());
         return Err(error_msg);
     }
-    
+
     add_log(format!("✅ Found bundled JRE: {:?}", java_executable));
     Ok(java_executable)
 }
@@ -77,20 +93,20 @@ fn find_stirling_jar(resource_dir: &PathBuf) -> Result<PathBuf, String> {
                     .unwrap_or(false)
         })
         .collect();
-    
+
     if jar_files.is_empty() {
         let error_msg = "No Stirling-PDF JAR found in libs directory.".to_string();
         add_log(error_msg.clone());
         return Err(error_msg);
     }
-    
+
     // Sort by filename to get the latest version (case-insensitive)
     jar_files.sort_by(|a, b| {
         let name_a = a.file_name().to_string_lossy().to_ascii_lowercase();
         let name_b = b.file_name().to_string_lossy().to_ascii_lowercase();
         name_b.cmp(&name_a) // Reverse order to get latest first
     });
-    
+
     let jar_path = jar_files[0].path();
     add_log(format!("📋 Selected JAR: {:?}", jar_path.file_name().unwrap()));
     Ok(jar_path)
@@ -123,23 +139,23 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
         let home = std::env::var("HOME").unwrap_or_else(|_| "/tmp".to_string());
         PathBuf::from(home).join(".config").join("Stirling-PDF")
     };
-    
+
     // Create subdirectories for different purposes
     let config_dir = app_data_dir.join("configs");
     let log_dir = app_data_dir.join("logs");
     let work_dir = app_data_dir.join("workspace");
-    
+
     // Create all necessary directories
     std::fs::create_dir_all(&app_data_dir).ok();
     std::fs::create_dir_all(&log_dir).ok();
     std::fs::create_dir_all(&work_dir).ok();
     std::fs::create_dir_all(&config_dir).ok();
-    
+
     add_log(format!("📁 App data directory: {}", app_data_dir.display()));
     add_log(format!("📁 Log directory: {}", log_dir.display()));
     add_log(format!("📁 Working directory: {}", work_dir.display()));
     add_log(format!("📁 Config directory: {}", config_dir.display()));
-    
+
     // Define all Java options with Tauri-specific paths
     let log_path_option = format!("-Dlogging.file.path={}", log_dir.display());
 
@@ -150,10 +166,13 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
         "-DSTIRLING_PDF_TAURI_MODE=true",
         &log_path_option,
         "-Dlogging.file.name=stirling-pdf.log",
+        "-Dserver.port=0",  // Let OS assign an available port
+        "-Dsecurity.enableLogin=false",  // Disable login for desktop mode
+        "-Dsecurity.csrfDisabled=true",  // Disable CSRF for desktop mode
         "-jar",
-        jar_path.to_str().unwrap()
+        jar_path.to_str().unwrap(),
     ];
-    
+
     // Log the equivalent command for external testing
     let java_command = format!(
         "TAURI_PARENT_PID={} \"{}\" {}",
@@ -163,14 +182,14 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
     );
     add_log(format!("🔧 Equivalent command: {}", java_command));
     add_log(format!("📁 Backend logs will be in: {}", log_dir.display()));
-    
+
     // Additional macOS-specific checks
     if cfg!(target_os = "macos") {
         // Check if java executable has execute permissions
         if let Ok(metadata) = std::fs::metadata(java_path) {
             let permissions = metadata.permissions();
             add_log(format!("🔍 Java executable permissions: {:?}", permissions));
-            
+
             #[cfg(unix)]
             {
                 use std::os::unix::fs::PermissionsExt;
@@ -181,7 +200,7 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
                 }
             }
         }
-        
+
         // Check if we can read the JAR file
         if let Ok(metadata) = std::fs::metadata(jar_path) {
             add_log(format!("📦 JAR file size: {} bytes", metadata.len()));
@@ -189,7 +208,7 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
             add_log("⚠️ Cannot read JAR file metadata".to_string());
         }
     }
-    
+
     let sidecar_command = app
         .shell()
         .command(java_path.to_str().unwrap())
@@ -199,9 +218,9 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
         .env("STIRLING_PDF_CONFIG_DIR", config_dir.to_str().unwrap())
         .env("STIRLING_PDF_LOG_DIR", log_dir.to_str().unwrap())
         .env("STIRLING_PDF_WORK_DIR", work_dir.to_str().unwrap());
-    
+
     add_log("⚙️ Starting backend with bundled JRE...".to_string());
-    
+
     let (rx, child) = sidecar_command
         .spawn()
         .map_err(|e| {
@@ -209,18 +228,18 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
             add_log(error_msg.clone());
             error_msg
         })?;
-    
+
     // Store the process handle
     {
         let mut process_guard = BACKEND_PROCESS.lock().unwrap();
         *process_guard = Some(child);
     }
-    
+
     add_log("✅ Backend started with bundled JRE, monitoring output...".to_string());
-    
+
     // Start monitoring output
     monitor_backend_output(rx);
-    
+
     Ok(())
 }
 
@@ -229,7 +248,7 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
     tokio::spawn(async move {
         let mut _startup_detected = false;
         let mut error_count = 0;
-        
+
         while let Some(event) = rx.recv().await {
             match event {
                 tauri_plugin_shell::process::CommandEvent::Stdout(output) => {
@@ -237,17 +256,22 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
                     // Strip exactly one trailing newline to avoid double newlines
                     let output_str = output_str.strip_suffix('\n').unwrap_or(&output_str);
                     add_log(format!("📤 Backend: {}", output_str));
-                    
-                    // Look for startup indicators
-                    if output_str.contains("Started SPDFApplication") || 
-                       output_str.contains("Navigate to "){
+
+                    // Look for actual runtime port from web server initialization
+                    // Format: "Stirling-PDF running on port: PORT"
+                    if output_str.contains("running on port:") {
                         _startup_detected = true;
-                        add_log(format!("🎉 Backend startup detected: {}", output_str));
+                        if let Some(port) = extract_port_from_running_log(&output_str) {
+                            let mut port_guard = BACKEND_PORT.lock().unwrap();
+                            *port_guard = Some(port);
+                            add_log(format!("🎉 Backend started on port: {}", port));
+                            add_log(format!("🔌 Navigate to: http://localhost:{}/", port));
+                        }
                     }
-                    
-                    // Look for port binding
-                    if output_str.contains("8080") {
-                        add_log(format!("🔌 Port 8080 related output: {}", output_str));
+
+                    if output_str.contains("Started SPDFApplication") {
+                        _startup_detected = true;
+                        add_log(format!("🎉 Backend startup completed: {}", output_str));
                     }
                 }
                 tauri_plugin_shell::process::CommandEvent::Stderr(output) => {
@@ -255,13 +279,13 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
                     // Strip exactly one trailing newline to avoid double newlines
                     let output_str = output_str.strip_suffix('\n').unwrap_or(&output_str);
                     add_log(format!("📥 Backend Error: {}", output_str));
-                    
+
                     // Look for error indicators
                     if output_str.contains("ERROR") || output_str.contains("Exception") || output_str.contains("FATAL") {
                         error_count += 1;
                         add_log(format!("⚠️ Backend error #{}: {}", error_count, output_str));
                     }
-                    
+
                     // Look for specific common issues
                     if output_str.contains("Address already in use") {
                         add_log("🚨 CRITICAL: Port 8080 is already in use by another process!".to_string());
@@ -299,7 +323,7 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
                 }
             }
         }
-        
+
         if error_count > 0 {
             println!("⚠️ Backend process ended with {} errors detected", error_count);
         }
@@ -308,14 +332,36 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
 
 // Command to start the backend with bundled JRE
 #[tauri::command]
-pub async fn start_backend(app: tauri::AppHandle) -> Result<String, String> {
+pub async fn start_backend(
+    app: tauri::AppHandle,
+    connection_state: tauri::State<'_, AppConnectionState>,
+) -> Result<String, String> {
     add_log("🚀 start_backend() called - Attempting to start backend with bundled JRE...".to_string());
-    
+
+    // Check connection mode
+    let mode = {
+        let state = connection_state.0.lock().map_err(|e| {
+            let error_msg = format!("❌ Failed to access connection state: {}", e);
+            add_log(error_msg.clone());
+            error_msg
+        })?;
+        state.mode.clone()
+    };
+
+    match mode {
+        ConnectionMode::Offline => {
+            add_log("🔌 Running in Offline mode - starting local backend".to_string());
+        }
+        ConnectionMode::Server => {
+            add_log("🌐 Running in Server mode - starting local backend (for hybrid execution support)".to_string());
+        }
+    }
+
     // Check if backend is already running or starting
     if let Err(msg) = check_backend_status() {
         return Ok(msg);
     }
-    
+
     // Use Tauri's resource API to find the bundled JRE and JAR
     let resource_dir = app.path().resource_dir().map_err(|e| {
         let error_msg = format!("❌ Failed to get resource directory: {}", e);
@@ -323,53 +369,60 @@ pub async fn start_backend(app: tauri::AppHandle) -> Result<String, String> {
         reset_starting_flag();
         error_msg
     })?;
-    
+
     add_log(format!("🔍 Resource directory: {:?}", resource_dir));
-    
+
     // Find the bundled JRE
     let java_executable = find_bundled_jre(&resource_dir).map_err(|e| {
         reset_starting_flag();
         e
     })?;
-    
+
     // Find the Stirling-PDF JAR
     let jar_path = find_stirling_jar(&resource_dir).map_err(|e| {
         reset_starting_flag();
         e
     })?;
-    
+
     // Normalize the paths to remove Windows UNC prefix
     let normalized_java_path = normalize_path(&java_executable);
     let normalized_jar_path = normalize_path(&jar_path);
-    
+
     add_log(format!("📦 Found JAR file: {:?}", jar_path));
     add_log(format!("📦 Normalized JAR path: {:?}", normalized_jar_path));
     add_log(format!("📦 Normalized Java path: {:?}", normalized_java_path));
-    
+
     // Create and start the Java command
     run_stirling_pdf_jar(&app, &normalized_java_path, &normalized_jar_path).map_err(|e| {
         reset_starting_flag();
         e
     })?;
-    
+
     // Wait for the backend to start
     println!("⏳ Waiting for backend startup...");
     tokio::time::sleep(std::time::Duration::from_millis(10000)).await;
-    
+
     // Reset the starting flag since startup is complete
     reset_starting_flag();
     add_log("✅ Backend startup sequence completed, starting flag cleared".to_string());
-    
+
     Ok("Backend startup initiated successfully with bundled JRE".to_string())
 }
 
+// Get the dynamically assigned backend port
+#[tauri::command]
+pub fn get_backend_port() -> Option<u16> {
+    let port_guard = BACKEND_PORT.lock().unwrap();
+    *port_guard
+}
+
 // Cleanup function to stop backend on app exit
 pub fn cleanup_backend() {
     let mut process_guard = BACKEND_PROCESS.lock().unwrap();
     if let Some(child) = process_guard.take() {
         let pid = child.pid();
         add_log(format!("🧹 App shutting down, cleaning up backend process (PID: {})", pid));
-        
+
         match child.kill() {
             Ok(_) => {
                 add_log(format!("✅ Backend process (PID: {}) terminated during cleanup", pid));
@@ -380,4 +433,4 @@ pub fn cleanup_backend() {
             }
         }
     }
-}
+}

frontend/src-tauri/src/commands/connection.rs

@@ -0,0 +1,111 @@
+use crate::state::connection_state::{
+    AppConnectionState,
+    ConnectionMode,
+    ServerConfig,
+};
+use serde::{Deserialize, Serialize};
+use tauri::{AppHandle, State};
+use tauri_plugin_store::StoreExt;
+
+const STORE_FILE: &str = "connection.json";
+const FIRST_LAUNCH_KEY: &str = "setup_completed";
+const CONNECTION_MODE_KEY: &str = "connection_mode";
+const SERVER_CONFIG_KEY: &str = "server_config";
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ConnectionConfig {
+    pub mode: ConnectionMode,
+    pub server_config: Option<ServerConfig>,
+}
+
+#[tauri::command]
+pub async fn get_connection_config(
+    app_handle: AppHandle,
+    state: State<'_, AppConnectionState>,
+) -> Result<ConnectionConfig, String> {
+    // Try to load from store
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    let mode = store
+        .get(CONNECTION_MODE_KEY)
+        .and_then(|v| serde_json::from_value(v.clone()).ok())
+        .unwrap_or(ConnectionMode::Offline);
+
+    let server_config: Option<ServerConfig> = store
+        .get(SERVER_CONFIG_KEY)
+        .and_then(|v| serde_json::from_value(v.clone()).ok());
+
+    // Update in-memory state
+    if let Ok(mut conn_state) = state.0.lock() {
+        conn_state.mode = mode.clone();
+        conn_state.server_config = server_config.clone();
+    }
+
+    Ok(ConnectionConfig {
+        mode,
+        server_config,
+    })
+}
+
+#[tauri::command]
+pub async fn set_connection_mode(
+    app_handle: AppHandle,
+    state: State<'_, AppConnectionState>,
+    mode: ConnectionMode,
+    server_config: Option<ServerConfig>,
+) -> Result<(), String> {
+    log::info!("Setting connection mode: {:?}", mode);
+
+    // Update in-memory state
+    if let Ok(mut conn_state) = state.0.lock() {
+        conn_state.mode = mode.clone();
+        conn_state.server_config = server_config.clone();
+    }
+
+    // Save to store
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    store.set(
+        CONNECTION_MODE_KEY,
+        serde_json::to_value(&mode).map_err(|e| format!("Failed to serialize mode: {}", e))?,
+    );
+
+    if let Some(config) = &server_config {
+        store.set(
+            SERVER_CONFIG_KEY,
+            serde_json::to_value(config)
+                .map_err(|e| format!("Failed to serialize config: {}", e))?,
+        );
+    } else {
+        store.delete(SERVER_CONFIG_KEY);
+    }
+
+    // Mark setup as completed
+    store.set(FIRST_LAUNCH_KEY, serde_json::json!(true));
+
+    store
+        .save()
+        .map_err(|e| format!("Failed to save store: {}", e))?;
+
+    log::info!("Connection mode saved successfully");
+    Ok(())
+}
+
+
+#[tauri::command]
+pub async fn is_first_launch(app_handle: AppHandle) -> Result<bool, String> {
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    let setup_completed = store
+        .get(FIRST_LAUNCH_KEY)
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+
+    Ok(!setup_completed)
+}

frontend/src-tauri/src/commands/default_app.rs

@@ -0,0 +1,217 @@
+use crate::utils::add_log;
+
+#[cfg(any(target_os = "windows", target_os = "linux"))]
+use std::process::Command;
+
+/// Check if Stirling PDF is the default PDF handler
+#[tauri::command]
+pub fn is_default_pdf_handler() -> Result<bool, String> {
+    add_log("🔍 Checking if app is default PDF handler".to_string());
+
+    #[cfg(target_os = "windows")]
+    {
+        check_default_windows()
+    }
+
+    #[cfg(target_os = "macos")]
+    {
+        check_default_macos()
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        check_default_linux()
+    }
+}
+
+/// Attempt to set/prompt for Stirling PDF as default PDF handler
+#[tauri::command]
+pub fn set_as_default_pdf_handler() -> Result<String, String> {
+    add_log("⚙️ Attempting to set as default PDF handler".to_string());
+
+    #[cfg(target_os = "windows")]
+    {
+        set_default_windows()
+    }
+
+    #[cfg(target_os = "macos")]
+    {
+        set_default_macos()
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        set_default_linux()
+    }
+}
+
+// ============================================================================
+// Windows Implementation
+// ============================================================================
+
+#[cfg(target_os = "windows")]
+fn check_default_windows() -> Result<bool, String> {
+    use std::os::windows::process::CommandExt;
+    const CREATE_NO_WINDOW: u32 = 0x08000000;
+
+    // Query the default handler for .pdf extension
+    let output = Command::new("cmd")
+        .args(["/C", "assoc .pdf"])
+        .creation_flags(CREATE_NO_WINDOW)
+        .output()
+        .map_err(|e| format!("Failed to check default app: {}", e))?;
+
+    let assoc = String::from_utf8_lossy(&output.stdout);
+    add_log(format!("Windows PDF association: {}", assoc.trim()));
+
+    // Get the ProgID for .pdf files
+    if let Some(prog_id) = assoc.trim().strip_prefix(".pdf=") {
+        // Query what application handles this ProgID
+        let output = Command::new("cmd")
+            .args(["/C", &format!("ftype {}", prog_id)])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output()
+            .map_err(|e| format!("Failed to query file type: {}", e))?;
+
+        let ftype = String::from_utf8_lossy(&output.stdout);
+        add_log(format!("Windows file type: {}", ftype.trim()));
+
+        // Check if it contains "Stirling" or our app name
+        let is_default = ftype.to_lowercase().contains("stirling");
+        Ok(is_default)
+    } else {
+        Ok(false)
+    }
+}
+
+#[cfg(target_os = "windows")]
+fn set_default_windows() -> Result<String, String> {
+    // On Windows 10+, we need to open the Default Apps settings
+    // as programmatic setting requires a signed installer
+    Command::new("cmd")
+        .args(["/C", "start", "ms-settings:defaultapps"])
+        .spawn()
+        .map_err(|e| format!("Failed to open default apps settings: {}", e))?;
+
+    add_log("Opened Windows Default Apps settings".to_string());
+    Ok("opened_settings".to_string())
+}
+
+// ============================================================================
+// macOS Implementation (using LaunchServices framework)
+// ============================================================================
+
+#[cfg(target_os = "macos")]
+fn check_default_macos() -> Result<bool, String> {
+    use core_foundation::base::TCFType;
+    use core_foundation::string::{CFString, CFStringRef};
+    use std::os::raw::c_int;
+
+    // Define the LSCopyDefaultRoleHandlerForContentType function
+    #[link(name = "CoreServices", kind = "framework")]
+    extern "C" {
+        fn LSCopyDefaultRoleHandlerForContentType(
+            content_type: CFStringRef,
+            role: c_int,
+        ) -> CFStringRef;
+    }
+
+    const K_LS_ROLES_ALL: c_int = 0xFFFFFFFF_u32 as c_int;
+
+    unsafe {
+        // Query the default handler for "com.adobe.pdf" (PDF UTI - standard macOS identifier)
+        let pdf_uti = CFString::new("com.adobe.pdf");
+        let handler_ref = LSCopyDefaultRoleHandlerForContentType(pdf_uti.as_concrete_TypeRef(), K_LS_ROLES_ALL);
+
+        if handler_ref.is_null() {
+            add_log("No default PDF handler found".to_string());
+            return Ok(false);
+        }
+
+        let handler = CFString::wrap_under_create_rule(handler_ref);
+        let handler_str = handler.to_string();
+        add_log(format!("macOS PDF handler: {}", handler_str));
+
+        // Check if it's our bundle identifier
+        let is_default = handler_str == "stirling.pdf.dev";
+        Ok(is_default)
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn set_default_macos() -> Result<String, String> {
+    use core_foundation::base::TCFType;
+    use core_foundation::string::{CFString, CFStringRef};
+    use std::os::raw::c_int;
+
+    // Define the LSSetDefaultRoleHandlerForContentType function
+    #[link(name = "CoreServices", kind = "framework")]
+    extern "C" {
+        fn LSSetDefaultRoleHandlerForContentType(
+            content_type: CFStringRef,
+            role: c_int,
+            handler_bundle_id: CFStringRef,
+        ) -> c_int; // OSStatus
+    }
+
+    const K_LS_ROLES_ALL: c_int = 0xFFFFFFFF_u32 as c_int;
+
+    unsafe {
+        // Set our app as the default handler for PDF files
+        let pdf_uti = CFString::new("com.adobe.pdf");
+        let our_bundle_id = CFString::new("stirling.pdf.dev");
+
+        let status = LSSetDefaultRoleHandlerForContentType(
+            pdf_uti.as_concrete_TypeRef(),
+            K_LS_ROLES_ALL,
+            our_bundle_id.as_concrete_TypeRef(),
+        );
+
+        if status == 0 {
+            add_log("Successfully triggered default app dialog".to_string());
+            Ok("set_successfully".to_string())
+        } else {
+            let error_msg = format!("LaunchServices returned status: {}", status);
+            add_log(error_msg.clone());
+            Err(error_msg)
+        }
+    }
+}
+
+// ============================================================================
+// Linux Implementation
+// ============================================================================
+
+#[cfg(target_os = "linux")]
+fn check_default_linux() -> Result<bool, String> {
+    // Use xdg-mime to check the default application for PDF files
+    let output = Command::new("xdg-mime")
+        .args(["query", "default", "application/pdf"])
+        .output()
+        .map_err(|e| format!("Failed to check default app: {}", e))?;
+
+    let handler = String::from_utf8_lossy(&output.stdout);
+    add_log(format!("Linux PDF handler: {}", handler.trim()));
+
+    // Check if it's our .desktop file
+    let is_default = handler.trim() == "stirling-pdf.desktop";
+    Ok(is_default)
+}
+
+#[cfg(target_os = "linux")]
+fn set_default_linux() -> Result<String, String> {
+    // Use xdg-mime to set the default application for PDF files
+    let result = Command::new("xdg-mime")
+        .args(["default", "stirling-pdf.desktop", "application/pdf"])
+        .output()
+        .map_err(|e| format!("Failed to set default app: {}", e))?;
+
+    if result.status.success() {
+        add_log("Set as default PDF handler on Linux".to_string());
+        Ok("set_successfully".to_string())
+    } else {
+        let error = String::from_utf8_lossy(&result.stderr);
+        add_log(format!("Failed to set default: {}", error));
+        Err(format!("Failed to set as default: {}", error))
+    }
+}

frontend/src-tauri/src/commands/files.rs

@@ -14,23 +14,11 @@ pub fn add_opened_file(file_path: String) {
 // Command to get opened file paths (if app was launched with files)
 #[tauri::command]
 pub async fn get_opened_files() -> Result<Vec<String>, String> {
-    let mut all_files: Vec<String> = Vec::new();
-
-    // Get files from command line arguments (Windows/Linux 'Open With Stirling' behaviour)
-    let args: Vec<String> = std::env::args().collect();
-    let pdf_files: Vec<String> = args.iter()
-        .skip(1)
-        .filter(|arg| std::path::Path::new(arg).exists())
-        .cloned()
-        .collect();
-
-    all_files.extend(pdf_files);
-
-    // Add any files sent via events or other instances (macOS 'Open With Stirling' behaviour, also Windows/Linux extra files)
-    {
-        let opened_files = OPENED_FILES.lock().unwrap();
-        all_files.extend(opened_files.clone());
-    }
+    // Get all files from the OPENED_FILES store
+    // Command line args are processed in setup() callback and added to this store
+    // Additional files from second instances or events are also added here
+    let opened_files = OPENED_FILES.lock().unwrap();
+    let all_files = opened_files.clone();
 
     add_log(format!("📂 Returning {} opened file(s)", all_files.len()));
     Ok(all_files)

frontend/src-tauri/src/commands/health.rs

@@ -1,36 +1,16 @@
-// Command to check if backend is healthy
+use reqwest;
+
 #[tauri::command]
-pub async fn check_backend_health() -> Result<bool, String> {
-    let client = reqwest::Client::builder()
+pub async fn check_backend_health(port: u16) -> Result<bool, String> {
+    let url = format!("http://localhost:{}/api/v1/info/status", port);
+
+    match reqwest::Client::new()
+        .get(&url)
         .timeout(std::time::Duration::from_secs(5))
-        .build()
-        .map_err(|e| format!("Failed to create HTTP client: {}", e))?;
-    
-    match client.get("http://localhost:8080/api/v1/info/status").send().await {
-        Ok(response) => {
-            let status = response.status();
-            if status.is_success() {
-                match response.text().await {
-                    Ok(_body) => {
-                        println!("✅ Backend health check successful");
-                        Ok(true)
-                    }
-                    Err(e) => {
-                        println!("⚠️ Failed to read health response: {}", e);
-                        Ok(false)
-                    }
-                }
-            } else {
-                println!("⚠️ Health check failed with status: {}", status);
-                Ok(false)
-            }
-        }
-        Err(e) => {
-            // Only log connection errors if they're not the common "connection refused" during startup
-            if !e.to_string().contains("connection refused") && !e.to_string().contains("No connection could be made") {
-                println!("❌ Health check error: {}", e);
-            }
-            Ok(false)
-        }
+        .send()
+        .await
+    {
+        Ok(response) => Ok(response.status().is_success()),
+        Err(_) => Ok(false), // Return false instead of error for connection failures
     }
-}
+}

frontend/src-tauri/src/commands/mod.rs

@@ -1,7 +1,25 @@
 pub mod backend;
-pub mod health;
 pub mod files;
+pub mod connection;
+pub mod auth;
+pub mod default_app;
+pub mod health;
 
-pub use backend::{start_backend, cleanup_backend};
+pub use backend::{cleanup_backend, get_backend_port, start_backend};
+pub use files::{add_opened_file, clear_opened_files, get_opened_files};
+pub use connection::{
+    get_connection_config,
+    is_first_launch,
+    set_connection_mode,
+};
+pub use auth::{
+    clear_auth_token,
+    clear_user_info,
+    get_auth_token,
+    get_user_info,
+    login,
+    save_auth_token,
+    save_user_info,
+};
+pub use default_app::{is_default_pdf_handler, set_as_default_pdf_handler};
 pub use health::check_backend_health;
-pub use files::{get_opened_files, clear_opened_files, add_opened_file};

frontend/src-tauri/src/lib.rs

@@ -1,9 +1,31 @@
-use tauri::{RunEvent, WindowEvent, Emitter, Manager};
+use tauri::{Manager, RunEvent, WindowEvent, Emitter};
 
 mod utils;
 mod commands;
+mod state;
 
-use commands::{start_backend, check_backend_health, get_opened_files, clear_opened_files, cleanup_backend, add_opened_file};
+use commands::{
+    add_opened_file,
+    check_backend_health,
+    cleanup_backend,
+    clear_auth_token,
+    clear_opened_files,
+    clear_user_info,
+    is_default_pdf_handler,
+    get_auth_token,
+    get_backend_port,
+    get_connection_config,
+    get_opened_files,
+    get_user_info,
+    is_first_launch,
+    login,
+    save_auth_token,
+    save_user_info,
+    set_connection_mode,
+    set_as_default_pdf_handler,
+    start_backend,
+};
+use state::connection_state::AppConnectionState;
 use utils::{add_log, get_tauri_logs};
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
@@ -11,6 +33,9 @@ pub fn run() {
   tauri::Builder::default()
     .plugin(tauri_plugin_shell::init())
     .plugin(tauri_plugin_fs::init())
+    .plugin(tauri_plugin_http::init())
+    .plugin(tauri_plugin_store::Builder::new().build())
+    .manage(AppConnectionState::default())
     .plugin(tauri_plugin_single_instance::init(|app, args, _cwd| {
       // This callback runs when a second instance tries to start
       add_log(format!("📂 Second instance detected with args: {:?}", args));
@@ -23,9 +48,6 @@ pub fn run() {
           // Store file for later retrieval (in case frontend isn't ready yet)
           add_opened_file(arg.clone());
 
-          // Also emit event for immediate handling if frontend is ready
-          let _ = app.emit("file-opened", arg.clone());
-
           // Bring the existing window to front
           if let Some(window) = app.get_webview_window("main") {
             let _ = window.set_focus();
@@ -33,13 +55,45 @@ pub fn run() {
           }
         }
       }
+
+      // Emit a generic notification that files were added (frontend will re-read storage)
+      let _ = app.emit("files-changed", ());
     }))
     .setup(|_app| {
       add_log("🚀 Tauri app setup started".to_string());
+
+      // Process command line arguments on first launch
+      let args: Vec<String> = std::env::args().collect();
+      for arg in args.iter().skip(1) {
+        if std::path::Path::new(arg).exists() {
+          add_log(format!("📂 Initial file from command line: {}", arg));
+          add_opened_file(arg.clone());
+        }
+      }
+
       add_log("🔍 DEBUG: Setup completed".to_string());
       Ok(())
     })
-    .invoke_handler(tauri::generate_handler![start_backend, check_backend_health, get_opened_files, clear_opened_files, get_tauri_logs])
+    .invoke_handler(tauri::generate_handler![
+      start_backend,
+      get_backend_port,
+      get_opened_files,
+      clear_opened_files,
+      get_tauri_logs,
+      get_connection_config,
+      set_connection_mode,
+      is_default_pdf_handler,
+      set_as_default_pdf_handler,
+      is_first_launch,
+      check_backend_health,
+      login,
+      save_auth_token,
+      get_auth_token,
+      clear_auth_token,
+      save_user_info,
+      get_user_info,
+      clear_user_info,
+    ])
     .build(tauri::generate_context!())
     .expect("error while building tauri application")
     .run(|app_handle, event| {
@@ -58,6 +112,7 @@ pub fn run() {
         #[cfg(target_os = "macos")]
         RunEvent::Opened { urls } => {
           add_log(format!("📂 Tauri file opened event: {:?}", urls));
+          let mut added_files = false;
           for url in urls {
             let url_str = url.as_str();
             if url_str.starts_with("file://") {
@@ -65,11 +120,14 @@ pub fn run() {
               if file_path.ends_with(".pdf") {
                 add_log(format!("📂 Processing opened PDF: {}", file_path));
                 add_opened_file(file_path.to_string());
-                // Use unified event name for consistency across platforms
-                let _ = app_handle.emit("file-opened", file_path.to_string());
+                added_files = true;
               }
             }
           }
+          // Emit a generic notification that files were added (frontend will re-read storage)
+          if added_files {
+            let _ = app_handle.emit("files-changed", ());
+          }
         }
         _ => {
           // Only log unhandled events in debug mode to reduce noise

frontend/src-tauri/src/state/connection_state.rs

@@ -0,0 +1,45 @@
+use serde::{Deserialize, Serialize};
+use std::sync::Mutex;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum ConnectionMode {
+    Offline,
+    Server,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum ServerType {
+    SaaS,
+    SelfHosted,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ServerConfig {
+    pub url: String,
+    pub server_type: ServerType,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ConnectionState {
+    pub mode: ConnectionMode,
+    pub server_config: Option<ServerConfig>,
+}
+
+impl Default for ConnectionState {
+    fn default() -> Self {
+        Self {
+            mode: ConnectionMode::Offline,
+            server_config: None,
+        }
+    }
+}
+
+pub struct AppConnectionState(pub Mutex<ConnectionState>);
+
+impl Default for AppConnectionState {
+    fn default() -> Self {
+        Self(Mutex::new(ConnectionState::default()))
+    }
+}

frontend/src-tauri/src/state/mod.rs

@@ -0,0 +1 @@
+pub mod connection_state;

frontend/src-tauri/tauri.conf.json

@@ -51,6 +51,11 @@
         "desktopTemplate": "stirling-pdf.desktop"
       }
     },
+    "windows": {
+      "certificateThumbprint": null,
+      "digestAlgorithm": "sha256",
+      "timestampUrl": "http://timestamp.digicert.com"
+    },
     "macOS": {
       "minimumSystemVersion": "10.15",
       "signingIdentity": null,

frontend/src/core/App.tsx

@@ -1,5 +1,6 @@
 import { Suspense } from "react";
 import { AppProviders } from "@app/components/AppProviders";
+import { AppLayout } from "@app/components/AppLayout";
 import { LoadingFallback } from "@app/components/shared/LoadingFallback";
 import HomePage from "@app/pages/HomePage";
 import OnboardingTour from "@app/components/onboarding/OnboardingTour";
@@ -16,8 +17,10 @@ export default function App() {
   return (
     <Suspense fallback={<LoadingFallback />}>
       <AppProviders>
-        <HomePage />
-        <OnboardingTour />
+        <AppLayout>
+          <HomePage />
+          <OnboardingTour />
+        </AppLayout>
       </AppProviders>
     </Suspense>
   );

frontend/src/core/components/AppLayout.tsx

@@ -0,0 +1,31 @@
+import { ReactNode } from 'react';
+import { useBanner } from '@app/contexts/BannerContext';
+
+interface AppLayoutProps {
+  children: ReactNode;
+}
+
+/**
+ * App layout wrapper that handles banner rendering and viewport sizing
+ * Automatically adjusts child components to fit remaining space after banner
+ */
+export function AppLayout({ children }: AppLayoutProps) {
+  const { banner } = useBanner();
+
+  return (
+    <>
+      <style>{`
+        .h-screen,
+        .right-rail {
+          height: 100% !important;
+        }
+      `}</style>
+      <div style={{ height: '100vh', display: 'flex', flexDirection: 'column' }}>
+        {banner}
+        <div style={{ flex: 1, minHeight: 0, height: 0 }}>
+          {children}
+        </div>
+      </div>
+    </>
+  );
+}

frontend/src/core/components/AppProviders.tsx

@@ -16,6 +16,7 @@ import { OnboardingProvider } from "@app/contexts/OnboardingContext";
 import { TourOrchestrationProvider } from "@app/contexts/TourOrchestrationContext";
 import { AdminTourOrchestrationProvider } from "@app/contexts/AdminTourOrchestrationContext";
 import { PageEditorProvider } from "@app/contexts/PageEditorContext";
+import { BannerProvider } from "@app/contexts/BannerContext";
 import ErrorBoundary from "@app/components/shared/ErrorBoundary";
 import { useScarfTracking } from "@app/hooks/useScarfTracking";
 import { useAppInitialization } from "@app/hooks/useAppInitialization";
@@ -50,22 +51,23 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
     <PreferencesProvider>
       <RainbowThemeProvider>
         <ErrorBoundary>
-          <OnboardingProvider>
-            <AppConfigProvider
-              retryOptions={appConfigRetryOptions}
-              {...appConfigProviderProps}
-            >
-              <ScarfTrackingInitializer />
-              <FileContextProvider enableUrlSync={true} enablePersistence={true}>
-                <AppInitializer />
-                <ToolRegistryProvider>
-                  <NavigationProvider>
-                    <FilesModalProvider>
-                      <ToolWorkflowProvider>
-                        <HotkeyProvider>
-                          <SidebarProvider>
-                            <ViewerProvider>
-                              <PageEditorProvider>
+          <BannerProvider>
+            <OnboardingProvider>
+              <AppConfigProvider
+                retryOptions={appConfigRetryOptions}
+                {...appConfigProviderProps}
+              >
+                <ScarfTrackingInitializer />
+                <FileContextProvider enableUrlSync={true} enablePersistence={true}>
+                  <AppInitializer />
+                  <ToolRegistryProvider>
+                    <NavigationProvider>
+                      <FilesModalProvider>
+                        <ToolWorkflowProvider>
+                          <HotkeyProvider>
+                            <SidebarProvider>
+                              <ViewerProvider>
+                                <PageEditorProvider>
                                 <SignatureProvider>
                                   <RightRailProvider>
                                       <TourOrchestrationProvider>
@@ -76,16 +78,17 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
                                   </RightRailProvider>
                                 </SignatureProvider>
                               </PageEditorProvider>
-                            </ViewerProvider>
-                          </SidebarProvider>
-                        </HotkeyProvider>
-                      </ToolWorkflowProvider>
-                    </FilesModalProvider>
-                  </NavigationProvider>
-                </ToolRegistryProvider>
-              </FileContextProvider>
-            </AppConfigProvider>
-          </OnboardingProvider>
+                              </ViewerProvider>
+                            </SidebarProvider>
+                          </HotkeyProvider>
+                        </ToolWorkflowProvider>
+                      </FilesModalProvider>
+                    </NavigationProvider>
+                  </ToolRegistryProvider>
+                </FileContextProvider>
+              </AppConfigProvider>
+            </OnboardingProvider>
+          </BannerProvider>
         </ErrorBoundary>
       </RainbowThemeProvider>
     </PreferencesProvider>

frontend/src/core/components/annotation/shared/BaseAnnotationTool.tsx

@@ -1,9 +1,10 @@
-import React, { useState } from 'react';
+import React, { useEffect, useState } from 'react';
 import { Stack, Alert, Text } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
 import { DrawingControls } from '@app/components/annotation/shared/DrawingControls';
 import { ColorPicker } from '@app/components/annotation/shared/ColorPicker';
 import { usePDFAnnotation } from '@app/components/annotation/providers/PDFAnnotationProvider';
+import { useSignature } from '@app/contexts/SignatureContext';
 
 export interface AnnotationToolConfig {
   enableDrawing?: boolean;
@@ -32,10 +33,34 @@ export const BaseAnnotationTool: React.FC<BaseAnnotationToolProps> = ({
     undo,
     redo
   } = usePDFAnnotation();
+  const { historyApiRef } = useSignature();
 
   const [selectedColor, setSelectedColor] = useState('#000000');
   const [isColorPickerOpen, setIsColorPickerOpen] = useState(false);
   const [signatureData, setSignatureData] = useState<string | null>(null);
+  const [historyAvailability, setHistoryAvailability] = useState({ canUndo: false, canRedo: false });
+  const historyApiInstance = historyApiRef.current;
+
+  useEffect(() => {
+    if (!historyApiInstance) {
+      setHistoryAvailability({ canUndo: false, canRedo: false });
+      return;
+    }
+
+    const updateAvailability = () => {
+      setHistoryAvailability({
+        canUndo: historyApiInstance.canUndo?.() ?? false,
+        canRedo: historyApiInstance.canRedo?.() ?? false,
+      });
+    };
+
+    const unsubscribe = historyApiInstance.subscribe?.(updateAvailability);
+    updateAvailability();
+
+    return () => {
+      unsubscribe?.();
+    };
+  }, [historyApiInstance]);
 
   const handleSignatureDataChange = (data: string | null) => {
     setSignatureData(data);
@@ -54,6 +79,8 @@ export const BaseAnnotationTool: React.FC<BaseAnnotationToolProps> = ({
       <DrawingControls
         onUndo={undo}
         onRedo={redo}
+        canUndo={historyAvailability.canUndo}
+        canRedo={historyAvailability.canRedo}
         onPlaceSignature={config.showPlaceButton ? handlePlaceSignature : undefined}
         hasSignatureData={!!signatureData}
         disabled={disabled}
@@ -86,4 +113,4 @@ export const BaseAnnotationTool: React.FC<BaseAnnotationToolProps> = ({
       />
     </Stack>
   );
-};
+};

frontend/src/core/components/annotation/shared/ColorPicker.tsx

@@ -1,5 +1,6 @@
 import React from 'react';
 import { Modal, Stack, ColorPicker as MantineColorPicker, Group, Button, ColorSwatch } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
 
 interface ColorPickerProps {
   isOpen: boolean;
@@ -14,13 +15,16 @@ export const ColorPicker: React.FC<ColorPickerProps> = ({
   onClose,
   selectedColor,
   onColorChange,
-  title = "Choose Color"
+  title
 }) => {
+  const { t } = useTranslation();
+  const resolvedTitle = title ?? t('colorPicker.title', 'Choose colour');
+
   return (
     <Modal
       opened={isOpen}
       onClose={onClose}
-      title={title}
+      title={resolvedTitle}
       size="sm"
       centered
     >
@@ -36,7 +40,7 @@ export const ColorPicker: React.FC<ColorPickerProps> = ({
         />
         <Group justify="flex-end">
           <Button onClick={onClose}>
-            Done
+            {t('common.done', 'Done')}
           </Button>
         </Group>
       </Stack>
@@ -64,4 +68,4 @@ export const ColorSwatchButton: React.FC<ColorSwatchButtonProps> = ({
       onClick={onClick}
     />
   );
-};
+};

frontend/src/core/components/annotation/shared/DrawingCanvas.tsx

@@ -1,5 +1,6 @@
-import React, { useRef, useState } from 'react';
-import { Paper, Button, Modal, Stack, Text, Popover, ColorPicker as MantineColorPicker } from '@mantine/core';
+import React, { useEffect, useRef, useState } from 'react';
+import { Paper, Button, Modal, Stack, Text, Group } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
 import { ColorSwatchButton } from '@app/components/annotation/shared/ColorPicker';
 import PenSizeSelector from '@app/components/tools/sign/PenSizeSelector';
 import SignaturePad from 'signature_pad';
@@ -20,6 +21,7 @@ interface DrawingCanvasProps {
   modalWidth?: number;
   modalHeight?: number;
   additionalButtons?: React.ReactNode;
+  initialSignatureData?: string;
 }
 
 export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
@@ -34,12 +36,14 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
   disabled = false,
   width = 400,
   height = 150,
+  initialSignatureData,
 }) => {
+  const { t } = useTranslation();
   const previewCanvasRef = useRef<HTMLCanvasElement>(null);
   const modalCanvasRef = useRef<HTMLCanvasElement>(null);
   const padRef = useRef<SignaturePad | null>(null);
   const [modalOpen, setModalOpen] = useState(false);
-  const [colorPickerOpen, setColorPickerOpen] = useState(false);
+  const [savedSignatureData, setSavedSignatureData] = useState<string | null>(null);
 
   const initPad = (canvas: HTMLCanvasElement) => {
     if (!padRef.current) {
@@ -55,6 +59,18 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
         minDistance: 5,
         velocityFilterWeight: 0.7,
       });
+
+      // Restore saved signature data if it exists
+      if (savedSignatureData) {
+        const img = new Image();
+        img.onload = () => {
+          const ctx = canvas.getContext('2d');
+          if (ctx) {
+            ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
+          }
+        };
+        img.src = savedSignatureData;
+      }
     }
   };
 
@@ -104,36 +120,35 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
     return trimmedCanvas.toDataURL('image/png');
   };
 
+  const renderPreview = (dataUrl: string) => {
+    const canvas = previewCanvasRef.current;
+    if (!canvas) return;
+    const ctx = canvas.getContext('2d');
+    if (!ctx) return;
+
+    const img = new Image();
+    img.onload = () => {
+      ctx.clearRect(0, 0, canvas.width, canvas.height);
+      const scale = Math.min(canvas.width / img.width, canvas.height / img.height);
+      const scaledWidth = img.width * scale;
+      const scaledHeight = img.height * scale;
+      const x = (canvas.width - scaledWidth) / 2;
+      const y = (canvas.height - scaledHeight) / 2;
+
+      ctx.drawImage(img, x, y, scaledWidth, scaledHeight);
+    };
+    img.src = dataUrl;
+  };
+
   const closeModal = () => {
     if (padRef.current && !padRef.current.isEmpty()) {
       const canvas = modalCanvasRef.current;
       if (canvas) {
         const trimmedPng = trimCanvas(canvas);
+        const untrimmedPng = canvas.toDataURL('image/png');
+        setSavedSignatureData(untrimmedPng); // Save untrimmed for restoration
         onSignatureDataChange(trimmedPng);
-
-        // Update preview canvas with proper aspect ratio
-        const img = new Image();
-        img.onload = () => {
-          if (previewCanvasRef.current) {
-            const ctx = previewCanvasRef.current.getContext('2d');
-            if (ctx) {
-              ctx.clearRect(0, 0, previewCanvasRef.current.width, previewCanvasRef.current.height);
-
-              // Calculate scaling to fit within preview canvas while maintaining aspect ratio
-              const scale = Math.min(
-                previewCanvasRef.current.width / img.width,
-                previewCanvasRef.current.height / img.height
-              );
-              const scaledWidth = img.width * scale;
-              const scaledHeight = img.height * scale;
-              const x = (previewCanvasRef.current.width - scaledWidth) / 2;
-              const y = (previewCanvasRef.current.height - scaledHeight) / 2;
-
-              ctx.drawImage(img, x, y, scaledWidth, scaledHeight);
-            }
-          }
-        };
-        img.src = trimmedPng;
+        renderPreview(trimmedPng);
 
         if (onDrawingComplete) {
           onDrawingComplete();
@@ -157,6 +172,7 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
         ctx.clearRect(0, 0, previewCanvasRef.current.width, previewCanvasRef.current.height);
       }
     }
+    setSavedSignatureData(null); // Clear saved signature
     onSignatureDataChange(null);
   };
 
@@ -173,67 +189,73 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
     }
   };
 
+  useEffect(() => {
+    updatePenColor(selectedColor);
+  }, [selectedColor]);
+
+  useEffect(() => {
+    updatePenSize(penSize);
+  }, [penSize]);
+
+  useEffect(() => {
+    const canvas = previewCanvasRef.current;
+    if (!canvas) return;
+    const ctx = canvas.getContext('2d');
+    if (!ctx) return;
+
+    if (!initialSignatureData) {
+      ctx.clearRect(0, 0, canvas.width, canvas.height);
+      setSavedSignatureData(null);
+
+      return;
+    }
+
+    renderPreview(initialSignatureData);
+    setSavedSignatureData(initialSignatureData);
+  }, [initialSignatureData]);
+
   return (
     <>
       <Paper withBorder p="md">
         <Stack gap="sm">
-          <Text fw={500}>Draw your signature</Text>
           <PrivateContent>
-            <canvas
-              ref={previewCanvasRef}
-              width={width}
-              height={height}
-              style={{
-                border: '1px solid #ccc',
-                borderRadius: '4px',
-                cursor: disabled ? 'default' : 'pointer',
-                backgroundColor: '#ffffff',
-                width: '100%',
-              }}
-              onClick={disabled ? undefined : openModal}
-            />
+          <Text fw={500}>{t('sign.canvas.heading', 'Draw your signature')}</Text>
+          <canvas
+            ref={previewCanvasRef}
+            width={width}
+            height={height}
+            style={{
+              border: '1px solid #ccc',
+              borderRadius: '4px',
+              cursor: disabled ? 'default' : 'pointer',
+              backgroundColor: '#ffffff',
+              width: '100%',
+            }}
+            onClick={disabled ? undefined : openModal}
+          />
           </PrivateContent>
           <Text size="sm" c="dimmed" ta="center">
-            Click to open drawing canvas
+            {t('sign.canvas.clickToOpen', 'Click to open the drawing canvas')}
           </Text>
         </Stack>
       </Paper>
 
-      <Modal opened={modalOpen} onClose={closeModal} title="Draw Your Signature" size="auto" centered>
+      <Modal opened={modalOpen} onClose={closeModal} title={t('sign.canvas.modalTitle', 'Draw your signature')} size="auto" centered>
         <Stack gap="md">
-          <div style={{ display: 'flex', gap: '20px', alignItems: 'flex-end' }}>
-            <div>
-              <Text size="sm" fw={500} mb="xs">Color</Text>
-              <Popover
-                opened={colorPickerOpen}
-                onChange={setColorPickerOpen}
-                position="bottom-start"
-                withArrow
-                withinPortal={false}
-              >
-                <Popover.Target>
-                  <div>
-                    <ColorSwatchButton
-                      color={selectedColor}
-                      onClick={() => setColorPickerOpen(!colorPickerOpen)}
-                    />
-                  </div>
-                </Popover.Target>
-                <Popover.Dropdown>
-                  <MantineColorPicker
-                    format="hex"
-                    value={selectedColor}
-                    onChange={(color) => {
-                      onColorSwatchClick();
-                      updatePenColor(color);
-                    }}
-                    swatches={['#000000', '#0066cc', '#cc0000', '#cc6600', '#009900', '#6600cc']}
-                  />
-                </Popover.Dropdown>
-              </Popover>
-            </div>
-            <div>
-              <Text size="sm" fw={500} mb="xs">Pen Size</Text>
+          <Group gap="lg" align="flex-end" wrap="wrap">
+            <Stack gap={4} style={{ minWidth: 120 }}>
+              <Text size="sm" fw={500}>
+                {t('sign.canvas.colorLabel', 'Colour')}
+              </Text>
+              <ColorSwatchButton
+                color={selectedColor}
+                onClick={onColorSwatchClick}
+              />
+            </Stack>
+            <Stack gap={4} style={{ minWidth: 120 }}>
+              <Text size="sm" fw={500}>
+                {t('sign.canvas.penSizeLabel', 'Pen size')}
+              </Text>
               <PenSizeSelector
                 value={penSize}
                 inputValue={penSizeInput}
@@ -242,12 +264,12 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
                   updatePenSize(size);
                 }}
                 onInputChange={onPenSizeInputChange}
-                placeholder="Size"
+                placeholder={t('sign.canvas.penSizePlaceholder', 'Size')}
                 size="compact-sm"
-                style={{ width: '60px' }}
+                style={{ width: '80px' }}
               />
-            </div>
-          </div>
+            </Stack>
+          </Group>
 
           <PrivateContent>
             <canvas
@@ -262,8 +284,8 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
                 touchAction: 'none',
                 backgroundColor: 'white',
                 width: '100%',
-                maxWidth: '800px',
-                height: '400px',
+                maxWidth: '50rem',
+                height: '25rem',
                 cursor: 'crosshair',
               }}
             />
@@ -271,10 +293,10 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
 
           <div style={{ display: 'flex', justifyContent: 'space-between' }}>
             <Button variant="subtle" color="red" onClick={clear}>
-              Clear Canvas
+              {t('sign.canvas.clear', 'Clear canvas')}
             </Button>
             <Button onClick={closeModal}>
-              Done
+              {t('common.done', 'Done')}
             </Button>
           </div>
         </Stack>

frontend/src/core/components/annotation/shared/DrawingControls.tsx

@@ -1,6 +1,7 @@
 import React from 'react';
-import { Group, Button } from '@mantine/core';
+import { Group, Button, ActionIcon, Tooltip } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
+import { LocalIcon } from '@app/components/shared/LocalIcon';
 
 interface DrawingControlsProps {
   onUndo?: () => void;
@@ -8,8 +9,11 @@ interface DrawingControlsProps {
   onPlaceSignature?: () => void;
   hasSignatureData?: boolean;
   disabled?: boolean;
+  canUndo?: boolean;
+  canRedo?: boolean;
   showPlaceButton?: boolean;
   placeButtonText?: string;
+  additionalControls?: React.ReactNode;
 }
 
 export const DrawingControls: React.FC<DrawingControlsProps> = ({
@@ -18,30 +22,48 @@ export const DrawingControls: React.FC<DrawingControlsProps> = ({
   onPlaceSignature,
   hasSignatureData = false,
   disabled = false,
+  canUndo = true,
+  canRedo = true,
   showPlaceButton = true,
-  placeButtonText = "Update and Place"
+  placeButtonText = "Update and Place",
+  additionalControls,
 }) => {
   const { t } = useTranslation();
+  const undoDisabled = disabled || !canUndo;
+  const redoDisabled = disabled || !canRedo;
 
   return (
-    <Group gap="sm">
-      {/* Undo/Redo Controls */}
-      <Button
-        variant="outline"
-        onClick={onUndo}
-        disabled={disabled}
-        flex={1}
-      >
-        {t('sign.undo', 'Undo')}
-      </Button>
-      <Button
-        variant="outline"
-        onClick={onRedo}
-        disabled={disabled}
-        flex={1}
-      >
-        {t('sign.redo', 'Redo')}
-      </Button>
+    <Group gap="xs" wrap="nowrap" align="center">
+      {onUndo && (
+        <Tooltip label={t('sign.undo', 'Undo')}>
+          <ActionIcon
+            variant="subtle"
+            size="lg"
+            aria-label={t('sign.undo', 'Undo')}
+            onClick={onUndo}
+            disabled={undoDisabled}
+            color={undoDisabled ? 'gray' : 'blue'}
+          >
+            <LocalIcon icon="undo" width={20} height={20} style={{ color: 'currentColor' }} />
+          </ActionIcon>
+        </Tooltip>
+      )}
+      {onRedo && (
+        <Tooltip label={t('sign.redo', 'Redo')}>
+          <ActionIcon
+            variant="subtle"
+            size="lg"
+            aria-label={t('sign.redo', 'Redo')}
+            onClick={onRedo}
+            disabled={redoDisabled}
+            color={redoDisabled ? 'gray' : 'blue'}
+          >
+            <LocalIcon icon="redo" width={20} height={20} style={{ color: 'currentColor' }} />
+          </ActionIcon>
+        </Tooltip>
+      )}
+
+      {additionalControls}
 
       {/* Place Signature Button */}
       {showPlaceButton && onPlaceSignature && (
@@ -50,11 +72,11 @@ export const DrawingControls: React.FC<DrawingControlsProps> = ({
           color="blue"
           onClick={onPlaceSignature}
           disabled={disabled || !hasSignatureData}
-          flex={1}
+          ml="auto"
         >
           {placeButtonText}
         </Button>
       )}
     </Group>
   );
-};
+};

frontend/src/core/components/annotation/shared/TextInputWithFont.tsx

@@ -34,12 +34,18 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
   const [fontSizeInput, setFontSizeInput] = useState(fontSize.toString());
   const fontSizeCombobox = useCombobox();
   const [isColorPickerOpen, setIsColorPickerOpen] = useState(false);
+  const [colorInput, setColorInput] = useState(textColor);
 
   // Sync font size input with prop changes
   useEffect(() => {
     setFontSizeInput(fontSize.toString());
   }, [fontSize]);
 
+  // Sync color input with prop changes
+  useEffect(() => {
+    setColorInput(textColor);
+  }, [textColor]);
+
   const fontOptions = [
     { value: 'Helvetica', label: 'Helvetica' },
     { value: 'Times-Roman', label: 'Times' },
@@ -50,10 +56,15 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
 
   const fontSizeOptions = ['8', '12', '16', '20', '24', '28', '32', '36', '40', '48', '56', '64', '72', '80', '96', '112', '128', '144', '160', '176', '192', '200'];
 
+  // Validate hex color
+  const isValidHexColor = (color: string): boolean => {
+    return /^#[0-9A-Fa-f]{6}$/.test(color);
+  };
+
   return (
     <Stack gap="sm">
       <TextInput
-        label={label || t('sign.text.name', 'Signer Name')}
+        label={label || t('sign.text.name', 'Signer name')}
         placeholder={placeholder || t('sign.text.placeholder', 'Enter your full name')}
         value={text}
         onChange={(e) => onTextChange(e.target.value)}
@@ -63,7 +74,7 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
 
       {/* Font Selection */}
       <Select
-        label="Font"
+        label={t('sign.text.fontLabel', 'Font')}
         value={fontFamily}
         onChange={(value) => onFontFamilyChange(value || 'Helvetica')}
         data={fontOptions}
@@ -88,8 +99,8 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
         >
           <Combobox.Target>
             <TextInput
-              label="Font Size"
-              placeholder="Type or select font size (8-200)"
+              label={t('sign.text.fontSizeLabel', 'Font size')}
+              placeholder={t('sign.text.fontSizePlaceholder', 'Type or select font size (8-200)')}
               value={fontSizeInput}
               onChange={(event) => {
                 const value = event.currentTarget.value;
@@ -135,14 +146,29 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
         {onTextColorChange && (
           <Box>
             <TextInput
-              label="Text Color"
-              value={textColor}
-              readOnly
+              label={t('sign.text.colorLabel', 'Text colour')}
+              value={colorInput}
+              placeholder="#000000"
               disabled={disabled}
-              onClick={() => !disabled && setIsColorPickerOpen(true)}
-              style={{ cursor: disabled ? 'default' : 'pointer' }}
+              onChange={(e) => {
+                const value = e.currentTarget.value;
+                setColorInput(value);
+
+                // Update color if valid hex
+                if (isValidHexColor(value)) {
+                  onTextColorChange(value);
+                }
+              }}
+              onBlur={() => {
+                // Revert to valid color on blur if invalid
+                if (!isValidHexColor(colorInput)) {
+                  setColorInput(textColor);
+                }
+              }}
+              style={{ width: '100%' }}
               rightSection={
                 <Box
+                  onClick={() => !disabled && setIsColorPickerOpen(true)}
                   style={{
                     width: 24,
                     height: 24,
@@ -169,4 +195,4 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
       )}
     </Stack>
   );
-};
+};

frontend/src/core/components/fileEditor/FileEditorThumbnail.tsx

@@ -9,6 +9,7 @@ import VisibilityIcon from '@mui/icons-material/Visibility';
 import UnarchiveIcon from '@mui/icons-material/Unarchive';
 import PushPinIcon from '@mui/icons-material/PushPin';
 import PushPinOutlinedIcon from '@mui/icons-material/PushPinOutlined';
+import LockOpenIcon from '@mui/icons-material/LockOpen';
 import DragIndicatorIcon from '@mui/icons-material/DragIndicator';
 import { draggable, dropTargetForElements } from '@atlaskit/pragmatic-drag-and-drop/element/adapter';
 import { StirlingFileStub } from '@app/types/fileContext';
@@ -56,7 +57,14 @@ const FileEditorThumbnail = ({
   isSupported = true,
 }: FileEditorThumbnailProps) => {
   const { t } = useTranslation();
-  const { pinFile, unpinFile, isFilePinned, activeFiles, actions: fileActions } = useFileContext();
+  const {
+    pinFile,
+    unpinFile,
+    isFilePinned,
+    activeFiles,
+    actions: fileActions,
+    openEncryptedUnlockPrompt,
+  } = useFileContext();
   const { state } = useFileState();
   const hasError = state.ui.errorFileIds.includes(file.id);
 
@@ -77,6 +85,7 @@ const FileEditorThumbnail = ({
   const isZipFile = zipFileService.isZipFileStub(file);
 
   const pageCount = file.processedFile?.totalPages || 0;
+  const isEncrypted = Boolean(file.processedFile?.isEncrypted);
 
   const handleRef = useRef<HTMLSpanElement | null>(null);
 
@@ -301,6 +310,21 @@ const FileEditorThumbnail = ({
 
         {/* Action buttons group */}
         <div className={styles.headerActions}>
+          {isEncrypted && (
+            <Tooltip label={t('encryptedPdfUnlock.unlockPrompt', 'Unlock PDF to continue')}>
+              <ActionIcon
+                aria-label={t('encryptedPdfUnlock.unlockPrompt', 'Unlock PDF to continue')}
+                variant="subtle"
+                className={styles.headerIconButton}
+                onClick={(e) => {
+                  e.stopPropagation();
+                  openEncryptedUnlockPrompt(file.id);
+                }}
+              >
+                <LockOpenIcon fontSize="small" />
+              </ActionIcon>
+            </Tooltip>
+          )}
           {/* Pin/Unpin icon */}
           <Tooltip label={isPinned ? t('unpin', 'Unpin File (replace after tool run)') : t('pin', 'Pin File (keep active after tool run)')}>
             <ActionIcon

frontend/src/core/components/onboarding/OnboardingTour.tsx

@@ -1,4 +1,4 @@
-import React from "react";
+import React, { useMemo } from "react";
 import { TourProvider, useTour, type StepType } from '@reactour/tour';
 import { useOnboarding } from '@app/contexts/OnboardingContext';
 import { useTranslation } from 'react-i18next';
@@ -10,6 +10,7 @@ import ArrowForwardIcon from '@mui/icons-material/ArrowForward';
 import CheckIcon from '@mui/icons-material/Check';
 import TourWelcomeModal from '@app/components/onboarding/TourWelcomeModal';
 import '@app/components/onboarding/OnboardingTour.css';
+import i18n from "@app/i18n";
 
 // Enum case order defines order steps will appear
 enum TourStep {
@@ -120,7 +121,7 @@ export default function OnboardingTour() {
   } = useAdminTourOrchestration();
 
   // Define steps as object keyed by enum - TypeScript ensures all keys are present
-  const stepsConfig: Record<TourStep, StepType> = {
+  const stepsConfig: Record<TourStep, StepType> = useMemo(() => ({
     [TourStep.ALL_TOOLS]: {
       selector: '[data-tour="tool-panel"]',
       content: t('onboarding.allTools', 'This is the <strong>Tools</strong> panel, where you can browse and select from all available PDF tools.'),
@@ -248,10 +249,10 @@ export default function OnboardingTour() {
       position: 'right',
       padding: 10,
     },
-  };
+  }), [t]);
 
   // Define admin tour steps
-  const adminStepsConfig: Record<AdminTourStep, StepType> = {
+  const adminStepsConfig: Record<AdminTourStep, StepType> = useMemo(() => ({
     [AdminTourStep.WELCOME]: {
       selector: '[data-tour="config-button"]',
       content: t('adminOnboarding.welcome', "Welcome to the <strong>Admin Tour</strong>! Let's explore the powerful enterprise features and settings available to system administrators."),
@@ -363,7 +364,7 @@ export default function OnboardingTour() {
         removeAllGlows();
       },
     },
-  };
+  }), [t]);
 
   // Select steps based on tour type
   const steps = tourType === 'admin'
@@ -416,7 +417,7 @@ export default function OnboardingTour() {
         }}
       />
       <TourProvider
-        key={tourType}
+        key={`${tourType}-${i18n.language}`}
         steps={steps}
         maskClassName={tourType === 'admin' ? 'admin-tour-mask' : undefined}
         onClickClose={handleCloseTour}

frontend/src/core/components/shared/EncryptedPdfUnlockModal.tsx

@@ -0,0 +1,85 @@
+import { Modal, Stack, Text, Button, PasswordInput, Group } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { type KeyboardEventHandler } from 'react';
+import { Z_INDEX_OVER_FULLSCREEN_SURFACE } from '@app/styles/zIndex';
+
+interface EncryptedPdfUnlockModalProps {
+  opened: boolean;
+  fileName?: string;
+  password: string;
+  errorMessage?: string | null;
+  isProcessing: boolean;
+  onPasswordChange: (value: string) => void;
+  onUnlock: () => void;
+  onSkip: () => void;
+}
+
+const EncryptedPdfUnlockModal = ({
+  opened,
+  fileName,
+  password,
+  errorMessage,
+  isProcessing,
+  onPasswordChange,
+  onUnlock,
+  onSkip,
+}: EncryptedPdfUnlockModalProps) => {
+  const { t } = useTranslation();
+
+  const handleKeyDown: KeyboardEventHandler<HTMLInputElement> = (event) => {
+    if (event.key === 'Enter' && !isProcessing && password.trim().length > 0) {
+      onUnlock();
+    }
+  };
+
+  return (
+    <Modal
+      opened={opened}
+      onClose={onSkip}
+      title={t('encryptedPdfUnlock.title', 'Remove password to continue')}
+      centered
+      size="md"
+      closeOnClickOutside={!isProcessing}
+      closeOnEscape={!isProcessing}
+      zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
+    >
+      <Stack gap="md">
+        <Text fw={600} ta="center">{fileName}</Text>
+        <Text c="dimmed" ta="center">
+          {t(
+            'encryptedPdfUnlock.description',
+            'This PDF is password protected. Enter the password so you can continue working with it.'
+          )}
+        </Text>
+
+        <Stack gap={4}>
+          <PasswordInput
+            label={t('encryptedPdfUnlock.password.label', 'PDF password')}
+            placeholder={t('encryptedPdfUnlock.password.placeholder', 'Enter the PDF password')}
+            value={password}
+            onChange={(event) => onPasswordChange(event.currentTarget.value)}
+            onKeyDown={handleKeyDown}
+            disabled={isProcessing}
+            autoFocus
+          />
+          {errorMessage ? (
+            <Text c="red" size="sm">
+              {errorMessage}
+            </Text>
+          ) : null}
+        </Stack>
+
+        <Group justify="space-between">
+          <Button variant="light" color="var(--mantine-color-gray-8)" onClick={onSkip} disabled={isProcessing}>
+            {t('encryptedPdfUnlock.skip', 'Skip for now')}
+          </Button>
+          <Button onClick={onUnlock} loading={isProcessing} disabled={password.trim().length === 0}>
+            {t('encryptedPdfUnlock.unlock', 'Unlock & Continue')}
+          </Button>
+        </Group>
+      </Stack>
+    </Modal>
+  );
+};
+
+export default EncryptedPdfUnlockModal;

frontend/src/core/components/shared/InfoBanner.tsx

@@ -0,0 +1,72 @@
+import React from 'react';
+import { Paper, Group, Text, Button, ActionIcon } from '@mantine/core';
+import LocalIcon from '@app/components/shared/LocalIcon';
+
+interface InfoBannerProps {
+  icon: string;
+  message: string;
+  buttonText: string;
+  buttonIcon?: string;
+  onButtonClick: () => void;
+  onDismiss: () => void;
+  loading?: boolean;
+  show?: boolean;
+}
+
+/**
+ * Generic info banner component for displaying dismissible messages at the top of the app
+ */
+export const InfoBanner: React.FC<InfoBannerProps> = ({
+  icon,
+  message,
+  buttonText,
+  buttonIcon = 'check-circle-rounded',
+  onButtonClick,
+  onDismiss,
+  loading = false,
+  show = true,
+}) => {
+  if (!show) {
+    return null;
+  }
+
+  return (
+    <Paper
+      p="sm"
+      radius={0}
+      style={{
+        background: 'var(--mantine-color-blue-0)',
+        borderBottom: '1px solid var(--mantine-color-blue-2)',
+        position: 'relative',
+      }}
+    >
+      <Group gap="sm" align="center" wrap="nowrap">
+        <LocalIcon icon={icon} width="1.2rem" height="1.2rem" style={{ color: 'var(--mantine-color-blue-6)', flexShrink: 0 }} />
+        <Text fw={500} size="sm" style={{ color: 'var(--mantine-color-blue-9)' }}>
+          {message}
+        </Text>
+        <Button
+          variant="light"
+          color="blue"
+          size="xs"
+          onClick={onButtonClick}
+          loading={loading}
+          leftSection={<LocalIcon icon={buttonIcon} width="0.9rem" height="0.9rem" />}
+          style={{ flexShrink: 0 }}
+        >
+          {buttonText}
+        </Button>
+      </Group>
+      <ActionIcon
+        variant="subtle"
+        color="gray"
+        size="sm"
+        onClick={onDismiss}
+        aria-label="Dismiss"
+        style={{ position: 'absolute', top: '50%', right: '0.5rem', transform: 'translateY(-50%)' }}
+      >
+        <LocalIcon icon="close-rounded" width="1rem" height="1rem" />
+      </ActionIcon>
+    </Paper>
+  );
+};

frontend/src/core/components/shared/LanguageSelector.tsx

@@ -272,8 +272,13 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-
           <ScrollArea h={190} type="scroll">
             <div className={styles.languageGrid}>
               {languageOptions.map((option, index) => {
-                // Enable languages with >90% translation completion
-                const enabledLanguages = ['en-GB', 'ar-AR', 'de-DE', 'es-ES', 'fr-FR', 'it-IT', 'pt-BR', 'ru-RU', 'zh-CN'];
+                const enabledLanguages = [
+                  'en-GB', 'zh-CN', 'zh-TW', 'ar-AR', 'fa-IR', 'tr-TR', 'uk-UA', 'zh-BO', 'sl-SI',
+                  'ru-RU', 'ja-JP', 'ko-KR', 'hu-HU', 'ga-IE', 'bg-BG', 'es-ES', 'hi-IN', 'hr-HR',
+                  'el-GR', 'ml-ML', 'pt-BR', 'pl-PL', 'pt-PT', 'sk-SK', 'sr-LATN-RS', 'no-NB',
+                  'th-TH', 'vi-VN', 'az-AZ', 'eu-ES', 'de-DE', 'sv-SE', 'it-IT', 'ca-CA', 'id-ID',
+                  'ro-RO', 'fr-FR', 'nl-NL', 'da-DK', 'cs-CZ'
+                ];
                 const isDisabled = !enabledLanguages.includes(option.value);
 
                 return (

frontend/src/core/components/shared/UpdateModal.tsx

@@ -0,0 +1,415 @@
+import React, { useState, useEffect } from 'react';
+import { Modal, Stack, Text, Badge, Button, Group, Loader, Center, Divider, Box, Collapse } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { updateService, UpdateSummary, FullUpdateInfo, MachineInfo } from '@app/services/updateService';
+import { Z_INDEX_OVER_CONFIG_MODAL } from '@app/styles/zIndex';
+import WarningAmberIcon from '@mui/icons-material/WarningAmber';
+import InfoOutlinedIcon from '@mui/icons-material/InfoOutlined';
+import OpenInNewIcon from '@mui/icons-material/OpenInNew';
+import DownloadIcon from '@mui/icons-material/Download';
+import ExpandMoreIcon from '@mui/icons-material/ExpandMore';
+import ExpandLessIcon from '@mui/icons-material/ExpandLess';
+
+interface UpdateModalProps {
+  opened: boolean;
+  onClose: () => void;
+  currentVersion: string;
+  updateSummary: UpdateSummary;
+  machineInfo: MachineInfo;
+}
+
+const UpdateModal: React.FC<UpdateModalProps> = ({
+  opened,
+  onClose,
+  currentVersion,
+  updateSummary,
+  machineInfo,
+}) => {
+  const { t } = useTranslation();
+  const [fullUpdateInfo, setFullUpdateInfo] = useState<FullUpdateInfo | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [expandedVersions, setExpandedVersions] = useState<Set<number>>(new Set([0]));
+
+  useEffect(() => {
+    if (opened) {
+      setLoading(true);
+      setExpandedVersions(new Set([0]));
+      updateService.getFullUpdateInfo(currentVersion, machineInfo).then((info) => {
+        setFullUpdateInfo(info);
+        setLoading(false);
+      });
+    }
+  }, [opened, currentVersion, machineInfo]);
+
+  const toggleVersion = (index: number) => {
+    setExpandedVersions((prev) => {
+      const newSet = new Set(prev);
+      if (newSet.has(index)) {
+        newSet.delete(index);
+      } else {
+        newSet.add(index);
+      }
+      return newSet;
+    });
+  };
+
+  const getPriorityColor = (priority: string): string => {
+    switch (priority?.toLowerCase()) {
+      case 'urgent':
+        return 'red';
+      case 'normal':
+        return 'blue';
+      case 'minor':
+        return 'cyan';
+      case 'low':
+        return 'gray';
+      default:
+        return 'gray';
+    }
+  };
+
+  const getPriorityLabel = (priority: string): string => {
+    const key = priority?.toLowerCase();
+    return t(`update.priority.${key}`, priority || 'Normal');
+  };
+
+  const downloadUrl = updateService.getDownloadUrl(machineInfo);
+
+  return (
+    <Modal
+      opened={opened}
+      onClose={onClose}
+      title={
+        <Text fw={600} size="lg">
+          {t('update.modalTitle', 'Update Available')}
+        </Text>
+      }
+      centered
+      size="xl"
+      zIndex={Z_INDEX_OVER_CONFIG_MODAL}
+      styles={{
+        body: {
+          maxHeight: '75vh',
+          overflowY: 'auto',
+        },
+      }}
+    >
+      <Stack gap="lg" pt="md">
+        {/* Version Summary Section */}
+        <Box>
+          <Group justify="space-between" align="flex-start" wrap="nowrap" mb="md">
+            <Stack gap={4} style={{ flex: 1 }}>
+              <Text size="xs" c="dimmed" tt="uppercase" fw={500}>
+                {t('update.current', 'Current Version')}
+              </Text>
+              <Text fw={600} size="xl">
+                {currentVersion}
+              </Text>
+            </Stack>
+
+            <Stack gap={4} style={{ flex: 1 }} ta="center">
+              <Text size="xs" c="dimmed" tt="uppercase" fw={500}>
+                {t('update.priorityLabel', 'Priority')}
+              </Text>
+              <Badge
+                color={getPriorityColor(updateSummary.max_priority)}
+                size="lg"
+                variant="filled"
+                style={{ alignSelf: 'center' }}
+              >
+                {getPriorityLabel(updateSummary.max_priority)}
+              </Badge>
+            </Stack>
+
+            <Stack gap={4} style={{ flex: 1 }} ta="right">
+              <Text size="xs" c="dimmed" tt="uppercase" fw={500}>
+                {t('update.latest', 'Latest Version')}
+              </Text>
+              <Text fw={600} size="xl" c="blue">
+                {updateSummary.latest_version}
+              </Text>
+            </Stack>
+          </Group>
+
+          {updateSummary.latest_stable_version && (
+            <Box
+              style={{
+                background: 'var(--mantine-color-green-0)',
+                padding: '10px 16px',
+                borderRadius: '8px',
+                border: '1px solid var(--mantine-color-green-2)',
+              }}
+            >
+              <Group gap="xs" justify="center">
+                <Text size="sm" fw={500}>
+                  {t('update.latestStable', 'Latest Stable')}:
+                </Text>
+                <Text size="sm" fw={600} c="green">
+                  {updateSummary.latest_stable_version}
+                </Text>
+              </Group>
+            </Box>
+          )}
+        </Box>
+
+        {/* Recommended action */}
+        {updateSummary.recommended_action && (
+          <Box
+            style={{
+              background: 'var(--mantine-color-blue-light)',
+              padding: '12px 16px',
+              borderRadius: '8px',
+              border: '1px solid var(--mantine-color-blue-outline)',
+            }}
+          >
+            <Group gap="xs" wrap="nowrap" align="flex-start">
+              <InfoOutlinedIcon style={{ fontSize: 18, color: 'var(--mantine-color-blue-filled)', marginTop: 2 }} />
+              <Box style={{ flex: 1 }}>
+                <Text size="xs" fw={600} mb={4} tt="uppercase">
+                  {t('update.recommendedAction', 'Recommended Action')}
+                </Text>
+                <Text size="sm">
+                  {updateSummary.recommended_action}
+                </Text>
+              </Box>
+            </Group>
+          </Box>
+        )}
+
+        {/* Breaking changes warning */}
+        {updateSummary.any_breaking && (
+          <Box
+            style={{
+              background: 'var(--mantine-color-orange-light)',
+              padding: '12px 16px',
+              borderRadius: '8px',
+              border: '1px solid var(--mantine-color-orange-outline)',
+            }}
+          >
+            <Group gap="xs" wrap="nowrap" align="flex-start">
+              <WarningAmberIcon style={{ fontSize: 18, color: 'var(--mantine-color-orange-filled)', marginTop: 2 }} />
+              <Box style={{ flex: 1 }}>
+                <Text size="xs" fw={600} mb={4} tt="uppercase">
+                  {t('update.breakingChangesDetected', 'Breaking Changes Detected')}
+                </Text>
+                <Text size="sm">
+                  {t(
+                    'update.breakingChangesMessage',
+                    'Some versions contain breaking changes. Please review the migration guides below before updating.'
+                  )}
+                </Text>
+              </Box>
+            </Group>
+          </Box>
+        )}
+
+        {/* Migration guides */}
+        {updateSummary.migration_guides && updateSummary.migration_guides.length > 0 && (
+          <>
+            <Divider />
+            <Stack gap="xs">
+              <Text fw={600} size="sm" tt="uppercase" c="dimmed">
+                {t('update.migrationGuides', 'Migration Guides')}
+              </Text>
+              {updateSummary.migration_guides.map((guide, idx) => (
+                <Box
+                  key={idx}
+                  style={{
+                    border: '1px solid var(--mantine-color-gray-3)',
+                    padding: '12px 16px',
+                    borderRadius: '8px',
+                    background: 'var(--mantine-color-gray-0)',
+                  }}
+                >
+                  <Group justify="space-between" align="center" wrap="nowrap">
+                    <Box style={{ flex: 1 }}>
+                      <Text fw={600} size="sm">
+                        {t('update.version', 'Version')} {guide.version}
+                      </Text>
+                      <Text size="xs" c="dimmed" mt={4}>
+                        {guide.notes}
+                      </Text>
+                    </Box>
+                    <Button
+                      component="a"
+                      href={guide.url}
+                      target="_blank"
+                      variant="light"
+                      size="xs"
+                      rightSection={<OpenInNewIcon style={{ fontSize: 14 }} />}
+                    >
+                      {t('update.viewGuide', 'View Guide')}
+                    </Button>
+                  </Group>
+                </Box>
+              ))}
+            </Stack>
+          </>
+        )}
+
+        {/* Version details */}
+        <Divider />
+        {loading ? (
+          <Center py="xl">
+            <Stack align="center" gap="sm">
+              <Loader size="md" />
+              <Text size="sm" c="dimmed">
+                {t('update.loadingDetailedInfo', 'Loading detailed information...')}
+              </Text>
+            </Stack>
+          </Center>
+        ) : fullUpdateInfo && fullUpdateInfo.new_versions && fullUpdateInfo.new_versions.length > 0 ? (
+          <Stack gap="xs">
+            <Group justify="space-between" align="center">
+              <Text fw={600} size="sm" tt="uppercase" c="dimmed">
+                {t('update.availableUpdates', 'Available Updates')}
+              </Text>
+              <Badge variant="light" color="gray">
+                {fullUpdateInfo.new_versions.length} {fullUpdateInfo.new_versions.length === 1 ? 'version' : 'versions'}
+              </Badge>
+            </Group>
+            <Stack gap="xs">
+              {fullUpdateInfo.new_versions.map((version, index) => {
+                const isExpanded = expandedVersions.has(index);
+                return (
+                  <Box
+                    key={index}
+                    style={{
+                      border: '1px solid var(--mantine-color-gray-3)',
+                      borderRadius: '8px',
+                      overflow: 'hidden',
+                    }}
+                  >
+                    <Group
+                      justify="space-between"
+                      align="center"
+                      p="md"
+                      style={{
+                        cursor: 'pointer',
+                        background: isExpanded ? 'var(--mantine-color-gray-0)' : 'transparent',
+                        transition: 'background 0.15s ease',
+                      }}
+                      onClick={() => toggleVersion(index)}
+                    >
+                      <Group gap="md" style={{ flex: 1 }}>
+                        <Box>
+                          <Text fw={600} size="sm" c="dimmed" mb={2}>
+                            {t('update.version', 'Version')}
+                          </Text>
+                          <Text fw={700} size="lg">
+                            {version.version}
+                          </Text>
+                        </Box>
+                        <Badge color={getPriorityColor(version.priority)} size="md">
+                          {getPriorityLabel(version.priority)}
+                        </Badge>
+                      </Group>
+                      <Group gap="xs">
+                        <Button
+                          component="a"
+                          href={`https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v${version.version}`}
+                          target="_blank"
+                          variant="light"
+                          size="xs"
+                          onClick={(e) => e.stopPropagation()}
+                          rightSection={<OpenInNewIcon style={{ fontSize: 14 }} />}
+                        >
+                          {t('update.releaseNotes', 'Release Notes')}
+                        </Button>
+                        {isExpanded ? (
+                          <ExpandLessIcon style={{ fontSize: 20, color: 'var(--mantine-color-gray-6)' }} />
+                        ) : (
+                          <ExpandMoreIcon style={{ fontSize: 20, color: 'var(--mantine-color-gray-6)' }} />
+                        )}
+                      </Group>
+                    </Group>
+
+                    <Collapse in={isExpanded}>
+                      <Box p="md" pt={0} style={{ borderTop: '1px solid var(--mantine-color-gray-2)' }}>
+                        <Stack gap="md" mt="md">
+                          <Box>
+                            <Text fw={600} size="sm" mb={6}>
+                              {version.announcement.title}
+                            </Text>
+                            <Text size="sm" c="dimmed" style={{ lineHeight: 1.6 }}>
+                              {version.announcement.message}
+                            </Text>
+                          </Box>
+
+                          {version.compatibility.breaking_changes && (
+                            <Box
+                              style={{
+                                background: 'var(--mantine-color-orange-light)',
+                                padding: '12px',
+                                borderRadius: '6px',
+                                border: '1px solid var(--mantine-color-orange-outline)',
+                              }}
+                            >
+                              <Group gap="xs" align="flex-start" wrap="nowrap" mb="xs">
+                                <WarningAmberIcon style={{ fontSize: 16, color: 'var(--mantine-color-orange-filled)', marginTop: 2 }} />
+                                <Text size="xs" fw={600} tt="uppercase">
+                                  {t('update.breakingChanges', 'Breaking Changes')}
+                                </Text>
+                              </Group>
+                              <Text size="sm" mb="xs">
+                                {version.compatibility.breaking_description ||
+                                  t('update.breakingChangesDefault', 'This version contains breaking changes.')}
+                              </Text>
+                              {version.compatibility.migration_guide_url && (
+                                <Button
+                                  component="a"
+                                  href={version.compatibility.migration_guide_url}
+                                  target="_blank"
+                                  variant="light"
+                                  color="orange"
+                                  size="xs"
+                                  rightSection={<OpenInNewIcon style={{ fontSize: 14 }} />}
+                                >
+                                  {t('update.migrationGuide', 'Migration Guide')}
+                                </Button>
+                              )}
+                            </Box>
+                          )}
+                        </Stack>
+                      </Box>
+                    </Collapse>
+                  </Box>
+                );
+              })}
+            </Stack>
+          </Stack>
+        ) : null}
+
+        {/* Action buttons */}
+        <Divider />
+        <Group justify="flex-end" gap="sm">
+          <Button variant="default" onClick={onClose}>
+            {t('update.close', 'Close')}
+          </Button>
+          <Button
+            variant="light"
+            component="a"
+            href="https://github.com/Stirling-Tools/Stirling-PDF/releases"
+            target="_blank"
+            rightSection={<OpenInNewIcon style={{ fontSize: 16 }} />}
+          >
+            {t('update.viewAllReleases', 'View All Releases')}
+          </Button>
+          {downloadUrl && (
+            <Button
+              component="a"
+              href={downloadUrl}
+              target="_blank"
+              color="green"
+              leftSection={<DownloadIcon style={{ fontSize: 16 }} />}
+            >
+              {t('update.downloadLatest', 'Download Latest')}
+            </Button>
+          )}
+        </Group>
+      </Stack>
+    </Modal>
+  );
+};
+
+export default UpdateModal;

frontend/src/core/components/shared/config/configSections/GeneralSection.tsx

@@ -1,10 +1,12 @@
 import React, { useState, useEffect } from 'react';
-import { Paper, Stack, Switch, Text, Tooltip, NumberInput, SegmentedControl, Code, Group, Anchor, ActionIcon } from '@mantine/core';
+import { Paper, Stack, Switch, Text, Tooltip, NumberInput, SegmentedControl, Code, Group, Anchor, ActionIcon, Button, Badge, Alert } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
 import { usePreferences } from '@app/contexts/PreferencesContext';
 import { useAppConfig } from '@app/contexts/AppConfigContext';
 import type { ToolPanelMode } from '@app/constants/toolPanel';
 import LocalIcon from '@app/components/shared/LocalIcon';
+import { updateService, UpdateSummary } from '@app/services/updateService';
+import UpdateModal from '@app/components/shared/UpdateModal';
 
 const DEFAULT_AUTO_UNZIP_FILE_LIMIT = 4;
 const BANNER_DISMISSED_KEY = 'stirlingpdf_features_banner_dismissed';
@@ -22,12 +24,50 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({ hideTitle = false }) =>
     // Check localStorage on mount
     return localStorage.getItem(BANNER_DISMISSED_KEY) === 'true';
   });
+  const [updateSummary, setUpdateSummary] = useState<UpdateSummary | null>(null);
+  const [updateModalOpened, setUpdateModalOpened] = useState(false);
+  const [checkingUpdate, setCheckingUpdate] = useState(false);
 
   // Sync local state with preference changes
   useEffect(() => {
     setFileLimitInput(preferences.autoUnzipFileLimit);
   }, [preferences.autoUnzipFileLimit]);
 
+  // Check for updates on mount
+  useEffect(() => {
+    if (config?.appVersion && config?.machineType) {
+      checkForUpdate();
+    }
+  }, [config?.appVersion, config?.machineType]);
+
+  const checkForUpdate = async () => {
+    if (!config?.appVersion || !config?.machineType) {
+      return;
+    }
+
+    setCheckingUpdate(true);
+    const machineInfo = {
+      machineType: config.machineType,
+      activeSecurity: config.activeSecurity ?? false,
+      licenseType: config.license ?? 'NORMAL',
+    };
+
+    const summary = await updateService.getUpdateSummary(config.appVersion, machineInfo);
+    if (summary && summary.latest_version) {
+      const isNewerVersion = updateService.compareVersions(summary.latest_version, config.appVersion) > 0;
+      if (isNewerVersion) {
+        setUpdateSummary(summary);
+      } else {
+        // Clear any existing update summary if user is on latest version
+        setUpdateSummary(null);
+      }
+    } else {
+      // No update available (latest_version is null) - clear any existing update summary
+      setUpdateSummary(null);
+    }
+    setCheckingUpdate(false);
+  };
+
   // Check if login is disabled
   const loginDisabled = !config?.enableLogin;
 
@@ -94,6 +134,93 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({ hideTitle = false }) =>
         </Paper>
       )}
 
+      {/* Update Check Section */}
+      {config?.appVersion && (
+        <Paper withBorder p="md" radius="md">
+          <Stack gap="md">
+            <div>
+              <Group justify="space-between" align="center">
+                <div>
+                  <Text fw={600} size="sm">
+                    {t('settings.general.updates.title', 'Software Updates')}
+                  </Text>
+                  <Text size="xs" c="dimmed" mt={4}>
+                    {t('settings.general.updates.description', 'Check for updates and view version information')}
+                  </Text>
+                </div>
+                {updateSummary && (
+                  <Badge
+                    color={updateSummary.max_priority === 'urgent' ? 'red' : 'blue'}
+                    variant="filled"
+                  >
+                    {updateSummary.max_priority === 'urgent'
+                      ? t('update.urgentUpdateAvailable', 'Urgent Update')
+                      : t('update.updateAvailable', 'Update Available')}
+                  </Badge>
+                )}
+              </Group>
+            </div>
+
+            <Group justify="space-between" align="center">
+              <div>
+                <Text size="sm" c="dimmed">
+                  {t('settings.general.updates.currentVersion', 'Current Version')}:{' '}
+                  <Text component="span" fw={500}>
+                    {config.appVersion}
+                  </Text>
+                </Text>
+                {updateSummary && (
+                  <Text size="sm" c="dimmed" mt={4}>
+                    {t('settings.general.updates.latestVersion', 'Latest Version')}:{' '}
+                    <Text component="span" fw={500} c="blue">
+                      {updateSummary.latest_version}
+                    </Text>
+                  </Text>
+                )}
+              </div>
+              <Group gap="sm">
+                <Button
+                  size="sm"
+                  variant="default"
+                  onClick={checkForUpdate}
+                  loading={checkingUpdate}
+                  leftSection={<LocalIcon icon="refresh-rounded" width="1rem" height="1rem" />}
+                >
+                  {t('settings.general.updates.checkForUpdates', 'Check for Updates')}
+                </Button>
+                {updateSummary && (
+                  <Button
+                    size="sm"
+                    color={updateSummary.max_priority === 'urgent' ? 'red' : 'blue'}
+                    onClick={() => setUpdateModalOpened(true)}
+                    leftSection={<LocalIcon icon="system-update-rounded" width="1rem" height="1rem" />}
+                  >
+                    {t('settings.general.updates.viewDetails', 'View Details')}
+                  </Button>
+                )}
+              </Group>
+            </Group>
+
+            {updateSummary?.any_breaking && (
+              <Alert
+                color="orange"
+                title={t('update.breakingChangesDetected', 'Breaking Changes Detected')}
+                styles={{
+                  title: { fontWeight: 600 }
+                }}
+              >
+                <Text size="sm">
+                  {t(
+                    'update.breakingChangesMessage',
+                    'Some versions contain breaking changes. Please review the migration guides before updating.'
+                  )}
+                </Text>
+              </Alert>
+            )}
+          </Stack>
+        </Paper>
+      )}
+
       <Paper withBorder p="md" radius="md">
         <Stack gap="md">
           <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
@@ -114,6 +241,34 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({ hideTitle = false }) =>
               ]}
             />
           </div>
+          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
+            <div>
+              <Text fw={500} size="sm">
+                {t('settings.general.hideUnavailableTools', 'Hide unavailable tools')}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t('settings.general.hideUnavailableToolsDescription', 'Remove tools that have been disabled by your server instead of showing them greyed out.')}
+              </Text>
+            </div>
+            <Switch
+              checked={preferences.hideUnavailableTools}
+              onChange={(event) => updatePreference('hideUnavailableTools', event.currentTarget.checked)}
+            />
+          </div>
+          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
+            <div>
+              <Text fw={500} size="sm">
+                {t('settings.general.hideUnavailableConversions', 'Hide unavailable conversions')}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t('settings.general.hideUnavailableConversionsDescription', 'Remove disabled conversion options in the Convert tool instead of showing them greyed out.')}
+              </Text>
+            </div>
+            <Switch
+              checked={preferences.hideUnavailableConversions}
+              onChange={(event) => updatePreference('hideUnavailableConversions', event.currentTarget.checked)}
+            />
+          </div>
           <Tooltip
             label={t('settings.general.autoUnzipTooltip', 'Automatically extract ZIP files returned from API operations. Disable to keep ZIP files intact. This does not affect automation workflows.')}
             multiline
@@ -170,6 +325,21 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({ hideTitle = false }) =>
           </Tooltip>
         </Stack>
       </Paper>
+
+      {/* Update Modal */}
+      {updateSummary && config?.appVersion && config?.machineType && (
+        <UpdateModal
+          opened={updateModalOpened}
+          onClose={() => setUpdateModalOpened(false)}
+          currentVersion={config.appVersion}
+          updateSummary={updateSummary}
+          machineInfo={{
+            machineType: config.machineType,
+            activeSecurity: config.activeSecurity ?? false,
+            licenseType: config.license ?? 'NORMAL',
+          }}
+        />
+      )}
     </Stack>
   );
 };

frontend/src/core/components/tools/addAttachments/AddAttachmentsSettings.tsx

@@ -4,7 +4,7 @@
  * Allows selecting files to attach to PDFs.
  */
 
-import { Stack, Text, Group, ActionIcon, Alert, ScrollArea, Button } from "@mantine/core";
+import { Stack, Text, Group, ActionIcon, ScrollArea, Button } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { AddAttachmentsParameters } from "@app/hooks/tools/addAttachments/useAddAttachmentsParameters";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -20,16 +20,7 @@ const AddAttachmentsSettings = ({ parameters, onParameterChange, disabled = fals
 
   return (
     <Stack gap="md">
-      <Alert color="blue" variant="light">
-        <Text size="sm">
-          {t("AddAttachmentsRequest.info", "Select files to attach to your PDF. These files will be embedded and accessible through the PDF's attachment panel.")}
-        </Text>
-      </Alert>
-
       <Stack gap="xs">
-        <Text size="sm" fw={500}>
-          {t("AddAttachmentsRequest.selectFiles", "Select Files to Attach")}
-        </Text>
         <input
           type="file"
           multiple

frontend/src/core/components/tools/convert/ConvertSettings.tsx

@@ -8,6 +8,7 @@ import { getConversionEndpoints } from "@app/data/toolsTaxonomy";
 import { useFileSelection } from "@app/contexts/FileContext";
 import { useFileState } from "@app/contexts/FileContext";
 import { detectFileExtension } from "@app/utils/fileUtils";
+import { usePreferences } from "@app/contexts/PreferencesContext";
 import GroupedFormatDropdown from "@app/components/tools/convert/GroupedFormatDropdown";
 import ConvertToImageSettings from "@app/components/tools/convert/ConvertToImageSettings";
 import ConvertFromImageSettings from "@app/components/tools/convert/ConvertFromImageSettings";
@@ -47,8 +48,12 @@ const ConvertSettings = ({
   const { setSelectedFiles } = useFileSelection();
   const { state, selectors } = useFileState();
   const activeFiles = state.files.ids;
+  const { preferences } = usePreferences();
 
-  const allEndpoints = useMemo(() => getConversionEndpoints(EXTENSION_TO_ENDPOINT), []);
+  const allEndpoints = useMemo(() => {
+    const endpoints = getConversionEndpoints(EXTENSION_TO_ENDPOINT);
+    return endpoints;
+  }, []);
 
   const { endpointStatus } = useMultipleEndpointsEnabled(allEndpoints);
 
@@ -56,7 +61,8 @@ const ConvertSettings = ({
     const endpointKey = EXTENSION_TO_ENDPOINT[fromExt]?.[toExt];
     if (!endpointKey) return false;
 
-    return endpointStatus[endpointKey] === true;
+    const isAvailable = endpointStatus[endpointKey] === true;
+    return isAvailable;
   };
 
   // Enhanced FROM options with endpoint availability
@@ -74,6 +80,12 @@ const ConvertSettings = ({
       };
     });
 
+    // Filter out unavailable source formats if preference is enabled
+    let filteredOptions = baseOptions;
+    if (preferences.hideUnavailableConversions) {
+      filteredOptions = baseOptions.filter(opt => opt.enabled !== false);
+    }
+
     // Add dynamic format option if current selection is a file-<extension> format
     if (parameters.fromExtension && parameters.fromExtension.startsWith('file-')) {
       const extension = parameters.fromExtension.replace('file-', '');
@@ -85,22 +97,32 @@ const ConvertSettings = ({
       };
 
       // Add the dynamic option at the beginning
-      return [dynamicOption, ...baseOptions];
+      return [dynamicOption, ...filteredOptions];
     }
 
-    return baseOptions;
-  }, [parameters.fromExtension, endpointStatus]);
+    return filteredOptions;
+  }, [parameters.fromExtension, endpointStatus, preferences.hideUnavailableConversions]);
 
   // Enhanced TO options with endpoint availability
   const enhancedToOptions = useMemo(() => {
     if (!parameters.fromExtension) return [];
 
     const availableOptions = getAvailableToExtensions(parameters.fromExtension) || [];
-    return availableOptions.map(option => ({
-      ...option,
-      enabled: isConversionAvailable(parameters.fromExtension, option.value)
-    }));
-  }, [parameters.fromExtension, endpointStatus]);
+    const enhanced = availableOptions.map(option => {
+      const enabled = isConversionAvailable(parameters.fromExtension, option.value);
+      return {
+        ...option,
+        enabled
+      };
+    });
+
+    // Filter out unavailable conversions if preference is enabled
+    if (preferences.hideUnavailableConversions) {
+      return enhanced.filter(opt => opt.enabled !== false);
+    }
+
+    return enhanced;
+  }, [parameters.fromExtension, endpointStatus, preferences.hideUnavailableConversions]);
 
   const resetParametersToDefaults = () => {
     onParameterChange('imageOptions', {

frontend/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx

@@ -0,0 +1,313 @@
+import { Fragment } from 'react';
+import { useTranslation } from 'react-i18next';
+import {
+  ActionIcon,
+  Badge,
+  Button,
+  Flex,
+  Group,
+  NumberInput,
+  Paper,
+  Stack,
+  Text,
+  TextInput,
+  Tooltip,
+} from '@mantine/core';
+import LocalIcon from '@app/components/shared/LocalIcon';
+import { BookmarkNode, createBookmarkNode } from '@app/utils/editTableOfContents';
+
+interface BookmarkEditorProps {
+  bookmarks: BookmarkNode[];
+  onChange: (bookmarks: BookmarkNode[]) => void;
+  disabled?: boolean;
+}
+
+const updateTree = (
+  nodes: BookmarkNode[],
+  targetId: string,
+  updater: (bookmark: BookmarkNode) => BookmarkNode,
+): BookmarkNode[] => {
+  return nodes.map(node => {
+    if (node.id === targetId) {
+      return updater(node);
+    }
+
+    if (node.children.length === 0) {
+      return node;
+    }
+
+    const updatedChildren = updateTree(node.children, targetId, updater);
+    if (updatedChildren !== node.children) {
+      return { ...node, children: updatedChildren };
+    }
+
+    return node;
+  });
+};
+
+const removeFromTree = (nodes: BookmarkNode[], targetId: string): BookmarkNode[] => {
+  return nodes
+    .filter(node => node.id !== targetId)
+    .map(node => ({
+      ...node,
+      children: removeFromTree(node.children, targetId),
+    }));
+};
+
+const addChildToTree = (
+  nodes: BookmarkNode[],
+  parentId: string,
+  child: BookmarkNode,
+): { nodes: BookmarkNode[]; added: boolean } => {
+  let added = false;
+  const next = nodes.map(node => {
+    if (node.id === parentId) {
+      added = true;
+      return { ...node, expanded: true, children: [...node.children, child] };
+    }
+
+    if (node.children.length === 0) {
+      return node;
+    }
+
+    const result = addChildToTree(node.children, parentId, child);
+    if (result.added) {
+      added = true;
+      return { ...node, children: result.nodes };
+    }
+
+    return node;
+  });
+
+  return { nodes: added ? next : nodes, added };
+};
+
+const addSiblingInTree = (
+  nodes: BookmarkNode[],
+  targetId: string,
+  sibling: BookmarkNode,
+): { nodes: BookmarkNode[]; added: boolean } => {
+  let added = false;
+  const result: BookmarkNode[] = [];
+
+  nodes.forEach(node => {
+    let currentNode = node;
+
+    if (!added && node.children.length > 0) {
+      const childResult = addSiblingInTree(node.children, targetId, sibling);
+      if (childResult.added) {
+        added = true;
+        currentNode = { ...node, children: childResult.nodes };
+      }
+    }
+
+    result.push(currentNode);
+
+    if (!added && node.id === targetId) {
+      result.push(sibling);
+      added = true;
+    }
+  });
+
+  return { nodes: added ? result : nodes, added };
+};
+
+export default function BookmarkEditor({ bookmarks, onChange, disabled }: BookmarkEditorProps) {
+  const { t } = useTranslation();
+
+  const handleAddTopLevel = () => {
+    const newBookmark = createBookmarkNode({ title: t('editTableOfContents.editor.defaultTitle', 'New bookmark') });
+    onChange([...bookmarks, newBookmark]);
+  };
+
+  const handleTitleChange = (id: string, value: string) => {
+    onChange(updateTree(bookmarks, id, bookmark => ({ ...bookmark, title: value })));
+  };
+
+  const handlePageChange = (id: string, value: number | string) => {
+    const page = typeof value === 'number' ? value : parseInt(value, 10);
+    onChange(updateTree(bookmarks, id, bookmark => ({ ...bookmark, pageNumber: Number.isFinite(page) && page > 0 ? page : 1 })));
+  };
+
+  const handleToggle = (id: string) => {
+    onChange(updateTree(bookmarks, id, bookmark => ({ ...bookmark, expanded: !bookmark.expanded })));
+  };
+
+  const handleRemove = (id: string) => {
+    const confirmation = t(
+      'editTableOfContents.editor.confirmRemove',
+      'Remove this bookmark and all of its children?'
+    );
+    if (window.confirm(confirmation)) {
+      onChange(removeFromTree(bookmarks, id));
+    }
+  };
+
+  const handleAddChild = (parentId: string) => {
+    const child = createBookmarkNode({ title: t('editTableOfContents.editor.defaultChildTitle', 'Child bookmark') });
+    const { nodes, added } = addChildToTree(bookmarks, parentId, child);
+    onChange(added ? nodes : [...bookmarks, child]);
+  };
+
+  const handleAddSibling = (targetId: string) => {
+    const sibling = createBookmarkNode({ title: t('editTableOfContents.editor.defaultSiblingTitle', 'New bookmark') });
+    const { nodes, added } = addSiblingInTree(bookmarks, targetId, sibling);
+    onChange(added ? nodes : [...bookmarks, sibling]);
+  };
+
+  const renderBookmark = (bookmark: BookmarkNode, level = 0) => {
+    const hasChildren = bookmark.children.length > 0;
+    const chevronIcon = bookmark.expanded ? 'expand-more-rounded' : 'chevron-right-rounded';
+
+    return (
+      <Paper
+        key={bookmark.id}
+        radius="md"
+        withBorder
+        p="md"
+        style={{
+          borderColor: 'var(--border-default)',
+          background: level === 0 ? 'var(--bg-surface)' : 'var(--bg-muted)',
+        }}
+      >
+        <Stack gap="sm">
+          <Flex align="flex-start" justify="space-between" gap="md">
+            <Group gap="sm" align="flex-start">
+              <ActionIcon
+                variant="subtle"
+                color="gray"
+                onClick={() => hasChildren && handleToggle(bookmark.id)}
+                disabled={disabled || !hasChildren}
+                aria-label={t('editTableOfContents.editor.actions.toggle', 'Toggle children')}
+                style={{ marginTop: 4 }}
+              >
+                <LocalIcon icon={chevronIcon} />
+              </ActionIcon>
+              <Stack gap={2}>
+                <Group gap="xs" align="center">
+                  <Text fw={600}>{bookmark.title || t('editTableOfContents.editor.untitled', 'Untitled bookmark')}</Text>
+                  {level > 0 && (
+                    <Badge size="xs" variant="light" color="blue">
+                      {t('editTableOfContents.editor.childBadge', 'Child')}
+                    </Badge>
+                  )}
+                </Group>
+                <Text size="sm" c="dimmed">
+                  {t('editTableOfContents.editor.pagePreview', { page: bookmark.pageNumber })}
+                </Text>
+              </Stack>
+            </Group>
+            <Group gap="xs">
+              <Tooltip label={t('editTableOfContents.editor.actions.addChild', 'Add child bookmark')}>
+                <ActionIcon
+                  variant="subtle"
+                  color="green"
+                  onClick={() => handleAddChild(bookmark.id)}
+                  disabled={disabled}
+                >
+                  <LocalIcon icon="subdirectory-arrow-right-rounded" />
+                </ActionIcon>
+              </Tooltip>
+              <Tooltip label={t('editTableOfContents.editor.actions.addSibling', 'Add sibling bookmark')}>
+                <ActionIcon
+                  variant="subtle"
+                  color="blue"
+                  onClick={() => handleAddSibling(bookmark.id)}
+                  disabled={disabled}
+                >
+                  <LocalIcon icon="add-rounded" />
+                </ActionIcon>
+              </Tooltip>
+              <Tooltip label={t('editTableOfContents.editor.actions.remove', 'Remove bookmark')}>
+                <ActionIcon
+                  variant="subtle"
+                  color="red"
+                  onClick={() => handleRemove(bookmark.id)}
+                  disabled={disabled}
+                >
+                  <LocalIcon icon="delete-rounded" />
+                </ActionIcon>
+              </Tooltip>
+            </Group>
+          </Flex>
+
+          {bookmark.expanded && (
+            <Stack gap="sm">
+              <TextInput
+                size="sm"
+                label={t('editTableOfContents.editor.field.title', 'Bookmark title')}
+                value={bookmark.title}
+                onChange={event => handleTitleChange(bookmark.id, event.currentTarget.value)}
+                disabled={disabled}
+              />
+              <NumberInput
+                size="sm"
+                label={t('editTableOfContents.editor.field.page', 'Target page number')}
+                min={1}
+                clampBehavior="strict"
+                value={bookmark.pageNumber}
+                onChange={value => handlePageChange(bookmark.id, value ?? 1)}
+                disabled={disabled}
+              />
+            </Stack>
+          )}
+
+          {bookmark.expanded && hasChildren && (
+            <Stack gap="sm" pl="lg" style={{ borderLeft: '1px solid var(--border-default)' }}>
+              {bookmark.children.map(child => (
+                <Fragment key={child.id}>{renderBookmark(child, level + 1)}</Fragment>
+              ))}
+            </Stack>
+          )}
+        </Stack>
+      </Paper>
+    );
+  };
+
+  return (
+    <Stack gap="md">
+      <Group justify="space-between" align="flex-start">
+        <div>
+          <Text fw={600}>{t('editTableOfContents.editor.heading', 'Bookmark editor')}</Text>
+          <Text size="sm" c="dimmed">
+            {t('editTableOfContents.editor.description', 'Add, nest, and reorder bookmarks to craft your PDF outline.')}
+          </Text>
+        </div>
+        <Button
+          variant="default"
+          color="blue"
+          leftSection={<LocalIcon icon="bookmark-add-rounded" />}
+          onClick={handleAddTopLevel}
+          disabled={disabled}
+        >
+          {t('editTableOfContents.editor.addTopLevel', 'Add top-level bookmark')}
+        </Button>
+      </Group>
+
+      {bookmarks.length === 0 ? (
+        <Paper withBorder radius="md" ta="center" py="xl">
+          <Stack gap="xs" align="center" px="lg">
+            <LocalIcon icon="bookmark-add-rounded" style={{ fontSize: '2.25rem' }} />
+            <Text fw={600}>{t('editTableOfContents.editor.empty.title', 'No bookmarks yet')}</Text>
+            <Text size="sm" c="dimmed" maw={420}>
+              {t('editTableOfContents.editor.empty.description', 'Import existing bookmarks or start by adding your first entry.')}
+            </Text>
+            <Button
+              variant="subtle"
+              color="blue"
+              leftSection={<LocalIcon icon="add-rounded" />}
+              onClick={handleAddTopLevel}
+              disabled={disabled}
+            >
+              {t('editTableOfContents.editor.empty.action', 'Add first bookmark')}
+            </Button>
+          </Stack>
+        </Paper>
+      ) : (
+        <Stack gap="sm">
+          {bookmarks.map(bookmark => renderBookmark(bookmark))}
+        </Stack>
+      )}
+    </Stack>
+  );
+}

frontend/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.tsx

@@ -0,0 +1,187 @@
+import { useMemo } from 'react';
+import { useTranslation } from 'react-i18next';
+import {
+  Alert,
+  Button,
+  Divider,
+  FileButton,
+  Stack,
+  Switch,
+  Text,
+  Tooltip,
+} from '@mantine/core';
+import LocalIcon from '@app/components/shared/LocalIcon';
+import { BookmarkNode } from '@app/utils/editTableOfContents';
+
+interface EditTableOfContentsSettingsProps {
+  bookmarks: BookmarkNode[];
+  replaceExisting: boolean;
+  onReplaceExistingChange: (value: boolean) => void;
+  onSelectFiles: () => void;
+  onLoadFromPdf: () => void;
+  onImportJson: (file: File) => void;
+  onImportClipboard: () => void;
+  onExportJson: () => void;
+  onExportClipboard: () => void;
+  isLoading: boolean;
+  loadError?: string | null;
+  canReadClipboard: boolean;
+  canWriteClipboard: boolean;
+  disabled?: boolean;
+  selectedFileName?: string;
+}
+
+export default function EditTableOfContentsSettings({
+  bookmarks,
+  replaceExisting,
+  onReplaceExistingChange,
+  onSelectFiles,
+  onLoadFromPdf,
+  onImportJson,
+  onImportClipboard,
+  onExportJson,
+  onExportClipboard,
+  isLoading,
+  loadError,
+  canReadClipboard,
+  canWriteClipboard,
+  disabled,
+  selectedFileName,
+}: EditTableOfContentsSettingsProps) {
+  const { t } = useTranslation();
+
+  const infoLines = useMemo(() => ([
+    t('editTableOfContents.info.line1', 'Each bookmark needs a descriptive title and the page it should open.'),
+    t('editTableOfContents.info.line2', 'Use child bookmarks to build a hierarchy for chapters, sections, or subsections.'),
+    t('editTableOfContents.info.line3', 'Import bookmarks from the selected PDF or from a JSON file to save time.'),
+  ]), [t]);
+
+  return (
+    <Stack gap="md">
+      <Stack gap="xs">
+        <Text size="sm" fw={500}>{t('editTableOfContents.actions.source', 'Load bookmarks')}</Text>
+        <Text size="xs" c="dimmed">
+          {selectedFileName
+            ? t('editTableOfContents.actions.selectedFile', { file: selectedFileName })
+            : t('editTableOfContents.actions.noFile', 'Select a PDF to extract existing bookmarks.')}
+        </Text>
+      </Stack>
+
+      <Stack gap="sm">
+        <Button
+          variant="light"
+          leftSection={<LocalIcon icon="folder-rounded" />}
+          onClick={onSelectFiles}
+          fullWidth
+        >
+          {selectedFileName
+            ? t('editTableOfContents.workbench.changeFile', 'Change PDF')
+            : t('editTableOfContents.workbench.selectFile', 'Select PDF')}
+        </Button>
+
+        <Tooltip label={!selectedFileName ? t('editTableOfContents.actions.noFile', 'Select a PDF to extract existing bookmarks.') : ''} disabled={Boolean(selectedFileName)}>
+          <Button
+            variant="default"
+            leftSection={<LocalIcon icon="picture-as-pdf-rounded" />}
+            onClick={onLoadFromPdf}
+            loading={isLoading}
+            disabled={disabled || !selectedFileName}
+            fullWidth
+          >
+            {t('editTableOfContents.actions.loadFromPdf', 'Load from PDF')}
+          </Button>
+        </Tooltip>
+
+        <FileButton
+          onChange={file => file && onImportJson(file)}
+          accept="application/json"
+          disabled={disabled}
+        >
+          {(props) => (
+            <Button
+              {...props}
+              variant="default"
+              leftSection={<LocalIcon icon="upload-rounded" />}
+              disabled={disabled}
+              fullWidth
+            >
+              {t('editTableOfContents.actions.importJson', 'Import JSON')}
+            </Button>
+          )}
+        </FileButton>
+
+        <Tooltip
+          label={canReadClipboard ? '' : t('editTableOfContents.actions.clipboardUnavailable', 'Clipboard access is not available in this browser.')}
+          disabled={canReadClipboard}
+        >
+          <Button
+            variant="default"
+            leftSection={<LocalIcon icon="content-paste-rounded" />}
+            onClick={onImportClipboard}
+            disabled={disabled || !canReadClipboard}
+            fullWidth
+          >
+            {t('editTableOfContents.actions.importClipboard', 'Paste from clipboard')}
+          </Button>
+        </Tooltip>
+      </Stack>
+
+      {loadError && (
+        <Alert color="red" radius="md" icon={<LocalIcon icon="error-outline-rounded" />}>
+          {loadError}
+        </Alert>
+      )}
+
+      <Divider />
+
+      <Stack gap="xs">
+        <Text size="sm" fw={500}>{t('editTableOfContents.actions.export', 'Export bookmarks')}</Text>
+      </Stack>
+
+      <Stack gap="sm">
+        <Button
+          variant="default"
+          leftSection={<LocalIcon icon="download-rounded" />}
+          onClick={onExportJson}
+          disabled={disabled || bookmarks.length === 0}
+          fullWidth
+        >
+          {t('editTableOfContents.actions.exportJson', 'Download JSON')}
+        </Button>
+
+        <Tooltip
+          label={canWriteClipboard ? '' : t('editTableOfContents.actions.clipboardUnavailable', 'Clipboard access is not available in this browser.')}
+          disabled={canWriteClipboard}
+        >
+          <Button
+            variant="default"
+            leftSection={<LocalIcon icon="content-copy-rounded" />}
+            onClick={onExportClipboard}
+            disabled={disabled || bookmarks.length === 0 || !canWriteClipboard}
+            fullWidth
+          >
+            {t('editTableOfContents.actions.exportClipboard', 'Copy to clipboard')}
+          </Button>
+        </Tooltip>
+      </Stack>
+
+      <Divider />
+
+      <Switch
+        checked={replaceExisting}
+        onChange={(event) => onReplaceExistingChange(event.currentTarget.checked)}
+        label={t('editTableOfContents.settings.replaceExisting', 'Replace existing bookmarks')}
+        description={t('editTableOfContents.settings.replaceExistingHint', 'When disabled, the new outline is appended after the current bookmarks.')}
+        disabled={disabled}
+      />
+
+      <Stack gap="xs">
+        {infoLines.map((line, index) => (
+          <Text key={index} size="sm" c="dimmed">
+            {line}
+          </Text>
+        ))}
+      </Stack>
+    </Stack>
+  );
+}

frontend/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx

@@ -0,0 +1,203 @@
+import { useMemo } from 'react';
+import { useTranslation } from 'react-i18next';
+import {
+  Box,
+  Button,
+  Card,
+  Divider,
+  Group,
+  Stack,
+  Text,
+} from '@mantine/core';
+import LocalIcon from '@app/components/shared/LocalIcon';
+import { BookmarkNode } from '@app/utils/editTableOfContents';
+import ErrorNotification from '@app/components/tools/shared/ErrorNotification';
+import ResultsPreview from '@app/components/tools/shared/ResultsPreview';
+import BookmarkEditor from '@app/components/tools/editTableOfContents/BookmarkEditor';
+
+export interface EditTableOfContentsWorkbenchViewData {
+  bookmarks: BookmarkNode[];
+  selectedFileName?: string;
+  disabled: boolean;
+  files: File[];
+  thumbnails: (string | undefined)[];
+  downloadUrl: string | null;
+  downloadFilename: string | null;
+  errorMessage: string | null;
+  isGeneratingThumbnails: boolean;
+  isExecuteDisabled: boolean;
+  isExecuting: boolean;
+  onClearError: () => void;
+  onBookmarksChange: (bookmarks: BookmarkNode[]) => void;
+  onExecute: () => void;
+  onUndo: () => void;
+  onFileClick: (file: File) => void;
+}
+
+interface EditTableOfContentsWorkbenchViewProps {
+  data: EditTableOfContentsWorkbenchViewData | null;
+}
+
+const EditTableOfContentsWorkbenchView = ({ data }: EditTableOfContentsWorkbenchViewProps) => {
+  const { t } = useTranslation();
+
+  if (!data) {
+    return (
+      <Box p="xl">
+        <Card withBorder radius="md">
+          <Stack gap="sm">
+            <Text fw={600}>{t('editTableOfContents.workbench.empty.title', 'Open the tool to start editing')}</Text>
+            <Text size="sm" c="dimmed">
+              {t('editTableOfContents.workbench.empty.description', 'Select the Edit Table of Contents tool to load its workspace.')}
+            </Text>
+          </Stack>
+        </Card>
+      </Box>
+    );
+  }
+
+  const {
+    bookmarks,
+    selectedFileName,
+    disabled,
+    files,
+    thumbnails,
+    downloadUrl,
+    downloadFilename,
+    errorMessage,
+    isGeneratingThumbnails,
+    isExecuteDisabled,
+    isExecuting,
+    onClearError,
+    onBookmarksChange,
+    onExecute,
+    onUndo,
+    onFileClick,
+  } = data;
+
+  const previewFiles = useMemo(
+    () =>
+      files?.map((file, index) => ({
+        file,
+        thumbnail: thumbnails[index],
+      })) ?? [],
+    [files, thumbnails]
+  );
+
+  const showResults = Boolean(
+    previewFiles.length > 0 || downloadUrl || errorMessage
+  );
+
+  return (
+    <Box
+      p="lg"
+      style={{
+        width: '100%',
+        height: '100%',
+        overflowY: 'auto',
+        background: 'var(--bg-raised)',
+      }}
+    >
+      <Stack gap="xl" maw={1200} mx="auto">
+        <Stack gap={4}>
+          <Text size="xl" fw={700}>
+            {t('home.editTableOfContents.title', 'Edit Table of Contents')}
+          </Text>
+          <Text size="sm" c="dimmed">
+            {t('editTableOfContents.workbench.subtitle', 'Import bookmarks, build hierarchies, and apply the outline without cramped side panels.')}
+          </Text>
+        </Stack>
+
+        <Card
+          withBorder
+          radius="md"
+          p="xl"
+          style={{
+            backgroundColor: 'var(--bg-surface)',
+            borderColor: 'var(--border-default)',
+            boxShadow: 'var(--shadow-md)',
+          }}
+        >
+          <Stack gap="md">
+            <Stack gap={2}>
+              <Text fw={600}>{t('editTableOfContents.editor.heading', 'Bookmark editor')}</Text>
+              <Text size="sm" c="dimmed">
+                {selectedFileName
+                  ? t('editTableOfContents.actions.selectedFile', { file: selectedFileName })
+                  : t('editTableOfContents.workbench.filePrompt', 'Select a PDF from your library or upload a new one to begin.')}
+              </Text>
+            </Stack>
+            <BookmarkEditor bookmarks={bookmarks} onChange={onBookmarksChange} disabled={disabled} />
+            <Divider />
+            <Group justify="flex-end">
+              <Button
+                leftSection={<LocalIcon icon="menu-book-rounded" />}
+                color="blue"
+                onClick={onExecute}
+                disabled={isExecuteDisabled}
+                loading={isExecuting}
+              >
+                {t('editTableOfContents.submit', 'Apply table of contents')}
+              </Button>
+            </Group>
+          </Stack>
+        </Card>
+
+        {showResults && (
+          <Card
+            withBorder
+            radius="md"
+            p="xl"
+            style={{
+              backgroundColor: 'var(--bg-surface)',
+              borderColor: 'var(--border-default)',
+              boxShadow: 'var(--shadow-md)',
+            }}
+          >
+            <Stack gap="md">
+              <Stack gap={4}>
+                <Text fw={600}>{t('editTableOfContents.results.title', 'Updated PDF with bookmarks')}</Text>
+                <Text size="sm" c="dimmed">
+                  {t('editTableOfContents.results.subtitle', 'Download the processed file or undo the operation below.')}
+                </Text>
+              </Stack>
+
+              <ErrorNotification error={errorMessage} onClose={onClearError} />
+
+              {previewFiles.length > 0 && (
+                <ResultsPreview
+                  files={previewFiles}
+                  onFileClick={onFileClick}
+                  isGeneratingThumbnails={isGeneratingThumbnails}
+                />
+              )}
+
+              <Group justify="flex-end" gap="sm">
+                {downloadUrl && (
+                  <Button
+                    component="a"
+                    href={downloadUrl}
+                    download={downloadFilename ?? undefined}
+                    leftSection={<LocalIcon icon='download-rounded' />}
+                  >
+                    {t('download', 'Download')}
+                  </Button>
+                )}
+                <Button
+                  variant="outline"
+                  leftSection={<LocalIcon icon="rotate-left" />}
+                  onClick={onUndo}
+                  disabled={isExecuting}
+                >
+                  {t('undo', 'Undo')}
+                </Button>
+              </Group>
+            </Stack>
+          </Card>
+        )}
+      </Stack>
+    </Box>
+  );
+};
+
+export default EditTableOfContentsWorkbenchView;

frontend/src/core/components/tools/fullscreen/CompactToolItem.tsx

@@ -5,7 +5,7 @@ import { Tooltip } from '@app/components/shared/Tooltip';
 import HotkeyDisplay from '@app/components/hotkeys/HotkeyDisplay';
 import FavoriteStar from '@app/components/tools/toolPicker/FavoriteStar';
 import { ToolRegistryEntry, getSubcategoryColor } from '@app/data/toolsTaxonomy';
-import { getIconBackground, getIconStyle, getItemClasses, useToolMeta } from '@app/components/tools/fullscreen/shared';
+import { getIconBackground, getIconStyle, getItemClasses, useToolMeta, getDisabledLabel } from '@app/components/tools/fullscreen/shared';
 
 interface CompactToolItemProps {
   id: string;
@@ -17,7 +17,7 @@ interface CompactToolItemProps {
 
 const CompactToolItem: React.FC<CompactToolItemProps> = ({ id, tool, isSelected, onClick, tooltipPortalTarget }) => {
   const { t } = useTranslation();
-  const { binding, isFav, toggleFavorite, disabled } = useToolMeta(id, tool);
+  const { binding, isFav, toggleFavorite, disabled, disabledReason } = useToolMeta(id, tool);
   const categoryColor = getSubcategoryColor(tool.subcategoryId);
   const iconBg = getIconBackground(categoryColor, false);
   const iconClasses = 'tool-panel__fullscreen-list-icon';
@@ -73,9 +73,12 @@ const CompactToolItem: React.FC<CompactToolItemProps> = ({ id, tool, isSelected,
     </button>
   );
 
+  const { key: disabledKey, fallback: disabledFallback } = getDisabledLabel(disabledReason);
+  const disabledMessage = t(disabledKey, disabledFallback);
+
   const tooltipContent = disabled
     ? (
-      <span><strong>{t('toolPanel.fullscreen.comingSoon', 'Coming soon:')}</strong> {tool.description}</span>
+      <span><strong>{disabledMessage}</strong> {tool.description}</span>
     )
     : (
       <div style={{ display: 'flex', flexDirection: 'column', gap: '0.35rem' }}>

frontend/src/core/components/tools/fullscreen/DetailedToolItem.tsx

@@ -4,7 +4,7 @@ import { useTranslation } from 'react-i18next';
 import HotkeyDisplay from '@app/components/hotkeys/HotkeyDisplay';
 import FavoriteStar from '@app/components/tools/toolPicker/FavoriteStar';
 import { ToolRegistryEntry, getSubcategoryColor } from '@app/data/toolsTaxonomy';
-import { getIconBackground, getIconStyle, getItemClasses, useToolMeta } from '@app/components/tools/fullscreen/shared';
+import { getIconBackground, getIconStyle, getItemClasses, useToolMeta, getDisabledLabel } from '@app/components/tools/fullscreen/shared';
 
 interface DetailedToolItemProps {
   id: string;
@@ -15,7 +15,7 @@ interface DetailedToolItemProps {
 
 const DetailedToolItem: React.FC<DetailedToolItemProps> = ({ id, tool, isSelected, onClick }) => {
   const { t } = useTranslation();
-  const { binding, isFav, toggleFavorite, disabled } = useToolMeta(id, tool);
+  const { binding, isFav, toggleFavorite, disabled, disabledReason } = useToolMeta(id, tool);
 
   const categoryColor = getSubcategoryColor(tool.subcategoryId);
   const iconBg = getIconBackground(categoryColor, true);
@@ -34,6 +34,9 @@ const DetailedToolItem: React.FC<DetailedToolItemProps> = ({ id, tool, isSelecte
     iconNode = tool.icon;
   }
 
+  const { key: disabledKey, fallback: disabledFallback } = getDisabledLabel(disabledReason);
+  const disabledMessage = t(disabledKey, disabledFallback);
+
   return (
     <button
       type="button"
@@ -60,7 +63,12 @@ const DetailedToolItem: React.FC<DetailedToolItemProps> = ({ id, tool, isSelecte
           {tool.name}
         </Text>
         <Text size="sm" c="dimmed" className="tool-panel__fullscreen-description">
-          {tool.description}
+          {disabled ? (
+            <>
+              <strong>{disabledMessage} </strong>
+              {tool.description}
+            </>
+          ) : tool.description}
         </Text>
         {binding && (
           <div className="tool-panel__fullscreen-shortcut">

frontend/src/core/components/tools/fullscreen/shared.ts

@@ -2,6 +2,7 @@ import { useHotkeys } from '@app/contexts/HotkeyContext';
 import { useToolWorkflow } from '@app/contexts/ToolWorkflowContext';
 import { ToolRegistryEntry } from '@app/data/toolsTaxonomy';
 import { ToolId } from '@app/types/toolId';
+import type { ToolAvailabilityMap } from '@app/hooks/useToolManagement';
 
 export const getItemClasses = (isDetailed: boolean): string => {
   return isDetailed ? 'tool-panel__fullscreen-item--detailed' : '';
@@ -22,23 +23,67 @@ export const getIconStyle = (): Record<string, string> => {
   return {};
 };
 
-export const isToolDisabled = (id: string, tool: ToolRegistryEntry): boolean => {
-  return !tool.component && !tool.link && id !== 'read' && id !== 'multiTool';
+export type ToolDisabledReason = 'comingSoon' | 'disabledByAdmin' | 'missingDependency' | 'unknownUnavailable' | null;
+
+export const getToolDisabledReason = (
+  id: string,
+  tool: ToolRegistryEntry,
+  toolAvailability?: ToolAvailabilityMap
+): ToolDisabledReason => {
+  if (!tool.component && !tool.link && id !== 'read' && id !== 'multiTool') {
+    return 'comingSoon';
+  }
+
+  const availabilityInfo = toolAvailability?.[id as ToolId];
+  if (availabilityInfo && availabilityInfo.available === false) {
+    if (availabilityInfo.reason === 'missingDependency') {
+      return 'missingDependency';
+    }
+    if (availabilityInfo.reason === 'disabledByAdmin') {
+      return 'disabledByAdmin';
+    }
+    return 'unknownUnavailable';
+  }
+
+  return null;
+};
+
+export const getDisabledLabel = (
+  disabledReason: ToolDisabledReason
+): { key: string; fallback: string } => {
+  if (disabledReason === 'missingDependency') {
+    return {
+      key: 'toolPanel.fullscreen.unavailableDependency',
+      fallback: 'Unavailable - required tool missing on server:'
+    };
+  }
+  if (disabledReason === 'disabledByAdmin' || disabledReason === 'unknownUnavailable') {
+    return {
+      key: 'toolPanel.fullscreen.unavailable',
+      fallback: 'Disabled by server administrator:'
+    };
+  }
+  return {
+    key: 'toolPanel.fullscreen.comingSoon',
+    fallback: 'Coming soon:'
+  };
 };
 
 export function useToolMeta(id: string, tool: ToolRegistryEntry) {
   const { hotkeys } = useHotkeys();
-  const { isFavorite, toggleFavorite } = useToolWorkflow();
+  const { isFavorite, toggleFavorite, toolAvailability } = useToolWorkflow();
 
   const isFav = isFavorite(id as ToolId);
   const binding = hotkeys[id as ToolId];
-  const disabled = isToolDisabled(id, tool);
+  const disabledReason = getToolDisabledReason(id, tool, toolAvailability);
+  const disabled = disabledReason !== null;
 
   return {
     binding,
     isFav,
     toggleFavorite: () => toggleFavorite(id as ToolId),
     disabled,
+    disabledReason,
   };
 }
 

frontend/src/core/components/tools/removeAnnotations/RemoveAnnotationsSettings.tsx

@@ -1,24 +1,9 @@
-import { useTranslation } from 'react-i18next';
-import { Stack, Text, Alert } from '@mantine/core';
-import LocalIcon from '@app/components/shared/LocalIcon';
+import { Stack } from '@mantine/core';
 
 const RemoveAnnotationsSettings = () => {
-  const { t } = useTranslation();
-
   return (
     <Stack gap="md">
-      <Alert
-        icon={<LocalIcon icon="info-rounded" width="1.2rem" height="1.2rem" />}
-        title={t('removeAnnotations.info.title', 'About Remove Annotations')}
-        color="blue"
-        variant="light"
-      >
-        <Text size="sm">
-          {t('removeAnnotations.info.description',
-            'This tool will remove all annotations (comments, highlights, notes, etc.) from your PDF documents.'
-          )}
-        </Text>
-      </Alert>
+      {/* No settings needed for this tool - description is in tooltip */}
     </Stack>
   );
 };