extra validations

address comments list[]
remove logs
2025-11-21 12:59:30 +00:00 · 2025-11-21 12:57:35 +00:00 · 2025-11-21 11:55:25 +00:00 · 2025-11-21 11:49:35 +00:00 · 2025-11-21 11:03:52 +00:00 · 2025-11-21 10:48:01 +00:00
121 changed files with 9820 additions and 491 deletions
@@ -14,7 +14,7 @@ on:
          - macos
          - linux
  pull_request:
-    branches: [main, V2]
+    branches: [main, V2, V2-tauri-windows]
    paths:
      - 'frontend/src-tauri/**'
      - 'frontend/src/desktop/**'
@@ -61,6 +61,9 @@ jobs:
      fail-fast: false
      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
@@ -174,6 +177,84 @@ jobs:
        working-directory: ./frontend
        run: npm install

+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
      - name: Import Apple Developer Certificate
        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        env:
@@ -229,13 +310,174 @@ jobs:
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          SIGN: 1
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          SIGN: ${{ (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # List available certificates and check if they have certificates attached
+          Write-Host "Checking for available certificates..."
+          $certList = & smctl keypair ls 2>&1
+          Write-Host "Keypair list output:"
+          Write-Host $certList
+          Write-Host ""
+
+          # Parse the output to check certificate status
+          $lines = $certList -split "`n"
+          $foundKeypair = $false
+          $hasCertificate = $false
+
+          foreach ($line in $lines) {
+            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
+              $foundKeypair = $true
+              Write-Host "[SUCCESS] Found keypair in list"
+
+              # Check if this line has certificate info (not just empty spaces after alias)
+              $parts = $line -split "\s+"
+              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
+                $hasCertificate = $true
+                Write-Host "[SUCCESS] Certificate is associated with keypair"
+              }
+            }
+          }
+
+          if (-not $foundKeypair) {
+            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
+            Write-Host "Available keypairs are listed above"
+            Write-Host ""
+            Write-Host "Please verify:"
+            Write-Host "  1. Keypair alias is correct in GitHub secret"
+            Write-Host "  2. API key has access to this keypair"
+            exit 1
+          }
+
+          if (-not $hasCertificate) {
+            Write-Host "[ERROR] No certificate associated with keypair"
+            Write-Host "This usually means:"
+            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
+            Write-Host "  2. Certificate is pending approval"
+            Write-Host "  3. Certificate needs to be attached to the keypair"
+            Write-Host ""
+            Write-Host "Try running in DigiCert ONE portal:"
+            Write-Host "  smctl keypair sync"
+            exit 1
+          }
+
+          Write-Host "[SUCCESS] Certificate check passed"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              Write-Host ""
+              Write-Host "Possible issues:"
+              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
+              Write-Host "  2. Incorrect keypair alias"
+              Write-Host "  3. API key lacks signing permissions"
+              Write-Host ""
+              Write-Host "Please verify in DigiCert ONE portal:"
+              Write-Host "  - Certificate status is 'Issued' (not Pending)"
+              Write-Host "  - Keypair status is 'Online'"
+              Write-Host "  - 'Can sign' is set to 'Yes'"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
      - name: Verify notarization (macOS only)
        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        run: |
@@ -269,6 +511,66 @@ jobs:
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

+      - name: Verify Windows Code Signature
+        if: matrix.platform == 'windows-latest'
+        shell: pwsh
+        run: |
+          Write-Host "Verifying Windows code signatures..."
+
+          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
+          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
+
+          $allSigned = $true
+          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
+          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
+
+          # Check EXE signature
+          if (Test-Path $exePath) {
+            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
+            Write-Host "EXE Signature Status: $($exeSig.Status)"
+            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
+            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
+
+            if ($exeSig.Status -ne "Valid") {
+              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] EXE is properly signed"
+            }
+          }
+
+          # Check MSI signature
+          if (Test-Path $msiPath) {
+            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI Signature Status: $($msiSig.Status)"
+            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
+            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+
+            if ($msiSig.Status -ne "Valid") {
+              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] MSI is properly signed"
+            }
+          }
+
+          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
+            Write-Host "[ERROR] Code signing verification failed"
+            exit 1
+          } else {
+            Write-Host "[SUCCESS] Code signature verification completed"
+          }
+
      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
@@ -0,0 +1,258 @@
+# Windows Code Signing Setup Guide
+
+This guide explains how to set up Windows code signing for Stirling-PDF desktop application builds.
+
+## Overview
+
+Windows code signing is essential for:
+- Preventing Windows SmartScreen warnings
+- Building trust with users
+- Enabling Microsoft Store distribution
+- Professional application distribution
+
+## Certificate Types
+
+### OV Certificate (Organization Validated)
+- More affordable option
+- Requires business verification
+- May trigger SmartScreen warnings initially until reputation builds
+- Suitable for most independent software vendors
+
+### EV Certificate (Extended Validation)
+- Premium option with immediate SmartScreen reputation
+- Requires hardware security module (HSM) or cloud-based signing
+- Higher cost but provides immediate trust
+- Required since June 2023 for new certificates
+
+## Obtaining a Certificate
+
+### Certificate Authorities
+Popular certificate authorities for Windows code signing:
+- DigiCert
+- Sectigo (formerly Comodo)
+- GlobalSign
+- SSL.com
+
+### Certificate Format
+You'll receive a certificate in one of these formats:
+- `.pfx` or `.p12` (preferred - contains both certificate and private key)
+- `.cer` + private key (needs conversion to .pfx)
+
+### Converting to PFX (if needed)
+If you have separate certificate and private key files:
+
+```bash
+openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cer
+```
+
+## Setting Up GitHub Secrets
+
+### Required Secrets
+
+Navigate to your GitHub repository → Settings → Secrets and variables → Actions
+
+Add the following secrets:
+
+#### 1. `WINDOWS_CERTIFICATE`
+- **Description**: Base64-encoded .pfx certificate file
+- **How to create**:
+
+**On macOS/Linux:**
+```bash
+base64 -i certificate.pfx | pbcopy  # Copies to clipboard
+```
+
+**On Windows (PowerShell):**
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
+```
+
+Paste the entire base64 string into the GitHub secret.
+
+#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
+- **Description**: Password for the .pfx certificate
+- **Value**: The password you set when creating/exporting the .pfx file
+
+### Optional Secrets for Tauri Updater
+
+If you're using Tauri's built-in updater feature:
+
+#### `TAURI_SIGNING_PRIVATE_KEY`
+- Generated using Tauri CLI: `npm run tauri signer generate`
+- Used for update package verification
+
+#### `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
+- Password for the Tauri signing key
+
+## Configuration Files
+
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
+
+The Windows signing configuration is already set up:
+
+```json
+"windows": {
+  "certificateThumbprint": null,
+  "digestAlgorithm": "sha256",
+  "timestampUrl": "http://timestamp.digicert.com"
+}
+```
+
+**Configuration Options:**
+- `certificateThumbprint`: Automatically extracted from imported certificate (leave as `null`)
+- `digestAlgorithm`: Hashing algorithm - `sha256` is recommended
+- `timestampUrl`: Timestamp server to prove signing time (survives certificate expiration)
+
+**Alternative Timestamp Servers:**
+- DigiCert: `http://timestamp.digicert.com`
+- Sectigo: `http://timestamp.sectigo.com`
+- GlobalSign: `http://timestamp.globalsign.com`
+
+### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
+
+The workflow includes three Windows signing steps:
+
+1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
+2. **Build Tauri App**: Builds and signs the application using the imported certificate
+3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
+
+## Testing the Setup
+
+### 1. Local Testing (Windows Only)
+
+Before pushing to GitHub, test locally:
+
+```powershell
+# Set environment variables
+$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
+$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
+
+# Build the application
+cd frontend
+npm run tauri build
+
+# Verify the signature
+Get-AuthenticodeSignature "./src-tauri/target/release/bundle/msi/Stirling-PDF_*.msi"
+```
+
+### 2. GitHub Actions Testing
+
+1. Push your changes to a branch
+2. Manually trigger the workflow:
+   - Go to Actions → Build Tauri Applications
+   - Click "Run workflow"
+   - Select "windows" platform
+3. Check the build logs for:
+   - ✅ Certificate import success
+   - ✅ Build completion
+   - ✅ Signature verification
+
+### 3. Verifying Signed Binaries
+
+After downloading the built artifacts:
+
+**Windows (PowerShell):**
+```powershell
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.exe"
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.msi"
+```
+
+Look for:
+- Status: `Valid`
+- Signer: Your organization name
+- Timestamp: Recent date/time
+
+**Windows (GUI):**
+1. Right-click the .exe or .msi file
+2. Select "Properties"
+3. Go to "Digital Signatures" tab
+4. Verify signature details
+
+## Troubleshooting
+
+### "HashMismatch" Status
+- Certificate doesn't match the binary
+- Possible file corruption during download
+- Re-download and verify
+
+### "NotSigned" Status
+- Certificate wasn't imported correctly
+- Check GitHub secrets are set correctly
+- Verify base64 encoding is complete (no truncation)
+
+### "UnknownError" Status
+- Timestamp server unreachable
+- Try alternative timestamp URL in tauri.conf.json
+- Check network connectivity in GitHub Actions
+
+### SmartScreen Still Shows Warnings
+- Normal for OV certificates initially
+- Reputation builds over time with user downloads
+- Consider EV certificate for immediate reputation
+
+### Certificate Not Found During Build
+- Verify `WINDOWS_CERTIFICATE` secret is set
+- Check base64 encoding is correct (no extra whitespace)
+- Ensure password is correct
+
+## Security Best Practices
+
+1. **Never commit certificates to version control**
+   - Keep .pfx files secure and backed up
+   - Use GitHub secrets for CI/CD
+
+2. **Rotate certificates before expiration**
+   - Set calendar reminders
+   - Update GitHub secrets with new certificate
+
+3. **Use strong passwords**
+   - Certificate password should be complex
+   - Store securely (password manager)
+
+4. **Monitor certificate usage**
+   - Review GitHub Actions logs
+   - Set up notifications for failed builds
+
+5. **Limit access to secrets**
+   - Only repository admins should access secrets
+   - Audit secret access regularly
+
+## Certificate Lifecycle
+
+### Before Expiration
+1. Obtain new certificate from CA (typically annual renewal)
+2. Convert to .pfx format if needed
+3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
+4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
+5. Test build to verify new certificate works
+
+### Expired Certificates
+- Signed binaries remain valid (timestamp proves signing time)
+- New builds will fail until certificate is renewed
+- Users can still install previously signed versions
+
+## Cost Considerations
+
+### Certificate Costs (Annual, as of 2024)
+- **OV Certificate**: $100-400/year
+- **EV Certificate**: $400-1000/year
+
+### Choosing the Right Certificate
+- **Open source / early stage**: Start with OV
+- **Commercial / enterprise**: Consider EV for better trust
+- **Microsoft Store**: EV certificate required
+
+## Additional Resources
+
+- [Tauri Windows Signing Documentation](https://v2.tauri.app/distribute/sign/windows/)
+- [Microsoft Code Signing Overview](https://docs.microsoft.com/windows/win32/seccrypto/cryptography-tools)
+- [DigiCert Code Signing Guide](https://www.digicert.com/signing/code-signing-certificates)
+- [Windows SmartScreen FAQ](https://support.microsoft.com/windows/smartscreen-faq)
+
+## Support
+
+If you encounter issues with Windows code signing:
+1. Check GitHub Actions logs for detailed error messages
+2. Verify all secrets are set correctly
+3. Test certificate locally first (Windows environment required)
+4. Open an issue in the repository with relevant logs (remove sensitive data)
@@ -38,6 +38,7 @@ public class GeneralUtils {
            Set.of(
                    "OCR images.json",
                    "Prepare-pdfs-for-email.json",
+                    "Pre-publish-sanitization.json",
                    "split-rotate-auto-rename.json");

    private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";
@@ -12,6 +12,8 @@ import java.util.Properties;

 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;

@@ -198,6 +200,14 @@ public class SPDFApplication {
        // }
    }

+    @EventListener
+    public void onWebServerInitialized(WebServerInitializedEvent event) {
+        int actualPort = event.getWebServer().getPort();
+        serverPortStatic = String.valueOf(actualPort);
+        // Log the actual runtime port for Tauri to parse
+        log.info("Stirling-PDF running on port: {}", actualPort);
+    }
+
    private static void printStartupLogs() {
        log.info("Stirling-PDF Started.");
        String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;
@@ -18,11 +18,37 @@ import stirling.software.common.model.ApplicationProperties;
@Slf4j
 public class EndpointConfiguration {

+    public enum DisableReason {
+        CONFIG,
+        DEPENDENCY,
+        UNKNOWN
+    }
+
+    public static class EndpointAvailability {
+        private final boolean enabled;
+        private final DisableReason reason;
+
+        public EndpointAvailability(boolean enabled, DisableReason reason) {
+            this.enabled = enabled;
+            this.reason = reason;
+        }
+
+        public boolean isEnabled() {
+            return enabled;
+        }
+
+        public DisableReason getReason() {
+            return reason;
+        }
+    }
+
    private static final String REMOVE_BLANKS = "remove-blanks";
    private final ApplicationProperties applicationProperties;
    @Getter private Map<String, Boolean> endpointStatuses = new ConcurrentHashMap<>();
    private Map<String, Set<String>> endpointGroups = new ConcurrentHashMap<>();
    private Set<String> disabledGroups = new HashSet<>();
+    private Map<String, DisableReason> endpointDisableReasons = new ConcurrentHashMap<>();
+    private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
    private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
    private final boolean runningProOrHigher;

@@ -35,16 +61,31 @@ public class EndpointConfiguration {
        processEnvironmentConfigs();
    }

+    private String normalizeEndpoint(String endpoint) {
+        if (endpoint == null) {
+            return null;
+        }
+        return endpoint.startsWith("/") ? endpoint.substring(1) : endpoint;
+    }
+
    public void enableEndpoint(String endpoint) {
-        endpointStatuses.put(endpoint, true);
-        log.debug("Enabled endpoint: {}", endpoint);
+        String normalized = normalizeEndpoint(endpoint);
+        endpointStatuses.put(normalized, true);
+        endpointDisableReasons.remove(normalized);
+        log.debug("Enabled endpoint: {}", normalized);
    }

    public void disableEndpoint(String endpoint) {
-        if (!Boolean.FALSE.equals(endpointStatuses.get(endpoint))) {
-            log.debug("Disabling endpoint: {}", endpoint);
+        disableEndpoint(endpoint, DisableReason.CONFIG);
+    }
+
+    public void disableEndpoint(String endpoint, DisableReason reason) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (!Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            log.debug("Disabling endpoint: {}", normalized);
        }
-        endpointStatuses.put(endpoint, false);
+        endpointStatuses.put(normalized, false);
+        endpointDisableReasons.put(normalized, reason);
    }

    public boolean isEndpointEnabled(String endpoint) {
@@ -150,6 +191,10 @@ public class EndpointConfiguration {
    }

    public void disableGroup(String group) {
+        disableGroup(group, DisableReason.CONFIG);
+    }
+
+    public void disableGroup(String group, DisableReason reason) {
        if (disabledGroups.add(group)) {
            if (isToolGroup(group)) {
                log.debug(
@@ -161,11 +206,12 @@ public class EndpointConfiguration {
                        group);
            }
        }
+        groupDisableReasons.put(group, reason);
        // Only cascade to endpoints for *functional* groups
        if (!isToolGroup(group)) {
            Set<String> endpoints = endpointGroups.get(group);
            if (endpoints != null) {
-                endpoints.forEach(this::disableEndpoint);
+                endpoints.forEach(endpoint -> disableEndpoint(endpoint, reason));
            }
        }
    }
@@ -174,12 +220,39 @@ public class EndpointConfiguration {
        if (disabledGroups.remove(group)) {
            log.debug("Enabling group: {}", group);
        }
+        groupDisableReasons.remove(group);
        Set<String> endpoints = endpointGroups.get(group);
        if (endpoints != null) {
            endpoints.forEach(this::enableEndpoint);
        }
    }

+    public EndpointAvailability getEndpointAvailability(String endpoint) {
+        boolean enabled = isEndpointEnabled(endpoint);
+        DisableReason reason = enabled ? null : determineDisableReason(endpoint);
+        return new EndpointAvailability(enabled, reason);
+    }
+
+    private DisableReason determineDisableReason(String endpoint) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            return endpointDisableReasons.getOrDefault(normalized, DisableReason.CONFIG);
+        }
+
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            Set<String> endpoints = entry.getValue();
+            if (!disabledGroups.contains(group) || endpoints == null) {
+                continue;
+            }
+            if (endpoints.contains(normalized)) {
+                return groupDisableReasons.getOrDefault(group, DisableReason.CONFIG);
+            }
+        }
+
+        return DisableReason.UNKNOWN;
+    }
+
    public Set<String> getDisabledGroups() {
        return new HashSet<>(disabledGroups);
    }
@@ -261,6 +334,8 @@ public class EndpointConfiguration {
        addEndpointToGroup("Convert", "pdf-to-csv");
        addEndpointToGroup("Convert", "pdf-to-markdown");
        addEndpointToGroup("Convert", "eml-to-pdf");
+        addEndpointToGroup("Convert", "cbz-to-pdf");
+        addEndpointToGroup("Convert", "pdf-to-cbz");

        // Adding endpoints to "Security" group
        addEndpointToGroup("Security", "add-password");
@@ -394,6 +469,8 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "pdf-to-markdown");
        addEndpointToGroup("Java", "add-attachments");
        addEndpointToGroup("Java", "compress-pdf");
+        addEndpointToGroup("Java", "cbz-to-pdf");
+        addEndpointToGroup("Java", "pdf-to-cbz");
        addEndpointToGroup("rar", "pdf-to-cbr");

        // Javascript
@@ -12,6 +12,7 @@ import jakarta.annotation.PostConstruct;

 import lombok.extern.slf4j.Slf4j;

+import stirling.software.SPDF.config.EndpointConfiguration.DisableReason;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.RegexPatternUtils;

@@ -97,7 +98,7 @@ public class ExternalAppDepConfig {
            if (affectedGroups != null) {
                for (String group : affectedGroups) {
                    List<String> affectedFeatures = getAffectedFeatures(group);
-                    endpointConfiguration.disableGroup(group);
+                    endpointConfiguration.disableGroup(group, DisableReason.DEPENDENCY);
                    log.warn(
                            "Missing dependency: {} - Disabling group: {} (Affected features: {})",
                            command,
@@ -127,8 +128,8 @@ public class ExternalAppDepConfig {
        if (!pythonAvailable) {
            List<String> pythonFeatures = getAffectedFeatures("Python");
            List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-            endpointConfiguration.disableGroup("Python");
-            endpointConfiguration.disableGroup("OpenCV");
+            endpointConfiguration.disableGroup("Python", DisableReason.DEPENDENCY);
+            endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
            log.warn(
                    "Missing dependency: Python - Disabling Python features: {} and OpenCV features: {}",
                    String.join(", ", pythonFeatures),
@@ -146,14 +147,14 @@ public class ExternalAppDepConfig {
                int exitCode = process.waitFor();
                if (exitCode != 0) {
                    List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                    endpointConfiguration.disableGroup("OpenCV");
+                    endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                    log.warn(
                            "OpenCV not available in Python - Disabling OpenCV features: {}",
                            String.join(", ", openCVFeatures));
                }
            } catch (Exception e) {
                List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                endpointConfiguration.disableGroup("OpenCV");
+                endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                log.warn(
                        "Error checking OpenCV: {} - Disabling OpenCV features: {}",
                        e.getMessage(),
@@ -2,6 +2,9 @@ package stirling.software.SPDF.config;

 import java.io.IOException;

+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
 import jakarta.servlet.Filter;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
@@ -9,17 +12,14 @@ import jakarta.servlet.ServletRequest;
 import jakarta.servlet.ServletResponse;
 import jakarta.servlet.http.HttpServletRequest;

-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.stereotype.Component;
-
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.service.WeeklyActiveUsersService;

 /**
- * Filter to track browser IDs for Weekly Active Users (WAU) counting.
- * Only active when security is disabled (no-login mode).
+ * Filter to track browser IDs for Weekly Active Users (WAU) counting. Only active when security is
+ * disabled (no-login mode).
 */
@Component
@ConditionalOnProperty(name = "security.enableLogin", havingValue = "false")
@@ -1,6 +1,7 @@
 package stirling.software.SPDF.controller.api.misc;

 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;

 import org.springframework.context.ApplicationContext;
@@ -10,9 +11,13 @@ import org.springframework.web.bind.annotation.RequestParam;

 import io.swagger.v3.oas.annotations.Hidden;

+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.config.EndpointConfiguration;
+import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
 import stirling.software.SPDF.config.InitialSetup;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
@@ -200,4 +205,19 @@ public class ConfigController {
        }
        return ResponseEntity.ok(result);
    }
+
+    @GetMapping("/endpoints-availability")
+    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
+            @RequestParam(name = "endpoints")
+                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
+                    List<@NotBlank String> endpoints) {
+        Map<String, EndpointAvailability> result = new HashMap<>();
+        for (String endpoint : endpoints) {
+            String trimmedEndpoint = endpoint.trim();
+            result.put(
+                    trimmedEndpoint,
+                    endpointConfiguration.getEndpointAvailability(trimmedEndpoint));
+        }
+        return ResponseEntity.ok(result);
+    }
 }
@@ -369,7 +369,8 @@ public class MetricsController {
        // Check if WAU service is available (only when security.enableLogin=false)
        if (wauService.isEmpty()) {
            return ResponseEntity.status(HttpStatus.NOT_FOUND)
-                    .body("WAU tracking is only available when security is disabled (no-login mode)");
+                    .body(
+                            "WAU tracking is only available when security is disabled (no-login mode)");
        }

        WeeklyActiveUsersService service = wauService.get();
@@ -10,8 +10,8 @@ import org.springframework.stereotype.Service;
 import lombok.extern.slf4j.Slf4j;

 /**
- * Service for tracking Weekly Active Users (WAU) in no-login mode.
- * Uses in-memory storage with automatic cleanup of old entries.
+ * Service for tracking Weekly Active Users (WAU) in no-login mode. Uses in-memory storage with
+ * automatic cleanup of old entries.
 */
@Service
@Slf4j
@@ -28,6 +28,7 @@ public class WeeklyActiveUsersService {

    /**
     * Records a browser access with the current timestamp
+     *
     * @param browserId Unique browser identifier from X-Browser-Id header
     */
    public void recordBrowserAccess(String browserId) {
@@ -46,6 +47,7 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the count of unique browsers seen in the last 7 days
+     *
     * @return Weekly Active Users count
     */
    public long getWeeklyActiveUsers() {
@@ -55,6 +57,7 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the total count of unique browsers ever seen
+     *
     * @return Total unique browsers count
     */
    public long getTotalUniqueBrowsers() {
@@ -63,6 +66,7 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the number of days the service has been running
+     *
     * @return Days online
     */
    public long getDaysOnline() {
@@ -71,23 +75,20 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the timestamp when tracking started
+     *
     * @return Start time
     */
    public Instant getStartTime() {
        return startTime;
    }

-    /**
-     * Removes entries older than 7 days
-     */
+    /** Removes entries older than 7 days */
    private void cleanupOldEntries() {
        Instant sevenDaysAgo = Instant.now().minus(7, ChronoUnit.DAYS);
        activeBrowsers.entrySet().removeIf(entry -> entry.getValue().isBefore(sevenDaysAgo));
    }

-    /**
-     * Manual cleanup trigger (can be called by scheduled task if needed)
-     */
+    /** Manual cleanup trigger (can be called by scheduled task if needed) */
    public void performCleanup() {
        int sizeBefore = activeBrowsers.size();
        cleanupOldEntries();
@@ -0,0 +1,54 @@
+{
+  "name": "Pre-publish-sanitization",
+  "pipeline": [
+    {
+      "operation": "/api/v1/security/sanitize-pdf",
+      "parameters": {
+        "removeJavaScript": true,
+        "removeEmbeddedFiles": true,
+        "removeXMPMetadata": true,
+        "removeMetadata": true,
+        "removeLinks": true,
+        "removeFonts": false
+      }
+    },
+    {
+      "operation": "/api/v1/misc/flatten",
+      "parameters": {
+        "flattenOnlyForms": true
+      }
+    },
+    {
+      "operation": "/api/v1/general/remove-annotations",
+      "parameters": {}
+    },
+    {
+      "operation": "/api/v1/misc/update-metadata",
+      "parameters": {
+        "deleteAll": true,
+        "author": "",
+        "creationDate": "",
+        "creator": "",
+        "keywords": "",
+        "modificationDate": "",
+        "producer": "",
+        "subject": "",
+        "title": "",
+        "trapped": ""
+      }
+    },
+    {
+      "operation": "/api/v1/misc/compress-pdf",
+      "parameters": {
+        "optimizeLevel": 3,
+        "expectedOutputSize": ""
+      }
+    }
+  ],
+  "_examples": {
+    "outputDir": "{outputFolder}/{folderName}",
+    "outputFileName": "{filename}-{pipelineName}-{date}-{time}"
+  },
+  "outputDir": "{outputFolder}",
+  "outputFileName": "pre_publish_{filename}.PDF"
+}
@@ -113,7 +113,12 @@ public class LicenseKeyChecker {

    public void updateLicenseKey(String newKey) throws IOException {
        applicationProperties.getPremium().setKey(newKey);
-        GeneralUtils.saveKeyToSettings("EnterpriseEdition.key", newKey);
+        GeneralUtils.saveKeyToSettings("premium.key", newKey);
+        evaluateLicense();
+        synchronizeLicenseSettings();
+    }
+
+    public void resyncLicense() {
        evaluateLicense();
        synchronizeLicenseSettings();
    }
@@ -0,0 +1,245 @@
+package stirling.software.proprietary.security.controller.api;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.GeneralUtils;
+import stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier;
+import stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier.License;
+import stirling.software.proprietary.security.configuration.ee.LicenseKeyChecker;
+
+/**
+ * Admin controller for license management. Provides installation ID for Stripe checkout metadata
+ * and endpoints for managing license keys.
+ */
+@RestController
+@Slf4j
+@RequestMapping("/api/v1/admin")
+@PreAuthorize("hasRole('ROLE_ADMIN')")
+@Tag(name = "Admin License Management", description = "Admin-only License Management APIs")
+public class AdminLicenseController {
+
+    @Autowired(required = false)
+    private LicenseKeyChecker licenseKeyChecker;
+
+    @Autowired(required = false)
+    private KeygenLicenseVerifier keygenLicenseVerifier;
+
+    @Autowired private ApplicationProperties applicationProperties;
+
+    /**
+     * Get the installation ID (machine fingerprint) for this self-hosted instance. This ID is used
+     * as metadata in Stripe checkout to link licenses to specific installations.
+     *
+     * @return Map containing the installation ID
+     */
+    @GetMapping("/installation-id")
+    @Operation(
+            summary = "Get installation ID",
+            description =
+                    "Returns the unique installation ID (MAC-based fingerprint) for this"
+                            + " self-hosted instance")
+    public ResponseEntity<Map<String, String>> getInstallationId() {
+        try {
+            String installationId = GeneralUtils.generateMachineFingerprint();
+            log.info("Admin requested installation ID: {}", installationId);
+            return ResponseEntity.ok(Map.of("installationId", installationId));
+        } catch (Exception e) {
+            log.error("Failed to generate installation ID", e);
+            return ResponseEntity.internalServerError()
+                    .body(Map.of("error", "Failed to generate installation ID"));
+        }
+    }
+
+    /**
+     * Save and activate a license key. This endpoint accepts a license key from the frontend (e.g.,
+     * after Stripe checkout) and activates it on the backend.
+     *
+     * @param request Map containing the license key
+     * @return Response with success status, license type, and whether restart is required
+     */
+    @PostMapping("/license-key")
+    @Operation(
+            summary = "Save and activate license key",
+            description =
+                    "Accepts a license key and activates it on the backend. Returns the activated"
+                            + " license type.")
+    public ResponseEntity<Map<String, Object>> saveLicenseKey(
+            @RequestBody Map<String, String> request) {
+        String licenseKey = request.get("licenseKey");
+
+        // Reject null but allow empty string to clear license
+        if (licenseKey == null) {
+            return ResponseEntity.badRequest()
+                    .body(Map.of("success", false, "error", "License key is required"));
+        }
+
+        try {
+            if (licenseKeyChecker == null) {
+                return ResponseEntity.internalServerError()
+                        .body(Map.of("success", false, "error", "License checker not available"));
+            }
+            // assume premium enabled when setting license key
+            applicationProperties.getPremium().setEnabled(true);
+
+            // Use existing LicenseKeyChecker to update and validate license
+            // Empty string will be evaluated as NORMAL license (free tier)
+            licenseKeyChecker.updateLicenseKey(licenseKey.trim());
+
+            // Get current license status
+            License license = licenseKeyChecker.getPremiumLicenseEnabledResult();
+
+            // Auto-enable premium features if license is valid
+            if (license != License.NORMAL) {
+                GeneralUtils.saveKeyToSettings("premium.enabled", true);
+                // Enable premium features
+
+                // Save maxUsers from license metadata
+                Integer maxUsers = applicationProperties.getPremium().getMaxUsers();
+                if (maxUsers != null) {
+                    GeneralUtils.saveKeyToSettings("premium.maxUsers", maxUsers);
+                }
+            } else {
+                GeneralUtils.saveKeyToSettings("premium.enabled", false);
+                log.info("License key is not valid for premium features: type={}", license.name());
+            }
+
+            Map<String, Object> response = new HashMap<>();
+            response.put("success", true);
+            response.put("licenseType", license.name());
+            response.put("enabled", applicationProperties.getPremium().isEnabled());
+            response.put("maxUsers", applicationProperties.getPremium().getMaxUsers());
+            response.put("requiresRestart", false); // Dynamic evaluation works
+            response.put("message", "License key saved and activated");
+
+            log.info("License key saved and activated: type={}", license.name());
+
+            return ResponseEntity.ok(response);
+        } catch (Exception e) {
+            log.error("Failed to save license key", e);
+            return ResponseEntity.badRequest()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Failed to activate license: " + e.getMessage()));
+        }
+    }
+
+    /**
+     * Resync the current license with Keygen. This endpoint re-validates the existing license key
+     * and updates the max users setting. Used after subscription upgrades to sync the new license
+     * limits.
+     *
+     * @return Response with updated license information
+     */
+    @PostMapping("/license/resync")
+    @Operation(
+            summary = "Resync license with Keygen",
+            description =
+                    "Re-validates the existing license key with Keygen and updates local settings."
+                            + " Used after subscription upgrades.")
+    public ResponseEntity<Map<String, Object>> resyncLicense() {
+        try {
+            if (licenseKeyChecker == null) {
+                return ResponseEntity.internalServerError()
+                        .body(Map.of("success", false, "error", "License checker not available"));
+            }
+
+            String currentKey = applicationProperties.getPremium().getKey();
+            if (currentKey == null || currentKey.trim().isEmpty()) {
+                return ResponseEntity.badRequest()
+                        .body(Map.of("success", false, "error", "No license key configured"));
+            }
+
+            log.info("Resyncing license with Keygen");
+
+            // Re-validate license and sync settings
+            licenseKeyChecker.resyncLicense();
+
+            // Get updated license status
+            License license = licenseKeyChecker.getPremiumLicenseEnabledResult();
+            ApplicationProperties.Premium premium = applicationProperties.getPremium();
+
+            Map<String, Object> response = new HashMap<>();
+            response.put("success", true);
+            response.put("licenseType", license.name());
+            response.put("enabled", premium.isEnabled());
+            response.put("maxUsers", premium.getMaxUsers());
+            response.put("message", "License resynced successfully");
+
+            log.info(
+                    "License resynced: type={}, maxUsers={}",
+                    license.name(),
+                    premium.getMaxUsers());
+
+            return ResponseEntity.ok(response);
+        } catch (Exception e) {
+            log.error("Failed to resync license", e);
+            return ResponseEntity.internalServerError()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Failed to resync license: " + e.getMessage()));
+        }
+    }
+
+    /**
+     * Get information about the current license key status, including license type, enabled status,
+     * and max users.
+     *
+     * @return Map containing license information
+     */
+    @GetMapping("/license-info")
+    @Operation(
+            summary = "Get license information",
+            description =
+                    "Returns information about the current license including type, enabled status,"
+                            + " and max users")
+    public ResponseEntity<Map<String, Object>> getLicenseInfo() {
+        try {
+            Map<String, Object> response = new HashMap<>();
+
+            if (licenseKeyChecker != null) {
+                License license = licenseKeyChecker.getPremiumLicenseEnabledResult();
+                response.put("licenseType", license.name());
+            } else {
+                response.put("licenseType", License.NORMAL.name());
+            }
+
+            ApplicationProperties.Premium premium = applicationProperties.getPremium();
+            response.put("enabled", premium.isEnabled());
+            response.put("maxUsers", premium.getMaxUsers());
+            response.put("hasKey", premium.getKey() != null && !premium.getKey().trim().isEmpty());
+
+            // Include license key for upgrades (admin-only endpoint)
+            if (premium.getKey() != null && !premium.getKey().trim().isEmpty()) {
+                response.put("licenseKey", premium.getKey());
+            }
+
+            return ResponseEntity.ok(response);
+        } catch (Exception e) {
+            log.error("Failed to get license info", e);
+            return ResponseEntity.internalServerError()
+                    .body(Map.of("error", "Failed to retrieve license information"));
+        }
+    }
+}
@@ -299,6 +299,16 @@ public class AdminSettingsController {
                                        + String.join(", ", VALID_SECTION_NAMES));
            }

+            // Auto-enable premium features if license key is provided
+            if ("premium".equalsIgnoreCase(sectionName) && sectionData.containsKey("key")) {
+                Object keyValue = sectionData.get("key");
+                if (keyValue != null && !keyValue.toString().trim().isEmpty()) {
+                    // Automatically set enabled to true when a key is provided
+                    sectionData.put("enabled", true);
+                    log.info("Auto-enabling premium features because license key was provided");
+                }
+            }
+
            int updatedCount = 0;
            for (Map.Entry<String, Object> entry : sectionData.entrySet()) {
                String propertyKey = entry.getKey();
@@ -39,7 +39,7 @@ import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrin
 public class JwtService implements JwtServiceInterface {

    private static final String ISSUER = "https://stirling.com";
-    private static final long EXPIRATION = 3600000;
+    private static final long EXPIRATION = 43200000;

    private final KeyPersistenceServiceInterface keyPersistenceService;
    private final boolean v2Enabled;
@@ -39,10 +39,14 @@
        "@mui/icons-material": "^7.3.2",
        "@mui/material": "^7.3.2",
        "@reactour/tour": "^3.8.0",
+        "@stripe/react-stripe-js": "^4.0.2",
+        "@stripe/stripe-js": "^7.9.0",
+        "@supabase/supabase-js": "^2.47.13",
        "@tailwindcss/postcss": "^4.1.13",
        "@tanstack/react-virtual": "^3.13.12",
        "@tauri-apps/api": "^2.5.0",
        "@tauri-apps/plugin-fs": "^2.4.0",
+        "@tauri-apps/plugin-http": "^2.5.4",
        "autoprefixer": "^10.4.21",
        "axios": "^1.12.2",
        "globals": "^16.4.0",
@@ -3120,6 +3124,138 @@
        "url": "https://github.com/sindresorhus/is?sponsor=1"
      }
    },
+    "node_modules/@stripe/react-stripe-js": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@stripe/react-stripe-js/-/react-stripe-js-4.0.2.tgz",
+      "integrity": "sha512-l2wau+8/LOlHl+Sz8wQ1oDuLJvyw51nQCsu6/ljT6smqzTszcMHifjAJoXlnMfcou3+jK/kQyVe04u/ufyTXgg==",
+      "license": "MIT",
+      "dependencies": {
+        "prop-types": "^15.7.2"
+      },
+      "peerDependencies": {
+        "@stripe/stripe-js": ">=1.44.1 <8.0.0",
+        "react": ">=16.8.0 <20.0.0",
+        "react-dom": ">=16.8.0 <20.0.0"
+      }
+    },
+    "node_modules/@stripe/stripe-js": {
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@stripe/stripe-js/-/stripe-js-7.9.0.tgz",
+      "integrity": "sha512-ggs5k+/0FUJcIgNY08aZTqpBTtbExkJMYMLSMwyucrhtWexVOEY1KJmhBsxf+E/Q15f5rbwBpj+t0t2AW2oCsQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.16"
+      }
+    },
+    "node_modules/@supabase/auth-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.81.1.tgz",
+      "integrity": "sha512-K20GgiSm9XeRLypxYHa5UCnybWc2K0ok0HLbqCej/wRxDpJxToXNOwKt0l7nO8xI1CyQ+GrNfU6bcRzvdbeopQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/auth-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/functions-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.81.1.tgz",
+      "integrity": "sha512-sYgSO3mlgL0NvBFS3oRfCK4OgKGQwuOWJLzfPyWg0k8MSxSFSDeN/JtrDJD5GQrxskP6c58+vUzruBJQY78AqQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/functions-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/postgrest-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.81.1.tgz",
+      "integrity": "sha512-DePpUTAPXJyBurQ4IH2e42DWoA+/Qmr5mbgY4B6ZcxVc/ZUKfTVK31BYIFBATMApWraFc8Q/Sg+yxtfJ3E0wSg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/postgrest-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/realtime-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.81.1.tgz",
+      "integrity": "sha512-ViQ+Kxm8BuUP/TcYmH9tViqYKGSD1LBjdqx2p5J+47RES6c+0QHedM0PPAjthMdAHWyb2LGATE9PD2++2rO/tw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/phoenix": "^1.6.6",
+        "@types/ws": "^8.18.1",
+        "tslib": "2.8.1",
+        "ws": "^8.18.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/realtime-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/storage-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.81.1.tgz",
+      "integrity": "sha512-UNmYtjnZnhouqnbEMC1D5YJot7y0rIaZx7FG2Fv8S3hhNjcGVvO+h9We/tggi273BFkiahQPS/uRsapo1cSapw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/storage-js/node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/@supabase/supabase-js": {
+      "version": "2.81.1",
+      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.81.1.tgz",
+      "integrity": "sha512-KSdY7xb2L0DlLmlYzIOghdw/na4gsMcqJ8u4sD6tOQJr+x3hLujU9s4R8N3ob84/1bkvpvlU5PYKa1ae+OICnw==",
+      "license": "MIT",
+      "dependencies": {
+        "@supabase/auth-js": "2.81.1",
+        "@supabase/functions-js": "2.81.1",
+        "@supabase/postgrest-js": "2.81.1",
+        "@supabase/realtime-js": "2.81.1",
+        "@supabase/storage-js": "2.81.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
    "node_modules/@sveltejs/acorn-typescript": {
      "version": "1.0.6",
      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.6.tgz",
@@ -3887,6 +4023,15 @@
        "@tauri-apps/api": "^2.8.0"
      }
    },
+    "node_modules/@tauri-apps/plugin-http": {
+      "version": "2.5.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-http/-/plugin-http-2.5.4.tgz",
+      "integrity": "sha512-/i4U/9za3mrytTgfRn5RHneKubZE/dwRmshYwyMvNRlkWjvu1m4Ma72kcbVJMZFGXpkbl+qLyWMGrihtWB76Zg==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.8.0"
+      }
+    },
    "node_modules/@testing-library/dom": {
      "version": "10.4.1",
      "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",
@@ -4193,7 +4338,6 @@
      "version": "24.9.1",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.9.1.tgz",
      "integrity": "sha512-QoiaXANRkSXK6p0Duvt56W208du4P9Uye9hWLWgGMDTEoKPhuenzNcC4vGUmrNkiOKTlIrBoyNQYNpSwfEZXSg==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "undici-types": "~7.16.0"
@@ -4205,6 +4349,12 @@
      "integrity": "sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==",
      "license": "MIT"
    },
+    "node_modules/@types/phoenix": {
+      "version": "1.6.6",
+      "resolved": "https://registry.npmjs.org/@types/phoenix/-/phoenix-1.6.6.tgz",
+      "integrity": "sha512-PIzZZlEppgrpoT2QgbnDU+MMzuR6BbCjllj0bM70lWoejMeNJAxCchxnv7J3XFkI8MpygtRpzXrIlmWUBclP5A==",
+      "license": "MIT"
+    },
    "node_modules/@types/prop-types": {
      "version": "15.7.15",
      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
@@ -4239,6 +4389,15 @@
        "@types/react": "*"
      }
    },
+    "node_modules/@types/ws": {
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
+      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
    "node_modules/@types/yauzl": {
      "version": "2.10.3",
      "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz",
@@ -13952,7 +14111,6 @@
      "version": "7.16.0",
      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/universalify": {
@@ -14823,7 +14981,6 @@
      "version": "8.18.3",
      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz",
      "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=10.0.0"
@@ -26,19 +26,23 @@
    "@embedpdf/plugin-viewport": "^1.4.1",
    "@embedpdf/plugin-zoom": "^1.4.1",
    "@emotion/react": "^11.14.0",
-    "@tauri-apps/api": "^2.5.0",
-    "@tauri-apps/plugin-fs": "^2.4.0",
    "@emotion/styled": "^11.14.1",
    "@iconify/react": "^6.0.2",
    "@mantine/core": "^8.3.1",
    "@mantine/dates": "^8.3.1",
    "@mantine/dropzone": "^8.3.1",
    "@mantine/hooks": "^8.3.1",
+    "@stripe/react-stripe-js": "^4.0.2",
+    "@stripe/stripe-js": "^7.9.0",
+    "@supabase/supabase-js": "^2.47.13",
    "@mui/icons-material": "^7.3.2",
    "@mui/material": "^7.3.2",
    "@reactour/tour": "^3.8.0",
    "@tailwindcss/postcss": "^4.1.13",
    "@tanstack/react-virtual": "^3.13.12",
+    "@tauri-apps/api": "^2.5.0",
+    "@tauri-apps/plugin-fs": "^2.4.0",
+    "@tauri-apps/plugin-http": "^2.5.4",
    "autoprefixer": "^10.4.21",
    "axios": "^1.12.2",
    "globals": "^16.4.0",
@@ -110,11 +114,11 @@
    ]
  },
  "devDependencies": {
-    "@tauri-apps/cli": "^2.5.0",
    "@eslint/js": "^9.36.0",
    "@iconify-json/material-symbols": "^1.2.37",
    "@iconify/utils": "^3.0.2",
    "@playwright/test": "^1.55.0",
+    "@tauri-apps/cli": "^2.5.0",
    "@testing-library/dom": "^10.4.1",
    "@testing-library/jest-dom": "^6.8.0",
    "@testing-library/react": "^16.3.0",
@@ -17,6 +17,8 @@
      "comingSoon": "Coming soon:",
      "favorite": "Add to favourites",
      "favorites": "Favourites",
+      "unavailable": "Disabled by server administrator:",
+      "unavailableDependency": "Unavailable - required tool missing on server:",
      "heading": "All tools (fullscreen view)",
      "noResults": "Try adjusting your search or toggle descriptions to find what you need.",
      "recommended": "Recommended",
@@ -918,6 +920,11 @@
    },
    "error": {
      "failed": "An error occurred while merging the PDFs."
+    },
+    "tooltip": {
+      "header": {
+        "title": "Merge Settings Overview"
+      }
    }
  },
  "split": {
@@ -2372,6 +2379,14 @@
      "title": "About Remove Annotations",
      "description": "This tool will remove all annotations (comments, highlights, notes, etc.) from your PDF documents."
    },
+    "tooltip": {
+      "header": {
+        "title": "About Remove Annotations"
+      },
+      "description": {
+        "title": "What it does"
+      }
+    },
    "error": {
      "failed": "An error occurred while removing annotations from the PDF."
    }
@@ -2415,7 +2430,7 @@
    },
    "cta": "Compare",
    "loading": "Comparing...",
-    
+
    "summary": {
      "baseHeading": "Original document",
      "comparisonHeading": "Edited document",
@@ -2471,7 +2486,7 @@
      "body": "This comparison is taking longer than usual. You can let it continue or cancel it.",
      "cancel": "Cancel comparison"
    },
-    
+
    "newLine": "new-line",
    "complex": {
      "message": "One or both of the provided documents are large files, accuracy of comparison may be reduced"
@@ -2834,6 +2849,9 @@
      "header": {
        "title": "How Auto-Rename Works"
      },
+      "description": {
+        "title": "What it does"
+      },
      "howItWorks": {
        "title": "Smart Renaming",
        "text": "Automatically finds the title from your PDF content and uses it as the filename.",
@@ -2841,6 +2859,9 @@
        "bullet2": "Creates a clean, valid filename from the detected title",
        "bullet3": "Keeps the original name if no suitable title is found"
      }
+    },
+    "settings": {
+      "title": "About"
    }
  },
  "adjust-contrast": {
@@ -4419,9 +4440,21 @@
        "title": "Premium & Enterprise",
        "description": "Configure your premium or enterprise license key.",
        "license": "License Configuration",
+        "licenseKey": {
+          "toggle": "Got a license key or certificate file?",
+          "info": "If you have a license key or certificate file from a direct purchase, you can enter it here to activate premium or enterprise features."
+        },
        "key": {
          "label": "License Key",
-          "description": "Enter your premium or enterprise license key"
+          "description": "Enter your premium or enterprise license key. Premium features will be automatically enabled when a key is provided.",
+          "success": "License Key Saved",
+          "successMessage": "Your license key has been activated successfully. No restart required.",
+          "overwriteWarning": {
+            "title": "⚠️ Warning: Existing License Detected",
+            "line1": "Overwriting your current license key cannot be undone.",
+            "line2": "Your previous license will be permanently lost unless you have backed it up elsewhere.",
+            "line3": "Important: Keep license keys private and secure. Never share them publicly."
+          }
        },
        "enabled": {
          "label": "Enable Premium Features",
@@ -4828,7 +4861,9 @@
      "secureWorkflow": "Security Workflow",
      "secureWorkflowDesc": "Secures PDF documents by removing potentially malicious content like JavaScript and embedded files, then adds password protection to prevent unauthorised access. Password is set to 'password' by default.",
      "processImages": "Process Images",
-      "processImagesDesc": "Converts multiple image files into a single PDF document, then applies OCR technology to extract searchable text from the images."
+      "processImagesDesc": "Converts multiple image files into a single PDF document, then applies OCR technology to extract searchable text from the images.",
+      "prePublishSanitization": "Pre-publish Sanitization",
+      "prePublishSanitizationDesc": "Sanitization workflow that removes all hidden metadata, JavaScript, embedded files, annotations, and flattens forms to prevent data leakage before publishing PDFs online."
    }
  },
  "colorPicker": {
@@ -4850,7 +4885,11 @@
    "available": "available",
    "cancel": "Cancel",
    "preview": "Preview",
-    "done": "Done"
+    "close": "Close",
+    "done": "Done",
+    "loading": "Loading...",
+    "back": "Back",
+    "continue": "Continue"
  },
  "config": {
    "overview": {
@@ -4916,6 +4955,14 @@
    "addMoreFiles": "Add more files...",
    "selectedFiles": "Selected Files",
    "submit": "Add Attachments",
+    "tooltip": {
+      "header": {
+        "title": "About Add Attachments"
+      },
+      "description": {
+        "title": "What it does"
+      }
+    },
    "results": {
      "title": "Attachment Results"
    },
@@ -5268,6 +5315,14 @@
    "showComparison": "Compare All Features",
    "hideComparison": "Hide Feature Comparison",
    "featureComparison": "Feature Comparison",
+    "from": "From",
+    "perMonth": "/month",
+    "licensedSeats": "Licensed: {{count}} seats",
+    "includedInCurrent": "Included in Your Plan",
+    "selectPlan": "Select Plan",
+    "manageSubscription": {
+      "description": "Manage your subscription, billing, and payment methods"
+    },
    "activePlan": {
      "title": "Active Plan",
      "subtitle": "Your current subscription details"
@@ -5285,13 +5340,16 @@
      "upTo": "Up to"
    },
    "period": {
-      "month": "month"
+      "month": "month",
+      "perUserPerMonth": "/user/month"
    },
    "free": {
      "name": "Free",
      "highlight1": "Limited Tool Usage Per week",
      "highlight2": "Access to all tools",
-      "highlight3": "Community support"
+      "highlight3": "Community support",
+      "forever": "Forever free",
+      "included": "Included"
    },
    "pro": {
      "name": "Pro",
@@ -5333,13 +5391,44 @@
      "error": "Failed to open billing portal"
    }
  },
+  "upgradeBanner": {
+    "title": "Upgrade to Server Plan",
+    "message": "Get the most out of Stirling PDF with unlimited users and advanced features",
+    "upgradeButton": "Upgrade Now",
+    "dismiss": "Dismiss banner"
+  },
  "payment": {
    "preparing": "Preparing your checkout...",
    "upgradeTitle": "Upgrade to {{planName}}",
    "success": "Payment Successful!",
    "successMessage": "Your subscription has been activated successfully. You will receive a confirmation email shortly.",
    "autoClose": "This window will close automatically...",
-    "error": "Payment Error"
+    "error": "Payment Error",
+    "upgradeSuccess": "Payment successful! Your subscription has been upgraded. The license has been updated on your server. You will receive a confirmation email shortly.",
+    "paymentSuccess": "Payment successful! Retrieving your license key...",
+    "licenseActivated": "License activated! Your license key has been saved. A confirmation email has been sent to your registered email address.",
+    "licenseDelayed": "Payment successful! Your license is being generated. You will receive an email with your license key shortly. If you don't receive it within 10 minutes, please contact support.",
+    "licensePollingError": "Payment successful but we couldn't retrieve your license key automatically. Please check your email or contact support with your payment confirmation.",
+    "licenseRetrievalError": "Payment successful but license retrieval failed. You will receive your license key via email. Please contact support if you don't receive it within 10 minutes.",
+    "syncError": "Payment successful but license sync failed. Your license will be updated shortly. Please contact support if issues persist.",
+    "licenseSaveError": "Failed to save license key. Please contact support with your license key to complete activation.",
+    "paymentCanceled": "Payment was canceled. No charges were made.",
+    "syncingLicense": "Syncing your upgraded license...",
+    "generatingLicense": "Generating your license key...",
+    "upgradeComplete": "Upgrade Complete",
+    "upgradeCompleteMessage": "Your subscription has been upgraded successfully. Your existing license key has been updated.",
+    "stripeNotConfigured": "Stripe Not Configured",
+    "stripeNotConfiguredMessage": "Stripe payment integration is not configured. Please contact your administrator.",
+    "monthly": "Monthly",
+    "yearly": "Yearly",
+    "billingPeriod": "Billing Period",
+    "enterpriseNote": "Seats can be adjusted in checkout (1-1000).",
+    "installationId": "Installation ID",
+    "licenseKey": "Your License Key",
+    "licenseInstructions": "Enter this key in Settings → Admin Plan → License Key section",
+    "canCloseWindow": "You can now close this window.",
+    "licenseKeyProcessing": "License Key Processing",
+    "licenseDelayedMessage": "Your license key is being generated. Please check your email shortly or contact support."
  },
  "firstLogin": {
    "title": "First Time Login",
@@ -5498,5 +5587,164 @@
    "offline": "Backend Offline",
    "starting": "Backend starting up...",
    "wait": "Please wait for the backend to finish launching and try again."
+  },
+  "encryptedPdfUnlock": {
+    "unlockPrompt": "Unlock PDF to continue",
+    "title": "Remove password to continue",
+    "description": "This PDF is password protected. Enter the password so you can continue working with it.",
+    "password": {
+      "label": "PDF password",
+      "placeholder": "Enter the PDF password"
+    },
+    "skip": "Skip for now",
+    "unlock": "Unlock & Continue",
+    "incorrectPassword": "Incorrect password",
+    "missingFile": "The selected file is no longer available.",
+    "emptyResponse": "Password removal did not produce a file.",
+    "required": "Enter the password to continue.",
+    "successTitle": "Password removed",
+    "successBodyWithName": "Password removed from {{fileName}}",
+    "successBody": "Password removed successfully."
+  },
+  "setup": {
+    "welcome": "Welcome to Stirling PDF",
+    "description": "Get started by choosing how you want to use Stirling PDF",
+    "step1": {
+      "label": "Choose Mode",
+      "description": "Offline or Server"
+    },
+    "step2": {
+      "label": "Select Server",
+      "description": "Self-hosted server"
+    },
+    "step3": {
+      "label": "Login",
+      "description": "Enter credentials"
+    },
+    "mode": {
+      "offline": {
+        "title": "Use Offline",
+        "description": "Run locally without an internet connection"
+      },
+      "server": {
+        "title": "Connect to Server",
+        "description": "Connect to a remote Stirling PDF server"
+      }
+    },
+    "server": {
+      "title": "Connect to Server",
+      "subtitle": "Enter your self-hosted server URL",
+      "type": {
+        "saas": "Stirling PDF SaaS",
+        "selfhosted": "Self-hosted server"
+      },
+      "url": {
+        "label": "Server URL",
+        "description": "Enter the full URL of your self-hosted Stirling PDF server"
+      },
+      "error": {
+        "emptyUrl": "Please enter a server URL",
+        "unreachable": "Could not connect to server",
+        "testFailed": "Connection test failed"
+      },
+      "testing": "Testing connection..."
+    },
+    "login": {
+      "title": "Sign In",
+      "subtitle": "Enter your credentials to continue",
+      "connectingTo": "Connecting to:",
+      "username": {
+        "label": "Username",
+        "placeholder": "Enter your username"
+      },
+      "password": {
+        "label": "Password",
+        "placeholder": "Enter your password"
+      },
+      "error": {
+        "emptyUsername": "Please enter your username",
+        "emptyPassword": "Please enter your password"
+      },
+      "submit": "Login"
+    }
+  },
+  "settings": {
+    "connection": {
+      "title": "Connection Mode",
+      "mode": {
+        "offline": "Offline",
+        "server": "Server"
+      },
+      "server": "Server",
+      "user": "Logged in as",
+      "switchToServer": "Connect to Server",
+      "switchToOffline": "Switch to Offline",
+      "logout": "Logout",
+      "selectServer": "Select Server",
+      "login": "Login"
+    },
+    "general": {
+      "title": "General",
+      "description": "Configure general application preferences.",
+      "user": "User",
+      "logout": "Log out",
+      "enableFeatures": {
+        "dismiss": "Dismiss",
+        "title": "For System Administrators",
+        "intro": "Enable user authentication, team management, and workspace features for your organisation.",
+        "action": "Configure",
+        "and": "and",
+        "benefit": "Enables user roles, team collaboration, admin controls, and enterprise features.",
+        "learnMore": "Learn more in documentation"
+      },
+      "defaultToolPickerMode": "Default tool picker mode",
+      "defaultToolPickerModeDescription": "Choose whether the tool picker opens in fullscreen or sidebar by default",
+      "mode": {
+        "sidebar": "Sidebar",
+        "fullscreen": "Fullscreen"
+      },
+      "autoUnzipTooltip": "Automatically extract ZIP files returned from API operations. Disable to keep ZIP files intact. This does not affect automation workflows.",
+      "autoUnzip": "Auto-unzip API responses",
+      "autoUnzipDescription": "Automatically extract files from ZIP responses",
+      "autoUnzipFileLimitTooltip": "Only unzip if the ZIP contains this many files or fewer. Set higher to extract larger ZIPs.",
+      "autoUnzipFileLimit": "Auto-unzip file limit",
+      "autoUnzipFileLimitDescription": "Maximum number of files to extract from ZIP",
+      "defaultPdfEditor": "Default PDF editor",
+      "defaultPdfEditorActive": "Stirling PDF is your default PDF editor",
+      "defaultPdfEditorInactive": "Another application is set as default",
+      "defaultPdfEditorChecking": "Checking...",
+      "defaultPdfEditorSet": "Already Default",
+      "setAsDefault": "Set as Default",
+      "updates": {
+        "title": "Software Updates",
+        "description": "Check for updates and view version information",
+        "currentVersion": "Current Version",
+        "latestVersion": "Latest Version",
+        "checkForUpdates": "Check for Updates",
+        "viewDetails": "View Details"
+      },
+      "hideUnavailableTools": "Hide unavailable tools",
+      "hideUnavailableToolsDescription": "Remove tools that have been disabled by your server instead of showing them greyed out.",
+      "hideUnavailableConversions": "Hide unavailable conversions",
+      "hideUnavailableConversionsDescription": "Remove disabled conversion options in the Convert tool instead of showing them greyed out."
+    },
+    "hotkeys": {
+      "errorConflict": "Shortcut already used by {{tool}}.",
+      "searchPlaceholder": "Search tools...",
+      "none": "Not assigned",
+      "customBadge": "Custom",
+      "defaultLabel": "Default: {{shortcut}}",
+      "capturing": "Press keys… (Esc to cancel)",
+      "change": "Change shortcut",
+      "reset": "Reset",
+      "shortcut": "Shortcut",
+      "noShortcut": "No shortcut set"
+    }
+  },
+  "auth": {
+    "sessionExpired": "Session Expired",
+    "pleaseLoginAgain": "Please login again.",
+    "accessDenied": "Access Denied",
+    "insufficientPermissions": "You do not have permission to perform this action."
  }
 }
@@ -589,10 +589,29 @@ version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
 dependencies = [
+ "percent-encoding",
 "time",
 "version_check",
 ]

+[[package]]
+name = "cookie_store"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eac901828f88a5241ee0600950ab981148a18f2f756900ffba1b125ca6a3ef9"
+dependencies = [
+ "cookie",
+ "document-features",
+ "idna",
+ "log",
+ "publicsuffix",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "url",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -767,6 +786,12 @@ dependencies = [
 "syn 2.0.108",
 ]

+[[package]]
+name = "data-url"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"
+
 [[package]]
 name = "deranged"
 version = "0.5.5"
@@ -871,6 +896,15 @@ dependencies = [
 "syn 2.0.108",
 ]

+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
 [[package]]
 name = "dpi"
 version = "0.1.2"
@@ -1365,8 +1399,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -1376,9 +1412,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "r-efi",
 "wasip2",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -1548,6 +1586,25 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "h2"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.3.1",
+ "indexmap 2.12.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -1677,7 +1734,7 @@ dependencies = [
 "futures-channel",
 "futures-core",
 "futures-util",
- "h2",
+ "h2 0.3.27",
 "http 0.2.12",
 "http-body 0.4.6",
 "httparse",
@@ -1701,6 +1758,7 @@ dependencies = [
 "bytes",
 "futures-channel",
 "futures-core",
+ "h2 0.4.12",
 "http 1.3.1",
 "http-body 1.0.1",
 "httparse",
@@ -1712,6 +1770,23 @@ dependencies = [
 "want",
 ]

+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http 1.3.1",
+ "hyper 1.7.0",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
 [[package]]
 name = "hyper-tls"
 version = "0.5.0"
@@ -1744,9 +1819,11 @@ dependencies = [
 "percent-encoding",
 "pin-project-lite",
 "socket2 0.6.1",
+ "system-configuration 0.6.1",
 "tokio",
 "tower-service",
 "tracing",
+ "windows-registry",
 ]

 [[package]]
@@ -2057,6 +2134,16 @@ dependencies = [
 "unicode-segmentation",
 ]

+[[package]]
+name = "keyring"
+version = "3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
+dependencies = [
+ "log",
+ "zeroize",
+]
+
 [[package]]
 name = "kuchikiki"
 version = "0.8.8-speedreader"
@@ -2137,6 +2224,12 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"

+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -2155,6 +2248,12 @@ dependencies = [
 "value-bag",
 ]

+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "mac"
 version = "0.1.1"
@@ -3092,6 +3191,12 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
 [[package]]
 name = "ptr_meta"
 version = "0.1.4"
@@ -3112,6 +3217,16 @@ dependencies = [
 "syn 1.0.109",
 ]

+[[package]]
+name = "publicsuffix"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42ea446cab60335f76979ec15e12619a2165b5ae2c12166bef27d283a9fadf"
+dependencies = [
+ "idna",
+ "psl-types",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.38.3"
@@ -3121,6 +3236,61 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2 0.6.1",
+ "thiserror 2.0.17",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.17",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.6.1",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.41"
@@ -3167,6 +3337,16 @@ dependencies = [
 "rand_core 0.6.4",
 ]

+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@@ -3187,6 +3367,16 @@ dependencies = [
 "rand_core 0.6.4",
 ]

+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
+]
+
 [[package]]
 name = "rand_core"
 version = "0.5.1"
@@ -3205,6 +3395,15 @@ dependencies = [
 "getrandom 0.2.16",
 ]

+[[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
 [[package]]
 name = "rand_hc"
 version = "0.2.0"
@@ -3318,7 +3517,7 @@ dependencies = [
 "encoding_rs",
 "futures-core",
 "futures-util",
- "h2",
+ "h2 0.3.27",
 "http 0.2.12",
 "http-body 0.4.6",
 "hyper 0.14.32",
@@ -3336,7 +3535,7 @@ dependencies = [
 "serde_json",
 "serde_urlencoded",
 "sync_wrapper 0.1.2",
- "system-configuration",
+ "system-configuration 0.5.1",
 "tokio",
 "tokio-native-tls",
 "tower-service",
@@ -3355,22 +3554,32 @@ checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
 dependencies = [
 "base64 0.22.1",
 "bytes",
+ "cookie",
+ "cookie_store",
+ "encoding_rs",
 "futures-core",
 "futures-util",
+ "h2 0.4.12",
 "http 1.3.1",
 "http-body 1.0.1",
 "http-body-util",
 "hyper 1.7.0",
+ "hyper-rustls",
 "hyper-util",
 "js-sys",
 "log",
+ "mime",
 "percent-encoding",
 "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
 "serde",
 "serde_json",
 "serde_urlencoded",
 "sync_wrapper 1.0.2",
 "tokio",
+ "tokio-rustls",
 "tokio-util",
 "tower",
 "tower-http",
@@ -3380,6 +3589,21 @@ dependencies = [
 "wasm-bindgen-futures",
 "wasm-streams",
 "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.16",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -3427,6 +3651,12 @@ dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -3449,6 +3679,20 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "rustls"
+version = "0.23.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls-pemfile"
 version = "1.0.4"
@@ -3458,6 +3702,27 @@ dependencies = [
 "base64 0.21.7",
 ]

+[[package]]
+name = "rustls-pki-types"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94182ad936a0c91c324cd46c6511b9510ed16af436d7b5bab34beab0afd55f7a"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -3952,6 +4217,7 @@ version = "0.1.0"
 dependencies = [
 "core-foundation 0.10.1",
 "core-services",
+ "keyring",
 "log",
 "reqwest 0.11.27",
 "serde",
@@ -3959,9 +4225,11 @@ dependencies = [
 "tauri",
 "tauri-build",
 "tauri-plugin-fs",
+ "tauri-plugin-http",
 "tauri-plugin-log",
 "tauri-plugin-shell",
 "tauri-plugin-single-instance",
+ "tauri-plugin-store",
 "tokio",
 ]

@@ -3996,6 +4264,12 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "swift-rs"
 version = "1.0.7"
@@ -4063,7 +4337,18 @@ checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
 dependencies = [
 "bitflags 1.3.2",
 "core-foundation 0.9.4",
- "system-configuration-sys",
+ "system-configuration-sys 0.5.0",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.9.4",
+ "system-configuration-sys 0.6.0",
 ]

 [[package]]
@@ -4076,6 +4361,16 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "system-deps"
 version = "6.2.2"
@@ -4305,6 +4600,30 @@ dependencies = [
 "url",
 ]

+[[package]]
+name = "tauri-plugin-http"
+version = "2.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c00685aceab12643cf024f712ab0448ba8fcadf86f2391d49d2e5aa732aacc70"
+dependencies = [
+ "bytes",
+ "cookie_store",
+ "data-url",
+ "http 1.3.1",
+ "regex",
+ "reqwest 0.12.24",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.17",
+ "tokio",
+ "url",
+ "urlpattern",
+]
+
 [[package]]
 name = "tauri-plugin-log"
 version = "2.7.1"
@@ -4363,6 +4682,22 @@ dependencies = [
 "zbus",
 ]

+[[package]]
+name = "tauri-plugin-store"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59a77036340a97eb5bbe1b3209c31e5f27f75e6f92a52fd9dd4b211ef08bf310"
+dependencies = [
+ "dunce",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "thiserror 2.0.17",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "tauri-runtime"
 version = "2.9.1"
@@ -4596,9 +4931,21 @@ dependencies = [
 "mio",
 "pin-project-lite",
 "socket2 0.6.1",
+ "tokio-macros",
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "tokio-macros"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.108",
+]
+
 [[package]]
 name = "tokio-native-tls"
 version = "0.3.1"
@@ -4609,6 +4956,16 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.16"
@@ -4898,6 +5255,12 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"

+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.5.7"
@@ -5131,6 +5494,16 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "webkit2gtk"
 version = "2.0.1"
@@ -5175,6 +5548,15 @@ dependencies = [
 "system-deps",
 ]

+[[package]]
+name = "webpki-roots"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2878ef029c47c6e8cf779119f20fcf52bde7ad42a731b2a304bc221df17571e"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.38.0"
@@ -5360,6 +5742,17 @@ dependencies = [
 "windows-link 0.1.3",
 ]

+[[package]]
+name = "windows-registry"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
+dependencies = [
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -5962,6 +6355,12 @@ dependencies = [
 "synstructure",
 ]

+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
 [[package]]
 name = "zerotrie"
 version = "0.2.2"
@@ -28,7 +28,10 @@ tauri = { version = "2.9.0", features = [ "devtools"] }
 tauri-plugin-log = "2.0.0-rc"
 tauri-plugin-shell = "2.1.0"
 tauri-plugin-fs = "2.4.4"
+tauri-plugin-http = "2.4.4"
 tauri-plugin-single-instance = "2.0.1"
+tauri-plugin-store = "2.1.0"
+keyring = "3.6.1"
 tokio = { version = "1.0", features = ["time"] }
 reqwest = { version = "0.11", features = ["json"] }

@@ -7,9 +7,18 @@
  ],
  "permissions": [
    "core:default",
-    { 
-    "identifier": "fs:allow-read-file",
-    "allow": [{ "path": "**" }]
-   }
+    "http:default",
+    {
+      "identifier": "http:allow-fetch",
+      "allow": [
+        { "url": "http://localhost:*" },
+        { "url": "http://127.0.0.1:*" },
+        { "url": "https://*" }
+      ]
+    },
+    {
+      "identifier": "fs:allow-read-file",
+      "allow": [{ "path": "**" }]
+    }
  ]
 }
@@ -0,0 +1,215 @@
+use keyring::Entry;
+use serde::{Deserialize, Serialize};
+use tauri::AppHandle;
+use tauri_plugin_store::StoreExt;
+
+const STORE_FILE: &str = "connection.json";
+const USER_INFO_KEY: &str = "user_info";
+const KEYRING_SERVICE: &str = "stirling-pdf";
+const KEYRING_TOKEN_KEY: &str = "auth-token";
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub struct UserInfo {
+    pub username: String,
+    pub email: Option<String>,
+}
+
+fn get_keyring_entry() -> Result<Entry, String> {
+    Entry::new(KEYRING_SERVICE, KEYRING_TOKEN_KEY)
+        .map_err(|e| format!("Failed to access keyring: {}", e))
+}
+
+#[tauri::command]
+pub async fn save_auth_token(_app_handle: AppHandle, token: String) -> Result<(), String> {
+    log::info!("Saving auth token to keyring");
+
+    let entry = get_keyring_entry()?;
+
+    entry
+        .set_password(&token)
+        .map_err(|e| format!("Failed to save token to keyring: {}", e))?;
+
+    log::info!("Auth token saved successfully");
+    Ok(())
+}
+
+#[tauri::command]
+pub async fn get_auth_token(_app_handle: AppHandle) -> Result<Option<String>, String> {
+    log::debug!("Retrieving auth token from keyring");
+
+    let entry = get_keyring_entry()?;
+
+    match entry.get_password() {
+        Ok(token) => Ok(Some(token)),
+        Err(keyring::Error::NoEntry) => Ok(None),
+        Err(e) => Err(format!("Failed to retrieve token: {}", e)),
+    }
+}
+
+#[tauri::command]
+pub async fn clear_auth_token(_app_handle: AppHandle) -> Result<(), String> {
+    log::info!("Clearing auth token from keyring");
+
+    let entry = get_keyring_entry()?;
+
+    // Delete the token - ignore error if it doesn't exist
+    match entry.delete_credential() {
+        Ok(_) => {
+            log::info!("Auth token cleared successfully");
+            Ok(())
+        }
+        Err(keyring::Error::NoEntry) => {
+            log::info!("Auth token was already cleared");
+            Ok(())
+        }
+        Err(e) => Err(format!("Failed to clear token: {}", e)),
+    }
+}
+
+#[tauri::command]
+pub async fn save_user_info(
+    app_handle: AppHandle,
+    username: String,
+    email: Option<String>,
+) -> Result<(), String> {
+    log::info!("Saving user info for: {}", username);
+
+    let user_info = UserInfo { username, email };
+
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    store.set(
+        USER_INFO_KEY,
+        serde_json::to_value(&user_info)
+            .map_err(|e| format!("Failed to serialize user info: {}", e))?,
+    );
+
+    store
+        .save()
+        .map_err(|e| format!("Failed to save store: {}", e))?;
+
+    log::info!("User info saved successfully");
+    Ok(())
+}
+
+#[tauri::command]
+pub async fn get_user_info(app_handle: AppHandle) -> Result<Option<UserInfo>, String> {
+    log::debug!("Retrieving user info");
+
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    let user_info: Option<UserInfo> = store
+        .get(USER_INFO_KEY)
+        .and_then(|v| serde_json::from_value(v.clone()).ok());
+
+    Ok(user_info)
+}
+
+#[tauri::command]
+pub async fn clear_user_info(app_handle: AppHandle) -> Result<(), String> {
+    log::info!("Clearing user info");
+
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    store.delete(USER_INFO_KEY);
+
+    store
+        .save()
+        .map_err(|e| format!("Failed to save store: {}", e))?;
+
+    log::info!("User info cleared successfully");
+    Ok(())
+}
+
+// Response types for Spring Boot login
+#[derive(Debug, Deserialize)]
+struct SpringBootSession {
+    access_token: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct SpringBootUser {
+    username: String,
+    email: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct SpringBootLoginResponse {
+    session: SpringBootSession,
+    user: SpringBootUser,
+}
+
+#[derive(Debug, Serialize)]
+pub struct LoginResponse {
+    pub token: String,
+    pub username: String,
+    pub email: Option<String>,
+}
+
+/// Login command - makes HTTP request from Rust to bypass CORS
+/// Supports Spring Boot authentication (self-hosted)
+#[tauri::command]
+pub async fn login(
+    server_url: String,
+    username: String,
+    password: String,
+) -> Result<LoginResponse, String> {
+    log::info!("Login attempt for user: {} to server: {}", username, server_url);
+
+    // Build login URL
+    let login_url = format!("{}/api/v1/auth/login", server_url.trim_end_matches('/'));
+    log::debug!("Login URL: {}", login_url);
+
+    // Create HTTP client
+    let client = reqwest::Client::new();
+
+    // Make login request
+    let response = client
+        .post(&login_url)
+        .json(&serde_json::json!({
+            "username": username,
+            "password": password,
+        }))
+        .send()
+        .await
+        .map_err(|e| format!("Network error: {}", e))?;
+
+    let status = response.status();
+    log::debug!("Login response status: {}", status);
+
+    if !status.is_success() {
+        let error_text = response
+            .text()
+            .await
+            .unwrap_or_else(|_| "Unknown error".to_string());
+        log::error!("Login failed with status {}: {}", status, error_text);
+
+        return Err(if status.as_u16() == 401 {
+            "Invalid username or password".to_string()
+        } else if status.as_u16() == 403 {
+            "Access denied".to_string()
+        } else {
+            format!("Login failed: {}", status)
+        });
+    }
+
+    // Parse Spring Boot response format
+    let login_response: SpringBootLoginResponse = response
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse response: {}", e))?;
+
+    log::info!("Login successful for user: {}", login_response.user.username);
+
+    Ok(LoginResponse {
+        token: login_response.session.access_token,
+        username: login_response.user.username,
+        email: login_response.user.email,
+    })
+}
@@ -3,10 +3,12 @@ use tauri::Manager;
 use std::sync::Mutex;
 use std::path::PathBuf;
 use crate::utils::add_log;
+use crate::state::connection_state::{AppConnectionState, ConnectionMode};

-// Store backend process handle globally
+// Store backend process handle and port globally
 static BACKEND_PROCESS: Mutex<Option<tauri_plugin_shell::process::CommandChild>> = Mutex::new(None);
 static BACKEND_STARTING: Mutex<bool> = Mutex::new(false);
+static BACKEND_PORT: Mutex<Option<u16>> = Mutex::new(None);

 // Helper function to reset starting flag
 fn reset_starting_flag() {
@@ -14,6 +16,20 @@ fn reset_starting_flag() {
    *starting_guard = false;
 }

+// Extract port number from "Stirling-PDF running on port: PORT" log line
+fn extract_port_from_running_log(log_line: &str) -> Option<u16> {
+    // Look for pattern: "running on port: PORT"
+    if let Some(start) = log_line.find("running on port: ") {
+        let after_prefix = &log_line[start + 17..]; // Skip "running on port: "
+        // Take digits until whitespace or end of line
+        let port_str: String = after_prefix.chars()
+            .take_while(|c| c.is_ascii_digit())
+            .collect();
+        return port_str.parse::<u16>().ok();
+    }
+    None
+}
+
 // Check if backend is already running or starting
 fn check_backend_status() -> Result<(), String> {
    // Check if backend is already running
@@ -24,7 +40,7 @@ fn check_backend_status() -> Result<(), String> {
            return Err("Backend already running".to_string());
        }
    }
-    
+
    // Check and set starting flag to prevent multiple simultaneous starts
    {
        let mut starting_guard = BACKEND_STARTING.lock().unwrap();
@@ -34,7 +50,7 @@ fn check_backend_status() -> Result<(), String> {
        }
        *starting_guard = true;
    }
-    
+
    Ok(())
 }

@@ -46,13 +62,13 @@ fn find_bundled_jre(resource_dir: &PathBuf) -> Result<PathBuf, String> {
    } else {
        jre_dir.join("bin").join("java")
    };
-    
+
    if !java_executable.exists() {
        let error_msg = format!("❌ Bundled JRE not found at: {:?}", java_executable);
        add_log(error_msg.clone());
        return Err(error_msg);
    }
-    
+
    add_log(format!("✅ Found bundled JRE: {:?}", java_executable));
    Ok(java_executable)
 }
@@ -77,20 +93,20 @@ fn find_stirling_jar(resource_dir: &PathBuf) -> Result<PathBuf, String> {
                    .unwrap_or(false)
        })
        .collect();
-    
+
    if jar_files.is_empty() {
        let error_msg = "No Stirling-PDF JAR found in libs directory.".to_string();
        add_log(error_msg.clone());
        return Err(error_msg);
    }
-    
+
    // Sort by filename to get the latest version (case-insensitive)
    jar_files.sort_by(|a, b| {
        let name_a = a.file_name().to_string_lossy().to_ascii_lowercase();
        let name_b = b.file_name().to_string_lossy().to_ascii_lowercase();
        name_b.cmp(&name_a) // Reverse order to get latest first
    });
-    
+
    let jar_path = jar_files[0].path();
    add_log(format!("📋 Selected JAR: {:?}", jar_path.file_name().unwrap()));
    Ok(jar_path)
@@ -123,23 +139,23 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
        let home = std::env::var("HOME").unwrap_or_else(|_| "/tmp".to_string());
        PathBuf::from(home).join(".config").join("Stirling-PDF")
    };
-    
+
    // Create subdirectories for different purposes
    let config_dir = app_data_dir.join("configs");
    let log_dir = app_data_dir.join("logs");
    let work_dir = app_data_dir.join("workspace");
-    
+
    // Create all necessary directories
    std::fs::create_dir_all(&app_data_dir).ok();
    std::fs::create_dir_all(&log_dir).ok();
    std::fs::create_dir_all(&work_dir).ok();
    std::fs::create_dir_all(&config_dir).ok();
-    
+
    add_log(format!("📁 App data directory: {}", app_data_dir.display()));
    add_log(format!("📁 Log directory: {}", log_dir.display()));
    add_log(format!("📁 Working directory: {}", work_dir.display()));
    add_log(format!("📁 Config directory: {}", config_dir.display()));
-    
+
    // Define all Java options with Tauri-specific paths
    let log_path_option = format!("-Dlogging.file.path={}", log_dir.display());

@@ -150,10 +166,13 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
        "-DSTIRLING_PDF_TAURI_MODE=true",
        &log_path_option,
        "-Dlogging.file.name=stirling-pdf.log",
+        "-Dserver.port=0",  // Let OS assign an available port
+        "-Dsecurity.enableLogin=false",  // Disable login for desktop mode
+        "-Dsecurity.csrfDisabled=true",  // Disable CSRF for desktop mode
        "-jar",
-        jar_path.to_str().unwrap()
+        jar_path.to_str().unwrap(),
    ];
-    
+
    // Log the equivalent command for external testing
    let java_command = format!(
        "TAURI_PARENT_PID={} \"{}\" {}",
@@ -163,14 +182,14 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
    );
    add_log(format!("🔧 Equivalent command: {}", java_command));
    add_log(format!("📁 Backend logs will be in: {}", log_dir.display()));
-    
+
    // Additional macOS-specific checks
    if cfg!(target_os = "macos") {
        // Check if java executable has execute permissions
        if let Ok(metadata) = std::fs::metadata(java_path) {
            let permissions = metadata.permissions();
            add_log(format!("🔍 Java executable permissions: {:?}", permissions));
-            
+
            #[cfg(unix)]
            {
                use std::os::unix::fs::PermissionsExt;
@@ -181,7 +200,7 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
                }
            }
        }
-        
+
        // Check if we can read the JAR file
        if let Ok(metadata) = std::fs::metadata(jar_path) {
            add_log(format!("📦 JAR file size: {} bytes", metadata.len()));
@@ -189,7 +208,7 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
            add_log("⚠️ Cannot read JAR file metadata".to_string());
        }
    }
-    
+
    let sidecar_command = app
        .shell()
        .command(java_path.to_str().unwrap())
@@ -199,9 +218,9 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
        .env("STIRLING_PDF_CONFIG_DIR", config_dir.to_str().unwrap())
        .env("STIRLING_PDF_LOG_DIR", log_dir.to_str().unwrap())
        .env("STIRLING_PDF_WORK_DIR", work_dir.to_str().unwrap());
-    
+
    add_log("⚙️ Starting backend with bundled JRE...".to_string());
-    
+
    let (rx, child) = sidecar_command
        .spawn()
        .map_err(|e| {
@@ -209,18 +228,18 @@ fn run_stirling_pdf_jar(app: &tauri::AppHandle, java_path: &PathBuf, jar_path: &
            add_log(error_msg.clone());
            error_msg
        })?;
-    
+
    // Store the process handle
    {
        let mut process_guard = BACKEND_PROCESS.lock().unwrap();
        *process_guard = Some(child);
    }
-    
+
    add_log("✅ Backend started with bundled JRE, monitoring output...".to_string());
-    
+
    // Start monitoring output
    monitor_backend_output(rx);
-    
+
    Ok(())
 }

@@ -229,7 +248,7 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
    tokio::spawn(async move {
        let mut _startup_detected = false;
        let mut error_count = 0;
-        
+
        while let Some(event) = rx.recv().await {
            match event {
                tauri_plugin_shell::process::CommandEvent::Stdout(output) => {
@@ -237,17 +256,22 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
                    // Strip exactly one trailing newline to avoid double newlines
                    let output_str = output_str.strip_suffix('\n').unwrap_or(&output_str);
                    add_log(format!("📤 Backend: {}", output_str));
-                    
-                    // Look for startup indicators
-                    if output_str.contains("Started SPDFApplication") || 
-                       output_str.contains("Navigate to "){
+
+                    // Look for actual runtime port from web server initialization
+                    // Format: "Stirling-PDF running on port: PORT"
+                    if output_str.contains("running on port:") {
                        _startup_detected = true;
-                        add_log(format!("🎉 Backend startup detected: {}", output_str));
+                        if let Some(port) = extract_port_from_running_log(&output_str) {
+                            let mut port_guard = BACKEND_PORT.lock().unwrap();
+                            *port_guard = Some(port);
+                            add_log(format!("🎉 Backend started on port: {}", port));
+                            add_log(format!("🔌 Navigate to: http://localhost:{}/", port));
+                        }
                    }
-                    
-                    // Look for port binding
-                    if output_str.contains("8080") {
-                        add_log(format!("🔌 Port 8080 related output: {}", output_str));
+
+                    if output_str.contains("Started SPDFApplication") {
+                        _startup_detected = true;
+                        add_log(format!("🎉 Backend startup completed: {}", output_str));
                    }
                }
                tauri_plugin_shell::process::CommandEvent::Stderr(output) => {
@@ -255,13 +279,13 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
                    // Strip exactly one trailing newline to avoid double newlines
                    let output_str = output_str.strip_suffix('\n').unwrap_or(&output_str);
                    add_log(format!("📥 Backend Error: {}", output_str));
-                    
+
                    // Look for error indicators
                    if output_str.contains("ERROR") || output_str.contains("Exception") || output_str.contains("FATAL") {
                        error_count += 1;
                        add_log(format!("⚠️ Backend error #{}: {}", error_count, output_str));
                    }
-                    
+
                    // Look for specific common issues
                    if output_str.contains("Address already in use") {
                        add_log("🚨 CRITICAL: Port 8080 is already in use by another process!".to_string());
@@ -299,7 +323,7 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh
                }
            }
        }
-        
+
        if error_count > 0 {
            println!("⚠️ Backend process ended with {} errors detected", error_count);
        }
@@ -308,14 +332,36 @@ fn monitor_backend_output(mut rx: tauri::async_runtime::Receiver<tauri_plugin_sh

 // Command to start the backend with bundled JRE
 #[tauri::command]
-pub async fn start_backend(app: tauri::AppHandle) -> Result<String, String> {
+pub async fn start_backend(
+    app: tauri::AppHandle,
+    connection_state: tauri::State<'_, AppConnectionState>,
+) -> Result<String, String> {
    add_log("🚀 start_backend() called - Attempting to start backend with bundled JRE...".to_string());
-    
+
+    // Check connection mode
+    let mode = {
+        let state = connection_state.0.lock().map_err(|e| {
+            let error_msg = format!("❌ Failed to access connection state: {}", e);
+            add_log(error_msg.clone());
+            error_msg
+        })?;
+        state.mode.clone()
+    };
+
+    match mode {
+        ConnectionMode::Offline => {
+            add_log("🔌 Running in Offline mode - starting local backend".to_string());
+        }
+        ConnectionMode::Server => {
+            add_log("🌐 Running in Server mode - starting local backend (for hybrid execution support)".to_string());
+        }
+    }
+
    // Check if backend is already running or starting
    if let Err(msg) = check_backend_status() {
        return Ok(msg);
    }
-    
+
    // Use Tauri's resource API to find the bundled JRE and JAR
    let resource_dir = app.path().resource_dir().map_err(|e| {
        let error_msg = format!("❌ Failed to get resource directory: {}", e);
@@ -323,53 +369,60 @@ pub async fn start_backend(app: tauri::AppHandle) -> Result<String, String> {
        reset_starting_flag();
        error_msg
    })?;
-    
+
    add_log(format!("🔍 Resource directory: {:?}", resource_dir));
-    
+
    // Find the bundled JRE
    let java_executable = find_bundled_jre(&resource_dir).map_err(|e| {
        reset_starting_flag();
        e
    })?;
-    
+
    // Find the Stirling-PDF JAR
    let jar_path = find_stirling_jar(&resource_dir).map_err(|e| {
        reset_starting_flag();
        e
    })?;
-    
+
    // Normalize the paths to remove Windows UNC prefix
    let normalized_java_path = normalize_path(&java_executable);
    let normalized_jar_path = normalize_path(&jar_path);
-    
+
    add_log(format!("📦 Found JAR file: {:?}", jar_path));
    add_log(format!("📦 Normalized JAR path: {:?}", normalized_jar_path));
    add_log(format!("📦 Normalized Java path: {:?}", normalized_java_path));
-    
+
    // Create and start the Java command
    run_stirling_pdf_jar(&app, &normalized_java_path, &normalized_jar_path).map_err(|e| {
        reset_starting_flag();
        e
    })?;
-    
+
    // Wait for the backend to start
    println!("⏳ Waiting for backend startup...");
    tokio::time::sleep(std::time::Duration::from_millis(10000)).await;
-    
+
    // Reset the starting flag since startup is complete
    reset_starting_flag();
    add_log("✅ Backend startup sequence completed, starting flag cleared".to_string());
-    
+
    Ok("Backend startup initiated successfully with bundled JRE".to_string())
 }

+// Get the dynamically assigned backend port
+#[tauri::command]
+pub fn get_backend_port() -> Option<u16> {
+    let port_guard = BACKEND_PORT.lock().unwrap();
+    *port_guard
+}
+
 // Cleanup function to stop backend on app exit
 pub fn cleanup_backend() {
    let mut process_guard = BACKEND_PROCESS.lock().unwrap();
    if let Some(child) = process_guard.take() {
        let pid = child.pid();
        add_log(format!("🧹 App shutting down, cleaning up backend process (PID: {})", pid));
-        
+
        match child.kill() {
            Ok(_) => {
                add_log(format!("✅ Backend process (PID: {}) terminated during cleanup", pid));
@@ -380,4 +433,4 @@ pub fn cleanup_backend() {
            }
        }
    }
-}
+}
@@ -0,0 +1,111 @@
+use crate::state::connection_state::{
+    AppConnectionState,
+    ConnectionMode,
+    ServerConfig,
+};
+use serde::{Deserialize, Serialize};
+use tauri::{AppHandle, State};
+use tauri_plugin_store::StoreExt;
+
+const STORE_FILE: &str = "connection.json";
+const FIRST_LAUNCH_KEY: &str = "setup_completed";
+const CONNECTION_MODE_KEY: &str = "connection_mode";
+const SERVER_CONFIG_KEY: &str = "server_config";
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ConnectionConfig {
+    pub mode: ConnectionMode,
+    pub server_config: Option<ServerConfig>,
+}
+
+#[tauri::command]
+pub async fn get_connection_config(
+    app_handle: AppHandle,
+    state: State<'_, AppConnectionState>,
+) -> Result<ConnectionConfig, String> {
+    // Try to load from store
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    let mode = store
+        .get(CONNECTION_MODE_KEY)
+        .and_then(|v| serde_json::from_value(v.clone()).ok())
+        .unwrap_or(ConnectionMode::Offline);
+
+    let server_config: Option<ServerConfig> = store
+        .get(SERVER_CONFIG_KEY)
+        .and_then(|v| serde_json::from_value(v.clone()).ok());
+
+    // Update in-memory state
+    if let Ok(mut conn_state) = state.0.lock() {
+        conn_state.mode = mode.clone();
+        conn_state.server_config = server_config.clone();
+    }
+
+    Ok(ConnectionConfig {
+        mode,
+        server_config,
+    })
+}
+
+#[tauri::command]
+pub async fn set_connection_mode(
+    app_handle: AppHandle,
+    state: State<'_, AppConnectionState>,
+    mode: ConnectionMode,
+    server_config: Option<ServerConfig>,
+) -> Result<(), String> {
+    log::info!("Setting connection mode: {:?}", mode);
+
+    // Update in-memory state
+    if let Ok(mut conn_state) = state.0.lock() {
+        conn_state.mode = mode.clone();
+        conn_state.server_config = server_config.clone();
+    }
+
+    // Save to store
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    store.set(
+        CONNECTION_MODE_KEY,
+        serde_json::to_value(&mode).map_err(|e| format!("Failed to serialize mode: {}", e))?,
+    );
+
+    if let Some(config) = &server_config {
+        store.set(
+            SERVER_CONFIG_KEY,
+            serde_json::to_value(config)
+                .map_err(|e| format!("Failed to serialize config: {}", e))?,
+        );
+    } else {
+        store.delete(SERVER_CONFIG_KEY);
+    }
+
+    // Mark setup as completed
+    store.set(FIRST_LAUNCH_KEY, serde_json::json!(true));
+
+    store
+        .save()
+        .map_err(|e| format!("Failed to save store: {}", e))?;
+
+    log::info!("Connection mode saved successfully");
+    Ok(())
+}
+
+
+#[tauri::command]
+pub async fn is_first_launch(app_handle: AppHandle) -> Result<bool, String> {
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    let setup_completed = store
+        .get(FIRST_LAUNCH_KEY)
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+
+    Ok(!setup_completed)
+}
@@ -1,36 +1,16 @@
-// Command to check if backend is healthy
+use reqwest;
+
 #[tauri::command]
-pub async fn check_backend_health() -> Result<bool, String> {
-    let client = reqwest::Client::builder()
+pub async fn check_backend_health(port: u16) -> Result<bool, String> {
+    let url = format!("http://localhost:{}/api/v1/info/status", port);
+
+    match reqwest::Client::new()
+        .get(&url)
        .timeout(std::time::Duration::from_secs(5))
-        .build()
-        .map_err(|e| format!("Failed to create HTTP client: {}", e))?;
-    
-    match client.get("http://localhost:8080/api/v1/info/status").send().await {
-        Ok(response) => {
-            let status = response.status();
-            if status.is_success() {
-                match response.text().await {
-                    Ok(_body) => {
-                        println!("✅ Backend health check successful");
-                        Ok(true)
-                    }
-                    Err(e) => {
-                        println!("⚠️ Failed to read health response: {}", e);
-                        Ok(false)
-                    }
-                }
-            } else {
-                println!("⚠️ Health check failed with status: {}", status);
-                Ok(false)
-            }
-        }
-        Err(e) => {
-            // Only log connection errors if they're not the common "connection refused" during startup
-            if !e.to_string().contains("connection refused") && !e.to_string().contains("No connection could be made") {
-                println!("❌ Health check error: {}", e);
-            }
-            Ok(false)
-        }
+        .send()
+        .await
+    {
+        Ok(response) => Ok(response.status().is_success()),
+        Err(_) => Ok(false), // Return false instead of error for connection failures
    }
-}
+}
@@ -1,9 +1,25 @@
 pub mod backend;
-pub mod health;
 pub mod files;
+pub mod connection;
+pub mod auth;
 pub mod default_app;
+pub mod health;

-pub use backend::{start_backend, cleanup_backend};
-pub use health::check_backend_health;
-pub use files::{get_opened_files, clear_opened_files, add_opened_file};
+pub use backend::{cleanup_backend, get_backend_port, start_backend};
+pub use files::{add_opened_file, clear_opened_files, get_opened_files};
+pub use connection::{
+    get_connection_config,
+    is_first_launch,
+    set_connection_mode,
+};
+pub use auth::{
+    clear_auth_token,
+    clear_user_info,
+    get_auth_token,
+    get_user_info,
+    login,
+    save_auth_token,
+    save_user_info,
+};
 pub use default_app::{is_default_pdf_handler, set_as_default_pdf_handler};
+pub use health::check_backend_health;
@@ -1,18 +1,31 @@
-use tauri::{RunEvent, WindowEvent, Emitter, Manager};
+use tauri::{Manager, RunEvent, WindowEvent, Emitter};

 mod utils;
 mod commands;
+mod state;

 use commands::{
-    start_backend,
-    check_backend_health,
-    get_opened_files,
-    clear_opened_files,
-    cleanup_backend,
    add_opened_file,
+    check_backend_health,
+    cleanup_backend,
+    clear_auth_token,
+    clear_opened_files,
+    clear_user_info,
    is_default_pdf_handler,
+    get_auth_token,
+    get_backend_port,
+    get_connection_config,
+    get_opened_files,
+    get_user_info,
+    is_first_launch,
+    login,
+    save_auth_token,
+    save_user_info,
+    set_connection_mode,
    set_as_default_pdf_handler,
+    start_backend,
 };
+use state::connection_state::AppConnectionState;
 use utils::{add_log, get_tauri_logs};

 #[cfg_attr(mobile, tauri::mobile_entry_point)]
@@ -20,6 +33,9 @@ pub fn run() {
  tauri::Builder::default()
    .plugin(tauri_plugin_shell::init())
    .plugin(tauri_plugin_fs::init())
+    .plugin(tauri_plugin_http::init())
+    .plugin(tauri_plugin_store::Builder::new().build())
+    .manage(AppConnectionState::default())
    .plugin(tauri_plugin_single_instance::init(|app, args, _cwd| {
      // This callback runs when a second instance tries to start
      add_log(format!("📂 Second instance detected with args: {:?}", args));
@@ -60,12 +76,23 @@ pub fn run() {
    })
    .invoke_handler(tauri::generate_handler![
      start_backend,
-      check_backend_health,
+      get_backend_port,
      get_opened_files,
      clear_opened_files,
      get_tauri_logs,
+      get_connection_config,
+      set_connection_mode,
      is_default_pdf_handler,
      set_as_default_pdf_handler,
+      is_first_launch,
+      check_backend_health,
+      login,
+      save_auth_token,
+      get_auth_token,
+      clear_auth_token,
+      save_user_info,
+      get_user_info,
+      clear_user_info,
    ])
    .build(tauri::generate_context!())
    .expect("error while building tauri application")
@@ -0,0 +1,45 @@
+use serde::{Deserialize, Serialize};
+use std::sync::Mutex;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum ConnectionMode {
+    Offline,
+    Server,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum ServerType {
+    SaaS,
+    SelfHosted,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ServerConfig {
+    pub url: String,
+    pub server_type: ServerType,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ConnectionState {
+    pub mode: ConnectionMode,
+    pub server_config: Option<ServerConfig>,
+}
+
+impl Default for ConnectionState {
+    fn default() -> Self {
+        Self {
+            mode: ConnectionMode::Offline,
+            server_config: None,
+        }
+    }
+}
+
+pub struct AppConnectionState(pub Mutex<ConnectionState>);
+
+impl Default for AppConnectionState {
+    fn default() -> Self {
+        Self(Mutex::new(ConnectionState::default()))
+    }
+}
@@ -0,0 +1 @@
+pub mod connection_state;
@@ -51,6 +51,11 @@
        "desktopTemplate": "stirling-pdf.desktop"
      }
    },
+    "windows": {
+      "certificateThumbprint": null,
+      "digestAlgorithm": "sha256",
+      "timestampUrl": "http://timestamp.digicert.com"
+    },
    "macOS": {
      "minimumSystemVersion": "10.15",
      "signingIdentity": null,
@@ -9,6 +9,7 @@ import VisibilityIcon from '@mui/icons-material/Visibility';
 import UnarchiveIcon from '@mui/icons-material/Unarchive';
 import PushPinIcon from '@mui/icons-material/PushPin';
 import PushPinOutlinedIcon from '@mui/icons-material/PushPinOutlined';
+import LockOpenIcon from '@mui/icons-material/LockOpen';
 import DragIndicatorIcon from '@mui/icons-material/DragIndicator';
 import { draggable, dropTargetForElements } from '@atlaskit/pragmatic-drag-and-drop/element/adapter';
 import { StirlingFileStub } from '@app/types/fileContext';
@@ -56,7 +57,14 @@ const FileEditorThumbnail = ({
  isSupported = true,
 }: FileEditorThumbnailProps) => {
  const { t } = useTranslation();
-  const { pinFile, unpinFile, isFilePinned, activeFiles, actions: fileActions } = useFileContext();
+  const {
+    pinFile,
+    unpinFile,
+    isFilePinned,
+    activeFiles,
+    actions: fileActions,
+    openEncryptedUnlockPrompt,
+  } = useFileContext();
  const { state } = useFileState();
  const hasError = state.ui.errorFileIds.includes(file.id);

@@ -77,6 +85,7 @@ const FileEditorThumbnail = ({
  const isZipFile = zipFileService.isZipFileStub(file);

  const pageCount = file.processedFile?.totalPages || 0;
+  const isEncrypted = Boolean(file.processedFile?.isEncrypted);

  const handleRef = useRef<HTMLSpanElement | null>(null);

@@ -301,6 +310,21 @@ const FileEditorThumbnail = ({

        {/* Action buttons group */}
        <div className={styles.headerActions}>
+          {isEncrypted && (
+            <Tooltip label={t('encryptedPdfUnlock.unlockPrompt', 'Unlock PDF to continue')}>
+              <ActionIcon
+                aria-label={t('encryptedPdfUnlock.unlockPrompt', 'Unlock PDF to continue')}
+                variant="subtle"
+                className={styles.headerIconButton}
+                onClick={(e) => {
+                  e.stopPropagation();
+                  openEncryptedUnlockPrompt(file.id);
+                }}
+              >
+                <LockOpenIcon fontSize="small" />
+              </ActionIcon>
+            </Tooltip>
+          )}
          {/* Pin/Unpin icon */}
          <Tooltip label={isPinned ? t('unpin', 'Unpin File (replace after tool run)') : t('pin', 'Pin File (keep active after tool run)')}>
            <ActionIcon
@@ -0,0 +1,85 @@
+import { Modal, Stack, Text, Button, PasswordInput, Group } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { type KeyboardEventHandler } from 'react';
+import { Z_INDEX_OVER_FULLSCREEN_SURFACE } from '@app/styles/zIndex';
+
+interface EncryptedPdfUnlockModalProps {
+  opened: boolean;
+  fileName?: string;
+  password: string;
+  errorMessage?: string | null;
+  isProcessing: boolean;
+  onPasswordChange: (value: string) => void;
+  onUnlock: () => void;
+  onSkip: () => void;
+}
+
+const EncryptedPdfUnlockModal = ({
+  opened,
+  fileName,
+  password,
+  errorMessage,
+  isProcessing,
+  onPasswordChange,
+  onUnlock,
+  onSkip,
+}: EncryptedPdfUnlockModalProps) => {
+  const { t } = useTranslation();
+
+  const handleKeyDown: KeyboardEventHandler<HTMLInputElement> = (event) => {
+    if (event.key === 'Enter' && !isProcessing && password.trim().length > 0) {
+      onUnlock();
+    }
+  };
+
+  return (
+    <Modal
+      opened={opened}
+      onClose={onSkip}
+      title={t('encryptedPdfUnlock.title', 'Remove password to continue')}
+      centered
+      size="md"
+      closeOnClickOutside={!isProcessing}
+      closeOnEscape={!isProcessing}
+      zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
+    >
+      <Stack gap="md">
+        <Text fw={600} ta="center">{fileName}</Text>
+        <Text c="dimmed" ta="center">
+          {t(
+            'encryptedPdfUnlock.description',
+            'This PDF is password protected. Enter the password so you can continue working with it.'
+          )}
+        </Text>
+
+        <Stack gap={4}>
+          <PasswordInput
+            label={t('encryptedPdfUnlock.password.label', 'PDF password')}
+            placeholder={t('encryptedPdfUnlock.password.placeholder', 'Enter the PDF password')}
+            value={password}
+            onChange={(event) => onPasswordChange(event.currentTarget.value)}
+            onKeyDown={handleKeyDown}
+            disabled={isProcessing}
+            autoFocus
+          />
+          {errorMessage ? (
+            <Text c="red" size="sm">
+              {errorMessage}
+            </Text>
+          ) : null}
+        </Stack>
+
+        <Group justify="space-between">
+          <Button variant="light" color="var(--mantine-color-gray-8)" onClick={onSkip} disabled={isProcessing}>
+            {t('encryptedPdfUnlock.skip', 'Skip for now')}
+          </Button>
+          <Button onClick={onUnlock} loading={isProcessing} disabled={password.trim().length === 0}>
+            {t('encryptedPdfUnlock.unlock', 'Unlock & Continue')}
+          </Button>
+        </Group>
+      </Stack>
+    </Modal>
+  );
+};
+
+export default EncryptedPdfUnlockModal;
@@ -53,11 +53,17 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({ hideTitle = false }) =>
    };

    const summary = await updateService.getUpdateSummary(config.appVersion, machineInfo);
-    if (summary) {
+    if (summary && summary.latest_version) {
      const isNewerVersion = updateService.compareVersions(summary.latest_version, config.appVersion) > 0;
      if (isNewerVersion) {
        setUpdateSummary(summary);
+      } else {
+        // Clear any existing update summary if user is on latest version
+        setUpdateSummary(null);
      }
+    } else {
+      // No update available (latest_version is null) - clear any existing update summary
+      setUpdateSummary(null);
    }
    setCheckingUpdate(false);
  };
@@ -128,83 +134,6 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({ hideTitle = false }) =>
        </Paper>
      )}

-      <Paper withBorder p="md" radius="md">
-        <Stack gap="md">
-          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
-            <div>
-              <Text fw={500} size="sm">
-                {t('settings.general.defaultToolPickerMode', 'Default tool picker mode')}
-              </Text>
-              <Text size="xs" c="dimmed" mt={4}>
-                {t('settings.general.defaultToolPickerModeDescription', 'Choose whether the tool picker opens in fullscreen or sidebar by default')}
-              </Text>
-            </div>
-            <SegmentedControl
-              value={preferences.defaultToolPanelMode}
-              onChange={(val: string) => updatePreference('defaultToolPanelMode', val as ToolPanelMode)}
-              data={[
-                { label: t('settings.general.mode.sidebar', 'Sidebar'), value: 'sidebar' },
-                { label: t('settings.general.mode.fullscreen', 'Fullscreen'), value: 'fullscreen' },
-              ]}
-            />
-          </div>
-          <Tooltip
-            label={t('settings.general.autoUnzipTooltip', 'Automatically extract ZIP files returned from API operations. Disable to keep ZIP files intact. This does not affect automation workflows.')}
-            multiline
-            w={300}
-            withArrow
-          >
-            <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', cursor: 'help' }}>
-              <div>
-                <Text fw={500} size="sm">
-                  {t('settings.general.autoUnzip', 'Auto-unzip API responses')}
-                </Text>
-                <Text size="xs" c="dimmed" mt={4}>
-                  {t('settings.general.autoUnzipDescription', 'Automatically extract files from ZIP responses')}
-                </Text>
-              </div>
-              <Switch
-                checked={preferences.autoUnzip}
-                onChange={(event) => updatePreference('autoUnzip', event.currentTarget.checked)}
-              />
-            </div>
-          </Tooltip>
-
-          <Tooltip
-            label={t('settings.general.autoUnzipFileLimitTooltip', 'Only unzip if the ZIP contains this many files or fewer. Set higher to extract larger ZIPs.')}
-            multiline
-            w={300}
-            withArrow
-          >
-            <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', cursor: 'help' }}>
-              <div>
-                <Text fw={500} size="sm">
-                  {t('settings.general.autoUnzipFileLimit', 'Auto-unzip file limit')}
-                </Text>
-                <Text size="xs" c="dimmed" mt={4}>
-                  {t('settings.general.autoUnzipFileLimitDescription', 'Maximum number of files to extract from ZIP')}
-                </Text>
-              </div>
-              <NumberInput
-                value={fileLimitInput}
-                onChange={setFileLimitInput}
-                onBlur={() => {
-                  const numValue = Number(fileLimitInput);
-                  const finalValue = (!fileLimitInput || isNaN(numValue) || numValue < 1 || numValue > 100) ? DEFAULT_AUTO_UNZIP_FILE_LIMIT : numValue;
-                  setFileLimitInput(finalValue);
-                  updatePreference('autoUnzipFileLimit', finalValue);
-                }}
-                min={1}
-                max={100}
-                step={1}
-                disabled={!preferences.autoUnzip}
-                style={{ width: 90 }}
-              />
-            </div>
-          </Tooltip>
-        </Stack>
-      </Paper>
-
      {/* Update Check Section */}
      {config?.appVersion && (
        <Paper withBorder p="md" radius="md">
@@ -292,6 +221,111 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({ hideTitle = false }) =>
        </Paper>
      )}

+      <Paper withBorder p="md" radius="md">
+        <Stack gap="md">
+          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
+            <div>
+              <Text fw={500} size="sm">
+                {t('settings.general.defaultToolPickerMode', 'Default tool picker mode')}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t('settings.general.defaultToolPickerModeDescription', 'Choose whether the tool picker opens in fullscreen or sidebar by default')}
+              </Text>
+            </div>
+            <SegmentedControl
+              value={preferences.defaultToolPanelMode}
+              onChange={(val: string) => updatePreference('defaultToolPanelMode', val as ToolPanelMode)}
+              data={[
+                { label: t('settings.general.mode.sidebar', 'Sidebar'), value: 'sidebar' },
+                { label: t('settings.general.mode.fullscreen', 'Fullscreen'), value: 'fullscreen' },
+              ]}
+            />
+          </div>
+          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
+            <div>
+              <Text fw={500} size="sm">
+                {t('settings.general.hideUnavailableTools', 'Hide unavailable tools')}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t('settings.general.hideUnavailableToolsDescription', 'Remove tools that have been disabled by your server instead of showing them greyed out.')}
+              </Text>
+            </div>
+            <Switch
+              checked={preferences.hideUnavailableTools}
+              onChange={(event) => updatePreference('hideUnavailableTools', event.currentTarget.checked)}
+            />
+          </div>
+          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
+            <div>
+              <Text fw={500} size="sm">
+                {t('settings.general.hideUnavailableConversions', 'Hide unavailable conversions')}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t('settings.general.hideUnavailableConversionsDescription', 'Remove disabled conversion options in the Convert tool instead of showing them greyed out.')}
+              </Text>
+            </div>
+            <Switch
+              checked={preferences.hideUnavailableConversions}
+              onChange={(event) => updatePreference('hideUnavailableConversions', event.currentTarget.checked)}
+            />
+          </div>
+          <Tooltip
+            label={t('settings.general.autoUnzipTooltip', 'Automatically extract ZIP files returned from API operations. Disable to keep ZIP files intact. This does not affect automation workflows.')}
+            multiline
+            w={300}
+            withArrow
+          >
+            <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', cursor: 'help' }}>
+              <div>
+                <Text fw={500} size="sm">
+                  {t('settings.general.autoUnzip', 'Auto-unzip API responses')}
+                </Text>
+                <Text size="xs" c="dimmed" mt={4}>
+                  {t('settings.general.autoUnzipDescription', 'Automatically extract files from ZIP responses')}
+                </Text>
+              </div>
+              <Switch
+                checked={preferences.autoUnzip}
+                onChange={(event) => updatePreference('autoUnzip', event.currentTarget.checked)}
+              />
+            </div>
+          </Tooltip>
+
+          <Tooltip
+            label={t('settings.general.autoUnzipFileLimitTooltip', 'Only unzip if the ZIP contains this many files or fewer. Set higher to extract larger ZIPs.')}
+            multiline
+            w={300}
+            withArrow
+          >
+            <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', cursor: 'help' }}>
+              <div>
+                <Text fw={500} size="sm">
+                  {t('settings.general.autoUnzipFileLimit', 'Auto-unzip file limit')}
+                </Text>
+                <Text size="xs" c="dimmed" mt={4}>
+                  {t('settings.general.autoUnzipFileLimitDescription', 'Maximum number of files to extract from ZIP')}
+                </Text>
+              </div>
+              <NumberInput
+                value={fileLimitInput}
+                onChange={setFileLimitInput}
+                onBlur={() => {
+                  const numValue = Number(fileLimitInput);
+                  const finalValue = (!fileLimitInput || isNaN(numValue) || numValue < 1 || numValue > 100) ? DEFAULT_AUTO_UNZIP_FILE_LIMIT : numValue;
+                  setFileLimitInput(finalValue);
+                  updatePreference('autoUnzipFileLimit', finalValue);
+                }}
+                min={1}
+                max={100}
+                step={1}
+                disabled={!preferences.autoUnzip}
+                style={{ width: 90 }}
+              />
+            </div>
+          </Tooltip>
+        </Stack>
+      </Paper>
+
      {/* Update Modal */}
      {updateSummary && config?.appVersion && config?.machineType && (
        <UpdateModal
@@ -4,7 +4,7 @@
 * Allows selecting files to attach to PDFs.
 */

-import { Stack, Text, Group, ActionIcon, Alert, ScrollArea, Button } from "@mantine/core";
+import { Stack, Text, Group, ActionIcon, ScrollArea, Button } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { AddAttachmentsParameters } from "@app/hooks/tools/addAttachments/useAddAttachmentsParameters";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -20,16 +20,7 @@ const AddAttachmentsSettings = ({ parameters, onParameterChange, disabled = fals

  return (
    <Stack gap="md">
-      <Alert color="blue" variant="light">
-        <Text size="sm">
-          {t("AddAttachmentsRequest.info", "Select files to attach to your PDF. These files will be embedded and accessible through the PDF's attachment panel.")}
-        </Text>
-      </Alert>
-
      <Stack gap="xs">
-        <Text size="sm" fw={500}>
-          {t("AddAttachmentsRequest.selectFiles", "Select Files to Attach")}
-        </Text>
        <input
          type="file"
          multiple
@@ -8,6 +8,7 @@ import { getConversionEndpoints } from "@app/data/toolsTaxonomy";
 import { useFileSelection } from "@app/contexts/FileContext";
 import { useFileState } from "@app/contexts/FileContext";
 import { detectFileExtension } from "@app/utils/fileUtils";
+import { usePreferences } from "@app/contexts/PreferencesContext";
 import GroupedFormatDropdown from "@app/components/tools/convert/GroupedFormatDropdown";
 import ConvertToImageSettings from "@app/components/tools/convert/ConvertToImageSettings";
 import ConvertFromImageSettings from "@app/components/tools/convert/ConvertFromImageSettings";
@@ -47,8 +48,12 @@ const ConvertSettings = ({
  const { setSelectedFiles } = useFileSelection();
  const { state, selectors } = useFileState();
  const activeFiles = state.files.ids;
+  const { preferences } = usePreferences();

-  const allEndpoints = useMemo(() => getConversionEndpoints(EXTENSION_TO_ENDPOINT), []);
+  const allEndpoints = useMemo(() => {
+    const endpoints = getConversionEndpoints(EXTENSION_TO_ENDPOINT);
+    return endpoints;
+  }, []);

  const { endpointStatus } = useMultipleEndpointsEnabled(allEndpoints);

@@ -56,7 +61,8 @@ const ConvertSettings = ({
    const endpointKey = EXTENSION_TO_ENDPOINT[fromExt]?.[toExt];
    if (!endpointKey) return false;

-    return endpointStatus[endpointKey] === true;
+    const isAvailable = endpointStatus[endpointKey] === true;
+    return isAvailable;
  };

  // Enhanced FROM options with endpoint availability
@@ -74,6 +80,12 @@ const ConvertSettings = ({
      };
    });

+    // Filter out unavailable source formats if preference is enabled
+    let filteredOptions = baseOptions;
+    if (preferences.hideUnavailableConversions) {
+      filteredOptions = baseOptions.filter(opt => opt.enabled !== false);
+    }
+
    // Add dynamic format option if current selection is a file-<extension> format
    if (parameters.fromExtension && parameters.fromExtension.startsWith('file-')) {
      const extension = parameters.fromExtension.replace('file-', '');
@@ -85,22 +97,32 @@ const ConvertSettings = ({
      };

      // Add the dynamic option at the beginning
-      return [dynamicOption, ...baseOptions];
+      return [dynamicOption, ...filteredOptions];
    }

-    return baseOptions;
-  }, [parameters.fromExtension, endpointStatus]);
+    return filteredOptions;
+  }, [parameters.fromExtension, endpointStatus, preferences.hideUnavailableConversions]);

  // Enhanced TO options with endpoint availability
  const enhancedToOptions = useMemo(() => {
    if (!parameters.fromExtension) return [];

    const availableOptions = getAvailableToExtensions(parameters.fromExtension) || [];
-    return availableOptions.map(option => ({
-      ...option,
-      enabled: isConversionAvailable(parameters.fromExtension, option.value)
-    }));
-  }, [parameters.fromExtension, endpointStatus]);
+    const enhanced = availableOptions.map(option => {
+      const enabled = isConversionAvailable(parameters.fromExtension, option.value);
+      return {
+        ...option,
+        enabled
+      };
+    });
+
+    // Filter out unavailable conversions if preference is enabled
+    if (preferences.hideUnavailableConversions) {
+      return enhanced.filter(opt => opt.enabled !== false);
+    }
+
+    return enhanced;
+  }, [parameters.fromExtension, endpointStatus, preferences.hideUnavailableConversions]);

  const resetParametersToDefaults = () => {
    onParameterChange('imageOptions', {
@@ -5,7 +5,7 @@ import { Tooltip } from '@app/components/shared/Tooltip';
 import HotkeyDisplay from '@app/components/hotkeys/HotkeyDisplay';
 import FavoriteStar from '@app/components/tools/toolPicker/FavoriteStar';
 import { ToolRegistryEntry, getSubcategoryColor } from '@app/data/toolsTaxonomy';
-import { getIconBackground, getIconStyle, getItemClasses, useToolMeta } from '@app/components/tools/fullscreen/shared';
+import { getIconBackground, getIconStyle, getItemClasses, useToolMeta, getDisabledLabel } from '@app/components/tools/fullscreen/shared';

 interface CompactToolItemProps {
  id: string;
@@ -17,7 +17,7 @@ interface CompactToolItemProps {

 const CompactToolItem: React.FC<CompactToolItemProps> = ({ id, tool, isSelected, onClick, tooltipPortalTarget }) => {
  const { t } = useTranslation();
-  const { binding, isFav, toggleFavorite, disabled } = useToolMeta(id, tool);
+  const { binding, isFav, toggleFavorite, disabled, disabledReason } = useToolMeta(id, tool);
  const categoryColor = getSubcategoryColor(tool.subcategoryId);
  const iconBg = getIconBackground(categoryColor, false);
  const iconClasses = 'tool-panel__fullscreen-list-icon';
@@ -73,9 +73,12 @@ const CompactToolItem: React.FC<CompactToolItemProps> = ({ id, tool, isSelected,
    </button>
  );

+  const { key: disabledKey, fallback: disabledFallback } = getDisabledLabel(disabledReason);
+  const disabledMessage = t(disabledKey, disabledFallback);
+
  const tooltipContent = disabled
    ? (
-      <span><strong>{t('toolPanel.fullscreen.comingSoon', 'Coming soon:')}</strong> {tool.description}</span>
+      <span><strong>{disabledMessage}</strong> {tool.description}</span>
    )
    : (
      <div style={{ display: 'flex', flexDirection: 'column', gap: '0.35rem' }}>
@@ -4,7 +4,7 @@ import { useTranslation } from 'react-i18next';
 import HotkeyDisplay from '@app/components/hotkeys/HotkeyDisplay';
 import FavoriteStar from '@app/components/tools/toolPicker/FavoriteStar';
 import { ToolRegistryEntry, getSubcategoryColor } from '@app/data/toolsTaxonomy';
-import { getIconBackground, getIconStyle, getItemClasses, useToolMeta } from '@app/components/tools/fullscreen/shared';
+import { getIconBackground, getIconStyle, getItemClasses, useToolMeta, getDisabledLabel } from '@app/components/tools/fullscreen/shared';

 interface DetailedToolItemProps {
  id: string;
@@ -15,7 +15,7 @@ interface DetailedToolItemProps {

 const DetailedToolItem: React.FC<DetailedToolItemProps> = ({ id, tool, isSelected, onClick }) => {
  const { t } = useTranslation();
-  const { binding, isFav, toggleFavorite, disabled } = useToolMeta(id, tool);
+  const { binding, isFav, toggleFavorite, disabled, disabledReason } = useToolMeta(id, tool);

  const categoryColor = getSubcategoryColor(tool.subcategoryId);
  const iconBg = getIconBackground(categoryColor, true);
@@ -34,6 +34,9 @@ const DetailedToolItem: React.FC<DetailedToolItemProps> = ({ id, tool, isSelecte
    iconNode = tool.icon;
  }

+  const { key: disabledKey, fallback: disabledFallback } = getDisabledLabel(disabledReason);
+  const disabledMessage = t(disabledKey, disabledFallback);
+
  return (
    <button
      type="button"
@@ -60,7 +63,12 @@ const DetailedToolItem: React.FC<DetailedToolItemProps> = ({ id, tool, isSelecte
          {tool.name}
        </Text>
        <Text size="sm" c="dimmed" className="tool-panel__fullscreen-description">
-          {tool.description}
+          {disabled ? (
+            <>
+              <strong>{disabledMessage} </strong>
+              {tool.description}
+            </>
+          ) : tool.description}
        </Text>
        {binding && (
          <div className="tool-panel__fullscreen-shortcut">
@@ -2,6 +2,7 @@ import { useHotkeys } from '@app/contexts/HotkeyContext';
 import { useToolWorkflow } from '@app/contexts/ToolWorkflowContext';
 import { ToolRegistryEntry } from '@app/data/toolsTaxonomy';
 import { ToolId } from '@app/types/toolId';
+import type { ToolAvailabilityMap } from '@app/hooks/useToolManagement';

 export const getItemClasses = (isDetailed: boolean): string => {
  return isDetailed ? 'tool-panel__fullscreen-item--detailed' : '';
@@ -22,23 +23,67 @@ export const getIconStyle = (): Record<string, string> => {
  return {};
 };

-export const isToolDisabled = (id: string, tool: ToolRegistryEntry): boolean => {
-  return !tool.component && !tool.link && id !== 'read' && id !== 'multiTool';
+export type ToolDisabledReason = 'comingSoon' | 'disabledByAdmin' | 'missingDependency' | 'unknownUnavailable' | null;
+
+export const getToolDisabledReason = (
+  id: string,
+  tool: ToolRegistryEntry,
+  toolAvailability?: ToolAvailabilityMap
+): ToolDisabledReason => {
+  if (!tool.component && !tool.link && id !== 'read' && id !== 'multiTool') {
+    return 'comingSoon';
+  }
+
+  const availabilityInfo = toolAvailability?.[id as ToolId];
+  if (availabilityInfo && availabilityInfo.available === false) {
+    if (availabilityInfo.reason === 'missingDependency') {
+      return 'missingDependency';
+    }
+    if (availabilityInfo.reason === 'disabledByAdmin') {
+      return 'disabledByAdmin';
+    }
+    return 'unknownUnavailable';
+  }
+
+  return null;
+};
+
+export const getDisabledLabel = (
+  disabledReason: ToolDisabledReason
+): { key: string; fallback: string } => {
+  if (disabledReason === 'missingDependency') {
+    return {
+      key: 'toolPanel.fullscreen.unavailableDependency',
+      fallback: 'Unavailable - required tool missing on server:'
+    };
+  }
+  if (disabledReason === 'disabledByAdmin' || disabledReason === 'unknownUnavailable') {
+    return {
+      key: 'toolPanel.fullscreen.unavailable',
+      fallback: 'Disabled by server administrator:'
+    };
+  }
+  return {
+    key: 'toolPanel.fullscreen.comingSoon',
+    fallback: 'Coming soon:'
+  };
 };

 export function useToolMeta(id: string, tool: ToolRegistryEntry) {
  const { hotkeys } = useHotkeys();
-  const { isFavorite, toggleFavorite } = useToolWorkflow();
+  const { isFavorite, toggleFavorite, toolAvailability } = useToolWorkflow();

  const isFav = isFavorite(id as ToolId);
  const binding = hotkeys[id as ToolId];
-  const disabled = isToolDisabled(id, tool);
+  const disabledReason = getToolDisabledReason(id, tool, toolAvailability);
+  const disabled = disabledReason !== null;

  return {
    binding,
    isFav,
    toggleFavorite: () => toggleFavorite(id as ToolId),
    disabled,
+    disabledReason,
  };
 }

@@ -1,24 +1,9 @@
-import { useTranslation } from 'react-i18next';
-import { Stack, Text, Alert } from '@mantine/core';
-import LocalIcon from '@app/components/shared/LocalIcon';
+import { Stack } from '@mantine/core';

 const RemoveAnnotationsSettings = () => {
-  const { t } = useTranslation();
-
  return (
    <Stack gap="md">
-      <Alert
-        icon={<LocalIcon icon="info-rounded" width="1.2rem" height="1.2rem" />}
-        title={t('removeAnnotations.info.title', 'About Remove Annotations')}
-        color="blue"
-        variant="light"
-      >
-        <Text size="sm">
-          {t('removeAnnotations.info.description',
-            'This tool will remove all annotations (comments, highlights, notes, etc.) from your PDF documents.'
-          )}
-        </Text>
-      </Alert>
+      {/* No settings needed for this tool - description is in tooltip */}
    </Stack>
  );
 };
@@ -12,6 +12,7 @@ import HotkeyDisplay from "@app/components/hotkeys/HotkeyDisplay";
 import FavoriteStar from "@app/components/tools/toolPicker/FavoriteStar";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { ToolId } from "@app/types/toolId";
+import { getToolDisabledReason, getDisabledLabel } from "@app/components/tools/fullscreen/shared";

 interface ToolButtonProps {
  id: ToolId;
@@ -26,12 +27,12 @@ interface ToolButtonProps {

 const ToolButton: React.FC<ToolButtonProps> = ({ id, tool, isSelected, onSelect, disableNavigation = false, matchedSynonym, hasStars = false }) => {
  const { t } = useTranslation();
-  // Special case: read and multiTool are navigational tools that are always available
-  const isUnavailable = !tool.component && !tool.link && id !== 'read' && id !== 'multiTool';
+  const { isFavorite, toggleFavorite, toolAvailability } = useToolWorkflow();
+  const disabledReason = getToolDisabledReason(id, tool, toolAvailability);
+  const isUnavailable = disabledReason !== null;
  const { hotkeys } = useHotkeys();
  const binding = hotkeys[id];
  const { getToolNavigation } = useToolNavigation();
-  const { isFavorite, toggleFavorite } = useToolWorkflow();
  const fav = isFavorite(id as ToolId);

  const handleClick = (id: ToolId) => {
@@ -48,8 +49,11 @@ const ToolButton: React.FC<ToolButtonProps> = ({ id, tool, isSelected, onSelect,
  // Get navigation props for URL support (only if navigation is not disabled)
  const navProps = !isUnavailable && !tool.link && !disableNavigation ? getToolNavigation(id, tool) : null;

+  const { key: disabledKey, fallback: disabledFallback } = getDisabledLabel(disabledReason);
+  const disabledMessage = t(disabledKey, disabledFallback);
+
  const tooltipContent = isUnavailable
-    ? (<span><strong>Coming soon:</strong> {tool.description}</span>)
+    ? (<span><strong>{disabledMessage}</strong> {tool.description}</span>)
    : (
      <div style={{ display: 'flex', flexDirection: 'column', gap: '0.35rem' }}>
        <span>{tool.description}</span>
@@ -0,0 +1,18 @@
+import { useTranslation } from 'react-i18next';
+import { TooltipContent } from '@app/types/tips';
+
+export const useAddAttachmentsTips = (): TooltipContent => {
+  const { t } = useTranslation();
+
+  return {
+    header: {
+      title: t("AddAttachmentsRequest.tooltip.header.title", "About Add Attachments")
+    },
+    tips: [
+      {
+        title: t("AddAttachmentsRequest.tooltip.description.title", "What it does"),
+        description: t("AddAttachmentsRequest.info", "Select files to attach to your PDF. These files will be embedded and accessible through the PDF's attachment panel."),
+      }
+    ]
+  };
+};
@@ -9,6 +9,10 @@ export const useAutoRenameTips = (): TooltipContent => {
      title: t("auto-rename.tooltip.header.title", "How Auto-Rename Works")
    },
    tips: [
+      {
+        title: t("auto-rename.tooltip.description.title", "What it does"),
+        description: t("auto-rename.description", "Automatically finds the title from your PDF content and uses it as the filename."),
+      },
      {
        title: t("auto-rename.tooltip.howItWorks.title", "Smart Renaming"),
        bullets: [
@@ -5,6 +5,9 @@ export const useMergeTips = (): TooltipContent => {
  const { t } = useTranslation();

  return {
+    header: {
+      title: t('merge.tooltip.header.title', 'Merge Settings Overview')
+    },
    tips: [
      {
        title: t('merge.removeDigitalSignature.tooltip.title', 'Remove Digital Signature'),
@@ -0,0 +1,20 @@
+import { useTranslation } from 'react-i18next';
+import { TooltipContent } from '@app/types/tips';
+
+export const useRemoveAnnotationsTips = (): TooltipContent => {
+  const { t } = useTranslation();
+
+  return {
+    header: {
+      title: t("removeAnnotations.tooltip.header.title", "About Remove Annotations")
+    },
+    tips: [
+      {
+        title: t("removeAnnotations.tooltip.description.title", "What it does"),
+        description: t('removeAnnotations.info.description',
+          'This tool will remove all annotations (comments, highlights, notes, etc.) from your PDF documents.'
+        ),
+      }
+    ]
+  };
+};
@@ -0,0 +1,288 @@
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
+import { waitFor, renderHook, act } from '@testing-library/react';
+import { AppConfigProvider, useAppConfig } from '@app/contexts/AppConfigContext';
+import apiClient from '@app/services/apiClient';
+import { ReactNode } from 'react';
+
+// Mock apiClient
+vi.mock('@app/services/apiClient');
+
+describe('AppConfigContext', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // Mock window.location.pathname
+    Object.defineProperty(window, 'location', {
+      value: { pathname: '/' },
+      writable: true,
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <AppConfigProvider>{children}</AppConfigProvider>
+  );
+
+  it('should fetch and provide app config on non-auth pages', async () => {
+    const mockConfig = {
+      enableLogin: false,
+      appNameNavbar: 'Stirling PDF',
+      languages: ['en-US', 'en-GB'],
+    };
+
+    vi.mocked(apiClient.get).mockResolvedValueOnce({
+      status: 200,
+      data: mockConfig,
+    } as any);
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    // Initially loading
+    expect(result.current.loading).toBe(true);
+    expect(result.current.config).toBeNull();
+
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+      expect(result.current.config).toEqual(mockConfig);
+      expect(result.current.error).toBeNull();
+    });
+
+    expect(apiClient.get).toHaveBeenCalledWith('/api/v1/config/app-config', {
+      suppressErrorToast: true,
+    });
+  });
+
+  it('should skip fetch on auth pages and use default config', async () => {
+    // Mock being on login page
+    Object.defineProperty(window, 'location', {
+      value: { pathname: '/login' },
+      writable: true,
+    });
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+      expect(result.current.config).toEqual({ enableLogin: true });
+    });
+
+    // Should NOT call API on auth pages
+    expect(apiClient.get).not.toHaveBeenCalled();
+  });
+
+  it('should handle 401 error gracefully', async () => {
+    const mockError = Object.assign(new Error('Unauthorized'), {
+      response: { status: 401, data: {} },
+    });
+    vi.mocked(apiClient.get).mockRejectedValueOnce(mockError);
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+      expect(result.current.config).toEqual({ enableLogin: true });
+      // 401 should be handled gracefully, error may be null or set
+    });
+  });
+
+  it('should handle network errors', async () => {
+    const errorMessage = 'Network error occurred';
+    const mockError = new Error(errorMessage);
+    // Network errors don't have response property
+    // Mock rejection for all retry attempts (default is 3 attempts)
+    vi.mocked(apiClient.get)
+      .mockRejectedValueOnce(mockError)
+      .mockRejectedValueOnce(mockError)
+      .mockRejectedValueOnce(mockError);
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+      expect(result.current.config).toEqual({ enableLogin: true });
+      expect(result.current.error).toBe(errorMessage);
+    });
+  });
+
+  it('should skip fetch on signup page', async () => {
+    Object.defineProperty(window, 'location', {
+      value: { pathname: '/signup' },
+      writable: true,
+    });
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+      expect(result.current.config).toEqual({ enableLogin: true });
+    });
+
+    expect(apiClient.get).not.toHaveBeenCalled();
+  });
+
+  it('should skip fetch on auth callback page', async () => {
+    Object.defineProperty(window, 'location', {
+      value: { pathname: '/auth/callback' },
+      writable: true,
+    });
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+      expect(result.current.config).toEqual({ enableLogin: true });
+    });
+
+    expect(apiClient.get).not.toHaveBeenCalled();
+  });
+
+  it('should skip fetch on invite accept page', async () => {
+    Object.defineProperty(window, 'location', {
+      value: { pathname: '/invite/abc123' },
+      writable: true,
+    });
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+      expect(result.current.config).toEqual({ enableLogin: true });
+    });
+
+    expect(apiClient.get).not.toHaveBeenCalled();
+  });
+
+  it('should refetch config when jwt-available event is triggered', async () => {
+    const initialConfig = {
+      enableLogin: true,
+      appNameNavbar: 'Stirling PDF',
+    };
+
+    const updatedConfig = {
+      enableLogin: true,
+      appNameNavbar: 'Stirling PDF',
+      isAdmin: true,
+      enableAnalytics: true,
+    };
+
+    // First call returns initial config
+    vi.mocked(apiClient.get).mockResolvedValueOnce({
+      status: 200,
+      data: initialConfig,
+    } as any);
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.config).toEqual(initialConfig);
+    });
+
+    // Setup second call for refetch
+    vi.mocked(apiClient.get).mockResolvedValueOnce({
+      status: 200,
+      data: updatedConfig,
+    } as any);
+
+    // Trigger jwt-available event wrapped in act
+    await act(async () => {
+      window.dispatchEvent(new CustomEvent('jwt-available'));
+      // Wait a tick for event handler to run
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+
+    await waitFor(() => {
+      expect(result.current.config).toEqual(updatedConfig);
+    });
+
+    expect(apiClient.get).toHaveBeenCalledTimes(2);
+  });
+
+  it('should provide refetch function', async () => {
+    const mockConfig = {
+      enableLogin: false,
+      appNameNavbar: 'Test App',
+    };
+
+    vi.mocked(apiClient.get).mockResolvedValue({
+      status: 200,
+      data: mockConfig,
+    } as any);
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.config).toEqual(mockConfig);
+    });
+
+    // Call refetch wrapped in act
+    await act(async () => {
+      await result.current.refetch();
+    });
+
+    expect(apiClient.get).toHaveBeenCalledTimes(2);
+  });
+
+  it('should not fetch twice without force flag', async () => {
+    const mockConfig = {
+      enableLogin: false,
+    };
+
+    vi.mocked(apiClient.get).mockResolvedValue({
+      status: 200,
+      data: mockConfig,
+    } as any);
+
+    const { result } = renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(result.current.config).toEqual(mockConfig);
+    });
+
+    // Should only be called once (no duplicate fetches)
+    expect(apiClient.get).toHaveBeenCalledTimes(1);
+  });
+
+  it('should handle initial config prop', async () => {
+    const initialConfig = {
+      enableLogin: false,
+      appNameNavbar: 'Initial App',
+    };
+
+    const customWrapper = ({ children }: { children: ReactNode }) => (
+      <AppConfigProvider initialConfig={initialConfig}>
+        {children}
+      </AppConfigProvider>
+    );
+
+    const { result } = renderHook(() => useAppConfig(), {
+      wrapper: customWrapper,
+    });
+
+    // With blocking mode (default), should still fetch even with initial config
+    await waitFor(() => {
+      expect(result.current.loading).toBe(false);
+    });
+
+    // Should still make API call
+    expect(apiClient.get).toHaveBeenCalled();
+  });
+
+  it('should use suppressErrorToast for all config requests', async () => {
+    const mockConfig = { enableLogin: true };
+
+    vi.mocked(apiClient.get).mockResolvedValueOnce({
+      status: 200,
+      data: mockConfig,
+    } as any);
+
+    renderHook(() => useAppConfig(), { wrapper });
+
+    await waitFor(() => {
+      expect(apiClient.get).toHaveBeenCalledWith('/api/v1/config/app-config', {
+        suppressErrorToast: true,
+      });
+    });
+  });
+});
@@ -114,7 +114,8 @@ export const AppConfigProvider: React.FC<AppConfigProviderProps> = ({
        }

        // apiClient automatically adds JWT header if available via interceptors
-        const response = await apiClient.get<AppConfig>('/api/v1/config/app-config', !isBlockingMode ? { suppressErrorToast: true } : undefined);
+        // Always suppress error toast - we handle 401 errors locally
+        const response = await apiClient.get<AppConfig>('/api/v1/config/app-config', { suppressErrorToast: true });
        const data = response.data;

        console.debug('[AppConfig] Config fetched successfully:', data);
@@ -159,8 +160,25 @@ export const AppConfigProvider: React.FC<AppConfigProviderProps> = ({
  }, [fetchCount, hasResolvedConfig, isBlockingMode, maxRetries, initialDelay]);

  useEffect(() => {
-    // Always try to fetch config to check if login is disabled
-    // The endpoint should be public and return proper JSON
+    // Skip config fetch on auth pages (/login, /signup, /auth/callback, /invite/*)
+    // Config will be fetched after successful authentication via jwt-available event
+    const currentPath = window.location.pathname;
+    const isAuthPage = currentPath.includes('/login') ||
+                       currentPath.includes('/signup') ||
+                       currentPath.includes('/auth/callback') ||
+                       currentPath.includes('/invite/');
+
+    // On auth pages, always skip the config fetch
+    // The config will be fetched after authentication via jwt-available event
+    if (isAuthPage) {
+      console.debug('[AppConfig] On auth page - using default config, skipping fetch');
+      setConfig({ enableLogin: true });
+      setHasResolvedConfig(true);
+      setLoading(false);
+      return;
+    }
+
+    // On non-auth pages, fetch config (will validate JWT if present)
    if (autoFetch) {
      fetchConfig();
    }
@@ -12,7 +12,7 @@
 * Memory management handled by FileLifecycleManager (PDF.js cleanup, blob URL revocation).
 */

-import { useReducer, useCallback, useEffect, useRef, useMemo } from 'react';
+import { useReducer, useCallback, useEffect, useRef, useMemo, useState } from 'react';
 import {
  FileContextProviderProps,
  FileContextSelectors,
@@ -22,17 +22,27 @@ import {
  FileId,
  StirlingFileStub,
  StirlingFile,
+  createStirlingFile,
 } from '@app/types/fileContext';

 // Import modular components
 import { fileContextReducer, initialFileContextState } from '@app/contexts/file/FileReducer';
 import { createFileSelectors } from '@app/contexts/file/fileSelectors';
-import { addFiles, addStirlingFileStubs, consumeFiles, undoConsumeFiles, createFileActions } from '@app/contexts/file/fileActions';
+import { addFiles, addStirlingFileStubs, consumeFiles, undoConsumeFiles, createFileActions, createChildStub, generateProcessedFileMetadata } from '@app/contexts/file/fileActions';
 import { FileLifecycleManager } from '@app/contexts/file/lifecycle';
 import { FileStateContext, FileActionsContext } from '@app/contexts/file/contexts';
 import { IndexedDBProvider, useIndexedDB } from '@app/contexts/IndexedDBContext';
 import { useZipConfirmation } from '@app/hooks/useZipConfirmation';
 import ZipWarningModal from '@app/components/shared/ZipWarningModal';
+import EncryptedPdfUnlockModal from '@app/components/shared/EncryptedPdfUnlockModal';
+import { useTranslation } from 'react-i18next';
+import { alert } from '@app/components/toast';
+import { buildRemovePasswordFormData } from '@app/hooks/tools/removePassword/buildRemovePasswordFormData';
+import type { RemovePasswordParameters } from '@app/hooks/tools/removePassword/useRemovePasswordParameters';
+import apiClient from '@app/services/apiClient';
+import { processResponse } from '@app/utils/toolResponseProcessor';
+import { ToolOperation } from '@app/types/file';
+import { handlePasswordError } from '@app/utils/toolErrorHandler';

 const DEBUG = process.env.NODE_ENV === 'development';

@@ -63,6 +73,98 @@ function FileContextInner({
    lifecycleManagerRef.current = new FileLifecycleManager(filesRef, dispatch);
  }
  const lifecycleManager = lifecycleManagerRef.current;
+  const { t } = useTranslation();
+
+  const [encryptedQueue, setEncryptedQueue] = useState<FileId[]>([]);
+  const [activeEncryptedFileId, setActiveEncryptedFileId] = useState<FileId | null>(null);
+  const [unlockPassword, setUnlockPassword] = useState('');
+  const [unlockError, setUnlockError] = useState<string | null>(null);
+  const [isUnlocking, setIsUnlocking] = useState(false);
+  const dismissedEncryptedFilesRef = useRef<Set<FileId>>(new Set());
+  const observedFileIdsRef = useRef<Set<FileId>>(new Set());
+
+  const enqueueEncryptedFiles = useCallback((fileIds: FileId[]) => {
+    if (fileIds.length === 0) return;
+    setEncryptedQueue(prevQueue => {
+      const existing = new Set(prevQueue);
+      const next = [...prevQueue];
+      for (const id of fileIds) {
+        if (dismissedEncryptedFilesRef.current.has(id)) continue;
+        if (id === activeEncryptedFileId) continue;
+        if (existing.has(id)) continue;
+        existing.add(id);
+        next.push(id);
+      }
+      return next;
+    });
+  }, [activeEncryptedFileId]);
+
+  useEffect(() => {
+    const previousIds = observedFileIdsRef.current;
+    const nextIds = new Set(state.files.ids);
+    const newEncryptedIds: FileId[] = [];
+
+    for (const id of state.files.ids) {
+      if (!previousIds.has(id)) {
+        const stub = state.files.byId[id];
+        if ((stub?.versionNumber ?? 1) <= 1 && stub?.processedFile?.isEncrypted) {
+          newEncryptedIds.push(id);
+        }
+      }
+    }
+
+    if (newEncryptedIds.length > 0) {
+      enqueueEncryptedFiles(newEncryptedIds);
+    }
+
+    observedFileIdsRef.current = nextIds;
+  }, [state.files.ids, state.files.byId, enqueueEncryptedFiles]);
+
+  useEffect(() => {
+    if (!activeEncryptedFileId && encryptedQueue.length > 0) {
+      setActiveEncryptedFileId(encryptedQueue[0]);
+      setEncryptedQueue(prev => prev.slice(1));
+    }
+  }, [activeEncryptedFileId, encryptedQueue]);
+
+  useEffect(() => {
+    if (activeEncryptedFileId && !state.files.ids.includes(activeEncryptedFileId)) {
+      setActiveEncryptedFileId(null);
+    }
+  }, [activeEncryptedFileId, state.files.ids]);
+
+  useEffect(() => {
+    setUnlockPassword('');
+    setUnlockError(null);
+  }, [activeEncryptedFileId]);
+
+  const handleUnlockSkip = useCallback(() => {
+    if (activeEncryptedFileId) {
+      dismissedEncryptedFilesRef.current.add(activeEncryptedFileId);
+    }
+    setActiveEncryptedFileId(null);
+  }, [activeEncryptedFileId]);
+
+  const promptEncryptedUnlock = useCallback((fileId: FileId) => {
+    const stub = stateRef.current.files.byId[fileId];
+    if (!stub?.processedFile?.isEncrypted) {
+      return;
+    }
+
+    dismissedEncryptedFilesRef.current.delete(fileId);
+
+    setEncryptedQueue(prevQueue => prevQueue.filter(id => id !== fileId));
+
+    setActiveEncryptedFileId(currentActiveId => {
+      if (currentActiveId && currentActiveId !== fileId) {
+        setEncryptedQueue(prevQueue => {
+          const withoutDuplicates = prevQueue.filter(id => id !== currentActiveId && id !== fileId);
+          return [currentActiveId, ...withoutDuplicates];
+        });
+      }
+      return fileId;
+    });
+  }, []);

  // Create stable selectors (memoized once to avoid re-renders)
  const selectors = useMemo<FileContextSelectors>(() =>
@@ -131,6 +233,80 @@ function FileContextInner({
    return consumeFiles(inputFileIds, outputStirlingFiles, outputStirlingFileStubs, filesRef, dispatch);
  }, []);

+  const runAutomaticPasswordRemoval = useCallback(async (fileId: FileId, password: string): Promise<void> => {
+    const file = filesRef.current.get(fileId);
+    const parentStub = stateRef.current.files.byId[fileId];
+
+    if (!file || !parentStub) {
+      throw new Error(t('encryptedPdfUnlock.missingFile', 'The selected file is no longer available.'));
+    }
+
+    const params: RemovePasswordParameters = { password };
+    const formData = buildRemovePasswordFormData(params, file);
+
+    const response = await apiClient.post('/api/v1/security/remove-password', formData, {
+      responseType: 'blob',
+      suppressErrorToast: true  // Handle errors in modal UI instead of toast
+    });
+    const responseFiles = await processResponse(response.data, [file]);
+
+    const unlockedFile = responseFiles[0];
+    if (!unlockedFile) {
+      throw new Error(t('encryptedPdfUnlock.emptyResponse', 'Password removal did not produce a file.'));
+    }
+
+    const processedMetadata = await generateProcessedFileMetadata(unlockedFile);
+    const thumbnail = processedMetadata?.thumbnailUrl;
+
+    const operation: ToolOperation = {
+      toolId: 'removePassword',
+      timestamp: Date.now()
+    };
+
+    const childStub = createChildStub(parentStub, operation, unlockedFile, thumbnail, processedMetadata);
+    const stirlingUnlockedFile = createStirlingFile(unlockedFile, childStub.id);
+
+    await consumeFilesWrapper([fileId], [stirlingUnlockedFile], [childStub]);
+  }, [consumeFilesWrapper, t]);
+
+  const handleUnlockSubmit = useCallback(async () => {
+    if (!activeEncryptedFileId) return;
+    if (!unlockPassword.trim()) {
+      setUnlockError(t('encryptedPdfUnlock.required', 'Enter the password to continue.'));
+      return;
+    }
+
+    setIsUnlocking(true);
+    setUnlockError(null);
+    try {
+      await runAutomaticPasswordRemoval(activeEncryptedFileId, unlockPassword.trim());
+      const fileName = stateRef.current.files.byId[activeEncryptedFileId]?.name;
+      alert({
+        alertType: 'success',
+        title: t('encryptedPdfUnlock.successTitle', 'Password removed'),
+        body: fileName
+          ? t('encryptedPdfUnlock.successBodyWithName', {
+              defaultValue: 'Removed password from {{fileName}}',
+              fileName,
+            })
+          : t('encryptedPdfUnlock.successBody', 'Password removed successfully.'),
+        expandable: false,
+        isPersistentPopup: false,
+      });
+      dismissedEncryptedFilesRef.current.delete(activeEncryptedFileId);
+      setActiveEncryptedFileId(null);
+    } catch (error) {
+      const errorMessage = await handlePasswordError(
+        error,
+        t('encryptedPdfUnlock.incorrectPassword', 'Incorrect password'),
+        t('removePassword.error.failed', 'An error occurred while removing the password from the PDF.')
+      );
+      setUnlockError(errorMessage);
+    } finally {
+      setIsUnlocking(false);
+    }
+  }, [activeEncryptedFileId, unlockPassword, runAutomaticPasswordRemoval, t]);
+
  const undoConsumeFilesWrapper = useCallback(async (inputFiles: File[], inputStirlingFileStubs: StirlingFileStub[], outputFileIds: FileId[]): Promise<void> => {
    return undoConsumeFiles(inputFiles, inputStirlingFileStubs, outputFileIds, filesRef, dispatch, indexedDB);
  }, [indexedDB]);
@@ -199,7 +375,8 @@ function FileContextInner({
    trackBlobUrl: lifecycleManager.trackBlobUrl,
    cleanupFile: (fileId: FileId) => lifecycleManager.cleanupFile(fileId, stateRef),
    scheduleCleanup: (fileId: FileId, delay?: number) =>
-      lifecycleManager.scheduleCleanup(fileId, delay, stateRef)
+      lifecycleManager.scheduleCleanup(fileId, delay, stateRef),
+    openEncryptedUnlockPrompt: promptEncryptedUnlock
  }), [
    baseActions,
    addRawFiles,
@@ -211,7 +388,8 @@ function FileContextInner({
    pinFileWrapper,
    unpinFileWrapper,
    indexedDB,
-    enablePersistence
+    enablePersistence,
+    promptEncryptedUnlock
  ]);

  // Split context values to minimize re-renders
@@ -225,6 +403,9 @@ function FileContextInner({
    dispatch
  }), [actions]);

+  const activeEncryptedStub = activeEncryptedFileId ? state.files.byId[activeEncryptedFileId] : undefined;
+  const isUnlockModalOpen = Boolean(activeEncryptedFileId && activeEncryptedStub);
+
  // Persistence loading disabled - files only loaded on explicit user action
  // useEffect(() => {
  //   if (!enablePersistence || !indexedDB) return;
@@ -251,6 +432,16 @@ function FileContextInner({
          fileCount={confirmationState.fileCount}
          zipFileName={confirmationState.fileName}
        />
+        <EncryptedPdfUnlockModal
+          opened={isUnlockModalOpen}
+          fileName={activeEncryptedStub?.name}
+          password={unlockPassword}
+          errorMessage={unlockError}
+          isProcessing={isUnlocking}
+          onPasswordChange={setUnlockPassword}
+          onUnlock={handleUnlockSubmit}
+          onSkip={handleUnlockSkip}
+        />
      </FileActionsContext.Provider>
    </FileStateContext.Provider>
  );
@@ -4,7 +4,7 @@
 */

 import React, { createContext, useContext, useReducer, useCallback, useMemo, useEffect } from 'react';
-import { useToolManagement } from '@app/hooks/useToolManagement';
+import { useToolManagement, type ToolAvailabilityMap } from '@app/hooks/useToolManagement';
 import { PageEditorFunctions } from '@app/types/pageEditor';
 import { ToolRegistryEntry, ToolRegistry } from '@app/data/toolsTaxonomy';
 import { useNavigationActions, useNavigationState } from '@app/contexts/NavigationContext';
@@ -44,6 +44,7 @@ interface ToolWorkflowContextValue extends ToolWorkflowState {
  selectedTool: ToolRegistryEntry | null;
  toolRegistry: Partial<ToolRegistry>;
  getSelectedTool: (toolId: ToolId | null) => ToolRegistryEntry | null;
+  toolAvailability: ToolAvailabilityMap;

  // UI Actions
  setSidebarsVisible: (visible: boolean) => void;
@@ -112,7 +113,7 @@ export function ToolWorkflowProvider({ children }: ToolWorkflowProviderProps) {
  const navigationState = useNavigationState();

  // Tool management hook
-  const { toolRegistry, getSelectedTool } = useToolManagement();
+  const { toolRegistry, getSelectedTool, toolAvailability } = useToolManagement();
  const { allTools } = useToolRegistry();

  // Tool history hook
@@ -258,6 +259,11 @@ export function ToolWorkflowProvider({ children }: ToolWorkflowProviderProps) {

  // Workflow actions (compound actions that coordinate multiple state changes)
  const handleToolSelect = useCallback((toolId: ToolId) => {
+    const availabilityInfo = toolAvailability[toolId];
+    const isExplicitlyDisabled = availabilityInfo ? availabilityInfo.available === false : false;
+    if (toolId !== 'read' && toolId !== 'multiTool' && isExplicitlyDisabled) {
+      return;
+    }
    // If we're currently on a custom workbench (e.g., Validate Signature report),
    // selecting any tool should take the user back to the default file manager view.
    const wasInCustomWorkbench = !isBaseWorkbench(navigationState.workbench);
@@ -299,7 +305,7 @@ export function ToolWorkflowProvider({ children }: ToolWorkflowProviderProps) {
    setSearchQuery('');
    setLeftPanelView('toolContent');
    setReaderMode(false); // Disable read mode when selecting tools
-  }, [actions, getSelectedTool, navigationState.workbench, setLeftPanelView, setReaderMode, setSearchQuery]);
+  }, [actions, getSelectedTool, navigationState.workbench, setLeftPanelView, setReaderMode, setSearchQuery, toolAvailability]);

  const handleBackToTools = useCallback(() => {
    setLeftPanelView('toolPicker');
@@ -354,6 +360,7 @@ export function ToolWorkflowProvider({ children }: ToolWorkflowProviderProps) {
    toolResetFunctions,
    registerToolReset,
    resetTool,
+    toolAvailability,

    // Workflow Actions
    handleToolSelect,
@@ -381,6 +388,7 @@ export function ToolWorkflowProvider({ children }: ToolWorkflowProviderProps) {
    selectedTool,
    toolRegistry,
    getSelectedTool,
+    toolAvailability,
    setSidebarsVisible,
    setLeftPanelView,
    setReaderMode,
@@ -63,7 +63,7 @@ export function createProcessedFile(
  thumbnail?: string,
  pageRotations?: number[],
  pageDimensions?: Array<{ width: number; height: number }>
-) {
+): ProcessedFileMetadata {
  return {
    totalPages: pageCount,
    pages: Array.from({ length: pageCount }, (_, index) => ({
@@ -106,6 +106,10 @@ export async function generateProcessedFileMetadata(file: File): Promise<Process
    // Use rotated thumbnail for file manager
    processedFile.thumbnailUrl = rotatedResult.thumbnail;

+    if (unrotatedResult.isEncrypted || rotatedResult.isEncrypted) {
+      processedFile.isEncrypted = true;
+    }
+
    return processedFile;
  } catch (error) {
    if (DEBUG) console.warn(`📄 Failed to generate processedFileMetadata for ${file.name}:`, error);
@@ -188,6 +188,7 @@ export function useFileContext() {

    // Active files
    activeFiles: selectors.getFiles(),
+    openEncryptedUnlockPrompt: actions.openEncryptedUnlockPrompt,

    // Direct access to actions and selectors (for advanced use cases)
    actions,
@@ -82,6 +82,7 @@ import { adjustPageScaleOperationConfig } from "@app/hooks/tools/adjustPageScale
 import { scannerImageSplitOperationConfig } from "@app/hooks/tools/scannerImageSplit/useScannerImageSplitOperation";
 import { addPageNumbersOperationConfig } from "@app/components/tools/addPageNumbers/useAddPageNumbersOperation";
 import { extractPagesOperationConfig } from "@app/hooks/tools/extractPages/useExtractPagesOperation";
+import { ENDPOINTS as SPLIT_ENDPOINT_NAMES } from '@app/constants/splitConstants';
 import CompressSettings from "@app/components/tools/compress/CompressSettings";
 import AddPasswordSettings from "@app/components/tools/addPassword/AddPasswordSettings";
 import RemovePasswordSettings from "@app/components/tools/removePassword/RemovePasswordSettings";
@@ -300,6 +301,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        description: t("home.getPdfInfo.desc", "Grabs any and all information possible on PDFs"),
        categoryId: ToolCategoryId.STANDARD_TOOLS,
        subcategoryId: SubcategoryId.VERIFICATION,
+        endpoints: ["get-info-on-pdf"],
        synonyms: getSynonyms(t, "getPdfInfo"),
        supportsAutomate: false,
        automationSettings: null
@@ -398,6 +400,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        description: t("home.split.desc", "Split PDFs into multiple documents"),
        categoryId: ToolCategoryId.STANDARD_TOOLS,
        subcategoryId: SubcategoryId.PAGE_FORMATTING,
+        endpoints: Array.from(new Set(Object.values(SPLIT_ENDPOINT_NAMES))),
        operationConfig: splitOperationConfig,
        automationSettings: SplitAutomationSettings,
        synonyms: getSynonyms(t, "split")
@@ -465,6 +468,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        description: t("home.bookletImposition.desc", "Create booklets with proper page ordering and multi-page layout for printing and binding"),
        categoryId: ToolCategoryId.STANDARD_TOOLS,
        subcategoryId: SubcategoryId.PAGE_FORMATTING,
+        endpoints: ["booklet-imposition"],
      },
      pdfToSinglePage: {

@@ -559,6 +563,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        categoryId: ToolCategoryId.STANDARD_TOOLS,
        subcategoryId: SubcategoryId.REMOVAL,
        maxFiles: -1,
+        endpoints: ["remove-annotations"],
        operationConfig: removeAnnotationsOperationConfig,
        automationSettings: null,
        synonyms: getSynonyms(t, "removeAnnotations")
@@ -597,7 +602,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        categoryId: ToolCategoryId.STANDARD_TOOLS,
        subcategoryId: SubcategoryId.REMOVAL,
        maxFiles: -1,
-        endpoints: ["remove-certificate-sign"],
+        endpoints: ["remove-cert-sign"],
        operationConfig: removeCertificateSignOperationConfig,
        synonyms: getSynonyms(t, "removeCertSign"),
        automationSettings: null,
@@ -626,7 +631,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        name: t("home.autoRename.title", "Auto Rename PDF File"),
        component: AutoRename,
        maxFiles: -1,
-        endpoints: ["remove-certificate-sign"],
+        endpoints: ["auto-rename"],
        operationConfig: autoRenameOperationConfig,
        description: t("home.autoRename.desc", "Automatically rename PDF files based on their content"),
        categoryId: ToolCategoryId.ADVANCED_TOOLS,
@@ -681,6 +686,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        description: t("home.overlay-pdfs.desc", "Overlay one PDF on top of another"),
        categoryId: ToolCategoryId.ADVANCED_TOOLS,
        subcategoryId: SubcategoryId.ADVANCED_FORMATTING,
+        endpoints: ["overlay-pdf"],
        operationConfig: overlayPdfsOperationConfig,
        synonyms: getSynonyms(t, "overlay-pdfs"),
        automationSettings: OverlayPdfsSettings
@@ -705,6 +711,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        description: t("home.addImage.desc", "Add images to PDF documents"),
        categoryId: ToolCategoryId.ADVANCED_TOOLS,
        subcategoryId: SubcategoryId.ADVANCED_FORMATTING,
+        endpoints: ["add-image"],
        synonyms: getSynonyms(t, "addImage"),
        automationSettings: null
      },
@@ -715,6 +722,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        description: t("home.scannerEffect.desc", "Create a PDF that looks like it was scanned"),
        categoryId: ToolCategoryId.ADVANCED_TOOLS,
        subcategoryId: SubcategoryId.ADVANCED_FORMATTING,
+        endpoints: ["scanner-effect"],
        synonyms: getSynonyms(t, "scannerEffect"),
        automationSettings: null
      },
@@ -805,6 +813,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        categoryId: ToolCategoryId.RECOMMENDED_TOOLS,
        subcategoryId: SubcategoryId.GENERAL,
        maxFiles: -1,
+        endpoints: ["compress-pdf"],
        operationConfig: compressOperationConfig,
        automationSettings: CompressSettings,
        synonyms: getSynonyms(t, "compress")
@@ -848,6 +857,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
        categoryId: ToolCategoryId.RECOMMENDED_TOOLS,
        subcategoryId: SubcategoryId.GENERAL,
        maxFiles: -1,
+        endpoints: ["ocr-pdf"],
        operationConfig: ocrOperationConfig,
        automationSettings: OCRSettings,
        synonyms: getSynonyms(t, "ocr")
@@ -9,6 +9,7 @@ import { SPLIT_METHODS } from '@app/constants/splitConstants';
 const CompressIcon = () => React.createElement(LocalIcon, { icon: 'compress', width: '1.5rem', height: '1.5rem' });
 const SecurityIcon = () => React.createElement(LocalIcon, { icon: 'security', width: '1.5rem', height: '1.5rem' });
 const StarIcon = () => React.createElement(LocalIcon, { icon: 'star', width: '1.5rem', height: '1.5rem' });
+const PrivacyIcon = () => React.createElement(LocalIcon, { icon: 'shield-lock', width: '1.5rem', height: '1.5rem' });

 export function useSuggestedAutomations(): SuggestedAutomation[] {
  const { t } = useTranslation();
@@ -67,6 +68,63 @@ export function useSuggestedAutomations(): SuggestedAutomation[] {
        updatedAt: now,
        icon: SecurityIcon,
      },
+      {
+        id: "pre-publish-sanitization",
+        name: t("automation.suggested.prePublishSanitization", "Pre-publish Sanitization"),
+        description: t("automation.suggested.prePublishSanitizationDesc", "Sanitization workflow that removes all hidden metadata, JavaScript, embedded files, annotations, and flattens forms to prevent data leakage before publishing PDFs online."),
+        operations: [
+          {
+            operation: "sanitize",
+            parameters: {
+              removeJavaScript: true,
+              removeEmbeddedFiles: true,
+              removeXMPMetadata: true,
+              removeMetadata: true,
+              removeLinks: true,
+              removeFonts: false,
+            }
+          },
+          {
+            operation: "flatten",
+            parameters: {
+              flattenOnlyForms: true,
+            }
+          },
+          {
+            operation: "removeAnnotations",
+            parameters: {}
+          },
+          {
+            operation: "changeMetadata",
+            parameters: {
+              deleteAll: true,
+              author: '',
+              creationDate: '',
+              creator: '',
+              keywords: '',
+              modificationDate: '',
+              producer: '',
+              subject: '',
+              title: '',
+              trapped: '',
+            }
+          },
+          {
+            operation: "compress",
+            parameters: {
+              compressionLevel: 3,
+              grayscale: false,
+              expectedSize: '',
+              compressionMethod: 'quality',
+              fileSizeValue: '',
+              fileSizeUnit: 'MB',
+            }
+          },
+        ],
+        createdAt: now,
+        updatedAt: now,
+        icon: PrivacyIcon,
+      },
      {
        id: "email-preparation",
        name: t("automation.suggested.emailPreparation", "Email Preparation"),
@@ -40,13 +40,15 @@ export const buildChangeMetadataFormData = (parameters: ChangeMetadataParameters

  // Custom metadata - backend expects them as values to 'allRequestParams[customKeyX/customValueX]'
  let keyNumber = 0;
-  parameters.customMetadata.forEach((entry) => {
-    if (entry.key.trim() && entry.value.trim()) {
-      keyNumber += 1;
-      formData.append(`allRequestParams[customKey${keyNumber}]`, entry.key.trim());
-      formData.append(`allRequestParams[customValue${keyNumber}]`, entry.value.trim());
-    }
-  });
+  if (parameters.customMetadata && Array.isArray(parameters.customMetadata)) {
+    parameters.customMetadata.forEach((entry) => {
+      if (entry.key.trim() && entry.value.trim()) {
+        keyNumber += 1;
+        formData.append(`allRequestParams[customKey${keyNumber}]`, entry.key.trim());
+        formData.append(`allRequestParams[customValue${keyNumber}]`, entry.value.trim());
+      }
+    });
+  }

  return formData;
 };
@@ -14,6 +14,6 @@ export type RemoveCertificateSignParametersHook = BaseParametersHook<RemoveCerti
 export const useRemoveCertificateSignParameters = (): RemoveCertificateSignParametersHook => {
  return useBaseParameters({
    defaultParameters,
-    endpointName: 'remove-certificate-sign',
+    endpointName: 'remove-cert-sign',
  });
 };
@@ -0,0 +1,12 @@
+import { RemovePasswordParameters } from '@app/hooks/tools/removePassword/useRemovePasswordParameters';
+
+/**
+ * Builds FormData for remove password API request.
+ * Separated from operation config to avoid circular dependencies with FileContext.
+ */
+export const buildRemovePasswordFormData = (parameters: RemovePasswordParameters, file: File): FormData => {
+  const formData = new FormData();
+  formData.append("fileInput", file);
+  formData.append("password", parameters.password);
+  return formData;
+};
@@ -2,14 +2,10 @@ import { useTranslation } from 'react-i18next';
 import { ToolType, useToolOperation } from '@app/hooks/tools/shared/useToolOperation';
 import { createStandardErrorHandler } from '@app/utils/toolErrorHandler';
 import { RemovePasswordParameters, defaultParameters } from '@app/hooks/tools/removePassword/useRemovePasswordParameters';
+import { buildRemovePasswordFormData } from '@app/hooks/tools/removePassword/buildRemovePasswordFormData';

-// Static function that can be used by both the hook and automation executor
-export const buildRemovePasswordFormData = (parameters: RemovePasswordParameters, file: File): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("password", parameters.password);
-  return formData;
-};
+// Re-export for backwards compatibility with any other imports
+export { buildRemovePasswordFormData };

 // Static configuration object
 export const removePasswordOperationConfig = {
@@ -5,7 +5,6 @@ import type { ToolOperationHook } from '@app/hooks/tools/shared/useToolOperation
 import type { StirlingFile } from '@app/types/fileContext';
 import { extractErrorMessage } from '@app/utils/toolErrorHandler';
 import type { ShowJSParameters } from '@app/hooks/tools/showJS/useShowJSParameters';
-import type { ResponseType } from 'axios';

 export interface ShowJSOperationHook extends ToolOperationHook<ShowJSParameters> {
 	scriptText: string | null;
@@ -71,8 +70,7 @@ export const useShowJSOperation = (): ShowJSOperationHook => {

 				const response = await apiClient.post('/api/v1/misc/show-javascript', formData, {
 					headers: { 'Content-Type': 'multipart/form-data' },
-					responseType: 'text' as ResponseType,
-					transformResponse: [(data) => data],
+					responseType: 'text',
 				});

 				const text: string = typeof response.data === 'string' ? response.data : '';
@@ -1,9 +1,10 @@
 import { useState, useEffect } from 'react';
 import apiClient from '@app/services/apiClient';
+import type { EndpointAvailabilityDetails } from '@app/types/endpointAvailability';

 // Track globally fetched endpoint sets to prevent duplicate fetches across components
 const globalFetchedSets = new Set<string>();
-const globalEndpointCache: Record<string, boolean> = {};
+const globalEndpointCache: Record<string, EndpointAvailabilityDetails> = {};

 /**
 * Hook to check if a specific endpoint is enabled
@@ -59,11 +60,13 @@ export function useEndpointEnabled(endpoint: string): {
 */
 export function useMultipleEndpointsEnabled(endpoints: string[]): {
  endpointStatus: Record<string, boolean>;
+  endpointDetails: Record<string, EndpointAvailabilityDetails>;
  loading: boolean;
  error: string | null;
  refetch: () => Promise<void>;
 } {
  const [endpointStatus, setEndpointStatus] = useState<Record<string, boolean>>({});
+  const [endpointDetails, setEndpointDetails] = useState<Record<string, EndpointAvailabilityDetails>>({});
  const [loading, setLoading] = useState(true);
  const [error, setError] = useState<string | null>(null);

@@ -73,31 +76,25 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
    // Skip if we already fetched these exact endpoints globally
    if (!force && globalFetchedSets.has(endpointsKey)) {
      console.debug('[useEndpointConfig] Already fetched these endpoints globally, using cache');
-      const cachedStatus = endpoints.reduce((acc, endpoint) => {
-        if (endpoint in globalEndpointCache) {
-          acc[endpoint] = globalEndpointCache[endpoint];
-        }
-        return acc;
-      }, {} as Record<string, boolean>);
-      setEndpointStatus(cachedStatus);
+      const cached = endpoints.reduce(
+        (acc, endpoint) => {
+          const cachedDetails = globalEndpointCache[endpoint];
+          if (cachedDetails) {
+            acc.status[endpoint] = cachedDetails.enabled;
+            acc.details[endpoint] = cachedDetails;
+          }
+          return acc;
+        },
+        { status: {} as Record<string, boolean>, details: {} as Record<string, EndpointAvailabilityDetails> }
+      );
+      setEndpointStatus(cached.status);
+      setEndpointDetails(prev => ({ ...prev, ...cached.details }));
      setLoading(false);
      return;
    }
    if (!endpoints || endpoints.length === 0) {
      setEndpointStatus({});
-      setLoading(false);
-      return;
-    }
-
-    // Check if JWT exists - if not, optimistically enable all endpoints
-    const hasJwt = !!localStorage.getItem('stirling_jwt');
-    if (!hasJwt) {
-      console.debug('[useEndpointConfig] No JWT found - optimistically enabling all endpoints');
-      const optimisticStatus = endpoints.reduce((acc, endpoint) => {
-        acc[endpoint] = true;
-        return acc;
-      }, {} as Record<string, boolean>);
-      setEndpointStatus(optimisticStatus);
+      setEndpointDetails({});
      setLoading(false);
      return;
    }
@@ -110,11 +107,19 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
      const newEndpoints = endpoints.filter(ep => !(ep in globalEndpointCache));
      if (newEndpoints.length === 0) {
        console.debug('[useEndpointConfig] All endpoints already in global cache');
-        const cachedStatus = endpoints.reduce((acc, endpoint) => {
-          acc[endpoint] = globalEndpointCache[endpoint];
-          return acc;
-        }, {} as Record<string, boolean>);
-        setEndpointStatus(cachedStatus);
+        const cached = endpoints.reduce(
+          (acc, endpoint) => {
+            const cachedDetails = globalEndpointCache[endpoint];
+            if (cachedDetails) {
+              acc.status[endpoint] = cachedDetails.enabled;
+              acc.details[endpoint] = cachedDetails;
+            }
+            return acc;
+          },
+          { status: {} as Record<string, boolean>, details: {} as Record<string, EndpointAvailabilityDetails> }
+        );
+        setEndpointStatus(cached.status);
+        setEndpointDetails(prev => ({ ...prev, ...cached.details }));
        globalFetchedSets.add(endpointsKey);
        setLoading(false);
        return;
@@ -123,30 +128,51 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
      // Use batch API for efficiency - only fetch new endpoints
      const endpointsParam = newEndpoints.join(',');

-      const response = await apiClient.get<Record<string, boolean>>(`/api/v1/config/endpoints-enabled?endpoints=${encodeURIComponent(endpointsParam)}`);
+      const response = await apiClient.get<Record<string, EndpointAvailabilityDetails>>(`/api/v1/config/endpoints-availability?endpoints=${encodeURIComponent(endpointsParam)}`);
      const statusMap = response.data;

      // Update global cache with new results
-      Object.assign(globalEndpointCache, statusMap);
+      Object.entries(statusMap).forEach(([endpoint, details]) => {
+        globalEndpointCache[endpoint] = {
+          enabled: details?.enabled ?? true,
+          reason: details?.reason ?? null,
+        };
+      });

      // Get all requested endpoints from cache (including previously cached ones)
-      const fullStatus = endpoints.reduce((acc, endpoint) => {
-        acc[endpoint] = globalEndpointCache[endpoint] ?? true; // Default to true if not in cache
-        return acc;
-      }, {} as Record<string, boolean>);
+      const fullStatus = endpoints.reduce(
+        (acc, endpoint) => {
+          const cachedDetails = globalEndpointCache[endpoint];
+          if (cachedDetails) {
+            acc.status[endpoint] = cachedDetails.enabled;
+            acc.details[endpoint] = cachedDetails;
+          } else {
+            acc.status[endpoint] = true;
+          }
+          return acc;
+        },
+        { status: {} as Record<string, boolean>, details: {} as Record<string, EndpointAvailabilityDetails> }
+      );

-      setEndpointStatus(fullStatus);
+      setEndpointStatus(fullStatus.status);
+      setEndpointDetails(prev => ({ ...prev, ...fullStatus.details }));
      globalFetchedSets.add(endpointsKey);
    } catch (err: any) {
      // On 401 (auth error), use optimistic fallback instead of disabling
      if (err.response?.status === 401) {
        console.warn('[useEndpointConfig] 401 error - using optimistic fallback');
-        const optimisticStatus = endpoints.reduce((acc, endpoint) => {
-          acc[endpoint] = true;
-          globalEndpointCache[endpoint] = true; // Cache the optimistic value
-          return acc;
-        }, {} as Record<string, boolean>);
-        setEndpointStatus(optimisticStatus);
+        const optimisticStatus = endpoints.reduce(
+          (acc, endpoint) => {
+            const optimisticDetails: EndpointAvailabilityDetails = { enabled: true, reason: null };
+            acc.status[endpoint] = true;
+            acc.details[endpoint] = optimisticDetails;
+            globalEndpointCache[endpoint] = optimisticDetails;
+            return acc;
+          },
+          { status: {} as Record<string, boolean>, details: {} as Record<string, EndpointAvailabilityDetails> }
+        );
+        setEndpointStatus(optimisticStatus.status);
+        setEndpointDetails(prev => ({ ...prev, ...optimisticStatus.details }));
        setLoading(false);
        return;
      }
@@ -156,11 +182,17 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
      console.error('[EndpointConfig] Failed to check multiple endpoints:', err);

      // Fallback: assume all endpoints are enabled on error (optimistic)
-      const optimisticStatus = endpoints.reduce((acc, endpoint) => {
-        acc[endpoint] = true;
-        return acc;
-      }, {} as Record<string, boolean>);
-      setEndpointStatus(optimisticStatus);
+      const optimisticStatus = endpoints.reduce(
+        (acc, endpoint) => {
+          const optimisticDetails: EndpointAvailabilityDetails = { enabled: true, reason: null };
+          acc.status[endpoint] = true;
+          acc.details[endpoint] = optimisticDetails;
+          return acc;
+        },
+        { status: {} as Record<string, boolean>, details: {} as Record<string, EndpointAvailabilityDetails> }
+      );
+      setEndpointStatus(optimisticStatus.status);
+      setEndpointDetails(prev => ({ ...prev, ...optimisticStatus.details }));
    } finally {
      setLoading(false);
    }
@@ -186,6 +218,7 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {

  return {
    endpointStatus,
+    endpointDetails,
    loading,
    error,
    refetch: () => fetchAllEndpointStatuses(true),
@@ -1,9 +1,20 @@
 import { useState, useCallback, useMemo } from 'react';
 import { useToolRegistry } from "@app/contexts/ToolRegistryContext";
+import { usePreferences } from '@app/contexts/PreferencesContext';
 import { getAllEndpoints, type ToolRegistryEntry, type ToolRegistry } from "@app/data/toolsTaxonomy";
 import { useMultipleEndpointsEnabled } from "@app/hooks/useEndpointConfig";
 import { FileId } from '@app/types/file';
 import { ToolId } from "@app/types/toolId";
+import type { EndpointDisableReason } from '@app/types/endpointAvailability';
+
+export type ToolDisableCause = 'disabledByAdmin' | 'missingDependency' | 'unknown';
+
+export interface ToolAvailabilityInfo {
+  available: boolean;
+  reason?: ToolDisableCause;
+}
+
+export type ToolAvailabilityMap = Partial<Record<ToolId, ToolAvailabilityInfo>>;

 interface ToolManagementResult {
  selectedTool: ToolRegistryEntry | null;
@@ -11,6 +22,7 @@ interface ToolManagementResult {
  toolRegistry: Partial<ToolRegistry>;
  setToolSelectedFileIds: (fileIds: FileId[]) => void;
  getSelectedTool: (toolKey: ToolId | null) => ToolRegistryEntry | null;
+  toolAvailability: ToolAvailabilityMap;
 }

 export const useToolManagement = (): ToolManagementResult => {
@@ -19,9 +31,10 @@ export const useToolManagement = (): ToolManagementResult => {
  // Build endpoints list from registry entries with fallback to legacy mapping
  const { allTools } = useToolRegistry();
  const baseRegistry = allTools;
+  const { preferences } = usePreferences();

  const allEndpoints = useMemo(() => getAllEndpoints(baseRegistry), [baseRegistry]);
-  const { endpointStatus, loading: endpointsLoading } = useMultipleEndpointsEnabled(allEndpoints);
+  const { endpointStatus, endpointDetails, loading: endpointsLoading } = useMultipleEndpointsEnabled(allEndpoints);

  const isToolAvailable = useCallback((toolKey: string): boolean => {
    // Keep tools enabled during loading (optimistic UX)
@@ -38,22 +51,64 @@ export const useToolManagement = (): ToolManagementResult => {
    return endpoints.some((endpoint: string) => endpointStatus[endpoint] !== false);
  }, [endpointsLoading, endpointStatus, baseRegistry]);

+  const deriveToolDisableReason = useCallback((toolKey: ToolId): ToolDisableCause => {
+    const tool = baseRegistry[toolKey];
+    if (!tool) {
+      return 'unknown';
+    }
+    const endpoints = tool.endpoints || [];
+    const disabledReasons: EndpointDisableReason[] = endpoints
+      .filter(endpoint => endpointStatus[endpoint] === false)
+      .map(endpoint => endpointDetails[endpoint]?.reason ?? 'CONFIG');
+
+    if (disabledReasons.some(reason => reason === 'DEPENDENCY')) {
+      return 'missingDependency';
+    }
+    if (disabledReasons.some(reason => reason === 'CONFIG')) {
+      return 'disabledByAdmin';
+    }
+    if (disabledReasons.length > 0) {
+      return 'unknown';
+    }
+    return 'unknown';
+  }, [baseRegistry, endpointDetails, endpointStatus]);
+
+  const toolAvailability = useMemo(() => {
+    if (endpointsLoading) {
+      return {};
+    }
+    const availability: ToolAvailabilityMap = {};
+    (Object.keys(baseRegistry) as ToolId[]).forEach(toolKey => {
+      const available = isToolAvailable(toolKey);
+      availability[toolKey] = available
+        ? { available: true }
+        : { available: false, reason: deriveToolDisableReason(toolKey) };
+    });
+    return availability;
+  }, [baseRegistry, deriveToolDisableReason, endpointsLoading, isToolAvailable]);
+
  const toolRegistry: Partial<ToolRegistry> = useMemo(() => {
    const availableToolRegistry: Partial<ToolRegistry> = {};
    (Object.keys(baseRegistry) as ToolId[]).forEach(toolKey => {
-      if (isToolAvailable(toolKey)) {
-        const baseTool = baseRegistry[toolKey];
-        if (baseTool) {
-          availableToolRegistry[toolKey] = {
-            ...baseTool,
-            name: baseTool.name,
-            description: baseTool.description,
-          };
-        }
+      const baseTool = baseRegistry[toolKey];
+      if (!baseTool) return;
+      const availabilityInfo = toolAvailability[toolKey];
+      const isAvailable = availabilityInfo ? availabilityInfo.available !== false : true;
+
+      // Check if tool is "coming soon" (has no component and no link)
+      const isComingSoon = !baseTool.component && !baseTool.link && toolKey !== 'read' && toolKey !== 'multiTool';
+
+      if (preferences.hideUnavailableTools && (!isAvailable || isComingSoon)) {
+        return;
      }
+      availableToolRegistry[toolKey] = {
+        ...baseTool,
+        name: baseTool.name,
+        description: baseTool.description,
+      };
    });
    return availableToolRegistry;
-  }, [isToolAvailable, baseRegistry]);
+  }, [baseRegistry, preferences.hideUnavailableTools, toolAvailability]);

  const getSelectedTool = useCallback((toolKey: ToolId | null): ToolRegistryEntry | null => {
    return toolKey ? toolRegistry[toolKey] || null : null;
@@ -65,5 +120,6 @@ export const useToolManagement = (): ToolManagementResult => {
    toolRegistry,
    setToolSelectedFileIds,
    getSelectedTool,
+    toolAvailability,
  };
 };
@@ -1,4 +1,4 @@
-import { AxiosInstance } from 'axios';
+import type { AxiosInstance } from 'axios';
 import { getBrowserId } from '@app/utils/browserIdentifier';

 export function setupApiInterceptors(client: AxiosInstance): void {
@@ -9,6 +9,8 @@ export interface UserPreferences {
  toolPanelModePromptSeen: boolean;
  showLegacyToolDescriptions: boolean;
  hasCompletedOnboarding: boolean;
+  hideUnavailableTools: boolean;
+  hideUnavailableConversions: boolean;
 }

 export const DEFAULT_PREFERENCES: UserPreferences = {
@@ -19,6 +21,8 @@ export const DEFAULT_PREFERENCES: UserPreferences = {
  toolPanelModePromptSeen: false,
  showLegacyToolDescriptions: false,
  hasCompletedOnboarding: false,
+  hideUnavailableTools: false,
+  hideUnavailableConversions: false,
 };

 const STORAGE_KEY = 'stirlingpdf_preferences';
@@ -0,0 +1,20 @@
+import { createClient, SupabaseClient } from '@supabase/supabase-js';
+
+const supabaseUrl = import.meta.env.VITE_SUPABASE_URL;
+const supabaseAnonKey = import.meta.env.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY;
+
+// Check if Supabase is configured
+export const isSupabaseConfigured = !!(supabaseUrl && supabaseAnonKey);
+
+// Create client only if configured, otherwise export null
+export const supabase: SupabaseClient | null = isSupabaseConfigured
+  ? createClient(supabaseUrl, supabaseAnonKey)
+  : null;
+
+// Log warning if not configured (for self-hosted installations)
+if (!isSupabaseConfigured) {
+  console.warn(
+    'Supabase is not configured. Checkout and billing features will be disabled. ' +
+    'Static plan information will be displayed instead.'
+  );
+}
@@ -1,6 +1,6 @@
 export interface UpdateSummary {
-  latest_version: string;
-  latest_stable_version?: string;
+  latest_version: string | null;
+  latest_stable_version?: string | null;
  max_priority: 'urgent' | 'normal' | 'minor' | 'low';
  recommended_action?: string;
  any_breaking: boolean;
@@ -8,10 +8,12 @@ import { useAddAttachmentsParameters } from "@app/hooks/tools/addAttachments/use
 import { useAddAttachmentsOperation } from "@app/hooks/tools/addAttachments/useAddAttachmentsOperation";
 import { useAccordionSteps } from "@app/hooks/tools/shared/useAccordionSteps";
 import AddAttachmentsSettings from "@app/components/tools/addAttachments/AddAttachmentsSettings";
+import { useAddAttachmentsTips } from "@app/components/tooltips/useAddAttachmentsTips";

 const AddAttachments = ({ onPreviewFile, onComplete, onError }: BaseToolProps) => {
  const { t } = useTranslation();
  const { selectedFiles } = useFileSelection();
+  const addAttachmentsTips = useAddAttachmentsTips();

  const params = useAddAttachmentsParameters();
  const operation = useAddAttachmentsOperation();
@@ -64,6 +66,7 @@ const AddAttachments = ({ onPreviewFile, onComplete, onError }: BaseToolProps) =
      isCollapsed: accordion.getCollapsedState(AddAttachmentsStep.ATTACHMENTS),
      onCollapsedClick: () => accordion.handleStepToggle(AddAttachmentsStep.ATTACHMENTS),
      isVisible: true,
+      tooltip: addAttachmentsTips,
      content: (
        <AddAttachmentsSettings
          parameters={params.parameters}
@@ -9,21 +9,28 @@ import { useAutoRenameTips } from "@app/components/tooltips/useAutoRenameTips";

 const AutoRename =(props: BaseToolProps) => {
  const { t } = useTranslation();
+  const autoRenameTips = useAutoRenameTips();

  const base = useBaseTool(
-    '"auto-rename-pdf-file',
+    'auto-rename-pdf-file',
    useAutoRenameParameters,
    useAutoRenameOperation,
    props
  );

 return createToolFlow({
-    title: { title:t("auto-rename.title", "Auto Rename PDF"), description: t("auto-rename.description", "Auto Rename PDF"), tooltip: useAutoRenameTips()},
    files: {
      selectedFiles: base.selectedFiles,
      isCollapsed: base.hasResults,
    },
-    steps: [],
+    steps: [
+      {
+        title: t("auto-rename.settings.title", "About"),
+        isCollapsed: false,
+        tooltip: autoRenameTips,
+        content: null,
+      },
+    ],
    executeButton: {
      text: t("auto-rename.submit", "Auto Rename"),
      isVisible: !base.hasResults,
@@ -5,9 +5,11 @@ import { useRemoveAnnotationsParameters } from "@app/hooks/tools/removeAnnotatio
 import { useRemoveAnnotationsOperation } from "@app/hooks/tools/removeAnnotations/useRemoveAnnotationsOperation";
 import { useBaseTool } from "@app/hooks/tools/shared/useBaseTool";
 import { BaseToolProps, ToolComponent } from "@app/types/tool";
+import { useRemoveAnnotationsTips } from "@app/components/tooltips/useRemoveAnnotationsTips";

 const RemoveAnnotations = (props: BaseToolProps) => {
  const { t } = useTranslation();
+  const removeAnnotationsTips = useRemoveAnnotationsTips();

  const base = useBaseTool(
    'removeAnnotations',
@@ -26,6 +28,7 @@ const RemoveAnnotations = (props: BaseToolProps) => {
        title: t("removeAnnotations.settings.title", "Settings"),
        isCollapsed: base.settingsCollapsed,
        onCollapsedClick: base.settingsCollapsed ? base.handleSettingsReset : undefined,
+        tooltip: removeAnnotationsTips,
        content: <RemoveAnnotationsSettings />,
      },
    ],
@@ -0,0 +1,6 @@
+export type EndpointDisableReason = 'CONFIG' | 'DEPENDENCY' | 'UNKNOWN' | null;
+
+export interface EndpointAvailabilityDetails {
+  enabled: boolean;
+  reason?: EndpointDisableReason;
+}
@@ -23,6 +23,7 @@ export interface ProcessedFileMetadata {
  pages: ProcessedFilePage[];
  totalPages?: number;
  lastProcessed?: number;
+  isEncrypted?: boolean;
  [key: string]: any;
 }

@@ -301,6 +302,7 @@ export interface FileContextActions {
  trackBlobUrl: (url: string) => void;
  scheduleCleanup: (fileId: FileId, delay?: number) => void;
  cleanupFile: (fileId: FileId) => void;
+  openEncryptedUnlockPrompt: (fileId: FileId) => void;
 }

 // File selectors (separate from actions to avoid re-renders)
@@ -5,6 +5,7 @@ export interface ThumbnailWithMetadata {
  pageCount: number;
  pageRotations?: number[]; // Rotation for each page (0, 90, 180, 270)
  pageDimensions?: Array<{ width: number; height: number }>;
+  isEncrypted?: boolean;
 }

 interface ColorScheme {
@@ -451,7 +452,7 @@ export async function generateThumbnailWithMetadata(file: File, applyRotation: b
    if (error instanceof Error && error.name === "PasswordException") {
      // Handle encrypted PDFs
      const thumbnail = generateEncryptedPDFThumbnail(file);
-      return { thumbnail, pageCount: 1 };
+      return { thumbnail, pageCount: 1, isEncrypted: true };
    }

    const thumbnail = generatePlaceholderThumbnail(file);
@@ -2,6 +2,8 @@
 * Standardized error handling utilities for tool operations
 */

+import { normalizeAxiosErrorData } from '@app/services/errorUtils';
+
 /**
 * Default error extractor that follows the standard pattern
 */
@@ -30,4 +32,36 @@ export const createStandardErrorHandler = (fallbackMessage: string) => {
    }
    return fallbackMessage;
  };
+};
+
+/**
+ * Handles password-related errors with status code checking
+ * @param error - The error object from axios
+ * @param incorrectPasswordMessage - Message to show for incorrect password (typically 500 status)
+ * @param fallbackMessage - Message to show for other errors
+ * @returns Error message string
+ */
+export const handlePasswordError = async (
+  error: any,
+  incorrectPasswordMessage: string,
+  fallbackMessage: string
+): Promise<string> => {
+  const status = error?.response?.status;
+
+  // Handle specific error cases with user-friendly messages
+  if (status === 500) {
+    // 500 typically means incorrect password for encrypted PDFs
+    return incorrectPasswordMessage;
+  }
+
+  // For other errors, try to extract the message
+  const normalizedData = await normalizeAxiosErrorData(error?.response?.data);
+  const errorWithNormalizedData = {
+    ...error,
+    response: {
+      ...error?.response,
+      data: normalizedData
+    }
+  };
+  return extractErrorMessage(errorWithNormalizedData) || fallbackMessage;
 };
@@ -1,15 +1,66 @@
-import { ReactNode } from "react";
+import { ReactNode, useEffect, useState } from "react";
 import { AppProviders as ProprietaryAppProviders } from "@proprietary/components/AppProviders";
 import { DesktopConfigSync } from '@app/components/DesktopConfigSync';
 import { DesktopBannerInitializer } from '@app/components/DesktopBannerInitializer';
+import { SetupWizard } from '@app/components/SetupWizard';
+import { useFirstLaunchCheck } from '@app/hooks/useFirstLaunchCheck';
+import { useBackendInitializer } from '@app/hooks/useBackendInitializer';
 import { DESKTOP_DEFAULT_APP_CONFIG } from '@app/config/defaultAppConfig';
+import { connectionModeService } from '@desktop/services/connectionModeService';
+import { tauriBackendService } from '@app/services/tauriBackendService';

 /**
 * Desktop application providers
 * Wraps proprietary providers and adds desktop-specific configuration
 * - Enables retry logic for app config (needed for Tauri mode when backend is starting)
+ * - Shows setup wizard on first launch
 */
 export function AppProviders({ children }: { children: ReactNode }) {
+  const { isFirstLaunch, setupComplete } = useFirstLaunchCheck();
+  const [connectionMode, setConnectionMode] = useState<'offline' | 'server' | null>(null);
+
+  // Load connection mode on mount
+  useEffect(() => {
+    void connectionModeService.getCurrentMode().then(setConnectionMode);
+  }, []);
+
+  // Initialize backend health monitoring for server mode
+  useEffect(() => {
+    if (setupComplete && !isFirstLaunch && connectionMode === 'server') {
+      console.log('[AppProviders] Initializing external backend monitoring for server mode');
+      void tauriBackendService.initializeExternalBackend();
+    }
+  }, [setupComplete, isFirstLaunch, connectionMode]);
+
+  // Only start bundled backend if in offline mode and setup is complete
+  const shouldStartBackend = setupComplete && !isFirstLaunch && connectionMode === 'offline';
+  useBackendInitializer(shouldStartBackend);
+
+  // Show setup wizard on first launch
+  if (isFirstLaunch && !setupComplete) {
+    return (
+      <ProprietaryAppProviders
+        appConfigRetryOptions={{
+          maxRetries: 5,
+          initialDelay: 1000,
+        }}
+        appConfigProviderProps={{
+          initialConfig: DESKTOP_DEFAULT_APP_CONFIG,
+          bootstrapMode: 'non-blocking',
+          autoFetch: false,
+        }}
+      >
+        <SetupWizard
+          onComplete={() => {
+            // Reload the page to reinitialize with new connection config
+            window.location.reload();
+          }}
+        />
+      </ProprietaryAppProviders>
+    );
+  }
+
+  // Normal app flow
  return (
    <ProprietaryAppProviders
      appConfigRetryOptions={{
@@ -0,0 +1,287 @@
+import React, { useState, useEffect } from 'react';
+import { Stack, Card, Badge, Button, Text, Group, Modal, TextInput, Radio } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import {
+  connectionModeService,
+  ConnectionConfig,
+  ServerConfig,
+} from '@app/services/connectionModeService';
+import { authService, UserInfo } from '@app/services/authService';
+import { LoginForm } from '@app/components/SetupWizard/LoginForm';
+import { STIRLING_SAAS_URL } from '@app/constants/connection';
+import { Z_INDEX_OVER_CONFIG_MODAL } from '@app/styles/zIndex';
+
+export const ConnectionSettings: React.FC = () => {
+  const { t } = useTranslation();
+  const [config, setConfig] = useState<ConnectionConfig | null>(null);
+  const [userInfo, setUserInfo] = useState<UserInfo | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [showServerModal, setShowServerModal] = useState(false);
+  const [showLoginModal, setShowLoginModal] = useState(false);
+  const [newServerConfig, setNewServerConfig] = useState<ServerConfig | null>(null);
+
+  // Load current config on mount
+  useEffect(() => {
+    const loadConfig = async () => {
+      const currentConfig = await connectionModeService.getCurrentConfig();
+      setConfig(currentConfig);
+
+      if (currentConfig.mode === 'server') {
+        const user = await authService.getUserInfo();
+        setUserInfo(user);
+      }
+    };
+
+    loadConfig();
+  }, []);
+
+  const handleSwitchToOffline = async () => {
+    try {
+      setLoading(true);
+      await connectionModeService.switchToOffline();
+
+      // Reload config
+      const newConfig = await connectionModeService.getCurrentConfig();
+      setConfig(newConfig);
+      setUserInfo(null);
+
+      // Reload the page to start the local backend
+      window.location.reload();
+    } catch (error) {
+      console.error('Failed to switch to offline:', error);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleSwitchToServer = () => {
+    setShowServerModal(true);
+  };
+
+  const handleServerConfigSubmit = (serverConfig: ServerConfig) => {
+    setNewServerConfig(serverConfig);
+    setShowServerModal(false);
+    setShowLoginModal(true);
+  };
+
+  const handleLogin = async (username: string, password: string) => {
+    if (!newServerConfig) return;
+
+    try {
+      setLoading(true);
+
+      // Login
+      await authService.login(newServerConfig.url, username, password);
+
+      // Switch to server mode
+      await connectionModeService.switchToServer(newServerConfig);
+
+      // Reload config and user info
+      const newConfig = await connectionModeService.getCurrentConfig();
+      setConfig(newConfig);
+      const user = await authService.getUserInfo();
+      setUserInfo(user);
+
+      setShowLoginModal(false);
+      setNewServerConfig(null);
+
+      // Reload the page to stop local backend and initialize external backend monitoring
+      window.location.reload();
+    } catch (error) {
+      console.error('Login failed:', error);
+      throw error; // Let LoginForm handle the error
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleLogout = async () => {
+    try {
+      setLoading(true);
+      await authService.logout();
+
+      // Switch to offline mode
+      await connectionModeService.switchToOffline();
+
+      // Reload config
+      const newConfig = await connectionModeService.getCurrentConfig();
+      setConfig(newConfig);
+      setUserInfo(null);
+
+      // Reload the page to clear all state and reconnect to local backend
+      window.location.reload();
+    } catch (error) {
+      console.error('Logout failed:', error);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  if (!config) {
+    return <Text>{t('common.loading', 'Loading...')}</Text>;
+  }
+
+  return (
+    <>
+      <Card shadow="sm" padding="lg" radius="md" withBorder>
+        <Stack gap="md">
+          <Group justify="space-between">
+            <Text fw={600}>{t('settings.connection.title', 'Connection Mode')}</Text>
+            <Badge color={config.mode === 'offline' ? 'blue' : 'green'} variant="light">
+              {config.mode === 'offline'
+                ? t('settings.connection.mode.offline', 'Offline')
+                : t('settings.connection.mode.server', 'Server')}
+            </Badge>
+          </Group>
+
+          {config.mode === 'server' && config.server_config && (
+            <>
+              <div>
+                <Text size="sm" fw={500}>
+                  {t('settings.connection.server', 'Server')}
+                </Text>
+                <Text size="sm" c="dimmed">
+                  {config.server_config.url}
+                </Text>
+              </div>
+
+              {userInfo && (
+                <div>
+                  <Text size="sm" fw={500}>
+                    {t('settings.connection.user', 'Logged in as')}
+                  </Text>
+                  <Text size="sm" c="dimmed">
+                    {userInfo.username}
+                    {userInfo.email && ` (${userInfo.email})`}
+                  </Text>
+                </div>
+              )}
+            </>
+          )}
+
+          <Group mt="md">
+            {config.mode === 'offline' ? (
+              <Button onClick={handleSwitchToServer} disabled={loading}>
+                {t('settings.connection.switchToServer', 'Connect to Server')}
+              </Button>
+            ) : (
+              <>
+                <Button onClick={handleSwitchToOffline} variant="default" disabled={loading}>
+                  {t('settings.connection.switchToOffline', 'Switch to Offline')}
+                </Button>
+                <Button onClick={handleLogout} color="red" variant="light" disabled={loading}>
+                  {t('settings.connection.logout', 'Logout')}
+                </Button>
+              </>
+            )}
+          </Group>
+        </Stack>
+      </Card>
+
+      {/* Server selection modal */}
+      <Modal
+        opened={showServerModal}
+        onClose={() => setShowServerModal(false)}
+        title={t('settings.connection.selectServer', 'Select Server')}
+        zIndex={Z_INDEX_OVER_CONFIG_MODAL}
+      >
+        <ServerSelectionInSettings onSubmit={handleServerConfigSubmit} />
+      </Modal>
+
+      {/* Login modal */}
+      <Modal
+        opened={showLoginModal}
+        onClose={() => {
+          setShowLoginModal(false);
+          setNewServerConfig(null);
+        }}
+        title={t('settings.connection.login', 'Login')}
+        zIndex={Z_INDEX_OVER_CONFIG_MODAL}
+      >
+        {newServerConfig && (
+          <LoginForm
+            serverUrl={newServerConfig.url}
+            onLogin={handleLogin}
+            loading={loading}
+          />
+        )}
+      </Modal>
+    </>
+  );
+};
+
+// Mini server selection component for settings
+const ServerSelectionInSettings: React.FC<{ onSubmit: (config: ServerConfig) => void }> = ({
+  onSubmit,
+}) => {
+  const { t } = useTranslation();
+  const [serverType, setServerType] = useState<'saas' | 'selfhosted'>('saas');
+  const [customUrl, setCustomUrl] = useState('');
+  const [testing, setTesting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const handleSubmit = async () => {
+    const url = serverType === 'saas' ? STIRLING_SAAS_URL : customUrl.trim();
+
+    if (!url) {
+      setError(t('setup.server.error.emptyUrl', 'Please enter a server URL'));
+      return;
+    }
+
+    setTesting(true);
+    setError(null);
+
+    try {
+      const isReachable = await connectionModeService.testConnection(url);
+
+      if (!isReachable) {
+        setError(t('setup.server.error.unreachable', 'Could not connect to server'));
+        setTesting(false);
+        return;
+      }
+
+      onSubmit({
+        url,
+        server_type: serverType,
+      });
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t('setup.server.error.testFailed', 'Connection test failed'));
+      setTesting(false);
+    }
+  };
+
+  return (
+    <Stack gap="md">
+      <Radio.Group value={serverType} onChange={(value) => setServerType(value as 'saas' | 'selfhosted')}>
+        <Stack gap="xs">
+          <Radio value="saas" label={t('setup.server.type.saas', 'Stirling PDF SaaS')} />
+          <Radio value="selfhosted" label={t('setup.server.type.selfhosted', 'Self-hosted server')} />
+        </Stack>
+      </Radio.Group>
+
+      {serverType === 'selfhosted' && (
+        <TextInput
+          label={t('setup.server.url.label', 'Server URL')}
+          placeholder="https://your-server.com"
+          value={customUrl}
+          onChange={(e) => {
+            setCustomUrl(e.target.value);
+            setError(null);
+          }}
+          disabled={testing}
+          error={error}
+        />
+      )}
+
+      {error && !customUrl && (
+        <Text c="red" size="sm">
+          {error}
+        </Text>
+      )}
+
+      <Button onClick={handleSubmit} loading={testing} fullWidth>
+        {testing ? t('setup.server.testing', 'Testing...') : t('common.continue', 'Continue')}
+      </Button>
+    </Stack>
+  );
+};
@@ -0,0 +1,85 @@
+import React, { useState } from 'react';
+import { Stack, TextInput, PasswordInput, Button, Text } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+
+interface LoginFormProps {
+  serverUrl: string;
+  onLogin: (username: string, password: string) => Promise<void>;
+  loading: boolean;
+}
+
+export const LoginForm: React.FC<LoginFormProps> = ({ serverUrl, onLogin, loading }) => {
+  const { t } = useTranslation();
+  const [username, setUsername] = useState('');
+  const [password, setPassword] = useState('');
+  const [validationError, setValidationError] = useState<string | null>(null);
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+
+    // Validation
+    if (!username.trim()) {
+      setValidationError(t('setup.login.error.emptyUsername', 'Please enter your username'));
+      return;
+    }
+
+    if (!password) {
+      setValidationError(t('setup.login.error.emptyPassword', 'Please enter your password'));
+      return;
+    }
+
+    setValidationError(null);
+    await onLogin(username.trim(), password);
+  };
+
+  return (
+    <form onSubmit={handleSubmit}>
+      <Stack gap="md">
+        <Text size="sm" c="dimmed">
+          {t('setup.login.connectingTo', 'Connecting to:')} <strong>{serverUrl}</strong>
+        </Text>
+
+        <TextInput
+          label={t('setup.login.username.label', 'Username')}
+          placeholder={t('setup.login.username.placeholder', 'Enter your username')}
+          value={username}
+          onChange={(e) => {
+            setUsername(e.target.value);
+            setValidationError(null);
+          }}
+          disabled={loading}
+          required
+        />
+
+        <PasswordInput
+          label={t('setup.login.password.label', 'Password')}
+          placeholder={t('setup.login.password.placeholder', 'Enter your password')}
+          value={password}
+          onChange={(e) => {
+            setPassword(e.target.value);
+            setValidationError(null);
+          }}
+          disabled={loading}
+          required
+        />
+
+        {validationError && (
+          <Text c="red" size="sm">
+            {validationError}
+          </Text>
+        )}
+
+        <Button
+          type="submit"
+          loading={loading}
+          disabled={loading}
+          mt="md"
+          fullWidth
+          color="#AF3434"
+        >
+          {t('setup.login.submit', 'Login')}
+        </Button>
+      </Stack>
+    </form>
+  );
+};
@@ -0,0 +1,66 @@
+import React from 'react';
+import { Stack, Button, Text } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import CloudIcon from '@mui/icons-material/Cloud';
+import ComputerIcon from '@mui/icons-material/Computer';
+
+interface ModeSelectionProps {
+  onSelect: (mode: 'offline' | 'server') => void;
+  loading: boolean;
+}
+
+export const ModeSelection: React.FC<ModeSelectionProps> = ({ onSelect, loading }) => {
+  const { t } = useTranslation();
+
+  return (
+    <Stack gap="md">
+      <Button
+        size="xl"
+        variant="default"
+        onClick={() => onSelect('offline')}
+        disabled={loading}
+        leftSection={<ComputerIcon />}
+        styles={{
+          root: {
+            height: 'auto',
+            padding: '1.25rem',
+          },
+          inner: {
+            justifyContent: 'flex-start',
+          },
+        }}
+      >
+        <div style={{ textAlign: 'left', flex: 1 }}>
+          <Text fw={600} size="md">{t('setup.mode.offline.title', 'Use Offline')}</Text>
+          <Text size="sm" c="dimmed" fw={400}>
+            {t('setup.mode.offline.description', 'Run locally without an internet connection')}
+          </Text>
+        </div>
+      </Button>
+
+      <Button
+        size="xl"
+        variant="default"
+        onClick={() => onSelect('server')}
+        disabled={loading}
+        leftSection={<CloudIcon />}
+        styles={{
+          root: {
+            height: 'auto',
+            padding: '1.25rem',
+          },
+          inner: {
+            justifyContent: 'flex-start',
+          },
+        }}
+      >
+        <div style={{ textAlign: 'left', flex: 1 }}>
+          <Text fw={600} size="md">{t('setup.mode.server.title', 'Connect to Server')}</Text>
+          <Text size="sm" c="dimmed" fw={400}>
+            {t('setup.mode.server.description', 'Connect to a remote Stirling PDF server')}
+          </Text>
+        </div>
+      </Button>
+    </Stack>
+  );
+};
@@ -0,0 +1,92 @@
+import React, { useState } from 'react';
+import { Stack, Button, TextInput } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { ServerConfig } from '@app/services/connectionModeService';
+import { connectionModeService } from '@app/services/connectionModeService';
+
+interface ServerSelectionProps {
+  onSelect: (config: ServerConfig) => void;
+  loading: boolean;
+}
+
+export const ServerSelection: React.FC<ServerSelectionProps> = ({ onSelect, loading }) => {
+  const { t } = useTranslation();
+  const [customUrl, setCustomUrl] = useState('');
+  const [testing, setTesting] = useState(false);
+  const [testError, setTestError] = useState<string | null>(null);
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+
+    const url = customUrl.trim();
+
+    if (!url) {
+      setTestError(t('setup.server.error.emptyUrl', 'Please enter a server URL'));
+      return;
+    }
+
+    // Test connection before proceeding
+    setTesting(true);
+    setTestError(null);
+
+    try {
+      const isReachable = await connectionModeService.testConnection(url);
+
+      if (!isReachable) {
+        setTestError(t('setup.server.error.unreachable', 'Could not connect to server'));
+        setTesting(false);
+        return;
+      }
+
+      // Connection successful
+      onSelect({
+        url,
+        server_type: 'selfhosted',
+      });
+    } catch (error) {
+      console.error('Connection test failed:', error);
+      setTestError(
+        error instanceof Error
+          ? error.message
+          : t('setup.server.error.testFailed', 'Connection test failed')
+      );
+    } finally {
+      setTesting(false);
+    }
+  };
+
+  return (
+    <form onSubmit={handleSubmit}>
+      <Stack gap="md">
+        <TextInput
+          label={t('setup.server.url.label', 'Server URL')}
+          placeholder="https://your-server.com"
+          value={customUrl}
+          onChange={(e) => {
+            setCustomUrl(e.target.value);
+            setTestError(null);
+          }}
+          disabled={loading || testing}
+          error={testError}
+          description={t(
+            'setup.server.url.description',
+            'Enter the full URL of your self-hosted Stirling PDF server'
+          )}
+        />
+
+        <Button
+          type="submit"
+          loading={testing || loading}
+          disabled={loading}
+          mt="md"
+          fullWidth
+          color="#AF3434"
+        >
+          {testing
+            ? t('setup.server.testing', 'Testing connection...')
+            : t('common.continue', 'Continue')}
+        </Button>
+      </Stack>
+    </form>
+  );
+};
@@ -0,0 +1,20 @@
+.setup-container {
+  position: relative;
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  background: linear-gradient(135deg, #f5f5f5 0%, #e8e8e8 100%);
+  padding: 2rem;
+}
+
+.setup-wrapper {
+  width: 100%;
+  max-width: 600px;
+}
+
+.setup-card {
+  background-color: white;
+  box-shadow: 0 20px 60px rgba(0, 0, 0, 0.12);
+}
@@ -0,0 +1,184 @@
+import React, { useState } from 'react';
+import { Container, Paper, Stack, Title, Text, Button, Image } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { ModeSelection } from '@app/components/SetupWizard/ModeSelection';
+import { ServerSelection } from '@app/components/SetupWizard/ServerSelection';
+import { LoginForm } from '@app/components/SetupWizard/LoginForm';
+import { connectionModeService, ServerConfig } from '@app/services/connectionModeService';
+import { authService } from '@app/services/authService';
+import { tauriBackendService } from '@app/services/tauriBackendService';
+import { BASE_PATH } from '@app/constants/app';
+import '@app/components/SetupWizard/SetupWizard.css';
+
+enum SetupStep {
+  ModeSelection,
+  ServerSelection,
+  Login,
+}
+
+interface SetupWizardProps {
+  onComplete: () => void;
+}
+
+export const SetupWizard: React.FC<SetupWizardProps> = ({ onComplete }) => {
+  const { t } = useTranslation();
+  const [activeStep, setActiveStep] = useState<SetupStep>(SetupStep.ModeSelection);
+  const [_selectedMode, setSelectedMode] = useState<'offline' | 'server' | null>(null);
+  const [serverConfig, setServerConfig] = useState<ServerConfig | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const handleModeSelection = (mode: 'offline' | 'server') => {
+    setSelectedMode(mode);
+    setError(null);
+
+    if (mode === 'offline') {
+      handleOfflineSetup();
+    } else {
+      setActiveStep(SetupStep.ServerSelection);
+    }
+  };
+
+  const handleOfflineSetup = async () => {
+    try {
+      setLoading(true);
+      setError(null);
+
+      await connectionModeService.switchToOffline();
+      await tauriBackendService.startBackend();
+      onComplete();
+    } catch (err) {
+      console.error('Failed to set up offline mode:', err);
+      setError(err instanceof Error ? err.message : 'Failed to set up offline mode');
+      setLoading(false);
+    }
+  };
+
+  const handleServerSelection = (config: ServerConfig) => {
+    setServerConfig(config);
+    setError(null);
+    setActiveStep(SetupStep.Login);
+  };
+
+  const handleLogin = async (username: string, password: string) => {
+    if (!serverConfig) {
+      setError('No server configured');
+      return;
+    }
+
+    try {
+      setLoading(true);
+      setError(null);
+
+      await authService.login(serverConfig.url, username, password);
+      await connectionModeService.switchToServer(serverConfig);
+      await tauriBackendService.initializeExternalBackend();
+      onComplete();
+    } catch (err) {
+      console.error('Login failed:', err);
+      setError(err instanceof Error ? err.message : 'Login failed');
+      setLoading(false);
+    }
+  };
+
+  const handleBack = () => {
+    setError(null);
+    if (activeStep === SetupStep.Login) {
+      setActiveStep(SetupStep.ServerSelection);
+    } else if (activeStep === SetupStep.ServerSelection) {
+      setActiveStep(SetupStep.ModeSelection);
+      setSelectedMode(null);
+      setServerConfig(null);
+    }
+  };
+
+  const getStepTitle = () => {
+    switch (activeStep) {
+      case SetupStep.ModeSelection:
+        return t('setup.welcome', 'Welcome to Stirling PDF');
+      case SetupStep.ServerSelection:
+        return t('setup.server.title', 'Connect to Server');
+      case SetupStep.Login:
+        return t('setup.login.title', 'Sign In');
+      default:
+        return '';
+    }
+  };
+
+  const getStepSubtitle = () => {
+    switch (activeStep) {
+      case SetupStep.ModeSelection:
+        return t('setup.description', 'Get started by choosing how you want to use Stirling PDF');
+      case SetupStep.ServerSelection:
+        return t('setup.server.subtitle', 'Enter your self-hosted server URL');
+      case SetupStep.Login:
+        return t('setup.login.subtitle', 'Enter your credentials to continue');
+      default:
+        return '';
+    }
+  };
+
+  return (
+    <div className="setup-container">
+      <Container size="sm" className="setup-wrapper">
+        <Paper shadow="xl" p="xl" radius="lg" className="setup-card">
+          <Stack gap="lg">
+            {/* Logo Header */}
+            <Stack gap="xs" align="center">
+              <Image
+                src={`${BASE_PATH}/branding/StirlingPDFLogoBlackText.svg`}
+                alt="Stirling PDF"
+                h={32}
+                fit="contain"
+              />
+              <Title order={1} ta="center" style={{ fontSize: '2rem', fontWeight: 800 }}>
+                {getStepTitle()}
+              </Title>
+              <Text size="sm" c="dimmed" ta="center">
+                {getStepSubtitle()}
+              </Text>
+            </Stack>
+
+            {/* Error Message */}
+            {error && (
+              <Paper p="md" bg="red.0" style={{ border: '1px solid var(--mantine-color-red-3)' }}>
+                <Text size="sm" c="red.7" ta="center">
+                  {error}
+                </Text>
+              </Paper>
+            )}
+
+            {/* Step Content */}
+            {activeStep === SetupStep.ModeSelection && (
+              <ModeSelection onSelect={handleModeSelection} loading={loading} />
+            )}
+
+            {activeStep === SetupStep.ServerSelection && (
+              <ServerSelection onSelect={handleServerSelection} loading={loading} />
+            )}
+
+            {activeStep === SetupStep.Login && (
+              <LoginForm
+                serverUrl={serverConfig?.url || ''}
+                onLogin={handleLogin}
+                loading={loading}
+              />
+            )}
+
+            {/* Back Button */}
+            {activeStep > SetupStep.ModeSelection && !loading && (
+              <Button
+                variant="subtle"
+                onClick={handleBack}
+                fullWidth
+                mt="md"
+              >
+                {t('common.back', 'Back')}
+              </Button>
+            )}
+          </Stack>
+        </Paper>
+      </Container>
+    </div>
+  );
+};
@@ -0,0 +1,30 @@
+import { createConfigNavSections as createProprietaryConfigNavSections } from '@proprietary/components/shared/config/configNavSections';
+import { ConfigNavSection } from '@core/components/shared/config/configNavSections';
+import { ConnectionSettings } from '@app/components/ConnectionSettings';
+
+/**
+ * Desktop extension of createConfigNavSections that adds connection settings
+ */
+export const createConfigNavSections = (
+  isAdmin: boolean = false,
+  runningEE: boolean = false,
+  loginEnabled: boolean = false
+): ConfigNavSection[] => {
+  // Get the proprietary sections (includes core Preferences + admin sections)
+  const sections = createProprietaryConfigNavSections(isAdmin, runningEE, loginEnabled);
+
+  // Add Connection section at the beginning (after Preferences)
+  sections.splice(1, 0, {
+    title: 'Connection',
+    items: [
+      {
+        key: 'connectionMode',
+        label: 'Connection Mode',
+        icon: 'cloud-rounded',
+        component: <ConnectionSettings />,
+      },
+    ],
+  });
+
+  return sections;
+};
@@ -0,0 +1,8 @@
+import { VALID_NAV_KEYS as CORE_NAV_KEYS } from '@core/components/shared/config/types';
+
+export const VALID_NAV_KEYS = [
+  ...CORE_NAV_KEYS,
+  'connectionMode',
+] as const;
+
+export type NavKey = typeof VALID_NAV_KEYS[number];
@@ -0,0 +1,5 @@
+/**
+ * Connection-related constants for desktop app
+ */
+
+export const STIRLING_SAAS_URL = 'https://stirling.com/app';
@@ -1,19 +1,15 @@
-import { useEffect } from 'react';
-import { useBackendInitializer } from '@app/hooks/useBackendInitializer';
+import { useEffect, useState } from 'react';
 import { useOpenedFile } from '@app/hooks/useOpenedFile';
 import { fileOpenService } from '@app/services/fileOpenService';
 import { useFileManagement } from '@app/contexts/file/fileHooks';

 /**
 * App initialization hook
- * Desktop version: Handles Tauri-specific initialization
- * - Starts the backend on app startup
+ * Desktop version: Handles Tauri-specific file initialization
+ * Requires FileContext - must be used inside FileContextProvider
 * - Handles files opened with the app (adds directly to FileContext)
 */
 export function useAppInitialization(): void {
-  // Initialize backend on app startup
-  useBackendInitializer();
-
  // Get file management actions
  const { addFiles } = useFileManagement();

@@ -59,3 +55,11 @@ export function useAppInitialization(): void {
    loadOpenedFiles();
  }, [openedFilePaths, openedFileLoading, addFiles]);
 }
+
+export function useSetupCompletion(): (completed: boolean) => void {
+  const [, setSetupComplete] = useState(false);
+
+  return (completed: boolean) => {
+    setSetupComplete(completed);
+  };
+}
@@ -5,12 +5,18 @@ import { tauriBackendService } from '@app/services/tauriBackendService';

 /**
 * Hook to initialize backend and monitor health
+ * @param enabled - Whether to initialize the backend (default: true)
 */
-export function useBackendInitializer() {
+export function useBackendInitializer(enabled = true) {
  const { status, checkHealth } = useBackendHealth();
  const { backendUrl } = useEndpointConfig();

  useEffect(() => {
+    // Skip if disabled
+    if (!enabled) {
+      return;
+    }
+
    // Skip if backend already running
    if (tauriBackendService.isBackendRunning()) {
      void checkHealth();
@@ -36,5 +42,5 @@ export function useBackendInitializer() {
    if (status !== 'healthy' && status !== 'starting') {
      void initializeBackend();
    }
-  }, [status, backendUrl, checkHealth]);
+  }, [enabled, status, backendUrl, checkHealth]);
 }
@@ -1,9 +1,12 @@
-import { useMemo, useState, useEffect, useCallback, useRef } from 'react';
+import { useState, useEffect, useCallback, useRef } from 'react';
 import { isAxiosError } from 'axios';
 import { useTranslation } from 'react-i18next';
 import apiClient from '@app/services/apiClient';
 import { tauriBackendService } from '@app/services/tauriBackendService';
 import { isBackendNotReadyError } from '@app/constants/backendErrors';
+import type { EndpointAvailabilityDetails } from '@app/types/endpointAvailability';
+import { connectionModeService } from '@desktop/services/connectionModeService';
+

 interface EndpointConfig {
  backendUrl: string;
@@ -127,6 +130,7 @@ export function useEndpointEnabled(endpoint: string): {

 export function useMultipleEndpointsEnabled(endpoints: string[]): {
  endpointStatus: Record<string, boolean>;
+  endpointDetails: Record<string, EndpointAvailabilityDetails>;
  loading: boolean;
  error: string | null;
  refetch: () => Promise<void>;
@@ -139,6 +143,7 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
      return acc;
    }, {} as Record<string, boolean>);
  });
+  const [endpointDetails, setEndpointDetails] = useState<Record<string, EndpointAvailabilityDetails>>({});
  const [loading, setLoading] = useState(false);
  const [error, setError] = useState<string | null>(null);
  const isMountedRef = useRef(true);
@@ -173,13 +178,27 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {

      const endpointsParam = endpoints.join(',');

-      const response = await apiClient.get<Record<string, boolean>>('/api/v1/config/endpoints-enabled', {
+      const response = await apiClient.get<Record<string, EndpointAvailabilityDetails>>('/api/v1/config/endpoints-availability', {
        params: { endpoints: endpointsParam },
        suppressErrorToast: true,
      });

      if (!isMountedRef.current) return;
-      setEndpointStatus(response.data);
+      const details = Object.entries(response.data).reduce((acc, [endpointName, detail]) => {
+        acc[endpointName] = {
+          enabled: detail?.enabled ?? true,
+          reason: detail?.reason ?? null,
+        };
+        return acc;
+      }, {} as Record<string, EndpointAvailabilityDetails>);
+
+      const statusMap = Object.keys(details).reduce((acc, key) => {
+        acc[key] = details[key].enabled;
+        return acc;
+      }, {} as Record<string, boolean>);
+
+      setEndpointDetails(prev => ({ ...prev, ...details }));
+      setEndpointStatus(statusMap);
    } catch (err: unknown) {
      const isBackendStarting = isBackendNotReadyError(err);
      const message = getErrorMessage(err);
@@ -187,10 +206,13 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
      setError(isBackendStarting ? t('backendHealth.starting', 'Backend starting up...') : message);

      const fallbackStatus = endpoints.reduce((acc, endpointName) => {
-        acc[endpointName] = true;
+        const fallbackDetail: EndpointAvailabilityDetails = { enabled: true, reason: null };
+        acc.status[endpointName] = true;
+        acc.details[endpointName] = fallbackDetail;
        return acc;
-      }, {} as Record<string, boolean>);
-      setEndpointStatus(fallbackStatus);
+      }, { status: {} as Record<string, boolean>, details: {} as Record<string, EndpointAvailabilityDetails> });
+      setEndpointStatus(fallbackStatus.status);
+      setEndpointDetails(prev => ({ ...prev, ...fallbackStatus.details }));

      if (!retryTimeoutRef.current) {
        retryTimeoutRef.current = setTimeout(() => {
@@ -208,6 +230,7 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
  useEffect(() => {
    if (!endpoints || endpoints.length === 0) {
      setEndpointStatus({});
+      setEndpointDetails({});
      setLoading(false);
      return;
    }
@@ -229,23 +252,41 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {

  return {
    endpointStatus,
+    endpointDetails,
    loading,
    error,
    refetch: fetchAllEndpointStatuses,
  };
 }

+// Default backend URL from environment variables
+const DEFAULT_BACKEND_URL =
+  import.meta.env.VITE_DESKTOP_BACKEND_URL
+  || import.meta.env.VITE_API_BASE_URL
+  || '';
+
 /**
- * Desktop override exposing the backend URL used by the embedded server.
+ * Desktop override exposing the backend URL based on connection mode.
+ * - Offline mode: Uses local bundled backend (from env vars)
+ * - Server mode: Uses configured server URL from connection config
 */
 export function useEndpointConfig(): EndpointConfig {
-  const backendUrl = useMemo(() => {
-    const runtimeEnv = typeof process !== 'undefined' ? process.env : undefined;
+  const [backendUrl, setBackendUrl] = useState<string>(DEFAULT_BACKEND_URL);

-    return runtimeEnv?.STIRLING_BACKEND_URL
-      || import.meta.env.VITE_DESKTOP_BACKEND_URL
-      || import.meta.env.VITE_API_BASE_URL
-      || 'http://localhost:8080';
+  useEffect(() => {
+    connectionModeService.getCurrentConfig()
+      .then((config) => {
+        if (config.mode === 'server' && config.server_config?.url) {
+          setBackendUrl(config.server_config.url);
+        } else {
+          // Offline mode - use default from env vars
+          setBackendUrl(DEFAULT_BACKEND_URL);
+        }
+      })
+      .catch((err) => {
+        console.error('Failed to get connection config:', err);
+        // Keep current URL on error
+      });
  }, []);

  return { backendUrl };
@@ -0,0 +1,44 @@
+import { useEffect, useRef, useState } from 'react';
+import { connectionModeService } from '@app/services/connectionModeService';
+import { authService } from '@app/services/authService';
+
+/**
+ * First launch check hook
+ * Checks if this is the first time the app is being launched
+ * Does not require FileContext - can be used early in the provider hierarchy
+ */
+export function useFirstLaunchCheck(): { isFirstLaunch: boolean; setupComplete: boolean } {
+  const [isFirstLaunch, setIsFirstLaunch] = useState(false);
+  const [setupComplete, setSetupComplete] = useState(false);
+  const setupCheckCompleteRef = useRef(false);
+
+  // Check if this is first launch
+  useEffect(() => {
+    const checkFirstLaunch = async () => {
+      try {
+        const firstLaunch = await connectionModeService.isFirstLaunch();
+        setIsFirstLaunch(firstLaunch);
+
+        if (!firstLaunch) {
+          // Not first launch - initialize auth state
+          await authService.initializeAuthState();
+          setSetupComplete(true);
+        }
+
+        setupCheckCompleteRef.current = true;
+      } catch (error) {
+        console.error('Failed to check first launch:', error);
+        // On error, assume not first launch and proceed
+        setIsFirstLaunch(false);
+        setSetupComplete(true);
+        setupCheckCompleteRef.current = true;
+      }
+    };
+
+    if (!setupCheckCompleteRef.current) {
+      checkFirstLaunch();
+    }
+  }, []);
+
+  return { isFirstLaunch, setupComplete };
+}
@@ -0,0 +1,34 @@
+/**
+ * Desktop-specific API client using Tauri's native HTTP client
+ * This file overrides @core/services/apiClient.ts for desktop builds
+ * Bypasses CORS restrictions by using native HTTP instead of browser fetch
+ */
+
+import type { AxiosInstance } from 'axios';
+import { create } from '@app/services/tauriHttpClient';
+import { handleHttpError } from '@app/services/httpErrorHandler';
+import { setupApiInterceptors } from '@app/services/apiClientSetup';
+import { getApiBaseUrl } from '@app/services/apiClientConfig';
+
+// Create Tauri HTTP client with default config
+const apiClient = create({
+  baseURL: getApiBaseUrl(),
+  responseType: 'json',
+  withCredentials: true,
+});
+
+// Setup interceptors (desktop-specific auth and backend ready checks)
+// Cast to AxiosInstance - Tauri client has compatible API
+setupApiInterceptors(apiClient as unknown as AxiosInstance);
+
+// ---------- Install error interceptor ----------
+apiClient.interceptors.response.use(
+  (response) => response,
+  async (error) => {
+    await handleHttpError(error); // Handle error (shows toast unless suppressed)
+    return Promise.reject(error);
+  }
+);
+
+// ---------- Exports ----------
+export default apiClient;
@@ -2,16 +2,19 @@ import { isTauri } from '@tauri-apps/api/core';

 /**
 * Desktop override: Determine base URL depending on Tauri environment
+ *
+ * Note: In Tauri mode, the actual URL is determined dynamically by operationRouter
+ * based on connection mode and backend port. This initial baseURL is overridden
+ * by request interceptors in apiClientSetup.ts.
 */
 export function getApiBaseUrl(): string {
  if (!isTauri()) {
    return import.meta.env.VITE_API_BASE_URL || '/';
  }

-  if (import.meta.env.DEV) {
-    // During tauri dev we rely on Vite proxy, so use relative path to avoid CORS preflight
-    return '/';
-  }
-
-  return import.meta.env.VITE_DESKTOP_BACKEND_URL || 'http://localhost:8080';
+  // In Tauri mode, return empty string as placeholder
+  // The actual URL will be set dynamically by operationRouter based on:
+  // - Offline mode: dynamic port from tauriBackendService
+  // - Server mode: configured server URL from connectionModeService
+  return '';
 }
@@ -1,44 +1,134 @@
-import { AxiosInstance } from 'axios';
+import type { AxiosInstance, InternalAxiosRequestConfig } from 'axios';
 import { alert } from '@app/components/toast';
 import { setupApiInterceptors as coreSetup } from '@core/services/apiClientSetup';
 import { tauriBackendService } from '@app/services/tauriBackendService';
 import { createBackendNotReadyError } from '@app/constants/backendErrors';
+import { operationRouter } from '@app/services/operationRouter';
+import { authService } from '@app/services/authService';
+import { connectionModeService } from '@app/services/connectionModeService';
 import i18n from '@app/i18n';

 const BACKEND_TOAST_COOLDOWN_MS = 4000;
 let lastBackendToast = 0;

+// Extended config for custom properties
+interface ExtendedRequestConfig extends InternalAxiosRequestConfig {
+  operationName?: string;
+  skipBackendReadyCheck?: boolean;
+  _retry?: boolean;
+}
+
 /**
 * Desktop-specific API interceptors
 * - Reuses the core interceptors
- * - Blocks API calls while the bundled backend is still starting and shows
- *   a friendly toast for user-initiated requests (non-GET)
+ * - Dynamically sets base URL based on connection mode
+ * - Adds auth token for remote server requests
+ * - Blocks API calls while the bundled backend is still starting
+ * - Handles auth token refresh on 401 errors
 */
 export function setupApiInterceptors(client: AxiosInstance): void {
  coreSetup(client);

+  // Request interceptor: Set base URL and auth headers dynamically
  client.interceptors.request.use(
-    (config) => {
-      const skipCheck = config?.skipBackendReadyCheck === true;
-      if (skipCheck || tauriBackendService.isBackendHealthy()) {
-        return config;
+    async (config: InternalAxiosRequestConfig) => {
+      const extendedConfig = config as ExtendedRequestConfig;
+
+      // Get the operation name from config if provided
+      const operation = extendedConfig.operationName;
+
+      // Get the appropriate base URL for this operation
+      const baseUrl = await operationRouter.getBaseUrl(operation);
+
+      // Build the full URL
+      if (extendedConfig.url && !extendedConfig.url.startsWith('http')) {
+        extendedConfig.url = `${baseUrl}${extendedConfig.url}`;
      }

-      const method = (config.method || 'get').toLowerCase();
-      if (method !== 'get') {
-        const now = Date.now();
-        if (now - lastBackendToast > BACKEND_TOAST_COOLDOWN_MS) {
-          lastBackendToast = now;
-          alert({
-            alertType: 'error',
-            title: i18n.t('backendHealth.offline', 'Backend Offline'),
-            body: i18n.t('backendHealth.wait', 'Please wait for the backend to finish launching and try again.'),
-            isPersistentPopup: false,
-          });
+      // Debug logging
+      console.debug(`[apiClientSetup] Request to: ${extendedConfig.url}`);
+
+      // Add auth token for remote requests
+      const isRemote = await operationRouter.isRemoteMode();
+      if (isRemote) {
+        const token = await authService.getAuthToken();
+        if (token) {
+          extendedConfig.headers.Authorization = `Bearer ${token}`;
        }
      }

-      return Promise.reject(createBackendNotReadyError());
+      // Backend readiness check (for local backend)
+      const skipCheck = extendedConfig.skipBackendReadyCheck === true;
+      const isOffline = await operationRouter.isOfflineMode();
+
+      if (isOffline && !skipCheck && !tauriBackendService.isBackendHealthy()) {
+        const method = (extendedConfig.method || 'get').toLowerCase();
+        if (method !== 'get') {
+          const now = Date.now();
+          if (now - lastBackendToast > BACKEND_TOAST_COOLDOWN_MS) {
+            lastBackendToast = now;
+            alert({
+              alertType: 'error',
+              title: i18n.t('backendHealth.offline', 'Backend Offline'),
+              body: i18n.t('backendHealth.wait', 'Please wait for the backend to finish launching and try again.'),
+              isPersistentPopup: false,
+            });
+          }
+        }
+        return Promise.reject(createBackendNotReadyError());
+      }
+
+      return extendedConfig;
+    },
+    (error) => Promise.reject(error)
+  );
+
+  // Response interceptor: Handle auth errors
+  client.interceptors.response.use(
+    (response) => response,
+    async (error) => {
+      const originalRequest = error.config as ExtendedRequestConfig;
+
+      // Handle 401 Unauthorized - try to refresh token
+      if (error.response?.status === 401 && !originalRequest._retry) {
+        originalRequest._retry = true;
+
+        const isRemote = await operationRouter.isRemoteMode();
+        if (isRemote) {
+          const serverConfig = await connectionModeService.getServerConfig();
+          if (serverConfig) {
+            const refreshed = await authService.refreshToken(serverConfig.url);
+            if (refreshed) {
+              // Retry the original request with new token
+              const token = await authService.getAuthToken();
+              if (token) {
+                originalRequest.headers.Authorization = `Bearer ${token}`;
+              }
+              return client(originalRequest);
+            }
+          }
+        }
+
+        // Refresh failed or not in remote mode - user needs to login again
+        alert({
+          alertType: 'error',
+          title: i18n.t('auth.sessionExpired', 'Session Expired'),
+          body: i18n.t('auth.pleaseLoginAgain', 'Please login again.'),
+          isPersistentPopup: false,
+        });
+      }
+
+      // Handle 403 Forbidden - unauthorized access
+      if (error.response?.status === 403) {
+        alert({
+          alertType: 'error',
+          title: i18n.t('auth.accessDenied', 'Access Denied'),
+          body: i18n.t('auth.insufficientPermissions', 'You do not have permission to perform this action.'),
+          isPersistentPopup: false,
+        });
+      }
+
+      return Promise.reject(error);
    }
  );
 }
@@ -0,0 +1,198 @@
+import { invoke } from '@tauri-apps/api/core';
+import axios from 'axios';
+
+export interface UserInfo {
+  username: string;
+  email?: string;
+}
+
+interface LoginResponse {
+  token: string;
+  username: string;
+  email: string | null;
+}
+
+export type AuthStatus = 'authenticated' | 'unauthenticated' | 'refreshing';
+
+export class AuthService {
+  private static instance: AuthService;
+  private authStatus: AuthStatus = 'unauthenticated';
+  private userInfo: UserInfo | null = null;
+  private authListeners = new Set<(status: AuthStatus, userInfo: UserInfo | null) => void>();
+
+  static getInstance(): AuthService {
+    if (!AuthService.instance) {
+      AuthService.instance = new AuthService();
+    }
+    return AuthService.instance;
+  }
+
+  subscribeToAuth(listener: (status: AuthStatus, userInfo: UserInfo | null) => void): () => void {
+    this.authListeners.add(listener);
+    // Immediately notify new listener of current state
+    listener(this.authStatus, this.userInfo);
+    return () => {
+      this.authListeners.delete(listener);
+    };
+  }
+
+  private notifyListeners() {
+    this.authListeners.forEach(listener => listener(this.authStatus, this.userInfo));
+  }
+
+  private setAuthStatus(status: AuthStatus, userInfo: UserInfo | null = null) {
+    this.authStatus = status;
+    this.userInfo = userInfo;
+    this.notifyListeners();
+  }
+
+  async login(serverUrl: string, username: string, password: string): Promise<UserInfo> {
+    try {
+      console.log('Logging in to:', serverUrl);
+
+      // Call Rust login command (bypasses CORS)
+      const response = await invoke<LoginResponse>('login', {
+        serverUrl,
+        username,
+        password,
+      });
+
+      const { token, username: returnedUsername, email } = response;
+
+      // Save the token to keyring
+      await invoke('save_auth_token', { token });
+
+      // Save user info to store
+      await invoke('save_user_info', {
+        username: returnedUsername || username,
+        email,
+      });
+
+      const userInfo: UserInfo = {
+        username: returnedUsername || username,
+        email: email || undefined,
+      };
+
+      this.setAuthStatus('authenticated', userInfo);
+
+      console.log('Login successful');
+      return userInfo;
+    } catch (error) {
+      console.error('Login failed:', error);
+      this.setAuthStatus('unauthenticated', null);
+
+      // Rust commands return string errors
+      if (typeof error === 'string') {
+        throw new Error(error);
+      }
+
+      throw new Error('Login failed. Please try again.');
+    }
+  }
+
+  async logout(): Promise<void> {
+    try {
+      console.log('Logging out');
+
+      // Clear token from keyring
+      await invoke('clear_auth_token');
+
+      // Clear user info from store
+      await invoke('clear_user_info');
+
+      this.setAuthStatus('unauthenticated', null);
+
+      console.log('Logged out successfully');
+    } catch (error) {
+      console.error('Error during logout:', error);
+      // Still set status to unauthenticated even if clear fails
+      this.setAuthStatus('unauthenticated', null);
+    }
+  }
+
+  async getAuthToken(): Promise<string | null> {
+    try {
+      const token = await invoke<string | null>('get_auth_token');
+      return token || null;
+    } catch (error) {
+      console.error('Failed to get auth token:', error);
+      return null;
+    }
+  }
+
+  async isAuthenticated(): Promise<boolean> {
+    const token = await this.getAuthToken();
+    return token !== null;
+  }
+
+  async getUserInfo(): Promise<UserInfo | null> {
+    if (this.userInfo) {
+      return this.userInfo;
+    }
+
+    try {
+      const userInfo = await invoke<UserInfo | null>('get_user_info');
+      this.userInfo = userInfo;
+      return userInfo;
+    } catch (error) {
+      console.error('Failed to get user info:', error);
+      return null;
+    }
+  }
+
+  async refreshToken(serverUrl: string): Promise<boolean> {
+    try {
+      console.log('Refreshing auth token');
+      this.setAuthStatus('refreshing', this.userInfo);
+
+      const currentToken = await this.getAuthToken();
+      if (!currentToken) {
+        this.setAuthStatus('unauthenticated', null);
+        return false;
+      }
+
+      // Call the server's refresh endpoint
+      const response = await axios.post(
+        `${serverUrl}/api/v1/auth/refresh`,
+        {},
+        {
+          headers: {
+            Authorization: `Bearer ${currentToken}`,
+          },
+        }
+      );
+
+      const { token } = response.data;
+
+      // Save the new token
+      await invoke('save_auth_token', { token });
+
+      const userInfo = await this.getUserInfo();
+      this.setAuthStatus('authenticated', userInfo);
+
+      console.log('Token refreshed successfully');
+      return true;
+    } catch (error) {
+      console.error('Token refresh failed:', error);
+      this.setAuthStatus('unauthenticated', null);
+
+      // Clear stored credentials on refresh failure
+      await this.logout();
+
+      return false;
+    }
+  }
+
+  async initializeAuthState(): Promise<void> {
+    const token = await this.getAuthToken();
+    const userInfo = await this.getUserInfo();
+
+    if (token && userInfo) {
+      this.setAuthStatus('authenticated', userInfo);
+    } else {
+      this.setAuthStatus('unauthenticated', null);
+    }
+  }
+}
+
+export const authService = AuthService.getInstance();
@@ -0,0 +1,131 @@
+import { invoke } from '@tauri-apps/api/core';
+import { fetch } from '@tauri-apps/plugin-http';
+
+export type ConnectionMode = 'offline' | 'server';
+export type ServerType = 'saas' | 'selfhosted';
+
+export interface ServerConfig {
+  url: string;
+  server_type: ServerType;
+}
+
+export interface ConnectionConfig {
+  mode: ConnectionMode;
+  server_config: ServerConfig | null;
+}
+
+export class ConnectionModeService {
+  private static instance: ConnectionModeService;
+  private currentConfig: ConnectionConfig | null = null;
+  private configLoadedOnce = false;
+  private modeListeners = new Set<(config: ConnectionConfig) => void>();
+
+  static getInstance(): ConnectionModeService {
+    if (!ConnectionModeService.instance) {
+      ConnectionModeService.instance = new ConnectionModeService();
+    }
+    return ConnectionModeService.instance;
+  }
+
+  async getCurrentConfig(): Promise<ConnectionConfig> {
+    if (!this.configLoadedOnce) {
+      await this.loadConfig();
+    }
+    return this.currentConfig || { mode: 'offline', server_config: null };
+  }
+
+  async getCurrentMode(): Promise<ConnectionMode> {
+    const config = await this.getCurrentConfig();
+    return config.mode;
+  }
+
+  async getServerConfig(): Promise<ServerConfig | null> {
+    const config = await this.getCurrentConfig();
+    return config.server_config;
+  }
+
+  subscribeToModeChanges(listener: (config: ConnectionConfig) => void): () => void {
+    this.modeListeners.add(listener);
+    return () => {
+      this.modeListeners.delete(listener);
+    };
+  }
+
+  private notifyListeners() {
+    if (this.currentConfig) {
+      this.modeListeners.forEach(listener => listener(this.currentConfig!));
+    }
+  }
+
+  private async loadConfig(): Promise<void> {
+    try {
+      const config = await invoke<ConnectionConfig>('get_connection_config');
+      this.currentConfig = config;
+      this.configLoadedOnce = true;
+    } catch (error) {
+      console.error('Failed to load connection config:', error);
+      // Default to offline mode on error
+      this.currentConfig = { mode: 'offline', server_config: null };
+      this.configLoadedOnce = true;
+    }
+  }
+
+  async switchToOffline(): Promise<void> {
+    console.log('Switching to offline mode');
+
+    await invoke('set_connection_mode', {
+      mode: 'offline',
+      serverConfig: null,
+    });
+
+    this.currentConfig = { mode: 'offline', server_config: null };
+    this.notifyListeners();
+
+    console.log('Switched to offline mode successfully');
+  }
+
+  async switchToServer(serverConfig: ServerConfig): Promise<void> {
+    console.log('Switching to server mode:', serverConfig);
+
+    await invoke('set_connection_mode', {
+      mode: 'server',
+      serverConfig,
+    });
+
+    this.currentConfig = { mode: 'server', server_config: serverConfig };
+    this.notifyListeners();
+
+    console.log('Switched to server mode successfully');
+  }
+
+  async testConnection(url: string): Promise<boolean> {
+    console.log(`[ConnectionModeService] Testing connection to: ${url}`);
+    try {
+      // Test connection by hitting the health/status endpoint
+      const healthUrl = `${url.replace(/\/$/, '')}/api/v1/info/status`;
+      const response = await fetch(healthUrl, {
+        method: 'GET',
+        connectTimeout: 10000,
+      });
+
+      const isOk = response.ok;
+      console.log(`[ConnectionModeService] Server connection test result: ${isOk}`);
+      return isOk;
+    } catch (error) {
+      console.warn('[ConnectionModeService] Server connection test failed:', error);
+      return false;
+    }
+  }
+
+  async isFirstLaunch(): Promise<boolean> {
+    try {
+      const result = await invoke<boolean>('is_first_launch');
+      return result;
+    } catch (error) {
+      console.error('Failed to check first launch:', error);
+      return false;
+    }
+  }
+}
+
+export const connectionModeService = ConnectionModeService.getInstance();
@@ -0,0 +1,99 @@
+import { connectionModeService } from '@app/services/connectionModeService';
+import { tauriBackendService } from '@app/services/tauriBackendService';
+
+export type ExecutionTarget = 'local' | 'remote';
+
+export class OperationRouter {
+  private static instance: OperationRouter;
+
+  static getInstance(): OperationRouter {
+    if (!OperationRouter.instance) {
+      OperationRouter.instance = new OperationRouter();
+    }
+    return OperationRouter.instance;
+  }
+
+  /**
+   * Determines where an operation should execute
+   * @param _operation - The operation name (for future operation classification)
+   * @returns 'local' or 'remote'
+   */
+  async getExecutionTarget(_operation?: string): Promise<ExecutionTarget> {
+    const mode = await connectionModeService.getCurrentMode();
+
+    // Current implementation: simple mode-based routing
+    if (mode === 'offline') {
+      return 'local';
+    }
+
+    // In server mode, currently all operations go to remote
+    // Future enhancement: check if operation is "simple" and route to local if so
+    // Example future logic:
+    // if (mode === 'server' && operation && this.isSimpleOperation(operation)) {
+    //   return 'local';
+    // }
+
+    return 'remote';
+  }
+
+  /**
+   * Gets the base URL for an operation based on execution target
+   * @param _operation - The operation name (for future operation classification)
+   * @returns Base URL for API calls
+   */
+  async getBaseUrl(_operation?: string): Promise<string> {
+    const target = await this.getExecutionTarget(_operation);
+
+    if (target === 'local') {
+      // Use dynamically assigned port from backend service
+      const backendUrl = tauriBackendService.getBackendUrl();
+      if (!backendUrl) {
+        throw new Error('Backend URL not available - backend may still be starting');
+      }
+      // Strip trailing slash to avoid double slashes in URLs
+      return backendUrl.replace(/\/$/, '');
+    }
+
+    // Remote: get from server config
+    const serverConfig = await connectionModeService.getServerConfig();
+    if (!serverConfig) {
+      console.warn('No server config found');
+      throw new Error('Server configuration not found');
+    }
+
+    // Strip trailing slash to avoid double slashes in URLs
+    return serverConfig.url.replace(/\/$/, '');
+  }
+
+  /**
+   * Checks if we're currently in remote mode
+   */
+  async isRemoteMode(): Promise<boolean> {
+    const mode = await connectionModeService.getCurrentMode();
+    return mode === 'server';
+  }
+
+  /**
+   * Checks if we're currently in offline mode
+   */
+  async isOfflineMode(): Promise<boolean> {
+    const mode = await connectionModeService.getCurrentMode();
+    return mode === 'offline';
+  }
+
+  // Future enhancement: operation classification
+  // private isSimpleOperation(operation: string): boolean {
+  //   const simpleOperations = [
+  //     'rotate',
+  //     'merge',
+  //     'split',
+  //     'extract-pages',
+  //     'remove-pages',
+  //     'reorder-pages',
+  //     'metadata',
+  //   ];
+  //   return simpleOperations.includes(operation);
+  // }
+}
+
+export const operationRouter = OperationRouter.getInstance();
@@ -1,4 +1,6 @@
 import { invoke } from '@tauri-apps/api/core';
+import { fetch } from '@tauri-apps/plugin-http';
+import { connectionModeService } from '@app/services/connectionModeService';

 export type BackendStatus = 'stopped' | 'starting' | 'healthy' | 'unhealthy';

@@ -6,6 +8,7 @@ export class TauriBackendService {
  private static instance: TauriBackendService;
  private backendStarted = false;
  private backendStatus: BackendStatus = 'stopped';
+  private backendPort: number | null = null;
  private healthMonitor: Promise<void> | null = null;
  private startPromise: Promise<void> | null = null;
  private statusListeners = new Set<(status: BackendStatus) => void>();
@@ -29,6 +32,14 @@ export class TauriBackendService {
    return this.backendStatus === 'healthy';
  }

+  getBackendPort(): number | null {
+    return this.backendPort;
+  }
+
+  getBackendUrl(): string | null {
+    return this.backendPort ? `http://localhost:${this.backendPort}` : null;
+  }
+
  subscribeToStatus(listener: (status: BackendStatus) => void): () => void {
    this.statusListeners.add(listener);
    return () => {
@@ -44,6 +55,21 @@ export class TauriBackendService {
    this.statusListeners.forEach(listener => listener(status));
  }

+  /**
+   * Initialize health monitoring for an external server (server mode)
+   * Does not start bundled backend, but enables health checks
+   */
+  async initializeExternalBackend(): Promise<void> {
+    if (this.backendStarted) {
+      return;
+    }
+
+    console.log('[TauriBackendService] Initializing external backend monitoring');
+    this.backendStarted = true; // Mark as active for health checks
+    this.setStatus('starting');
+    this.beginHealthMonitoring();
+  }
+
  async startBackend(backendUrl?: string): Promise<void> {
    if (this.backendStarted) {
      return;
@@ -56,10 +82,14 @@ export class TauriBackendService {
    this.setStatus('starting');

    this.startPromise = invoke('start_backend', { backendUrl })
-      .then((result) => {
+      .then(async (result) => {
        console.log('Backend started:', result);
        this.backendStarted = true;
        this.setStatus('starting');
+
+        // Poll for the dynamically assigned port
+        await this.waitForPort();
+
        this.beginHealthMonitoring();
      })
      .catch((error) => {
@@ -74,6 +104,24 @@ export class TauriBackendService {
    return this.startPromise;
  }

+  private async waitForPort(maxAttempts = 30): Promise<void> {
+    console.log('[TauriBackendService] Waiting for backend port assignment...');
+    for (let i = 0; i < maxAttempts; i++) {
+      try {
+        const port = await invoke<number | null>('get_backend_port');
+        if (port) {
+          this.backendPort = port;
+          console.log(`[TauriBackendService] Backend port detected: ${port}`);
+          return;
+        }
+      } catch (error) {
+        console.error('Failed to get backend port:', error);
+      }
+      await new Promise(resolve => setTimeout(resolve, 500));
+    }
+    throw new Error('Failed to detect backend port after 15 seconds');
+  }
+
  private beginHealthMonitoring() {
    if (this.healthMonitor) {
      return;
@@ -88,16 +136,58 @@ export class TauriBackendService {
  }

  async checkBackendHealth(): Promise<boolean> {
+    const mode = await connectionModeService.getCurrentMode();
+
+    // For remote server mode, check the configured server
+    if (mode !== 'offline') {
+      const serverConfig = await connectionModeService.getServerConfig();
+      if (!serverConfig) {
+        console.error('[TauriBackendService] Server mode but no server URL configured');
+        this.setStatus('unhealthy');
+        return false;
+      }
+
+      try {
+        const baseUrl = serverConfig.url.replace(/\/$/, '');
+        const healthUrl = `${baseUrl}/api/v1/info/status`;
+        const response = await fetch(healthUrl, {
+          method: 'GET',
+          connectTimeout: 5000,
+        });
+
+        const isHealthy = response.ok;
+        this.setStatus(isHealthy ? 'healthy' : 'unhealthy');
+        return isHealthy;
+      } catch (error) {
+        const errorStr = String(error);
+        if (!errorStr.includes('connection refused') && !errorStr.includes('No connection could be made')) {
+          console.error('[TauriBackendService] Server health check failed:', error);
+        }
+        this.setStatus('unhealthy');
+        return false;
+      }
+    }
+
+    // For offline mode, check the bundled backend via Rust
    if (!this.backendStarted) {
      this.setStatus('stopped');
      return false;
    }
+
+    if (!this.backendPort) {
+      console.debug('[TauriBackendService] Backend port not available yet');
+      return false;
+    }
+
    try {
-      const isHealthy = await invoke<boolean>('check_backend_health');
+      const isHealthy = await invoke<boolean>('check_backend_health', { port: this.backendPort });
      this.setStatus(isHealthy ? 'healthy' : 'unhealthy');
      return isHealthy;
    } catch (error) {
-      console.error('Health check failed:', error);
+      const errorStr = String(error);
+      if (!errorStr.includes('connection refused') && !errorStr.includes('No connection could be made')) {
+        console.error('[TauriBackendService] Bundled backend health check failed:', error);
+      }
      this.setStatus('unhealthy');
      return false;
    }
@@ -115,6 +205,18 @@ export class TauriBackendService {
    this.setStatus('unhealthy');
    throw new Error('Backend failed to become healthy after 60 seconds');
  }
+
+  /**
+   * Reset backend state (used when switching from external to local backend)
+   */
+  reset(): void {
+    console.log('[TauriBackendService] Resetting backend state');
+    this.backendStarted = false;
+    this.backendPort = null;
+    this.setStatus('stopped');
+    this.healthMonitor = null;
+    this.startPromise = null;
+  }
 }

 export const tauriBackendService = TauriBackendService.getInstance();
@@ -0,0 +1,361 @@
+import { fetch } from '@tauri-apps/plugin-http';
+
+/**
+ * Tauri HTTP Client - wrapper around Tauri's native HTTP client
+ * Provides axios-compatible API while bypassing CORS restrictions
+ */
+
+export interface TauriHttpResponse<T = any> {
+  data: T;
+  status: number;
+  statusText: string;
+  headers: Record<string, string>;
+  config: TauriHttpRequestConfig;
+}
+
+export interface TauriHttpRequestConfig {
+  url?: string;
+  method?: string;
+  baseURL?: string;
+  headers?: Record<string, string>;
+  params?: Record<string, string | number | boolean> | any;
+  data?: any;
+  timeout?: number;
+  responseType?: 'json' | 'text' | 'blob' | 'arraybuffer';
+  withCredentials?: boolean;
+  // Custom properties for desktop
+  operationName?: string;
+  skipBackendReadyCheck?: boolean;
+  // Axios compatibility properties (ignored by Tauri HTTP)
+  suppressErrorToast?: boolean;
+  cancelToken?: any;
+}
+
+export interface TauriHttpError extends Error {
+  config?: TauriHttpRequestConfig;
+  code?: string;
+  request?: unknown;
+  response?: TauriHttpResponse;
+  isAxiosError: boolean;
+  toJSON: () => object;
+}
+
+type RequestInterceptor = (config: TauriHttpRequestConfig) => Promise<TauriHttpRequestConfig> | TauriHttpRequestConfig;
+type ResponseInterceptor<T = any> = (response: TauriHttpResponse<T>) => Promise<TauriHttpResponse<T>> | TauriHttpResponse<T>;
+type ErrorInterceptor = (error: any) => Promise<any>;
+
+interface Interceptors {
+  request: {
+    handlers: RequestInterceptor[];
+    use: (onFulfilled: RequestInterceptor, onRejected?: ErrorInterceptor) => number;
+  };
+  response: {
+    handlers: { fulfilled: ResponseInterceptor; rejected?: ErrorInterceptor }[];
+    use: (onFulfilled: ResponseInterceptor, onRejected?: ErrorInterceptor) => number;
+  };
+}
+
+class TauriHttpClient {
+  public defaults: TauriHttpRequestConfig = {
+    baseURL: '',
+    headers: {},
+    timeout: 120000,
+    responseType: 'json',
+    withCredentials: true,
+  };
+
+  public interceptors: Interceptors = {
+    request: {
+      handlers: [],
+      use: (onFulfilled: RequestInterceptor, _onRejected?: ErrorInterceptor) => {
+        this.interceptors.request.handlers.push(onFulfilled);
+        return this.interceptors.request.handlers.length - 1;
+      },
+    },
+    response: {
+      handlers: [],
+      use: (onFulfilled: ResponseInterceptor, onRejected?: ErrorInterceptor) => {
+        this.interceptors.response.handlers.push({ fulfilled: onFulfilled, rejected: onRejected });
+        return this.interceptors.response.handlers.length - 1;
+      },
+    },
+  };
+
+  constructor(config?: TauriHttpRequestConfig) {
+    if (config) {
+      this.defaults = { ...this.defaults, ...config };
+    }
+  }
+
+  private createError(message: string, config?: TauriHttpRequestConfig, code?: string, response?: TauriHttpResponse): TauriHttpError {
+    const error = new Error(message) as TauriHttpError;
+    error.config = config;
+    error.code = code;
+    error.response = response;
+    error.isAxiosError = true;
+    error.toJSON = () => ({
+      message: error.message,
+      name: error.name,
+      config: error.config,
+      code: error.code,
+    });
+    return error;
+  }
+
+  private buildUrl(config: TauriHttpRequestConfig): string {
+    let url = config.url || '';
+
+    // If URL is already absolute, use it as-is
+    if (url.startsWith('http://') || url.startsWith('https://')) {
+      return url;
+    }
+
+    // Prepend baseURL if present
+    const baseURL = config.baseURL || this.defaults.baseURL || '';
+    if (baseURL) {
+      url = baseURL + url;
+    }
+
+    // Add query parameters
+    if (config.params && typeof config.params === 'object') {
+      const searchParams = new URLSearchParams();
+      Object.entries(config.params as Record<string, unknown>).forEach(([key, value]) => {
+        if (value !== null && value !== undefined) {
+          searchParams.append(key, String(value));
+        }
+      });
+      const queryString = searchParams.toString();
+      if (queryString) {
+        url += (url.includes('?') ? '&' : '?') + queryString;
+      }
+    }
+
+    return url;
+  }
+
+  private async executeRequest<T = any>(config: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    // Merge with defaults
+    const mergedConfig: TauriHttpRequestConfig = {
+      ...this.defaults,
+      ...config,
+      headers: {
+        ...this.defaults.headers,
+        ...config.headers,
+      },
+    };
+
+    // Run request interceptors
+    let finalConfig = mergedConfig;
+    for (const interceptor of this.interceptors.request.handlers) {
+      finalConfig = await Promise.resolve(interceptor(finalConfig));
+    }
+
+    const url = this.buildUrl(finalConfig);
+    const method = (finalConfig.method || 'GET').toUpperCase();
+
+    // Prepare request body and headers
+    let body: BodyInit | undefined;
+    const headers: Record<string, string> = { ...(finalConfig.headers || {}) };
+
+    if (finalConfig.data) {
+      if (finalConfig.data instanceof FormData) {
+        // FormData can be passed directly
+        body = finalConfig.data;
+      } else if (typeof finalConfig.data === 'object') {
+        // Serialize as JSON
+        body = JSON.stringify(finalConfig.data);
+        if (!headers['Content-Type']) {
+          headers['Content-Type'] = 'application/json';
+        }
+      } else {
+        body = String(finalConfig.data);
+      }
+    }
+
+    try {
+      // Debug logging
+      console.debug(`[tauriHttpClient] Fetch request:`, { url, method });
+
+      // Make the request using Tauri's native HTTP client (standard Fetch API)
+      const response = await fetch(url, {
+        method,
+        headers,
+        body,
+      });
+
+      // Parse response based on responseType
+      let data: T;
+      const responseType = finalConfig.responseType || 'json';
+
+      if (responseType === 'json') {
+        data = await response.json() as T;
+      } else if (responseType === 'text') {
+        data = (await response.text()) as T;
+      } else if (responseType === 'blob') {
+        // Standard fetch doesn't set blob.type from Content-Type header (unlike axios)
+        // Set it manually to match axios behavior
+        const blob = await response.blob();
+        if (!blob.type) {
+          const contentType = response.headers.get('content-type') || 'application/octet-stream';
+          data = new Blob([blob], { type: contentType }) as T;
+        } else {
+          data = blob as T;
+        }
+      } else if (responseType === 'arraybuffer') {
+        data = (await response.arrayBuffer()) as T;
+      } else {
+        data = await response.json() as T;
+      }
+
+      // Convert Headers to plain object
+      const responseHeaders: Record<string, string> = {};
+      response.headers.forEach((value, key) => {
+        responseHeaders[key] = value;
+      });
+
+      const httpResponse: TauriHttpResponse<T> = {
+        data,
+        status: response.status,
+        statusText: response.statusText || '',
+        headers: responseHeaders,
+        config: finalConfig,
+      };
+
+      // Check for HTTP errors
+      if (!response.ok) {
+        const error = this.createError(
+          `Request failed with status code ${response.status}`,
+          finalConfig,
+          'ERR_BAD_REQUEST',
+          httpResponse
+        );
+
+        // Run error interceptors
+        let finalError: unknown = error;
+        for (const handler of this.interceptors.response.handlers) {
+          if (handler.rejected) {
+            try {
+              finalError = await Promise.resolve(handler.rejected(finalError));
+            } catch (e) {
+              finalError = e;
+            }
+          }
+        }
+        throw finalError;
+      }
+
+      // Run response interceptors
+      let finalResponse = httpResponse;
+      for (const handler of this.interceptors.response.handlers) {
+        finalResponse = await Promise.resolve(handler.fulfilled(finalResponse)) as TauriHttpResponse<T>;
+      }
+
+      return finalResponse;
+    } catch (error: unknown) {
+      // If it's already a TauriHttpError with interceptors run, re-throw
+      if (error && typeof error === 'object' && 'isAxiosError' in error) {
+        throw error;
+      }
+
+      // Create new error for network/other failures
+      const errorMessage = error instanceof Error ? error.message : 'Network Error';
+      const httpError = this.createError(
+        errorMessage,
+        finalConfig,
+        'ERR_NETWORK'
+      );
+
+      // Run error interceptors
+      let finalError: unknown = httpError;
+      for (const handler of this.interceptors.response.handlers) {
+        if (handler.rejected) {
+          try {
+            finalError = await Promise.resolve(handler.rejected(finalError));
+          } catch (e) {
+            finalError = e;
+          }
+        }
+      }
+      throw finalError;
+    }
+  }
+
+  async request<T = any>(config: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>(config);
+  }
+
+  async get<T = any>(url: string, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>({ ...config, method: 'GET', url });
+  }
+
+  async delete<T = any>(url: string, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>({ ...config, method: 'DELETE', url });
+  }
+
+  async head<T = any>(url: string, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>({ ...config, method: 'HEAD', url });
+  }
+
+  async options<T = any>(url: string, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>({ ...config, method: 'OPTIONS', url });
+  }
+
+  async post<T = any>(url: string, data?: any, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>({ ...config, method: 'POST', url, data });
+  }
+
+  async put<T = any>(url: string, data?: any, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>({ ...config, method: 'PUT', url, data });
+  }
+
+  async patch<T = any>(url: string, data?: any, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    return this.executeRequest<T>({ ...config, method: 'PATCH', url, data });
+  }
+
+  // Axios compatibility methods
+  create(config?: TauriHttpRequestConfig): TauriHttpClient {
+    return new TauriHttpClient({ ...this.defaults, ...config });
+  }
+
+  getUri(config?: TauriHttpRequestConfig): string {
+    return this.buildUrl({ ...this.defaults, ...config });
+  }
+
+  async postForm<T = any>(url: string, data?: any, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    const formData = data instanceof FormData ? data : new FormData();
+    if (!(data instanceof FormData) && data && typeof data === 'object') {
+      Object.entries(data).forEach(([key, value]) => {
+        formData.append(key, String(value));
+      });
+    }
+    return this.post<T>(url, formData, config);
+  }
+
+  async putForm<T = any>(url: string, data?: any, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    const formData = data instanceof FormData ? data : new FormData();
+    if (!(data instanceof FormData) && data && typeof data === 'object') {
+      Object.entries(data).forEach(([key, value]) => {
+        formData.append(key, String(value));
+      });
+    }
+    return this.put<T>(url, formData, config);
+  }
+
+  async patchForm<T = any>(url: string, data?: any, config?: TauriHttpRequestConfig): Promise<TauriHttpResponse<T>> {
+    const formData = data instanceof FormData ? data : new FormData();
+    if (!(data instanceof FormData) && data && typeof data === 'object') {
+      Object.entries(data).forEach(([key, value]) => {
+        formData.append(key, String(value));
+      });
+    }
+    return this.patch<T>(url, formData, config);
+  }
+}
+
+// Factory function matching axios.create()
+export function create(config?: TauriHttpRequestConfig): TauriHttpClient {
+  return new TauriHttpClient(config);
+}
+
+// Default instance
+export default new TauriHttpClient();
@@ -0,0 +1,354 @@
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
+import { springAuth } from '@app/auth/springAuthClient';
+import apiClient from '@app/services/apiClient';
+import { AxiosError } from 'axios';
+
+// Mock apiClient
+vi.mock('@app/services/apiClient');
+
+describe('SpringAuthClient', () => {
+  beforeEach(() => {
+    // Clear localStorage before each test
+    localStorage.clear();
+    // Clear all mocks
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('getSession', () => {
+    it('should return null session when no JWT in localStorage', async () => {
+      const result = await springAuth.getSession();
+
+      expect(result.data.session).toBeNull();
+      expect(result.error).toBeNull();
+      expect(apiClient.get).not.toHaveBeenCalled();
+    });
+
+    it('should validate JWT and return session when JWT exists', async () => {
+      const mockToken = 'mock-jwt-token';
+      const mockUser = {
+        id: '123',
+        email: 'test@example.com',
+        username: 'testuser',
+        role: 'USER',
+      };
+
+      localStorage.setItem('stirling_jwt', mockToken);
+
+      vi.mocked(apiClient.get).mockResolvedValueOnce({
+        status: 200,
+        data: { user: mockUser },
+      } as any);
+
+      const result = await springAuth.getSession();
+
+      expect(apiClient.get).toHaveBeenCalledWith('/api/v1/auth/me', {
+        headers: { Authorization: `Bearer ${mockToken}` },
+        suppressErrorToast: true,
+      });
+      expect(result.data.session).toBeTruthy();
+      expect(result.data.session?.user).toEqual(mockUser);
+      expect(result.data.session?.access_token).toBe(mockToken);
+      expect(result.error).toBeNull();
+    });
+
+    it('should clear invalid JWT on 401 error', async () => {
+      const mockToken = 'invalid-jwt-token';
+      localStorage.setItem('stirling_jwt', mockToken);
+
+      const mockError = new AxiosError(
+        'Unauthorized',
+        'ERR_BAD_REQUEST',
+        undefined,
+        undefined,
+        {
+          status: 401,
+          statusText: 'Unauthorized',
+          data: {},
+          headers: {},
+          config: {} as any,
+        }
+      );
+
+      vi.mocked(apiClient.get).mockRejectedValueOnce(mockError);
+
+      const result = await springAuth.getSession();
+
+      expect(localStorage.getItem('stirling_jwt')).toBeNull();
+      expect(result.data.session).toBeNull();
+      // 401 is handled gracefully, so error should be null
+      expect(result.error).toBeNull();
+    });
+
+    it('should clear invalid JWT on 403 error', async () => {
+      const mockToken = 'forbidden-jwt-token';
+      localStorage.setItem('stirling_jwt', mockToken);
+
+      const mockError = new AxiosError(
+        'Forbidden',
+        'ERR_BAD_REQUEST',
+        undefined,
+        undefined,
+        {
+          status: 403,
+          statusText: 'Forbidden',
+          data: {},
+          headers: {},
+          config: {} as any,
+        }
+      );
+
+      vi.mocked(apiClient.get).mockRejectedValueOnce(mockError);
+
+      const result = await springAuth.getSession();
+
+      expect(localStorage.getItem('stirling_jwt')).toBeNull();
+      expect(result.data.session).toBeNull();
+      // 403 is handled gracefully, so error should be null
+      expect(result.error).toBeNull();
+    });
+  });
+
+  describe('signInWithPassword', () => {
+    it('should successfully sign in with email and password', async () => {
+      const credentials = {
+        email: 'test@example.com',
+        password: 'password123',
+      };
+
+      const mockToken = 'new-jwt-token';
+      const mockUser = {
+        id: '123',
+        email: credentials.email,
+        username: credentials.email,
+        role: 'USER',
+      };
+
+      vi.mocked(apiClient.post).mockResolvedValueOnce({
+        status: 200,
+        data: {
+          user: mockUser,
+          session: {
+            access_token: mockToken,
+            expires_in: 3600,
+          },
+        },
+      } as any);
+
+      // Spy on window.dispatchEvent
+      const dispatchEventSpy = vi.spyOn(window, 'dispatchEvent');
+
+      const result = await springAuth.signInWithPassword(credentials);
+
+      expect(apiClient.post).toHaveBeenCalledWith(
+        '/api/v1/auth/login',
+        {
+          username: credentials.email,
+          password: credentials.password,
+        },
+        { withCredentials: true }
+      );
+      expect(localStorage.getItem('stirling_jwt')).toBe(mockToken);
+      expect(dispatchEventSpy).toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'jwt-available' })
+      );
+      expect(result.user).toEqual(mockUser);
+      expect(result.session?.access_token).toBe(mockToken);
+      expect(result.error).toBeNull();
+    });
+
+    it('should return error on failed login', async () => {
+      const credentials = {
+        email: 'wrong@example.com',
+        password: 'wrongpassword',
+      };
+
+      const errorMessage = 'Invalid credentials';
+      const mockError = Object.assign(new Error(errorMessage), {
+        isAxiosError: true,
+        response: {
+          status: 401,
+          data: { message: errorMessage },
+        },
+      });
+
+      vi.mocked(apiClient.post).mockRejectedValueOnce(mockError);
+
+      const result = await springAuth.signInWithPassword(credentials);
+
+      expect(result.user).toBeNull();
+      expect(result.session).toBeNull();
+      expect(result.error).toBeTruthy();
+      expect(result.error?.message).toBe(errorMessage);
+    });
+  });
+
+  describe('signUp', () => {
+    it('should successfully register new user', async () => {
+      const credentials = {
+        email: 'newuser@example.com',
+        password: 'newpassword123',
+      };
+
+      const mockUser = {
+        id: '456',
+        email: credentials.email,
+        username: credentials.email,
+        role: 'USER',
+      };
+
+      vi.mocked(apiClient.post).mockResolvedValueOnce({
+        status: 200,
+        data: { user: mockUser },
+      } as any);
+
+      const result = await springAuth.signUp(credentials);
+
+      expect(apiClient.post).toHaveBeenCalledWith(
+        '/api/v1/user/register',
+        {
+          username: credentials.email,
+          password: credentials.password,
+        },
+        { withCredentials: true }
+      );
+      expect(result.user).toEqual(mockUser);
+      expect(result.session).toBeNull(); // No auto-login on signup
+      expect(result.error).toBeNull();
+    });
+
+    it('should return error on failed registration', async () => {
+      const credentials = {
+        email: 'existing@example.com',
+        password: 'password123',
+      };
+
+      const errorMessage = 'User already exists';
+      const mockError = Object.assign(new Error(errorMessage), {
+        isAxiosError: true,
+        response: {
+          status: 409,
+          data: { message: errorMessage },
+        },
+      });
+
+      vi.mocked(apiClient.post).mockRejectedValueOnce(mockError);
+
+      const result = await springAuth.signUp(credentials);
+
+      expect(result.user).toBeNull();
+      expect(result.session).toBeNull();
+      expect(result.error).toBeTruthy();
+      expect(result.error?.message).toBe(errorMessage);
+    });
+  });
+
+  describe('signOut', () => {
+    it('should successfully sign out and clear JWT', async () => {
+      const mockToken = 'jwt-to-clear';
+      localStorage.setItem('stirling_jwt', mockToken);
+
+      vi.mocked(apiClient.post).mockResolvedValueOnce({
+        status: 200,
+        data: {},
+      } as any);
+
+      const result = await springAuth.signOut();
+
+      expect(apiClient.post).toHaveBeenCalledWith(
+        '/api/v1/auth/logout',
+        null,
+        expect.objectContaining({ withCredentials: true })
+      );
+      expect(localStorage.getItem('stirling_jwt')).toBeNull();
+      expect(result.error).toBeNull();
+    });
+
+    it('should clear JWT even if logout request fails', async () => {
+      const mockToken = 'jwt-to-clear';
+      localStorage.setItem('stirling_jwt', mockToken);
+
+      vi.mocked(apiClient.post).mockRejectedValueOnce({
+        isAxiosError: true,
+        response: { status: 500 },
+        message: 'Server error',
+      });
+
+      const result = await springAuth.signOut();
+
+      expect(localStorage.getItem('stirling_jwt')).toBeNull();
+      expect(result.error).toBeTruthy();
+    });
+  });
+
+  describe('refreshSession', () => {
+    it('should refresh JWT token successfully', async () => {
+      const newToken = 'refreshed-jwt-token';
+      const mockUser = {
+        id: '123',
+        email: 'test@example.com',
+        username: 'testuser',
+        role: 'USER',
+      };
+
+      vi.mocked(apiClient.post).mockResolvedValueOnce({
+        status: 200,
+        data: {
+          user: mockUser,
+          session: {
+            access_token: newToken,
+            expires_in: 3600,
+          },
+        },
+      } as any);
+
+      const dispatchEventSpy = vi.spyOn(window, 'dispatchEvent');
+
+      const result = await springAuth.refreshSession();
+
+      expect(localStorage.getItem('stirling_jwt')).toBe(newToken);
+      expect(dispatchEventSpy).toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'jwt-available' })
+      );
+      expect(result.data.session?.access_token).toBe(newToken);
+      expect(result.error).toBeNull();
+    });
+
+    it('should clear JWT and return error on 401', async () => {
+      localStorage.setItem('stirling_jwt', 'expired-token');
+
+      vi.mocked(apiClient.post).mockRejectedValueOnce({
+        isAxiosError: true,
+        response: { status: 401 },
+        message: 'Token expired',
+      });
+
+      const result = await springAuth.refreshSession();
+
+      expect(localStorage.getItem('stirling_jwt')).toBeNull();
+      expect(result.data.session).toBeNull();
+      expect(result.error).toBeTruthy();
+    });
+  });
+
+  describe('signInWithOAuth', () => {
+    it('should redirect to OAuth provider', async () => {
+      const mockAssign = vi.fn();
+      Object.defineProperty(window, 'location', {
+        value: { assign: mockAssign },
+        writable: true,
+      });
+
+      const result = await springAuth.signInWithOAuth({
+        provider: 'github',
+        options: { redirectTo: '/auth/callback' },
+      });
+
+      expect(mockAssign).toHaveBeenCalledWith('/oauth2/authorization/github');
+      expect(result.error).toBeNull();
+    });
+  });
+});
@@ -134,6 +134,7 @@ class SpringAuthClient {
        headers: {
          'Authorization': `Bearer ${token}`,
        },
+        suppressErrorToast: true, // Suppress global error handler (we handle errors locally)
      });

      console.debug('[SpringAuth] /me response status:', response.status);
@@ -314,6 +315,7 @@ class SpringAuthClient {
          'X-XSRF-TOKEN': this.getCsrfToken() || '',
        },
        withCredentials: true,
+        suppressErrorToast: true, // Suppress global error handler (we handle errors locally)
      });

      const data = response.data;
@@ -1,5 +1,8 @@
 import { AppProviders as CoreAppProviders, AppProvidersProps } from "@core/components/AppProviders";
 import { AuthProvider } from "@app/auth/UseSession";
+import { LicenseProvider } from "@app/contexts/LicenseContext";
+import { CheckoutProvider } from "@app/contexts/CheckoutContext";
+import UpgradeBanner from "@app/components/shared/UpgradeBanner";

 export function AppProviders({ children, appConfigRetryOptions, appConfigProviderProps }: AppProvidersProps) {
  return (
@@ -8,7 +11,12 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
      appConfigProviderProps={appConfigProviderProps}
    >
      <AuthProvider>
-        {children}
+        <LicenseProvider>
+          <CheckoutProvider>
+            <UpgradeBanner />
+            {children}
+          </CheckoutProvider>
+        </LicenseProvider>
      </AuthProvider>
    </CoreAppProviders>
  );
@@ -0,0 +1,53 @@
+import React, { useState } from 'react';
+import { Button } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import licenseService from '@app/services/licenseService';
+import { alert } from '@app/components/toast';
+
+interface ManageBillingButtonProps {
+  returnUrl?: string;
+}
+
+export const ManageBillingButton: React.FC<ManageBillingButtonProps> = ({
+  returnUrl = window.location.href,
+}) => {
+  const { t } = useTranslation();
+  const [loading, setLoading] = useState(false);
+
+  const handleClick = async () => {
+    try {
+      setLoading(true);
+
+      // Get current license key for authentication
+      const licenseInfo = await licenseService.getLicenseInfo();
+
+      if (!licenseInfo.licenseKey) {
+        throw new Error('No license key found. Please activate a license first.');
+      }
+
+      // Create billing portal session with license key
+      const response = await licenseService.createBillingPortalSession(
+        returnUrl,
+        licenseInfo.licenseKey
+      );
+
+      // Open billing portal in new tab
+      window.open(response.url, '_blank');
+      setLoading(false);
+    } catch (error: any) {
+      console.error('Failed to open billing portal:', error);
+      alert({
+        alertType: 'error',
+        title: t('billing.portal.error', 'Failed to open billing portal'),
+        body: error.message || 'Please try again or contact support.',
+      });
+      setLoading(false);
+    }
+  };
+
+  return (
+    <Button variant="outline" onClick={handleClick} loading={loading}>
+      {t('billing.manageBilling', 'Manage Billing')}
+    </Button>
+  );
+};
@@ -0,0 +1,507 @@
+import React, { useState, useEffect, useCallback } from 'react';
+import { Modal, Button, Text, Alert, Loader, Stack, Group, Paper, SegmentedControl, Grid, Code } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { loadStripe } from '@stripe/stripe-js';
+import { EmbeddedCheckoutProvider, EmbeddedCheckout } from '@stripe/react-stripe-js';
+import licenseService, { PlanTierGroup } from '@app/services/licenseService';
+import { Z_INDEX_OVER_CONFIG_MODAL } from '@app/styles/zIndex';
+import { pollLicenseKeyWithBackoff, activateLicenseKey, resyncExistingLicense } from '@app/utils/licenseCheckoutUtils';
+
+// Validate Stripe key (static validation, no dynamic imports)
+const STRIPE_KEY = import.meta.env.VITE_STRIPE_PUBLISHABLE_KEY;
+
+if (!STRIPE_KEY) {
+  console.error(
+    'VITE_STRIPE_PUBLISHABLE_KEY environment variable is required. ' +
+    'Please add it to your .env file. ' +
+    'Get your key from https://dashboard.stripe.com/apikeys'
+  );
+}
+
+if (STRIPE_KEY && !STRIPE_KEY.startsWith('pk_')) {
+  console.error(
+    `Invalid Stripe publishable key format. ` +
+    `Expected key starting with 'pk_', got: ${STRIPE_KEY.substring(0, 10)}...`
+  );
+}
+
+const stripePromise = STRIPE_KEY ? loadStripe(STRIPE_KEY) : null;
+
+interface StripeCheckoutProps {
+  opened: boolean;
+  onClose: () => void;
+  planGroup: PlanTierGroup;
+  minimumSeats?: number;
+  onSuccess?: (sessionId: string) => void;
+  onError?: (error: string) => void;
+  onLicenseActivated?: (licenseInfo: {licenseType: string; enabled: boolean; maxUsers: number; hasKey: boolean}) => void;
+  hostedCheckoutSuccess?: {
+    isUpgrade: boolean;
+    licenseKey?: string;
+  } | null;
+}
+
+type CheckoutState = {
+  status: 'idle' | 'loading' | 'ready' | 'success' | 'error';
+  clientSecret?: string;
+  error?: string;
+  sessionId?: string;
+};
+
+const StripeCheckout: React.FC<StripeCheckoutProps> = ({
+  opened,
+  onClose,
+  planGroup,
+  minimumSeats = 1,
+  onSuccess,
+  onError,
+  onLicenseActivated,
+  hostedCheckoutSuccess,
+}) => {
+  const { t } = useTranslation();
+  const [state, setState] = useState<CheckoutState>({ status: 'idle' });
+  // Default to yearly if available (better value), otherwise monthly
+  const [selectedPeriod, setSelectedPeriod] = useState<'monthly' | 'yearly'>(
+    planGroup.yearly ? 'yearly' : 'monthly'
+  );
+  const [installationId, setInstallationId] = useState<string | null>(null);
+  const [currentLicenseKey, setCurrentLicenseKey] = useState<string | null>(null);
+  const [licenseKey, setLicenseKey] = useState<string | null>(null);
+  const [pollingStatus, setPollingStatus] = useState<'idle' | 'polling' | 'ready' | 'timeout'>('idle');
+
+  // Refs for polling cleanup
+  const isMountedRef = React.useRef(true);
+  const pollingTimeoutRef = React.useRef<NodeJS.Timeout | null>(null);
+
+  // Get the selected plan based on period
+  const selectedPlan = selectedPeriod === 'yearly' ? planGroup.yearly : planGroup.monthly;
+
+  const createCheckoutSession = async () => {
+    if (!selectedPlan) {
+      setState({
+        status: 'error',
+        error: 'Selected plan period is not available',
+      });
+      return;
+    }
+
+    try {
+      setState({ status: 'loading' });
+
+      // Fetch installation ID from backend
+      let fetchedInstallationId = installationId;
+      if (!fetchedInstallationId) {
+        fetchedInstallationId = await licenseService.getInstallationId();
+        setInstallationId(fetchedInstallationId);
+      }
+
+      // Fetch current license key for upgrades
+      let existingLicenseKey: string | undefined;
+      try {
+        const licenseInfo = await licenseService.getLicenseInfo();
+        if (licenseInfo && licenseInfo.licenseKey) {
+          existingLicenseKey = licenseInfo.licenseKey;
+          setCurrentLicenseKey(existingLicenseKey);
+          console.log('Found existing license for upgrade');
+        }
+      } catch (error) {
+        console.warn('Could not fetch license info, proceeding as new license:', error);
+      }
+
+      const response = await licenseService.createCheckoutSession({
+        lookup_key: selectedPlan.lookupKey,
+        installation_id: fetchedInstallationId,
+        current_license_key: existingLicenseKey,
+        requires_seats: selectedPlan.requiresSeats,
+        seat_count: Math.max(1, Math.min(minimumSeats || 1, 10000)),
+      });
+
+      // Check if we got a redirect URL (hosted checkout for HTTP)
+      if (response.url) {
+        console.log('Redirecting to Stripe hosted checkout:', response.url);
+        // Redirect to Stripe's hosted checkout page
+        window.location.href = response.url;
+        return;
+      }
+
+      // Otherwise, use embedded checkout (HTTPS)
+      setState({
+        status: 'ready',
+        clientSecret: response.clientSecret,
+        sessionId: response.sessionId,
+      });
+    } catch (err) {
+      const errorMessage =
+        err instanceof Error ? err.message : 'Failed to create checkout session';
+      setState({
+        status: 'error',
+        error: errorMessage,
+      });
+      onError?.(errorMessage);
+    }
+  };
+
+  const pollForLicenseKey = useCallback(async (installId: string) => {
+    // Use shared polling utility
+    const result = await pollLicenseKeyWithBackoff(installId, {
+      isMounted: () => isMountedRef.current,
+      onStatusChange: setPollingStatus,
+    });
+
+    if (result.success && result.licenseKey) {
+      setLicenseKey(result.licenseKey);
+
+      // Activate the license key
+      const activation = await activateLicenseKey(result.licenseKey, {
+        isMounted: () => isMountedRef.current,
+        onActivated: onLicenseActivated,
+      });
+
+      if (!activation.success) {
+        console.error('Failed to activate license key:', activation.error);
+      }
+    } else if (result.timedOut) {
+      console.warn('License key polling timed out');
+    } else if (result.error) {
+      console.error('License key polling failed:', result.error);
+    }
+  }, [onLicenseActivated]);
+
+  const handlePaymentComplete = async () => {
+    // Preserve state when changing status
+    setState(prev => ({ ...prev, status: 'success' }));
+
+    // Check if this is an upgrade (existing license key) or new plan
+    if (currentLicenseKey) {
+      // UPGRADE FLOW: Resync existing license with Keygen
+      console.log('Upgrade detected - resyncing existing license with Keygen');
+      setPollingStatus('polling');
+
+      const activation = await resyncExistingLicense({
+        isMounted: () => true, // Modal is open, no need to check
+        onActivated: onLicenseActivated,
+      });
+
+      if (activation.success) {
+        console.log(`License upgraded successfully: ${activation.licenseType}`);
+        setPollingStatus('ready');
+      } else {
+        console.error('Failed to sync upgraded license:', activation.error);
+        setPollingStatus('timeout');
+      }
+
+      // Notify parent (don't wait - upgrade is complete)
+      onSuccess?.(state.sessionId || '');
+    } else {
+      // NEW PLAN FLOW: Poll for new license key
+      console.log('New subscription - polling for license key');
+
+      if (installationId) {
+        pollForLicenseKey(installationId).finally(() => {
+          // Only notify parent after polling completes or times out
+          onSuccess?.(state.sessionId || '');
+        });
+      } else {
+        // No installation ID, notify immediately
+        onSuccess?.(state.sessionId || '');
+      }
+    }
+  };
+
+  const handleClose = () => {
+    // Clear any active polling
+    if (pollingTimeoutRef.current) {
+      clearTimeout(pollingTimeoutRef.current);
+      pollingTimeoutRef.current = null;
+    }
+
+    setState({ status: 'idle' });
+    setPollingStatus('idle');
+    setCurrentLicenseKey(null);
+    setLicenseKey(null);
+    // Reset to default period on close
+    setSelectedPeriod(planGroup.yearly ? 'yearly' : 'monthly');
+    onClose();
+  };
+
+  const handlePeriodChange = (value: string) => {
+    setSelectedPeriod(value as 'monthly' | 'yearly');
+    // Reset state to trigger checkout reload
+    setState({ status: 'idle' });
+  };
+
+  // Cleanup on unmount
+  useEffect(() => {
+    isMountedRef.current = true;
+
+    return () => {
+      isMountedRef.current = false;
+      if (pollingTimeoutRef.current) {
+        clearTimeout(pollingTimeoutRef.current);
+        pollingTimeoutRef.current = null;
+      }
+    };
+  }, []);
+
+  // Handle hosted checkout success - open directly to success state
+  useEffect(() => {
+    if (opened && hostedCheckoutSuccess) {
+      console.log('Opening modal to success state for hosted checkout return');
+
+      // Set appropriate state based on upgrade vs new subscription
+      if (hostedCheckoutSuccess.isUpgrade) {
+        setCurrentLicenseKey('existing'); // Flag to indicate upgrade
+        setPollingStatus('ready');
+      } else if (hostedCheckoutSuccess.licenseKey) {
+        setLicenseKey(hostedCheckoutSuccess.licenseKey);
+        setPollingStatus('ready');
+      }
+
+      // Set to success state to show success UI
+      setState({ status: 'success' });
+    }
+  }, [opened, hostedCheckoutSuccess]);
+
+  // Initialize checkout when modal opens or period changes
+  useEffect(() => {
+    // Don't reset if we're showing success state (license key)
+    if (state.status === 'success') {
+      return;
+    }
+
+    // Skip initialization if opening for hosted checkout success
+    if (hostedCheckoutSuccess) {
+      return;
+    }
+
+    if (opened && state.status === 'idle') {
+      createCheckoutSession();
+    } else if (!opened) {
+      setState({ status: 'idle' });
+    }
+  }, [opened, selectedPeriod, state.status, hostedCheckoutSuccess]);
+
+  const renderContent = () => {
+    // Check if Stripe is configured
+    if (!stripePromise) {
+      return (
+        <Alert color="red" title={t('payment.stripeNotConfigured', 'Stripe Not Configured')}>
+          <Stack gap="md">
+            <Text size="sm">
+              {t(
+                'payment.stripeNotConfiguredMessage',
+                'Stripe payment integration is not configured. Please contact your administrator.'
+              )}
+            </Text>
+            <Button variant="outline" onClick={handleClose}>
+              {t('common.close', 'Close')}
+            </Button>
+          </Stack>
+        </Alert>
+      );
+    }
+
+    switch (state.status) {
+      case 'loading':
+        return (
+          <Stack align="center" justify="center" style={{ padding: '2rem 0' }}>
+            <Loader size="lg" />
+            <Text size="sm" c="dimmed" mt="md">
+              {t('payment.preparing', 'Preparing your checkout...')}
+            </Text>
+          </Stack>
+        );
+
+      case 'ready':
+        {
+        if (!state.clientSecret || !selectedPlan) return null;
+
+        // Build period selector data with prices
+        const periodData = [];
+        if (planGroup.monthly) {
+          const monthlyPrice = planGroup.monthly.requiresSeats && planGroup.monthly.seatPrice
+            ? `${planGroup.monthly.currency}${planGroup.monthly.price.toFixed(2)}${planGroup.monthly.period} + ${planGroup.monthly.currency}${planGroup.monthly.seatPrice.toFixed(2)}/seat`
+            : `${planGroup.monthly.currency}${planGroup.monthly.price.toFixed(2)}${planGroup.monthly.period}`;
+
+          periodData.push({
+            value: 'monthly',
+            label: `${t('payment.monthly', 'Monthly')} - ${monthlyPrice}`,
+          });
+        }
+        if (planGroup.yearly) {
+          const yearlyPrice = planGroup.yearly.requiresSeats && planGroup.yearly.seatPrice
+            ? `${planGroup.yearly.currency}${planGroup.yearly.price.toFixed(2)}${planGroup.yearly.period} + ${planGroup.yearly.currency}${planGroup.yearly.seatPrice.toFixed(2)}/seat`
+            : `${planGroup.yearly.currency}${planGroup.yearly.price.toFixed(2)}${planGroup.yearly.period}`;
+
+          periodData.push({
+            value: 'yearly',
+            label: `${t('payment.yearly', 'Yearly')} - ${yearlyPrice}`,
+          });
+        }
+
+        return (
+          <Grid gutter="md">
+            {/* Left: Period Selector - only show if both periods available */}
+            {periodData.length > 1 && (
+              <Grid.Col span={3}>
+                <Stack gap="sm" style={{ height: '100%' }}>
+                  <Text size="sm" fw={600}>
+                    {t('payment.billingPeriod', 'Billing Period')}
+                  </Text>
+                  <SegmentedControl
+                    value={selectedPeriod}
+                    onChange={handlePeriodChange}
+                    data={periodData}
+                    orientation="vertical"
+                    fullWidth
+                  />
+                  {selectedPlan.requiresSeats && selectedPlan.seatPrice && (
+                    <Text size="xs" c="dimmed" mt="md">
+                      {t('payment.enterpriseNote', 'Seats can be adjusted in checkout (1-1000).')}
+                    </Text>
+                  )}
+                </Stack>
+              </Grid.Col>
+            )}
+
+            {/* Right: Stripe Checkout */}
+            <Grid.Col span={periodData.length > 1 ? 9 : 12}>
+              <EmbeddedCheckoutProvider
+                key={state.clientSecret}
+                stripe={stripePromise}
+                options={{
+                  clientSecret: state.clientSecret,
+                  onComplete: handlePaymentComplete,
+                }}
+              >
+                <EmbeddedCheckout />
+              </EmbeddedCheckoutProvider>
+            </Grid.Col>
+          </Grid>
+        );
+      }
+      case 'success':
+        return (
+          <Alert color="green" title={t('payment.success', 'Payment Successful!')}>
+            <Stack gap="md">
+              <Text size="sm">
+                {t(
+                  'payment.successMessage',
+                  'Your subscription has been activated successfully.'
+                )}
+              </Text>
+
+              {/* License Key Polling Status */}
+              {pollingStatus === 'polling' && (
+                <Group gap="xs">
+                  <Loader size="sm" />
+                  <Text size="sm" c="dimmed">
+                    {currentLicenseKey
+                      ? t('payment.syncingLicense', 'Syncing your upgraded license...')
+                      : t('payment.generatingLicense', 'Generating your license key...')}
+                  </Text>
+                </Group>
+              )}
+
+              {pollingStatus === 'ready' && !currentLicenseKey && licenseKey && (
+                <Paper withBorder p="md" radius="md" bg="gray.1">
+                  <Stack gap="sm">
+                    <Text size="sm" fw={600}>
+                      {t('payment.licenseKey', 'Your License Key')}
+                    </Text>
+                    <Code block>{licenseKey}</Code>
+                    <Button
+                      variant="light"
+                      size="sm"
+                      onClick={() => navigator.clipboard.writeText(licenseKey)}
+                    >
+                      {t('common.copy', 'Copy to Clipboard')}
+                    </Button>
+                    <Text size="xs" c="dimmed">
+                      {t(
+                        'payment.licenseInstructions',
+                        'Enter this key in Settings → Admin Plan → License Key section'
+                      )}
+                    </Text>
+                  </Stack>
+                </Paper>
+              )}
+
+              {pollingStatus === 'ready' && currentLicenseKey && (
+                <Alert color="green" title={t('payment.upgradeComplete', 'Upgrade Complete')}>
+                  <Text size="sm">
+                    {t(
+                      'payment.upgradeCompleteMessage',
+                      'Your subscription has been upgraded successfully. Your existing license key has been updated.'
+                    )}
+                  </Text>
+                </Alert>
+              )}
+
+              {pollingStatus === 'timeout' && (
+                <Alert color="yellow" title={t('payment.licenseDelayed', 'License Key Processing')}>
+                  <Text size="sm">
+                    {t(
+                      'payment.licenseDelayedMessage',
+                      'Your license key is being generated. Please check your email shortly or contact support.'
+                    )}
+                  </Text>
+                </Alert>
+              )}
+
+              {pollingStatus === 'ready' && (
+                <Text size="xs" c="dimmed">
+                  {t('payment.canCloseWindow', 'You can now close this window.')}
+                </Text>
+              )}
+            </Stack>
+          </Alert>
+        );
+
+      case 'error':
+        return (
+          <Alert color="red" title={t('payment.error', 'Payment Error')}>
+            <Stack gap="md">
+              <Text size="sm">{state.error}</Text>
+              <Button variant="outline" onClick={handleClose}>
+                {t('common.close', 'Close')}
+              </Button>
+            </Stack>
+          </Alert>
+        );
+
+      default:
+        return null;
+    }
+  };
+
+  return (
+    <Modal
+      opened={opened}
+      onClose={handleClose}
+      title={
+        <Text fw={600} size="lg">
+          {t('payment.upgradeTitle', 'Upgrade to {{planName}}', { planName: planGroup.name })}
+        </Text>
+      }
+      size="90%"
+      centered
+      withCloseButton={true}
+      closeOnEscape={true}
+      closeOnClickOutside={false}
+      zIndex={Z_INDEX_OVER_CONFIG_MODAL}
+      styles={{
+        body: {
+          minHeight: '85vh',
+        },
+        content: {
+          maxHeight: '95vh',
+        },
+      }}
+    >
+      {renderContent()}
+    </Modal>
+  );
+};
+
+export default StripeCheckout;
@@ -0,0 +1,144 @@
+import React, { useState, useEffect } from 'react';
+import { Group, Text, Button, ActionIcon, Paper } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { useAuth } from '@app/auth/UseSession';
+import { useCheckout } from '@app/contexts/CheckoutContext';
+import { useLicense } from '@app/contexts/LicenseContext';
+import { mapLicenseToTier } from '@app/services/licenseService';
+import LocalIcon from '@app/components/shared/LocalIcon';
+import { isSupabaseConfigured } from '@app/services/supabaseClient';
+
+/**
+ * UpgradeBanner - Dismissable top banner encouraging users to upgrade
+ *
+ * This component demonstrates:
+ * - How to check authentication status with useAuth()
+ * - How to check license status with licenseService
+ * - How to open checkout modal with useCheckout()
+ * - How to persist dismissal state with localStorage
+ *
+ * To remove this banner:
+ * 1. Remove the import and component from AppProviders.tsx
+ * 2. Delete this file
+ */
+const UpgradeBanner: React.FC = () => {
+  const { t } = useTranslation();
+  const { user } = useAuth();
+  const { openCheckout } = useCheckout();
+  const { licenseInfo, loading: licenseLoading } = useLicense();
+  const [isVisible, setIsVisible] = useState(false);
+
+  // Check if user should see the banner
+  useEffect(() => {
+    // Don't show if not logged in
+    if (!user) {
+      setIsVisible(false);
+      return;
+    }
+
+    // Don't show if Supabase is not configured (no checkout available)
+    if (!isSupabaseConfigured) {
+      setIsVisible(false);
+      return;
+    }
+
+    // Don't show while license is loading
+    if (licenseLoading) {
+      return;
+    }
+
+    // Check if banner was dismissed
+    const dismissed = localStorage.getItem('upgradeBannerDismissed');
+    if (dismissed === 'true') {
+      setIsVisible(false);
+      return;
+    }
+
+    // Check license status from global context
+    const tier = mapLicenseToTier(licenseInfo);
+
+    // Show banner only for free tier users
+    if (tier === 'free' || tier === null) {
+      setIsVisible(true);
+    } else {
+      // Auto-hide banner if user upgrades
+      setIsVisible(false);
+    }
+  }, [user, licenseInfo, licenseLoading]);
+
+  // Handle dismiss
+  const handleDismiss = () => {
+    localStorage.setItem('upgradeBannerDismissed', 'true');
+    setIsVisible(false);
+  };
+
+  // Handle upgrade button click
+  const handleUpgrade = () => {
+    openCheckout('server', {
+      currency: 'gbp',
+      minimumSeats: 1,
+      onSuccess: () => {
+        // Banner will auto-hide on next render when license is detected
+        setIsVisible(false);
+      },
+    });
+  };
+
+  // Don't render anything if loading or not visible
+  if (licenseLoading || !isVisible) {
+    return null;
+  }
+
+  return (
+    <Paper
+      shadow="sm"
+      p="md"
+      style={{
+        position: 'fixed',
+        top: 0,
+        left: 0,
+        right: 0,
+        zIndex: 1000,
+        borderRadius: 0,
+        background: 'linear-gradient(135deg, #667eea 0%, #764ba2 100%)',
+        color: 'white',
+      }}
+    >
+      <Group justify="space-between" wrap="nowrap">
+        <Group gap="md" wrap="nowrap">
+          <LocalIcon icon="stars-rounded" width="1.5rem" height="1.5rem" />
+          <div>
+            <Text size="sm" fw={600}>
+              {t('upgradeBanner.title', 'Upgrade to Server Plan')}
+            </Text>
+            <Text size="xs" opacity={0.9}>
+              {t('upgradeBanner.message', 'Get the most out of Stirling PDF with unlimited users and advanced features')}
+            </Text>
+          </div>
+        </Group>
+
+        <Group gap="xs" wrap="nowrap">
+          <Button
+            variant="white"
+            size="sm"
+            onClick={handleUpgrade}
+            leftSection={<LocalIcon icon="upgrade-rounded" width="1rem" height="1rem" />}
+          >
+            {t('upgradeBanner.upgradeButton', 'Upgrade Now')}
+          </Button>
+          <ActionIcon
+            variant="subtle"
+            color="white"
+            size="lg"
+            onClick={handleDismiss}
+            aria-label={t('upgradeBanner.dismiss', 'Dismiss banner')}
+          >
+            <LocalIcon icon="close-rounded" width="1.25rem" height="1.25rem" />
+          </ActionIcon>
+        </Group>
+      </Group>
+    </Paper>
+  );
+};
+
+export default UpgradeBanner;
@@ -10,6 +10,7 @@ import AdminDatabaseSection from '@app/components/shared/config/configSections/A
 import AdminAdvancedSection from '@app/components/shared/config/configSections/AdminAdvancedSection';
 import AdminLegalSection from '@app/components/shared/config/configSections/AdminLegalSection';
 import AdminPremiumSection from '@app/components/shared/config/configSections/AdminPremiumSection';
+import AdminPlanSection from '@app/components/shared/config/configSections/AdminPlanSection';
 import AdminFeaturesSection from '@app/components/shared/config/configSections/AdminFeaturesSection';
 import AdminEndpointsSection from '@app/components/shared/config/configSections/AdminEndpointsSection';
 import AdminAuditSection from '@app/components/shared/config/configSections/AdminAuditSection';
@@ -136,6 +137,14 @@ export const createConfigNavSections = (
          disabled: requiresLogin,
          disabledTooltip: requiresLogin ? 'Enable login mode first' : undefined
        },
+        {
+          key: 'adminPlan',
+          label: 'Plan',
+          icon: 'star-rounded',
+          component: <AdminPlanSection />,
+          disabled: requiresLogin,
+          disabledTooltip: requiresLogin ? 'Enable login mode first' : undefined
+        },
        {
          key: 'adminAudit',
          label: 'Audit',
@@ -0,0 +1,240 @@
+import React, { useState, useCallback, useEffect } from 'react';
+import { Divider, Loader, Alert, Select, Group, Text, Collapse, Button, TextInput, Stack, Paper } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { usePlans } from '@app/hooks/usePlans';
+import licenseService, { PlanTierGroup } from '@app/services/licenseService';
+import { useCheckout } from '@app/contexts/CheckoutContext';
+import { useLicense } from '@app/contexts/LicenseContext';
+import AvailablePlansSection from '@app/components/shared/config/configSections/plan/AvailablePlansSection';
+import StaticPlanSection from '@app/components/shared/config/configSections/plan/StaticPlanSection';
+import { alert } from '@app/components/toast';
+import LocalIcon from '@app/components/shared/LocalIcon';
+import { Z_INDEX_OVER_CONFIG_MODAL } from '@app/styles/zIndex';
+import { ManageBillingButton } from '@app/components/shared/ManageBillingButton';
+import { isSupabaseConfigured } from '@app/services/supabaseClient';
+
+const AdminPlanSection: React.FC = () => {
+  const { t } = useTranslation();
+  const { openCheckout } = useCheckout();
+  const { licenseInfo, refetchLicense } = useLicense();
+  const [currency, setCurrency] = useState<string>('gbp');
+  const [useStaticVersion, setUseStaticVersion] = useState(false);
+  const [showLicenseKey, setShowLicenseKey] = useState(false);
+  const [licenseKeyInput, setLicenseKeyInput] = useState<string>('');
+  const [savingLicense, setSavingLicense] = useState(false);
+  const { plans, loading, error, refetch } = usePlans(currency);
+
+  // Check if we should use static version
+  useEffect(() => {
+    // Check if Stripe and Supabase are configured
+    const stripeKey = import.meta.env.VITE_STRIPE_PUBLISHABLE_KEY;
+    if (!stripeKey || !isSupabaseConfigured || error) {
+      setUseStaticVersion(true);
+    }
+  }, [error]);
+
+  const handleSaveLicense = async () => {
+    try {
+      setSavingLicense(true);
+      // Allow empty string to clear/remove license
+      const response = await licenseService.saveLicenseKey(licenseKeyInput.trim());
+
+      if (response.success) {
+        // Refresh license context to update all components
+        await refetchLicense();
+
+        alert({
+          alertType: 'success',
+          title: t('admin.settings.premium.key.success', 'License Key Saved'),
+          body: t('admin.settings.premium.key.successMessage', 'Your license key has been activated successfully. No restart required.'),
+        });
+
+        // Clear input
+        setLicenseKeyInput('');
+      } else {
+        alert({
+          alertType: 'error',
+          title: t('admin.error', 'Error'),
+          body: response.error || t('admin.settings.saveError', 'Failed to save license key'),
+        });
+      }
+    } catch (error) {
+      console.error('Failed to save license key:', error);
+      alert({
+        alertType: 'error',
+        title: t('admin.error', 'Error'),
+        body: t('admin.settings.saveError', 'Failed to save license key'),
+      });
+    } finally {
+      setSavingLicense(false);
+    }
+  };
+
+  const currencyOptions = [
+    { value: 'gbp', label: 'British pound (GBP, £)' },
+    { value: 'usd', label: 'US dollar (USD, $)' },
+    { value: 'eur', label: 'Euro (EUR, €)' },
+    { value: 'cny', label: 'Chinese yuan (CNY, ¥)' },
+    { value: 'inr', label: 'Indian rupee (INR, ₹)' },
+    { value: 'brl', label: 'Brazilian real (BRL, R$)' },
+    { value: 'idr', label: 'Indonesian rupiah (IDR, Rp)' },
+  ];
+
+  const handleUpgradeClick = useCallback(
+    (planGroup: PlanTierGroup) => {
+      // Only allow upgrades for server and enterprise tiers
+      if (planGroup.tier === 'free') {
+        return;
+      }
+
+      // Use checkout context to open checkout modal
+      openCheckout(planGroup.tier, {
+        currency,
+        onSuccess: () => {
+          // Refetch plans after successful payment
+          // License context will auto-update
+          refetch();
+        },
+      });
+    },
+    [openCheckout, currency, refetch]
+  );
+
+  // Show static version if Stripe is not configured or there's an error
+  if (useStaticVersion) {
+    return <StaticPlanSection currentLicenseInfo={licenseInfo ?? undefined} />;
+  }
+
+  // Early returns after all hooks are called
+  if (loading) {
+    return (
+      <div style={{ display: 'flex', justifyContent: 'center', alignItems: 'center', padding: '2rem 0' }}>
+        <Loader size="lg" />
+      </div>
+    );
+  }
+
+  if (error) {
+    // Fallback to static version on error
+    return <StaticPlanSection currentLicenseInfo={licenseInfo ?? undefined} />;
+  }
+
+  if (!plans || plans.length === 0) {
+    return (
+      <Alert color="yellow" title="No data available">
+        Plans data is not available at the moment.
+      </Alert>
+    );
+  }
+
+  return (
+    <div style={{ display: 'flex', flexDirection: 'column', gap: '2rem' }}>
+      {/* Currency Selection & Manage Subscription */}
+      <Paper withBorder p="md" radius="md">
+        <Stack gap="md">
+          <Group justify="space-between" align="center">
+            <Text size="lg" fw={600}>
+              {t('plan.currency', 'Currency')}
+            </Text>
+            <Select
+              value={currency}
+              onChange={(value) => setCurrency(value || 'gbp')}
+              data={currencyOptions}
+              searchable
+              clearable={false}
+              w={300}
+              comboboxProps={{ withinPortal: true, zIndex: Z_INDEX_OVER_CONFIG_MODAL }}
+            />
+          </Group>
+
+          {/* Manage Subscription Button - Only show if user has active license and Supabase is configured */}
+          {licenseInfo?.licenseKey && isSupabaseConfigured && (
+            <Group justify="space-between" align="center">
+              <Text size="sm" c="dimmed">
+                {t('plan.manageSubscription.description', 'Manage your subscription, billing, and payment methods')}
+              </Text>
+              <ManageBillingButton />
+            </Group>
+          )}
+        </Stack>
+      </Paper>
+
+      <AvailablePlansSection
+        plans={plans}
+        currentLicenseInfo={licenseInfo}
+        onUpgradeClick={handleUpgradeClick}
+      />
+
+      <Divider />
+
+      {/* License Key Section */}
+      <div>
+        <Button
+          variant="subtle"
+          leftSection={<LocalIcon icon={showLicenseKey ? "expand-less-rounded" : "expand-more-rounded"} width="1.25rem" height="1.25rem" />}
+          onClick={() => setShowLicenseKey(!showLicenseKey)}
+        >
+          {t('admin.settings.premium.licenseKey.toggle', 'Got a license key or certificate file?')}
+        </Button>
+
+        <Collapse in={showLicenseKey} mt="md">
+          <Stack gap="md">
+            <Alert
+              variant="light"
+              color="blue"
+              icon={<LocalIcon icon="info-rounded" width="1rem" height="1rem" />}
+            >
+              <Text size="sm">
+                {t('admin.settings.premium.licenseKey.info', 'If you have a license key or certificate file from a direct purchase, you can enter it here to activate premium or enterprise features.')}
+              </Text>
+            </Alert>
+
+            {/* Severe warning if license already exists */}
+            {licenseInfo?.licenseKey && (
+              <Alert
+                variant="light"
+                color="red"
+                icon={<LocalIcon icon="warning-rounded" width="1rem" height="1rem" />}
+                title={t('admin.settings.premium.key.overwriteWarning.title', '⚠️ Warning: Existing License Detected')}
+              >
+                <Stack gap="xs">
+                  <Text size="sm" fw={600}>
+                    {t('admin.settings.premium.key.overwriteWarning.line1', 'Overwriting your current license key cannot be undone.')}
+                  </Text>
+                  <Text size="sm">
+                    {t('admin.settings.premium.key.overwriteWarning.line2', 'Your previous license will be permanently lost unless you have backed it up elsewhere.')}
+                  </Text>
+                  <Text size="sm" fw={500}>
+                    {t('admin.settings.premium.key.overwriteWarning.line3', 'Important: Keep license keys private and secure. Never share them publicly.')}
+                  </Text>
+                </Stack>
+              </Alert>
+            )}
+
+            <Paper withBorder p="md" radius="md">
+              <Stack gap="md">
+                <TextInput
+                  label={t('admin.settings.premium.key.label', 'License Key')}
+                  description={t('admin.settings.premium.key.description', 'Enter your premium or enterprise license key. Premium features will be automatically enabled when a key is provided.')}
+                  value={licenseKeyInput}
+                  onChange={(e) => setLicenseKeyInput(e.target.value)}
+                  placeholder={licenseInfo?.licenseKey || '00000000-0000-0000-0000-000000000000'}
+                  type="password"
+                  disabled={savingLicense}
+                />
+
+                <Group justify="flex-end">
+                  <Button onClick={handleSaveLicense} loading={savingLicense} size="sm">
+                    {t('admin.settings.save', 'Save Changes')}
+                  </Button>
+                </Group>
+              </Stack>
+            </Paper>
+          </Stack>
+        </Collapse>
+      </div>
+    </div>
+  );
+};
+
+export default AdminPlanSection;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Anthony Stirling	84ac407017	extra validations	2025-11-21 12:59:30 +00:00
Anthony Stirling	794d15ebaa	address comments list[]	2025-11-21 12:57:35 +00:00
Anthony Stirling	1e11848d4f	remove logs	2025-11-21 11:55:25 +00:00
Anthony Stirling	5f32502b54	style cleanup	2025-11-21 11:49:35 +00:00
Anthony Stirling	4f4f3c90ba	Merge branch 'codex/re-enable-tool-disabling-functionality' of git@github.com:Stirling-Tools/Stirling-PDF.git into codex/re-enable-tool-disabling-functionality	2025-11-21 11:03:52 +00:00
Anthony Stirling	2e51a7b288	translations	2025-11-21 10:48:01 +00:00
Anthony Stirling	8140ff8c02	rtf to text oops	2025-11-20 23:57:05 +00:00
Anthony StirlingandGitHub	432e1047d9	Merge branch 'V2' into codex/re-enable-tool-disabling-functionality	2025-11-20 23:55:00 +00:00
Anthony Stirling	89df78c347	update tool disable	2025-11-20 23:52:02 +00:00
Anthony Stirling	dd6419743f	Merge remote-tracking branch 'origin/V2' into codex/re-enable-tool-disabling-functionality	2025-11-20 21:27:06 +00:00
Dario Ghunney WareandGitHub	fca8470637	Moar Login Fixes (#4948 )	2025-11-20 20:51:53 +00:00
Balázs SzücsandGitHub	76f2fd3b76	[V2] refactor(tooltips): add merge tooltips header for consistency, and update other tooltips (#4895 ) # Description of Changes Note on tooltips: I'll do more PRs on tooltips, however this has priority, hence I submitted this for now. #### Before: <img width="758" height="721" alt="image" src="https://github.com/user-attachments/assets/ce3166d2-c681-447e-82df-68fe6d18669d" /> <img width="782" height="485" alt="image" src="https://github.com/user-attachments/assets/48970a4c-9911-4ade-9346-c33c5a6a319f" /> <img width="782" height="602" alt="image" src="https://github.com/user-attachments/assets/9f77648d-4d1a-4e4b-93af-eaab6db849ff" /> <img width="782" height="602" alt="image" src="https://github.com/user-attachments/assets/ae653534-bf04-47a0-8aab-0bb5b9c3ecef" /> #### After: <img width="758" height="721" alt="image" src="https://github.com/user-attachments/assets/8d45e876-a0df-4fe3-89a8-5184492db204" /> <img width="782" height="602" alt="image" src="https://github.com/user-attachments/assets/550ee105-1286-4072-9f55-46255b3fbe80" /> <img width="782" height="602" alt="image" src="https://github.com/user-attachments/assets/fba7ea93-73fe-4529-84fe-c37816375a9e" /> <img width="782" height="602" alt="image" src="https://github.com/user-attachments/assets/ca452e77-b58b-4a5b-8e97-e6ccef4cf500" /> <!-- Please provide a summary of the changes, including: - What was changed - Why the change was made - Any challenges encountered Closes #(issue_number) --> --- ## Checklist ### General - [X] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [X] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [X] I have performed a self-review of my own code - [X] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [X] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details. --------- Signed-off-by: Balázs Szücs <bszucs1209@gmail.com>	2025-11-20 15:00:16 +00:00
Balázs SzücsandGitHub	06af6be14b	[V2] feat(pipeline): add pre-publish sanitization workflow (#4910 ) # Description of Changes TLDR - Created `Pre-publish-sanitization.json` default pipeline configuration - Added sanitization operations removing metadata, JavaScript, embedded files, and annotations - Registered new pipeline in `GeneralUtils` - Included "Pre-publish Sanitization" in the suggested automations list This pull request introduces a new "Pre-publish Sanitization" workflow for PDF files, designed to help users remove sensitive metadata and content before publishing documents online. The changes include backend and frontend updates to support this workflow, as well as a minor bug fix in form data handling. New Pre-publish Sanitization Workflow: * Added a new default configuration file `Pre-publish-sanitization.json` that defines a pipeline for sanitizing PDFs by removing JavaScript, embedded files, metadata, annotations, flattening forms, and compressing the document. * Registered the new `Pre-publish-sanitization.json` config in the set of default web UI configurations in `GeneralUtils.java`, making it available in the application. Frontend Integration: * Added a new suggested automation called "Pre-publish Sanitization" in the `useSuggestedAutomations` hook, including its name, description, operations, and a new privacy icon for better UI representation. <!-- Please provide a summary of the changes, including: - What was changed - Why the change was made - Any challenges encountered Closes #(issue_number) --> --- ## Checklist ### General - [X] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [X] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [X] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [X] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details. --------- Signed-off-by: Balázs Szücs <bszucs1209@gmail.com>	2025-11-20 14:59:13 +00:00
Anthony StirlingandGitHub	c87da6d5cc	Add automatic unlock prompt for encrypted PDFs (#4912 ) ## Summary - propagate an `isEncrypted` flag from thumbnail generation into processed file metadata so uploads know when a password is still present - add queueing logic inside `FileContext` that detects encrypted uploads, prompts the user via a new modal, and automatically runs the Remove Password endpoint to replace the file and preserve history - introduce a dedicated `EncryptedPdfUnlockModal` component that mirrors existing styling and messaging for unlocking PDFs ## Testing - npm run typecheck:core ------ [Codex Task](https://chatgpt.com/codex/tasks/task_b_6919a0a418bc8328b886ec76a28170b7)	2025-11-20 14:54:41 +00:00
Anthony Stirling GitHub James Brunton James Brunton	6c8d2c89fe	Add initial Windows signing infrastructure (#4945 ) # Description of Changes <!-- Please provide a summary of the changes, including: - What was changed - Why the change was made - Any challenges encountered Closes #(issue_number) --> --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details. --------- Co-authored-by: James Brunton <james@stirlingpdf.com> Co-authored-by: James Brunton <jbrunton96@gmail.com>	2025-11-20 12:21:42 +00:00
ConnorYoh GitHub Anthony Stirling Connor Yoh	8d9e70c796	Stripe and license payment integration (#4935 ) selfhosted stripe payment and license integration --------- Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com> Co-authored-by: Connor Yoh <connor@stirlingpdf.com>	2025-11-20 12:07:37 +00:00
James BruntonandGitHub	f4725b98b0	Allow desktop app to connect to selfhosted servers (#4902 ) # Description of Changes Changes the desktop app to allow connections to self-hosted servers on first startup. This was quite involved and hit loads of CORS issues all through the stack, but I think it's working now. This also changes the bundled backend to spawn on an OS-decided port rather than always spawning on `8080`, which means that the user can have other things running on port `8080` now and the app will still work fine. There were quite a few places that needed to be updated to decouple the app from explicitly using `8080` and I was originally going to split those changes out into another PR (#4939), but I couldn't get it working independently in the time I had, so the diff here is just going to be complex and contian two distinct changes - sorry 🙁	2025-11-20 10:03:34 +00:00
Anthony Stirling	5f62e6f81f	Differentiate unavailable tools by reason	2025-11-16 22:05:25 +00:00