tests

## Summary
- hide password and username update controls for SSO accounts and show a
managed-account notice
- prevent account update handlers from calling APIs when the user
authenticates via SSO
- expose authenticationType on the user session model and add
translations for new SSO messaging

## Testing
- not run (not requested)


------
[Codex
Task](https://chatgpt.com/codex/tasks/task_b_693ae8144148832888ecf128e66cd3ca)

.github/README.md

@@ -1,12 +0,0 @@
-# CI Configuration
-
-## CI Lite Mode
-
-Skip non-essential CI workflows by setting a repository variable:
-
-**Settings → Secrets and variables → Actions → Variables → New repository variable**
-
-- Name: `CI_PROFILE`
-- Value: `lite`
-
-Skips resource-intensive builds, releases, and OSS-specific workflows. Useful for deployment-only forks or faster CI runs.

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -52,7 +52,6 @@ jobs:
             core.setOutput('repository', pr.head.repo.full_name);
             core.setOutput('ref', pr.head.ref);
             core.setOutput('is_fork', String(pr.head.repo.fork));
-            core.setOutput('base_ref', pr.base.ref);
             core.setOutput('author', pr.user.login);
             core.setOutput('state', pr.state);
 
@@ -65,10 +64,6 @@ jobs:
           IS_FORK: ${{ steps.resolve.outputs.is_fork }}
           # nur bei workflow_dispatch gesetzt:
           ALLOW_FORK_INPUT: ${{ inputs.allow_fork }}
-          # für Auto-PR-Logik:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
-          PR_BASE: ${{ steps.resolve.outputs.base_ref }}
           PR_AUTHOR: ${{ steps.resolve.outputs.author }}
         run: |
           set -e
@@ -89,14 +84,8 @@ jobs:
           else
             auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
             is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
-            if [ "$PR_BASE" = "V2" ] && [ "$is_auth" = true ]; then
+            if [ "$is_auth" = true ]; then
               should=true
-            else
-              title_has_v2=false; echo "$PR_TITLE" | grep -qiE 'v2|version.?2|version.?two' && title_has_v2=true
-              branch_has_kw=false; echo "$PR_BRANCH" | grep -qiE 'v2|react' && branch_has_kw=true
-              if [ "$is_auth" = true ] && { [ "$title_has_v2" = true ] || [ "$branch_has_kw" = true ]; }; then
-                should=true
-              fi
             fi
           fi
 
@@ -174,7 +163,7 @@ jobs:
               owner,
               repo,
               issue_number: prNumber,
-              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment triggered by V2/version2 keywords in the PR title or V2/React keywords in the branch name._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
+              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment for approved V2 contributors._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
             });
             return newComment.id;
 
@@ -394,7 +383,7 @@ jobs:
                               `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
                               `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                               `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
-                              `🔄 **Auto-deployed** because PR title or branch name contains V2/version2/React keywords.`;
+                              `🔄 **Auto-deployed** for approved V2 contributors.`;
 
             await github.rest.issues.createComment({
               owner,

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -491,6 +491,9 @@ public class EndpointConfiguration {
         addEndpointToGroup("Ghostscript", "repair");
         addEndpointToGroup("Ghostscript", "compress-pdf");
 
+        /* ImageMagick */
+        addEndpointToGroup("ImageMagick", "compress-pdf");
+
         /* tesseract */
         addEndpointToGroup("tesseract", "ocr-pdf");
 
@@ -574,6 +577,7 @@ public class EndpointConfiguration {
                 || "Javascript".equals(group)
                 || "Weasyprint".equals(group)
                 || "Pdftohtml".equals(group)
+                || "ImageMagick".equals(group)
                 || "rar".equals(group);
     }
 

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -68,6 +68,7 @@ public class ApplicationProperties {
 
     private AutoPipeline autoPipeline = new AutoPipeline();
     private ProcessExecutor processExecutor = new ProcessExecutor();
+    private PdfEditor pdfEditor = new PdfEditor();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -100,6 +101,46 @@ public class ApplicationProperties {
         private String outputFolder;
     }
 
+    @Data
+    public static class PdfEditor {
+        private Cache cache = new Cache();
+        private FontNormalization fontNormalization = new FontNormalization();
+        private CffConverter cffConverter = new CffConverter();
+        private Type3 type3 = new Type3();
+        private String fallbackFont = "classpath:/static/fonts/NotoSans-Regular.ttf";
+
+        @Data
+        public static class Cache {
+            private long maxBytes = -1;
+            private int maxPercent = 20;
+        }
+
+        @Data
+        public static class FontNormalization {
+            private boolean enabled = false;
+        }
+
+        @Data
+        public static class CffConverter {
+            private boolean enabled = true;
+            private String method = "python";
+            private String pythonCommand = "/opt/venv/bin/python3";
+            private String pythonScript = "/scripts/convert_cff_to_ttf.py";
+            private String fontforgeCommand = "fontforge";
+        }
+
+        @Data
+        public static class Type3 {
+            private Library library = new Library();
+
+            @Data
+            public static class Library {
+                private boolean enabled = true;
+                private String index = "classpath:/type3/library/index.json";
+            }
+        }
+    }
+
     @Data
     public static class Legal {
         private String termsAndConditions;
@@ -357,6 +398,7 @@ public class ApplicationProperties {
         private Boolean enableAnalytics;
         private Boolean enablePosthog;
         private Boolean enableScarf;
+        private Boolean enableDesktopInstallSlide;
         private Datasource datasource;
         private Boolean disableSanitize;
         private int maxDPI;
@@ -367,10 +409,12 @@ public class ApplicationProperties {
         private TempFileManagement tempFileManagement = new TempFileManagement();
         private DatabaseBackup databaseBackup = new DatabaseBackup();
         private List<String> corsAllowedOrigins = new ArrayList<>();
-        private String
-                frontendUrl; // Base URL for frontend (used for invite links, etc.). If not set,
+        private String backendUrl; // Backend base URL for SAML/OAuth/API callbacks (e.g.
+        // 'http://localhost:8080', 'https://api.example.com'). Required for
+        // SSO.
+        private String frontendUrl; // Frontend URL for invite email links (e.g.
 
-        // falls back to backend URL.
+        // 'https://app.example.com'). If not set, falls back to backendUrl.
 
         public boolean isAnalyticsEnabled() {
             return this.getEnableAnalytics() != null && this.getEnableAnalytics();
@@ -535,6 +579,7 @@ public class ApplicationProperties {
         @ToString.Exclude private String key;
         private String UUID;
         private String appVersion;
+        private Boolean isNewServer;
     }
 
     // TODO: Remove post migration
@@ -652,6 +697,7 @@ public class ApplicationProperties {
             private int weasyPrintSessionLimit;
             private int installAppSessionLimit;
             private int calibreSessionLimit;
+            private int imageMagickSessionLimit;
             private int qpdfSessionLimit;
             private int tesseractSessionLimit;
             private int ghostscriptSessionLimit;
@@ -689,6 +735,10 @@ public class ApplicationProperties {
                 return calibreSessionLimit > 0 ? calibreSessionLimit : 1;
             }
 
+            public int getImageMagickSessionLimit() {
+                return imageMagickSessionLimit > 0 ? imageMagickSessionLimit : 4;
+            }
+
             public int getGhostscriptSessionLimit() {
                 return ghostscriptSessionLimit > 0 ? ghostscriptSessionLimit : 8;
             }
@@ -718,6 +768,8 @@ public class ApplicationProperties {
             @JsonProperty("calibretimeoutMinutes")
             private long calibreTimeoutMinutes;
 
+            private long imageMagickTimeoutMinutes;
+
             private long tesseractTimeoutMinutes;
             private long qpdfTimeoutMinutes;
             private long ghostscriptTimeoutMinutes;
@@ -755,6 +807,10 @@ public class ApplicationProperties {
                 return calibreTimeoutMinutes > 0 ? calibreTimeoutMinutes : 30;
             }
 
+            public long getImageMagickTimeoutMinutes() {
+                return imageMagickTimeoutMinutes > 0 ? imageMagickTimeoutMinutes : 30;
+            }
+
             public long getGhostscriptTimeoutMinutes() {
                 return ghostscriptTimeoutMinutes > 0 ? ghostscriptTimeoutMinutes : 30;
             }

app/common/src/main/java/stirling/software/common/service/LineArtConversionService.java

@@ -0,0 +1,12 @@
+package stirling.software.common.service;
+
+import java.io.IOException;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
+
+public interface LineArtConversionService {
+    PDImageXObject convertImageToLineArt(
+            PDDocument doc, PDImageXObject originalImage, double threshold, int edgeLevel)
+            throws IOException;
+}

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -86,6 +86,11 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getCalibreSessionLimit();
+                                case IMAGEMAGICK ->
+                                        applicationProperties
+                                                .getProcessExecutor()
+                                                .getSessionLimit()
+                                                .getImageMagickSessionLimit();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -141,6 +146,11 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getCalibreTimeoutMinutes();
+                                case IMAGEMAGICK ->
+                                        applicationProperties
+                                                .getProcessExecutor()
+                                                .getTimeoutMinutes()
+                                                .getImageMagickTimeoutMinutes();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -301,6 +311,7 @@ public class ProcessExecutor {
         WEASYPRINT,
         INSTALL_APP,
         CALIBRE,
+        IMAGEMAGICK,
         TESSERACT,
         QPDF,
         GHOSTSCRIPT,

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -26,6 +26,7 @@ public class RequestUriUtils {
                 || normalizedUri.startsWith("/public/")
                 || normalizedUri.startsWith("/pdfjs/")
                 || normalizedUri.startsWith("/pdfjs-legacy/")
+                || normalizedUri.startsWith("/pdfium/")
                 || normalizedUri.startsWith("/assets/")
                 || normalizedUri.startsWith("/locales/")
                 || normalizedUri.startsWith("/Login/")
@@ -61,7 +62,8 @@ public class RequestUriUtils {
                 || normalizedUri.endsWith(".css")
                 || normalizedUri.endsWith(".mjs")
                 || normalizedUri.endsWith(".html")
-                || normalizedUri.endsWith(".toml");
+                || normalizedUri.endsWith(".toml")
+                || normalizedUri.endsWith(".wasm");
     }
 
     public static boolean isFrontendRoute(String contextPath, String requestURI) {
@@ -125,11 +127,13 @@ public class RequestUriUtils {
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
                 || requestURI.endsWith(".toml")
+                || requestURI.endsWith(".wasm")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
                 || requestURI.startsWith("/fonts")
-                || requestURI.startsWith("/pdfjs"));
+                || requestURI.startsWith("/pdfjs")
+                || requestURI.startsWith("/pdfium"));
     }
 
     /**

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -24,6 +24,9 @@ public class RequestUriUtilsTest {
         assertTrue(
                 RequestUriUtils.isStaticResource("/pdfjs/pdf.worker.js"),
                 "PDF.js files should be static");
+        assertTrue(
+                RequestUriUtils.isStaticResource("/pdfium/pdfium.wasm"),
+                "PDFium wasm should be static");
         assertTrue(
                 RequestUriUtils.isStaticResource("/api/v1/info/status"),
                 "API status should be static");
@@ -110,7 +113,8 @@ public class RequestUriUtilsTest {
                 "/downloads/document.png",
                 "/assets/brand.ico",
                 "/any/path/with/image.svg",
-                "/deep/nested/folder/icon.png"
+                "/deep/nested/folder/icon.png",
+                "/pdfium/pdfium.wasm"
             })
     void testIsStaticResourceWithFileExtensions(String path) {
         assertTrue(
@@ -148,6 +152,9 @@ public class RequestUriUtilsTest {
         assertFalse(
                 RequestUriUtils.isTrackableResource("/script.js"),
                 "JS files should not be trackable");
+        assertFalse(
+                RequestUriUtils.isTrackableResource("/pdfium/pdfium.wasm"),
+                "PDFium wasm should not be trackable");
         assertFalse(
                 RequestUriUtils.isTrackableResource("/swagger/index.html"),
                 "Swagger files should not be trackable");
@@ -224,7 +231,8 @@ public class RequestUriUtilsTest {
                 "/api/v1/info/health",
                 "/site.webmanifest",
                 "/fonts/roboto.woff",
-                "/pdfjs/viewer.js"
+                "/pdfjs/viewer.js",
+                "/pdfium/pdfium.wasm"
             })
     void testNonTrackableResources(String path) {
         assertFalse(

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -46,6 +46,7 @@ public class ExternalAppDepConfig {
                         put("qpdf", List.of("qpdf"));
                         put("tesseract", List.of("tesseract"));
                         put("rar", List.of("rar")); // Required for real CBR output
+                        put("magick", List.of("ImageMagick"));
                     }
                 };
     }
@@ -128,6 +129,7 @@ public class ExternalAppDepConfig {
         checkDependencyAndDisableGroup("pdftohtml");
         checkDependencyAndDisableGroup(unoconvPath);
         checkDependencyAndDisableGroup("rar");
+        checkDependencyAndDisableGroup("magick");
         // Special handling for Python/OpenCV dependencies
         boolean pythonAvailable = isCommandAvailable("python3") || isCommandAvailable("python");
         if (!pythonAvailable) {

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -94,6 +94,7 @@ public class InitialSetup {
         }
         GeneralUtils.saveKeyToSettings("AutomaticallyGenerated.appVersion", appVersion);
         applicationProperties.getAutomaticallyGenerated().setAppVersion(appVersion);
+        applicationProperties.getAutomaticallyGenerated().setIsNewServer(isNewServer);
     }
 
     public static boolean isNewServer() {

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonExceptionHandler.java

@@ -0,0 +1,60 @@
+package stirling.software.SPDF.controller.api.converters;
+
+import java.nio.charset.StandardCharsets;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.exception.CacheUnavailableException;
+
+@ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
+@Slf4j
+@RequiredArgsConstructor
+public class ConvertPdfJsonExceptionHandler {
+
+    private final ObjectMapper objectMapper;
+
+    @ExceptionHandler(CacheUnavailableException.class)
+    @ResponseBody
+    public ResponseEntity<byte[]> handleCacheUnavailable(CacheUnavailableException ex) {
+        try {
+            byte[] body =
+                    objectMapper.writeValueAsBytes(
+                            java.util.Map.of(
+                                    "error", "cache_unavailable",
+                                    "action", "reupload",
+                                    "message", ex.getMessage()));
+            return ResponseEntity.status(HttpStatus.GONE)
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .body(body);
+        } catch (Exception e) {
+            log.warn("Failed to serialize cache_unavailable response", e);
+            var fallbackBody =
+                    java.util.Map.of(
+                            "error", "cache_unavailable",
+                            "action", "reupload",
+                            "message", String.valueOf(ex.getMessage()));
+            try {
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .body(objectMapper.writeValueAsBytes(fallbackBody));
+            } catch (Exception ignored) {
+                // Truly last-ditch fallback
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .body(
+                                "{\"error\":\"cache_unavailable\",\"action\":\"reupload\",\"message\":\"Cache unavailable\"}"
+                                        .getBytes(StandardCharsets.UTF_8));
+            }
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/CompressController.java

@@ -28,10 +28,13 @@ import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.graphics.PDXObject;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -44,6 +47,7 @@ import stirling.software.SPDF.model.api.misc.OptimizePdfRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.MiscApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.service.LineArtConversionService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
@@ -58,6 +62,9 @@ public class CompressController {
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final EndpointConfiguration endpointConfiguration;
 
+    @Autowired(required = false)
+    private LineArtConversionService lineArtConversionService;
+
     private boolean isQpdfEnabled() {
         return endpointConfiguration.isGroupEnabled("qpdf");
     }
@@ -66,6 +73,10 @@ public class CompressController {
         return endpointConfiguration.isGroupEnabled("Ghostscript");
     }
 
+    private boolean isImageMagickEnabled() {
+        return endpointConfiguration.isGroupEnabled("ImageMagick");
+    }
+
     @Data
     @AllArgsConstructor
     @NoArgsConstructor
@@ -660,6 +671,9 @@ public class CompressController {
         Integer optimizeLevel = request.getOptimizeLevel();
         String expectedOutputSizeString = request.getExpectedOutputSize();
         Boolean convertToGrayscale = request.getGrayscale();
+        Boolean convertToLineArt = request.getLineArt();
+        Double lineArtThreshold = request.getLineArtThreshold();
+        Integer lineArtEdgeLevel = request.getLineArtEdgeLevel();
         if (expectedOutputSizeString == null && optimizeLevel == null) {
             throw new Exception("Both expected output size and optimize level are not specified");
         }
@@ -689,6 +703,26 @@ public class CompressController {
                 optimizeLevel = determineOptimizeLevel(sizeReductionRatio);
             }
 
+            if (Boolean.TRUE.equals(convertToLineArt)) {
+                if (lineArtConversionService == null) {
+                    throw new ResponseStatusException(
+                            HttpStatus.FORBIDDEN,
+                            "Line art conversion is unavailable - ImageMagick service not found");
+                }
+                if (!isImageMagickEnabled()) {
+                    throw new IOException(
+                            "ImageMagick is not enabled but line art conversion was requested");
+                }
+                double thresholdValue =
+                        lineArtThreshold == null
+                                ? 55d
+                                : Math.min(100d, Math.max(0d, lineArtThreshold));
+                int edgeLevel =
+                        lineArtEdgeLevel == null ? 1 : Math.min(3, Math.max(1, lineArtEdgeLevel));
+                currentFile =
+                        applyLineArtConversion(currentFile, tempFiles, thresholdValue, edgeLevel);
+            }
+
             boolean sizeMet = false;
             boolean imageCompressionApplied = false;
             boolean externalCompressionApplied = false;
@@ -810,6 +844,75 @@ public class CompressController {
         }
     }
 
+    private Path applyLineArtConversion(
+            Path currentFile, List<Path> tempFiles, double threshold, int edgeLevel)
+            throws IOException {
+
+        Path lineArtFile = Files.createTempFile("lineart_output_", ".pdf");
+        tempFiles.add(lineArtFile);
+
+        try (PDDocument doc = pdfDocumentFactory.load(currentFile.toFile())) {
+            Map<String, List<ImageReference>> uniqueImages = findImages(doc);
+            CompressionStats stats = new CompressionStats();
+            stats.uniqueImagesCount = uniqueImages.size();
+            calculateImageStats(uniqueImages, stats);
+
+            Map<String, PDImageXObject> convertedImages =
+                    createLineArtImages(doc, uniqueImages, stats, threshold, edgeLevel);
+
+            replaceImages(doc, uniqueImages, convertedImages, stats);
+
+            log.info(
+                    "Applied line art conversion to {} unique images ({} total references)",
+                    stats.uniqueImagesCount,
+                    stats.totalImages);
+
+            doc.save(lineArtFile.toString());
+            return lineArtFile;
+        }
+    }
+
+    private Map<String, PDImageXObject> createLineArtImages(
+            PDDocument doc,
+            Map<String, List<ImageReference>> uniqueImages,
+            CompressionStats stats,
+            double threshold,
+            int edgeLevel)
+            throws IOException {
+
+        Map<String, PDImageXObject> convertedImages = new HashMap<>();
+
+        for (Entry<String, List<ImageReference>> entry : uniqueImages.entrySet()) {
+            String imageHash = entry.getKey();
+            List<ImageReference> references = entry.getValue();
+            if (references.isEmpty()) continue;
+
+            PDImageXObject originalImage = getOriginalImage(doc, references.get(0));
+
+            int originalSize = (int) originalImage.getCOSObject().getLength();
+            stats.totalOriginalBytes += originalSize;
+
+            PDImageXObject converted =
+                    lineArtConversionService.convertImageToLineArt(
+                            doc, originalImage, threshold, edgeLevel);
+            convertedImages.put(imageHash, converted);
+            stats.compressedImages++;
+
+            int convertedSize = (int) converted.getCOSObject().getLength();
+            stats.totalCompressedBytes += convertedSize * references.size();
+
+            double reductionPercentage = 100.0 - ((convertedSize * 100.0) / originalSize);
+            log.info(
+                    "Image hash {}: Line art conversion {} → {} (reduced by {}%)",
+                    imageHash,
+                    GeneralUtils.formatBytes(originalSize),
+                    GeneralUtils.formatBytes(convertedSize),
+                    String.format("%.1f", reductionPercentage));
+        }
+
+        return convertedImages;
+    }
+
     // Run Ghostscript compression
     private void applyGhostscriptCompression(
             OptimizePdfRequest request, int optimizeLevel, Path currentFile, List<Path> tempFiles)

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -124,6 +124,9 @@ public class ConfigController {
                     "enableAnalytics", applicationProperties.getSystem().getEnableAnalytics());
             configData.put("enablePosthog", applicationProperties.getSystem().getEnablePosthog());
             configData.put("enableScarf", applicationProperties.getSystem().getEnableScarf());
+            configData.put(
+                    "enableDesktopInstallSlide",
+                    applicationProperties.getSystem().getEnableDesktopInstallSlide());
 
             // Premium/Enterprise settings
             configData.put("premiumEnabled", applicationProperties.getPremium().isEnabled());
@@ -227,4 +230,10 @@ public class ConfigController {
         }
         return ResponseEntity.ok(result);
     }
+
+    @GetMapping("/group-enabled")
+    public ResponseEntity<Boolean> isGroupEnabled(@RequestParam(name = "group") String group) {
+        boolean enabled = endpointConfiguration.isGroupEnabled(group);
+        return ResponseEntity.ok(enabled);
+    }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java

@@ -191,6 +191,12 @@ public class CertSignController {
 
         switch (certType) {
             case "PEM":
+                privateKeyFile =
+                        validateFilePresent(
+                                privateKeyFile, "PEM private key", "private key file is required");
+                certFile =
+                        validateFilePresent(
+                                certFile, "PEM certificate", "certificate file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(null);
                 PrivateKey privateKey = getPrivateKeyFromPEM(privateKeyFile.getBytes(), password);
@@ -200,10 +206,16 @@ public class CertSignController {
                 break;
             case "PKCS12":
             case "PFX":
+                p12File =
+                        validateFilePresent(
+                                p12File, "PKCS12 keystore", "PKCS12/PFX keystore file is required");
                 ks = KeyStore.getInstance("PKCS12");
                 ks.load(p12File.getInputStream(), password.toCharArray());
                 break;
             case "JKS":
+                jksfile =
+                        validateFilePresent(
+                                jksfile, "JKS keystore", "JKS keystore file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(jksfile.getInputStream(), password.toCharArray());
                 break;
@@ -251,6 +263,17 @@ public class CertSignController {
                 GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_signed.pdf"));
     }
 
+    private MultipartFile validateFilePresent(
+            MultipartFile file, String argumentName, String errorDescription) {
+        if (file == null || file.isEmpty()) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidArgument",
+                    "Invalid argument: {0}",
+                    argumentName + " - " + errorDescription);
+        }
+        return file;
+    }
+
     private PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
             throws IOException, OperatorCreationException, PKCSException {
         try (PEMParser pemParser =

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -74,13 +74,13 @@ public class ReactRoutingController {
     }
 
     @GetMapping(
-            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
+            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
     public ResponseEntity<String> forwardRootPaths(HttpServletRequest request) throws IOException {
         return serveIndexHtml(request);
     }
 
     @GetMapping(
-            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
     public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
             throws IOException {
         return serveIndexHtml(request);

app/core/src/main/java/stirling/software/SPDF/exception/CacheUnavailableException.java

@@ -0,0 +1,8 @@
+package stirling.software.SPDF.exception;
+
+public class CacheUnavailableException extends RuntimeException {
+
+    public CacheUnavailableException(String message) {
+        super(message);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/model/api/misc/OptimizePdfRequest.java

@@ -45,4 +45,26 @@ public class OptimizePdfRequest extends PDFFile {
             requiredMode = Schema.RequiredMode.REQUIRED,
             defaultValue = "false")
     private Boolean grayscale = false;
+
+    @Schema(
+            description =
+                    "Whether to convert images to high-contrast line art using ImageMagick. Default is false.",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "false")
+    private Boolean lineArt = false;
+
+    @Schema(
+            description = "Threshold to use for line art conversion (0-100).",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "55")
+    private Double lineArtThreshold = 55d;
+
+    @Schema(
+            description =
+                    "Edge detection strength to use for line art conversion (1-3). This maps to"
+                            + " ImageMagick's -edge radius.",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "1",
+            allowableValues = {"1", "2", "3"})
+    private Integer lineArtEdgeLevel = 1;
 }

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonConversionService.java

@@ -86,7 +86,6 @@ import org.apache.pdfbox.text.PDFTextStripper;
 import org.apache.pdfbox.text.TextPosition;
 import org.apache.pdfbox.util.DateConverter;
 import org.apache.pdfbox.util.Matrix;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -144,15 +143,23 @@ public class PdfJsonConversionService {
     private final PdfJsonFontService fontService;
     private final Type3FontConversionService type3FontConversionService;
     private final Type3GlyphExtractor type3GlyphExtractor;
+    private final stirling.software.common.model.ApplicationProperties applicationProperties;
     private final Map<String, PDFont> type3NormalizedFontCache = new ConcurrentHashMap<>();
     private final Map<String, Set<Integer>> type3GlyphCoverageCache = new ConcurrentHashMap<>();
 
-    @Value("${stirling.pdf.json.font-normalization.enabled:true}")
     private boolean fontNormalizationEnabled;
+    private long cacheMaxBytes;
+    private int cacheMaxPercent;
 
     /** Cache for storing PDDocuments for lazy page loading. Key is jobId. */
     private final Map<String, CachedPdfDocument> documentCache = new ConcurrentHashMap<>();
 
+    private final java.util.LinkedHashMap<String, CachedPdfDocument> lruCache =
+            new java.util.LinkedHashMap<>(16, 0.75f, true);
+    private final Object cacheLock = new Object();
+    private volatile long currentCacheBytes = 0L;
+    private volatile long cacheBudgetBytes = -1L;
+
     private volatile boolean ghostscriptAvailable;
 
     private static final float FLOAT_EPSILON = 0.0001f;
@@ -161,7 +168,23 @@ public class PdfJsonConversionService {
 
     @PostConstruct
     private void initializeToolAvailability() {
+        loadConfigurationFromProperties();
         initializeGhostscriptAvailability();
+        initializeCacheBudget();
+    }
+
+    private void loadConfigurationFromProperties() {
+        stirling.software.common.model.ApplicationProperties.PdfEditor cfg =
+                applicationProperties.getPdfEditor();
+        if (cfg != null) {
+            fontNormalizationEnabled = cfg.getFontNormalization().isEnabled();
+            cacheMaxBytes = cfg.getCache().getMaxBytes();
+            cacheMaxPercent = cfg.getCache().getMaxPercent();
+        } else {
+            fontNormalizationEnabled = false;
+            cacheMaxBytes = -1;
+            cacheMaxPercent = 20;
+        }
     }
 
     private void initializeGhostscriptAvailability() {
@@ -202,6 +225,25 @@ public class PdfJsonConversionService {
         }
     }
 
+    private void initializeCacheBudget() {
+        long effective = -1L;
+        if (cacheMaxBytes > 0) {
+            effective = cacheMaxBytes;
+        } else if (cacheMaxPercent > 0) {
+            long maxMem = Runtime.getRuntime().maxMemory();
+            effective = Math.max(0L, (maxMem * cacheMaxPercent) / 100);
+        }
+        cacheBudgetBytes = effective;
+        if (cacheBudgetBytes > 0) {
+            log.info(
+                    "PDF JSON cache budget configured: {} bytes (source: {})",
+                    cacheBudgetBytes,
+                    cacheMaxBytes > 0 ? "max-bytes" : "max-percent");
+        } else {
+            log.info("PDF JSON cache budget: unlimited");
+        }
+    }
+
     public byte[] convertPdfToJson(MultipartFile file) throws IOException {
         return convertPdfToJson(file, null, false);
     }
@@ -236,7 +278,10 @@ public class PdfJsonConversionService {
             log.debug("Generated synthetic jobId for synchronous conversion: {}", jobId);
         } else {
             jobId = contextJobId;
-            log.debug("Starting PDF to JSON conversion, jobId from context: {}", jobId);
+            log.info(
+                    "Starting PDF to JSON conversion, jobId from context: {} (lightweight={})",
+                    jobId,
+                    lightweight);
         }
 
         Consumer<PdfJsonConversionProgress> progress =
@@ -318,9 +363,9 @@ public class PdfJsonConversionService {
 
             try (PDDocument document = pdfDocumentFactory.load(workingPath, true)) {
                 int totalPages = document.getNumberOfPages();
-                // Only use lazy images for real async jobs where client can access the cache
-                // Synchronous calls with synthetic jobId should do full extraction
-                boolean useLazyImages = totalPages > 5 && isRealJobId;
+                // Always enable lazy mode for real async jobs so cache is available regardless of
+                // page count. Synchronous calls with synthetic jobId still do full extraction.
+                boolean useLazyImages = isRealJobId;
                 Map<COSBase, FontModelCacheEntry> fontCache = new IdentityHashMap<>();
                 Map<COSBase, EncodedImage> imageCache = new IdentityHashMap<>();
                 log.debug(
@@ -403,6 +448,11 @@ public class PdfJsonConversionService {
 
                 // Only cache for real async jobIds, not synthetic synchronous ones
                 if (useLazyImages && isRealJobId) {
+                    log.info(
+                            "Creating cache for jobId: {} (useLazyImages={}, isRealJobId={})",
+                            jobId,
+                            useLazyImages,
+                            isRealJobId);
                     PdfJsonDocumentMetadata docMetadata = new PdfJsonDocumentMetadata();
                     docMetadata.setMetadata(pdfJson.getMetadata());
                     docMetadata.setXmpMetadata(pdfJson.getXmpMetadata());
@@ -435,16 +485,23 @@ public class PdfJsonConversionService {
                         cachedPdfBytes = Files.readAllBytes(workingPath);
                     }
                     CachedPdfDocument cached =
-                            new CachedPdfDocument(
-                                    cachedPdfBytes, docMetadata, fonts, pageFontResources);
-                    documentCache.put(jobId, cached);
-                    log.debug(
-                            "Cached PDF bytes ({} bytes, {} pages, {} fonts) for lazy images, jobId: {}",
-                            cachedPdfBytes.length,
+                            buildCachedDocument(
+                                    jobId, cachedPdfBytes, docMetadata, fonts, pageFontResources);
+                    putCachedDocument(jobId, cached);
+                    log.info(
+                            "Successfully cached PDF ({} bytes, {} pages, {} fonts) for jobId: {} (diskBacked={})",
+                            cached.getPdfSize(),
                             totalPages,
                             fonts.size(),
-                            jobId);
+                            jobId,
+                            cached.isDiskBacked());
                     scheduleDocumentCleanup(jobId);
+                } else {
+                    log.warn(
+                            "Skipping cache creation: useLazyImages={}, isRealJobId={}, jobId={}",
+                            useLazyImages,
+                            isRealJobId,
+                            jobId);
                 }
 
                 if (lightweight) {
@@ -2973,6 +3030,139 @@ public class PdfJsonConversionService {
         }
     }
 
+    // Cache helpers
+    private CachedPdfDocument buildCachedDocument(
+            String jobId,
+            byte[] pdfBytes,
+            PdfJsonDocumentMetadata metadata,
+            Map<String, PdfJsonFont> fonts,
+            Map<Integer, Map<PDFont, String>> pageFontResources)
+            throws IOException {
+        if (pdfBytes == null) {
+            throw new IllegalArgumentException("pdfBytes must not be null");
+        }
+        long budget = cacheBudgetBytes;
+        // If single document is larger than budget, spill straight to disk
+        if (budget > 0 && pdfBytes.length > budget) {
+            TempFile tempFile = new TempFile(tempFileManager, ".pdfjsoncache");
+            Files.write(tempFile.getPath(), pdfBytes);
+            log.debug(
+                    "Cached PDF spilled to disk ({} bytes exceeds budget {}) for jobId {}",
+                    pdfBytes.length,
+                    budget,
+                    jobId);
+            return new CachedPdfDocument(
+                    null, tempFile, pdfBytes.length, metadata, fonts, pageFontResources);
+        }
+        return new CachedPdfDocument(
+                pdfBytes, null, pdfBytes.length, metadata, fonts, pageFontResources);
+    }
+
+    private void putCachedDocument(String jobId, CachedPdfDocument cached) {
+        synchronized (cacheLock) {
+            CachedPdfDocument existing = documentCache.put(jobId, cached);
+            if (existing != null) {
+                lruCache.remove(jobId);
+                currentCacheBytes = Math.max(0L, currentCacheBytes - existing.getInMemorySize());
+                existing.close();
+            }
+            lruCache.put(jobId, cached);
+            currentCacheBytes += cached.getInMemorySize();
+            enforceCacheBudget();
+        }
+    }
+
+    private CachedPdfDocument getCachedDocument(String jobId) {
+        synchronized (cacheLock) {
+            CachedPdfDocument cached = documentCache.get(jobId);
+            if (cached != null) {
+                lruCache.remove(jobId);
+                lruCache.put(jobId, cached);
+            }
+            return cached;
+        }
+    }
+
+    private void enforceCacheBudget() {
+        if (cacheBudgetBytes <= 0) {
+            return;
+        }
+        // Must be called under cacheLock
+        java.util.Iterator<java.util.Map.Entry<String, CachedPdfDocument>> it =
+                lruCache.entrySet().iterator();
+        while (currentCacheBytes > cacheBudgetBytes && it.hasNext()) {
+            java.util.Map.Entry<String, CachedPdfDocument> entry = it.next();
+            it.remove();
+            CachedPdfDocument removed = entry.getValue();
+            documentCache.remove(entry.getKey(), removed);
+            currentCacheBytes = Math.max(0L, currentCacheBytes - removed.getInMemorySize());
+            removed.close();
+            log.warn(
+                    "Evicted cached PDF for jobId {} to enforce cache budget (budget={} bytes, current={} bytes)",
+                    entry.getKey(),
+                    cacheBudgetBytes,
+                    currentCacheBytes);
+        }
+        if (currentCacheBytes > cacheBudgetBytes && !lruCache.isEmpty()) {
+            // Spill the most recently used large entry to disk
+            String key =
+                    lruCache.entrySet().stream()
+                            .reduce((first, second) -> second)
+                            .map(java.util.Map.Entry::getKey)
+                            .orElse(null);
+            if (key != null) {
+                CachedPdfDocument doc = lruCache.get(key);
+                if (doc != null && doc.getInMemorySize() > 0) {
+                    try {
+                        CachedPdfDocument diskDoc =
+                                buildCachedDocument(
+                                        key,
+                                        doc.getPdfBytes(),
+                                        doc.getMetadata(),
+                                        doc.getFonts(),
+                                        doc.getPageFontResources());
+                        lruCache.put(key, diskDoc);
+                        documentCache.put(key, diskDoc);
+                        currentCacheBytes =
+                                Math.max(0L, currentCacheBytes - doc.getInMemorySize())
+                                        + diskDoc.getInMemorySize();
+                        doc.close();
+                        log.debug("Spilled cached PDF for jobId {} to disk to satisfy budget", key);
+                    } catch (IOException ex) {
+                        log.warn(
+                                "Failed to spill cached PDF for jobId {} to disk: {}",
+                                key,
+                                ex.getMessage());
+                    }
+                }
+            }
+        }
+    }
+
+    private void removeCachedDocument(String jobId) {
+        log.warn(
+                "removeCachedDocument called for jobId: {} [CALLER: {}]",
+                jobId,
+                Thread.currentThread().getStackTrace()[2].toString());
+        CachedPdfDocument removed = null;
+        synchronized (cacheLock) {
+            removed = documentCache.remove(jobId);
+            if (removed != null) {
+                lruCache.remove(jobId);
+                currentCacheBytes = Math.max(0L, currentCacheBytes - removed.getInMemorySize());
+                log.warn(
+                        "Removed cached document for jobId: {} (size={} bytes)",
+                        jobId,
+                        removed.getInMemorySize());
+            } else {
+                log.warn("Attempted to remove jobId: {} but it was not in cache", jobId);
+            }
+        }
+        if (removed != null) {
+            removed.close();
+        }
+    }
+
     private void applyTextState(PDPageContentStream contentStream, PdfJsonTextElement element)
             throws IOException {
         if (element.getCharacterSpacing() != null) {
@@ -5311,6 +5501,8 @@ public class PdfJsonConversionService {
      */
     private static class CachedPdfDocument {
         private final byte[] pdfBytes;
+        private final TempFile pdfTempFile;
+        private final long pdfSize;
         private final PdfJsonDocumentMetadata metadata;
         private final Map<String, PdfJsonFont> fonts; // Font map with UIDs for consistency
         private final Map<Integer, Map<PDFont, String>> pageFontResources; // Page font resources
@@ -5318,10 +5510,14 @@ public class PdfJsonConversionService {
 
         public CachedPdfDocument(
                 byte[] pdfBytes,
+                TempFile pdfTempFile,
+                long pdfSize,
                 PdfJsonDocumentMetadata metadata,
                 Map<String, PdfJsonFont> fonts,
                 Map<Integer, Map<PDFont, String>> pageFontResources) {
             this.pdfBytes = pdfBytes;
+            this.pdfTempFile = pdfTempFile;
+            this.pdfSize = pdfSize;
             this.metadata = metadata;
             // Create defensive copies to prevent mutation of shared maps
             this.fonts =
@@ -5336,8 +5532,14 @@ public class PdfJsonConversionService {
         }
 
         // Getters return defensive copies to prevent external mutation
-        public byte[] getPdfBytes() {
-            return pdfBytes;
+        public byte[] getPdfBytes() throws IOException {
+            if (pdfBytes != null) {
+                return pdfBytes;
+            }
+            if (pdfTempFile != null) {
+                return Files.readAllBytes(pdfTempFile.getPath());
+            }
+            throw new IOException("Cached PDF backing missing");
         }
 
         public PdfJsonDocumentMetadata getMetadata() {
@@ -5352,6 +5554,18 @@ public class PdfJsonConversionService {
             return new java.util.concurrent.ConcurrentHashMap<>(pageFontResources);
         }
 
+        public long getPdfSize() {
+            return pdfSize;
+        }
+
+        public long getInMemorySize() {
+            return pdfBytes != null ? pdfBytes.length : 0L;
+        }
+
+        public boolean isDiskBacked() {
+            return pdfBytes == null && pdfTempFile != null;
+        }
+
         public long getTimestamp() {
             return timestamp;
         }
@@ -5363,7 +5577,19 @@ public class PdfJsonConversionService {
         public CachedPdfDocument withUpdatedFonts(
                 byte[] nextBytes, Map<String, PdfJsonFont> nextFonts) {
             Map<String, PdfJsonFont> fontsToUse = nextFonts != null ? nextFonts : this.fonts;
-            return new CachedPdfDocument(nextBytes, metadata, fontsToUse, pageFontResources);
+            return new CachedPdfDocument(
+                    nextBytes,
+                    null,
+                    nextBytes != null ? nextBytes.length : 0,
+                    metadata,
+                    fontsToUse,
+                    pageFontResources);
+        }
+
+        public void close() {
+            if (pdfTempFile != null) {
+                pdfTempFile.close();
+            }
         }
     }
 
@@ -5444,14 +5670,15 @@ public class PdfJsonConversionService {
             // Cache PDF bytes, metadata, and fonts for lazy page loading
             if (jobId != null) {
                 CachedPdfDocument cached =
-                        new CachedPdfDocument(pdfBytes, docMetadata, fonts, pageFontResources);
-                documentCache.put(jobId, cached);
+                        buildCachedDocument(jobId, pdfBytes, docMetadata, fonts, pageFontResources);
+                putCachedDocument(jobId, cached);
                 log.debug(
-                        "Cached PDF bytes ({} bytes, {} pages, {} fonts) for lazy loading, jobId: {}",
-                        pdfBytes.length,
+                        "Cached PDF bytes ({} bytes, {} pages, {} fonts) for lazy loading, jobId: {} (diskBacked={})",
+                        cached.getPdfSize(),
                         totalPages,
                         fonts.size(),
-                        jobId);
+                        jobId,
+                        cached.isDiskBacked());
 
                 // Schedule cleanup after 30 minutes
                 scheduleDocumentCleanup(jobId);
@@ -5466,9 +5693,10 @@ public class PdfJsonConversionService {
 
     /** Extracts a single page from cached PDF bytes. Re-loads the PDF for each request. */
     public byte[] extractSinglePage(String jobId, int pageNumber) throws IOException {
-        CachedPdfDocument cached = documentCache.get(jobId);
+        CachedPdfDocument cached = getCachedDocument(jobId);
         if (cached == null) {
-            throw new IllegalArgumentException("No cached document found for jobId: " + jobId);
+            throw new stirling.software.SPDF.exception.CacheUnavailableException(
+                    "No cached document found for jobId: " + jobId);
         }
 
         int pageIndex = pageNumber - 1;
@@ -5480,8 +5708,8 @@ public class PdfJsonConversionService {
         }
 
         log.debug(
-                "Loading PDF from bytes ({} bytes) to extract page {} (jobId: {})",
-                cached.getPdfBytes().length,
+                "Loading PDF from {} to extract page {} (jobId: {})",
+                cached.isDiskBacked() ? "disk cache" : "memory cache",
                 pageNumber,
                 jobId);
 
@@ -5627,10 +5855,21 @@ public class PdfJsonConversionService {
         if (jobId == null || jobId.isBlank()) {
             throw new IllegalArgumentException("jobId is required for incremental export");
         }
-        CachedPdfDocument cached = documentCache.get(jobId);
+        log.info("Looking up cache for jobId: {}", jobId);
+        CachedPdfDocument cached = getCachedDocument(jobId);
         if (cached == null) {
-            throw new IllegalArgumentException("No cached document available for jobId: " + jobId);
+            log.error(
+                    "Cache not found for jobId: {}. Available cache keys: {}",
+                    jobId,
+                    documentCache.keySet());
+            throw new stirling.software.SPDF.exception.CacheUnavailableException(
+                    "No cached document available for jobId: " + jobId);
         }
+        log.info(
+                "Found cached document for jobId: {} (size={}, diskBacked={})",
+                jobId,
+                cached.getPdfSize(),
+                cached.isDiskBacked());
         if (updates == null || updates.getPages() == null || updates.getPages().isEmpty()) {
             log.debug(
                     "Incremental export requested with no page updates; returning cached PDF for jobId {}",
@@ -5709,7 +5948,14 @@ public class PdfJsonConversionService {
             document.save(baos);
             byte[] updatedBytes = baos.toByteArray();
 
-            documentCache.put(jobId, cached.withUpdatedFonts(updatedBytes, mergedFonts));
+            CachedPdfDocument updated =
+                    buildCachedDocument(
+                            jobId,
+                            updatedBytes,
+                            cached.getMetadata(),
+                            mergedFonts,
+                            cached.getPageFontResources());
+            putCachedDocument(jobId, updated);
 
             // Clear Type3 cache entries for this incremental update
             clearType3CacheEntriesForJob(updateJobId);
@@ -5724,11 +5970,13 @@ public class PdfJsonConversionService {
 
     /** Clears a cached document. */
     public void clearCachedDocument(String jobId) {
-        CachedPdfDocument cached = documentCache.remove(jobId);
+        CachedPdfDocument cached = getCachedDocument(jobId);
+        removeCachedDocument(jobId);
         if (cached != null) {
             log.debug(
-                    "Removed cached PDF bytes ({} bytes) for jobId: {}",
-                    cached.getPdfBytes().length,
+                    "Removed cached PDF ({} bytes, diskBacked={}) for jobId: {}",
+                    cached.getPdfSize(),
+                    cached.isDiskBacked(),
                     jobId);
         }
 

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonFallbackFontService.java

@@ -312,12 +312,29 @@ public class PdfJsonFallbackFontService {
                                     "ttf")));
 
     private final ResourceLoader resourceLoader;
+    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
     @Value("${stirling.pdf.fallback-font:" + DEFAULT_FALLBACK_FONT_LOCATION + "}")
+    private String legacyFallbackFontLocation;
+
     private String fallbackFontLocation;
 
     private final Map<String, byte[]> fallbackFontCache = new ConcurrentHashMap<>();
 
+    @jakarta.annotation.PostConstruct
+    private void loadConfig() {
+        String configured = null;
+        if (applicationProperties.getPdfEditor() != null) {
+            configured = applicationProperties.getPdfEditor().getFallbackFont();
+        }
+        if (configured != null && !configured.isBlank()) {
+            fallbackFontLocation = configured;
+        } else {
+            fallbackFontLocation = legacyFallbackFontLocation;
+        }
+        log.info("Using fallback font location: {}", fallbackFontLocation);
+    }
+
     public PdfJsonFont buildFallbackFontModel() throws IOException {
         return buildFallbackFontModel(FALLBACK_FONT_ID);
     }

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/PdfJsonFontService.java

@@ -5,7 +5,6 @@ import java.nio.file.Files;
 import java.util.Base64;
 import java.util.Locale;
 
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
 import jakarta.annotation.PostConstruct;
@@ -25,22 +24,16 @@ import stirling.software.common.util.TempFileManager;
 public class PdfJsonFontService {
 
     private final TempFileManager tempFileManager;
+    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
-    @Getter
-    @Value("${stirling.pdf.json.cff-converter.enabled:true}")
-    private boolean cffConversionEnabled;
+    @Getter private boolean cffConversionEnabled;
 
-    @Getter
-    @Value("${stirling.pdf.json.cff-converter.method:python}")
-    private String cffConverterMethod;
+    @Getter private String cffConverterMethod;
 
-    @Value("${stirling.pdf.json.cff-converter.python-command:/opt/venv/bin/python3}")
     private String pythonCommand;
 
-    @Value("${stirling.pdf.json.cff-converter.python-script:/scripts/convert_cff_to_ttf.py}")
     private String pythonScript;
 
-    @Value("${stirling.pdf.json.cff-converter.fontforge-command:fontforge}")
     private String fontforgeCommand;
 
     private volatile boolean pythonCffConverterAvailable;
@@ -48,6 +41,7 @@ public class PdfJsonFontService {
 
     @PostConstruct
     private void initialiseCffConverterAvailability() {
+        loadConfiguration();
         if (!cffConversionEnabled) {
             log.warn("[FONT-DEBUG] CFF conversion is DISABLED in configuration");
             pythonCffConverterAvailable = false;
@@ -77,6 +71,22 @@ public class PdfJsonFontService {
         log.info("[FONT-DEBUG] Selected CFF converter method: {}", cffConverterMethod);
     }
 
+    private void loadConfiguration() {
+        if (applicationProperties.getPdfEditor() != null
+                && applicationProperties.getPdfEditor().getCffConverter() != null) {
+            var cfg = applicationProperties.getPdfEditor().getCffConverter();
+            this.cffConversionEnabled = cfg.isEnabled();
+            this.cffConverterMethod = cfg.getMethod();
+            this.pythonCommand = cfg.getPythonCommand();
+            this.pythonScript = cfg.getPythonScript();
+            this.fontforgeCommand = cfg.getFontforgeCommand();
+        } else {
+            // Use defaults when config is not available
+            this.cffConversionEnabled = false;
+            log.warn("[FONT-DEBUG] PdfEditor configuration not available, CFF conversion disabled");
+        }
+    }
+
     public byte[] convertCffProgramToTrueType(byte[] fontBytes, String toUnicode) {
         if (!cffConversionEnabled || fontBytes == null || fontBytes.length == 0) {
             log.warn(

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/type3/Type3LibraryStrategy.java

@@ -2,7 +2,6 @@ package stirling.software.SPDF.service.pdfjson.type3;
 
 import java.io.IOException;
 
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 
@@ -23,8 +22,8 @@ import stirling.software.SPDF.service.pdfjson.type3.library.Type3FontLibraryPayl
 public class Type3LibraryStrategy implements Type3ConversionStrategy {
 
     private final Type3FontLibrary fontLibrary;
+    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
-    @Value("${stirling.pdf.json.type3.library.enabled:true}")
     private boolean enabled;
 
     @Override
@@ -42,6 +41,19 @@ public class Type3LibraryStrategy implements Type3ConversionStrategy {
         return enabled && fontLibrary != null && fontLibrary.isLoaded();
     }
 
+    @jakarta.annotation.PostConstruct
+    private void loadConfiguration() {
+        if (applicationProperties.getPdfEditor() != null
+                && applicationProperties.getPdfEditor().getType3() != null
+                && applicationProperties.getPdfEditor().getType3().getLibrary() != null) {
+            var cfg = applicationProperties.getPdfEditor().getType3().getLibrary();
+            this.enabled = cfg.isEnabled();
+        } else {
+            this.enabled = false;
+            log.warn("PdfEditor Type3 library configuration not available, disabled");
+        }
+    }
+
     @Override
     public PdfJsonFontConversionCandidate convert(
             Type3ConversionRequest request, Type3GlyphContext context) throws IOException {

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/type3/library/Type3FontLibrary.java

@@ -14,7 +14,6 @@ import java.util.stream.Collectors;
 
 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.pdmodel.font.PDType3Font;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.Resource;
 import org.springframework.core.io.ResourceLoader;
 import org.springframework.stereotype.Component;
@@ -34,8 +33,8 @@ public class Type3FontLibrary {
 
     private final ObjectMapper objectMapper;
     private final ResourceLoader resourceLoader;
+    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
-    @Value("${stirling.pdf.json.type3.library.index:classpath:/type3/library/index.json}")
     private String indexLocation;
 
     private final Map<String, Type3FontLibraryEntry> signatureIndex = new ConcurrentHashMap<>();
@@ -44,6 +43,17 @@ public class Type3FontLibrary {
 
     @jakarta.annotation.PostConstruct
     void initialise() {
+        if (applicationProperties.getPdfEditor() != null
+                && applicationProperties.getPdfEditor().getType3() != null
+                && applicationProperties.getPdfEditor().getType3().getLibrary() != null) {
+            this.indexLocation =
+                    applicationProperties.getPdfEditor().getType3().getLibrary().getIndex();
+        } else {
+            log.warn(
+                    "[TYPE3] PdfEditor Type3 library configuration not available; Type3 library disabled");
+            entries = List.of();
+            return;
+        }
         Resource resource = resourceLoader.getResource(indexLocation);
         if (!resource.exists()) {
             log.info("[TYPE3] Library index {} not found; Type3 library disabled", indexLocation);

app/core/src/main/resources/settings.yml.template

@@ -58,6 +58,8 @@ security:
     idpCert: classpath:okta.cert # The certificate your Provider will use to authenticate your app's SAML authentication requests. Provided by your Provider
     privateKey: classpath:saml-private-key.key # Your private key. Generated from your keypair
     spCert: classpath:saml-public-cert.crt # Your signing certificate. Generated from your keypair
+    # IMPORTANT: For SAML setup, download your SP metadata from the BACKEND URL: http://localhost:8080/saml2/service-provider-metadata/{registrationId}
+    # Do NOT use the frontend dev server URL (localhost:5173) as it will generate incorrect ACS URLs. Always use the backend URL (localhost:8080) for SAML configuration.
   jwt: # This feature is currently under development and not yet fully supported. Do not use in production.
     persistence: true # Set to 'true' to enable JWT key store
     enableKeyRotation: true # Set to 'true' to enable key pair rotation
@@ -126,13 +128,15 @@ system:
   customHTMLFiles: false # enable to have files placed in /customFiles/templates override the existing template HTML files
   tessdataDir: /usr/share/tessdata # path to the directory containing the Tessdata files. This setting is relevant for Windows systems. For Windows users, this path should be adjusted to point to the appropriate directory where the Tessdata files are stored.
   enableAnalytics: null # Master toggle for analytics: set to 'true' to enable all analytics, 'false' to disable all analytics, or leave as 'null' to prompt admin on first launch
+  enableDesktopInstallSlide: true # Set to 'false' to hide the desktop app installation slide in the onboarding flow
   enablePosthog: null # Enable PostHog analytics (open-source product analytics): set to 'true' to enable, 'false' to disable, or 'null' to enable by default when analytics is enabled
   enableScarf: null # Enable Scarf tracking pixel: set to 'true' to enable, 'false' to disable, or 'null' to enable by default when analytics is enabled
   enableUrlToPDF: false # Set to 'true' to enable URL to PDF, INTERNAL ONLY, known security issues, should not be used externally
   disableSanitize: false # set to true to disable Sanitize HTML; (can lead to injections in HTML)
   maxDPI: 500 # Maximum allowed DPI for PDF to image conversion
-  corsAllowedOrigins: [] # List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS.
-  frontendUrl: '' # Base URL for frontend (e.g. 'https://pdf.example.com'). Used for generating invite links in emails. If empty, falls back to backend URL.
+  corsAllowedOrigins: [] # List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS. For local development with frontend on port 5173, add 'http://localhost:5173'
+  backendUrl: '' # Backend base URL for SAML/OAuth/API callbacks (e.g. 'http://localhost:8080' for dev, 'https://api.example.com' for production). REQUIRED for SSO authentication to work correctly. This is where your IdP will send SAML responses and OAuth callbacks. Leave empty to default to 'http://localhost:8080' in development.
+  frontendUrl: '' # Frontend URL for invite email links (e.g. 'https://app.example.com'). Optional - if not set, will use backendUrl. This is the URL users click in invite emails.
   serverCertificate:
     enabled: true # Enable server-side certificate for "Sign with Stirling-PDF" option
     organizationName: Stirling-PDF # Organization name for generated certificates
@@ -178,23 +182,6 @@ system:
   databaseBackup:
     cron: '0 0 0 * * ?' # Cron expression for automatic database backups "0 0 0 * * ?" daily at midnight
 
-stirling:
-  pdf:
-    fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
-    json:
-      font-normalization:
-        enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
-      cff-converter:
-        enabled: true # Wrap CFF/Type1C fonts as OpenType-CFF for browser compatibility
-        method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
-        python-command: /opt/venv/bin/python3 # Python interpreter path
-        python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
-        fontforge-command: fontforge # Override if FontForge is installed under a different name/path
-      type3:
-        library:
-          enabled: true # Match common Type3 fonts against the built-in library of converted programs
-          index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)
-
 ui:
   appNameNavbar: '' # name displayed on the navigation bar
   logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)
@@ -223,6 +210,7 @@ processExecutor:
     weasyPrintSessionLimit: 16
     installAppSessionLimit: 1
     calibreSessionLimit: 1
+    imageMagickSessionLimit: 4
     ghostscriptSessionLimit: 8
     ocrMyPdfSessionLimit: 2
   timeoutMinutes: # Process executor timeout in minutes
@@ -232,7 +220,26 @@ processExecutor:
     weasyPrinttimeoutMinutes: 30
     installApptimeoutMinutes: 60
     calibretimeoutMinutes: 30
+    imageMagickTimeoutMinutes: 30
     tesseractTimeoutMinutes: 30
     qpdfTimeoutMinutes: 30
     ghostscriptTimeoutMinutes: 30
     ocrMyPdfTimeoutMinutes: 30
+
+pdfEditor:
+  fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
+  cache:
+    max-bytes: -1 # Max in-memory cache size in bytes; -1 disables byte cap
+    max-percent: 20 # Max in-memory cache as % of JVM max; used when max-bytes <= 0
+  font-normalization:
+    enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
+  cff-converter:
+    enabled: true # Wrap CFF/Type1CFF fonts as OpenType-CFF for browser compatibility
+    method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
+    python-command: /opt/venv/bin/python3 # Python interpreter path
+    python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
+    fontforge-command: fontforge # Override if FontForge is installed under a different name/path
+  type3:
+    library:
+      enabled: true # Match common Type3 fonts against the built-in library of converted programs
+      index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)

app/core/src/test/java/stirling/software/SPDF/controller/api/security/CertSignControllerTest.java

@@ -1,9 +1,10 @@
 package stirling.software.SPDF.controller.api.security;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.lenient;
 
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
@@ -107,7 +108,8 @@ class CertSignControllerTest {
             derCertBytes = baos.toByteArray();
         }
 
-        when(pdfDocumentFactory.load(any(MultipartFile.class)))
+        lenient()
+                .when(pdfDocumentFactory.load(any(MultipartFile.class)))
                 .thenAnswer(
                         invocation -> {
                             MultipartFile file = invocation.getArgument(0);
@@ -167,6 +169,31 @@ class CertSignControllerTest {
         assertTrue(response.getBody().length > 0);
     }
 
+    @Test
+    void testSignPdfWithMissingPkcs12FileThrowsError() {
+        MockMultipartFile pdfFile =
+                new MockMultipartFile(
+                        "fileInput", "test.pdf", MediaType.APPLICATION_PDF_VALUE, pdfBytes);
+
+        SignPDFWithCertRequest request = new SignPDFWithCertRequest();
+        request.setFileInput(pdfFile);
+        request.setCertType("PFX");
+        request.setPassword("password");
+        request.setShowSignature(false);
+        request.setReason("test");
+        request.setLocation("test");
+        request.setName("tester");
+        request.setPageNumber(1);
+        request.setShowLogo(false);
+
+        IllegalArgumentException exception =
+                assertThrows(
+                        IllegalArgumentException.class,
+                        () -> certSignController.signPDFWithCert(request));
+
+        assertTrue(exception.getMessage().contains("PKCS12 keystore"));
+    }
+
     @Test
     void testSignPdfWithJks() throws Exception {
         MockMultipartFile pdfFile =

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java

@@ -94,6 +94,22 @@ public class ProprietaryUIDataController {
         this.auditRepository = auditRepository;
     }
 
+    /**
+     * Get the backend base URL for SAML/OAuth redirects. Uses system.backendUrl from config if set,
+     * otherwise defaults to http://localhost:8080
+     */
+    private String getBackendBaseUrl() {
+        String backendUrl = applicationProperties.getSystem().getBackendUrl();
+
+        // If backendUrl is configured, use it
+        if (backendUrl != null && !backendUrl.trim().isEmpty()) {
+            return backendUrl.trim();
+        }
+
+        // For development, default to localhost:8080 (backend port)
+        return "http://localhost:8080";
+    }
+
     @GetMapping("/audit-dashboard")
     @PreAuthorize("hasRole('ADMIN')")
     @EnterpriseEndpoint
@@ -185,14 +201,17 @@ public class ProprietaryUIDataController {
         }
 
         SAML2 saml2 = securityProps.getSaml2();
-        if (securityProps.isSaml2Active()
-                && applicationProperties.getSystem().getEnableAlphaFunctionality()
-                && applicationProperties.getPremium().isEnabled()) {
+        if (securityProps.isSaml2Active() && applicationProperties.getPremium().isEnabled()) {
             String samlIdp = saml2.getProvider();
             String saml2AuthenticationPath = "/saml2/authenticate/" + saml2.getRegistrationId();
 
+            // For SAML, we need to use the backend URL directly, not a relative path
+            // This ensures Spring Security generates the correct ACS URL
+            String backendUrl = getBackendBaseUrl();
+            String fullSamlPath = backendUrl + saml2AuthenticationPath;
+
             if (!applicationProperties.getPremium().getProFeatures().isSsoAutoLogin()) {
-                providerList.put(saml2AuthenticationPath, samlIdp + " (SAML 2)");
+                providerList.put(fullSamlPath, samlIdp + " (SAML 2)");
             }
         }
 

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/SignatureController.java

@@ -22,7 +22,6 @@ import org.springframework.web.bind.annotation.RestController;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.annotations.api.UserApi;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.proprietary.model.api.signature.SavedSignatureRequest;
 import stirling.software.proprietary.model.api.signature.SavedSignatureResponse;
@@ -34,7 +33,6 @@ import stirling.software.proprietary.service.SignatureService;
  * authentication and enforces per-user storage limits. All endpoints require authentication
  * via @PreAuthorize("isAuthenticated()").
  */
-@UserApi
 @Slf4j
 @RestController
 @RequestMapping("/api/v1/proprietary/signatures")

app/proprietary/src/main/java/stirling/software/proprietary/security/config/AccountWebController.java

@@ -120,9 +120,7 @@ public class AccountWebController {
 
         SAML2 saml2 = securityProps.getSaml2();
 
-        if (securityProps.isSaml2Active()
-                && applicationProperties.getSystem().getEnableAlphaFunctionality()
-                && applicationProperties.getPremium().isEnabled()) {
+        if (securityProps.isSaml2Active() && applicationProperties.getPremium().isEnabled()) {
             String samlIdp = saml2.getProvider();
             String saml2AuthenticationPath = "/saml2/authenticate/" + saml2.getRegistrationId();
 

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -334,7 +334,8 @@ public class SecurityConfiguration {
                                                                 securityProperties.getSaml2(),
                                                                 userService,
                                                                 jwtService,
-                                                                licenseSettingsService))
+                                                                licenseSettingsService,
+                                                                applicationProperties))
                                                 .failureHandler(
                                                         new CustomSaml2AuthenticationFailureHandler())
                                                 .authenticationRequestResolver(

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AuthController.java

@@ -244,10 +244,13 @@ public class AuthController {
         userMap.put("username", user.getUsername());
         userMap.put("role", user.getRolesAsString());
         userMap.put("enabled", user.isEnabled());
+        userMap.put(
+                "authenticationType",
+                user.getAuthenticationType()); // Expose authentication type for SSO detection
 
         // Add metadata for OAuth compatibility
         Map<String, Object> appMetadata = new HashMap<>();
-        appMetadata.put("provider", user.getAuthenticationType()); // Default to email provider
+        appMetadata.put("provider", user.getAuthenticationType());
         userMap.put("app_metadata", appMetadata);
 
         return userMap;

app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticationSuccessHandler.java

@@ -51,6 +51,7 @@ public class CustomSaml2AuthenticationSuccessHandler
     private final JwtServiceInterface jwtService;
     private final stirling.software.proprietary.service.UserLicenseSettingsService
             licenseSettingsService;
+    private final ApplicationProperties applicationProperties;
 
     @Override
     @Audited(type = AuditEventType.USER_LOGIN, level = AuditLevel.BASIC)
@@ -77,8 +78,8 @@ public class CustomSaml2AuthenticationSuccessHandler
                     log.warn(
                             "SAML2 login blocked for existing user '{}' - not eligible (not grandfathered and no ENTERPRISE license)",
                             username);
-                    response.sendRedirect(
-                            request.getContextPath() + "/logout?saml2RequiresLicense=true");
+                    String origin = resolveOrigin(request);
+                    response.sendRedirect(origin + "/logout?saml2RequiresLicense=true");
                     return;
                 }
             } else if (!licenseSettingsService.isSamlEligible(null)) {
@@ -86,8 +87,8 @@ public class CustomSaml2AuthenticationSuccessHandler
                 log.warn(
                         "SAML2 login blocked for new user '{}' - not eligible (no ENTERPRISE license for auto-creation)",
                         username);
-                response.sendRedirect(
-                        request.getContextPath() + "/logout?saml2RequiresLicense=true");
+                String origin = resolveOrigin(request);
+                response.sendRedirect(origin + "/logout?saml2RequiresLicense=true");
                 return;
             }
 
@@ -144,20 +145,28 @@ public class CustomSaml2AuthenticationSuccessHandler
                     log.debug(
                             "User {} exists with password but is not SSO user, redirecting to logout",
                             username);
-                    response.sendRedirect(
-                            contextPath + "/logout?oAuth2AuthenticationErrorWeb=true");
+                    String origin = resolveOrigin(request);
+                    response.sendRedirect(origin + "/logout?oAuth2AuthenticationErrorWeb=true");
                     return;
                 }
 
                 try {
-                    if (!userExists || saml2Properties.getBlockRegistration()) {
-                        log.debug("Registration blocked for new user: {}", username);
-                        response.sendRedirect(
-                                contextPath + "/login?errorOAuth=oAuth2AdminBlockedUser");
+                    // Block new users only if: blockRegistration is true OR autoCreateUser is false
+                    if (!userExists
+                            && (saml2Properties.getBlockRegistration()
+                                    || !saml2Properties.getAutoCreateUser())) {
+                        log.debug(
+                                "Registration blocked for new user '{}' (blockRegistration: {}, autoCreateUser: {})",
+                                username,
+                                saml2Properties.getBlockRegistration(),
+                                saml2Properties.getAutoCreateUser());
+                        String origin = resolveOrigin(request);
+                        response.sendRedirect(origin + "/login?errorOAuth=oAuth2AdminBlockedUser");
                         return;
                     }
                     if (!userExists && licenseSettingsService.wouldExceedLimit(1)) {
-                        response.sendRedirect(contextPath + "/logout?maxUsersReached=true");
+                        String origin = resolveOrigin(request);
+                        response.sendRedirect(origin + "/logout?maxUsersReached=true");
                         return;
                     }
 
@@ -222,16 +231,30 @@ public class CustomSaml2AuthenticationSuccessHandler
             String contextPath,
             String jwt) {
         String redirectPath = resolveRedirectPath(request, contextPath);
-        String origin =
-                resolveForwardedOrigin(request)
-                        .orElseGet(
-                                () ->
-                                        resolveOriginFromReferer(request)
-                                                .orElseGet(() -> buildOriginFromRequest(request)));
+        String origin = resolveOrigin(request);
         clearRedirectCookie(response);
         return origin + redirectPath + "#access_token=" + jwt;
     }
 
+    /**
+     * Resolve the origin (frontend URL) for redirects. First checks system.frontendUrl from config,
+     * then falls back to detecting from request headers.
+     */
+    private String resolveOrigin(HttpServletRequest request) {
+        // First check if frontendUrl is configured
+        String configuredFrontendUrl = applicationProperties.getSystem().getFrontendUrl();
+        if (configuredFrontendUrl != null && !configuredFrontendUrl.trim().isEmpty()) {
+            return configuredFrontendUrl.trim();
+        }
+
+        // Fall back to auto-detection from request headers
+        return resolveForwardedOrigin(request)
+                .orElseGet(
+                        () ->
+                                resolveOriginFromReferer(request)
+                                        .orElseGet(() -> buildOriginFromRequest(request)));
+    }
+
     private String resolveRedirectPath(HttpServletRequest request, String contextPath) {
         return extractRedirectPathFromCookie(request)
                 .filter(path -> path.startsWith("/"))

app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/Saml2Configuration.java

@@ -41,22 +41,74 @@ public class Saml2Configuration {
     @ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
     public RelyingPartyRegistrationRepository relyingPartyRegistrations() throws Exception {
         SAML2 samlConf = applicationProperties.getSecurity().getSaml2();
-        X509Certificate idpCert = CertificateUtils.readCertificate(samlConf.getIdpCert());
+
+        log.info(
+                "Initializing SAML2 configuration with registration ID: {}",
+                samlConf.getRegistrationId());
+
+        // Load IdP certificate
+        X509Certificate idpCert;
+        try {
+            Resource idpCertResource = samlConf.getIdpCert();
+            log.info("Loading IdP certificate from: {}", idpCertResource.getDescription());
+            if (!idpCertResource.exists()) {
+                log.error(
+                        "SAML2 IdP certificate not found at: {}", idpCertResource.getDescription());
+                throw new IllegalStateException(
+                        "SAML2 IdP certificate file does not exist: "
+                                + idpCertResource.getDescription());
+            }
+            idpCert = CertificateUtils.readCertificate(idpCertResource);
+            log.info(
+                    "Successfully loaded IdP certificate. Subject: {}",
+                    idpCert.getSubjectX500Principal().getName());
+        } catch (Exception e) {
+            log.error("Failed to load SAML2 IdP certificate: {}", e.getMessage(), e);
+            throw new IllegalStateException("Failed to load SAML2 IdP certificate", e);
+        }
+
         Saml2X509Credential verificationCredential = Saml2X509Credential.verification(idpCert);
+
+        // Load SP private key and certificate
         Resource privateKeyResource = samlConf.getPrivateKey();
         Resource certificateResource = samlConf.getSpCert();
-        Saml2X509Credential signingCredential =
-                new Saml2X509Credential(
-                        CertificateUtils.readPrivateKey(privateKeyResource),
-                        CertificateUtils.readCertificate(certificateResource),
-                        Saml2X509CredentialType.SIGNING);
+
+        log.info("Loading SP private key from: {}", privateKeyResource.getDescription());
+        if (!privateKeyResource.exists()) {
+            log.error("SAML2 SP private key not found at: {}", privateKeyResource.getDescription());
+            throw new IllegalStateException(
+                    "SAML2 SP private key file does not exist: "
+                            + privateKeyResource.getDescription());
+        }
+
+        log.info("Loading SP certificate from: {}", certificateResource.getDescription());
+        if (!certificateResource.exists()) {
+            log.error(
+                    "SAML2 SP certificate not found at: {}", certificateResource.getDescription());
+            throw new IllegalStateException(
+                    "SAML2 SP certificate file does not exist: "
+                            + certificateResource.getDescription());
+        }
+
+        Saml2X509Credential signingCredential;
+        try {
+            signingCredential =
+                    new Saml2X509Credential(
+                            CertificateUtils.readPrivateKey(privateKeyResource),
+                            CertificateUtils.readCertificate(certificateResource),
+                            Saml2X509CredentialType.SIGNING);
+            log.info("Successfully loaded SP credentials");
+        } catch (Exception e) {
+            log.error("Failed to load SAML2 SP credentials: {}", e.getMessage(), e);
+            throw new IllegalStateException("Failed to load SAML2 SP credentials", e);
+        }
         RelyingPartyRegistration rp =
                 RelyingPartyRegistration.withRegistrationId(samlConf.getRegistrationId())
                         .signingX509Credentials(c -> c.add(signingCredential))
                         .entityId(samlConf.getIdpIssuer())
                         .singleLogoutServiceBinding(Saml2MessageBinding.POST)
                         .singleLogoutServiceLocation(samlConf.getIdpSingleLogoutUrl())
-                        .singleLogoutServiceResponseLocation("http://localhost:8080/login")
+                        .singleLogoutServiceResponseLocation("{baseUrl}/login")
                         .assertionConsumerServiceBinding(Saml2MessageBinding.POST)
                         .assertionConsumerServiceLocation(
                                 "{baseUrl}/login/saml2/sso/{registrationId}")
@@ -75,9 +127,14 @@ public class Saml2Configuration {
                                                 .singleLogoutServiceLocation(
                                                         samlConf.getIdpSingleLogoutUrl())
                                                 .singleLogoutServiceResponseLocation(
-                                                        "http://localhost:8080/login")
+                                                        "{baseUrl}/login")
                                                 .wantAuthnRequestsSigned(true))
                         .build();
+
+        log.info(
+                "SAML2 configuration initialized successfully. Registration ID: {}, IdP: {}",
+                samlConf.getRegistrationId(),
+                samlConf.getIdpIssuer());
         return new InMemoryRelyingPartyRegistrationRepository(rp);
     }
 

app/proprietary/src/main/java/stirling/software/proprietary/service/ImageMagickLineArtConversionService.java

@@ -0,0 +1,81 @@
+package stirling.software.proprietary.service;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+import javax.imageio.ImageIO;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.service.LineArtConversionService;
+import stirling.software.common.util.ProcessExecutor;
+import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
+
+@Slf4j
+@Service
+public class ImageMagickLineArtConversionService implements LineArtConversionService {
+
+    @Override
+    public PDImageXObject convertImageToLineArt(
+            PDDocument doc, PDImageXObject originalImage, double threshold, int edgeLevel)
+            throws IOException {
+
+        Path inputImage = Files.createTempFile("lineart_image_input_", ".png");
+        Path outputImage = Files.createTempFile("lineart_image_output_", ".tiff");
+
+        try {
+            ImageIO.write(originalImage.getImage(), "png", inputImage.toFile());
+
+            List<String> command = new ArrayList<>();
+            command.add("magick");
+            command.add(inputImage.toString());
+            command.add("-colorspace");
+            command.add("Gray");
+
+            // Edge-aware line art conversion using ImageMagick's built-in operators.
+            // -edge/-negate/-normalize are standard convert options (IM v6+/v7) that
+            // accentuate outlines before thresholding to a bilevel image.
+            command.add("-edge");
+            command.add(String.valueOf(edgeLevel));
+            command.add("-negate");
+            command.add("-normalize");
+
+            command.add("-type");
+            command.add("Bilevel");
+            command.add("-threshold");
+            command.add(String.format(Locale.ROOT, "%.1f%%", threshold));
+            command.add("-compress");
+            command.add("Group4");
+            command.add(outputImage.toString());
+
+            ProcessExecutorResult result =
+                    ProcessExecutor.getInstance(ProcessExecutor.Processes.IMAGEMAGICK)
+                            .runCommandWithOutputHandling(command);
+
+            if (result.getRc() != 0) {
+                log.warn(
+                        "ImageMagick line art conversion failed with return code: {}",
+                        result.getRc());
+                throw new IOException("ImageMagick line art conversion failed");
+            }
+
+            byte[] convertedBytes = Files.readAllBytes(outputImage);
+            return PDImageXObject.createFromByteArray(
+                    doc, convertedBytes, originalImage.getCOSObject().toString());
+        } catch (Exception e) {
+            log.warn("ImageMagick line art conversion failed", e);
+            throw new IOException("ImageMagick line art conversion failed", e);
+        } finally {
+            Files.deleteIfExists(inputImage);
+            Files.deleteIfExists(outputImage);
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java

@@ -177,6 +177,13 @@ public class UserLicenseSettingsService {
      */
     @Transactional
     public void grandfatherExistingOAuthUsers() {
+        // Only grandfather users if this is a V1→V2 upgrade, not a fresh V2 install
+        Boolean isNewServer = applicationProperties.getAutomaticallyGenerated().getIsNewServer();
+        if (Boolean.TRUE.equals(isNewServer)) {
+            log.info("Fresh V2 installation detected - skipping OAuth user grandfathering");
+            return;
+        }
+
         UserLicenseSettings settings = getOrCreateSettings();
 
         // Check if we've already run this migration
@@ -348,30 +355,22 @@ public class UserLicenseSettingsService {
         String username = (user != null) ? user.getUsername() : "<new user>";
         log.info("OAuth eligibility check for user: {}", username);
 
-        // Grandfathered users always have OAuth access
-        if (user != null && user.isOauthGrandfathered()) {
-            log.debug("User {} is grandfathered for OAuth", user.getUsername());
+        // Check license first - if paying, they're eligible (no need to check grandfathering)
+        boolean hasPaid = hasPaidLicense();
+        if (hasPaid) {
+            log.debug("User {} eligible for OAuth via paid license", username);
             return true;
         }
 
-        // todo: remove
-        if (user != null) {
-            log.info(
-                    "User {} is NOT grandfathered (isOauthGrandfathered={})",
-                    username,
-                    user.isOauthGrandfathered());
-        } else {
-            log.info("New user attempting OAuth login - checking license requirement");
+        // No license - check if grandfathered (fallback for V1 users)
+        if (user != null && user.isOauthGrandfathered()) {
+            log.info("User {} eligible for OAuth via grandfathering (no paid license)", username);
+            return true;
         }
 
-        // Users can use OAuth with SERVER or ENTERPRISE license
-        boolean hasPaid = hasPaidLicense();
-        log.info(
-                "OAuth eligibility result: hasPaidLicense={}, user={}, eligible={}",
-                hasPaid,
-                username,
-                hasPaid);
-        return hasPaid;
+        // Not grandfathered and no license
+        log.info("User {} NOT eligible for OAuth: no paid license and not grandfathered", username);
+        return false;
     }
 
     /**
@@ -391,29 +390,26 @@ public class UserLicenseSettingsService {
         String username = (user != null) ? user.getUsername() : "<new user>";
         log.info("SAML2 eligibility check for user: {}", username);
 
-        // Grandfathered users always have SAML access
-        if (user != null && user.isOauthGrandfathered()) {
-            log.info("User {} is grandfathered for SAML2 - ELIGIBLE", username);
+        // Check license first - if paying, they're eligible (no need to check grandfathering)
+        boolean hasEnterprise = hasEnterpriseLicense();
+        if (hasEnterprise) {
+            log.debug("User {} eligible for SAML2 via ENTERPRISE license", username);
             return true;
         }
 
-        if (user != null) {
+        // No license - check if grandfathered (fallback for V1 users)
+        if (user != null && user.isOauthGrandfathered()) {
             log.info(
-                    "User {} is NOT grandfathered (isOauthGrandfathered={})",
-                    username,
-                    user.isOauthGrandfathered());
-        } else {
-            log.info("New user attempting SAML2 login - checking license requirement");
+                    "User {} eligible for SAML2 via grandfathering (no ENTERPRISE license)",
+                    username);
+            return true;
         }
 
-        // Users can use SAML only with ENTERPRISE license
-        boolean hasEnterprise = hasEnterpriseLicense();
+        // Not grandfathered and no license
         log.info(
-                "SAML2 eligibility result: hasEnterpriseLicense={}, user={}, eligible={}",
-                hasEnterprise,
-                username,
-                hasEnterprise);
-        return hasEnterprise;
+                "User {} NOT eligible for SAML2: no ENTERPRISE license and not grandfathered",
+                username);
+        return false;
     }
 
     /**

app/proprietary/src/test/java/stirling/software/proprietary/service/UserLicenseSettingsServiceTest.java

@@ -33,6 +33,7 @@ class UserLicenseSettingsServiceTest {
     @Mock private UserService userService;
     @Mock private ApplicationProperties applicationProperties;
     @Mock private ApplicationProperties.Premium premium;
+    @Mock private ApplicationProperties.AutomaticallyGenerated automaticallyGenerated;
     @Mock private LicenseKeyChecker licenseKeyChecker;
     @Mock private ObjectProvider<LicenseKeyChecker> licenseKeyCheckerProvider;
 
@@ -49,6 +50,8 @@ class UserLicenseSettingsServiceTest {
         mockSettings.setGrandfatheredUserSignature("80:test-signature");
 
         when(applicationProperties.getPremium()).thenReturn(premium);
+        when(applicationProperties.getAutomaticallyGenerated()).thenReturn(automaticallyGenerated);
+        when(automaticallyGenerated.getIsNewServer()).thenReturn(false); // Default: not a new server
         when(settingsRepository.findSettings()).thenReturn(Optional.of(mockSettings));
         when(userService.getTotalUsersCount()).thenReturn(80L);
         when(settingsRepository.save(any(UserLicenseSettings.class)))

build.gradle

@@ -59,7 +59,7 @@ repositories {
 
 allprojects {
     group = 'stirling.software'
-    version = '2.1.2'
+    version = '2.1.4'
 
     configurations.configureEach {
         exclude group: 'commons-logging', module: 'commons-logging'

docker/Dockerfile.unified

@@ -105,6 +105,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     gcompat \
     libc6-compat \
     libreoffice \
+    imagemagick \
     # pdftohtml
     poppler-utils \
     # OCR MY PDF

docker/backend/Dockerfile

@@ -81,6 +81,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     libc6-compat \
     libreoffice \
     ghostscript \
+    imagemagick \
     fontforge \
     # pdftohtml
     poppler-utils \

docker/backend/Dockerfile.fat

@@ -74,6 +74,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     libc6-compat \
     libreoffice \
     ghostscript \
+    imagemagick \
     fontforge \
     # pdftohtml
     poppler-utils \

docker/embedded/Dockerfile

@@ -99,6 +99,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     libc6-compat \
     libreoffice \
     ghostscript \
+    imagemagick \
     fontforge \
     # pdftohtml
     poppler-utils \

docker/embedded/Dockerfile.fat

@@ -101,6 +101,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     libc6-compat \
     libreoffice \
     ghostscript \
+    imagemagick \
     fontforge \
     # pdftohtml
     poppler-utils \

frontend/public/locales/de-DE/translation.toml

@@ -6131,8 +6131,8 @@ tags = "text,anmerkung,beschriftung"
 applySignatures = "Text anwenden"
 
 [addText.text]
-name = "Textinhalt"
-placeholder = "Geben Sie den hinzuzufügenden Text ein"
+name = "Text"
+placeholder = "Text eingeben"
 fontLabel = "Schriftart"
 fontSizeLabel = "Schriftgröße"
 fontSizePlaceholder = "Schriftgröße eingeben oder wählen (8-200)"

frontend/public/locales/en-GB/translation.toml

@@ -312,10 +312,10 @@ yamlAdvert = "Stirling PDF Pro supports YAML configuration files and other SSO f
 ssoAdvert = "Looking for more user management features? Check out Stirling PDF Pro"
 
 [analytics]
-title = "Do you want make Stirling PDF better?"
-paragraph1 = "Stirling PDF has opt in analytics to help us improve the product. We do not track any personal information or file contents."
+title = "Do you want to help make Stirling PDF better?"
+paragraph1 = "Stirling PDF has opt-in analytics to help us improve the product. We do not track any personal information or file contents."
 paragraph2 = "Please consider enabling analytics to help Stirling-PDF grow and to allow us to understand our users better."
-learnMore = "Learn more"
+learnMore = "Learn more about our analytics"
 enable = "Enable analytics"
 disable = "Disable analytics"
 settings = "You can change the settings for analytics in the config/settings.yml file"
@@ -340,6 +340,10 @@ advance = "Advanced"
 edit = "View & Edit"
 popular = "Popular"
 
+[footer]
+discord = "Discord"
+issues = "GitHub"
+
 [settings.preferences]
 title = "Preferences"
 
@@ -435,6 +439,25 @@ latestVersion = "Latest Version"
 checkForUpdates = "Check for Updates"
 viewDetails = "View Details"
 
+[settings.security]
+title = "Security"
+description = "Update your password to keep your account secure."
+
+[settings.security.password]
+subtitle = "Change your password. You will be logged out after updating."
+required = "All fields are required."
+mismatch = "New passwords do not match."
+error = "Unable to update password. Please verify your current password and try again."
+success = "Password updated successfully. Please sign in again."
+ssoDisabled = "Password changes are managed by your identity provider."
+current = "Current password"
+currentPlaceholder = "Enter your current password"
+new = "New password"
+newPlaceholder = "Enter a new password"
+confirm = "Confirm new password"
+confirmPlaceholder = "Re-enter your new password"
+update = "Update password"
+
 [settings.hotkeys]
 title = "Keyboard Shortcuts"
 description = "Customize keyboard shortcuts for quick tool access. Click \"Change shortcut\" and press a new key combination. Press Esc to cancel."
@@ -488,11 +511,16 @@ low = "Low"
 title = "Change Credentials"
 header = "Update Your Account Details"
 changePassword = "You are using default login credentials. Please enter a new password"
+ssoManaged = "Your account is managed by your identity provider."
 newUsername = "New Username"
 oldPassword = "Current Password"
 newPassword = "New Password"
 confirmNewPassword = "Confirm New Password"
 submit = "Submit Changes"
+credsUpdated = "Account updated"
+description = "Changes saved. Please log in again."
+error = "Unable to update username. Please verify your password and try again."
+changeUsername = "Update your username. You will be logged out after updating."
 
 [account]
 title = "Account Settings"
@@ -3703,6 +3731,16 @@ filesize = "File Size"
 [compress.grayscale]
 label = "Apply Grayscale for Compression"
 
+[compress.lineArt]
+label = "Convert images to line art"
+description = "Uses ImageMagick to reduce pages to high-contrast black and white for maximum size reduction."
+unavailable = "ImageMagick is not installed or enabled on this server"
+detailLevel = "Detail level"
+edgeEmphasis = "Edge emphasis"
+edgeLow = "Gentle"
+edgeMedium = "Balanced"
+edgeHigh = "Strong"
+
 [compress.tooltip.header]
 title = "Compress Settings Overview"
 
@@ -3720,6 +3758,10 @@ bullet2 = "Higher values reduce file size"
 title = "Grayscale"
 text = "Select this option to convert all images to black and white, which can significantly reduce file size especially for scanned PDFs or image-heavy documents."
 
+[compress.tooltip.lineArt]
+title = "Line Art"
+text = "Convert pages to high-contrast black and white using ImageMagick. Use detail level to control how much content becomes black, and edge emphasis to control how aggressively edges are detected."
+
 [compress.error]
 failed = "An error occurred while compressing the PDF."
 
@@ -4038,12 +4080,20 @@ settings = "Settings"
 adminSettings = "Admin Settings"
 allTools = "Tools"
 reader = "Reader"
+tours = "Tours"
+showMeAround = "Show me around"
+
+[quickAccess.toursTooltip]
+admin = "Watch walkthroughs here: Tools tour, New V2 layout tour, and the Admin tour."
+user = "Watch walkthroughs here: Tools tour and the New V2 layout tour."
 
 [quickAccess.helpMenu]
 toolsTour = "Tools Tour"
 toolsTourDesc = "Learn what the tools can do"
 adminTour = "Admin Tour"
 adminTourDesc = "Explore admin settings & features"
+whatsNewTour = "See what's new in V2"
+whatsNewTourDesc = "Tour the updated layout"
 
 [admin]
 error = "Error"
@@ -5070,6 +5120,7 @@ loading = "Loading..."
 back = "Back"
 continue = "Continue"
 error = "Error"
+save = "Save"
 
 [config.overview]
 title = "Application Configuration"
@@ -5236,6 +5287,16 @@ finish = "Finish"
 startTour = "Start Tour"
 startTourDescription = "Take a guided tour of Stirling PDF's key features"
 
+[onboarding.whatsNew]
+quickAccess = "Start at the <strong>Quick Access</strong> rail to jump between Reader, Automate, your files, and all the tours."
+leftPanel = "The left <strong>Tools</strong> panel lists everything you can do. Browse categories or search to find a tool quickly."
+fileUpload = "Use the <strong>Files</strong> button to upload or pick a recent PDF. We will load a sample so you can see the workspace."
+rightRail = "The <strong>Right Rail</strong> holds quick actions to select files, change theme or language, and download results."
+topBar = "The top bar lets you swap between <strong>Viewer</strong>, <strong>Page Editor</strong>, and <strong>Active Files</strong>."
+pageEditorView = "Switch to the Page Editor to reorder, rotate, or delete pages."
+activeFilesView = "Use Active Files to see everything you have open and pick what to work on."
+wrapUp = "That is what is new in V2. Open the <strong>Tours</strong> menu anytime to replay this, the Tools tour, or the Admin tour."
+
 [onboarding.welcomeModal]
 title = "Welcome to Stirling PDF!"
 description = "Would you like to take a quick 1-minute tour to learn the key features and how to get started?"
@@ -5256,6 +5317,10 @@ download = "Download →"
 showMeAround = "Show me around"
 skipTheTour = "Skip the tour"
 
+[onboarding.tourOverview]
+title = "Tour Overview"
+body = "Stirling PDF V2 ships with dozens of tools and a refreshed layout. Take a quick tour to see what changed and where to find the features you need."
+
 [onboarding.serverLicense]
 skip = "Skip for now"
 seePlans = "See Plans →"
@@ -5794,6 +5859,8 @@ notAvailable = "Audit system not available"
 notAvailableMessage = "The audit system is not configured or not available."
 disabled = "Audit logging is disabled"
 disabledMessage = "Enable audit logging in your application configuration to track system events."
+enterpriseRequired = "Enterprise License Required"
+enterpriseRequiredMessage = "The audit logging system is an enterprise feature. Please upgrade to an enterprise license to access audit logs and analytics."
 
 [audit.error]
 title = "Error loading audit system"

frontend/src-tauri/tauri.conf.json

@@ -1,74 +1,82 @@
 {
-  "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
-  "productName": "Stirling-PDF",
-  "version": "2.0.0",
-  "identifier": "stirling.pdf.dev",
-  "build": {
-    "frontendDist": "../dist",
-    "devUrl": "http://localhost:5173",
-    "beforeDevCommand": "npm run dev -- --mode desktop",
-    "beforeBuildCommand": "npm run build -- --mode desktop"
-  },
-  "app": {
-    "windows": [
-      {
-        "title": "Stirling-PDF",
-        "width": 1280,
-        "height": 800,
-        "resizable": true,
-        "fullscreen": false
-      }
-    ]
-  },
-  "bundle": {
-    "active": true,
-    "targets": ["deb", "rpm", "dmg", "app", "msi"],
-    "icon": [
-      "icons/icon.png",
-      "icons/icon.icns",
-      "icons/icon.ico",
-      "icons/16x16.png",
-      "icons/32x32.png",
-      "icons/64x64.png",
-      "icons/128x128.png",
-      "icons/192x192.png"
-    ],
-    "resources": [
-      "libs/*.jar",
-      "runtime/jre/**/*"
-    ],
-    "fileAssociations": [
-      {
-        "ext": ["pdf"],
-        "name": "PDF Document",
-        "description": "Open PDF files with Stirling-PDF",
-        "role": "Editor",
-        "mimeType": "application/pdf"
-      }
-    ],
-    "linux": {
-      "deb": {
-        "desktopTemplate": "stirling-pdf.desktop"
-      }
+    "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
+    "productName": "Stirling-PDF",
+    "version": "2.1.3",
+    "identifier": "stirling.pdf.dev",
+    "build": {
+        "frontendDist": "../dist",
+        "devUrl": "http://localhost:5173",
+        "beforeDevCommand": "npm run dev -- --mode desktop",
+        "beforeBuildCommand": "npm run build -- --mode desktop"
     },
-    "windows": {
-      "certificateThumbprint": null,
-      "digestAlgorithm": "sha256",
-      "timestampUrl": "http://timestamp.digicert.com"
+    "app": {
+        "windows": [
+            {
+                "title": "Stirling-PDF",
+                "width": 1280,
+                "height": 800,
+                "resizable": true,
+                "fullscreen": false
+            }
+        ]
     },
-    "macOS": {
-      "minimumSystemVersion": "10.15",
-      "signingIdentity": null,
-      "entitlements": null,
-      "providerShortName": null
+    "bundle": {
+        "active": true,
+        "targets": [
+            "deb",
+            "rpm",
+            "dmg",
+            "app",
+            "msi"
+        ],
+        "icon": [
+            "icons/icon.png",
+            "icons/icon.icns",
+            "icons/icon.ico",
+            "icons/16x16.png",
+            "icons/32x32.png",
+            "icons/64x64.png",
+            "icons/128x128.png",
+            "icons/192x192.png"
+        ],
+        "resources": [
+            "libs/*.jar",
+            "runtime/jre/**/*"
+        ],
+        "fileAssociations": [
+            {
+                "ext": [
+                    "pdf"
+                ],
+                "name": "PDF Document",
+                "description": "Open PDF files with Stirling-PDF",
+                "role": "Editor",
+                "mimeType": "application/pdf"
+            }
+        ],
+        "linux": {
+            "deb": {
+                "desktopTemplate": "stirling-pdf.desktop"
+            }
+        },
+        "windows": {
+            "certificateThumbprint": null,
+            "digestAlgorithm": "sha256",
+            "timestampUrl": "http://timestamp.digicert.com"
+        },
+        "macOS": {
+            "minimumSystemVersion": "10.15",
+            "signingIdentity": null,
+            "entitlements": null,
+            "providerShortName": null
+        }
+    },
+    "plugins": {
+        "shell": {
+            "open": true
+        },
+        "fs": {
+            "requireLiteralLeadingDot": false
+        }
     }
-  },
-  "plugins": {
-    "shell": {
-      "open": true
-    },
-    "fs": {
-      "requireLiteralLeadingDot": false
-    }
-  }
 }

frontend/src/core/components/annotation/shared/TextInputWithFont.tsx

@@ -1,6 +1,5 @@
 import React, { useState, useEffect } from 'react';
 import { Stack, TextInput, Select, Combobox, useCombobox, Group, Box } from '@mantine/core';
-import { useTranslation } from 'react-i18next';
 import { ColorPicker } from '@app/components/annotation/shared/ColorPicker';
 
 interface TextInputWithFontProps {
@@ -13,8 +12,12 @@ interface TextInputWithFontProps {
   textColor?: string;
   onTextColorChange?: (color: string) => void;
   disabled?: boolean;
-  label?: string;
-  placeholder?: string;
+  label: string;
+  placeholder: string;
+  fontLabel: string;
+  fontSizeLabel: string;
+  fontSizePlaceholder: string;
+  colorLabel?: string;
   onAnyChange?: () => void;
 }
 
@@ -30,9 +33,12 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
   disabled = false,
   label,
   placeholder,
+  fontLabel,
+  fontSizeLabel,
+  fontSizePlaceholder,
+  colorLabel,
   onAnyChange
 }) => {
-  const { t } = useTranslation();
   const [fontSizeInput, setFontSizeInput] = useState(fontSize.toString());
   const fontSizeCombobox = useCombobox();
   const [isColorPickerOpen, setIsColorPickerOpen] = useState(false);
@@ -66,8 +72,8 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
   return (
     <Stack gap="sm">
       <TextInput
-        label={label || t('sign.text.name', 'Signer name')}
-        placeholder={placeholder || t('sign.text.placeholder', 'Enter your full name')}
+        label={label}
+        placeholder={placeholder}
         value={text}
         onChange={(e) => {
           onTextChange(e.target.value);
@@ -79,7 +85,7 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
 
       {/* Font Selection */}
       <Select
-        label={t('sign.text.fontLabel', 'Font')}
+        label={fontLabel}
         value={fontFamily}
         onChange={(value) => {
           onFontFamilyChange(value || 'Helvetica');
@@ -107,8 +113,8 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
         >
           <Combobox.Target>
             <TextInput
-              label={t('sign.text.fontSizeLabel', 'Font size')}
-              placeholder={t('sign.text.fontSizePlaceholder', 'Type or select font size (8-200)')}
+              label={fontSizeLabel}
+              placeholder={fontSizePlaceholder}
               value={fontSizeInput}
               onChange={(event) => {
                 const value = event.currentTarget.value;
@@ -155,7 +161,7 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
         {onTextColorChange && (
           <Box>
             <TextInput
-              label={t('sign.text.colorLabel', 'Text colour')}
+              label={colorLabel}
               value={colorInput}
               placeholder="#000000"
               disabled={disabled}

frontend/src/core/components/annotation/tools/TextTool.tsx

@@ -1,57 +0,0 @@
-import React, { useState } from 'react';
-import { Stack } from '@mantine/core';
-import { BaseAnnotationTool } from '@app/components/annotation/shared/BaseAnnotationTool';
-import { TextInputWithFont } from '@app/components/annotation/shared/TextInputWithFont';
-
-interface TextToolProps {
-  onTextChange?: (text: string) => void;
-  disabled?: boolean;
-}
-
-export const TextTool: React.FC<TextToolProps> = ({
-  onTextChange,
-  disabled = false
-}) => {
-  const [text, setText] = useState('');
-  const [fontSize, setFontSize] = useState(16);
-  const [fontFamily, setFontFamily] = useState('Helvetica');
-
-  const handleTextChange = (newText: string) => {
-    setText(newText);
-    onTextChange?.(newText);
-  };
-
-  const handleSignatureDataChange = (data: string | null) => {
-    if (data) {
-      onTextChange?.(data);
-    }
-  };
-
-  const toolConfig = {
-    enableTextInput: true,
-    showPlaceButton: true,
-    placeButtonText: "Place Text"
-  };
-
-  return (
-    <BaseAnnotationTool
-      config={toolConfig}
-      onSignatureDataChange={handleSignatureDataChange}
-      disabled={disabled}
-    >
-      <Stack gap="sm">
-        <TextInputWithFont
-          text={text}
-          onTextChange={handleTextChange}
-          fontSize={fontSize}
-          onFontSizeChange={setFontSize}
-          fontFamily={fontFamily}
-          onFontFamilyChange={setFontFamily}
-          disabled={disabled}
-          label="Text Content"
-          placeholder="Enter text to place on the PDF"
-        />
-      </Stack>
-    </BaseAnnotationTool>
-  );
-};

frontend/src/core/components/onboarding/InitialOnboardingModal/renderButtons.tsx

@@ -47,11 +47,11 @@ export function SlideButtons({ slideDefinition, licenseNotice, flowState, onActi
     ) {
       return t('onboarding.serverLicense.upgrade', 'Upgrade now →');
     }
-    
+
     // Translate the label (it's a translation key)
     const label = button.label ?? '';
     if (!label) return '';
-    
+
     // Extract fallback text from translation key (e.g., 'onboarding.buttons.next' -> 'Next')
     const fallback = label.split('.').pop() || label;
     return t(label, fallback);
@@ -105,4 +105,4 @@ export function SlideButtons({ slideDefinition, licenseNotice, flowState, onActi
       <Group gap={12}>{rightButtons.map(renderButton)}</Group>
     </Group>
   );
-}
+}

frontend/src/core/components/onboarding/Onboarding.tsx

@@ -5,7 +5,6 @@ import { useNavigate, useLocation } from 'react-router-dom';
 import { isAuthRoute } from '@app/constants/routes';
 import { dispatchTourState } from '@app/constants/events';
 import { useOnboardingOrchestrator } from '@app/components/onboarding/orchestrator/useOnboardingOrchestrator';
-import { markStepSeen } from '@app/components/onboarding/orchestrator/onboardingStorage';
 import { useBypassOnboarding } from '@app/components/onboarding/useBypassOnboarding';
 import OnboardingTour, { type AdvanceArgs, type CloseArgs } from '@app/components/onboarding/OnboardingTour';
 import OnboardingModalSlide from '@app/components/onboarding/OnboardingModalSlide';
@@ -20,10 +19,12 @@ import { useTourOrchestration } from '@app/contexts/TourOrchestrationContext';
 import { useAdminTourOrchestration } from '@app/contexts/AdminTourOrchestrationContext';
 import { createUserStepsConfig } from '@app/components/onboarding/userStepsConfig';
 import { createAdminStepsConfig } from '@app/components/onboarding/adminStepsConfig';
+import { createWhatsNewStepsConfig } from '@app/components/onboarding/whatsNewStepsConfig';
 import { removeAllGlows } from '@app/components/onboarding/tourGlow';
 import { useFilesModalContext } from '@app/contexts/FilesModalContext';
 import { useServerExperience } from '@app/hooks/useServerExperience';
-import AdminAnalyticsChoiceModal from '@app/components/shared/AdminAnalyticsChoiceModal';
+import { useAppConfig } from '@app/contexts/AppConfigContext';
+import apiClient from '@app/services/apiClient';
 import '@app/components/onboarding/OnboardingTour.css';
 
 export default function Onboarding() {
@@ -39,6 +40,11 @@ export default function Onboarding() {
   const { osInfo, osOptions, setSelectedDownloadUrl, handleDownloadSelected } = useOnboardingDownload();
   const { showLicenseSlide, licenseNotice: externalLicenseNotice, closeLicenseSlide } = useServerLicenseRequest();
   const { tourRequested: externalTourRequested, requestedTourType, clearTourRequest } = useTourRequest();
+  const { config, refetch: refetchConfig } = useAppConfig();
+  const [analyticsError, setAnalyticsError] = useState<string | null>(null);
+  const [analyticsLoading, setAnalyticsLoading] = useState(false);
+  const [showAnalyticsModal, setShowAnalyticsModal] = useState(false);
+  const [analyticsModalDismissed, setAnalyticsModalDismissed] = useState(false);
 
   const handleRoleSelect = useCallback((role: 'admin' | 'user' | null) => {
     actions.updateRuntimeState({ selectedRole: role });
@@ -50,7 +56,34 @@ export default function Onboarding() {
     window.location.href = '/login';
   }, [actions]);
 
-  const handleButtonAction = useCallback((action: ButtonAction) => {
+  // Check if we should show analytics modal before onboarding
+  useEffect(() => {
+    if (!isLoading && !analyticsModalDismissed && serverExperience.effectiveIsAdmin && config?.enableAnalytics == null) {
+      setShowAnalyticsModal(true);
+    }
+  }, [isLoading, analyticsModalDismissed, serverExperience.effectiveIsAdmin, config?.enableAnalytics]);
+
+  const handleAnalyticsChoice = useCallback(async (enableAnalytics: boolean) => {
+    if (analyticsLoading) return;
+    setAnalyticsLoading(true);
+    setAnalyticsError(null);
+
+    try {
+      const formData = new FormData();
+      formData.append('enabled', enableAnalytics.toString());
+
+      await apiClient.post('/api/v1/settings/update-enable-analytics', formData);
+      await refetchConfig();
+      setShowAnalyticsModal(false);
+      setAnalyticsModalDismissed(true);
+      setAnalyticsLoading(false);
+    } catch (error) {
+      setAnalyticsError(error instanceof Error ? error.message : 'Unknown error');
+      setAnalyticsLoading(false);
+    }
+  }, [analyticsLoading, refetchConfig]);
+
+  const handleButtonAction = useCallback(async (action: ButtonAction) => {
     switch (action) {
       case 'next':
       case 'complete-close':
@@ -69,35 +102,43 @@ export default function Onboarding() {
       case 'security-next':
         if (!runtimeState.selectedRole) return;
         if (runtimeState.selectedRole !== 'admin') {
-          actions.updateRuntimeState({ tourRequested: true, tourType: 'tools' });
+          actions.updateRuntimeState({ tourType: 'whatsnew' });
+          setIsTourOpen(true);
         }
         actions.complete();
         break;
       case 'launch-admin':
-        actions.updateRuntimeState({ tourRequested: true, tourType: 'admin' });
-        actions.complete();
+        actions.updateRuntimeState({ tourType: 'admin' });
+        setIsTourOpen(true);
         break;
       case 'launch-tools':
-        actions.updateRuntimeState({ tourRequested: true, tourType: 'tools' });
-        actions.complete();
+        actions.updateRuntimeState({ tourType: 'whatsnew' });
+        setIsTourOpen(true);
         break;
       case 'launch-auto': {
-        const tourType = serverExperience.effectiveIsAdmin || runtimeState.selectedRole === 'admin' ? 'admin' : 'tools';
-        actions.updateRuntimeState({ tourRequested: true, tourType });
-        actions.complete();
+        const tourType = serverExperience.effectiveIsAdmin || runtimeState.selectedRole === 'admin' ? 'admin' : 'whatsnew';
+        actions.updateRuntimeState({ tourType });
+        setIsTourOpen(true);
         break;
       }
       case 'skip-to-license':
-        markStepSeen('tour');
-        actions.updateRuntimeState({ tourRequested: false });
+        actions.complete();
+        break;
+      case 'skip-tour':
         actions.complete();
         break;
       case 'see-plans':
         actions.complete();
         navigate('/settings/adminPlan');
         break;
+      case 'enable-analytics':
+        await handleAnalyticsChoice(true);
+        break;
+      case 'disable-analytics':
+        await handleAnalyticsChoice(false);
+        break;
     }
-  }, [actions, handleDownloadSelected, navigate, runtimeState.selectedRole, serverExperience.effectiveIsAdmin]);
+  }, [actions, handleAnalyticsChoice, handleDownloadSelected, navigate, runtimeState.selectedRole, serverExperience.effectiveIsAdmin]);
 
   const isRTL = typeof document !== 'undefined' ? document.documentElement.dir === 'rtl' : false;
   const [isTourOpen, setIsTourOpen] = useState(false);
@@ -117,10 +158,7 @@ export default function Onboarding() {
         backToAllTools: tourOrch.backToAllTools,
         selectCropTool: tourOrch.selectCropTool,
         loadSampleFile: tourOrch.loadSampleFile,
-        switchToViewer: tourOrch.switchToViewer,
-        switchToPageEditor: tourOrch.switchToPageEditor,
         switchToActiveFiles: tourOrch.switchToActiveFiles,
-        selectFirstFile: tourOrch.selectFirstFile,
         pinFile: tourOrch.pinFile,
         modifyCropSettings: tourOrch.modifyCropSettings,
         executeTool: tourOrch.executeTool,
@@ -130,6 +168,24 @@ export default function Onboarding() {
     [t, tourOrch, closeFilesModal, openFilesModal]
   );
 
+  const whatsNewStepsConfig = useMemo(
+    () => createWhatsNewStepsConfig({
+      t,
+      actions: {
+        saveWorkbenchState: tourOrch.saveWorkbenchState,
+        closeFilesModal,
+        backToAllTools: tourOrch.backToAllTools,
+        openFilesModal,
+        loadSampleFile: tourOrch.loadSampleFile,
+        switchToViewer: tourOrch.switchToViewer,
+        switchToPageEditor: tourOrch.switchToPageEditor,
+        switchToActiveFiles: tourOrch.switchToActiveFiles,
+        selectFirstFile: tourOrch.selectFirstFile,
+      },
+    }),
+    [t, tourOrch, closeFilesModal, openFilesModal]
+  );
+
   const adminStepsConfig = useMemo(
     () => createAdminStepsConfig({
       t,
@@ -144,21 +200,19 @@ export default function Onboarding() {
   );
 
   const tourSteps = useMemo<StepType[]>(() => {
-    const config = runtimeState.tourType === 'admin' ? adminStepsConfig : userStepsConfig;
-    return Object.values(config);
-  }, [adminStepsConfig, runtimeState.tourType, userStepsConfig]);
-
-  useEffect(() => {
-    if (currentStep?.id === 'tour' && !isTourOpen) {
-      markStepSeen('tour');
-      setIsTourOpen(true);
+    switch (runtimeState.tourType) {
+      case 'admin':
+        return Object.values(adminStepsConfig);
+      case 'whatsnew':
+        return Object.values(whatsNewStepsConfig);
+      default:
+        return Object.values(userStepsConfig);
     }
-  }, [currentStep, isTourOpen, activeFlow]);
+  }, [adminStepsConfig, runtimeState.tourType, userStepsConfig, whatsNewStepsConfig]);
 
   useEffect(() => {
     if (externalTourRequested) {
-      actions.updateRuntimeState({ tourRequested: true, tourType: requestedTourType });
-      markStepSeen('tour');
+      actions.updateRuntimeState({ tourType: requestedTourType });
       setIsTourOpen(true);
       clearTourRequest();
     }
@@ -176,9 +230,9 @@ export default function Onboarding() {
     } else {
       tourOrch.restoreWorkbenchState();
     }
-    markStepSeen('tour');
-    if (currentStep?.id === 'tour') actions.complete();
-  }, [actions, adminTourOrch, currentStep?.id, runtimeState.tourType, tourOrch]);
+    // Advance to next onboarding step after tour completes
+    actions.complete();
+  }, [actions, adminTourOrch, runtimeState.tourType, tourOrch]);
 
   const handleAdvanceTour = useCallback((args: AdvanceArgs) => {
     const { setCurrentStep, currentStep: tourCurrentStep, steps, setIsOpen } = args;
@@ -216,8 +270,10 @@ export default function Onboarding() {
       firstLoginUsername: runtimeState.firstLoginUsername,
       onPasswordChanged: handlePasswordChanged,
       usingDefaultCredentials: runtimeState.usingDefaultCredentials,
+      analyticsError,
+      analyticsLoading,
     });
-  }, [currentSlideDefinition, osInfo, osOptions, runtimeState.selectedRole, runtimeState.licenseNotice, handleRoleSelect, serverExperience.loginEnabled, setSelectedDownloadUrl, runtimeState.firstLoginUsername, handlePasswordChanged]);
+  }, [analyticsError, analyticsLoading, currentSlideDefinition, osInfo, osOptions, runtimeState.selectedRole, runtimeState.licenseNotice, handleRoleSelect, serverExperience.loginEnabled, setSelectedDownloadUrl, runtimeState.firstLoginUsername, handlePasswordChanged]);
 
   const modalSlideCount = useMemo(() => {
     return activeFlow.filter((step) => step.type === 'modal-slide').length;
@@ -237,8 +293,45 @@ export default function Onboarding() {
     return null;
   }
 
+  // Show analytics modal before onboarding if needed
+  if (showAnalyticsModal) {
+    const slideDefinition = SLIDE_DEFINITIONS['analytics-choice'];
+    const slideContent = slideDefinition.createSlide({
+      osLabel: '',
+      osUrl: '',
+      selectedRole: null,
+      onRoleSelect: () => {},
+      analyticsError,
+      analyticsLoading,
+    });
+
+    return (
+      <OnboardingModalSlide
+        slideDefinition={slideDefinition}
+        slideContent={slideContent}
+        runtimeState={runtimeState}
+        modalSlideCount={1}
+        currentModalSlideIndex={0}
+        onSkip={() => {}} // No skip allowed
+        onAction={async (action) => {
+          if (action === 'enable-analytics') {
+            await handleAnalyticsChoice(true);
+          } else if (action === 'disable-analytics') {
+            await handleAnalyticsChoice(false);
+          }
+        }}
+        allowDismiss={false}
+      />
+    );
+  }
+
   if (showLicenseSlide) {
-    const slideDefinition = SLIDE_DEFINITIONS['server-license'];
+    const baseSlideDefinition = SLIDE_DEFINITIONS['server-license'];
+    // Remove back button for external license notice
+    const slideDefinition = {
+      ...baseSlideDefinition,
+      buttons: baseSlideDefinition.buttons.filter(btn => btn.key !== 'license-back')
+    };
     const effectiveLicenseNotice = externalLicenseNotice || runtimeState.licenseNotice;
     const slideContent = slideDefinition.createSlide({
       osLabel: '',
@@ -250,7 +343,7 @@ export default function Onboarding() {
       licenseNotice: effectiveLicenseNotice,
       loginEnabled: serverExperience.loginEnabled,
     });
-    
+
     return (
       <OnboardingModalSlide
         slideDefinition={slideDefinition}
@@ -271,40 +364,34 @@ export default function Onboarding() {
     );
   }
 
+  // Always render the tour component (it controls its own visibility with isOpen)
+  const tourComponent = (
+    <OnboardingTour
+      isOpen={isTourOpen}
+      tourSteps={tourSteps}
+      tourType={runtimeState.tourType}
+      isRTL={isRTL}
+      t={t}
+      onAdvance={handleAdvanceTour}
+      onClose={handleCloseTour}
+    />
+  );
+
+  // If no active onboarding, just show the tour (which may or may not be open)
   if (isLoading || !isActive || !currentStep) {
-    return (
-      <OnboardingTour
-        isOpen={isTourOpen}
-        tourSteps={tourSteps}
-        tourType={runtimeState.tourType}
-        isRTL={isRTL}
-        t={t}
-        onAdvance={handleAdvanceTour}
-        onClose={handleCloseTour}
-      />
-    );
+    return tourComponent;
   }
 
+  // If tour is open, hide the onboarding modal and just show the tour
+  if (isTourOpen) {
+    return tourComponent;
+  }
+
+  // Render the current onboarding step
   switch (currentStep.type) {
     case 'tool-prompt':
       return <ToolPanelModePrompt forceOpen={true} onComplete={actions.complete} />;
 
-    case 'tour':
-      return (
-        <OnboardingTour
-          isOpen={true}
-          tourSteps={tourSteps}
-          tourType={runtimeState.tourType}
-          isRTL={isRTL}
-          t={t}
-          onAdvance={handleAdvanceTour}
-          onClose={handleCloseTour}
-        />
-      );
-
-    case 'analytics-modal':
-      return <AdminAnalyticsChoiceModal opened={true} onClose={actions.complete} />;
-
     case 'modal-slide':
       if (!currentSlideDefinition || !currentSlideContent) return null;
       return (

frontend/src/core/components/onboarding/OnboardingModalSlide.tsx

@@ -6,8 +6,9 @@
  */
 
 import React from 'react';
-import { Modal, Stack } from '@mantine/core';
+import { Modal, Stack, ActionIcon } from '@mantine/core';
 import DiamondOutlinedIcon from '@mui/icons-material/DiamondOutlined';
+import CloseIcon from '@mui/icons-material/Close';
 
 import type { SlideDefinition, ButtonAction } from '@app/components/onboarding/onboardingFlowConfig';
 import type { OnboardingRuntimeState } from '@app/components/onboarding/orchestrator/onboardingConfig';
@@ -28,6 +29,7 @@ interface OnboardingModalSlideProps {
   currentModalSlideIndex: number;
   onSkip: () => void;
   onAction: (action: ButtonAction) => void;
+  allowDismiss?: boolean;
 }
 
 export default function OnboardingModalSlide({
@@ -38,6 +40,7 @@ export default function OnboardingModalSlide({
   currentModalSlideIndex,
   onSkip,
   onAction,
+  allowDismiss = true,
 }: OnboardingModalSlideProps) {
 
   const renderHero = () => {
@@ -62,6 +65,9 @@ export default function OnboardingModalSlide({
         {slideDefinition.hero.type === 'lock' && (
           <LocalIcon icon="lock-outline" width={64} height={64} className={styles.heroIcon} />
         )}
+        {slideDefinition.hero.type === 'analytics' && (
+          <LocalIcon icon="analytics" width={64} height={64} className={styles.heroIcon} />
+        )}
         {slideDefinition.hero.type === 'diamond' && <DiamondOutlinedIcon sx={{ fontSize: 64, color: '#000000' }} />}
         {slideDefinition.hero.type === 'logo' && (
           <img src={`${BASE_PATH}/branding/StirlingPDFLogoNoTextLightHC.svg`} alt="Stirling logo" />
@@ -75,6 +81,7 @@ export default function OnboardingModalSlide({
       opened={true}
       onClose={onSkip}
       closeOnClickOutside={false}
+      closeOnEscape={allowDismiss}
       centered
       size="lg"
       radius="lg"
@@ -93,6 +100,31 @@ export default function OnboardingModalSlide({
             isActive
             slideKey={slideContent.key}
           />
+          {allowDismiss && (
+            <ActionIcon
+              onClick={onSkip}
+              radius="md"
+              size={36}
+              style={{
+                position: 'absolute',
+                top: 16,
+                right: 16,
+                backgroundColor: 'rgba(255, 255, 255, 0.2)',
+                color: 'white',
+                backdropFilter: 'blur(4px)',
+                zIndex: 10,
+              }}
+              styles={{
+                root: {
+                  '&:hover': {
+                    backgroundColor: 'rgba(255, 255, 255, 0.3)',
+                  },
+                },
+              }}
+            >
+              <CloseIcon fontSize="small" />
+            </ActionIcon>
+          )}
           <div className={styles.heroLogo} key={`logo-${slideContent.key}`}>
             {renderHero()}
           </div>
@@ -114,7 +146,9 @@ export default function OnboardingModalSlide({
               <style>{`div strong{color: var(--onboarding-title); font-weight: 600;}`}</style>
             </div>
 
-            <OnboardingStepper totalSteps={modalSlideCount} activeStep={currentModalSlideIndex} />
+            {modalSlideCount > 1 && (
+              <OnboardingStepper totalSteps={modalSlideCount} activeStep={currentModalSlideIndex} />
+            )}
 
             <div className={styles.buttonContainer}>
               <SlideButtons

frontend/src/core/components/onboarding/OnboardingTour.tsx

@@ -49,7 +49,7 @@ interface CloseArgs {
 
 interface OnboardingTourProps {
   tourSteps: StepType[];
-  tourType: 'admin' | 'tools';
+  tourType: 'admin' | 'tools' | 'whatsnew';
   isRTL: boolean;
   t: TFunction;
   isOpen: boolean;

frontend/src/core/components/onboarding/onboardingFlowConfig.ts

@@ -4,6 +4,8 @@ import SecurityCheckSlide from '@app/components/onboarding/slides/SecurityCheckS
 import PlanOverviewSlide from '@app/components/onboarding/slides/PlanOverviewSlide';
 import ServerLicenseSlide from '@app/components/onboarding/slides/ServerLicenseSlide';
 import FirstLoginSlide from '@app/components/onboarding/slides/FirstLoginSlide';
+import TourOverviewSlide from '@app/components/onboarding/slides/TourOverviewSlide';
+import AnalyticsChoiceSlide from '@app/components/onboarding/slides/AnalyticsChoiceSlide';
 import { SlideConfig, LicenseNotice } from '@app/types/types';
 
 export type SlideId =
@@ -12,9 +14,11 @@ export type SlideId =
   | 'desktop-install'
   | 'security-check'
   | 'admin-overview'
-  | 'server-license';
+  | 'server-license'
+  | 'tour-overview'
+  | 'analytics-choice';
 
-export type HeroType = 'rocket' | 'dual-icon' | 'shield' | 'diamond' | 'logo' | 'lock';
+export type HeroType = 'rocket' | 'dual-icon' | 'shield' | 'diamond' | 'logo' | 'lock' | 'analytics';
 
 export type ButtonAction =
   | 'next'
@@ -27,7 +31,10 @@ export type ButtonAction =
   | 'launch-tools'
   | 'launch-auto'
   | 'see-plans'
-  | 'skip-to-license';
+  | 'skip-to-license'
+  | 'skip-tour'
+  | 'enable-analytics'
+  | 'disable-analytics';
 
 export interface FlowState {
   selectedRole: 'admin' | 'user' | null;
@@ -52,6 +59,8 @@ export interface SlideFactoryParams {
   firstLoginUsername?: string;
   onPasswordChanged?: () => void;
   usingDefaultCredentials?: boolean;
+  analyticsError?: string | null;
+  analyticsLoading?: boolean;
 }
 
 export interface HeroDefinition {
@@ -79,9 +88,9 @@ export interface SlideDefinition {
 export const SLIDE_DEFINITIONS: Record<SlideId, SlideDefinition> = {
   'first-login': {
     id: 'first-login',
-    createSlide: ({ firstLoginUsername, onPasswordChanged, usingDefaultCredentials }) => 
-      FirstLoginSlide({ 
-        username: firstLoginUsername || '', 
+    createSlide: ({ firstLoginUsername, onPasswordChanged, usingDefaultCredentials }) =>
+      FirstLoginSlide({
+        username: firstLoginUsername || '',
         onPasswordChanged: onPasswordChanged || (() => {}),
         usingDefaultCredentials: usingDefaultCredentials || false,
       }),
@@ -194,6 +203,13 @@ export const SLIDE_DEFINITIONS: Record<SlideId, SlideDefinition> = {
     createSlide: ({ licenseNotice }) => ServerLicenseSlide({ licenseNotice }),
     hero: { type: 'dual-icon' },
     buttons: [
+      {
+        key: 'license-back',
+        type: 'icon',
+        icon: 'chevron-left',
+        group: 'left',
+        action: 'prev',
+      },
       {
         key: 'license-close',
         type: 'button',
@@ -212,5 +228,58 @@ export const SLIDE_DEFINITIONS: Record<SlideId, SlideDefinition> = {
       },
     ],
   },
+  'tour-overview': {
+    id: 'tour-overview',
+    createSlide: () => TourOverviewSlide(),
+    hero: { type: 'rocket' },
+    buttons: [
+      {
+        key: 'tour-overview-back',
+        type: 'icon',
+        icon: 'chevron-left',
+        group: 'left',
+        action: 'prev',
+      },
+      {
+        key: 'tour-overview-skip',
+        type: 'button',
+        label: 'onboarding.buttons.skipForNow',
+        variant: 'secondary',
+        group: 'left',
+        action: 'skip-tour',
+      },
+      {
+        key: 'tour-overview-show',
+        type: 'button',
+        label: 'onboarding.buttons.showMeAround',
+        variant: 'primary',
+        group: 'right',
+        action: 'launch-tools',
+      },
+    ],
+  },
+  'analytics-choice': {
+    id: 'analytics-choice',
+    createSlide: ({ analyticsError }) => AnalyticsChoiceSlide({ analyticsError }),
+    hero: { type: 'analytics' },
+    buttons: [
+      {
+        key: 'analytics-disable',
+        type: 'button',
+        label: 'no',
+        variant: 'secondary',
+        group: 'left',
+        action: 'disable-analytics',
+      },
+      {
+        key: 'analytics-enable',
+        type: 'button',
+        label: 'yes',
+        variant: 'primary',
+        group: 'right',
+        action: 'enable-analytics',
+      },
+    ],
+  },
 };
 

frontend/src/core/components/onboarding/orchestrator/onboardingConfig.ts

@@ -5,21 +5,20 @@ export type OnboardingStepId =
   | 'security-check'
   | 'admin-overview'
   | 'tool-layout'
-  | 'tour'
+  | 'tour-overview'
   | 'server-license'
   | 'analytics-choice';
 
 export type OnboardingStepType =
   | 'modal-slide'
-  | 'tool-prompt'
-  | 'tour'
-  | 'analytics-modal';
+  | 'tool-prompt';
 
 export interface OnboardingRuntimeState {
   selectedRole: 'admin' | 'user' | null;
   tourRequested: boolean;
-  tourType: 'admin' | 'tools';
+  tourType: 'admin' | 'tools' | 'whatsnew';
   isDesktopApp: boolean;
+  desktopSlideEnabled: boolean;
   analyticsNotConfigured: boolean;
   analyticsEnabled: boolean;
   licenseNotice: {
@@ -42,13 +41,13 @@ export interface OnboardingStep {
   id: OnboardingStepId;
   type: OnboardingStepType;
   condition: (ctx: OnboardingConditionContext) => boolean;
-  slideId?: 'first-login' | 'welcome' | 'desktop-install' | 'security-check' | 'admin-overview' | 'server-license';
+  slideId?: 'first-login' | 'welcome' | 'desktop-install' | 'security-check' | 'admin-overview' | 'server-license' | 'tour-overview' | 'analytics-choice';
 }
 
 export const DEFAULT_RUNTIME_STATE: OnboardingRuntimeState = {
   selectedRole: null,
   tourRequested: false,
-  tourType: 'tools',
+  tourType: 'whatsnew',
   isDesktopApp: false,
   analyticsNotConfigured: false,
   analyticsEnabled: false,
@@ -61,6 +60,7 @@ export const DEFAULT_RUNTIME_STATE: OnboardingRuntimeState = {
   requiresPasswordChange: false,
   firstLoginUsername: '',
   usingDefaultCredentials: false,
+  desktopSlideEnabled: true,
 };
 
 export const ONBOARDING_STEPS: OnboardingStep[] = [
@@ -76,18 +76,6 @@ export const ONBOARDING_STEPS: OnboardingStep[] = [
     slideId: 'welcome',
     condition: () => true,
   },
-  {
-    id: 'desktop-install',
-    type: 'modal-slide',
-    slideId: 'desktop-install',
-    condition: (ctx) => !ctx.isDesktopApp,
-  },
-  {
-    id: 'security-check',
-    type: 'modal-slide',
-    slideId: 'security-check',
-    condition: (ctx) => !ctx.loginEnabled && !ctx.isDesktopApp,
-  },
   {
     id: 'admin-overview',
     type: 'modal-slide',
@@ -95,14 +83,27 @@ export const ONBOARDING_STEPS: OnboardingStep[] = [
     condition: (ctx) => ctx.effectiveIsAdmin,
   },
   {
-    id: 'tool-layout',
-    type: 'tool-prompt',
-    condition: () => true,
+    id: 'desktop-install',
+    type: 'modal-slide',
+    slideId: 'desktop-install',
+    condition: (ctx) => !ctx.isDesktopApp && ctx.desktopSlideEnabled,
   },
   {
-    id: 'tour',
-    type: 'tour',
-    condition: (ctx) => ctx.tourRequested || !ctx.effectiveIsAdmin,
+    id: 'security-check',
+    type: 'modal-slide',
+    slideId: 'security-check',
+    condition: () => false,
+  },
+  {
+    id: 'tool-layout',
+    type: 'tool-prompt',
+    condition: () => false,
+  },
+  {
+    id: 'tour-overview',
+    type: 'modal-slide',
+    slideId: 'tour-overview',
+    condition: (ctx) => !ctx.effectiveIsAdmin && ctx.tourType !== 'admin',
   },
   {
     id: 'server-license',
@@ -110,11 +111,6 @@ export const ONBOARDING_STEPS: OnboardingStep[] = [
     slideId: 'server-license',
     condition: (ctx) => ctx.effectiveIsAdmin && ctx.licenseNotice.requiresLicense,
   },
-  {
-    id: 'analytics-choice',
-    type: 'analytics-modal',
-    condition: (ctx) => ctx.effectiveIsAdmin && ctx.analyticsNotConfigured,
-  },
 ];
 
 export function getStepById(id: OnboardingStepId): OnboardingStep | undefined {

frontend/src/core/components/onboarding/orchestrator/onboardingStorage.ts

@@ -1,94 +1,71 @@
-import { type OnboardingStepId, ONBOARDING_STEPS } from '@app/components/onboarding/orchestrator/onboardingConfig';
-
 const STORAGE_PREFIX = 'onboarding';
+const TOURS_TOOLTIP_KEY = `${STORAGE_PREFIX}::tours-tooltip-shown`;
+const ONBOARDING_COMPLETED_KEY = `${STORAGE_PREFIX}::completed`;
 
-export function getStorageKey(stepId: OnboardingStepId): string {
-  return `${STORAGE_PREFIX}::${stepId}`;
-}
-
-export function hasSeenStep(stepId: OnboardingStepId): boolean {
+export function isOnboardingCompleted(): boolean {
   if (typeof window === 'undefined') return false;
   try {
-    return localStorage.getItem(getStorageKey(stepId)) === 'true';
+    return localStorage.getItem(ONBOARDING_COMPLETED_KEY) === 'true';
   } catch {
     return false;
   }
 }
 
-export function markStepSeen(stepId: OnboardingStepId): void {
+export function markOnboardingCompleted(): void {
   if (typeof window === 'undefined') return;
   try {
-    localStorage.setItem(getStorageKey(stepId), 'true');
+    localStorage.setItem(ONBOARDING_COMPLETED_KEY, 'true');
   } catch (error) {
-    console.error('[onboardingStorage] Error marking step as seen:', error);
+    console.error('[onboardingStorage] Error marking onboarding as completed:', error);
   }
 }
 
-export function resetStepSeen(stepId: OnboardingStepId): void {
+export function resetOnboardingProgress(): void {
   if (typeof window === 'undefined') return;
   try {
-    localStorage.removeItem(getStorageKey(stepId));
+    localStorage.removeItem(ONBOARDING_COMPLETED_KEY);
   } catch (error) {
-    console.error('[onboardingStorage] Error resetting step seen:', error);
+    console.error('[onboardingStorage] Error resetting onboarding progress:', error);
   }
 }
 
-export function resetAllOnboardingProgress(): void {
-  if (typeof window === 'undefined') return;
+export function hasShownToursTooltip(): boolean {
+  if (typeof window === 'undefined') return false;
   try {
-    const prefix = `${STORAGE_PREFIX}::`;
-    const keysToRemove: string[] = [];
-    for (let i = 0; i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.startsWith(prefix)) keysToRemove.push(key);
-    }
-    keysToRemove.forEach((key) => localStorage.removeItem(key));
-  } catch (error) {
-    console.error('[onboardingStorage] Error resetting all onboarding progress:', error);
+    return localStorage.getItem(TOURS_TOOLTIP_KEY) === 'true';
+  } catch {
+    return false;
   }
 }
 
-export function getOnboardingStorageState(): Record<string, boolean> {
-  const state: Record<string, boolean> = {};
-  ONBOARDING_STEPS.forEach((step) => {
-    state[step.id] = hasSeenStep(step.id);
-  });
-  return state;
+export function markToursTooltipShown(): void {
+  if (typeof window === 'undefined') return;
+  try {
+    localStorage.setItem(TOURS_TOOLTIP_KEY, 'true');
+  } catch (error) {
+    console.error('[onboardingStorage] Error marking tours tooltip as shown:', error);
+  }
 }
 
 export function migrateFromLegacyPreferences(): void {
   if (typeof window === 'undefined') return;
-  
+
   const migrationKey = `${STORAGE_PREFIX}::migrated`;
-  
+
   try {
     // Skip if already migrated
     if (localStorage.getItem(migrationKey) === 'true') return;
-    
+
     const prefsRaw = localStorage.getItem('stirlingpdf_preferences');
     if (prefsRaw) {
       const prefs = JSON.parse(prefsRaw) as Record<string, unknown>;
-      
-      // Migrate based on legacy flags
-      if (prefs.hasSeenIntroOnboarding === true) {
-        markStepSeen('welcome');
-        markStepSeen('desktop-install');
-        markStepSeen('security-check');
-        markStepSeen('admin-overview');
+
+      // If user had completed onboarding in old system, mark new system as complete
+      if (prefs.hasCompletedOnboarding === true || prefs.hasSeenIntroOnboarding === true) {
+        markOnboardingCompleted();
       }
-      
-      if (prefs.toolPanelModePromptSeen === true || prefs.hasSelectedToolPanelMode === true) {
-        markStepSeen('tool-layout');
-      }
-      
-      if (prefs.hasCompletedOnboarding === true) {
-        markStepSeen('tour');
-        markStepSeen('analytics-choice');
-        markStepSeen('server-license');
-      }
-      
     }
-    
+
     // Mark migration complete
     localStorage.setItem(migrationKey, 'true');
   } catch {

frontend/src/core/components/onboarding/orchestrator/useOnboardingOrchestrator.ts

@@ -12,8 +12,8 @@ import {
   DEFAULT_RUNTIME_STATE,
 } from '@app/components/onboarding/orchestrator/onboardingConfig';
 import {
-  hasSeenStep,
-  markStepSeen,
+  isOnboardingCompleted,
+  markOnboardingCompleted,
   migrateFromLegacyPreferences,
 } from '@app/components/onboarding/orchestrator/onboardingStorage';
 import { accountService } from '@app/services/accountService';
@@ -35,12 +35,15 @@ function getInitialRuntimeState(baseState: OnboardingRuntimeState): OnboardingRu
   if (typeof window === 'undefined') {
     return baseState;
   }
-  
+
   try {
     const tourRequested = sessionStorage.getItem(SESSION_TOUR_REQUESTED) === 'true';
-    const tourType = (sessionStorage.getItem(SESSION_TOUR_TYPE) as 'admin' | 'tools') || 'tools';
+    const sessionTourType = sessionStorage.getItem(SESSION_TOUR_TYPE);
+    const tourType = (sessionTourType === 'admin' || sessionTourType === 'tools' || sessionTourType === 'whatsnew')
+      ? sessionTourType
+      : 'whatsnew';
     const selectedRole = sessionStorage.getItem(SESSION_SELECTED_ROLE) as 'admin' | 'user' | null;
-    
+
     return {
       ...baseState,
       tourRequested,
@@ -54,7 +57,7 @@ function getInitialRuntimeState(baseState: OnboardingRuntimeState): OnboardingRu
 
 function persistRuntimeState(state: Partial<OnboardingRuntimeState>): void {
   if (typeof window === 'undefined') return;
-  
+
   try {
     if (state.tourRequested !== undefined) {
       sessionStorage.setItem(SESSION_TOUR_REQUESTED, state.tourRequested ? 'true' : 'false');
@@ -76,7 +79,7 @@ function persistRuntimeState(state: Partial<OnboardingRuntimeState>): void {
 
 function clearRuntimeStateSession(): void {
   if (typeof window === 'undefined') return;
-  
+
   try {
     sessionStorage.removeItem(SESSION_TOUR_REQUESTED);
     sessionStorage.removeItem(SESSION_TOUR_TYPE);
@@ -145,7 +148,7 @@ export function useOnboardingOrchestrator(
   const location = useLocation();
   const bypassOnboarding = useBypassOnboarding();
 
-  const [runtimeState, setRuntimeState] = useState<OnboardingRuntimeState>(() => 
+  const [runtimeState, setRuntimeState] = useState<OnboardingRuntimeState>(() =>
     getInitialRuntimeState(defaultState)
   );
   const [isPaused, setIsPaused] = useState(false);
@@ -166,6 +169,7 @@ export function useOnboardingOrchestrator(
       ...prev,
       analyticsEnabled: config?.enableAnalytics === true,
       analyticsNotConfigured: config?.enableAnalytics == null,
+      desktopSlideEnabled: config?.enableDesktopInstallSlide ?? true,
       licenseNotice: {
         totalUsers: serverExperience.totalUsers,
         freeTierLimit: serverExperience.freeTierLimit,
@@ -221,7 +225,7 @@ export function useOnboardingOrchestrator(
   const conditionContext = useMemo<OnboardingConditionContext>(() => ({
     ...serverExperience,
     ...runtimeState,
-    effectiveIsAdmin: serverExperience.effectiveIsAdmin || 
+    effectiveIsAdmin: serverExperience.effectiveIsAdmin ||
       (!serverExperience.loginEnabled && runtimeState.selectedRole === 'admin'),
   }), [serverExperience, runtimeState]);
 
@@ -235,53 +239,44 @@ export function useOnboardingOrchestrator(
 
   // Wait for config AND admin status before calculating initial step
   const adminStatusResolved = !configLoading && (
-    config?.enableLogin === false || 
-    config?.enableLogin === undefined || 
+    config?.enableLogin === false ||
+    config?.enableLogin === undefined ||
     config?.isAdmin !== undefined
   );
-  
+
   useEffect(() => {
-    if (configLoading || !adminStatusResolved || activeFlow.length === 0) return;
+    if (configLoading || !adminStatusResolved) return;
 
-    let firstUnseenIndex = -1;
-    for (let i = 0; i < activeFlow.length; i++) {
-      // Special case: first-login step should always be considered "unseen" if requiresPasswordChange is true
-      const isFirstLoginStep = activeFlow[i].id === 'first-login';
-      const shouldTreatAsUnseen = isFirstLoginStep ? runtimeState.requiresPasswordChange : !hasSeenStep(activeFlow[i].id);
-
-      if (shouldTreatAsUnseen) {
-        firstUnseenIndex = i;
-        break;
-      }
-    }
-
-    // Force reset index when password change is required (overrides initialIndexSet)
-    if (runtimeState.requiresPasswordChange && firstUnseenIndex === 0) {
+    // If there are no steps to show, mark initialized/completed baseline
+    if (activeFlow.length === 0) {
       setCurrentStepIndex(0);
       initialIndexSet.current = true;
-    } else if (firstUnseenIndex === -1) {
+      return;
+    }
+
+    // If onboarding has been completed, don't show it
+    if (isOnboardingCompleted() && !runtimeState.requiresPasswordChange) {
       setCurrentStepIndex(activeFlow.length);
       initialIndexSet.current = true;
-    } else if (!initialIndexSet.current) {
-      setCurrentStepIndex(firstUnseenIndex);
+      return;
+    }
+
+    // Start from the beginning
+    if (!initialIndexSet.current) {
+      setCurrentStepIndex(0);
       initialIndexSet.current = true;
     }
   }, [activeFlow, configLoading, adminStatusResolved, runtimeState.requiresPasswordChange]);
 
   const totalSteps = activeFlow.length;
-  
-  const allStepsAlreadySeen = useMemo(() => {
-    if (activeFlow.length === 0) return false;
-    return activeFlow.every(step => hasSeenStep(step.id));
-  }, [activeFlow]);
-  
-  const isComplete = isInitialized && initialIndexSet.current && 
-    (currentStepIndex >= totalSteps || allStepsAlreadySeen);
-  const currentStep = (currentStepIndex >= 0 && currentStepIndex < totalSteps && !allStepsAlreadySeen) 
-    ? activeFlow[currentStepIndex] 
+
+  const isComplete = isInitialized &&
+    (totalSteps === 0 || currentStepIndex >= totalSteps || isOnboardingCompleted());
+  const currentStep = (currentStepIndex >= 0 && currentStepIndex < totalSteps)
+    ? activeFlow[currentStepIndex]
     : null;
   const isActive = !shouldBlockOnboarding && !isPaused && !isComplete && isInitialized && currentStep !== null;
-  const isLoading = configLoading || !adminStatusResolved || !isInitialized || 
+  const isLoading = configLoading || !adminStatusResolved || !isInitialized ||
     !initialIndexSet.current || (currentStepIndex === -1 && activeFlow.length > 0);
 
   useEffect(() => {
@@ -293,35 +288,33 @@ export function useOnboardingOrchestrator(
   }, [isComplete]);
 
   const next = useCallback(() => {
-    if (currentStep) markStepSeen(currentStep.id);
-    setCurrentStepIndex((prev) => Math.min(prev + 1, totalSteps));
-  }, [currentStep, totalSteps]);
+    const nextIndex = currentStepIndex + 1;
+    if (nextIndex >= totalSteps) {
+      // Reached the end, mark onboarding as completed
+      markOnboardingCompleted();
+    }
+    setCurrentStepIndex(nextIndex);
+  }, [currentStepIndex, totalSteps]);
 
   const prev = useCallback(() => {
     setCurrentStepIndex((prev) => Math.max(prev - 1, 0));
   }, []);
 
   const skip = useCallback(() => {
-    if (currentStep) markStepSeen(currentStep.id);
-    setCurrentStepIndex((prev) => Math.min(prev + 1, totalSteps));
-  }, [currentStep, totalSteps]);
+    // Skip marks the entire onboarding as completed
+    markOnboardingCompleted();
+    setCurrentStepIndex(totalSteps);
+  }, [totalSteps]);
 
   const complete = useCallback(() => {
-    if (currentStep) markStepSeen(currentStep.id);
-    setCurrentStepIndex((prev) => Math.min(prev + 1, totalSteps));
-  }, [currentStep, totalSteps]);
-
-  useEffect(() => {
-    if (!currentStep || isLoading) {
-      return;
+    const nextIndex = currentStepIndex + 1;
+    if (nextIndex >= totalSteps) {
+      // Reached the end, mark onboarding as completed
+      markOnboardingCompleted();
     }
-    // Special case: never auto-complete first-login step if requiresPasswordChange is true
-    const isFirstLoginStep = currentStep.id === 'first-login';
+    setCurrentStepIndex(nextIndex);
+  }, [currentStepIndex, totalSteps]);
 
-    if (!isFirstLoginStep && hasSeenStep(currentStep.id)) {
-      complete();
-    }
-  }, [currentStep, isLoading, complete, runtimeState.requiresPasswordChange]);
 
   const updateRuntimeState = useCallback((updates: Partial<OnboardingRuntimeState>) => {
     persistRuntimeState(updates);

frontend/src/core/components/onboarding/slides/AnalyticsChoiceSlide.tsx

@@ -0,0 +1,55 @@
+import React from 'react';
+import { Trans } from 'react-i18next';
+import { Button } from '@mantine/core';
+import OpenInNewIcon from '@mui/icons-material/OpenInNew';
+import i18n from '@app/i18n';
+import { SlideConfig } from '@app/types/types';
+import { UNIFIED_CIRCLE_CONFIG } from '@app/components/onboarding/slides/unifiedBackgroundConfig';
+import styles from '@app/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css';
+
+interface AnalyticsChoiceSlideProps {
+  analyticsError?: string | null;
+}
+
+export default function AnalyticsChoiceSlide({ analyticsError }: AnalyticsChoiceSlideProps): SlideConfig {
+  return {
+    key: 'analytics-choice',
+    title: i18n.t('analytics.title', 'Do you want to help make Stirling PDF better?'),
+    body: (
+      <div className={styles.bodyCopyInner}>
+        <Trans
+          i18nKey="analytics.paragraph1"
+          defaults="Stirling PDF has opt-in analytics to help us improve the product. We do not track any personal information or file contents."
+          components={{ strong: <strong /> }}
+        />
+        <br />
+        <Trans
+          i18nKey="analytics.paragraph2"
+          defaults="Please consider enabling analytics to help Stirling-PDF grow and to allow us to understand our users better."
+          components={{ strong: <strong /> }}
+        />
+        <br />
+        <div style={{ textAlign: 'right', marginTop: 0 }}>
+          <Button
+            variant="default"
+            size="sm"
+            onClick={() => window.open('https://docs.stirlingpdf.com/analytics-telemetry/', '_blank')}
+            rightSection={<OpenInNewIcon style={{ fontSize: 16 }} />}
+          >
+            {i18n.t('analytics.learnMore', 'Learn more about our analytics')}
+          </Button>
+        </div>
+        {analyticsError && (
+          <div style={{ color: 'var(--mantine-color-red-6)', marginTop: 12 }}>
+            {analyticsError}
+          </div>
+        )}
+      </div>
+    ),
+    background: {
+      gradientStops: ['#0EA5E9', '#6366F1'],
+      circles: UNIFIED_CIRCLE_CONFIG,
+    },
+  };
+}
+

frontend/src/core/components/onboarding/slides/TourOverviewSlide.tsx

@@ -0,0 +1,27 @@
+import React from 'react';
+import { Trans } from 'react-i18next';
+import i18n from '@app/i18n';
+import { SlideConfig } from '@app/types/types';
+import { UNIFIED_CIRCLE_CONFIG } from '@app/components/onboarding/slides/unifiedBackgroundConfig';
+import styles from '@app/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css';
+
+export default function TourOverviewSlide(): SlideConfig {
+  return {
+    key: 'tour-overview',
+    title: i18n.t('onboarding.tourOverview.title', 'Tour Overview'),
+    body: (
+      <span className={styles.bodyCopyInner}>
+        <Trans
+          i18nKey="onboarding.tourOverview.body"
+          defaults="Stirling PDF V2 ships with dozens of tools and a refreshed layout. Take a quick tour to see what changed and where to find the features you need."
+          components={{ strong: <strong /> }}
+        />
+      </span>
+    ),
+    background: {
+      gradientStops: ['#2563EB', '#7C3AED'],
+      circles: UNIFIED_CIRCLE_CONFIG,
+    },
+  };
+}
+

frontend/src/core/components/onboarding/useBypassOnboarding.ts

@@ -1,7 +1,6 @@
-import { useEffect, useMemo, useRef, useState } from 'react';
+import { useEffect, useMemo, useState } from 'react';
 import { useLocation } from 'react-router-dom';
-import { ONBOARDING_STEPS } from '@app/components/onboarding/orchestrator/onboardingConfig';
-import { markStepSeen } from '@app/components/onboarding/orchestrator/onboardingStorage';
+import { markOnboardingCompleted } from '@app/components/onboarding/orchestrator/onboardingStorage';
 
 const SESSION_KEY = 'onboarding::bypass-all';
 const PARAM_KEY = 'bypassOnboarding';
@@ -34,13 +33,12 @@ function setStoredBypass(enabled: boolean): void {
 
 /**
  * Detects the `bypassOnboarding` query parameter and stores it in session storage
- * so that onboarding remains disabled while the app is open. Also marks all steps
- * as seen to ensure any dependent UI elements remain hidden.
+ * so that onboarding remains disabled while the app is open. Also marks onboarding
+ * as completed to ensure any dependent UI elements remain hidden.
  */
 export function useBypassOnboarding(): boolean {
   const location = useLocation();
   const [bypassOnboarding, setBypassOnboarding] = useState<boolean>(() => readStoredBypass());
-  const stepsMarkedRef = useRef(false);
 
   const shouldBypassFromSearch = useMemo(() => {
     try {
@@ -57,14 +55,9 @@ export function useBypassOnboarding(): boolean {
     setBypassOnboarding(nextBypass);
     if (nextBypass) {
       setStoredBypass(true);
+      markOnboardingCompleted();
     }
   }, [shouldBypassFromSearch]);
 
-  useEffect(() => {
-    if (!bypassOnboarding || stepsMarkedRef.current) return;
-    stepsMarkedRef.current = true;
-    ONBOARDING_STEPS.forEach((step) => markStepSeen(step.id));
-  }, [bypassOnboarding]);
-
   return bypassOnboarding;
 }

frontend/src/core/components/onboarding/useOnboardingEffects.ts

@@ -51,14 +51,14 @@ export function useTourRequest(): {
   clearTourRequest: () => void;
 } {
   const [tourRequested, setTourRequested] = useState(false);
-  const [requestedTourType, setRequestedTourType] = useState<TourType>('tools');
+  const [requestedTourType, setRequestedTourType] = useState<TourType>('whatsnew');
 
   useEffect(() => {
     if (typeof window === 'undefined') return;
 
     const handleTourRequest = (event: Event) => {
       const { detail } = event as CustomEvent<StartTourPayload>;
-      setRequestedTourType(detail?.tourType ?? 'tools');
+      setRequestedTourType(detail?.tourType ?? 'whatsnew');
       setTourRequested(true);
     };
 

frontend/src/core/components/onboarding/userStepsConfig.ts

@@ -8,12 +8,8 @@ export enum TourStep {
   FILES_BUTTON,
   FILE_SOURCES,
   WORKBENCH,
-  VIEW_SWITCHER,
-  VIEWER,
-  PAGE_EDITOR,
   ACTIVE_FILES,
   FILE_CHECKBOX,
-  SELECT_CONTROLS,
   CROP_SETTINGS,
   RUN_BUTTON,
   RESULTS,
@@ -28,10 +24,7 @@ interface UserStepActions {
   backToAllTools: () => void;
   selectCropTool: () => void;
   loadSampleFile: () => void;
-  switchToViewer: () => void;
-  switchToPageEditor: () => void;
   switchToActiveFiles: () => void;
-  selectFirstFile: () => void;
   pinFile: () => void;
   modifyCropSettings: () => void;
   executeTool: () => void;
@@ -50,10 +43,7 @@ export function createUserStepsConfig({ t, actions }: CreateUserStepsConfigArgs)
     backToAllTools,
     selectCropTool,
     loadSampleFile,
-    switchToViewer,
-    switchToPageEditor,
     switchToActiveFiles,
-    selectFirstFile,
     pinFile,
     modifyCropSettings,
     executeTool,
@@ -108,26 +98,6 @@ export function createUserStepsConfig({ t, actions }: CreateUserStepsConfigArgs)
       position: 'center',
       padding: 0,
     },
-    [TourStep.VIEW_SWITCHER]: {
-      selector: '[data-tour="view-switcher"]',
-      content: t('onboarding.viewSwitcher', 'Use these controls to select how you want to view your PDFs.'),
-      position: 'bottom',
-      padding: 0,
-    },
-    [TourStep.VIEWER]: {
-      selector: '[data-tour="workbench"]',
-      content: t('onboarding.viewer', "The <strong>Viewer</strong> lets you read and annotate your PDFs."),
-      position: 'center',
-      padding: 0,
-      action: () => switchToViewer(),
-    },
-    [TourStep.PAGE_EDITOR]: {
-      selector: '[data-tour="workbench"]',
-      content: t('onboarding.pageEditor', "The <strong>Page Editor</strong> allows you to do various operations on the pages within your PDFs, such as reordering, rotating and deleting."),
-      position: 'center',
-      padding: 0,
-      action: () => switchToPageEditor(),
-    },
     [TourStep.ACTIVE_FILES]: {
       selector: '[data-tour="workbench"]',
       content: t('onboarding.activeFiles', "The <strong>Active Files</strong> view shows all of the PDFs you have loaded into the tool, and allows you to select which ones to process."),
@@ -141,14 +111,6 @@ export function createUserStepsConfig({ t, actions }: CreateUserStepsConfigArgs)
       position: 'top',
       padding: 10,
     },
-    [TourStep.SELECT_CONTROLS]: {
-      selector: '[data-tour="right-rail-controls"]',
-      highlightedSelectors: ['[data-tour="right-rail-controls"]', '[data-tour="right-rail-settings"]'],
-      content: t('onboarding.selectControls', "The <strong>Right Rail</strong> contains buttons to quickly select/deselect all of your active PDFs, along with buttons to change the app's theme or language."),
-      position: 'left',
-      padding: 5,
-      action: () => selectFirstFile(),
-    },
     [TourStep.CROP_SETTINGS]: {
       selector: '[data-tour="crop-settings"]',
       content: t('onboarding.cropSettings', "Now that we've selected the file we want crop, we can configure the <strong>Crop</strong> tool to choose the area that we want to crop the PDF to."),

frontend/src/core/components/onboarding/whatsNewStepsConfig.ts

@@ -0,0 +1,197 @@
+import type { StepType } from '@reactour/tour';
+import type { TFunction } from 'i18next';
+
+async function waitForElement(selector: string, timeoutMs = 7000, intervalMs = 100): Promise<void> {
+  if (typeof document === 'undefined') return;
+  const start = Date.now();
+  // Immediate hit
+  if (document.querySelector(selector)) return;
+
+  return new Promise((resolve) => {
+    const check = () => {
+      if (document.querySelector(selector) || Date.now() - start >= timeoutMs) {
+        resolve();
+        return;
+      }
+      setTimeout(check, intervalMs);
+    };
+    check();
+  });
+}
+
+async function waitForHighlightable(selector: string, timeoutMs = 7000, intervalMs = 500): Promise<void> {
+  if (typeof document === 'undefined') return;
+  const start = Date.now();
+
+  return new Promise((resolve) => {
+    const check = () => {
+      const el = document.querySelector<HTMLElement>(selector);
+      const isVisible = !!el && el.getClientRects().length > 0;
+      if (isVisible || Date.now() - start >= timeoutMs) {
+        // Nudge Reactour to recalc positions in case layout shifted
+        window.dispatchEvent(new Event('resize'));
+        requestAnimationFrame(() => window.dispatchEvent(new Event('resize')));
+        resolve();
+        return;
+      }
+      setTimeout(check, intervalMs);
+    };
+    check();
+  });
+}
+
+export enum WhatsNewTourStep {
+  QUICK_ACCESS,
+  LEFT_PANEL,
+  FILE_UPLOAD,
+  RIGHT_RAIL,
+  TOP_BAR,
+  PAGE_EDITOR_VIEW,
+  ACTIVE_FILES_VIEW,
+  WRAP_UP,
+}
+
+interface WhatsNewStepActions {
+  saveWorkbenchState: () => void;
+  closeFilesModal: () => void;
+  backToAllTools: () => void;
+  openFilesModal: () => void;
+  loadSampleFile: () => Promise<void> | void;
+  switchToViewer: () => void;
+  switchToPageEditor: () => void;
+  switchToActiveFiles: () => void;
+  selectFirstFile: () => void;
+}
+
+interface CreateWhatsNewStepsConfigArgs {
+  t: TFunction;
+  actions: WhatsNewStepActions;
+}
+
+export function createWhatsNewStepsConfig({ t, actions }: CreateWhatsNewStepsConfigArgs): Record<WhatsNewTourStep, StepType> {
+  const {
+    saveWorkbenchState,
+    closeFilesModal,
+    backToAllTools,
+    openFilesModal,
+    loadSampleFile,
+    switchToViewer,
+    switchToPageEditor,
+    switchToActiveFiles,
+    selectFirstFile,
+  } = actions;
+
+  return {
+    [WhatsNewTourStep.QUICK_ACCESS]: {
+      selector: '[data-tour="quick-access-bar"]',
+      content: t(
+        'onboarding.whatsNew.quickAccess',
+        'Start at the <strong>Quick Access</strong> rail to jump between Reader, Automate, your files, and all the tours.'
+      ),
+      position: 'right',
+      padding: 10,
+      action: () => {
+        saveWorkbenchState();
+        closeFilesModal();
+        backToAllTools();
+      },
+    },
+    [WhatsNewTourStep.LEFT_PANEL]: {
+      selector: '[data-tour="tool-panel"]',
+      content: t(
+        'onboarding.whatsNew.leftPanel',
+        'The left <strong>Tools</strong> panel lists everything you can do. Browse categories or search to find a tool quickly.'
+      ),
+      position: 'center',
+      padding: 0,
+    },
+    [WhatsNewTourStep.FILE_UPLOAD]: {
+      selector: '[data-tour="files-button"]',
+      content: t(
+        'onboarding.whatsNew.fileUpload',
+        'Use the <strong>Files</strong> button to upload or pick a recent PDF. We will load a sample so you can see the workspace.'
+      ),
+      position: 'right',
+      padding: 10,
+      action: async () => {
+        openFilesModal();
+        await waitForElement('[data-tour="file-sources"]', 5000, 100);
+      },
+      actionAfter: async () => {
+        await Promise.resolve(loadSampleFile());
+        closeFilesModal();
+        switchToViewer();
+        // wait for file render and top controls to mount
+        await waitForElement('[data-tour="view-switcher"]', 7000, 100);
+        await waitForHighlightable('[data-tour="view-switcher"]', 7000, 500);
+      },
+    },
+    [WhatsNewTourStep.RIGHT_RAIL]: {
+      selector: '[data-tour="right-rail-controls"]',
+      highlightedSelectors: ['[data-tour="right-rail-controls"]', '[data-tour="right-rail-settings"]'],
+      content: t(
+        'onboarding.whatsNew.rightRail',
+        'The <strong>Right Rail</strong> holds quick actions to select files, change theme or language, and download results.'
+      ),
+      position: 'left',
+      padding: 10,
+      action: async () => {
+        await waitForElement('[data-tour="right-rail-controls"]', 7000, 100);
+        selectFirstFile();
+      },
+    },
+    [WhatsNewTourStep.TOP_BAR]: {
+      selector: '[data-tour="view-switcher"]',
+      content: t(
+        'onboarding.whatsNew.topBar',
+        'The top bar lets you swap between <strong>Viewer</strong>, <strong>Page Editor</strong>, and <strong>Active Files</strong>.'
+      ),
+      position: 'bottom',
+      padding: 8,
+      // Ensure the switcher has mounted before this step renders
+      action: async () => {
+        switchToViewer();
+        await waitForElement('[data-tour="view-switcher"]', 7000, 100);
+        await waitForHighlightable('[data-tour="view-switcher"]', 7000, 500);
+      },
+    },
+    [WhatsNewTourStep.PAGE_EDITOR_VIEW]: {
+      selector: '[data-tour="view-switcher"]',
+      content: t(
+        'onboarding.whatsNew.pageEditorView',
+        'Switch to the Page Editor to reorder, rotate, or delete pages.'
+      ),
+      position: 'bottom',
+      padding: 8,
+      action: async () => {
+        switchToPageEditor();
+        await waitForElement('[data-tour="view-switcher"]', 7000, 100);
+        await waitForHighlightable('[data-tour="view-switcher"]', 7000, 500);
+      },
+    },
+    [WhatsNewTourStep.ACTIVE_FILES_VIEW]: {
+      selector: '[data-tour="view-switcher"]',
+      content: t(
+        'onboarding.whatsNew.activeFilesView',
+        'Use Active Files to see everything you have open and pick what to work on.'
+      ),
+      position: 'bottom',
+      padding: 8,
+      action: async () => {
+        switchToActiveFiles();
+        await waitForElement('[data-tour="view-switcher"]', 7000, 100);
+        await waitForHighlightable('[data-tour="view-switcher"]', 7000, 500);
+      },
+    },
+    [WhatsNewTourStep.WRAP_UP]: {
+      selector: '[data-tour="help-button"]',
+      content: t(
+        'onboarding.whatsNew.wrapUp',
+        'That is what is new in V2. Open the <strong>Tours</strong> menu anytime to replay this, the Tools tour, or the Admin tour.'
+      ),
+      position: 'right',
+      padding: 10,
+    },
+  };
+}
+

frontend/src/core/components/shared/AdminAnalyticsChoiceModal.tsx

@@ -1,139 +0,0 @@
-import {
-  Modal,
-  Stack,
-  Button,
-  Text,
-  Title,
-  Anchor,
-  useMantineTheme,
-  useComputedColorScheme,
-} from '@mantine/core';
-import { useTranslation } from 'react-i18next';
-import { useState } from 'react';
-import { Z_ANALYTICS_MODAL } from '@app/styles/zIndex';
-import { useAppConfig } from '@app/contexts/AppConfigContext';
-import apiClient from '@app/services/apiClient';
-
-interface AdminAnalyticsChoiceModalProps {
-  opened: boolean;
-  onClose: () => void;
-}
-
-export default function AdminAnalyticsChoiceModal({ opened, onClose }: AdminAnalyticsChoiceModalProps) {
-  const { t } = useTranslation();
-  const { refetch } = useAppConfig();
-  const [loading, setLoading] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const theme = useMantineTheme();
-  const computedColorScheme = useComputedColorScheme('light', { getInitialValueInEffect: true });
-  const isDark = computedColorScheme === 'dark';
-  const privacyHighlightStyles = {
-    color: isDark ? '#FFFFFF' : theme.colors.blue[7],
-    padding: `${theme.spacing.xs} ${theme.spacing.sm}`,
-    borderRadius: theme.radius.md,
-    fontWeight: 700,
-    textAlign: 'center' as const,
-    display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'center',
-    gap: theme.spacing.xs,
-    letterSpacing: 0.3,
-  };
-
-  const handleChoice = async (enableAnalytics: boolean) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const formData = new FormData();
-      formData.append('enabled', enableAnalytics.toString());
-
-      await apiClient.post('/api/v1/settings/update-enable-analytics', formData);
-
-      // Refetch config to apply new settings without page reload
-      await refetch();
-
-      // Close the modal after successful save
-      onClose();
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'Unknown error occurred');
-      setLoading(false);
-    }
-  };
-
-  const handleEnable = () => {
-    handleChoice(true);
-  };
-
-  const handleDisable = () => {
-    handleChoice(false);
-  };
-
-  return (
-    <Modal
-      opened={opened}
-      onClose={() => {}} // Prevent closing
-      closeOnClickOutside={false}
-      closeOnEscape={false}
-      withCloseButton={false}
-      size="lg"
-      centered
-      zIndex={Z_ANALYTICS_MODAL}
-    >
-      <Stack gap="md">
-        <Title order={2}>{t('analytics.title', 'Do you want make Stirling PDF better?')}</Title>
-
-        <Text size="sm" c="dimmed">
-          {t('analytics.paragraph1', 'Stirling PDF has opt in analytics to help us improve the product.')}
-        </Text>
-        <Text size="sm" style={privacyHighlightStyles}>
-          • {t('analytics.privacyAssurance', 'We do not track any personal information or the contents of your files.')} •
-        </Text>
-
-        <Text size="sm" c="dimmed">
-          {t('analytics.paragraph2', 'Please consider enabling analytics to help Stirling-PDF grow and to allow us to understand our users better.')}{' '}
-          <Anchor
-            href="https://docs.stirlingpdf.com/analytics-telemetry"
-            target="_blank"
-            rel="noopener noreferrer"
-            size="sm"
-          >
-            {t('analytics.learnMore', 'Learn more')}
-          </Anchor>
-        </Text>
-
-        {error && (
-          <Text c="red" size="sm">
-            {error}
-          </Text>
-        )}
-
-        <Stack gap="sm">
-          <Button
-            onClick={handleEnable}
-            loading={loading}
-            fullWidth
-            size="md"
-          >
-            {t('analytics.enable', 'Enable analytics')}
-          </Button>
-
-          <Button
-            onClick={handleDisable}
-            loading={loading}
-            fullWidth
-            size="md"
-            variant="subtle"
-            c="gray"
-          >
-            {t('analytics.disable', 'Disable analytics')}
-          </Button>
-        </Stack>
-
-        <Text size="xs" c="dimmed" ta="center">
-          {t('analytics.settings', 'You can change the settings for analytics in the config/settings.yml file')}
-        </Text>
-      </Stack>
-    </Modal>
-  );
-}

frontend/src/core/components/shared/AppConfigModal.tsx

@@ -69,7 +69,7 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({ opened, onClose })
   }), []);
 
   // Get isAdmin and runningEE from app config
-  const isAdmin = true // config?.isAdmin ?? false;
+  const isAdmin = config?.isAdmin ?? false;
   const runningEE = config?.runningEE ?? false;
   const loginEnabled = config?.enableLogin ?? false;
 

frontend/src/core/components/shared/Footer.tsx

@@ -95,6 +95,22 @@ export default function Footer({
           >
             {t('legal.terms', 'Terms and Conditions')}
           </a>
+          <a
+            className="footer-link px-3"
+            target="_blank"
+            rel="noopener noreferrer"
+            href="https://discord.gg/Cn8pWhQRxZ"
+          >
+            {t('footer.discord', 'Discord')}
+          </a>
+          <a
+            className="footer-link px-3"
+            target="_blank"
+            rel="noopener noreferrer"
+            href="https://github.com/Stirling-Tools/Stirling-PDF"
+          >
+            {t('footer.issues', 'GitHub')}
+          </a>
           <a
             className="footer-link px-3"
             target="_blank"

frontend/src/core/components/shared/LanguageSelector.tsx

@@ -173,7 +173,7 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({
     .sort(([, nameA], [, nameB]) => nameA.localeCompare(nameB))
     .map(([code, name]) => ({
       value: code,
-      label: `${name} (${code})`,
+      label: name,
     }));
 
   // Hide the language selector if there's only one language option

frontend/src/core/components/shared/QuickAccessBar.tsx

@@ -11,6 +11,7 @@ import { useSidebarNavigation } from '@app/hooks/useSidebarNavigation';
 import { handleUnlessSpecialClick } from '@app/utils/clickHandlers';
 import { ButtonConfig } from '@app/types/sidebar';
 import '@app/components/shared/quickAccessBar/QuickAccessBar.css';
+import { Tooltip } from '@app/components/shared/Tooltip';
 import AllToolsNavButton from '@app/components/shared/AllToolsNavButton';
 import ActiveToolButton from "@app/components/shared/quickAccessBar/ActiveToolButton";
 import AppConfigModal from '@app/components/shared/AppConfigModal';
@@ -18,6 +19,7 @@ import { useAppConfig } from '@app/contexts/AppConfigContext';
 import { useLicenseAlert } from "@app/hooks/useLicenseAlert";
 import { requestStartTour } from '@app/constants/events';
 import QuickAccessButton from '@app/components/shared/quickAccessBar/QuickAccessButton';
+import { useToursTooltip } from '@app/components/shared/quickAccessBar/useToursTooltip';
 
 import {
   isNavButtonActive,
@@ -41,6 +43,14 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
   const [configModalOpen, setConfigModalOpen] = useState(false);
   const [activeButton, setActiveButton] = useState<string>('tools');
   const scrollableRef = useRef<HTMLDivElement>(null);
+  const {
+    tooltipOpen,
+    manualCloseOnly,
+    showCloseButton,
+    toursMenuOpen,
+    setToursMenuOpen,
+    handleTooltipOpenChange,
+  } = useToursTooltip();
 
   const isRTL = typeof document !== 'undefined' && document.documentElement.dir === 'rtl';
 
@@ -166,8 +176,8 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
   const bottomButtons: ButtonConfig[] = [
     {
       id: 'help',
-      name: t("quickAccess.help", "Help"),
-      icon: <LocalIcon icon="help-rounded" width="1.25rem" height="1.25rem" />,
+      name: t("quickAccess.tours", "Tours"),
+      icon: <LocalIcon icon="explore-rounded" width="1.25rem" height="1.25rem" />,
       isRound: true,
       size: 'md',
       type: 'action',
@@ -192,6 +202,7 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
     <div
       ref={ref}
       data-sidebar="quick-access"
+      data-tour="quick-access-bar"
       className={`h-screen flex flex-col w-16 quick-access-bar-main ${isRainbowMode ? 'rainbow-mode' : ''}`}
     >
       {/* Fixed header outside scrollable area */}
@@ -247,58 +258,83 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
               // Handle help button with menu or direct action
               if (buttonConfig.id === 'help') {
                 const isAdmin = config?.isAdmin === true;
+                const toursTooltipContent = isAdmin
+                  ? t('quickAccess.toursTooltip.admin', 'Watch walkthroughs here: Tools tour, New V2 layout tour, and the Admin tour.')
+                  : t('quickAccess.toursTooltip.user', 'Watch walkthroughs here: Tools tour and the New V2 layout tour.');
+                const tourItems = [
+                  {
+                    key: 'whatsnew',
+                    icon: <LocalIcon icon="auto-awesome-rounded" width="1.25rem" height="1.25rem" />,
+                    title: t("quickAccess.helpMenu.whatsNewTour", "See what's new in V2"),
+                    description: t("quickAccess.helpMenu.whatsNewTourDesc", "Tour the updated layout"),
+                    onClick: () => requestStartTour('whatsnew'),
+                  },
+                  {
+                    key: 'tools',
+                    icon: <LocalIcon icon="view-carousel-rounded" width="1.25rem" height="1.25rem" />,
+                    title: t("quickAccess.helpMenu.toolsTour", "Tools Tour"),
+                    description: t("quickAccess.helpMenu.toolsTourDesc", "Learn what the tools can do"),
+                    onClick: () => requestStartTour('tools'),
+                  },
+                  ...(isAdmin ? [{
+                    key: 'admin',
+                    icon: <LocalIcon icon="admin-panel-settings-rounded" width="1.25rem" height="1.25rem" />,
+                    title: t("quickAccess.helpMenu.adminTour", "Admin Tour"),
+                    description: t("quickAccess.helpMenu.adminTourDesc", "Explore admin settings & features"),
+                    onClick: () => requestStartTour('admin'),
+                  }] : []),
+                ];
 
-                // If not admin, just show button that starts tools tour directly
-                if (!isAdmin) {
-                  return (
-                    <div
-                      key={buttonConfig.id}
-                      data-tour="help-button"
-                      onClick={() => requestStartTour('tools')}
+                const helpButtonNode = (
+                  <div data-tour="help-button">
+                    <Menu
+                      position={isRTL ? 'left' : 'right'}
+                      offset={10}
+                      zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
+                      opened={toursMenuOpen}
+                      onChange={setToursMenuOpen}
                     >
-                      {renderNavButton(buttonConfig, index)}
-                    </div>
-                  );
-                }
-
-                // If admin, show menu with both options
-                return (
-                  <div key={buttonConfig.id} data-tour="help-button">
-                    <Menu position={isRTL ? 'left' : 'right'} offset={10} zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}>
                       <Menu.Target>
                         <div>{renderNavButton(buttonConfig, index)}</div>
                       </Menu.Target>
                       <Menu.Dropdown>
-                        <Menu.Item
-                          leftSection={<LocalIcon icon="view-carousel-rounded" width="1.25rem" height="1.25rem" />}
-                          onClick={() => requestStartTour('tools')}
-                        >
-                          <div>
-                            <div style={{ fontWeight: 500 }}>
-                              {t("quickAccess.helpMenu.toolsTour", "Tools Tour")}
+                        {tourItems.map((item) => (
+                          <Menu.Item
+                            key={item.key}
+                            leftSection={item.icon}
+                            onClick={item.onClick}
+                          >
+                            <div>
+                              <div style={{ fontWeight: 500 }}>
+                                {item.title}
+                              </div>
+                              <div style={{ fontSize: '0.875rem', opacity: 0.7 }}>
+                                {item.description}
+                              </div>
                             </div>
-                            <div style={{ fontSize: '0.875rem', opacity: 0.7 }}>
-                              {t("quickAccess.helpMenu.toolsTourDesc", "Learn what the tools can do")}
-                            </div>
-                          </div>
-                        </Menu.Item>
-                        <Menu.Item
-                          leftSection={<LocalIcon icon="admin-panel-settings-rounded" width="1.25rem" height="1.25rem" />}
-                          onClick={() => requestStartTour('admin')}
-                        >
-                          <div>
-                            <div style={{ fontWeight: 500 }}>
-                              {t("quickAccess.helpMenu.adminTour", "Admin Tour")}
-                            </div>
-                            <div style={{ fontSize: '0.875rem', opacity: 0.7 }}>
-                              {t("quickAccess.helpMenu.adminTourDesc", "Explore admin settings & features")}
-                            </div>
-                          </div>
-                        </Menu.Item>
+                          </Menu.Item>
+                        ))}
                       </Menu.Dropdown>
                     </Menu>
                   </div>
                 );
+
+                return (
+                  <Tooltip
+                    position="right"
+                    arrow
+                    offset={8}
+                    open={tooltipOpen}
+                    manualCloseOnly={manualCloseOnly}
+                    showCloseButton={showCloseButton}
+                    closeOnOutside={false}
+                    openOnFocus={false}
+                    content={toursTooltipContent}
+                    onOpenChange={handleTooltipOpenChange}
+                  >
+                    {helpButtonNode}
+                  </Tooltip>
+                );
               }
 
               const buttonNode = renderNavButton(buttonConfig, index);

frontend/src/core/components/shared/Tooltip.tsx

@@ -33,6 +33,10 @@ export interface TooltipProps {
   disabled?: boolean;
   /** If false, tooltip will not open on focus (hover only) */
   openOnFocus?: boolean;
+  /** If true, tooltip stays open until explicitly closed (ignores hover/blur/esc/outside) */
+  manualCloseOnly?: boolean;
+  /** Show a close button even when not pinned */
+  showCloseButton?: boolean;
 }
 
 export const Tooltip: React.FC<TooltipProps> = ({
@@ -55,6 +59,8 @@ export const Tooltip: React.FC<TooltipProps> = ({
   closeOnOutside = true,
   disabled = false,
   openOnFocus = true,
+  manualCloseOnly = false,
+  showCloseButton = false,
 }) => {
   const [internalOpen, setInternalOpen] = useState(false);
   const [isPinned, setIsPinned] = useState(false);
@@ -81,6 +87,7 @@ export const Tooltip: React.FC<TooltipProps> = ({
 
   const isControlled = controlledOpen !== undefined;
   const open = (isControlled ? !!controlledOpen : internalOpen) && !disabled;
+  const allowAutoClose = !manualCloseOnly;
 
   const resolvedPosition: NonNullable<TooltipProps['position']> = useMemo(() => {
     const htmlDir = typeof document !== 'undefined' ? document.documentElement.dir : 'ltr';
@@ -132,11 +139,11 @@ export const Tooltip: React.FC<TooltipProps> = ({
       }
 
       // Not pinned and configured to close on outside
-      if (closeOnOutside && !insideTooltip && !insideTrigger) {
+      if (allowAutoClose && closeOnOutside && !insideTooltip && !insideTrigger) {
         setOpen(false);
       }
     },
-    [isPinned, closeOnOutside, setOpen]
+    [isPinned, closeOnOutside, setOpen, allowAutoClose]
   );
 
   useEffect(() => {
@@ -200,10 +207,10 @@ export const Tooltip: React.FC<TooltipProps> = ({
       }
 
       clearTimers();
-      if (!isPinned) setOpen(false);
+      if (allowAutoClose && !isPinned) setOpen(false);
       (children.props as any)?.onPointerLeave?.(e);
     },
-    [clearTimers, isPinned, setOpen, children.props]
+    [clearTimers, isPinned, setOpen, children.props, allowAutoClose]
   );
 
   const handleMouseDown = useCallback(
@@ -257,15 +264,16 @@ export const Tooltip: React.FC<TooltipProps> = ({
         return;
       }
       clearTimers();
-      if (!isPinned) setOpen(false);
+      if (allowAutoClose && !isPinned) setOpen(false);
       (children.props as any)?.onBlur?.(e);
     },
-    [isPinned, setOpen, children.props, clearTimers]
+    [isPinned, setOpen, children.props, allowAutoClose, clearTimers]
   );
 
   const handleKeyDown = useCallback((e: React.KeyboardEvent) => {
+    if (manualCloseOnly) return;
     if (e.key === 'Escape') setOpen(false);
-  }, [setOpen]);
+  }, [setOpen, manualCloseOnly]);
 
   // Keep open while pointer is over the tooltip; close when leaving it (if not pinned)
   const handleTooltipPointerEnter = useCallback(() => {
@@ -276,9 +284,9 @@ export const Tooltip: React.FC<TooltipProps> = ({
     (e: React.PointerEvent) => {
       const related = e.relatedTarget as Node | null;
       if (isDomNode(related) && triggerRef.current && triggerRef.current.contains(related)) return;
-      if (!isPinned) setOpen(false);
+      if (allowAutoClose && !isPinned) setOpen(false);
     },
-    [isPinned, setOpen]
+    [isPinned, setOpen, allowAutoClose]
   );
 
   // Enhance child with handlers and ref
@@ -301,6 +309,7 @@ export const Tooltip: React.FC<TooltipProps> = ({
   });
 
   const shouldShowTooltip = open;
+  const shouldShowCloseButton = showCloseButton || isPinned;
 
   const tooltipElement = shouldShowTooltip ? (
     <div
@@ -325,7 +334,7 @@ export const Tooltip: React.FC<TooltipProps> = ({
       className={`${styles['tooltip-container']} ${isPinned ? styles.pinned : ''}`}
       onClick={pinOnClick ? (e) => { e.stopPropagation(); setIsPinned(true); } : undefined}
     >
-      {isPinned && (
+      {shouldShowCloseButton && (
         <button
           className={styles['tooltip-pin-button']}
           onClick={(e) => {
@@ -363,7 +372,7 @@ export const Tooltip: React.FC<TooltipProps> = ({
           <span className={styles['tooltip-title']}>{header.title}</span>
         </div>
       )}
-      <TooltipContent content={content} tips={tips} />
+      <TooltipContent content={content} tips={tips} extraRightPadding={shouldShowCloseButton ? 48 : 0} />
     </div>
   ) : null;
 

frontend/src/core/components/shared/config/types.ts

@@ -3,6 +3,7 @@ export const VALID_NAV_KEYS = [
   'preferences',
   'notifications',
   'connections',
+  'account',
   'general',
   'people',
   'teams',

frontend/src/core/components/shared/quickAccessBar/useToursTooltip.ts

@@ -0,0 +1,81 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { TOUR_STATE_EVENT, type TourStatePayload } from '@app/constants/events';
+import { isOnboardingCompleted, hasShownToursTooltip, markToursTooltipShown } from '@app/components/onboarding/orchestrator/onboardingStorage';
+
+export interface ToursTooltipState {
+  tooltipOpen: boolean | undefined;
+  manualCloseOnly: boolean;
+  showCloseButton: boolean;
+  toursMenuOpen: boolean;
+  setToursMenuOpen: (open: boolean) => void;
+  handleTooltipOpenChange: (next: boolean) => void;
+}
+
+/**
+ * Encapsulates all the logic for the tours tooltip:
+ * - Shows automatically after onboarding/tour completes (once per user)
+ * - Hides while the tours menu is open
+ * - After dismissal, reverts to hover-only tooltip
+ */
+export function useToursTooltip(): ToursTooltipState {
+  const [showToursTooltip, setShowToursTooltip] = useState(false);
+  const [toursMenuOpen, setToursMenuOpen] = useState(false);
+  const tourWasOpenRef = useRef(false);
+
+  // Auto-show when a tour ends (fires once per user)
+  useEffect(() => {
+    if (typeof window === 'undefined') return;
+
+    const handleTourStateChange = (event: Event) => {
+      const { detail } = event as CustomEvent<TourStatePayload>;
+      const wasOpen = tourWasOpenRef.current;
+      tourWasOpenRef.current = detail.isOpen;
+
+      if (wasOpen && !detail.isOpen && !hasShownToursTooltip()) {
+        setShowToursTooltip(true);
+      }
+    };
+
+    window.addEventListener(TOUR_STATE_EVENT, handleTourStateChange);
+    return () => window.removeEventListener(TOUR_STATE_EVENT, handleTourStateChange);
+  }, []);
+
+  // Show once after onboarding is complete
+  useEffect(() => {
+    if (isOnboardingCompleted() && !hasShownToursTooltip()) {
+      setShowToursTooltip(true);
+    }
+  }, []);
+
+  const handleDismissToursTooltip = useCallback(() => {
+    markToursTooltipShown();
+    setShowToursTooltip(false);
+  }, []);
+
+  const hasBeenDismissed = hasShownToursTooltip();
+
+  const handleTooltipOpenChange = useCallback(
+    (next: boolean) => {
+      if (!next) {
+        if (!hasBeenDismissed) {
+          handleDismissToursTooltip();
+        }
+      } else if (!hasBeenDismissed && !toursMenuOpen) {
+        setShowToursTooltip(true);
+      }
+    },
+    [hasBeenDismissed, toursMenuOpen, handleDismissToursTooltip]
+  );
+
+  const tooltipOpen = toursMenuOpen ? false : hasBeenDismissed ? undefined : showToursTooltip;
+
+  return {
+    tooltipOpen,
+    manualCloseOnly: !hasBeenDismissed,
+    showCloseButton: !hasBeenDismissed,
+    toursMenuOpen,
+    setToursMenuOpen,
+    handleTooltipOpenChange,
+  };
+}
+

frontend/src/core/components/shared/tooltip/Tooltip.module.css

@@ -39,7 +39,7 @@
   background: var(--bg-raised);
   padding: 0.25rem;
   border-radius: 0.25rem;
-  border: 0.0625rem solid var(--primary-color, #3b82f6);
+  border: 0.0625rem solid var(--border-default);
   cursor: pointer;
   transition: background-color 0.2s ease, border-color 0.2s ease;
   z-index: 1;
@@ -60,6 +60,13 @@
   border-color: #ef4444 !important;
 }
 
+.tooltip-pin-button:focus,
+.tooltip-pin-button:focus-visible {
+  outline: none;
+  border-color: var(--border-default) !important;
+  background-color: var(--bg-raised) !important;
+}
+
 /* Tooltip Header */
 .tooltip-header {
   display: flex;
@@ -91,7 +98,7 @@
 
 /* Tooltip Body */
 .tooltip-body {
-  padding: 1rem !important;
+  padding: 1rem;
   color: var(--text-primary) !important;
   font-size: 0.875rem !important;
   line-height: 1.6 !important;

frontend/src/core/components/shared/tooltip/TooltipContent.tsx

@@ -5,18 +5,20 @@ import { TooltipTip } from '@app/types/tips';
 interface TooltipContentProps {
   content?: React.ReactNode;
   tips?: TooltipTip[];
+  extraRightPadding?: number;
 }
 
 export const TooltipContent: React.FC<TooltipContentProps> = ({
   content,
   tips,
+  extraRightPadding = 0,
 }) => {
   return (
     <div
       className={`${styles['tooltip-body']}`}
       style={{
         color: 'var(--text-primary)',
-        padding: '16px',
+        padding: `16px ${16 + extraRightPadding}px 16px 16px`,
         fontSize: '14px',
         lineHeight: '1.6'
       }}

frontend/src/core/components/tools/compress/CompressSettings.tsx

@@ -1,8 +1,9 @@
-import { useState } from "react";
-import { Stack, Text, NumberInput, Select, Divider, Checkbox } from "@mantine/core";
+import { useState, useEffect } from "react";
+import { Stack, Text, NumberInput, Select, Divider, Checkbox, Slider, SegmentedControl } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { CompressParameters } from "@app/hooks/tools/compress/useCompressParameters";
 import ButtonSelector from "@app/components/shared/ButtonSelector";
+import apiClient from "@app/services/apiClient";
 
 interface CompressSettingsProps {
   parameters: CompressParameters;
@@ -13,6 +14,20 @@ interface CompressSettingsProps {
 const CompressSettings = ({ parameters, onParameterChange, disabled = false }: CompressSettingsProps) => {
   const { t } = useTranslation();
   const [isSliding, setIsSliding] = useState(false);
+  const [imageMagickAvailable, setImageMagickAvailable] = useState<boolean | null>(null);
+
+  useEffect(() => {
+    const checkImageMagick = async () => {
+      try {
+        const response = await apiClient.get<boolean>('/api/v1/config/group-enabled?group=ImageMagick');
+        setImageMagickAvailable(response.data);
+      } catch (error) {
+        console.error('Failed to check ImageMagick availability:', error);
+        setImageMagickAvailable(true); // Optimistic fallback
+      }
+    };
+    checkImageMagick();
+  }, []);
 
   return (
     <Stack gap="md">
@@ -129,6 +144,62 @@ const CompressSettings = ({ parameters, onParameterChange, disabled = false }: C
           disabled={disabled}
           label={t("compress.grayscale.label", "Apply Grayscale for compression")}
         />
+        <Checkbox
+          checked={parameters.lineArt}
+          onChange={(event) => onParameterChange('lineArt', event.currentTarget.checked)}
+          disabled={disabled || imageMagickAvailable === false}
+          label={t("compress.lineArt.label", "Convert images to line art (bilevel)")}
+          description={
+            imageMagickAvailable === false
+              ? t("compress.lineArt.unavailable", "ImageMagick is not installed or enabled on this server")
+              : t("compress.lineArt.description", "Uses ImageMagick to reduce pages to high-contrast black and white for maximum size reduction.")
+          }
+        />
+        {parameters.lineArt && (
+          <Stack gap="xs" style={{ opacity: (disabled || imageMagickAvailable === false) ? 0.6 : 1 }}>
+            <Text size="sm" fw={600}>{t('compress.lineArt.detailLevel', 'Detail level')}</Text>
+            <Slider
+              min={1}
+              max={5}
+              step={1}
+              value={(() => {
+                // Map threshold to slider position
+                const thresholdMap = [20, 35, 50, 65, 80];
+                const closest = thresholdMap.reduce((prev, curr, idx) =>
+                  Math.abs(curr - parameters.lineArtThreshold) < Math.abs(thresholdMap[prev] - parameters.lineArtThreshold)
+                    ? idx : prev, 0);
+                return closest + 1;
+              })()}
+              onChange={(value) => {
+                // Map slider position to threshold: 1=20%, 2=35%, 3=50%, 4=65%, 5=80%
+                const thresholdMap = [20, 35, 50, 65, 80];
+                onParameterChange('lineArtThreshold', thresholdMap[value - 1]);
+              }}
+              disabled={disabled || imageMagickAvailable === false}
+              label={null}
+              marks={[
+                { value: 1 },
+                { value: 2 },
+                { value: 3 },
+                { value: 4 },
+                { value: 5 },
+              ]}
+            />
+
+            <Text size="sm" fw={600}>{t('compress.lineArt.edgeEmphasis', 'Edge emphasis')}</Text>
+            <SegmentedControl
+              fullWidth
+              disabled={disabled || imageMagickAvailable === false}
+              data={[
+                { value: '1', label: t('compress.lineArt.edgeLow', 'Gentle') },
+                { value: '2', label: t('compress.lineArt.edgeMedium', 'Balanced') },
+                { value: '3', label: t('compress.lineArt.edgeHigh', 'Strong') },
+              ]}
+              value={parameters.lineArtEdgeLevel.toString()}
+              onChange={(value) => onParameterChange('lineArtEdgeLevel', parseInt(value) as 1 | 2 | 3)}
+            />
+          </Stack>
+        )}
       </Stack>
     </Stack>
   );

frontend/src/core/components/tools/sign/SignSettings.tsx

@@ -853,6 +853,12 @@ const SignSettings = ({
           textColor={parameters.textColor || '#000000'}
           onTextColorChange={(color) => onParameterChange('textColor', color)}
           disabled={disabled}
+          label={translate('text.name', 'Text')}
+          placeholder={translate('text.placeholder', 'Enter text')}
+          fontLabel={translate('text.fontLabel', 'Font')}
+          fontSizeLabel={translate('text.fontSizeLabel', 'Font size')}
+          fontSizePlaceholder={translate('text.fontSizePlaceholder', 'Type or select font size (8-200)')}
+          colorLabel={translate('text.colorLabel', 'Text colour')}
           onAnyChange={() => {
             setPlacementManuallyPaused(false);
             lastAppliedPlacementKey.current = null;

frontend/src/core/components/tooltips/useCompressTips.ts

@@ -24,6 +24,13 @@ export const useCompressTips = (): TooltipContent => {
       {
         title: t("compress.tooltip.grayscale.title", "Grayscale"),
         description: t("compress.tooltip.grayscale.text", "Select this option to convert all images to black and white, which can significantly reduce file size especially for scanned PDFs or image-heavy documents.")
+      },
+      {
+        title: t("compress.tooltip.lineArt.title", "Line Art"),
+        description: t(
+          "compress.tooltip.lineArt.text",
+          "Convert pages to high-contrast black and white using ImageMagick. Use line thickness to control the threshold percentage and detection strength to choose how aggressively edges are outlined."
+        )
       }
     ]
   };

frontend/src/core/constants/events.ts

@@ -25,7 +25,7 @@ export interface UpgradeBannerAlertPayload {
   freeTierLimit?: number;
 }
 
-export type TourType = 'admin' | 'tools';
+export type TourType = 'admin' | 'tools' | 'whatsnew';
 
 export interface StartTourPayload {
   tourType: TourType;

frontend/src/core/contexts/AppConfigContext.tsx

@@ -29,6 +29,7 @@ export interface AppConfig {
   enableAnalytics?: boolean | null;
   enablePosthog?: boolean | null;
   enableScarf?: boolean | null;
+  enableDesktopInstallSlide?: boolean;
   premiumEnabled?: boolean;
   premiumKey?: string;
   termsAndConditions?: string;

frontend/src/core/contexts/TourOrchestrationContext.tsx

@@ -111,6 +111,8 @@ export const TourOrchestrationProvider: React.FC<{ children: React.ReactNode }>
 
   const loadSampleFile = useCallback(async () => {
     try {
+      // Hide the modal immediately so the tour targets are visible while we load
+      closeFilesModal();
       const response = await fetch(`${BASE_PATH}/samples/Sample.pdf`);
       const blob = await response.blob();
       const file = new File([blob], 'Sample.pdf', { type: 'application/pdf' });

frontend/src/core/hooks/tools/compress/useCompressOperation.ts

@@ -19,6 +19,11 @@ export const buildCompressFormData = (parameters: CompressParameters, file: File
   }
 
   formData.append("grayscale", parameters.grayscale.toString());
+  formData.append("lineArt", parameters.lineArt.toString());
+  if (parameters.lineArt) {
+    formData.append("lineArtThreshold", parameters.lineArtThreshold.toString());
+    formData.append("lineArtEdgeLevel", parameters.lineArtEdgeLevel.toString());
+  }
   return formData;
 };
 

frontend/src/core/hooks/tools/compress/useCompressParameters.ts

@@ -4,6 +4,9 @@ import { useBaseParameters, BaseParametersHook } from '@app/hooks/tools/shared/u
 export interface CompressParameters extends BaseParameters {
   compressionLevel: number;
   grayscale: boolean;
+  lineArt: boolean;
+  lineArtThreshold: number;
+  lineArtEdgeLevel: 1 | 2 | 3;
   expectedSize: string;
   compressionMethod: 'quality' | 'filesize';
   fileSizeValue: string;
@@ -13,6 +16,9 @@ export interface CompressParameters extends BaseParameters {
 export const defaultParameters: CompressParameters = {
   compressionLevel: 5,
   grayscale: false,
+  lineArt: false,
+  lineArtThreshold: 50,
+  lineArtEdgeLevel: 3,
   expectedSize: '',
   compressionMethod: 'quality',
   fileSizeValue: '',

frontend/src/core/hooks/useServerExperience.ts

@@ -64,7 +64,10 @@ export function useServerExperience(): ServerExperienceValue {
 
   const loginEnabled = config?.enableLogin !== false;
   const configIsAdmin = Boolean(config?.isAdmin);
-  const effectiveIsAdmin = configIsAdmin || (!loginEnabled && selfReportedAdmin);
+  // For no-login servers, treat everyone as a regular user (no effective admin)
+  // Commented out the previous self-reported admin path to avoid elevating users.
+  // const effectiveIsAdmin = configIsAdmin || (!loginEnabled && selfReportedAdmin);
+  const effectiveIsAdmin = loginEnabled ? configIsAdmin : false;
   const hasPaidLicense = config?.license === 'SERVER' || config?.license === 'PRO' || config?.license === 'ENTERPRISE';
 
   const setSelfReportedAdmin = useCallback((value: boolean) => {

frontend/src/core/services/accountService.ts

@@ -56,4 +56,14 @@ export const accountService = {
     formData.append('newPassword', newPassword);
     await apiClient.post('/api/v1/user/change-password-on-login', formData);
   },
+
+  /**
+   * Change username
+   */
+  async changeUsername(newUsername: string, currentPassword: string): Promise<void> {
+    const formData = new FormData();
+    formData.append('currentPasswordChangeUsername', currentPassword);
+    formData.append('newUsername', newUsername);
+    await apiClient.post('/api/v1/user/change-username', formData);
+  },
 };

frontend/src/core/services/auditService.ts

@@ -49,7 +49,9 @@ const auditService = {
    * Get audit system status
    */
   async getSystemStatus(): Promise<AuditSystemStatus> {
-    const response = await apiClient.get<any>('/api/v1/proprietary/ui-data/audit-dashboard');
+    const response = await apiClient.get('/api/v1/proprietary/ui-data/audit-dashboard', {
+      suppressErrorToast: true,
+    });
     const data = response.data;
 
     // Map V1 response to expected format

frontend/src/core/testing/serverExperienceSimulations.ts

@@ -38,7 +38,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: '2.0.0',
+  appVersion: '2.1.3',
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   serverPort: 8080,

frontend/src/core/tools/pdfTextEditor/PdfTextEditor.tsx

@@ -238,6 +238,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
   const originalImagesRef = useRef<PdfJsonImageElement[][]>([]);
   const originalGroupsRef = useRef<TextGroup[][]>([]);
   const imagesByPageRef = useRef<PdfJsonImageElement[][]>([]);
+  const lastLoadedFileRef = useRef<File | null>(null);
   const autoLoadKeyRef = useRef<string | null>(null);
   const sourceFileIdRef = useRef<string | null>(null);
   const loadRequestIdRef = useRef(0);
@@ -251,6 +252,10 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
   const pagePreviewsRef = useRef<Map<number, string>>(pagePreviews);
   const previewScaleRef = useRef<Map<number, number>>(new Map());
   const cachedJobIdRef = useRef<string | null>(null);
+  const previousCachedJobIdRef = useRef<string | null>(null);
+  const cacheRecoveryInProgressRef = useRef(false);
+  const cacheRecoveryAttemptsRef = useRef(0);
+  const recoverCacheAndReloadRef = useRef<() => Promise<boolean>>(async () => false);
 
   // Keep ref in sync with state for access in async callbacks
   useEffect(() => {
@@ -279,6 +284,13 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     };
   }, []);
 
+  const isCacheUnavailableError = useCallback((error: any): boolean => {
+    const status = error?.response?.status;
+    // Treat any 410 as cache unavailable, since responseType: 'blob' makes
+    // it impossible to reliably check the JSON body
+    return status === 410;
+  }, []);
+
   const dirtyPages = useMemo(
     () => getDirtyPages(groupsByPage, imagesByPage, originalGroupsRef.current, originalImagesRef.current),
     [groupsByPage, imagesByPage],
@@ -316,6 +328,9 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
       loadedImagePagesRef.current = new Set();
       loadingImagePagesRef.current = new Set();
       setSelectedPage(0);
+      setIsLazyMode(false);
+      setCachedJobId(null);
+      cachedJobIdRef.current = null;
       return;
     }
     const cloned = deepCloneDocument(document);
@@ -365,11 +380,14 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
   }, []);
 
   useEffect(() => {
-    const previousJobId = cachedJobIdRef.current;
+    // Clear old cached job when job ID changes
+    const previousJobId = previousCachedJobIdRef.current;
     if (previousJobId && previousJobId !== cachedJobId) {
+      console.log(`[PdfTextEditor] Clearing old cache for jobId: ${previousJobId}, new jobId: ${cachedJobId}`);
       clearCachedJob(previousJobId);
     }
-    cachedJobIdRef.current = cachedJobId;
+    // Update the previous jobId ref for next time
+    previousCachedJobIdRef.current = cachedJobId;
   }, [cachedJobId, clearCachedJob]);
 
   const initializePdfPreview = useCallback(
@@ -489,6 +507,11 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         );
       } catch (error) {
         console.error(`[loadImagesForPage] Failed to load images for page ${pageNumber}:`, error);
+        if (isCacheUnavailableError(error)) {
+          console.log('[loadImagesForPage] Cache expired, triggering automatic recovery...');
+          // Automatically recover by reloading the file
+          void recoverCacheAndReloadRef.current();
+        }
       } finally {
         loadingImagePagesRef.current.delete(pageIndex);
         setLoadingImagePages((prev) => {
@@ -498,7 +521,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         });
       }
     },
-    [isLazyMode, cachedJobId],
+    [isLazyMode, cachedJobId, isCacheUnavailableError],
   );
 
   const handleLoadFile = useCallback(
@@ -507,6 +530,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         return;
       }
 
+      lastLoadedFileRef.current = file;
       const requestId = loadRequestIdRef.current + 1;
       loadRequestIdRef.current = requestId;
 
@@ -555,59 +579,35 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
             message: 'Starting conversion...',
           });
 
-          let jobComplete = false;
-          let attempts = 0;
-          const maxAttempts = 600;
+        let jobComplete = false;
+        let attempts = 0;
+        const maxAttempts = 600;
+        let pollDelay = 500;
 
-          while (!jobComplete && attempts < maxAttempts) {
-            await new Promise((resolve) => setTimeout(resolve, 1000));
-            attempts += 1;
+        while (!jobComplete && attempts < maxAttempts) {
+          await new Promise((resolve) => setTimeout(resolve, pollDelay));
+          attempts += 1;
+          if (pollDelay < 10000) {
+            pollDelay = Math.min(10000, Math.floor(pollDelay * 1.5));
+          }
 
             try {
               const statusResponse = await apiClient.get(`/api/v1/general/job/${jobId}`);
               const jobStatus = statusResponse.data;
               console.log(`Job status (attempt ${attempts}):`, jobStatus);
 
-              if (jobStatus.notes && jobStatus.notes.length > 0) {
-                const lastNote = jobStatus.notes[jobStatus.notes.length - 1];
-                console.log('Latest note:', lastNote);
-                const matchWithCount = lastNote.match(
-                  /\[(\d+)%\]\s+(\w+):\s+(.+?)\s+\((\d+)\/(\d+)\)/,
-                );
-                if (matchWithCount) {
-                  const percent = parseInt(matchWithCount[1], 10);
-                  const stage = matchWithCount[2];
-                  const message = matchWithCount[3];
-                  const current = parseInt(matchWithCount[4], 10);
-                  const total = parseInt(matchWithCount[5], 10);
-                  setConversionProgress({
-                    percent,
-                    stage,
-                    message,
-                    current,
-                    total,
-                  });
-                } else {
-                  const match = lastNote.match(/\[(\d+)%\]\s+(\w+):\s+(.+)/);
-                  if (match) {
-                    const percent = parseInt(match[1], 10);
-                    const stage = match[2];
-                    const message = match[3];
-                    setConversionProgress({
-                      percent,
-                      stage,
-                      message,
-                    });
-                  }
-                }
-              } else if (jobStatus.progress !== undefined) {
-                const percent = Math.min(Math.max(jobStatus.progress, 0), 100);
-                setConversionProgress({
-                  percent,
-                  stage: jobStatus.stage || 'processing',
-                  message: jobStatus.note || 'Converting PDF to JSON...',
-                });
-              }
+              const percent = Math.min(Math.max(jobStatus.progress ?? 0, 0), 100);
+              const stage = jobStatus.stage || 'processing';
+              const message = jobStatus.note || 'Converting PDF to JSON...';
+              const current = jobStatus.current ?? undefined;
+              const total = jobStatus.total ?? undefined;
+              setConversionProgress({
+                percent,
+                stage,
+                message,
+                current,
+                total,
+              });
 
               if (jobStatus.complete) {
                 if (jobStatus.error) {
@@ -701,7 +701,9 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         setLoadedDocument(parsed);
         resetToDocument(parsed, groupingMode);
         setIsLazyMode(shouldUseLazyMode);
-        setCachedJobId(shouldUseLazyMode ? pendingJobId : null);
+        const newJobId = shouldUseLazyMode ? pendingJobId : null;
+        setCachedJobId(newJobId);
+        cachedJobIdRef.current = newJobId;
         setFileName(file.name);
         setErrorMessage(null);
       } catch (error: any) {
@@ -719,6 +721,9 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         setLoadedDocument(null);
         resetToDocument(null, groupingMode);
         clearPdfPreview();
+        setIsLazyMode(false);
+        setCachedJobId(null);
+        cachedJobIdRef.current = null;
 
         if (isPdf) {
           const errorMsg =
@@ -743,6 +748,38 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     [groupingMode, resetToDocument, t],
   );
 
+  const recoverCacheAndReload = useCallback(async () => {
+    if (cacheRecoveryInProgressRef.current) {
+      return false;
+    }
+    if (cacheRecoveryAttemptsRef.current >= 2) {
+      console.warn('[PdfTextEditor] Cache recovery limit reached');
+      return false;
+    }
+    cacheRecoveryAttemptsRef.current += 1;
+    const file = lastLoadedFileRef.current;
+    if (!file) {
+      console.warn('[PdfTextEditor] No file available for cache recovery');
+      return false;
+    }
+    cacheRecoveryInProgressRef.current = true;
+    try {
+      console.log('[PdfTextEditor] Automatically reloading file due to cache expiration...');
+      await handleLoadFile(file);
+      console.log('[PdfTextEditor] Cache recovery successful');
+      return true;
+    } catch (error) {
+      console.error('[PdfTextEditor] Cache recovery failed', error);
+      return false;
+    } finally {
+      cacheRecoveryInProgressRef.current = false;
+    }
+  }, [handleLoadFile]);
+
+  useEffect(() => {
+    recoverCacheAndReloadRef.current = recoverCacheAndReload;
+  }, [recoverCacheAndReload]);
+
   // Wrapper for loading files from the dropzone - adds to workbench first
   const handleLoadFileFromDropzone = useCallback(
     async (file: File) => {
@@ -1057,7 +1094,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         try {
           const payload = buildPayload();
           if (!payload) {
-            return;
+            throw new Error('Failed to build payload');
           }
 
           const { document, filename } = payload;
@@ -1076,7 +1113,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
           const baseName = sanitizeBaseName(filename).replace(/-edited$/u, '');
           const expectedName = `${baseName || 'document'}.pdf`;
           const response = await apiClient.post(
-            `/api/v1/convert/pdf/text-editor/partial/${cachedJobId}?filename=${encodeURIComponent(expectedName)}`,
+            `/api/v1/convert/pdf/text-editor/partial/${cachedJobIdRef.current}?filename=${encodeURIComponent(expectedName)}`,
             partialDocument,
             {
               responseType: 'blob',
@@ -1100,6 +1137,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
             '[handleGeneratePdf] Incremental export failed, falling back to full export',
             incrementalError,
           );
+          // Fall through to full export below
         }
       }
 
@@ -1636,6 +1674,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     }, 0);
   }, [navigationActions, navigationState.selectedTool]);
 
+  // Register workbench view (re-runs when dependencies change)
   useEffect(() => {
     registerCustomWorkbenchView({
       id: WORKBENCH_VIEW_ID,
@@ -1646,24 +1685,30 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     });
     setLeftPanelView('hidden');
     setCustomWorkbenchViewData(WORKBENCH_VIEW_ID, latestViewDataRef.current);
-
-    return () => {
-      // Clear backend cache if we were using lazy loading
-      clearCachedJob(cachedJobIdRef.current);
-      clearCustomWorkbenchViewData(WORKBENCH_VIEW_ID);
-      unregisterCustomWorkbenchView(WORKBENCH_VIEW_ID);
-      setLeftPanelView('toolPicker');
-    };
   }, [
-    clearCachedJob,
-    clearCustomWorkbenchViewData,
     registerCustomWorkbenchView,
     setCustomWorkbenchViewData,
     setLeftPanelView,
     viewLabel,
-    unregisterCustomWorkbenchView,
   ]);
 
+  // Cleanup ONLY on component unmount (not on re-renders)
+  useEffect(() => {
+    return () => {
+      // Clear backend cache when leaving the tool
+      const jobId = cachedJobIdRef.current;
+      if (jobId) {
+        console.log(`[PdfTextEditor] Cleaning up cached document on unmount: ${jobId}`);
+        apiClient.post(`/api/v1/convert/pdf/text-editor/clear-cache/${jobId}`).catch((error) => {
+          console.warn('[PdfTextEditor] Failed to clear cache on unmount:', error);
+        });
+      }
+      clearCustomWorkbenchViewData(WORKBENCH_VIEW_ID);
+      unregisterCustomWorkbenchView(WORKBENCH_VIEW_ID);
+      setLeftPanelView('toolPicker');
+    };
+  }, []); // Empty deps = cleanup only on unmount
+
   // Note: Compare tool doesn't auto-force workbench, and neither should we
   // The workbench should be set when the tool is selected via proper channels
   // (tool registry, tool picker, etc.) - not forced here

frontend/src/proprietary/auth/springAuthClient.test.ts

@@ -343,7 +343,7 @@ describe('SpringAuthClient', () => {
       });
 
       const result = await springAuth.signInWithOAuth({
-        provider: 'github',
+        provider: '/oauth2/authorization/github',
         options: { redirectTo: '/auth/callback' },
       });
 

frontend/src/proprietary/auth/springAuthClient.ts

@@ -60,6 +60,7 @@ export interface User {
   enabled?: boolean;
   is_anonymous?: boolean;
   isFirstLogin?: boolean;
+  authenticationType?: string;
   app_metadata?: Record<string, any>;
 }
 
@@ -249,11 +250,11 @@ class SpringAuthClient {
   }
 
   /**
-   * Sign in with OAuth provider (GitHub, Google, Authentik, etc.)
-   * This redirects to the Spring OAuth2 authorization endpoint
+   * Sign in with OAuth/SAML provider (GitHub, Google, Authentik, etc.)
+   * This redirects to the Spring OAuth2/SAML2 authorization endpoint
    *
-   * @param params.provider - OAuth provider ID (e.g., 'github', 'google', 'authentik', 'mycompany')
-   *                          Can be any known provider or custom string - the backend determines available providers
+   * @param params.provider - Full auth path from backend (e.g., '/oauth2/authorization/google', '/saml2/authenticate/stirling')
+   *                          The backend provides the complete path including the auth type and provider ID
    */
   async signInWithOAuth(params: {
     provider: OAuthProvider;
@@ -263,15 +264,16 @@ class SpringAuthClient {
       const redirectPath = normalizeRedirectPath(params.options?.redirectTo);
       persistRedirectPath(redirectPath);
 
-      // Redirect to Spring OAuth2 endpoint (Vite will proxy to backend)
-      const redirectUrl = `/oauth2/authorization/${params.provider}`;
-      // console.log('[SpringAuth] Redirecting to OAuth:', redirectUrl);
+      // Use the full path provided by the backend
+      // This supports both OAuth2 (/oauth2/authorization/...) and SAML2 (/saml2/authenticate/...)
+      const redirectUrl = params.provider;
+      // console.log('[SpringAuth] Redirecting to SSO:', redirectUrl);
       // Use window.location.assign for full page navigation
       window.location.assign(redirectUrl);
       return { error: null };
     } catch (error) {
       return {
-        error: { message: error instanceof Error ? error.message : 'OAuth redirect failed' },
+        error: { message: error instanceof Error ? error.message : 'SSO redirect failed' },
       };
     }
   }

frontend/src/proprietary/components/shared/UpgradeBanner.tsx

@@ -13,7 +13,7 @@ import {
   UPGRADE_BANNER_ALERT_EVENT,
 } from '@core/constants/events';
 import { useServerExperience } from '@app/hooks/useServerExperience';
-import { hasSeenStep } from '@core/components/onboarding/orchestrator/onboardingStorage';
+import { isOnboardingCompleted } from '@core/components/onboarding/orchestrator/onboardingStorage';
 
 const FRIENDLY_LAST_SEEN_KEY = 'upgradeBannerFriendlyLastShownAt';
 const WEEK_IN_MS = 7 * 24 * 60 * 60 * 1000;
@@ -26,6 +26,7 @@ const UpgradeBanner: React.FC = () => {
   const onAuthRoute = isAuthRoute(location.pathname);
   const { openCheckout } = useCheckout();
   const {
+    loginEnabled,
     totalUsers,
     userCountResolved,
     userCountLoading,
@@ -34,9 +35,11 @@ const UpgradeBanner: React.FC = () => {
     licenseLoading,
     freeTierLimit,
     overFreeTierLimit,
+    weeklyActiveUsers,
     scenarioKey,
   } = useServerExperience();
-  const onboardingComplete = hasSeenStep('welcome');
+  const onboardingComplete = isOnboardingCompleted();
+  console.log('onboardingComplete', onboardingComplete);
   const [friendlyVisible, setFriendlyVisible] = useState(() => {
     if (typeof window === 'undefined') return false;
     const lastShownRaw = window.localStorage.getItem(FRIENDLY_LAST_SEEN_KEY);
@@ -296,8 +299,18 @@ const UpgradeBanner: React.FC = () => {
     );
   };
 
+  const suppressForNoLogin =
+    !loginEnabled ||
+    (!loginEnabled && (weeklyActiveUsers ?? Number.POSITIVE_INFINITY) > 5);
+
   // Don't show on auth routes or if neither banner type should show
-  if (onAuthRoute || (!friendlyVisible && !shouldEvaluateUrgent)) {
+  // Also suppress entirely for no-login servers (treat them as regular users only)
+  // and, per request, never surface upgrade messaging there when WAU > 5.
+  if (
+    onAuthRoute ||
+    suppressForNoLogin ||
+    (!friendlyVisible && !shouldEvaluateUrgent)
+  ) {
     return null;
   }
 

frontend/src/proprietary/components/shared/config/configNavSections.tsx

@@ -16,6 +16,8 @@ import AdminEndpointsSection from '@app/components/shared/config/configSections/
 import AdminAuditSection from '@app/components/shared/config/configSections/AdminAuditSection';
 import AdminUsageSection from '@app/components/shared/config/configSections/AdminUsageSection';
 import ApiKeys from '@app/components/shared/config/configSections/ApiKeys';
+import AccountSection from '@app/components/shared/config/configSections/AccountSection';
+import GeneralSection from '@app/components/shared/config/configSections/GeneralSection';
 
 /**
  * Hook version of proprietary config nav sections with proper i18n support
@@ -30,6 +32,23 @@ export const useConfigNavSections = (
   // Get the core sections (just Preferences)
   const sections = useCoreConfigNavSections(isAdmin, runningEE, loginEnabled);
 
+  // Add account management under Preferences
+  const preferencesSection = sections.find((section) => section.items.some((item) => item.key === 'general'));
+  if (preferencesSection) {
+    preferencesSection.items = preferencesSection.items.map((item) =>
+      item.key === 'general' ? { ...item, component: <GeneralSection /> } : item
+    );
+
+    if (loginEnabled) {
+      preferencesSection.items.push({
+        key: 'account',
+        label: t('account.accountSettings', 'Account'),
+        icon: 'person-rounded',
+        component: <AccountSection />
+      });
+    }
+  }
+
   // Add Admin sections if user is admin OR if login is disabled (but mark as disabled)
   if (isAdmin || !loginEnabled) {
     const requiresLogin = !loginEnabled;
@@ -220,6 +239,23 @@ export const createConfigNavSections = (
   // Get the core sections (just Preferences)
   const sections = createCoreConfigNavSections(isAdmin, runningEE, loginEnabled);
 
+  // Add account management under Preferences
+  const preferencesSection = sections.find((section) => section.items.some((item) => item.key === 'general'));
+  if (preferencesSection) {
+    preferencesSection.items = preferencesSection.items.map((item) =>
+      item.key === 'general' ? { ...item, component: <GeneralSection /> } : item
+    );
+
+    if (loginEnabled) {
+      preferencesSection.items.push({
+        key: 'account',
+        label: 'Account',
+        icon: 'person-rounded',
+        component: <AccountSection />
+      });
+    }
+  }
+
   // Add Admin sections if user is admin OR if login is disabled (but mark as disabled)
   if (isAdmin || !loginEnabled) {
     const requiresLogin = !loginEnabled;

frontend/src/proprietary/components/shared/config/configSections/AccountSection.tsx

@@ -0,0 +1,293 @@
+import React, { useCallback, useMemo, useState } from 'react';
+import { Alert, Button, Group, Modal, Paper, PasswordInput, Stack, Text, TextInput } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import LocalIcon from '@app/components/shared/LocalIcon';
+import { alert as showToast } from '@app/components/toast';
+import { useAuth } from '@app/auth/UseSession';
+import { accountService } from '@app/services/accountService';
+import { Z_INDEX_OVER_CONFIG_MODAL } from '@app/styles/zIndex';
+
+const AccountSection: React.FC = () => {
+  const { t } = useTranslation();
+  const { user, signOut } = useAuth();
+  const [passwordModalOpen, setPasswordModalOpen] = useState(false);
+  const [usernameModalOpen, setUsernameModalOpen] = useState(false);
+
+  const [currentPassword, setCurrentPassword] = useState('');
+  const [newPassword, setNewPassword] = useState('');
+  const [confirmPassword, setConfirmPassword] = useState('');
+  const [passwordError, setPasswordError] = useState('');
+  const [passwordSubmitting, setPasswordSubmitting] = useState(false);
+
+  const [currentPasswordForUsername, setCurrentPasswordForUsername] = useState('');
+  const [newUsername, setNewUsername] = useState('');
+  const [usernameError, setUsernameError] = useState('');
+  const [usernameSubmitting, setUsernameSubmitting] = useState(false);
+
+  const authTypeFromMetadata = useMemo(() => {
+    const metadata = user?.app_metadata as { authType?: string; authenticationType?: string } | undefined;
+    return metadata?.authenticationType ?? metadata?.authType;
+  }, [user?.app_metadata]);
+
+  const normalizedAuthType = useMemo(
+    () => (user?.authenticationType ?? authTypeFromMetadata ?? '').toLowerCase(),
+    [authTypeFromMetadata, user?.authenticationType]
+  );
+  const isSsoUser = useMemo(() => ['sso', 'oauth2', 'saml2'].includes(normalizedAuthType), [normalizedAuthType]);
+
+  const userIdentifier = useMemo(() => user?.email || user?.username || '', [user?.email, user?.username]);
+
+  const redirectToLogin = useCallback(() => {
+    window.location.assign('/login');
+  }, []);
+
+  const handleLogout = useCallback(async () => {
+    try {
+      await signOut();
+    } finally {
+      redirectToLogin();
+    }
+  }, [redirectToLogin, signOut]);
+
+  const handlePasswordSubmit = async (event: React.FormEvent) => {
+    event.preventDefault();
+
+    if (isSsoUser) {
+      setPasswordError(t('settings.security.password.ssoDisabled', 'Password changes are managed by your identity provider.'));
+      return;
+    }
+
+    if (!currentPassword || !newPassword || !confirmPassword) {
+      setPasswordError(t('settings.security.password.required', 'All fields are required.'));
+      return;
+    }
+
+    if (newPassword !== confirmPassword) {
+      setPasswordError(t('settings.security.password.mismatch', 'New passwords do not match.'));
+      return;
+    }
+
+    try {
+      setPasswordSubmitting(true);
+      setPasswordError('');
+
+      await accountService.changePassword(currentPassword, newPassword);
+
+      showToast({
+        alertType: 'success',
+        title: t('settings.security.password.success', 'Password updated successfully. Please sign in again.'),
+      });
+
+      setCurrentPassword('');
+      setNewPassword('');
+      setConfirmPassword('');
+      setPasswordModalOpen(false);
+      await handleLogout();
+    } catch (err) {
+      const axiosError = err as { response?: { data?: { message?: string } } };
+      setPasswordError(
+        axiosError.response?.data?.message ||
+          t('settings.security.password.error', 'Unable to update password. Please verify your current password and try again.')
+      );
+    } finally {
+      setPasswordSubmitting(false);
+    }
+  };
+
+  const handleUsernameSubmit = async (event: React.FormEvent) => {
+    event.preventDefault();
+
+    if (isSsoUser) {
+      setUsernameError(t('changeCreds.ssoManaged', 'Your account is managed by your identity provider.'));
+      return;
+    }
+
+    if (!currentPasswordForUsername || !newUsername) {
+      setUsernameError(t('settings.security.password.required', 'All fields are required.'));
+      return;
+    }
+
+    try {
+      setUsernameSubmitting(true);
+      setUsernameError('');
+
+      await accountService.changeUsername(newUsername, currentPasswordForUsername);
+
+      showToast({
+        alertType: 'success',
+        title: t('changeCreds.credsUpdated', 'Account updated'),
+        body: t('changeCreds.description', 'Changes saved. Please log in again.'),
+      });
+
+      setNewUsername('');
+      setCurrentPasswordForUsername('');
+      setUsernameModalOpen(false);
+      await handleLogout();
+    } catch (err) {
+      const axiosError = err as { response?: { data?: { message?: string } } };
+      setUsernameError(
+        axiosError.response?.data?.message ||
+          t('changeCreds.error', 'Unable to update username. Please verify your password and try again.')
+      );
+    } finally {
+      setUsernameSubmitting(false);
+    }
+  };
+
+  return (
+    <Stack gap="md">
+      <div>
+        <Text fw={600} size="lg">
+          {t('account.accountSettings', 'Account')}
+        </Text>
+        <Text size="sm" c="dimmed">
+          {t('changeCreds.header', 'Update Your Account Details')}
+        </Text>
+      </div>
+
+      <Paper withBorder p="md" radius="md">
+        <Stack gap="sm">
+          <Text size="sm" c="dimmed">
+            {userIdentifier
+              ? t('settings.general.user', 'User') + ': ' + userIdentifier
+              : t('account.accountSettings', 'Account Settings')}
+          </Text>
+
+          <Stack gap="xs">
+            {isSsoUser && (
+              <Alert icon={<LocalIcon icon="info" width="1rem" height="1rem" />} color="blue" variant="light">
+                {t('changeCreds.ssoManaged', 'Your account is managed by your identity provider.')}
+              </Alert>
+            )}
+
+            <Group gap="sm" wrap="wrap">
+              {!isSsoUser && (
+                <Button leftSection={<LocalIcon icon="key-rounded" />} onClick={() => setPasswordModalOpen(true)}>
+                  {t('settings.security.password.update', 'Update password')}
+                </Button>
+              )}
+
+              {!isSsoUser && (
+                <Button
+                  variant="light"
+                  leftSection={<LocalIcon icon="edit-rounded" />}
+                  onClick={() => setUsernameModalOpen(true)}
+                >
+                  {t('account.changeUsername', 'Change username')}
+                </Button>
+              )}
+
+              <Button variant="outline" color="red" leftSection={<LocalIcon icon="logout-rounded" />} onClick={handleLogout}>
+                {t('settings.general.logout', 'Log out')}
+              </Button>
+            </Group>
+          </Stack>
+        </Stack>
+      </Paper>
+
+      <Modal
+        opened={passwordModalOpen}
+        onClose={() => setPasswordModalOpen(false)}
+        title={t('settings.security.title', 'Change password')}
+        withinPortal
+        zIndex={Z_INDEX_OVER_CONFIG_MODAL}
+      >
+        <form onSubmit={handlePasswordSubmit}>
+          <Stack gap="md">
+            <Text size="sm" c="dimmed">
+              {t('settings.security.password.subtitle', 'Change your password. You will be logged out after updating.')}
+            </Text>
+
+            {passwordError && (
+              <Alert icon={<LocalIcon icon="error-rounded" width="1rem" height="1rem" />} color="red" variant="light">
+                {passwordError}
+              </Alert>
+            )}
+
+            <PasswordInput
+              label={t('settings.security.password.current', 'Current password')}
+              placeholder={t('settings.security.password.currentPlaceholder', 'Enter your current password')}
+              value={currentPassword}
+              onChange={(event) => setCurrentPassword(event.currentTarget.value)}
+              required
+            />
+
+            <PasswordInput
+              label={t('settings.security.password.new', 'New password')}
+              placeholder={t('settings.security.password.newPlaceholder', 'Enter a new password')}
+              value={newPassword}
+              onChange={(event) => setNewPassword(event.currentTarget.value)}
+              required
+            />
+
+            <PasswordInput
+              label={t('settings.security.password.confirm', 'Confirm new password')}
+              placeholder={t('settings.security.password.confirmPlaceholder', 'Re-enter your new password')}
+              value={confirmPassword}
+              onChange={(event) => setConfirmPassword(event.currentTarget.value)}
+              required
+            />
+
+            <Group justify="flex-end" gap="sm">
+              <Button variant="default" onClick={() => setPasswordModalOpen(false)}>
+                {t('common.cancel', 'Cancel')}
+              </Button>
+              <Button type="submit" loading={passwordSubmitting} leftSection={<LocalIcon icon="save-rounded" />}>
+                {t('settings.security.password.update', 'Update password')}
+              </Button>
+            </Group>
+          </Stack>
+        </form>
+      </Modal>
+
+      <Modal
+        opened={usernameModalOpen}
+        onClose={() => setUsernameModalOpen(false)}
+        title={t('account.changeUsername', 'Change username')}
+        withinPortal
+        zIndex={Z_INDEX_OVER_CONFIG_MODAL}
+      >
+        <form onSubmit={handleUsernameSubmit}>
+          <Stack gap="md">
+            <Text size="sm" c="dimmed">
+              {t('changeCreds.changeUsername', 'Update your username. You will be logged out after updating.')}
+            </Text>
+
+            {usernameError && (
+              <Alert icon={<LocalIcon icon="error-rounded" width="1rem" height="1rem" />} color="red" variant="light">
+                {usernameError}
+              </Alert>
+            )}
+
+            <TextInput
+              label={t('changeCreds.newUsername', 'New Username')}
+              placeholder={t('changeCreds.newUsername', 'New Username')}
+              value={newUsername}
+              onChange={(event) => setNewUsername(event.currentTarget.value)}
+              required
+            />
+
+            <PasswordInput
+              label={t('changeCreds.oldPassword', 'Current Password')}
+              placeholder={t('changeCreds.oldPassword', 'Current Password')}
+              value={currentPasswordForUsername}
+              onChange={(event) => setCurrentPasswordForUsername(event.currentTarget.value)}
+              required
+            />
+
+            <Group justify="flex-end" gap="sm">
+              <Button variant="default" onClick={() => setUsernameModalOpen(false)}>
+                {t('common.cancel', 'Cancel')}
+              </Button>
+              <Button type="submit" loading={usernameSubmitting} leftSection={<LocalIcon icon="save-rounded" />}>
+                {t('common.save', 'Save')}
+              </Button>
+            </Group>
+          </Stack>
+        </form>
+      </Modal>
+    </Stack>
+  );
+};
+
+export default AccountSection;

frontend/src/proprietary/components/shared/config/configSections/AdminAuditSection.tsx

@@ -23,8 +23,14 @@ const AdminAuditSection: React.FC = () => {
         setError(null);
         const status = await auditService.getSystemStatus();
         setSystemStatus(status);
-      } catch (err) {
-        setError(err instanceof Error ? err.message : 'Failed to load audit system status');
+      } catch (err: any) {
+        // Check if this is a permission/license error (403/404)
+        const status = err?.response?.status;
+        if (status === 403 || status === 404) {
+          setError('enterprise-license-required');
+        } else {
+          setError(err instanceof Error ? err.message : 'Failed to load audit system status');
+        }
       } finally {
         setLoading(false);
       }
@@ -56,6 +62,16 @@ const AdminAuditSection: React.FC = () => {
   }
 
   if (error) {
+    if (error === 'enterprise-license-required') {
+      return (
+        <Alert color="blue" title={t('audit.enterpriseRequired', 'Enterprise License Required')}>
+          {t(
+            'audit.enterpriseRequiredMessage',
+            'The audit logging system is an enterprise feature. Please upgrade to an enterprise license to access audit logs and analytics.'
+          )}
+        </Alert>
+      );
+    }
     return (
       <Alert color="red" title={t('audit.error.title', 'Error loading audit system')}>
         {error}

frontend/src/proprietary/components/shared/config/configSections/GeneralSection.tsx

@@ -1,53 +0,0 @@
-import React from 'react';
-import { Stack, Text, Button } from '@mantine/core';
-import { useTranslation } from 'react-i18next';
-import { useAuth } from '@app/auth/UseSession';
-import { useNavigate } from 'react-router-dom';
-import CoreGeneralSection from '@core/components/shared/config/configSections/GeneralSection';
-
-/**
- * Proprietary extension of GeneralSection that adds account management
- */
-const GeneralSection: React.FC = () => {
-  const { t } = useTranslation();
-  const { signOut, user } = useAuth();
-  const navigate = useNavigate();
-
-  const handleLogout = async () => {
-    try {
-      await signOut();
-      navigate('/login');
-    } catch (error) {
-      console.error('Logout error:', error);
-    }
-  };
-
-  return (
-    <Stack gap="lg">
-      <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start' }}>
-        <div>
-          <Text fw={600} size="lg">{t('settings.general.title', 'General')}</Text>
-          <Text size="sm" c="dimmed">
-            {t('settings.general.description', 'Configure general application preferences.')}
-          </Text>
-        </div>
-
-        {user && (
-          <Stack gap="xs" align="flex-end">
-            <Text size="sm" c="dimmed">
-              {t('settings.general.user', 'User')}: <strong>{user.email || user.username}</strong>
-            </Text>
-            <Button color="red" variant="outline" size="xs" onClick={handleLogout}>
-              {t('settings.general.logout', 'Log out')}
-            </Button>
-          </Stack>
-        )}
-      </div>
-
-      {/* Render core general section preferences (without title since we show it above) */}
-      <CoreGeneralSection hideTitle />
-    </Stack>
-  );
-};
-
-export default GeneralSection;

frontend/src/proprietary/routes/Login.test.tsx

@@ -295,9 +295,9 @@ describe('Login', () => {
     await user.click(oauthButton);
 
     await waitFor(() => {
-      // Should use 'authentik' directly, NOT map to 'oidc'
+      // Should use full path directly, NOT map to 'oidc'
       expect(springAuth.signInWithOAuth).toHaveBeenCalledWith({
-        provider: 'authentik',
+        provider: '/oauth2/authorization/authentik',
         options: { redirectTo: '/auth/callback' }
       });
     });
@@ -338,10 +338,10 @@ describe('Login', () => {
     await user.click(oauthButton);
 
     await waitFor(() => {
-      // Should use 'mycompany' directly - this is the critical fix
+      // Should use full path directly - this is the critical fix
       // Previously it would map unknown providers to 'oidc'
       expect(springAuth.signInWithOAuth).toHaveBeenCalledWith({
-        provider: 'mycompany',
+        provider: '/oauth2/authorization/mycompany',
         options: { redirectTo: '/auth/callback' }
       });
     });
@@ -382,9 +382,9 @@ describe('Login', () => {
     await user.click(oauthButton);
 
     await waitFor(() => {
-      // Should use 'oidc' when explicitly configured
+      // Should use full path when explicitly configured
       expect(springAuth.signInWithOAuth).toHaveBeenCalledWith({
-        provider: 'oidc',
+        provider: '/oauth2/authorization/oidc',
         options: { redirectTo: '/auth/callback' }
       });
     });

frontend/src/proprietary/routes/Login.tsx

@@ -109,13 +109,12 @@ export default function Login() {
           updateSupportedLanguages(data.languages, data.defaultLocale);
         }
 
-        // Extract provider IDs from the providerList map
-        // The keys are like "/oauth2/authorization/google" - extract the last part
-        const providerIds = Object.keys(data.providerList || {})
-          .map(key => key.split('/').pop())
-          .filter((id): id is string => id !== undefined);
+        // Use the full paths from providerList as provider identifiers
+        // The backend provides paths like "/oauth2/authorization/google" or "/saml2/authenticate/stirling"
+        // We'll use these full paths so the auth client knows where to redirect
+        const providerPaths = Object.keys(data.providerList || {});
 
-        setEnabledProviders(providerIds);
+        setEnabledProviders(providerPaths);
       } catch (err) {
         console.error('[Login] Failed to fetch enabled providers:', err);
       }

frontend/src/proprietary/routes/login/OAuthButtons.tsx

@@ -26,7 +26,7 @@ interface OAuthButtonsProps {
   onProviderClick: (provider: OAuthProvider) => void
   isSubmitting: boolean
   layout?: 'vertical' | 'grid' | 'icons'
-  enabledProviders?: OAuthProvider[]  // List of enabled provider IDs from backend
+  enabledProviders?: OAuthProvider[]  // List of full auth paths from backend (e.g., '/oauth2/authorization/google', '/saml2/authenticate/stirling')
 }
 
 export default function OAuthButtons({ onProviderClick, isSubmitting, layout = 'vertical', enabledProviders = [] }: OAuthButtonsProps) {
@@ -37,19 +37,24 @@ export default function OAuthButtons({ onProviderClick, isSubmitting, layout = '
     ? Object.keys(oauthProviderConfig)
     : enabledProviders;
 
-  // Build provider list - use provider ID to determine icon and label
-  const providers = providersToShow.map(id => {
-    if (id in oauthProviderConfig) {
+  // Build provider list - extract provider ID from full path for display
+  const providers = providersToShow.map(pathOrId => {
+    // Extract provider ID from full path (e.g., '/saml2/authenticate/stirling' -> 'stirling')
+    const providerId = pathOrId.split('/').pop() || pathOrId;
+
+    if (providerId in oauthProviderConfig) {
       // Known provider - use predefined icon and label
       return {
-        id,
-        ...oauthProviderConfig[id]
+        id: pathOrId,  // Keep full path for redirect
+        providerId,    // Store extracted ID for display lookup
+        ...oauthProviderConfig[providerId]
       };
     }
     // Unknown provider - use generic icon and capitalize ID for label
     return {
-      id,
-      label: id.charAt(0).toUpperCase() + id.slice(1),
+      id: pathOrId,  // Keep full path for redirect
+      providerId,    // Store extracted ID for display lookup
+      label: providerId.charAt(0).toUpperCase() + providerId.slice(1),
       file: GENERIC_PROVIDER_ICON
     };
   });

frontend/src/proprietary/testing/serverExperienceSimulations.ts

@@ -48,9 +48,10 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: '2.0.0',
+  appVersion: '2.1.3',
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
+  enableDesktopInstallSlide: true,
   serverPort: 8080,
   premiumEnabled: false,
   runningProOrHigher: false,

frontend/vite.config.ts

@@ -55,12 +55,24 @@ export default defineConfig(({ mode }) => {
           secure: false,
           xfwd: true,
         },
+        '/saml2': {
+          target: 'http://localhost:8080',
+          changeOrigin: true,
+          secure: false,
+          xfwd: true,
+        },
         '/login/oauth2': {
           target: 'http://localhost:8080',
           changeOrigin: true,
           secure: false,
           xfwd: true,
         },
+        '/login/saml2': {
+          target: 'http://localhost:8080',
+          changeOrigin: true,
+          secure: false,
+          xfwd: true,
+        },
         '/swagger-ui': {
           target: 'http://localhost:8080',
           changeOrigin: true,