Update embed and allow form rendering

# Description of Changes

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.

---------

Co-authored-by: Reece <reece@stirlingpdf.com>
Co-authored-by: Reece Browne <74901996+reecebrowne@users.noreply.github.com>

.dockerignore

@@ -5,6 +5,7 @@ frontend/dist
 frontend/build
 frontend/.vite
 frontend/.tauri
+frontend/src-tauri/target
 
 # Gradle build artifacts
 .gradle

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -180,7 +180,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha

.github/workflows/build.yml

@@ -262,7 +262,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        docker-rev: ["Dockerfile", "Dockerfile.ultra-lite", "Dockerfile.fat"]
+        docker-rev: ["docker/embedded/Dockerfile", "docker/embedded/Dockerfile.ultra-lite", "docker/embedded/Dockerfile.fat"]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -301,7 +301,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/backend/${{ matrix.docker-rev }}
+          file: ./${{ matrix.docker-rev }}
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/push-docker-v2.yml

@@ -5,6 +5,7 @@ on:
   push:
     branches:
       - V2-master
+      - alljavadocker
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -93,10 +94,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
             type=raw,value=latest
 
-      - name: Generate tags for latest (V2-demo branch - test)
+      - name: Generate tags for latest (alljavadocker branch - test)
         id: meta-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
+        if: github.ref == 'refs/heads/alljavadocker'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -110,7 +111,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/Dockerfile.unified
+          file: ./docker/embedded/Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -149,10 +150,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
             type=raw,value=latest-fat
 
-      - name: Generate tags for latest-fat (V2-demo branch - test)
+      - name: Generate tags for latest-fat (alljavadocker branch - test)
         id: meta-fat-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
+        if: github.ref == 'refs/heads/alljavadocker'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -166,7 +167,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/Dockerfile.unified
+          file: ./docker/embedded/Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -203,10 +204,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
             type=raw,value=latest-ultra-lite
 
-      - name: Generate tags for ultra-lite (V2-demo branch - test)
+      - name: Generate tags for ultra-lite (alljavadocker branch - test)
         id: meta-lite-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
+        if: github.ref == 'refs/heads/alljavadocker'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -220,7 +221,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/Dockerfile.unified-lite
+          file: ./docker/embedded/Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/push-docker.yml

@@ -107,7 +107,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -152,7 +152,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         with:
           context: .
-          file: ./Dockerfile.ultra-lite
+          file: ./docker/embedded/Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -183,7 +183,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./Dockerfile.fat
+          file: ./docker/embedded/Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/testdriver.yml

@@ -66,7 +66,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Analysis",
         description =
                 """
-                Document analysis and information extraction services for content intelligence and insights.
+                Read-only inspection of PDFs: page count, page sizes, fonts, form fields, annotations, document properties, and security details.
+                Use these endpoints to understand what's inside a document without changing it.
 
-                This endpoint group provides analytical capabilities to understand document structure,
-                extract information, and generate insights from PDF content for automated processing.
-
-                Common use cases:
-                • Document inventory management and content audit for compliance verification
-                • Quality assurance workflows and business intelligence analytics
-                • Migration planning, accessibility evaluation, and document forensics
-
-                Business applications:
-                • Legal discovery, financial document review, and healthcare records analysis
-                • Academic research, government processing, and publishing optimization
-
-                Operational scenarios:
-                • Large-scale profiling, migration assessment, and performance optimization
-                • Automated quality control and content strategy development
-
-                Target users: Data analysts, QA teams, administrators, and business intelligence
-                professionals requiring detailed document insights.
+                Typical uses:
+                • Get page counts and dimensions for layout or print rules
+                • List fonts and annotations to spot compatibility issues
+                • Inspect form fields before deciding how to fill or modify them
+                • Pull metadata and security settings for audits or reports
                 """)
 public @interface AnalysisApi {}

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Convert",
         description =
                 """
-                Document format transformation services for cross-platform compatibility and workflow integration.
+                Convert PDFs to and from other formats (Word, images, HTML, Markdown, PDF/A, CBZ/CBR, EML, etc.).
+                This group also powers the text-editor / jobId-based editing flow for incremental PDF edits.
 
-                This endpoint group enables transformation between various formats, supporting
-                diverse business workflows and system integrations for mixed document ecosystems.
-
-                Common use cases:
-                • Legacy system integration, document migration, and cross-platform sharing
-                • Archive standardization, publishing preparation, and content adaptation
-                • Accessibility compliance and mobile-friendly document preparation
-
-                Business applications:
-                • Enterprise content management, digital publishing, and educational platforms
-                • Legal document processing, healthcare interoperability, and government standardization
-
-                Integration scenarios:
-                • API-driven pipelines, automated workflow preparation, and batch conversions
-                • Real-time format adaptation for user requests
-
-                Target users: System integrators, content managers, digital archivists, and
-                organizations requiring flexible document format interoperability.
+                Typical uses:
+                • Turn PDFs into Word or text for editing
+                • Convert office files, images, HTML, or email (EML) into PDFs
+                • Create PDF/A for long-term archiving
+                • Export PDFs as images, HTML, CSV, or Markdown for search, analysis, or reuse
                 """)
 public @interface ConvertApi {}

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Filter",
         description =
                 """
-                Document content filtering and search operations for information discovery and organization.
+                Check basic properties of PDFs before you process them: page count, file size, page size/rotation, and whether they contain text or images.
+                Use these endpoints as a "pre-check" step to decide what to do with a file next.
 
-                This endpoint group enables intelligent content discovery and organization within
-                document collections for content-based processing and information extraction.
-
-                Common use cases:
-                • Legal discovery, research organization, and compliance auditing
-                • Content moderation, academic research, and business intelligence
-                • Quality assurance and content validation workflows
-
-                Business applications:
-                • Contract analysis, financial review, and healthcare records organization
-                • Government processing, educational curation, and IP protection
-
-                Workflow scenarios:
-                • Large-scale processing, automated classification, and information extraction
-                • Document preparation for further processing or analysis
-
-                Target users: Legal professionals, researchers, compliance officers, and
-                organizations requiring intelligent document content discovery and organization.
+                Typical uses:
+                • Reject files that are too big or too small
+                • Detect image-only PDFs that should go through OCR
+                • Ensure a document has enough pages before it enters a workflow
+                • Check orientation of pages before printing or merging
                 """)
 public @interface FilterApi {}

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -22,21 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "General",
         description =
                 """
-                Core PDF processing operations for fundamental document manipulation workflows.
+                Page-level PDF editing: split, merge, rotate, crop, rearrange, and scale pages.
+                These endpoints handle most daily "I opened a PDF editor just to…" type tasks.
 
-                This endpoint group provides essential PDF functionality that forms the foundation
-                of most document processing workflows across various industries.
-
-                Common use cases:
-                • Document preparation for archival systems and content organization
-                • File preparation for distribution, accessibility compliance, and batch processing
-                • Document consolidation for reporting and legal compliance workflows
-
-                Typical applications:
-                • Content management, publishing workflows, and educational content distribution
-                • Business process automation and archive management
-
-                Target users: Content managers, document processors, and organizations requiring
-                reliable foundational PDF manipulation capabilities.
+                Typical uses:
+                • Split a large PDF into smaller files (by pages, chapters, or size)
+                • Merge several PDFs into one report or pack
+                • Rotate or reorder pages before sending or archiving
+                • Turn a multi-page document into one long scrolling page
                 """)
 public @interface GeneralApi {}

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -22,25 +22,15 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Misc",
         description =
                 """
-                Specialized utilities and supplementary tools for enhanced document processing workflows.
+                Tools that don't fit neatly elsewhere: OCR, compress, repair, flatten, extract images, update metadata, add stamps/page numbers/images, and more.
+                These endpoints help fix problem PDFs and prepare them for sharing, storage, or further processing.
 
-                This endpoint group provides utility operations that support core document processing
-                tasks and address specific workflow needs in real-world scenarios.
-
-                Common use cases:
-                • Document optimization for bandwidth-limited environments and storage cost management
-                • Document repair, content extraction, and validation for quality assurance
-                • Accessibility improvement and custom processing for specialized needs
-
-                Business applications:
-                • Web publishing optimization, email attachment management, and archive efficiency
-                • Mobile compatibility, print production, and legacy document recovery
-
-                Operational scenarios:
-                • Batch processing, quality control, and performance optimization
-                • Troubleshooting and recovery of problematic documents
-
-                Target users: System administrators, document specialists, and organizations requiring
-                specialized document processing and optimization tools.
+                Typical uses:
+                • Repair a damaged PDF or remove blank pages
+                • Run OCR on scanned PDFs so they become searchable
+                • Compress large PDFs for email or web download
+                • Extract embedded images or scans
+                • Add page numbers, stamps, or overlay an image (e.g. logo, seal)
+                • Update PDF metadata (title, author, etc.)
                 """)
 public @interface MiscApi {}

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -22,25 +22,12 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Pipeline",
         description =
                 """
-                Automated document processing workflows for complex multi-stage business operations.
+                Run several PDF operations in one configured pipeline instead of calling multiple endpoints yourself.
+                Useful when you always do the same steps in sequence (for example: convert → OCR → compress → watermark).
 
-                This endpoint group enables organizations to create sophisticated document processing
-                workflows that combine multiple operations into streamlined, repeatable processes.
-
-                Common use cases:
-                • Invoice processing, legal document review, and healthcare records standardization
-                • Government processing, educational content preparation, and publishing automation
-                • Contract lifecycle management and approval processes
-
-                Business applications:
-                • Automated compliance reporting, large-scale migration, and quality assurance
-                • Archive preparation, content delivery, and document approval workflows
-
-                Operational scenarios:
-                • Scheduled batch processing and event-driven document processing
-                • Multi-department coordination and business system integration
-
-                Target users: Business process managers, IT automation specialists, and organizations
-                requiring consistent, repeatable document processing workflows.
+                Typical uses:
+                • Process incoming invoices in one go (clean, OCR, compress, stamp, etc.)
+                • Normalise documents before they enter an archive
+                • Wrap a complex document flow behind a single API call for your own apps
                 """)
 public @interface PipelineApi {}

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Security",
         description =
                 """
-                Document security and protection services for confidential and sensitive content.
+                Protect and clean PDFs: passwords, digital signatures, redaction, and sanitizing.
+                These endpoints help you control who can open a file, what they can do with it, and remove sensitive content when needed.
 
-                This endpoint group provides essential security operations for organizations handling
-                sensitive documents and materials requiring controlled access.
-
-                Common use cases:
-                • Legal confidentiality, healthcare privacy (HIPAA), and financial regulatory compliance
-                • Government classified handling, corporate IP protection, and educational privacy (FERPA)
-                • Contract security for business transactions
-
-                Business applications:
-                • Document authentication, confidential sharing, and secure archiving
-                • Content watermarking, access control, and privacy protection through redaction
-
-                Industry scenarios:
-                • Legal discovery, medical records exchange, financial audit documentation
-                • Enterprise policy enforcement and data governance
-
-                Target users: Legal professionals, healthcare administrators, compliance officers,
-                government agencies, and enterprises handling sensitive content.
+                Typical uses:
+                • Add or remove a password on a PDF
+                • Redact personal or confidential information (manually or automatically)
+                • Validate or remove digital signatures
+                • Sanitize a PDF to strip scripts and embedded content
                 """)
 public @interface SecurityApi {}

app/common/src/main/java/stirling/software/common/service/PersonalSignatureServiceInterface.java

@@ -0,0 +1,21 @@
+package stirling.software.common.service;
+
+import java.io.IOException;
+
+/**
+ * Interface for personal signature access (proprietary feature). Implemented only in proprietary
+ * module to provide authenticated users access to their personal signatures.
+ */
+public interface PersonalSignatureServiceInterface {
+
+    /**
+     * Get a personal signature from the user's folder. Only checks personal folder, not shared
+     * folder.
+     *
+     * @param username Username of the signature owner
+     * @param fileName Signature filename
+     * @return Personal signature image bytes
+     * @throws IOException If file not found or read error
+     */
+    byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException;
+}

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -39,6 +39,7 @@ public class RequestUriUtils {
         // Specific static files bundled with the frontend
         if (normalizedUri.equals("/robots.txt")
                 || normalizedUri.equals("/favicon.ico")
+                || normalizedUri.equals("/manifest.json")
                 || normalizedUri.equals("/site.webmanifest")
                 || normalizedUri.equals("/manifest-classic.json")
                 || normalizedUri.equals("/index.html")) {
@@ -159,6 +160,8 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith(
                         "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
                 // enableLogin)
+                || trimmedUri.startsWith(
+                        "/api/v1/ui-data/footer-info") // Public footer configuration
                 || trimmedUri.startsWith("/v1/api-docs")
                 || trimmedUri.startsWith("/api/v1/invite/validate")
                 || trimmedUri.startsWith("/api/v1/invite/accept")

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -51,7 +51,8 @@ public class RequestUriUtilsTest {
 
     @Test
     void testIsFrontendRoute() {
-        assertTrue(RequestUriUtils.isFrontendRoute("", "/"), "Root path should be a frontend route");
+        assertTrue(
+                RequestUriUtils.isFrontendRoute("", "/"), "Root path should be a frontend route");
         assertTrue(
                 RequestUriUtils.isFrontendRoute("", "/app/dashboard"),
                 "React routes without extensions should be frontend routes");

app/core/src/main/java/stirling/software/SPDF/config/SpringDocConfig.java

@@ -21,6 +21,9 @@ public class SpringDocConfig {
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
                         "/api/v1/team/**",
+                        "/api/v1/auth/**",
+                        "/api/v1/invite/**",
+                        "/api/v1/audit/**",
                         "/api/v1/ui-data/**",
                         "/api/v1/proprietary/ui-data/**",
                         "/api/v1/info/**",
@@ -33,7 +36,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - Processing API")
                                             .description(
-                                                    "API documentation for PDF processing operations including conversion, manipulation, security, and utilities."));
+                                                    "APIs for converting, editing, securing, and analysing PDF documents. Use these endpoints to automate common PDF tasks (like split, merge, convert, OCR) and plug them into your own apps and backend jobs."));
                         })
                 .build();
     }
@@ -47,14 +50,17 @@ public class SpringDocConfig {
                         "/api/v1/admin/**",
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
-                        "/api/v1/team/**")
+                        "/api/v1/team/**",
+                        "/api/v1/auth/**",
+                        "/api/v1/invite/**",
+                        "/api/v1/audit/**")
                 .addOpenApiCustomizer(
                         openApi -> {
                             openApi.info(
                                     openApi.getInfo()
-                                            .title("Stirling PDF - Admin API")
+                                            .title("Stirling PDF - Management API")
                                             .description(
-                                                    "API documentation for administrative functions, user management, and system configuration."));
+                                                    "Endpoints for authentication, user management, invitations, audit logging, and system configuration."));
                         })
                 .build();
     }
@@ -76,7 +82,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - System API")
                                             .description(
-                                                    "API documentation for system information, UI data, and utility endpoints."));
+                                                    "System information, UI metadata, job status, and file management endpoints."));
                         })
                 .build();
     }

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -26,7 +26,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.Dependency;
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SignatureService;
+import stirling.software.SPDF.service.SharedSignatureService;
 import stirling.software.common.annotations.api.UiDataApi;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
@@ -40,14 +40,14 @@ import stirling.software.common.util.GeneralUtils;
 public class UIDataController {
 
     private final ApplicationProperties applicationProperties;
-    private final SignatureService signatureService;
+    private final SharedSignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
-            SignatureService signatureService,
+            SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {
@@ -58,6 +58,21 @@ public class UIDataController {
         this.runtimePathConfig = runtimePathConfig;
     }
 
+    @GetMapping("/footer-info")
+    @Operation(summary = "Get public footer configuration data")
+    public ResponseEntity<FooterData> getFooterData() {
+        FooterData data = new FooterData();
+        data.setAnalyticsEnabled(applicationProperties.getSystem().getEnableAnalytics());
+        data.setTermsAndConditions(applicationProperties.getLegal().getTermsAndConditions());
+        data.setPrivacyPolicy(applicationProperties.getLegal().getPrivacyPolicy());
+        data.setAccessibilityStatement(
+                applicationProperties.getLegal().getAccessibilityStatement());
+        data.setCookiePolicy(applicationProperties.getLegal().getCookiePolicy());
+        data.setImpressum(applicationProperties.getLegal().getImpressum());
+
+        return ResponseEntity.ok(data);
+    }
+
     @GetMapping("/home")
     @Operation(summary = "Get home page data")
     public ResponseEntity<HomeData> getHomeData() {
@@ -237,6 +252,16 @@ public class UIDataController {
     }
 
     // Data classes
+    @Data
+    public static class FooterData {
+        private Boolean analyticsEnabled;
+        private String termsAndConditions;
+        private String privacyPolicy;
+        private String accessibilityStatement;
+        private String cookiePolicy;
+        private String impressum;
+    }
+
     @Data
     public static class HomeData {
         private boolean showSurveyFromDocker;

app/core/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java

@@ -25,7 +25,7 @@ import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SignatureService;
+import stirling.software.SPDF.service.SharedSignatureService;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.UserServiceInterface;
@@ -37,13 +37,13 @@ import stirling.software.common.util.GeneralUtils;
 @Slf4j
 public class GeneralWebController {
 
-    private final SignatureService signatureService;
+    private final SharedSignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public GeneralWebController(
-            SignatureService signatureService,
+            SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,18 +1,61 @@
 package stirling.software.SPDF.controller.web;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
+import jakarta.servlet.http.HttpServletRequest;
+
 @Controller
 public class ReactRoutingController {
 
-    @GetMapping("/{path:^(?!api|static|robots\\.txt|favicon\\.ico|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*$}")
-    public String forwardRootPaths() {
-        return "forward:/index.html";
+    @Value("${server.servlet.context-path:/}")
+    private String contextPath;
+
+    @GetMapping(value = {"/", "/index.html"}, produces = MediaType.TEXT_HTML_VALUE)
+    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request)
+            throws IOException {
+        ClassPathResource resource = new ClassPathResource("static/index.html");
+
+        try (InputStream inputStream = resource.getInputStream()) {
+            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
+
+            // Replace %BASE_URL% with the actual context path for base href
+            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
+            html = html.replace("%BASE_URL%", baseUrl);
+            // Also rewrite any existing <base> tag (Vite may have baked one in)
+            html =
+                    html.replaceFirst(
+                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
+                            "<base href=\\\"" + baseUrl + "\\\" />");
+
+            // Inject context path as a global variable for API calls
+            String contextPathScript =
+                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
+            html = html.replace("</head>", contextPathScript + "</head>");
+
+            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(html);
+        }
     }
 
-    @GetMapping("/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
-    public String forwardNestedPaths() {
-        return "forward:/index.html";
+    @GetMapping(
+            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
+    public ResponseEntity<String> forwardRootPaths(HttpServletRequest request)
+            throws IOException {
+        return serveIndexHtml(request);
+    }
+
+    @GetMapping(
+            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
+            throws IOException {
+        return serveIndexHtml(request);
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java

@@ -1,48 +0,0 @@
-package stirling.software.SPDF.controller.web;
-
-import java.io.IOException;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-
-import stirling.software.SPDF.service.SignatureService;
-import stirling.software.common.service.UserServiceInterface;
-
-// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
-@RequestMapping("/api/v1/general")
-public class SignatureController {
-
-    private final SignatureService signatureService;
-
-    private final UserServiceInterface userService;
-
-    public SignatureController(
-            SignatureService signatureService,
-            @Autowired(required = false) UserServiceInterface userService) {
-        this.signatureService = signatureService;
-        this.userService = userService;
-    }
-
-    @GetMapping("/sign/{fileName}")
-    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName)
-            throws IOException {
-        String username = "NON_SECURITY_USER";
-        if (userService != null) {
-            username = userService.getCurrentUsername();
-        }
-        // Verify access permission
-        if (!signatureService.hasAccessToFile(username, fileName)) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
-        }
-        byte[] imageBytes = signatureService.getSignatureBytes(username, fileName);
-        return ResponseEntity.ok()
-                .contentType( // Adjust based on file type
-                        MediaType.IMAGE_JPEG)
-                .body(imageBytes);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureImageController.java

@@ -0,0 +1,84 @@
+package stirling.software.SPDF.controller.web;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.common.service.PersonalSignatureServiceInterface;
+import stirling.software.common.service.UserServiceInterface;
+
+/**
+ * Unified signature image controller that works for both authenticated and unauthenticated users.
+ * Uses composition pattern: - Core SharedSignatureService (always available): reads shared
+ * signatures - PersonalSignatureService (proprietary, optional): reads personal signatures For
+ * authenticated signature management (save/delete), see proprietary SignatureController.
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/general")
+public class SignatureImageController {
+
+    private final SharedSignatureService sharedSignatureService;
+    private final PersonalSignatureServiceInterface personalSignatureService;
+    private final UserServiceInterface userService;
+
+    public SignatureImageController(
+            SharedSignatureService sharedSignatureService,
+            @Autowired(required = false) PersonalSignatureServiceInterface personalSignatureService,
+            @Autowired(required = false) UserServiceInterface userService) {
+        this.sharedSignatureService = sharedSignatureService;
+        this.personalSignatureService = personalSignatureService;
+        this.userService = userService;
+    }
+
+    /**
+     * Get a signature image (works for both authenticated and unauthenticated users). -
+     * Authenticated with proprietary: tries personal first, then shared - Unauthenticated or
+     * community: tries shared only
+     */
+    @GetMapping("/signatures/{fileName}")
+    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName) {
+        try {
+            byte[] imageBytes = null;
+
+            // If proprietary service available and user authenticated, try personal folder first
+            if (personalSignatureService != null && userService != null) {
+                try {
+                    String username = userService.getCurrentUsername();
+                    imageBytes =
+                            personalSignatureService.getPersonalSignatureBytes(username, fileName);
+                } catch (Exception e) {
+                    // Not found in personal folder or not authenticated, will try shared
+                    log.debug("Personal signature not found, trying shared: {}", e.getMessage());
+                }
+            }
+
+            // If not found in personal (or no personal service), try shared
+            if (imageBytes == null) {
+                imageBytes = sharedSignatureService.getSharedSignatureBytes(fileName);
+            }
+
+            // Determine content type from file extension
+            MediaType contentType = MediaType.IMAGE_PNG; // Default
+            String lowerFileName = fileName.toLowerCase();
+            if (lowerFileName.endsWith(".jpg") || lowerFileName.endsWith(".jpeg")) {
+                contentType = MediaType.IMAGE_JPEG;
+            }
+
+            return ResponseEntity.ok().contentType(contentType).body(imageBytes);
+        } catch (IOException e) {
+            log.debug("Signature not found: {}", fileName);
+            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureRequest.java

@@ -0,0 +1,18 @@
+package stirling.software.SPDF.model.api.signature;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class SavedSignatureRequest {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureResponse.java

@@ -0,0 +1,22 @@
+package stirling.software.SPDF.model.api.signature;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SavedSignatureResponse {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types (or URL to fetch image)
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+    private Long createdAt;
+    private Long updatedAt;
+}

app/core/src/main/java/stirling/software/SPDF/service/SharedSignatureService.java

@@ -0,0 +1,308 @@
+package stirling.software.SPDF.service;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardOpenOption;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.SignatureFile;
+import stirling.software.SPDF.model.api.signature.SavedSignatureRequest;
+import stirling.software.SPDF.model.api.signature.SavedSignatureResponse;
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Service
+@Slf4j
+public class SharedSignatureService {
+
+    private final String SIGNATURE_BASE_PATH;
+    private final String ALL_USERS_FOLDER = "ALL_USERS";
+    private final ObjectMapper objectMapper;
+
+    public SharedSignatureService() {
+        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
+        this.objectMapper = new ObjectMapper();
+    }
+
+    public boolean hasAccessToFile(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // Check if file exists in user's personal folder or ALL_USERS folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+
+        return Files.exists(userPath) || Files.exists(allUsersPath);
+    }
+
+    public List<SignatureFile> getAvailableSignatures(String username) {
+        List<SignatureFile> signatures = new ArrayList<>();
+
+        // Get signatures from user's personal folder
+        if (StringUtils.hasText(username)) {
+            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+            if (Files.exists(userFolder)) {
+                try {
+                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
+                } catch (IOException e) {
+                    log.error("Error reading user signatures folder", e);
+                }
+            }
+        }
+
+        // Get signatures from ALL_USERS folder
+        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(allUsersFolder)) {
+            try {
+                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
+            } catch (IOException e) {
+                log.error("Error reading shared signatures folder", e);
+            }
+        }
+
+        return signatures;
+    }
+
+    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
+            throws IOException {
+        try (Stream<Path> stream = Files.list(folder)) {
+            return stream.filter(this::isImageFile)
+                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
+                    .toList();
+        }
+    }
+
+    /**
+     * Get a signature from the shared (ALL_USERS) folder. This is always available for both
+     * authenticated and unauthenticated users.
+     */
+    public byte[] getSharedSignatureBytes(String fileName) throws IOException {
+        validateFileName(fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+        if (!Files.exists(allUsersPath)) {
+            throw new FileNotFoundException("Shared signature file not found");
+        }
+        return Files.readAllBytes(allUsersPath);
+    }
+
+    private boolean isImageFile(Path path) {
+        String fileName = path.getFileName().toString().toLowerCase();
+        return fileName.endsWith(".jpg") || fileName.endsWith(".jpeg") || fileName.endsWith(".png");
+    }
+
+    private void validateFileName(String fileName) {
+        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
+            throw new IllegalArgumentException("Invalid filename");
+        }
+        // Only allow alphanumeric, hyphen, underscore, and dot (for extensions)
+        if (!fileName.matches("^[a-zA-Z0-9_.-]+$")) {
+            throw new IllegalArgumentException("Filename contains invalid characters");
+        }
+    }
+
+    private String validateAndNormalizeExtension(String extension) {
+        String normalized = extension.toLowerCase().trim();
+        // Whitelist only safe image extensions
+        if (normalized.equals("png") || normalized.equals("jpg") || normalized.equals("jpeg")) {
+            return normalized;
+        }
+        throw new IllegalArgumentException("Unsupported image extension: " + extension);
+    }
+
+    private void verifyPathWithinDirectory(Path resolvedPath, Path targetDirectory)
+            throws IOException {
+        Path canonicalTarget = targetDirectory.toAbsolutePath().normalize();
+        Path canonicalResolved = resolvedPath.toAbsolutePath().normalize();
+        if (!canonicalResolved.startsWith(canonicalTarget)) {
+            throw new IOException("Resolved path is outside the target directory");
+        }
+    }
+
+    /** Save a signature as image file */
+    public SavedSignatureResponse saveSignature(String username, SavedSignatureRequest request)
+            throws IOException {
+        validateFileName(request.getId());
+
+        // Determine folder based on scope
+        String scope = request.getScope();
+        if (scope == null || scope.isEmpty()) {
+            scope = "personal"; // Default to personal
+        }
+
+        String folderName = "shared".equals(scope) ? ALL_USERS_FOLDER : username;
+        Path targetFolder = Paths.get(SIGNATURE_BASE_PATH, folderName);
+        Files.createDirectories(targetFolder);
+
+        long timestamp = System.currentTimeMillis();
+
+        SavedSignatureResponse response = new SavedSignatureResponse();
+        response.setId(request.getId());
+        response.setLabel(request.getLabel());
+        response.setType(request.getType());
+        response.setScope(scope);
+        response.setCreatedAt(timestamp);
+        response.setUpdatedAt(timestamp);
+
+        // Extract and save image data
+        String dataUrl = request.getDataUrl();
+        if (dataUrl != null && dataUrl.startsWith("data:image/")) {
+            // Extract base64 data
+            String base64Data = dataUrl.substring(dataUrl.indexOf(",") + 1);
+            byte[] imageBytes = Base64.getDecoder().decode(base64Data);
+
+            // Determine and validate file extension from data URL
+            String mimeType = dataUrl.substring(dataUrl.indexOf(":") + 1, dataUrl.indexOf(";"));
+            String rawExtension = mimeType.substring(mimeType.indexOf("/") + 1);
+            String extension = validateAndNormalizeExtension(rawExtension);
+
+            // Save image file only
+            String imageFileName = request.getId() + "." + extension;
+            Path imagePath = targetFolder.resolve(imageFileName);
+
+            // Verify path is within target directory
+            verifyPathWithinDirectory(imagePath, targetFolder);
+
+            Files.write(
+                    imagePath,
+                    imageBytes,
+                    StandardOpenOption.CREATE,
+                    StandardOpenOption.TRUNCATE_EXISTING);
+
+            // Store reference to image file
+            response.setDataUrl("/api/v1/general/sign/" + imageFileName);
+        }
+
+        log.info("Saved signature {} for user {}", request.getId(), username);
+        return response;
+    }
+
+    /** Get all saved signatures for a user */
+    public List<SavedSignatureResponse> getSavedSignatures(String username) throws IOException {
+        List<SavedSignatureResponse> signatures = new ArrayList<>();
+
+        // Load personal signatures
+        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+        if (Files.exists(personalFolder)) {
+            try (Stream<Path> stream = Files.list(personalFolder)) {
+                stream.filter(this::isImageFile)
+                        .forEach(
+                                path -> {
+                                    try {
+                                        String fileName = path.getFileName().toString();
+                                        String id =
+                                                fileName.substring(0, fileName.lastIndexOf('.'));
+
+                                        SavedSignatureResponse sig = new SavedSignatureResponse();
+                                        sig.setId(id);
+                                        sig.setLabel(id); // Use ID as label
+                                        sig.setType("image"); // Default type
+                                        sig.setScope("personal");
+                                        sig.setDataUrl("/api/v1/general/sign/" + fileName);
+                                        sig.setCreatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+                                        sig.setUpdatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+
+                                        signatures.add(sig);
+                                    } catch (IOException e) {
+                                        log.error("Error reading signature file: " + path, e);
+                                    }
+                                });
+            }
+        }
+
+        // Load shared signatures
+        Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(sharedFolder)) {
+            try (Stream<Path> stream = Files.list(sharedFolder)) {
+                stream.filter(this::isImageFile)
+                        .forEach(
+                                path -> {
+                                    try {
+                                        String fileName = path.getFileName().toString();
+                                        String id =
+                                                fileName.substring(0, fileName.lastIndexOf('.'));
+
+                                        SavedSignatureResponse sig = new SavedSignatureResponse();
+                                        sig.setId(id);
+                                        sig.setLabel(id); // Use ID as label
+                                        sig.setType("image"); // Default type
+                                        sig.setScope("shared");
+                                        sig.setDataUrl("/api/v1/general/sign/" + fileName);
+                                        sig.setCreatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+                                        sig.setUpdatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+
+                                        signatures.add(sig);
+                                    } catch (IOException e) {
+                                        log.error("Error reading signature file: " + path, e);
+                                    }
+                                });
+            }
+        }
+
+        return signatures;
+    }
+
+    /** Delete a saved signature */
+    public void deleteSignature(String username, String signatureId) throws IOException {
+        validateFileName(signatureId);
+
+        // Try to find and delete image file in personal folder
+        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+        boolean deleted = false;
+
+        if (Files.exists(personalFolder)) {
+            try (Stream<Path> stream = Files.list(personalFolder)) {
+                List<Path> matchingFiles =
+                        stream.filter(
+                                        path ->
+                                                path.getFileName()
+                                                        .toString()
+                                                        .startsWith(signatureId + "."))
+                                .toList();
+                for (Path file : matchingFiles) {
+                    Files.delete(file);
+                    deleted = true;
+                }
+            }
+        }
+
+        // Try shared folder if not found in personal
+        if (!deleted) {
+            Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+            if (Files.exists(sharedFolder)) {
+                try (Stream<Path> stream = Files.list(sharedFolder)) {
+                    List<Path> matchingFiles =
+                            stream.filter(
+                                            path ->
+                                                    path.getFileName()
+                                                            .toString()
+                                                            .startsWith(signatureId + "."))
+                                    .toList();
+                    for (Path file : matchingFiles) {
+                        Files.delete(file);
+                        deleted = true;
+                    }
+                }
+            }
+        }
+
+        if (!deleted) {
+            throw new FileNotFoundException("Signature not found");
+        }
+
+        log.info("Deleted signature {} for user {}", signatureId, username);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/SignatureService.java

@@ -1,107 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.springframework.stereotype.Service;
-import org.springframework.util.StringUtils;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.common.configuration.InstallationPathConfig;
-
-@Service
-@Slf4j
-public class SignatureService {
-
-    private final String SIGNATURE_BASE_PATH;
-    private final String ALL_USERS_FOLDER = "ALL_USERS";
-
-    public SignatureService() {
-        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
-    }
-
-    public boolean hasAccessToFile(String username, String fileName) throws IOException {
-        validateFileName(fileName);
-        // Check if file exists in user's personal folder or ALL_USERS folder
-        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-
-        return Files.exists(userPath) || Files.exists(allUsersPath);
-    }
-
-    public List<SignatureFile> getAvailableSignatures(String username) {
-        List<SignatureFile> signatures = new ArrayList<>();
-
-        // Get signatures from user's personal folder
-        if (StringUtils.hasText(username)) {
-            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-            if (Files.exists(userFolder)) {
-                try {
-                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
-                } catch (IOException e) {
-                    log.error("Error reading user signatures folder", e);
-                }
-            }
-        }
-
-        // Get signatures from ALL_USERS folder
-        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(allUsersFolder)) {
-            try {
-                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
-            } catch (IOException e) {
-                log.error("Error reading shared signatures folder", e);
-            }
-        }
-
-        return signatures;
-    }
-
-    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
-            throws IOException {
-        try (Stream<Path> stream = Files.list(folder)) {
-            return stream.filter(this::isImageFile)
-                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
-                    .toList();
-        }
-    }
-
-    public byte[] getSignatureBytes(String username, String fileName) throws IOException {
-        validateFileName(fileName);
-        // First try user's personal folder
-        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
-        if (Files.exists(userPath)) {
-            return Files.readAllBytes(userPath);
-        }
-
-        // Then try ALL_USERS folder
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-        if (Files.exists(allUsersPath)) {
-            return Files.readAllBytes(allUsersPath);
-        }
-
-        throw new FileNotFoundException("Signature file not found");
-    }
-
-    private boolean isImageFile(Path path) {
-        String fileName = path.getFileName().toString().toLowerCase();
-        return fileName.endsWith(".jpg")
-                || fileName.endsWith(".jpeg")
-                || fileName.endsWith(".png")
-                || fileName.endsWith(".gif");
-    }
-
-    private void validateFileName(String fileName) {
-        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
-            throw new IllegalArgumentException("Invalid filename");
-        }
-    }
-}

app/core/src/main/resources/static/css/cookieconsentCustomisation.css

@@ -24,8 +24,8 @@
     --cc-toggle-on-knob-bg: var(--cc-btn-primary-color);
     --cc-toggle-off-knob-bg: var(--cc-btn-primary-color);
 
-    --cc-toggle-enabled-icon-color: var(--cc-btn-primary-color);   
-    --cc-toggle-disabled-icon-color: var(--cc-btn-primary-color);  
+    --cc-toggle-enabled-icon-color: var(--cc-btn-primary-color);
+    --cc-toggle-disabled-icon-color: var(--cc-btn-primary-color);
 
     --cc-toggle-readonly-bg: var(--md-sys-color-surface);
     --cc-toggle-readonly-knob-bg: var(--md-sys-color-outline);
@@ -34,10 +34,10 @@
     --cc-section-category-border: var(--md-sys-color-outline);
 
     --cc-cookie-category-block-bg: var(--cc-btn-secondary-bg);
-    --cc-cookie-category-block-border: var(--cc-btn-secondary-bg); 
+    --cc-cookie-category-block-border: var(--cc-btn-secondary-bg);
     --cc-cookie-category-block-hover-bg: var(--cc-btn-secondary-bg);
     --cc-cookie-category-block-hover-border: var(--cc-btn-secondary-bg);
-    
+
     --cc-cookie-category-expanded-block-bg: var(--cc-btn-secondary-bg);
     --cc-cookie-category-expanded-block-hover-bg: var(--cc-toggle-readonly-bg);
 
@@ -47,7 +47,7 @@
 */
     --cc-footer-bg: var(--cc-bg);
     --cc-footer-color: var(--cc-primary-color);
-    --cc-footer-border-color: var(--cc-bg); 
+    --cc-footer-border-color: var(--cc-bg);
 }
 .cm__body{
     max-width: 90% !important;
@@ -81,4 +81,4 @@
 /* Lower z-index so cookie banner appears behind onboarding modals */
 #cc-main {
     z-index: 100 !important;
-}
+}

app/core/src/test/java/stirling/software/SPDF/service/SignatureServiceTest.java

@@ -23,7 +23,7 @@ import stirling.software.common.configuration.InstallationPathConfig;
 class SignatureServiceTest {
 
     @TempDir Path tempDir;
-    private SignatureService signatureService;
+    private SharedSignatureService signatureService;
     private Path personalSignatureFolder;
     private Path sharedSignatureFolder;
     private final String ALL_USERS_FOLDER = "ALL_USERS";
@@ -53,7 +53,7 @@ class SignatureServiceTest {
                     .thenReturn(tempDir.toString());
 
             // Initialize the service with our temp directory
-            signatureService = new SignatureService();
+            signatureService = new SharedSignatureService();
         }
     }
 
@@ -165,7 +165,7 @@ class SignatureServiceTest {
     }
 
     @Test
-    void testGetSignatureBytes_PersonalFile() throws IOException {
+    void testGetSharedSignatureBytes_SharedFile() throws IOException {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -173,28 +173,8 @@ class SignatureServiceTest {
                     .when(InstallationPathConfig::getSignaturesPath)
                     .thenReturn(tempDir.toString());
 
-            // Test
-            byte[] bytes = signatureService.getSignatureBytes(TEST_USER, "personal.png");
-
-            // Verify
-            assertEquals(
-                    "personal signature content",
-                    new String(bytes),
-                    "Should return the correct content for personal file");
-        }
-    }
-
-    @Test
-    void testGetSignatureBytes_SharedFile() throws IOException {
-        // Mock static method for each test
-        try (MockedStatic<InstallationPathConfig> mockedConfig =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedConfig
-                    .when(InstallationPathConfig::getSignaturesPath)
-                    .thenReturn(tempDir.toString());
-
-            // Test
-            byte[] bytes = signatureService.getSignatureBytes(TEST_USER, "shared.jpg");
+            // Test - core service only reads shared signatures
+            byte[] bytes = signatureService.getSharedSignatureBytes("shared.jpg");
 
             // Verify
             assertEquals(
@@ -205,7 +185,7 @@ class SignatureServiceTest {
     }
 
     @Test
-    void testGetSignatureBytes_FileNotFound() {
+    void testGetSharedSignatureBytes_FileNotFound() {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -216,13 +196,13 @@ class SignatureServiceTest {
             // Test and verify
             assertThrows(
                     FileNotFoundException.class,
-                    () -> signatureService.getSignatureBytes(TEST_USER, "nonexistent.png"),
+                    () -> signatureService.getSharedSignatureBytes("nonexistent.png"),
                     "Should throw exception for non-existent files");
         }
     }
 
     @Test
-    void testGetSignatureBytes_InvalidFileName() {
+    void testGetSharedSignatureBytes_InvalidFileName() {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -233,11 +213,28 @@ class SignatureServiceTest {
             // Test and verify
             assertThrows(
                     IllegalArgumentException.class,
-                    () -> signatureService.getSignatureBytes(TEST_USER, "../invalid.png"),
+                    () -> signatureService.getSharedSignatureBytes("../invalid.png"),
                     "Should throw exception for file names with directory traversal");
         }
     }
 
+    @Test
+    void testGetSharedSignatureBytes_CannotAccessPersonalFiles() {
+        // Mock static method for each test
+        try (MockedStatic<InstallationPathConfig> mockedConfig =
+                mockStatic(InstallationPathConfig.class)) {
+            mockedConfig
+                    .when(InstallationPathConfig::getSignaturesPath)
+                    .thenReturn(tempDir.toString());
+
+            // Test and verify - core service should NOT be able to read personal files
+            assertThrows(
+                    FileNotFoundException.class,
+                    () -> signatureService.getSharedSignatureBytes("personal.png"),
+                    "Core service should not have access to personal signatures");
+        }
+    }
+
     @Test
     void testGetAvailableSignatures_EmptyUsername() throws IOException {
         // Mock static method for each test

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/SignatureController.java

@@ -0,0 +1,102 @@
+package stirling.software.proprietary.controller.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.annotations.api.UserApi;
+import stirling.software.proprietary.model.api.signature.SavedSignatureRequest;
+import stirling.software.proprietary.model.api.signature.SavedSignatureResponse;
+import stirling.software.proprietary.security.service.UserService;
+import stirling.software.proprietary.service.SignatureService;
+
+/**
+ * Controller for managing user signatures in proprietary/authenticated mode only. Requires user
+ * authentication and enforces per-user storage limits. All endpoints require authentication
+ * via @PreAuthorize("isAuthenticated()").
+ */
+@UserApi
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/proprietary/signatures")
+@RequiredArgsConstructor
+@PreAuthorize("isAuthenticated()")
+public class SignatureController {
+
+    private final SignatureService signatureService;
+    private final UserService userService;
+
+    /**
+     * Save a new signature for the authenticated user. Enforces storage limits and authentication
+     * requirements.
+     */
+    @PostMapping
+    public ResponseEntity<SavedSignatureResponse> saveSignature(
+            @RequestBody SavedSignatureRequest request) {
+        try {
+            String username = userService.getCurrentUsername();
+
+            // Validate request
+            if (request.getDataUrl() == null || request.getDataUrl().isEmpty()) {
+                log.warn("User {} attempted to save signature without dataUrl", username);
+                return ResponseEntity.badRequest().build();
+            }
+
+            SavedSignatureResponse response = signatureService.saveSignature(username, request);
+            log.info("User {} saved signature {}", username, request.getId());
+            return ResponseEntity.ok(response);
+        } catch (IllegalArgumentException e) {
+            log.warn("Invalid signature save request: {}", e.getMessage());
+            return ResponseEntity.badRequest().build();
+        } catch (IOException e) {
+            log.error("Failed to save signature", e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
+        }
+    }
+
+    /**
+     * List all signatures accessible to the authenticated user. Includes both personal and shared
+     * signatures.
+     */
+    @GetMapping
+    public ResponseEntity<List<SavedSignatureResponse>> listSignatures() {
+        try {
+            String username = userService.getCurrentUsername();
+            List<SavedSignatureResponse> signatures = signatureService.getSavedSignatures(username);
+            return ResponseEntity.ok(signatures);
+        } catch (IOException e) {
+            log.error("Failed to list signatures for user", e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
+        }
+    }
+
+    /**
+     * Delete a signature owned by the authenticated user. Users can only delete their own personal
+     * signatures, not shared ones.
+     */
+    @DeleteMapping("/{signatureId}")
+    public ResponseEntity<Void> deleteSignature(@PathVariable String signatureId) {
+        try {
+            String username = userService.getCurrentUsername();
+            signatureService.deleteSignature(username, signatureId);
+            log.info("User {} deleted signature {}", username, signatureId);
+            return ResponseEntity.noContent().build();
+        } catch (IOException e) {
+            log.warn("Failed to delete signature {} for user: {}", signatureId, e.getMessage());
+            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/form/FormFillController.java

@@ -34,7 +34,19 @@ import stirling.software.proprietary.util.FormUtils;
 
 @RestController
 @RequestMapping("/api/v1/form")
-@Tag(name = "Forms", description = "PDF form APIs")
+@Tag(
+        name = "Forms",
+        description =
+                """
+                Work with PDF form fields: read them, fill them, edit them, or remove them.
+                Treats a PDF as a structured form instead of just flat pages.
+
+                Typical uses:
+                • Inspect which form fields exist in a PDF
+                • Autofill forms from your own systems (e.g. CRM, ERP)
+                • Change or delete form fields before sending out a final, non-editable copy
+                • Unlock read-only form fields when you need to update them
+                """)
 @RequiredArgsConstructor
 public class FormFillController {
 

app/proprietary/src/main/java/stirling/software/proprietary/model/api/signature/SavedSignatureRequest.java

@@ -0,0 +1,18 @@
+package stirling.software.proprietary.model.api.signature;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class SavedSignatureRequest {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/api/signature/SavedSignatureResponse.java

@@ -0,0 +1,22 @@
+package stirling.software.proprietary.model.api.signature;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SavedSignatureResponse {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types (or URL to fetch image)
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+    private Long createdAt;
+    private Long updatedAt;
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/MailConfig.java

@@ -35,15 +35,40 @@ public class MailConfig {
         JavaMailSenderImpl mailSender = new JavaMailSenderImpl();
         mailSender.setHost(mailProperties.getHost());
         mailSender.setPort(mailProperties.getPort());
-        mailSender.setUsername(mailProperties.getUsername());
-        mailSender.setPassword(mailProperties.getPassword());
         mailSender.setDefaultEncoding("UTF-8");
 
+        // Only set username and password if they are provided
+        String username = mailProperties.getUsername();
+        String password = mailProperties.getPassword();
+        boolean hasCredentials =
+                (username != null && !username.trim().isEmpty())
+                        || (password != null && !password.trim().isEmpty());
+
+        if (username != null && !username.trim().isEmpty()) {
+            mailSender.setUsername(username);
+            log.info("SMTP username configured");
+        } else {
+            log.info("SMTP username not configured - using anonymous connection");
+        }
+
+        if (password != null && !password.trim().isEmpty()) {
+            mailSender.setPassword(password);
+            log.info("SMTP password configured");
+        } else {
+            log.info("SMTP password not configured");
+        }
+
         // Retrieves the JavaMail properties to configure additional SMTP parameters
         Properties props = mailSender.getJavaMailProperties();
 
-        // Enables SMTP authentication
-        props.put("mail.smtp.auth", "true");
+        // Only enable SMTP authentication if credentials are provided
+        if (hasCredentials) {
+            props.put("mail.smtp.auth", "true");
+            log.info("SMTP authentication enabled");
+        } else {
+            props.put("mail.smtp.auth", "false");
+            log.info("SMTP authentication disabled - no credentials provided");
+        }
 
         // Enables STARTTLS to encrypt the connection if supported by the SMTP server
         props.put("mail.smtp.starttls.enable", "true");

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -324,10 +324,14 @@ public class SecurityConfiguration {
                                     .authenticated());
             // Handle User/Password Logins
             if (securityProperties.isUserPass()) {
+                // v2: Authentication is handled via API (/api/v1/auth/login), not form login
+                // We configure form login to handle Spring Security redirects,
+                // but use /perform_login as the processing URL so /login remains a React route
                 http.formLogin(
                         formLogin ->
                                 formLogin
-                                        .loginPage("/login")
+                                        .loginPage("/login") // Redirect here when unauthenticated
+                                        .loginProcessingUrl("/perform_login") // Process form posts here (not /login)
                                         .successHandler(
                                                 new CustomAuthenticationSuccessHandler(
                                                         loginAttemptService,

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminLicenseController.java

@@ -1,22 +1,32 @@
 package stirling.software.proprietary.security.controller.api;
 
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardCopyOption;
 import java.util.HashMap;
 import java.util.Map;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
 
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier;
@@ -242,4 +252,159 @@ public class AdminLicenseController {
                     .body(Map.of("error", "Failed to retrieve license information"));
         }
     }
+
+    /**
+     * Upload a license certificate file for offline activation. Accepts .lic or .cert files,
+     * validates the certificate format, saves to configs directory, and activates the license.
+     *
+     * @param file The license certificate file to upload
+     * @return Response with success status, license type, and file information
+     */
+    @PostMapping(value = "/license-file", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Upload license certificate file",
+            description =
+                    "Upload a license certificate file (.lic, .cert) for offline activation."
+                            + " Validates the file format and activates the license.")
+    public ResponseEntity<Map<String, Object>> uploadLicenseFile(
+            @RequestParam("file") MultipartFile file) {
+
+        // Validate file exists
+        if (file == null || file.isEmpty()) {
+            return ResponseEntity.badRequest()
+                    .body(Map.of("success", false, "error", "File is empty"));
+        }
+
+        String filename = file.getOriginalFilename();
+        if (filename == null || filename.trim().isEmpty()) {
+            return ResponseEntity.badRequest()
+                    .body(Map.of("success", false, "error", "Invalid filename"));
+        }
+        // Prevent path traversal and enforce single filename component
+        if (filename.contains("..") || filename.contains("/") || filename.contains("\\")) {
+            return ResponseEntity.badRequest()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Filename must not contain path separators or '..'"));
+        }
+
+        // Validate file extension
+        if (!isValidLicenseFile(filename)) {
+            return ResponseEntity.badRequest()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Invalid file type. Expected .lic or .cert"));
+        }
+
+        // Check file size (max 1MB for license files)
+        if (file.getSize() > 1_048_576) {
+            return ResponseEntity.badRequest()
+                    .body(Map.of("success", false, "error", "File too large. Maximum 1MB allowed"));
+        }
+
+        try {
+            // Validate certificate format by reading content
+            byte[] fileBytes = file.getBytes();
+            String content = new String(fileBytes, StandardCharsets.UTF_8);
+            if (!content.trim().startsWith("-----BEGIN LICENSE FILE-----")) {
+                return ResponseEntity.badRequest()
+                        .body(
+                                Map.of(
+                                        "success",
+                                        false,
+                                        "error",
+                                        "Invalid license certificate format"));
+            }
+
+            // Get config directory and target path
+            Path configPath = Paths.get(InstallationPathConfig.getConfigPath());
+            Path targetPath = configPath.resolve(filename).normalize();
+            // Prevent directory traversal: ensure targetPath is inside configPath
+            if (!targetPath.startsWith(configPath.normalize().toAbsolutePath())) {
+                return ResponseEntity.badRequest()
+                        .body(Map.of("success", false, "error", "Invalid file path"));
+            }
+
+            // Backup existing file if present
+            if (Files.exists(targetPath)) {
+                Path backupDir = configPath.resolve("backup");
+                Files.createDirectories(backupDir);
+
+                String backupFilename = filename + ".bak." + System.currentTimeMillis();
+                Path backupPath = backupDir.resolve(backupFilename);
+
+                Files.copy(targetPath, backupPath, StandardCopyOption.REPLACE_EXISTING);
+                log.info("Backed up existing license file to: {}", backupPath);
+            }
+
+            // Write new license file
+            Files.write(targetPath, fileBytes);
+            log.info("License file saved to: {}", targetPath);
+
+            // assume premium enabled when setting license key
+            applicationProperties.getPremium().setEnabled(true);
+
+            // Update settings with file reference (relative path)
+            String fileReference = "file:configs/" + filename;
+            licenseKeyChecker.updateLicenseKey(fileReference);
+
+            // Get license status after activation
+            License license = licenseKeyChecker.getPremiumLicenseEnabledResult();
+
+            Map<String, Object> response = new HashMap<>();
+            response.put("success", true);
+            response.put("licenseType", license.name());
+            response.put("filename", filename);
+            response.put("filePath", "configs/" + filename);
+            response.put("enabled", applicationProperties.getPremium().isEnabled());
+            response.put("maxUsers", applicationProperties.getPremium().getMaxUsers());
+            response.put("message", "License file uploaded and activated");
+
+            log.info(
+                    "License file uploaded and activated: filename={}, type={}",
+                    filename,
+                    license.name());
+
+            return ResponseEntity.ok(response);
+
+        } catch (IOException e) {
+            log.error("Failed to save license file", e);
+            return ResponseEntity.internalServerError()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Failed to save license file: " + e.getMessage()));
+        } catch (Exception e) {
+            log.error("Failed to activate license from file", e);
+            return ResponseEntity.badRequest()
+                    .body(
+                            Map.of(
+                                    "success",
+                                    false,
+                                    "error",
+                                    "Failed to activate license: " + e.getMessage()));
+        }
+    }
+
+    /**
+     * Validates if the filename has a valid license file extension (.lic or .cert)
+     *
+     * @param filename The filename to validate
+     * @return true if the filename ends with .lic or .cert (case-insensitive)
+     */
+    private boolean isValidLicenseFile(String filename) {
+        if (filename == null) {
+            return false;
+        }
+        String lower = filename.toLowerCase();
+        return lower.endsWith(".lic") || lower.endsWith(".cert");
+    }
 }

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UserController.java

@@ -407,7 +407,8 @@ public class UserController {
     public ResponseEntity<?> inviteUsers(
             @RequestParam(name = "emails", required = true) String emails,
             @RequestParam(name = "role", defaultValue = "ROLE_USER") String role,
-            @RequestParam(name = "teamId", required = false) Long teamId)
+            @RequestParam(name = "teamId", required = false) Long teamId,
+            HttpServletRequest request)
             throws SQLException, UnsupportedProviderException {
 
         // Check if email invites are enabled
@@ -477,6 +478,9 @@ public class UserController {
             }
         }
 
+        // Build login URL
+        String loginUrl = buildLoginUrl(request);
+
         int successCount = 0;
         int failureCount = 0;
         StringBuilder errors = new StringBuilder();
@@ -488,7 +492,7 @@ public class UserController {
                 continue;
             }
 
-            InviteResult result = processEmailInvite(email, effectiveTeamId, role);
+            InviteResult result = processEmailInvite(email, effectiveTeamId, role, loginUrl);
             if (result.isSuccess()) {
                 successCount++;
             } else {
@@ -687,15 +691,45 @@ public class UserController {
         return ResponseEntity.ok(apiKey);
     }
 
+    /**
+     * Helper method to build the login URL from the application configuration or request.
+     *
+     * @param request The HTTP request
+     * @return The login URL
+     */
+    private String buildLoginUrl(HttpServletRequest request) {
+        String baseUrl;
+        String configuredFrontendUrl = applicationProperties.getSystem().getFrontendUrl();
+        if (configuredFrontendUrl != null && !configuredFrontendUrl.trim().isEmpty()) {
+            // Use configured frontend URL (remove trailing slash if present)
+            baseUrl =
+                    configuredFrontendUrl.endsWith("/")
+                            ? configuredFrontendUrl.substring(0, configuredFrontendUrl.length() - 1)
+                            : configuredFrontendUrl;
+        } else {
+            // Fall back to backend URL from request
+            baseUrl =
+                    request.getScheme()
+                            + "://"
+                            + request.getServerName()
+                            + (request.getServerPort() != 80 && request.getServerPort() != 443
+                                    ? ":" + request.getServerPort()
+                                    : "");
+        }
+        return baseUrl + "/login";
+    }
+
     /**
      * Helper method to process a single email invitation.
      *
      * @param email The email address to invite
      * @param teamId The team ID to assign the user to
      * @param role The role to assign to the user
+     * @param loginUrl The URL to the login page
      * @return InviteResult containing success status and optional error message
      */
-    private InviteResult processEmailInvite(String email, Long teamId, String role) {
+    private InviteResult processEmailInvite(
+            String email, Long teamId, String role, String loginUrl) {
         try {
             // Validate email format (basic check)
             if (!email.contains("@") || !email.contains(".")) {
@@ -715,7 +749,7 @@ public class UserController {
 
             // Send invite email
             try {
-                emailService.get().sendInviteEmail(email, email, temporaryPassword);
+                emailService.get().sendInviteEmail(email, email, temporaryPassword, loginUrl);
                 log.info("Sent invite email to: {}", email);
                 return InviteResult.success();
             } catch (Exception emailEx) {

app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java

@@ -56,6 +56,19 @@ public interface UserRepository extends JpaRepository<User, Long> {
                     + "OR LOWER(u.authenticationType) IN ('sso', 'oauth2', 'saml2')")
     List<User> findAllSsoUsers();
 
+    /**
+     * Finds SSO users who have never created a session (pending activation) and are not yet
+     * grandfathered.
+     */
+    @Query(
+            "SELECT u FROM User u "
+                    + "LEFT JOIN SessionEntity s ON u.username = s.principalName "
+                    + "WHERE (u.ssoProvider IS NOT NULL "
+                    + "OR LOWER(u.authenticationType) IN ('sso', 'oauth2', 'saml2')) "
+                    + "AND (u.oauthGrandfathered IS NULL OR u.oauthGrandfathered = false) "
+                    + "AND s.sessionId IS NULL")
+    List<User> findPendingSsoUsersWithoutSession();
+
     /**
      * Counts all SSO users - those with sso_provider set OR authenticationType is sso/oauth2/saml2.
      */

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/JwtAuthenticationFilter.java

@@ -105,22 +105,18 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             }
 
             try {
-                log.debug("Validating JWT token");
                 jwtService.validateToken(jwtToken);
-                log.debug("JWT token validated successfully");
             } catch (AuthenticationFailureException e) {
-                log.warn("JWT validation failed: {}", e.getMessage());
+                log.debug("JWT validation failed: {}", e.getMessage());
                 handleAuthenticationFailure(request, response, e);
                 return;
             }
 
             Map<String, Object> claims = jwtService.extractClaims(jwtToken);
             String tokenUsername = claims.get("sub").toString();
-            log.debug("JWT token username: {}", tokenUsername);
 
             try {
                 authenticate(request, claims);
-                log.debug("Authentication successful for user: {}", tokenUsername);
             } catch (SQLException | UnsupportedProviderException e) {
                 log.error("Error processing user authentication for user: {}", tokenUsername, e);
                 handleAuthenticationFailure(

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java

@@ -299,7 +299,8 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             contextPath + "/api/v1/auth/refresh",
             contextPath + "/api/v1/auth/me",
             contextPath + "/api/v1/invite/validate",
-            contextPath + "/api/v1/invite/accept"
+            contextPath + "/api/v1/invite/accept",
+            contextPath + "/api/v1/ui-data/footer-info"
         };
 
         for (String pattern : publicApiPatterns) {

app/proprietary/src/main/java/stirling/software/proprietary/security/service/EmailService.java

@@ -115,10 +115,12 @@ public class EmailService {
      * @param to The recipient email address
      * @param username The username for the new account
      * @param temporaryPassword The temporary password
+     * @param loginUrl The URL to the login page
      * @throws MessagingException If there is an issue with creating or sending the email.
      */
     @Async
-    public void sendInviteEmail(String to, String username, String temporaryPassword)
+    public void sendInviteEmail(
+            String to, String username, String temporaryPassword, String loginUrl)
             throws MessagingException {
         String subject = "Welcome to Stirling PDF";
 
@@ -144,6 +146,14 @@ public class EmailService {
                       <div style="background-color: #fff3cd; border-left: 4px solid #ffc107; padding: 15px; margin: 20px 0; border-radius: 4px;">
                         <p style="margin: 0; color: #856404;"><strong>⚠️ Important:</strong> You will be required to change your password upon first login for security reasons.</p>
                       </div>
+                      <!-- CTA Button -->
+                      <div style="text-align: center; margin: 30px 0;">
+                        <a href="%s" style="display: inline-block; background-color: #007bff; color: #ffffff; padding: 14px 28px; text-decoration: none; border-radius: 5px; font-weight: bold;">Log In to Stirling PDF</a>
+                      </div>
+                      <p style="font-size: 14px; color: #666;">Or copy and paste this link in your browser:</p>
+                      <div style="background-color: #f8f9fa; padding: 12px; margin: 15px 0; border-radius: 4px; word-break: break-all; font-size: 13px; color: #555;">
+                        %s
+                      </div>
                       <p>Please keep these credentials secure and do not share them with anyone.</p>
                       <p style="margin-bottom: 0;">— The Stirling PDF Team</p>
                     </div>
@@ -155,7 +165,7 @@ public class EmailService {
                 </div>
                 </body></html>
                 """
-                        .formatted(username, temporaryPassword);
+                        .formatted(username, temporaryPassword, loginUrl, loginUrl);
 
         sendPlainEmail(to, subject, body, true);
     }

app/proprietary/src/main/java/stirling/software/proprietary/security/service/JwtService.java

@@ -50,7 +50,6 @@ public class JwtService implements JwtServiceInterface {
             KeyPersistenceServiceInterface keyPersistenceService) {
         this.v2Enabled = v2Enabled;
         this.keyPersistenceService = keyPersistenceService;
-        log.info("JwtService initialized");
     }
 
     @Override
@@ -256,11 +255,9 @@ public class JwtService implements JwtServiceInterface {
         String authHeader = request.getHeader("Authorization");
         if (authHeader != null && authHeader.startsWith("Bearer ")) {
             String token = authHeader.substring(7); // Remove "Bearer " prefix
-            log.debug("JWT token extracted from Authorization header");
             return token;
         }
 
-        log.debug("No JWT token found in Authorization header");
         return null;
     }
 
@@ -283,10 +280,9 @@ public class JwtService implements JwtServiceInterface {
                                     .parse(token)
                                     .getHeader()
                                     .get("kid");
-            log.debug("Extracted key ID from token: {}", keyId);
             return keyId;
         } catch (Exception e) {
-            log.warn("Failed to extract key ID from token header: {}", e.getMessage());
+            log.debug("Failed to extract key ID from token header: {}", e.getMessage());
             return null;
         }
     }

app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPairCleanupService.java

@@ -55,7 +55,6 @@ public class KeyPairCleanupService {
             return;
         }
 
-        log.info("Removing keys older than retention period");
         removeKeys(eligibleKeys);
         keyPersistenceService.refreshActiveKeyPair();
     }

app/proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java

@@ -778,4 +778,30 @@ public class UserService implements UserServiceInterface {
 
         return updated;
     }
+
+    /**
+     * Grandfathers SSO users who have never created a session (invited/pending accounts). These
+     * users would otherwise be blocked when SSO requires a paid license despite existing before the
+     * policy change.
+     *
+     * @return Number of pending users updated
+     */
+    @Transactional
+    public int grandfatherPendingSsoUsersWithoutSession() {
+        List<User> pendingUsers = userRepository.findPendingSsoUsersWithoutSession();
+        int updated = 0;
+
+        for (User user : pendingUsers) {
+            if (!user.isOauthGrandfathered()) {
+                user.setOauthGrandfathered(true);
+                updated++;
+            }
+        }
+
+        if (updated > 0) {
+            userRepository.saveAll(pendingUsers);
+        }
+
+        return updated;
+    }
 }

app/proprietary/src/main/java/stirling/software/proprietary/service/SignatureService.java

@@ -0,0 +1,299 @@
+package stirling.software.proprietary.service;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardOpenOption;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.configuration.InstallationPathConfig;
+import stirling.software.common.service.PersonalSignatureServiceInterface;
+import stirling.software.proprietary.model.api.signature.SavedSignatureRequest;
+import stirling.software.proprietary.model.api.signature.SavedSignatureResponse;
+
+/**
+ * Service for managing user signatures with authentication and storage limits. This proprietary
+ * version enforces per-user quotas and requires authentication. Provides access to personal
+ * signatures only (shared signatures handled by core service).
+ */
+@Service
+@Slf4j
+public class SignatureService implements PersonalSignatureServiceInterface {
+
+    private final String SIGNATURE_BASE_PATH;
+    private final String ALL_USERS_FOLDER = "ALL_USERS";
+
+    // Storage limits per user
+    private static final int MAX_SIGNATURES_PER_USER = 20;
+    private static final long MAX_SIGNATURE_SIZE_BYTES = 2_000_000; // 2MB per signature
+    private static final long MAX_TOTAL_USER_STORAGE_BYTES = 20_000_000; // 20MB total per user
+
+    public SignatureService() {
+        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
+    }
+
+    /**
+     * Get a personal signature from the user's folder only. Does NOT check shared folder (that's
+     * handled by core service).
+     */
+    @Override
+    public byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+
+        if (!Files.exists(userPath)) {
+            throw new FileNotFoundException("Personal signature not found");
+        }
+
+        return Files.readAllBytes(userPath);
+    }
+
+    /** Save a signature with storage limits enforced. */
+    public SavedSignatureResponse saveSignature(String username, SavedSignatureRequest request)
+            throws IOException {
+        validateFileName(request.getId());
+
+        // Determine folder based on scope
+        String scope = request.getScope();
+        if (scope == null || scope.isEmpty()) {
+            scope = "personal"; // Default to personal
+        }
+
+        String folderName = "shared".equals(scope) ? ALL_USERS_FOLDER : username;
+        Path targetFolder = Paths.get(SIGNATURE_BASE_PATH, folderName);
+
+        // Only enforce limits for personal signatures (not shared)
+        if ("personal".equals(scope)) {
+            enforceStorageLimits(username, request.getDataUrl());
+        }
+
+        Files.createDirectories(targetFolder);
+
+        long timestamp = System.currentTimeMillis();
+
+        SavedSignatureResponse response = new SavedSignatureResponse();
+        response.setId(request.getId());
+        response.setLabel(request.getLabel());
+        response.setType(request.getType());
+        response.setScope(scope);
+        response.setCreatedAt(timestamp);
+        response.setUpdatedAt(timestamp);
+
+        // Extract and save image data
+        String dataUrl = request.getDataUrl();
+        if (dataUrl != null && dataUrl.startsWith("data:image/")) {
+            // Validate dataUrl size before decoding
+            if (dataUrl.length() > MAX_SIGNATURE_SIZE_BYTES * 2) {
+                throw new IllegalArgumentException(
+                        "Signature data too large (max "
+                                + (MAX_SIGNATURE_SIZE_BYTES / 1024)
+                                + "KB)");
+            }
+
+            // Extract base64 data
+            String base64Data = dataUrl.substring(dataUrl.indexOf(",") + 1);
+            byte[] imageBytes = Base64.getDecoder().decode(base64Data);
+
+            // Validate decoded size
+            if (imageBytes.length > MAX_SIGNATURE_SIZE_BYTES) {
+                throw new IllegalArgumentException(
+                        "Signature image too large (max "
+                                + (MAX_SIGNATURE_SIZE_BYTES / 1024)
+                                + "KB)");
+            }
+
+            // Determine and validate file extension from data URL
+            String mimeType = dataUrl.substring(dataUrl.indexOf(":") + 1, dataUrl.indexOf(";"));
+            String rawExtension = mimeType.substring(mimeType.indexOf("/") + 1);
+            String extension = validateAndNormalizeExtension(rawExtension);
+
+            // Save image file
+            String imageFileName = request.getId() + "." + extension;
+            Path imagePath = targetFolder.resolve(imageFileName);
+
+            // Verify path is within target directory
+            verifyPathWithinDirectory(imagePath, targetFolder);
+
+            Files.write(
+                    imagePath,
+                    imageBytes,
+                    StandardOpenOption.CREATE,
+                    StandardOpenOption.TRUNCATE_EXISTING);
+
+            // Store reference to image file (unified endpoint for all signatures)
+            response.setDataUrl("/api/v1/general/signatures/" + imageFileName);
+        }
+
+        log.info("Saved signature {} for user {} (scope: {})", request.getId(), username, scope);
+        return response;
+    }
+
+    /** Get all saved signatures for a user (personal + shared). */
+    public List<SavedSignatureResponse> getSavedSignatures(String username) throws IOException {
+        List<SavedSignatureResponse> signatures = new ArrayList<>();
+
+        // Load personal signatures
+        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+        if (Files.exists(personalFolder)) {
+            signatures.addAll(loadSignaturesFromFolder(personalFolder, "personal", true));
+        }
+
+        // Load shared signatures
+        Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(sharedFolder)) {
+            signatures.addAll(loadSignaturesFromFolder(sharedFolder, "shared", false));
+        }
+
+        return signatures;
+    }
+
+    /** Delete a signature from user's personal folder. Cannot delete shared signatures. */
+    public void deleteSignature(String username, String signatureId) throws IOException {
+        validateFileName(signatureId);
+
+        // Only allow deletion from personal folder
+        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+        boolean deleted = false;
+
+        if (Files.exists(personalFolder)) {
+            try (Stream<Path> stream = Files.list(personalFolder)) {
+                List<Path> matchingFiles =
+                        stream.filter(
+                                        path ->
+                                                path.getFileName()
+                                                        .toString()
+                                                        .startsWith(signatureId + "."))
+                                .toList();
+                for (Path file : matchingFiles) {
+                    Files.delete(file);
+                    deleted = true;
+                    log.info("Deleted signature file: {}", file);
+                }
+            }
+        }
+
+        if (!deleted) {
+            throw new FileNotFoundException("Signature not found or cannot be deleted");
+        }
+    }
+
+    // Private helper methods
+
+    private void enforceStorageLimits(String username, String dataUrlToAdd) throws IOException {
+        Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+
+        if (!Files.exists(userFolder)) {
+            return; // First signature, no limits to check
+        }
+
+        // Count existing signatures
+        long signatureCount;
+        try (Stream<Path> stream = Files.list(userFolder)) {
+            signatureCount = stream.filter(this::isImageFile).count();
+        }
+
+        if (signatureCount >= MAX_SIGNATURES_PER_USER) {
+            throw new IllegalArgumentException(
+                    "Maximum signatures limit reached (" + MAX_SIGNATURES_PER_USER + ")");
+        }
+
+        // Calculate total storage used
+        long totalSize = 0;
+        try (Stream<Path> stream = Files.list(userFolder)) {
+            totalSize =
+                    stream.filter(this::isImageFile)
+                            .mapToLong(
+                                    path -> {
+                                        try {
+                                            return Files.size(path);
+                                        } catch (IOException e) {
+                                            return 0;
+                                        }
+                                    })
+                            .sum();
+        }
+
+        // Estimate new signature size (base64 decodes to ~75% of original)
+        long estimatedNewSize = (long) (dataUrlToAdd.length() * 0.75);
+
+        if (totalSize + estimatedNewSize > MAX_TOTAL_USER_STORAGE_BYTES) {
+            throw new IllegalArgumentException(
+                    "Storage quota exceeded (max "
+                            + (MAX_TOTAL_USER_STORAGE_BYTES / 1_000_000)
+                            + "MB)");
+        }
+    }
+
+    private List<SavedSignatureResponse> loadSignaturesFromFolder(
+            Path folder, String scope, boolean isPersonal) throws IOException {
+        List<SavedSignatureResponse> signatures = new ArrayList<>();
+
+        try (Stream<Path> stream = Files.list(folder)) {
+            stream.filter(this::isImageFile)
+                    .forEach(
+                            path -> {
+                                try {
+                                    String fileName = path.getFileName().toString();
+                                    String id = fileName.substring(0, fileName.lastIndexOf('.'));
+
+                                    SavedSignatureResponse sig = new SavedSignatureResponse();
+                                    sig.setId(id);
+                                    sig.setLabel(id);
+                                    sig.setType("image");
+                                    sig.setScope(scope);
+                                    sig.setCreatedAt(Files.getLastModifiedTime(path).toMillis());
+                                    sig.setUpdatedAt(Files.getLastModifiedTime(path).toMillis());
+
+                                    // Set unified URL path (works for both personal and shared)
+                                    sig.setDataUrl("/api/v1/general/signatures/" + fileName);
+
+                                    signatures.add(sig);
+                                } catch (IOException e) {
+                                    log.error("Error reading signature file: " + path, e);
+                                }
+                            });
+        }
+
+        return signatures;
+    }
+
+    private boolean isImageFile(Path path) {
+        String fileName = path.getFileName().toString().toLowerCase();
+        return fileName.endsWith(".jpg") || fileName.endsWith(".jpeg") || fileName.endsWith(".png");
+    }
+
+    private void validateFileName(String fileName) {
+        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
+            throw new IllegalArgumentException("Invalid filename");
+        }
+        if (!fileName.matches("^[a-zA-Z0-9_.-]+$")) {
+            throw new IllegalArgumentException("Filename contains invalid characters");
+        }
+    }
+
+    private String validateAndNormalizeExtension(String extension) {
+        String normalized = extension.toLowerCase().trim();
+        if (normalized.equals("png") || normalized.equals("jpg") || normalized.equals("jpeg")) {
+            return normalized;
+        }
+        throw new IllegalArgumentException("Unsupported image extension: " + extension);
+    }
+
+    private void verifyPathWithinDirectory(Path resolvedPath, Path targetDirectory)
+            throws IOException {
+        Path canonicalTarget = targetDirectory.toAbsolutePath().normalize();
+        Path canonicalResolved = resolvedPath.toAbsolutePath().normalize();
+        if (!canonicalResolved.startsWith(canonicalTarget)) {
+            throw new IOException("Resolved path is outside the target directory");
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java

@@ -192,10 +192,18 @@ public class UserLicenseSettingsService {
                                 + "They will retain OAuth access even without a paid license. "
                                 + "New users will require a paid license for OAuth.",
                         updated);
-            } else if (grandfatheredCount > 0) {
-                log.debug(
-                        "OAuth grandfathering already completed: {} users grandfathered",
-                        grandfatheredCount);
+            }
+
+            // Grandfather pending users (invited but never logged in)
+            // The query filters to non-grandfathered users only, so this is idempotent
+            if (grandfatheredCount > 0 || oauthUsersCount > 0) {
+                int pendingUpdated = userService.grandfatherPendingSsoUsersWithoutSession();
+                if (pendingUpdated > 0) {
+                    log.warn(
+                            "OAuth GRANDFATHERING: Marked {} pending SSO users (no prior sessions) as"
+                                    + " grandfathered.",
+                            pendingUpdated);
+                }
             }
         }
     }

app/proprietary/src/test/java/stirling/software/proprietary/service/UserLicenseSettingsServiceTest.java

@@ -2,6 +2,9 @@ package stirling.software.proprietary.service;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 import java.util.Optional;
@@ -198,4 +201,70 @@ class UserLicenseSettingsServiceTest {
 
         assertEquals(5, result, "Should fall back to default 5 users if grandfathered is 0");
     }
+
+    @Test
+    void grandfatherExistingOAuthUsers_runsOnlyWhenNoneGrandfathered() {
+        // With grandfatheredCount == 0, should run grandfathering for all users
+        when(userService.countOAuthUsers()).thenReturn(10L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(0L);
+        when(userService.grandfatherAllOAuthUsers()).thenReturn(10);
+        when(userService.grandfatherPendingSsoUsersWithoutSession()).thenReturn(0);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, times(1)).grandfatherAllOAuthUsers();
+        verify(userService, times(1)).grandfatherPendingSsoUsersWithoutSession();
+    }
+
+    @Test
+    void grandfatherExistingOAuthUsers_skipsMainButRunsPendingWhenSomeAlreadyGrandfathered() {
+        // V2→V2.1 upgrade: some users already grandfathered, but pending users need to be checked
+        when(userService.countOAuthUsers()).thenReturn(10L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(4L);
+        when(userService.grandfatherPendingSsoUsersWithoutSession()).thenReturn(2);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, never()).grandfatherAllOAuthUsers();
+        verify(userService, times(1)).grandfatherPendingSsoUsersWithoutSession();
+    }
+
+    @Test
+    void grandfatherExistingOAuthUsers_stillChecksPendingWhenAllUsersGrandfathered() {
+        // All active users grandfathered, but still check for pending users
+        when(userService.countOAuthUsers()).thenReturn(10L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(10L);
+        when(userService.grandfatherPendingSsoUsersWithoutSession()).thenReturn(0);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, never()).grandfatherAllOAuthUsers();
+        verify(userService, times(1)).grandfatherPendingSsoUsersWithoutSession();
+    }
+
+    @Test
+    void grandfatherExistingOAuthUsers_skipsWhenNoOAuthUsers() {
+        when(userService.countOAuthUsers()).thenReturn(0L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(0L);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, never()).grandfatherAllOAuthUsers();
+        verify(userService, never()).grandfatherPendingSsoUsersWithoutSession();
+    }
+
+    @Test
+    void grandfatherExistingOAuthUsers_grandfathersPendingUsersOnFirstRun() {
+        // Pending users (invited but never logged in) should be grandfathered
+        // during the initial grandfathering run (when grandfatheredCount == 0)
+        when(userService.countOAuthUsers()).thenReturn(5L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(0L);
+        when(userService.grandfatherAllOAuthUsers()).thenReturn(5);
+        when(userService.grandfatherPendingSsoUsersWithoutSession()).thenReturn(3);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, times(1)).grandfatherAllOAuthUsers();
+        verify(userService, times(1)).grandfatherPendingSsoUsersWithoutSession();
+    }
 }

build.gradle

@@ -57,7 +57,7 @@ repositories {
 
 allprojects {
     group = 'stirling.software'
-    version = '2.0.1'
+    version = '2.0.2'
 
     configurations.configureEach {
         exclude group: 'commons-logging', module: 'commons-logging'

docker/embedded/Dockerfile

@@ -0,0 +1,138 @@
+# Stirling-PDF Dockerfile - Full version with embedded frontend
+# Single JAR contains both frontend and backend
+
+# Stage 1: Build application with embedded frontend
+FROM gradle:8.14-jdk21 AS build
+
+# Install Node.js and npm for frontend build
+RUN apt-get update && apt-get install -y \
+    curl \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
+    && npm --version \
+    && node --version \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy gradle files for dependency resolution
+COPY build.gradle .
+COPY settings.gradle .
+COPY gradlew .
+COPY gradle gradle/
+COPY app/core/build.gradle core/.
+COPY app/common/build.gradle common/.
+COPY app/proprietary/build.gradle proprietary/.
+RUN ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube || return 0
+
+# Set working directory
+WORKDIR /app
+
+# Copy entire project
+COPY . .
+
+# Build JAR with embedded frontend (includes security features controlled at runtime)
+RUN DISABLE_ADDITIONAL_FEATURES=false \
+    STIRLING_PDF_DESKTOP_UI=false \
+    ./gradlew clean build -PbuildWithFrontend=true -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+# Stage 2: Runtime image
+FROM alpine:3.22.1
+
+ARG VERSION_TAG
+
+# Labels
+LABEL org.opencontainers.image.title="Stirling-PDF"
+LABEL org.opencontainers.image.description="Stirling-PDF with embedded frontend - Full version"
+LABEL org.opencontainers.image.source="https://github.com/Stirling-Tools/Stirling-PDF"
+LABEL org.opencontainers.image.licenses="MIT"
+LABEL org.opencontainers.image.vendor="Stirling-Tools"
+LABEL org.opencontainers.image.url="https://www.stirlingpdf.com"
+LABEL org.opencontainers.image.documentation="https://docs.stirlingpdf.com"
+LABEL maintainer="Stirling-Tools"
+LABEL org.opencontainers.image.authors="Stirling-Tools"
+LABEL org.opencontainers.image.version="${VERSION_TAG}"
+LABEL org.opencontainers.image.keywords="PDF, manipulation, API, Spring Boot, React"
+
+# Copy scripts and fonts
+COPY scripts /scripts
+COPY app/core/src/main/resources/static/fonts/*.ttf /usr/share/fonts/opentype/noto/
+
+# Copy built JAR from build stage
+COPY --from=build /app/app/core/build/libs/*.jar /app.jar
+COPY --from=build /app/build/libs/restart-helper.jar /restart-helper.jar
+
+# Environment Variables
+ENV VERSION_TAG=$VERSION_TAG \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_CUSTOM_OPTS="" \
+    HOME=/home/stirlingpdfuser \
+    PUID=1000 \
+    PGID=1000 \
+    UMASK=022 \
+    PYTHONPATH=/usr/lib/libreoffice/program:/opt/venv/lib/python3.12/site-packages \
+    UNO_PATH=/usr/lib/libreoffice/program \
+    URE_BOOTSTRAP=file:///usr/lib/libreoffice/program/fundamentalrc \
+    PATH=$PATH:/opt/venv/bin \
+    STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
+    TMPDIR=/tmp/stirling-pdf \
+    TEMP=/tmp/stirling-pdf \
+    TMP=/tmp/stirling-pdf
+
+# Install all dependencies
+RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
+    echo "@community https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
+    echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" | tee -a /etc/apk/repositories && \
+    apk upgrade --no-cache -a && \
+    apk add --no-cache \
+    ca-certificates \
+    tzdata \
+    tini \
+    bash \
+    curl \
+    shadow \
+    su-exec \
+    openssl \
+    openssl-dev \
+    openjdk21-jre \
+    # Doc conversion
+    gcompat \
+    libc6-compat \
+    libreoffice \
+    ghostscript \
+    fontforge \
+    # pdftohtml
+    poppler-utils \
+    # OCR MY PDF
+    unpaper \
+    tesseract-ocr-data-eng \
+    tesseract-ocr-data-chi_sim \
+    tesseract-ocr-data-deu \
+    tesseract-ocr-data-fra \
+    tesseract-ocr-data-por \
+    ocrmypdf \
+    # CV
+    py3-opencv \
+    python3 \
+    py3-pip \
+    py3-pillow@testing \
+    py3-pdf2image@testing && \
+    python3 -m venv /opt/venv && \
+    /opt/venv/bin/pip install --upgrade pip setuptools && \
+    /opt/venv/bin/pip install --no-cache-dir --upgrade unoserver weasyprint && \
+    ln -s /usr/lib/libreoffice/program/uno.py /opt/venv/lib/python3.12/site-packages/ && \
+    ln -s /usr/lib/libreoffice/program/unohelper.py /opt/venv/lib/python3.12/site-packages/ && \
+    ln -s /usr/lib/libreoffice/program /opt/venv/lib/python3.12/site-packages/LibreOffice && \
+    mv /usr/share/tessdata /usr/share/tessdata-original && \
+    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf && \
+    fc-cache -f -v && \
+    chmod +x /scripts/* && \
+    # User permissions
+    addgroup -S stirlingpdfgroup && adduser -S stirlingpdfuser -G stirlingpdfgroup && \
+    chown -R stirlingpdfuser:stirlingpdfgroup $HOME /scripts /pipeline /usr/share/fonts/opentype/noto /configs /customFiles /tmp/stirling-pdf && \
+    chown stirlingpdfuser:stirlingpdfgroup /app.jar /restart-helper.jar
+
+EXPOSE 8080/tcp
+
+# Set user and run command
+ENTRYPOINT ["tini", "--", "/scripts/init.sh"]
+CMD ["sh", "-c", "java -Dfile.encoding=UTF-8 -Djava.io.tmpdir=/tmp/stirling-pdf -jar /app.jar & /opt/venv/bin/unoserver --port 2003 --interface 127.0.0.1"]

docker/embedded/Dockerfile.fat

@@ -0,0 +1,142 @@
+# Stirling-PDF Dockerfile - Fat version with embedded frontend
+# Single JAR contains both frontend and backend with extra fonts for air-gapped environments
+
+# Stage 1: Build application with embedded frontend
+FROM gradle:8.14-jdk21 AS build
+
+# Install Node.js and npm for frontend build
+RUN apt-get update && apt-get install -y \
+    curl \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
+    && npm --version \
+    && node --version \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy gradle files for dependency resolution
+COPY build.gradle .
+COPY settings.gradle .
+COPY gradlew .
+COPY gradle gradle/
+COPY app/core/build.gradle core/.
+COPY app/common/build.gradle common/.
+COPY app/proprietary/build.gradle proprietary/.
+RUN ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube || return 0
+
+# Set working directory
+WORKDIR /app
+
+# Copy entire project
+COPY . .
+
+# Build JAR with embedded frontend (includes security features controlled at runtime)
+RUN DISABLE_ADDITIONAL_FEATURES=false \
+    STIRLING_PDF_DESKTOP_UI=false \
+    ./gradlew clean build -PbuildWithFrontend=true -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+# Stage 2: Runtime image
+FROM alpine:3.22.1
+
+ARG VERSION_TAG
+
+# Labels
+LABEL org.opencontainers.image.title="Stirling-PDF Fat"
+LABEL org.opencontainers.image.description="Stirling-PDF with embedded frontend - Fat version with extra fonts for air-gapped environments"
+LABEL org.opencontainers.image.source="https://github.com/Stirling-Tools/Stirling-PDF"
+LABEL org.opencontainers.image.licenses="MIT"
+LABEL org.opencontainers.image.vendor="Stirling-Tools"
+LABEL org.opencontainers.image.url="https://www.stirlingpdf.com"
+LABEL org.opencontainers.image.documentation="https://docs.stirlingpdf.com"
+LABEL maintainer="Stirling-Tools"
+LABEL org.opencontainers.image.authors="Stirling-Tools"
+LABEL org.opencontainers.image.version="${VERSION_TAG}"
+LABEL org.opencontainers.image.keywords="PDF, manipulation, fat, air-gapped, API, Spring Boot, React"
+
+# Copy scripts and fonts
+COPY scripts /scripts
+COPY app/core/src/main/resources/static/fonts/*.ttf /usr/share/fonts/opentype/noto/
+
+# Copy built JAR from build stage
+COPY --from=build /app/app/core/build/libs/*.jar /app.jar
+COPY --from=build /app/build/libs/restart-helper.jar /restart-helper.jar
+
+# Environment Variables
+ENV VERSION_TAG=$VERSION_TAG \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_CUSTOM_OPTS="" \
+    HOME=/home/stirlingpdfuser \
+    PUID=1000 \
+    PGID=1000 \
+    UMASK=022 \
+    FAT_DOCKER=true \
+    INSTALL_BOOK_AND_ADVANCED_HTML_OPS=false \
+    PYTHONPATH=/usr/lib/libreoffice/program:/opt/venv/lib/python3.12/site-packages \
+    UNO_PATH=/usr/lib/libreoffice/program \
+    URE_BOOTSTRAP=file:///usr/lib/libreoffice/program/fundamentalrc \
+    PATH=$PATH:/opt/venv/bin \
+    STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
+    TMPDIR=/tmp/stirling-pdf \
+    TEMP=/tmp/stirling-pdf \
+    TMP=/tmp/stirling-pdf
+
+# Install all dependencies plus extra fonts for air-gapped environments
+RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
+    echo "@community https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
+    echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" | tee -a /etc/apk/repositories && \
+    apk upgrade --no-cache -a && \
+    apk add --no-cache \
+    ca-certificates \
+    tzdata \
+    tini \
+    bash \
+    curl \
+    shadow \
+    su-exec \
+    openssl \
+    openssl-dev \
+    openjdk21-jre \
+    # Doc conversion
+    gcompat \
+    libc6-compat \
+    libreoffice \
+    ghostscript \
+    fontforge \
+    # pdftohtml
+    poppler-utils \
+    # OCR MY PDF
+    unpaper \
+    tesseract-ocr-data-eng \
+    tesseract-ocr-data-chi_sim \
+    tesseract-ocr-data-deu \
+    tesseract-ocr-data-fra \
+    tesseract-ocr-data-por \
+    ocrmypdf \
+    # Extra fonts for fat version
+    font-terminus font-dejavu font-noto font-noto-cjk font-awesome font-noto-extra font-liberation font-linux-libertine \
+    # CV
+    py3-opencv \
+    python3 \
+    py3-pip \
+    py3-pillow@testing \
+    py3-pdf2image@testing && \
+    python3 -m venv /opt/venv && \
+    /opt/venv/bin/pip install --upgrade pip setuptools && \
+    /opt/venv/bin/pip install --no-cache-dir --upgrade unoserver weasyprint && \
+    ln -s /usr/lib/libreoffice/program/uno.py /opt/venv/lib/python3.12/site-packages/ && \
+    ln -s /usr/lib/libreoffice/program/unohelper.py /opt/venv/lib/python3.12/site-packages/ && \
+    ln -s /usr/lib/libreoffice/program /opt/venv/lib/python3.12/site-packages/LibreOffice && \
+    mv /usr/share/tessdata /usr/share/tessdata-original && \
+    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf && \
+    fc-cache -f -v && \
+    chmod +x /scripts/* && \
+    # User permissions
+    addgroup -S stirlingpdfgroup && adduser -S stirlingpdfuser -G stirlingpdfgroup && \
+    chown -R stirlingpdfuser:stirlingpdfgroup $HOME /scripts /pipeline /usr/share/fonts/opentype/noto /configs /customFiles /tmp/stirling-pdf && \
+    chown stirlingpdfuser:stirlingpdfgroup /app.jar /restart-helper.jar
+
+EXPOSE 8080/tcp
+
+# Set user and run command
+ENTRYPOINT ["tini", "--", "/scripts/init.sh"]
+CMD ["sh", "-c", "java -Dfile.encoding=UTF-8 -Djava.io.tmpdir=/tmp/stirling-pdf -jar /app.jar & /opt/venv/bin/unoserver --port 2003 --interface 127.0.0.1"]

docker/embedded/Dockerfile.ultra-lite

@@ -0,0 +1,104 @@
+# Stirling-PDF Dockerfile - Ultra-lite version with embedded frontend
+# Single JAR contains both frontend and backend with minimal dependencies
+
+# Stage 1: Build application with embedded frontend
+FROM gradle:8.14-jdk21 AS build
+
+# Install Node.js and npm for frontend build
+RUN apt-get update && apt-get install -y \
+    curl \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
+    && npm --version \
+    && node --version \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy gradle files for dependency resolution
+COPY build.gradle .
+COPY settings.gradle .
+COPY gradlew .
+COPY gradle gradle/
+COPY app/core/build.gradle core/.
+COPY app/common/build.gradle common/.
+COPY app/proprietary/build.gradle proprietary/.
+RUN ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube || return 0
+
+# Set working directory
+WORKDIR /app
+
+# Copy entire project
+COPY . .
+
+# Build ultra-lite JAR with embedded frontend (minimal features)
+RUN DISABLE_ADDITIONAL_FEATURES=true \
+    STIRLING_PDF_DESKTOP_UI=false \
+    ./gradlew clean build -PbuildWithFrontend=true -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+# Stage 2: Runtime image
+FROM alpine:3.22.1
+
+ARG VERSION_TAG
+
+# Labels
+LABEL org.opencontainers.image.title="Stirling-PDF Ultra-Lite"
+LABEL org.opencontainers.image.description="Stirling-PDF with embedded frontend - Ultra-lite version with minimal dependencies"
+LABEL org.opencontainers.image.source="https://github.com/Stirling-Tools/Stirling-PDF"
+LABEL org.opencontainers.image.licenses="MIT"
+LABEL org.opencontainers.image.vendor="Stirling-Tools"
+LABEL org.opencontainers.image.url="https://www.stirlingpdf.com"
+LABEL org.opencontainers.image.documentation="https://docs.stirlingpdf.com"
+LABEL maintainer="Stirling-Tools"
+LABEL org.opencontainers.image.authors="Stirling-Tools"
+LABEL org.opencontainers.image.version="${VERSION_TAG}"
+LABEL org.opencontainers.image.keywords="PDF, manipulation, ultra-lite, API, Spring Boot, React"
+
+# Copy scripts
+COPY scripts/init-without-ocr.sh /scripts/init-without-ocr.sh
+COPY scripts/installFonts.sh /scripts/installFonts.sh
+
+# Copy built JAR from build stage
+COPY --from=build /app/app/core/build/libs/*.jar /app.jar
+COPY --from=build /app/build/libs/restart-helper.jar /restart-helper.jar
+
+# Environment Variables
+ENV VERSION_TAG=$VERSION_TAG \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_CUSTOM_OPTS="" \
+    HOME=/home/stirlingpdfuser \
+    PUID=1000 \
+    PGID=1000 \
+    UMASK=022 \
+    STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
+    TMPDIR=/tmp/stirling-pdf \
+    TEMP=/tmp/stirling-pdf \
+    TMP=/tmp/stirling-pdf \
+    ENDPOINTS_GROUPS_TO_REMOVE=CLI
+
+# Install minimal dependencies
+RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
+    echo "@community https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
+    echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" | tee -a /etc/apk/repositories && \
+    apk upgrade --no-cache -a && \
+    apk add --no-cache \
+    ca-certificates \
+    tzdata \
+    tini \
+    bash \
+    curl \
+    shadow \
+    su-exec \
+    openjdk21-jre && \
+    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf && \
+    mkdir -p /usr/share/fonts/opentype/noto && \
+    chmod +x /scripts/*.sh && \
+    # User permissions
+    addgroup -S stirlingpdfgroup && adduser -S stirlingpdfuser -G stirlingpdfgroup && \
+    chown -R stirlingpdfuser:stirlingpdfgroup $HOME /scripts /configs /customFiles /pipeline /tmp/stirling-pdf && \
+    chown stirlingpdfuser:stirlingpdfgroup /app.jar /restart-helper.jar
+
+EXPOSE 8080/tcp
+
+# Set user and run command
+ENTRYPOINT ["tini", "--", "/scripts/init-without-ocr.sh"]
+CMD ["java", "-Dfile.encoding=UTF-8", "-Djava.io.tmpdir=/tmp/stirling-pdf", "-jar", "/app.jar"]

frontend/index.html

@@ -3,21 +3,21 @@
   <head>
     <meta charset="UTF-8" />
     <base href="%BASE_URL%" />
-    <link rel="icon" href="/modern-logo/favicon.ico" />
+    <link rel="icon" href="modern-logo/favicon.ico" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#000000" />
     <meta
       name="description"
       content="The Free Adobe Acrobat alternative (10M+ Downloads)"
     />
-    <link rel="apple-touch-icon" href="/modern-logo/logo192.png" />
-    <link rel="manifest" href="/manifest.json" />
+    <link rel="apple-touch-icon" href="modern-logo/logo192.png" />
+    <link rel="manifest" href="manifest.json" />
 
     <title>Stirling PDF</title>
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>
     <div id="root"></div>
-    <script type="module" src="/src/index.tsx"></script>
+    <script type="module" src="src/index.tsx"></script>
   </body>
 </html>

frontend/package-lock.json

@@ -11,25 +11,26 @@
       "dependencies": {
         "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
         "@dnd-kit/core": "^6.3.1",
-        "@embedpdf/core": "^1.4.1",
-        "@embedpdf/engines": "^1.4.1",
-        "@embedpdf/plugin-annotation": "^1.4.1",
-        "@embedpdf/plugin-bookmark": "^1.4.1",
-        "@embedpdf/plugin-export": "^1.4.1",
-        "@embedpdf/plugin-history": "^1.4.1",
-        "@embedpdf/plugin-interaction-manager": "^1.4.1",
-        "@embedpdf/plugin-loader": "^1.4.1",
-        "@embedpdf/plugin-pan": "^1.4.1",
-        "@embedpdf/plugin-render": "^1.4.1",
-        "@embedpdf/plugin-rotate": "^1.4.1",
-        "@embedpdf/plugin-scroll": "^1.4.1",
-        "@embedpdf/plugin-search": "^1.4.1",
-        "@embedpdf/plugin-selection": "^1.4.1",
-        "@embedpdf/plugin-spread": "^1.4.1",
-        "@embedpdf/plugin-thumbnail": "^1.4.1",
-        "@embedpdf/plugin-tiling": "^1.4.1",
-        "@embedpdf/plugin-viewport": "^1.4.1",
-        "@embedpdf/plugin-zoom": "^1.4.1",
+        "@embedpdf/core": "^1.5.0",
+        "@embedpdf/engines": "^1.5.0",
+        "@embedpdf/plugin-annotation": "^1.5.0",
+        "@embedpdf/plugin-bookmark": "^1.5.0",
+        "@embedpdf/plugin-export": "^1.5.0",
+        "@embedpdf/plugin-history": "^1.5.0",
+        "@embedpdf/plugin-interaction-manager": "^1.5.0",
+        "@embedpdf/plugin-loader": "^1.5.0",
+        "@embedpdf/plugin-pan": "^1.5.0",
+        "@embedpdf/plugin-print": "^1.5.0",
+        "@embedpdf/plugin-render": "^1.5.0",
+        "@embedpdf/plugin-rotate": "^1.5.0",
+        "@embedpdf/plugin-scroll": "^1.5.0",
+        "@embedpdf/plugin-search": "^1.5.0",
+        "@embedpdf/plugin-selection": "^1.5.0",
+        "@embedpdf/plugin-spread": "^1.5.0",
+        "@embedpdf/plugin-thumbnail": "^1.5.0",
+        "@embedpdf/plugin-tiling": "^1.5.0",
+        "@embedpdf/plugin-viewport": "^1.5.0",
+        "@embedpdf/plugin-zoom": "^1.5.0",
         "@emotion/react": "^11.14.0",
         "@emotion/styled": "^11.14.1",
         "@iconify/react": "^6.0.2",
@@ -574,13 +575,13 @@
       "license": "0BSD"
     },
     "node_modules/@embedpdf/core": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/core/-/core-1.4.1.tgz",
-      "integrity": "sha512-TGpxn2CvAKRnOJWJ3bsK+dKBiCp75ehxftRUmv7wAmPomhnG5XrDfoWJungvO+zbbqAwso6PocdeXINVt3hlAw==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/core/-/core-1.5.0.tgz",
+      "integrity": "sha512-Yrh9XoVaT8cUgzgqpJ7hx5wg6BqQrCFirqqlSwVb+Ly9oNn4fZbR9GycIWmzJOU5XBnaOJjXfQSaDyoNP0woNA==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/engines": "1.4.1",
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/engines": "1.5.0",
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
         "preact": "^10.26.4",
@@ -591,13 +592,13 @@
       }
     },
     "node_modules/@embedpdf/engines": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/engines/-/engines-1.4.1.tgz",
-      "integrity": "sha512-yugIb5OwTI/1VnAaEvSYxAd2DvYBPkV/D7wytagyaOq98o3sqzcY2Q9zHt+LhnawA5KKG1e/FDPjCd4qm8gsvg==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/engines/-/engines-1.5.0.tgz",
+      "integrity": "sha512-/GzhjHFHWfOaX7vjgFJX/pyq668wYjoda1bZ9MpwF/EF000Wwy2Q0AOhprjldPFz8ASKjwKwqsXmaqrK99yOAQ==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1",
-        "@embedpdf/pdfium": "1.4.1"
+        "@embedpdf/models": "1.5.0",
+        "@embedpdf/pdfium": "1.5.0"
       },
       "peerDependencies": {
         "preact": "^10.26.4",
@@ -608,31 +609,31 @@
       }
     },
     "node_modules/@embedpdf/models": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/models/-/models-1.4.1.tgz",
-      "integrity": "sha512-2nTg8Q1qpplBvspZJXMCZOA+/OILpfdNRPddlplxZXY/Upx0rzKXx/e6pXWW7AuOgtfGneT4h9tMs3A595/PdQ==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/models/-/models-1.5.0.tgz",
+      "integrity": "sha512-x/1li3jdag+IzfZkcfRLKLqASLep4v6dgVi3z0JArwaicFra8k1IY2xaVTrwcZyx7pRb/rxvoO9yLHW0Y34NFw==",
       "license": "MIT"
     },
     "node_modules/@embedpdf/pdfium": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/pdfium/-/pdfium-1.4.1.tgz",
-      "integrity": "sha512-BekKEK4UNCwzj7xOffKn6WpL0FQHxq+mTj2iGI3N7OwAX2J/BO2G+rDOB+lvojQG+Dkpg8uqm427ZKJDRyLgVQ==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/pdfium/-/pdfium-1.5.0.tgz",
+      "integrity": "sha512-PI32t2U4ThZC907n2Iwr8E5WqmC574G83u3V9ysNFl29N9kasrY9RiLSzU4W/yQvXPjIbpQHBsbMKXLjCFBI9w==",
       "license": "MIT"
     },
     "node_modules/@embedpdf/plugin-annotation": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-annotation/-/plugin-annotation-1.4.1.tgz",
-      "integrity": "sha512-d4HibNy6ecyDqx2Y2R8VjaqppSdjNofAJmU6VenOd88wn080sAUqvnkeVJ6ehJH5BoND4ymQrcAkcbVeYK0myA==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-annotation/-/plugin-annotation-1.5.0.tgz",
+      "integrity": "sha512-mxEPI6xYwOGaf9fYfoywuj6nwA10eHFPBuN066MzwphDk6DOHJGZ3Vq8zNQBXh20c/Lb25PL718D7MZWxZLUHg==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1",
-        "@embedpdf/utils": "1.4.1"
+        "@embedpdf/models": "1.5.0",
+        "@embedpdf/utils": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-history": "1.4.1",
-        "@embedpdf/plugin-interaction-manager": "1.4.1",
-        "@embedpdf/plugin-selection": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-history": "1.5.0",
+        "@embedpdf/plugin-interaction-manager": "1.5.0",
+        "@embedpdf/plugin-selection": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -640,15 +641,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-bookmark": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-bookmark/-/plugin-bookmark-1.4.1.tgz",
-      "integrity": "sha512-WnfBJdv+Eq5zsMfwDZ5RlXZMGpvKm/ccL6jlTVwtELBhu3wvhjjbBmZdheEOzHMC3VXMNYDMjCeaXkUG4nWoDA==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-bookmark/-/plugin-bookmark-1.5.0.tgz",
+      "integrity": "sha512-s3C9PtVesy5X8Ds/C9TEElFiqfKGRklG/uNPTROpNoolfpi0h7qX2xqqh/9+FzKH2nHjVcPB7Pp432v16h7eRA==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -656,15 +657,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-export": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-export/-/plugin-export-1.4.1.tgz",
-      "integrity": "sha512-g89fREFM/zkt2Ai2Q5dWwDkhXgC/JmVyUniaMgm1fTG/MZ0Z05E7f34DUzX/CKcJyVjxEgl6tojBTMeUbm15bA==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-export/-/plugin-export-1.5.0.tgz",
+      "integrity": "sha512-luk68mNW9l2X31qk4b02phKaqDl9aDXUAgHVz1EWrgwXQ3Oz9WEdu60utYARYDiepDo3Caadll8RwctYSf/anA==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -673,15 +674,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-history": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-history/-/plugin-history-1.4.1.tgz",
-      "integrity": "sha512-5WLDiNMH6tACkLGGv/lJtNsDeozOhSbrh0mjD1btHun8u7Yscu/Vf8tdJRUOsd+nULivo2nQ2NFNKu0OTbVo8w==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-history/-/plugin-history-1.5.0.tgz",
+      "integrity": "sha512-p7PTNNaIr4gH3jLwX+eLJe1DeUXgi21kVGN6SRx/pocH8esg4jqoOeD/YiRRZoZnPOiy0jBXVhkPkwSmY7a2hQ==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -689,15 +690,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-interaction-manager": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-interaction-manager/-/plugin-interaction-manager-1.4.1.tgz",
-      "integrity": "sha512-Ng02S9SFIAi9JZS5rI+NXSnZZ1Yk9YYRw4MlN2pig49qOyivZdz0oScZaYxQPewo8ccJkLeghjdeWswOBW/6cA==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-interaction-manager/-/plugin-interaction-manager-1.5.0.tgz",
+      "integrity": "sha512-ckHgTfvkW6c5Ta7Mc+Dl9C2foVnvEpqEJ84wyBnqrU0OWbe/jsiPhyKBVeartMGqNI/kVfaQTXupyrKhekAVmg==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -706,15 +707,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-loader": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-loader/-/plugin-loader-1.4.1.tgz",
-      "integrity": "sha512-m3ZOk8JygsLxoa4cZ+0BVB5pfRWuBCg2/gPqjhoFZNKTqAFw4J6HGUrhYKg94GRYe+w1cTJl/NbTBYuU5DOrsA==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-loader/-/plugin-loader-1.5.0.tgz",
+      "integrity": "sha512-P4YpIZfaW69etYIjphyaL4cGl2pB14h3OdTE0tRQ2pZYZHFLTvlt4q9B3PVSdhlSrHK5nob7jfLGon2U7xCslg==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -723,17 +724,17 @@
       }
     },
     "node_modules/@embedpdf/plugin-pan": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-pan/-/plugin-pan-1.4.1.tgz",
-      "integrity": "sha512-zmOZJ9dUqXiaV0F5GPf/5WTWf3jAEkiv153Tl3x8HT9Rfff+WQhV48NruCIBAy/T4jVt4aH7D1zt/B/ftvcdkA==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-pan/-/plugin-pan-1.5.0.tgz",
+      "integrity": "sha512-EMQ08dHqLkZmFVuLOO6h3AAinFPQoA1r6OlL9z+p0sswq31JAgd4X7+xjYIpI01z/V3+cTzPHzp7qwob5E4tbA==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-interaction-manager": "1.4.1",
-        "@embedpdf/plugin-viewport": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-interaction-manager": "1.5.0",
+        "@embedpdf/plugin-viewport": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -741,16 +742,33 @@
         "vue": ">=3.2.0"
       }
     },
-    "node_modules/@embedpdf/plugin-render": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-render/-/plugin-render-1.4.1.tgz",
-      "integrity": "sha512-gKCdNKw6WBHBEpTc2DLBWIWOxzsNnaNbpfeY6C4f2Bum0EO+XW3Hl2oIx1uaRHjIhhnXso1J3QweqelsPwDGwg==",
+    "node_modules/@embedpdf/plugin-print": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-print/-/plugin-print-1.5.0.tgz",
+      "integrity": "sha512-rjorvNxAZfO9X4cFZVU9fHnldMWqMceJGmr3mH+yj7KdHePvNDDP+omyZyZKtxlUZENaeDI2h6k5z0GbhBz6sQ==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "preact": "^10.26.4",
+        "react": ">=18.0.0",
+        "react-dom": ">=18.0.0",
+        "svelte": ">=5 <6",
+        "vue": ">=3.2.0"
+      }
+    },
+    "node_modules/@embedpdf/plugin-render": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-render/-/plugin-render-1.5.0.tgz",
+      "integrity": "sha512-ywwSj0ByrlkvrJIHKRzqxARkOZriki8VJUC+T4MV8fGyF4CzvCRJyKlPktahFz+VxhoodqTh7lBCib68dH+GvA==",
+      "license": "MIT",
+      "dependencies": {
+        "@embedpdf/models": "1.5.0"
+      },
+      "peerDependencies": {
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -759,15 +777,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-rotate": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-rotate/-/plugin-rotate-1.4.1.tgz",
-      "integrity": "sha512-hVzHkKwMNH3tUhxqJGsj5qTLpYZXbj6E74AEcG0w/fz5FrK7EnofPqt0gRfYmIzxnQGIh+39BRtcp8gmx8UNnw==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-rotate/-/plugin-rotate-1.5.0.tgz",
+      "integrity": "sha512-5EmBCsq0VfrE3xWY6ofuVm8S6aK95EbAycRIk1wczcmTdvpsuXZ6P2ZaECUgYMcpZ6uAg4/kGf8X8VVZuCihSQ==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -776,16 +794,16 @@
       }
     },
     "node_modules/@embedpdf/plugin-scroll": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-scroll/-/plugin-scroll-1.4.1.tgz",
-      "integrity": "sha512-Y9O+matB4j4fLim5s/jn7qIi+lMC9vmDJRpJhiWe8bvD9oYLP2xfD/DdhFgAjRKcNhPoxC+j8q8QN5BMeGAv2Q==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-scroll/-/plugin-scroll-1.5.0.tgz",
+      "integrity": "sha512-RNmTZCZ8X1mA8cw9M7TMDuhO9GtkOalGha2bBL3En3D1IlDRS7PzNNMSMV7eqT7OQICSTltlpJ8p8Qi5esvL/Q==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-viewport": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-viewport": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -794,16 +812,16 @@
       }
     },
     "node_modules/@embedpdf/plugin-search": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-search/-/plugin-search-1.4.1.tgz",
-      "integrity": "sha512-8JG4CbOcUsLuT0vHJJ4cECmu+Yn53EokWFUVXi2Mo/XvHjhrQuWmD7+y6s/qQPEpctFYWmUCXTDAX9ynPud+2Q==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-search/-/plugin-search-1.5.0.tgz",
+      "integrity": "sha512-TB5b0H8Iobx/azVUBIlG2ClaKtf0y3/Xi3E/iB8BwvkIE2+g6EGfp8IMXIn8WDXST6bbvJEP31Ab0Ilp6SVkiw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-loader": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-loader": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -812,17 +830,17 @@
       }
     },
     "node_modules/@embedpdf/plugin-selection": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-selection/-/plugin-selection-1.4.1.tgz",
-      "integrity": "sha512-lo5Ytk1PH0PrRKv6zKVupm4t02VGsqIrnSIeP6NO8Ujx0wfqEhj//sqIuO/EwfFVJD8lcQIP9UUo9y8baCrEog==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-selection/-/plugin-selection-1.5.0.tgz",
+      "integrity": "sha512-zrxLBAZQoPswDuf9q9DrYaQc6B0Ysc2U1hueTjNH/4+ydfl0BFXZkKR63C2e3YmWtXvKjkoIj0GyPzsiBORLUw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-interaction-manager": "1.4.1",
-        "@embedpdf/plugin-viewport": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-interaction-manager": "1.5.0",
+        "@embedpdf/plugin-viewport": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -831,16 +849,16 @@
       }
     },
     "node_modules/@embedpdf/plugin-spread": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-spread/-/plugin-spread-1.4.1.tgz",
-      "integrity": "sha512-l+SrDVGTiiItkt2cEtzv7V/X5HhmLbYHcQ8CFobGeIKdJtzKS1Nu/JSKqg7Ki7eCNgyPL1yMNfNE92bNKYVN4w==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-spread/-/plugin-spread-1.5.0.tgz",
+      "integrity": "sha512-3EU5Cp+fPQSiMjvMR/P2kXxXry/RlnxHLs4JeskAaH95QcqWW3VD+DrHkWSiLFkdhI18rNNGNlMc5RvDGvbXGQ==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-loader": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-loader": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -849,16 +867,16 @@
       }
     },
     "node_modules/@embedpdf/plugin-thumbnail": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-thumbnail/-/plugin-thumbnail-1.4.1.tgz",
-      "integrity": "sha512-bN3msjI0PovazgbPK3LyugYVTwIDo0RyBUhBaG42FgJxeY3hmFOWTPgfUH1QF7twHlySnksIvHRFYR3nViryVw==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-thumbnail/-/plugin-thumbnail-1.5.0.tgz",
+      "integrity": "sha512-Z2qpyyr5s2M6460KDGu1Vk6rdbQFIoCpnyFAT6e7UaTIKkqJSNpmjqMsBU5PosYCFu/cClpHPvS7tg9/IKAk6g==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-render": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-render": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -867,18 +885,18 @@
       }
     },
     "node_modules/@embedpdf/plugin-tiling": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-tiling/-/plugin-tiling-1.4.1.tgz",
-      "integrity": "sha512-wgTfj5T8HV6KP61iiR63DVNrbVp8sPxTqa1Sm+2/D0jY+EPSSCmpt1/qYWiAXd1X+t78foOjCnfbo7fEMn5/pg==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-tiling/-/plugin-tiling-1.5.0.tgz",
+      "integrity": "sha512-0Vx9elHNpMM+zv8hEoZXBEm8Q0+4kU52LxOlTYRr1A5FskF836sUct6g1ngwK1bmfbAfpz+62PnYI2EeilDZig==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-render": "1.4.1",
-        "@embedpdf/plugin-scroll": "1.4.1",
-        "@embedpdf/plugin-viewport": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-render": "1.5.0",
+        "@embedpdf/plugin-scroll": "1.5.0",
+        "@embedpdf/plugin-viewport": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -887,15 +905,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-viewport": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-viewport/-/plugin-viewport-1.4.1.tgz",
-      "integrity": "sha512-+TgFHKPCLTBiDYe2DdsmTS37hwQgcZ3dYIc7bE0l5cp+GVwouu1h0MTmjL+90loizeWwCiu10E/zXR6hz+CUaQ==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-viewport/-/plugin-viewport-1.5.0.tgz",
+      "integrity": "sha512-G8GDyYRhfehw72+r4qKkydnA5+AU8qH67g01Y12b0DzI0VIzymh/05Z4dK8DsY3jyWPXJfw2hlg5+KDHaMBHgQ==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1"
+        "@embedpdf/models": "1.5.0"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
+        "@embedpdf/core": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -904,19 +922,19 @@
       }
     },
     "node_modules/@embedpdf/plugin-zoom": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-zoom/-/plugin-zoom-1.4.1.tgz",
-      "integrity": "sha512-9HocmXnPZxqN06q7kyNAmLjgDHOEW8/8QfgNE3nMpRyNHIgnAjxvsWc9lApgp5ErDPG0cSDt0Cduil6nB3wSBQ==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-zoom/-/plugin-zoom-1.5.0.tgz",
+      "integrity": "sha512-LiDkCd5/IXg2CRORl1Yikan2op+AYXSxhHzCFatyBdwzVj+n4y9I74OwCI62Mar8WDAIMyXZDCQxGPToSm+zDw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "1.4.1",
+        "@embedpdf/models": "1.5.0",
         "hammerjs": "^2.0.8"
       },
       "peerDependencies": {
-        "@embedpdf/core": "1.4.1",
-        "@embedpdf/plugin-interaction-manager": "1.4.1",
-        "@embedpdf/plugin-scroll": "1.4.1",
-        "@embedpdf/plugin-viewport": "1.4.1",
+        "@embedpdf/core": "1.5.0",
+        "@embedpdf/plugin-interaction-manager": "1.5.0",
+        "@embedpdf/plugin-scroll": "1.5.0",
+        "@embedpdf/plugin-viewport": "1.5.0",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -925,9 +943,9 @@
       }
     },
     "node_modules/@embedpdf/utils": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/utils/-/utils-1.4.1.tgz",
-      "integrity": "sha512-vvJ51Qsz3PyJWR2YvDMMpJXg4+YqdV7Vn2cusmW9sx+4EnAiBiw0HevEE+FepgFV8k+A0WbwXzmsujDIQJ7R4A==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@embedpdf/utils/-/utils-1.5.0.tgz",
+      "integrity": "sha512-L6jsAPQPGM8ne+MMFAd5gqXb1RNEgNyh16VvVUVKcVnJlBhwil59nVeEQ0cwPhjF5qVeY6MQDIOjBzJqkgXOYg==",
       "license": "MIT",
       "peerDependencies": {
         "preact": "^10.26.4",

frontend/package.json

@@ -7,25 +7,26 @@
   "dependencies": {
     "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
     "@dnd-kit/core": "^6.3.1",
-    "@embedpdf/core": "^1.4.1",
-    "@embedpdf/engines": "^1.4.1",
-    "@embedpdf/plugin-annotation": "^1.4.1",
-    "@embedpdf/plugin-bookmark": "^1.4.1",
-    "@embedpdf/plugin-export": "^1.4.1",
-    "@embedpdf/plugin-history": "^1.4.1",
-    "@embedpdf/plugin-interaction-manager": "^1.4.1",
-    "@embedpdf/plugin-loader": "^1.4.1",
-    "@embedpdf/plugin-pan": "^1.4.1",
-    "@embedpdf/plugin-render": "^1.4.1",
-    "@embedpdf/plugin-rotate": "^1.4.1",
-    "@embedpdf/plugin-scroll": "^1.4.1",
-    "@embedpdf/plugin-search": "^1.4.1",
-    "@embedpdf/plugin-selection": "^1.4.1",
-    "@embedpdf/plugin-spread": "^1.4.1",
-    "@embedpdf/plugin-thumbnail": "^1.4.1",
-    "@embedpdf/plugin-tiling": "^1.4.1",
-    "@embedpdf/plugin-viewport": "^1.4.1",
-    "@embedpdf/plugin-zoom": "^1.4.1",
+    "@embedpdf/core": "^1.5.0",
+    "@embedpdf/engines": "^1.5.0",
+    "@embedpdf/plugin-annotation": "^1.5.0",
+    "@embedpdf/plugin-bookmark": "^1.5.0",
+    "@embedpdf/plugin-export": "^1.5.0",
+    "@embedpdf/plugin-history": "^1.5.0",
+    "@embedpdf/plugin-interaction-manager": "^1.5.0",
+    "@embedpdf/plugin-loader": "^1.5.0",
+    "@embedpdf/plugin-pan": "^1.5.0",
+    "@embedpdf/plugin-print": "^1.5.0",
+    "@embedpdf/plugin-render": "^1.5.0",
+    "@embedpdf/plugin-rotate": "^1.5.0",
+    "@embedpdf/plugin-scroll": "^1.5.0",
+    "@embedpdf/plugin-search": "^1.5.0",
+    "@embedpdf/plugin-selection": "^1.5.0",
+    "@embedpdf/plugin-spread": "^1.5.0",
+    "@embedpdf/plugin-thumbnail": "^1.5.0",
+    "@embedpdf/plugin-tiling": "^1.5.0",
+    "@embedpdf/plugin-viewport": "^1.5.0",
+    "@embedpdf/plugin-zoom": "^1.5.0",
     "@emotion/react": "^11.14.0",
     "@emotion/styled": "^11.14.1",
     "@iconify/react": "^6.0.2",

frontend/public/css/cookieconsentCustomisation.css

@@ -54,17 +54,17 @@
     --cc-secondary-color: #b0b0b0;
 
     --cc-btn-primary-bg: #4dabf7;
-    --cc-btn-primary-color: #2d2d2d;
+    --cc-btn-primary-color: #ffffff;
     --cc-btn-primary-border-color: #4dabf7;
     --cc-btn-primary-hover-bg: #3d3d3d;
-    --cc-btn-primary-hover-color: #e5e5e5;
+    --cc-btn-primary-hover-color: #ffffff;
     --cc-btn-primary-hover-border-color: #3d3d3d;
 
     --cc-btn-secondary-bg: #3d3d3d;
-    --cc-btn-secondary-color: #e5e5e5;
+    --cc-btn-secondary-color: #ffffff;
     --cc-btn-secondary-border-color: #3d3d3d;
     --cc-btn-secondary-hover-bg: #4dabf7;
-    --cc-btn-secondary-hover-color: #2d2d2d;
+    --cc-btn-secondary-hover-color: #ffffff;
     --cc-btn-secondary-hover-border-color: #4dabf7;
 
     --cc-separator-border-color: #555555;
@@ -180,4 +180,27 @@
 /* Lower z-index so cookie banner appears behind onboarding modals */
 #cc-main {
     z-index: 100 !important;
+}
+
+/* Ensure consent modal text is visible in both themes */
+#cc-main .cm {
+    background: var(--cc-bg) !important;
+    color: var(--cc-primary-color) !important;
+}
+
+#cc-main .cm__title {
+    color: var(--cc-primary-color) !important;
+}
+
+#cc-main .cm__desc {
+    color: var(--cc-primary-color) !important;
+}
+
+#cc-main .cm__footer {
+    color: var(--cc-primary-color) !important;
+}
+
+#cc-main .cm__footer-links a,
+#cc-main .cm__link {
+    color: var(--cc-primary-color) !important;
 }

frontend/public/locales/en-GB/translation.toml

@@ -2267,8 +2267,16 @@ defaultCanvasLabel = "Drawing signature"
 defaultImageLabel = "Uploaded signature"
 defaultTextLabel = "Typed signature"
 saveButton = "Save signature"
+savePersonal = "Save Personal"
+saveShared = "Save Shared"
 saveUnavailable = "Create a signature first to save it."
 noChanges = "Current signature is already saved."
+tempStorageTitle = "Temporary browser storage"
+tempStorageDescription = "Signatures are stored in your browser only. They will be lost if you clear browser data or switch browsers."
+personalHeading = "Personal Signatures"
+sharedHeading = "Shared Signatures"
+personalDescription = "Only you can see these signatures."
+sharedDescription = "All users can see and use these signatures."
 
 [sign.saved.type]
 canvas = "Drawing"
@@ -3891,6 +3899,7 @@ toggleSidebar = "Toggle Sidebar"
 exportSelected = "Export Selected Pages"
 toggleAnnotations = "Toggle Annotations Visibility"
 annotationMode = "Toggle Annotation Mode"
+print = "Print PDF"
 draw = "Draw"
 save = "Save"
 saveChanges = "Save Changes"
@@ -4508,6 +4517,7 @@ description = "URL or filename to impressum (required in some jurisdictions)"
 title = "Premium & Enterprise"
 description = "Configure your premium or enterprise license key."
 license = "License Configuration"
+noInput = "Please provide a license key or file"
 
 [admin.settings.premium.licenseKey]
 toggle = "Got a license key or certificate file?"
@@ -4525,6 +4535,26 @@ line1 = "Overwriting your current license key cannot be undone."
 line2 = "Your previous license will be permanently lost unless you have backed it up elsewhere."
 line3 = "Important: Keep license keys private and secure. Never share them publicly."
 
+[admin.settings.premium.inputMethod]
+text = "License Key"
+file = "Certificate File"
+
+[admin.settings.premium.file]
+label = "License Certificate File"
+description = "Upload your .lic or .cert license file from offline purchases"
+choose = "Choose License File"
+selected = "Selected: {{filename}} ({{size}})"
+successMessage = "License file uploaded and activated successfully. No restart required."
+
+[admin.settings.premium.currentLicense]
+title = "Active License"
+file = "Source: License file ({{path}})"
+key = "Source: License key"
+type = "Type: {{type}}"
+
+noInput = "Please provide a license key or upload a certificate file"
+success = "Success"
+
 [admin.settings.premium.enabled]
 label = "Enable Premium Features"
 description = "Enable license key checks for pro/enterprise features"
@@ -5261,7 +5291,7 @@ emailsPlaceholder = "user1@example.com, user2@example.com"
 emailsRequired = "At least one email address is required"
 submit = "Send Invites"
 success = "user(s) invited successfully"
-partialSuccess = "Some invites failed"
+partialFailure = "Some invites failed"
 allFailed = "Failed to invite users"
 error = "Failed to send invites"
 
@@ -5777,7 +5807,7 @@ description = "Sign in with your Stirling account"
 
 [setup.mode.selfhosted]
 title = "Self-Hosted Server"
-description = "Connect to your own Stirling PDF server"
+description = "Connect to your own Stirling PDF server with your personal account"
 
 [setup.saas]
 title = "Sign in to Stirling"
@@ -5813,6 +5843,13 @@ submit = "Login"
 signInWith = "Sign in with"
 oauthPending = "Opening browser for authentication..."
 orContinueWith = "Or continue with email"
+serverRequirement = "Note: The server must have login enabled."
+showInstructions = "How to enable?"
+hideInstructions = "Hide instructions"
+instructions = "To enable login on your Stirling PDF server:"
+instructionsEnvVar = "Set the environment variable:"
+instructionsOrYml = "Or in settings.yml:"
+instructionsRestart = "Then restart your server for the changes to take effect."
 
 [setup.login.username]
 label = "Username"

frontend/src-tauri/capabilities/default.json

@@ -11,8 +11,8 @@
     {
       "identifier": "http:allow-fetch",
       "allow": [
-        { "url": "http://localhost:*" },
-        { "url": "http://127.0.0.1:*" },
+        { "url": "http://*" },
+        { "url": "http://*:*" },
         { "url": "https://*" }
       ]
     },

frontend/src-tauri/stirling-pdf.desktop

@@ -3,6 +3,7 @@ Version=1.0
 Type=Application
 Name=Stirling-PDF
 Comment=Locally hosted web application that allows you to perform various operations on PDF files
+Exec=/usr/bin/stirling-pdf
 Icon={{icon}}
 Terminal=false
 MimeType=application/pdf;

frontend/src/core/App.tsx

@@ -3,7 +3,7 @@ import { AppProviders } from "@app/components/AppProviders";
 import { AppLayout } from "@app/components/AppLayout";
 import { LoadingFallback } from "@app/components/shared/LoadingFallback";
 import HomePage from "@app/pages/HomePage";
-import OnboardingTour from "@app/components/onboarding/OnboardingTour";
+import Onboarding from "@app/components/onboarding/Onboarding";
 
 // Import global styles
 import "@app/styles/tailwind.css";
@@ -19,7 +19,7 @@ export default function App() {
       <AppProviders>
         <AppLayout>
           <HomePage />
-          <OnboardingTour />
+          <Onboarding />
         </AppLayout>
       </AppProviders>
     </Suspense>

frontend/src/core/components/AppProviders.tsx

@@ -12,7 +12,6 @@ import { AppConfigProvider, AppConfigProviderProps, AppConfigRetryOptions } from
 import { RightRailProvider } from "@app/contexts/RightRailContext";
 import { ViewerProvider } from "@app/contexts/ViewerContext";
 import { SignatureProvider } from "@app/contexts/SignatureContext";
-import { OnboardingProvider } from "@app/contexts/OnboardingContext";
 import { TourOrchestrationProvider } from "@app/contexts/TourOrchestrationContext";
 import { AdminTourOrchestrationProvider } from "@app/contexts/AdminTourOrchestrationContext";
 import { PageEditorProvider } from "@app/contexts/PageEditorContext";
@@ -77,7 +76,6 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
       <RainbowThemeProvider>
         <ErrorBoundary>
           <BannerProvider>
-            <OnboardingProvider>
               <AppConfigProvider
                 retryOptions={appConfigRetryOptions}
                 {...appConfigProviderProps}
@@ -113,7 +111,6 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
                     </ToolRegistryProvider>
                   </FileContextProvider>
               </AppConfigProvider>
-            </OnboardingProvider>
           </BannerProvider>
         </ErrorBoundary>
       </RainbowThemeProvider>

frontend/src/core/components/onboarding/InitialOnboardingModal/flowResolver.ts

@@ -1,33 +0,0 @@
-import { FLOW_SEQUENCES, type SlideId } from '@app/components/onboarding/onboardingFlowConfig';
-
-export type FlowType = 'login-admin' | 'login-user' | 'no-login' | 'no-login-admin';
-
-export interface FlowConfig {
-  type: FlowType;
-  ids: SlideId[];
-}
-
-export function resolveFlow(enableLogin: boolean, isAdmin: boolean, selfReportedAdmin: boolean): FlowConfig {
-  if (!enableLogin) {
-    return selfReportedAdmin
-      ? {
-          type: 'no-login-admin',
-          ids: [...FLOW_SEQUENCES.noLoginBase, ...FLOW_SEQUENCES.noLoginAdmin],
-        }
-      : {
-          type: 'no-login',
-          ids: FLOW_SEQUENCES.noLoginBase,
-        };
-  }
-
-  return isAdmin
-    ? {
-        type: 'login-admin',
-        ids: FLOW_SEQUENCES.loginAdmin,
-      }
-    : {
-        type: 'login-user',
-        ids: FLOW_SEQUENCES.loginUser,
-      };
-}
-

frontend/src/core/components/onboarding/InitialOnboardingModal/renderButtons.tsx

@@ -6,7 +6,7 @@ import { ButtonDefinition, type FlowState } from '@app/components/onboarding/onb
 import type { LicenseNotice } from '@app/types/types';
 import type { ButtonAction } from '@app/components/onboarding/onboardingFlowConfig';
 
-interface RenderButtonsProps {
+interface SlideButtonsProps {
   slideDefinition: {
     buttons: ButtonDefinition[];
     id: string;
@@ -16,7 +16,7 @@ interface RenderButtonsProps {
   onAction: (action: ButtonAction) => void;
 }
 
-export function renderButtons({ slideDefinition, licenseNotice, flowState, onAction }: RenderButtonsProps) {
+export function SlideButtons({ slideDefinition, licenseNotice, flowState, onAction }: SlideButtonsProps) {
   const { t } = useTranslation();
   const leftButtons = slideDefinition.buttons.filter((btn) => btn.group === 'left');
   const rightButtons = slideDefinition.buttons.filter((btn) => btn.group === 'right');
@@ -105,5 +105,4 @@ export function renderButtons({ slideDefinition, licenseNotice, flowState, onAct
       <Group gap={12}>{rightButtons.map(renderButton)}</Group>
     </Group>
   );
-}
-
+}

frontend/src/core/components/onboarding/InitialOnboardingModal/types.ts

@@ -1,21 +0,0 @@
-import type { LicenseNotice } from '@app/types/types';
-
-export interface InitialOnboardingModalProps {
-  opened: boolean;
-  onClose: () => void;
-  onRequestServerLicense?: (options?: { deferUntilTourComplete?: boolean; selfReportedAdmin?: boolean }) => void;
-  onLicenseNoticeUpdate?: (licenseNotice: LicenseNotice) => void;
-}
-
-export interface OnboardingState {
-  step: number;
-  selectedRole: 'admin' | 'user' | null;
-  selfReportedAdmin: boolean;
-}
-
-export const DEFAULT_STATE: OnboardingState = {
-  step: 0,
-  selectedRole: null,
-  selfReportedAdmin: false,
-};
-

frontend/src/core/components/onboarding/InitialOnboardingModal/useInitialOnboardingState.ts

@@ -1,381 +0,0 @@
-import { useCallback, useEffect, useMemo, useState, useRef } from 'react';
-import { usePreferences } from '@app/contexts/PreferencesContext';
-import { useOnboarding } from '@app/contexts/OnboardingContext';
-import { useOs } from '@app/hooks/useOs';
-import { useNavigate } from 'react-router-dom';
-import {
-  SLIDE_DEFINITIONS,
-  type ButtonAction,
-  type FlowState,
-  type SlideId,
-} from '@app/components/onboarding/onboardingFlowConfig';
-import type { LicenseNotice } from '@app/types/types';
-import { resolveFlow } from '@app/components/onboarding/InitialOnboardingModal/flowResolver';
-import { useServerExperience } from '@app/hooks/useServerExperience';
-import { DEFAULT_STATE, type InitialOnboardingModalProps, type OnboardingState } from '@app/components/onboarding/InitialOnboardingModal/types';
-import { DOWNLOAD_URLS } from '@app/constants/downloads';
-
-interface UseInitialOnboardingStateResult {
-  state: OnboardingState;
-  totalSteps: number;
-  slideDefinition: (typeof SLIDE_DEFINITIONS)[SlideId];
-  currentSlide: ReturnType<(typeof SLIDE_DEFINITIONS)[SlideId]['createSlide']>;
-  licenseNotice: LicenseNotice;
-  flowState: FlowState;
-  closeAndMarkSeen: () => void;
-  handleButtonAction: (action: ButtonAction) => void;
-}
-
-export function useInitialOnboardingState({
-  opened,
-  onClose,
-  onRequestServerLicense,
-  onLicenseNoticeUpdate,
-}: InitialOnboardingModalProps): UseInitialOnboardingStateResult | null {
-  const { preferences, updatePreference } = usePreferences();
-  const { startTour } = useOnboarding();
-  const {
-    loginEnabled: loginEnabledFromServer,
-    configIsAdmin,
-    totalUsers: serverTotalUsers,
-    userCountResolved: serverUserCountResolved,
-    freeTierLimit,
-    hasPaidLicense,
-    scenarioKey,
-    setSelfReportedAdmin,
-    isNewServer,
-  } = useServerExperience();
-  const osType = useOs();
-  const navigate = useNavigate();
-  const selectedDownloadUrlRef = useRef<string>('');
-
-  const [state, setState] = useState<OnboardingState>(DEFAULT_STATE);
-
-  const resetState = useCallback(() => {
-    setState(DEFAULT_STATE);
-  }, []);
-
-  useEffect(() => {
-    if (!opened) {
-      resetState();
-    }
-  }, [opened, resetState]);
-
-  const handleRoleSelect = useCallback(
-    (role: 'admin' | 'user' | null) => {
-      const isAdminSelection = role === 'admin';
-      setState((prev) => ({
-        ...prev,
-        selectedRole: role,
-        selfReportedAdmin: isAdminSelection,
-      }));
-
-      if (typeof window !== 'undefined') {
-        if (isAdminSelection) {
-          window.localStorage.setItem('stirling-self-reported-admin', 'true');
-        } else {
-          window.localStorage.removeItem('stirling-self-reported-admin');
-        }
-      }
-
-      setSelfReportedAdmin(isAdminSelection);
-    },
-    [setSelfReportedAdmin],
-  );
-
-  const closeAndMarkSeen = useCallback(() => {
-    if (!preferences.hasSeenIntroOnboarding) {
-      updatePreference('hasSeenIntroOnboarding', true);
-    }
-    onClose();
-  }, [onClose, preferences.hasSeenIntroOnboarding, updatePreference]);
-
-  const isAdmin = configIsAdmin;
-  const enableLogin = loginEnabledFromServer;
-
-  const effectiveEnableLogin = enableLogin;
-  const effectiveIsAdmin = isAdmin;
-  const shouldAssumeAdminForNewServer = Boolean(isNewServer) && !effectiveEnableLogin;
-
-  useEffect(() => {
-    if (shouldAssumeAdminForNewServer && !state.selfReportedAdmin) {
-      handleRoleSelect('admin');
-    }
-  }, [handleRoleSelect, shouldAssumeAdminForNewServer, state.selfReportedAdmin]);
-
-  const shouldUseServerCount =
-    (effectiveEnableLogin && effectiveIsAdmin) || !effectiveEnableLogin;
-  const licenseUserCountFromServer =
-    shouldUseServerCount && serverUserCountResolved ? serverTotalUsers : null;
-
-  const effectiveLicenseUserCount = licenseUserCountFromServer ?? null;
-
-  const os = useMemo(() => {
-    switch (osType) {
-      case 'windows':
-        return { label: 'Windows', url: DOWNLOAD_URLS.WINDOWS };
-      case 'mac-apple':
-        return { label: 'Mac (Apple Silicon)', url: DOWNLOAD_URLS.MAC_APPLE_SILICON };
-      case 'mac-intel':
-        return { label: 'Mac (Intel)', url: DOWNLOAD_URLS.MAC_INTEL };
-      case 'linux-x64':
-      case 'linux-arm64':
-        return { label: 'Linux', url: DOWNLOAD_URLS.LINUX_DOCS };
-      default:
-        return { label: '', url: '' };
-    }
-  }, [osType]);
-
-  const osOptions = useMemo(() => {
-    const options = [
-      { label: 'Windows', url: DOWNLOAD_URLS.WINDOWS, value: 'windows' },
-      { label: 'Mac (Apple Silicon)', url: DOWNLOAD_URLS.MAC_APPLE_SILICON, value: 'mac-apple' },
-      { label: 'Mac (Intel)', url: DOWNLOAD_URLS.MAC_INTEL, value: 'mac-intel' },
-      { label: 'Linux', url: DOWNLOAD_URLS.LINUX_DOCS, value: 'linux' },
-    ];
-    return options.filter(opt => opt.url);
-  }, []);
-
-  const resolvedFlow = useMemo(
-    () => resolveFlow(effectiveEnableLogin, effectiveIsAdmin, state.selfReportedAdmin),
-    [effectiveEnableLogin, effectiveIsAdmin, state.selfReportedAdmin],
-  );
-  const shouldSkipSecurityCheck = shouldAssumeAdminForNewServer;
-  const flowSlideIds = useMemo(
-    () =>
-      shouldSkipSecurityCheck
-        ? resolvedFlow.ids.filter((id) => id !== 'security-check')
-        : resolvedFlow.ids,
-    [resolvedFlow.ids, shouldSkipSecurityCheck],
-  );
-  const flowType = resolvedFlow.type;
-  const totalSteps = flowSlideIds.length;
-  const maxIndex = Math.max(totalSteps - 1, 0);
-
-  useEffect(() => {
-    if (state.step >= flowSlideIds.length) {
-      setState((prev) => ({
-        ...prev,
-        step: Math.max(flowSlideIds.length - 1, 0),
-      }));
-    }
-  }, [flowSlideIds.length, state.step]);
-
-  const currentSlideId = flowSlideIds[state.step] ?? flowSlideIds[flowSlideIds.length - 1];
-  const slideDefinition = SLIDE_DEFINITIONS[currentSlideId];
-
-  if (!slideDefinition) {
-    return null;
-  }
-
-  const scenarioProvidesInfo =
-    scenarioKey && scenarioKey !== 'unknown' && scenarioKey !== 'licensed';
-  const scenarioIndicatesAdmin = scenarioProvidesInfo
-    ? scenarioKey!.includes('admin')
-    : state.selfReportedAdmin || effectiveIsAdmin;
-  const scenarioIndicatesOverLimit = scenarioProvidesInfo
-    ? scenarioKey!.includes('over-limit')
-    : effectiveLicenseUserCount != null && effectiveLicenseUserCount > freeTierLimit;
-  const scenarioRequiresLicense =
-    scenarioKey === 'licensed' ? false : scenarioKey === 'unknown' ? !hasPaidLicense : true;
-
-  const shouldShowServerLicenseInfo = scenarioIndicatesAdmin && scenarioRequiresLicense;
-
-  const licenseNotice = useMemo<LicenseNotice>(
-    () => ({
-      totalUsers: effectiveLicenseUserCount,
-      freeTierLimit,
-      isOverLimit: scenarioIndicatesOverLimit,
-      requiresLicense: shouldShowServerLicenseInfo,
-    }),
-    [
-      effectiveLicenseUserCount,
-      freeTierLimit,
-      scenarioIndicatesOverLimit,
-      shouldShowServerLicenseInfo,
-    ],
-  );
-
-  const requestServerLicenseIfNeeded = useCallback(
-    (options?: { deferUntilTourComplete?: boolean; selfReportedAdmin?: boolean }) => {
-      if (!shouldShowServerLicenseInfo) {
-        return;
-      }
-      onRequestServerLicense?.(options);
-    },
-    [onRequestServerLicense, shouldShowServerLicenseInfo],
-  );
-
-  useEffect(() => {
-    onLicenseNoticeUpdate?.(licenseNotice);
-  }, [licenseNotice, onLicenseNoticeUpdate]);
-
-  // Initialize ref with default URL
-  useEffect(() => {
-    if (!selectedDownloadUrlRef.current && os.url) {
-      selectedDownloadUrlRef.current = os.url;
-    }
-  }, [os.url]);
-
-  const handleDownloadUrlChange = useCallback((url: string) => {
-    selectedDownloadUrlRef.current = url;
-  }, []);
-
-  const currentSlide = slideDefinition.createSlide({
-    osLabel: os.label,
-    osUrl: os.url,
-    osOptions,
-    onDownloadUrlChange: handleDownloadUrlChange,
-    selectedRole: state.selectedRole,
-    onRoleSelect: handleRoleSelect,
-    licenseNotice,
-    loginEnabled: effectiveEnableLogin,
-  });
-
-  const goNext = useCallback(() => {
-    setState((prev) => ({
-      ...prev,
-      step: Math.min(prev.step + 1, maxIndex),
-    }));
-  }, [maxIndex]);
-
-  const goPrev = useCallback(() => {
-    setState((prev) => ({
-      ...prev,
-      step: Math.max(prev.step - 1, 0),
-    }));
-  }, []);
-
-  const launchTour = useCallback(
-    (mode: 'admin' | 'tools', options?: { closeOnboardingSlides?: boolean }) => {
-      if (options?.closeOnboardingSlides) {
-        closeAndMarkSeen();
-      }
-
-      startTour(mode, {
-        source: 'initial-onboarding-modal',
-        metadata: {
-          hasCompletedOnboarding: preferences.hasCompletedOnboarding,
-          toolPanelModePromptSeen: preferences.toolPanelModePromptSeen,
-          selfReportedAdmin: state.selfReportedAdmin,
-        },
-      });
-    },
-    [closeAndMarkSeen, preferences.hasCompletedOnboarding, preferences.toolPanelModePromptSeen, startTour, state.selfReportedAdmin],
-  );
-
-  const handleButtonAction = useCallback(
-    (action: ButtonAction) => {
-      const currentSlideIdLocal = currentSlideId;
-      const shouldAutoLaunchLoginUserTour =
-        flowType === 'login-user' && currentSlideIdLocal === 'desktop-install';
-
-      switch (action) {
-        case 'next':
-          if (shouldAutoLaunchLoginUserTour) {
-            launchTour('tools', { closeOnboardingSlides: true });
-            return;
-          }
-          goNext();
-          return;
-        case 'prev':
-          goPrev();
-          return;
-        case 'close':
-          closeAndMarkSeen();
-          return;
-        case 'download-selected': {
-          const downloadUrl = selectedDownloadUrlRef.current || os.url || currentSlide.downloadUrl;
-          if (downloadUrl) {
-            window.open(downloadUrl, '_blank', 'noopener');
-          }
-          if (shouldAutoLaunchLoginUserTour) {
-            launchTour('tools', { closeOnboardingSlides: true });
-            return;
-          }
-          goNext();
-          return;
-        }
-        case 'complete-close':
-          updatePreference('hasCompletedOnboarding', true);
-          closeAndMarkSeen();
-          return;
-        case 'security-next':
-          if (!state.selectedRole) {
-            return;
-          }
-          if (state.selectedRole === 'admin') {
-            goNext();
-          } else {
-            launchTour('tools', { closeOnboardingSlides: true });
-          }
-          return;
-        case 'launch-admin':
-          requestServerLicenseIfNeeded({
-            deferUntilTourComplete: true,
-            selfReportedAdmin: state.selfReportedAdmin || effectiveIsAdmin,
-          });
-          launchTour('admin', { closeOnboardingSlides: true });
-          return;
-        case 'launch-tools':
-          launchTour('tools', { closeOnboardingSlides: true });
-          return;
-        case 'launch-auto': {
-          const launchMode = state.selfReportedAdmin || effectiveIsAdmin ? 'admin' : 'tools';
-          if (launchMode === 'admin') {
-            requestServerLicenseIfNeeded({
-              deferUntilTourComplete: true,
-              selfReportedAdmin: state.selfReportedAdmin || effectiveIsAdmin,
-            });
-          }
-          launchTour(launchMode, { closeOnboardingSlides: true });
-          return;
-        }
-        case 'skip-to-license':
-          updatePreference('hasCompletedOnboarding', true);
-          requestServerLicenseIfNeeded({
-            deferUntilTourComplete: false,
-            selfReportedAdmin: state.selfReportedAdmin || effectiveIsAdmin,
-          });
-          closeAndMarkSeen();
-          return;
-        case 'see-plans':
-          closeAndMarkSeen();
-          navigate('/settings/adminPlan');
-          return;
-        default:
-          return;
-      }
-    },
-    [
-      closeAndMarkSeen,
-      currentSlide,
-      effectiveIsAdmin,
-      flowType,
-      goNext,
-      goPrev,
-      launchTour,
-      navigate,
-      requestServerLicenseIfNeeded,
-      onRequestServerLicense,
-      os.url,
-      state.selectedRole,
-      state.selfReportedAdmin,
-      updatePreference,
-    ],
-  );
-
-  const flowState: FlowState = { selectedRole: state.selectedRole };
-
-  return {
-    state,
-    totalSteps,
-    slideDefinition,
-    currentSlide,
-    licenseNotice,
-    flowState,
-    closeAndMarkSeen,
-    handleButtonAction,
-  };
-}
-

frontend/src/core/components/onboarding/Onboarding.tsx

@@ -0,0 +1,319 @@
+import { useEffect, useMemo, useCallback, useState } from 'react';
+import { type StepType } from '@reactour/tour';
+import { useTranslation } from 'react-i18next';
+import { useNavigate, useLocation } from 'react-router-dom';
+import { isAuthRoute } from '@app/constants/routes';
+import { dispatchTourState } from '@app/constants/events';
+import { useOnboardingOrchestrator } from '@app/components/onboarding/orchestrator/useOnboardingOrchestrator';
+import { markStepSeen } from '@app/components/onboarding/orchestrator/onboardingStorage';
+import OnboardingTour, { type AdvanceArgs, type CloseArgs } from '@app/components/onboarding/OnboardingTour';
+import OnboardingModalSlide from '@app/components/onboarding/OnboardingModalSlide';
+import {
+  useServerLicenseRequest,
+  useTourRequest,
+} from '@app/components/onboarding/useOnboardingEffects';
+import { useOnboardingDownload } from '@app/components/onboarding/useOnboardingDownload';
+import { SLIDE_DEFINITIONS, type SlideId, type ButtonAction } from '@app/components/onboarding/onboardingFlowConfig';
+import ToolPanelModePrompt from '@app/components/tools/ToolPanelModePrompt';
+import { useTourOrchestration } from '@app/contexts/TourOrchestrationContext';
+import { useAdminTourOrchestration } from '@app/contexts/AdminTourOrchestrationContext';
+import { createUserStepsConfig } from '@app/components/onboarding/userStepsConfig';
+import { createAdminStepsConfig } from '@app/components/onboarding/adminStepsConfig';
+import { removeAllGlows } from '@app/components/onboarding/tourGlow';
+import { useFilesModalContext } from '@app/contexts/FilesModalContext';
+import { useServerExperience } from '@app/hooks/useServerExperience';
+import AdminAnalyticsChoiceModal from '@app/components/shared/AdminAnalyticsChoiceModal';
+import '@app/components/onboarding/OnboardingTour.css';
+
+export default function Onboarding() {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const location = useLocation();
+  const { state, actions } = useOnboardingOrchestrator();
+  const serverExperience = useServerExperience();
+  const onAuthRoute = isAuthRoute(location.pathname);
+  const { currentStep, isActive, isLoading, runtimeState, activeFlow } = state;
+
+  const { osInfo, osOptions, setSelectedDownloadUrl, handleDownloadSelected } = useOnboardingDownload();
+  const { showLicenseSlide, licenseNotice: externalLicenseNotice, closeLicenseSlide } = useServerLicenseRequest();
+  const { tourRequested: externalTourRequested, requestedTourType, clearTourRequest } = useTourRequest();
+
+  const handleRoleSelect = useCallback((role: 'admin' | 'user' | null) => {
+    actions.updateRuntimeState({ selectedRole: role });
+    serverExperience.setSelfReportedAdmin(role === 'admin');
+  }, [actions, serverExperience]);
+
+  const handlePasswordChanged = useCallback(() => {
+    actions.updateRuntimeState({ requiresPasswordChange: false });
+    window.location.href = '/login';
+  }, [actions]);
+
+  const handleButtonAction = useCallback((action: ButtonAction) => {
+    switch (action) {
+      case 'next':
+      case 'complete-close':
+        actions.complete();
+        break;
+      case 'prev':
+        actions.prev();
+        break;
+      case 'close':
+        actions.skip();
+        break;
+      case 'download-selected':
+        handleDownloadSelected();
+        actions.complete();
+        break;
+      case 'security-next':
+        if (!runtimeState.selectedRole) return;
+        if (runtimeState.selectedRole !== 'admin') {
+          actions.updateRuntimeState({ tourRequested: true, tourType: 'tools' });
+        }
+        actions.complete();
+        break;
+      case 'launch-admin':
+        actions.updateRuntimeState({ tourRequested: true, tourType: 'admin' });
+        actions.complete();
+        break;
+      case 'launch-tools':
+        actions.updateRuntimeState({ tourRequested: true, tourType: 'tools' });
+        actions.complete();
+        break;
+      case 'launch-auto': {
+        const tourType = serverExperience.effectiveIsAdmin || runtimeState.selectedRole === 'admin' ? 'admin' : 'tools';
+        actions.updateRuntimeState({ tourRequested: true, tourType });
+        actions.complete();
+        break;
+      }
+      case 'skip-to-license':
+        markStepSeen('tour');
+        actions.updateRuntimeState({ tourRequested: false });
+        actions.complete();
+        break;
+      case 'see-plans':
+        actions.complete();
+        navigate('/settings/adminPlan');
+        break;
+    }
+  }, [actions, handleDownloadSelected, navigate, runtimeState.selectedRole, serverExperience.effectiveIsAdmin]);
+
+  const isRTL = typeof document !== 'undefined' ? document.documentElement.dir === 'rtl' : false;
+  const [isTourOpen, setIsTourOpen] = useState(false);
+
+  useEffect(() => dispatchTourState(isTourOpen), [isTourOpen]);
+
+  const { openFilesModal, closeFilesModal } = useFilesModalContext();
+  const tourOrch = useTourOrchestration();
+  const adminTourOrch = useAdminTourOrchestration();
+
+  const userStepsConfig = useMemo(
+    () => createUserStepsConfig({
+      t,
+      actions: {
+        saveWorkbenchState: tourOrch.saveWorkbenchState,
+        closeFilesModal,
+        backToAllTools: tourOrch.backToAllTools,
+        selectCropTool: tourOrch.selectCropTool,
+        loadSampleFile: tourOrch.loadSampleFile,
+        switchToViewer: tourOrch.switchToViewer,
+        switchToPageEditor: tourOrch.switchToPageEditor,
+        switchToActiveFiles: tourOrch.switchToActiveFiles,
+        selectFirstFile: tourOrch.selectFirstFile,
+        pinFile: tourOrch.pinFile,
+        modifyCropSettings: tourOrch.modifyCropSettings,
+        executeTool: tourOrch.executeTool,
+        openFilesModal,
+      },
+    }),
+    [t, tourOrch, closeFilesModal, openFilesModal]
+  );
+
+  const adminStepsConfig = useMemo(
+    () => createAdminStepsConfig({
+      t,
+      actions: {
+        saveAdminState: adminTourOrch.saveAdminState,
+        openConfigModal: adminTourOrch.openConfigModal,
+        navigateToSection: adminTourOrch.navigateToSection,
+        scrollNavToSection: adminTourOrch.scrollNavToSection,
+      },
+    }),
+    [t, adminTourOrch]
+  );
+
+  const tourSteps = useMemo<StepType[]>(() => {
+    const config = runtimeState.tourType === 'admin' ? adminStepsConfig : userStepsConfig;
+    return Object.values(config);
+  }, [adminStepsConfig, runtimeState.tourType, userStepsConfig]);
+
+  useEffect(() => {
+    if (currentStep?.id === 'tour' && !isTourOpen) {
+      markStepSeen('tour');
+      setIsTourOpen(true);
+    }
+  }, [currentStep, isTourOpen, activeFlow]);
+
+  useEffect(() => {
+    if (externalTourRequested) {
+      actions.updateRuntimeState({ tourRequested: true, tourType: requestedTourType });
+      markStepSeen('tour');
+      setIsTourOpen(true);
+      clearTourRequest();
+    }
+  }, [externalTourRequested, requestedTourType, actions, clearTourRequest]);
+
+  useEffect(() => {
+    if (!isTourOpen) removeAllGlows();
+    return () => removeAllGlows();
+  }, [isTourOpen]);
+
+  const finishTour = useCallback(() => {
+    setIsTourOpen(false);
+    if (runtimeState.tourType === 'admin') {
+      adminTourOrch.restoreAdminState();
+    } else {
+      tourOrch.restoreWorkbenchState();
+    }
+    markStepSeen('tour');
+    if (currentStep?.id === 'tour') actions.complete();
+  }, [actions, adminTourOrch, currentStep?.id, runtimeState.tourType, tourOrch]);
+
+  const handleAdvanceTour = useCallback((args: AdvanceArgs) => {
+    const { setCurrentStep, currentStep: tourCurrentStep, steps, setIsOpen } = args;
+    if (steps && tourCurrentStep === steps.length - 1) {
+      setIsOpen(false);
+      finishTour();
+    } else if (steps) {
+      setCurrentStep((s) => (s === steps.length - 1 ? 0 : s + 1));
+    }
+  }, [finishTour]);
+
+  const handleCloseTour = useCallback((args: CloseArgs) => {
+    args.setIsOpen(false);
+    finishTour();
+  }, [finishTour]);
+
+  const currentSlideDefinition = useMemo(() => {
+    if (!currentStep || currentStep.type !== 'modal-slide' || !currentStep.slideId) {
+      return null;
+    }
+    return SLIDE_DEFINITIONS[currentStep.slideId as SlideId];
+  }, [currentStep]);
+
+  const currentSlideContent = useMemo(() => {
+    if (!currentSlideDefinition) return null;
+    return currentSlideDefinition.createSlide({
+      osLabel: osInfo.label,
+      osUrl: osInfo.url,
+      osOptions,
+      onDownloadUrlChange: setSelectedDownloadUrl,
+      selectedRole: runtimeState.selectedRole,
+      onRoleSelect: handleRoleSelect,
+      licenseNotice: runtimeState.licenseNotice,
+      loginEnabled: serverExperience.loginEnabled,
+      firstLoginUsername: runtimeState.firstLoginUsername,
+      onPasswordChanged: handlePasswordChanged,
+      usingDefaultCredentials: runtimeState.usingDefaultCredentials,
+    });
+  }, [currentSlideDefinition, osInfo, osOptions, runtimeState.selectedRole, runtimeState.licenseNotice, handleRoleSelect, serverExperience.loginEnabled, setSelectedDownloadUrl, runtimeState.firstLoginUsername, handlePasswordChanged]);
+
+  const modalSlideCount = useMemo(() => {
+    return activeFlow.filter((step) => step.type === 'modal-slide').length;
+  }, [activeFlow]);
+
+  const currentModalSlideIndex = useMemo(() => {
+    if (!currentStep || currentStep.type !== 'modal-slide') return 0;
+    const modalSlides = activeFlow.filter((step) => step.type === 'modal-slide');
+    return modalSlides.findIndex((step) => step.id === currentStep.id);
+  }, [activeFlow, currentStep]);
+
+  if (onAuthRoute) {
+    return null;
+  }
+
+  if (showLicenseSlide) {
+    const slideDefinition = SLIDE_DEFINITIONS['server-license'];
+    const effectiveLicenseNotice = externalLicenseNotice || runtimeState.licenseNotice;
+    const slideContent = slideDefinition.createSlide({
+      osLabel: '',
+      osUrl: '',
+      osOptions: [],
+      onDownloadUrlChange: () => {},
+      selectedRole: null,
+      onRoleSelect: () => {},
+      licenseNotice: effectiveLicenseNotice,
+      loginEnabled: serverExperience.loginEnabled,
+    });
+    
+    return (
+      <OnboardingModalSlide
+        slideDefinition={slideDefinition}
+        slideContent={slideContent}
+        runtimeState={{ ...runtimeState, licenseNotice: effectiveLicenseNotice }}
+        modalSlideCount={1}
+        currentModalSlideIndex={0}
+        onSkip={closeLicenseSlide}
+        onAction={(action) => {
+          if (action === 'see-plans') {
+            closeLicenseSlide();
+            navigate('/settings/adminPlan');
+          } else {
+            closeLicenseSlide();
+          }
+        }}
+      />
+    );
+  }
+
+  if (isLoading || !isActive || !currentStep) {
+    return (
+      <OnboardingTour
+        isOpen={isTourOpen}
+        tourSteps={tourSteps}
+        tourType={runtimeState.tourType}
+        isRTL={isRTL}
+        t={t}
+        onAdvance={handleAdvanceTour}
+        onClose={handleCloseTour}
+      />
+    );
+  }
+
+  switch (currentStep.type) {
+    case 'tool-prompt':
+      return <ToolPanelModePrompt forceOpen={true} onComplete={actions.complete} />;
+
+    case 'tour':
+      return (
+        <OnboardingTour
+          isOpen={true}
+          tourSteps={tourSteps}
+          tourType={runtimeState.tourType}
+          isRTL={isRTL}
+          t={t}
+          onAdvance={handleAdvanceTour}
+          onClose={handleCloseTour}
+        />
+      );
+
+    case 'analytics-modal':
+      return <AdminAnalyticsChoiceModal opened={true} onClose={actions.complete} />;
+
+    case 'modal-slide':
+      if (!currentSlideDefinition || !currentSlideContent) return null;
+      return (
+        <OnboardingModalSlide
+          slideDefinition={currentSlideDefinition}
+          slideContent={currentSlideContent}
+          runtimeState={runtimeState}
+          modalSlideCount={modalSlideCount}
+          currentModalSlideIndex={currentModalSlideIndex}
+          onSkip={actions.skip}
+          onAction={handleButtonAction}
+        />
+      );
+
+    default:
+      return null;
+  }
+}

frontend/src/core/components/onboarding/OnboardingModalSlide.tsx

@@ -1,33 +1,44 @@
+/**
+ * OnboardingModalSlide Component
+ * 
+ * Renders a single modal slide in the onboarding flow.
+ * Handles the hero image, content, stepper, and button actions.
+ */
+
 import React from 'react';
 import { Modal, Stack } from '@mantine/core';
 import DiamondOutlinedIcon from '@mui/icons-material/DiamondOutlined';
-import LocalIcon from '@app/components/shared/LocalIcon';
+
+import type { SlideDefinition, ButtonAction } from '@app/components/onboarding/onboardingFlowConfig';
+import type { OnboardingRuntimeState } from '@app/components/onboarding/orchestrator/onboardingConfig';
+import type { SlideConfig } from '@app/types/types';
 import AnimatedSlideBackground from '@app/components/onboarding/slides/AnimatedSlideBackground';
 import OnboardingStepper from '@app/components/onboarding/OnboardingStepper';
-import { renderButtons } from '@app/components/onboarding/InitialOnboardingModal/renderButtons';
-import styles from '@app/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css';
-import type { InitialOnboardingModalProps } from '@app/components/onboarding/InitialOnboardingModal/types';
-import { useInitialOnboardingState } from '@app/components/onboarding/InitialOnboardingModal/useInitialOnboardingState';
+import { SlideButtons } from '@app/components/onboarding/InitialOnboardingModal/renderButtons';
+import LocalIcon from '@app/components/shared/LocalIcon';
 import { BASE_PATH } from '@app/constants/app';
 import { Z_INDEX_OVER_FULLSCREEN_SURFACE } from '@app/styles/zIndex';
+import styles from '@app/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css';
 
-export default function InitialOnboardingModal(props: InitialOnboardingModalProps) {
-  const flow = useInitialOnboardingState(props);
+interface OnboardingModalSlideProps {
+  slideDefinition: SlideDefinition;
+  slideContent: SlideConfig;
+  runtimeState: OnboardingRuntimeState;
+  modalSlideCount: number;
+  currentModalSlideIndex: number;
+  onSkip: () => void;
+  onAction: (action: ButtonAction) => void;
+}
 
-  if (!flow) {
-    return null;
-  }
-
-  const {
-    state,
-    totalSteps,
-    currentSlide,
-    slideDefinition,
-    licenseNotice,
-    flowState,
-    closeAndMarkSeen,
-    handleButtonAction,
-  } = flow;
+export default function OnboardingModalSlide({
+  slideDefinition,
+  slideContent,
+  runtimeState,
+  modalSlideCount,
+  currentModalSlideIndex,
+  onSkip,
+  onAction,
+}: OnboardingModalSlideProps) {
 
   const renderHero = () => {
     if (slideDefinition.hero.type === 'dual-icon') {
@@ -48,6 +59,9 @@ export default function InitialOnboardingModal(props: InitialOnboardingModalProp
         {slideDefinition.hero.type === 'shield' && (
           <LocalIcon icon="verified-user-outline" width={64} height={64} className={styles.heroIcon} />
         )}
+        {slideDefinition.hero.type === 'lock' && (
+          <LocalIcon icon="lock-outline" width={64} height={64} className={styles.heroIcon} />
+        )}
         {slideDefinition.hero.type === 'diamond' && <DiamondOutlinedIcon sx={{ fontSize: 64, color: '#000000' }} />}
         {slideDefinition.hero.type === 'logo' && (
           <img src={`${BASE_PATH}/branding/StirlingPDFLogoNoTextLightHC.svg`} alt="Stirling logo" />
@@ -58,8 +72,8 @@ export default function InitialOnboardingModal(props: InitialOnboardingModalProp
 
   return (
     <Modal
-      opened={props.opened}
-      onClose={closeAndMarkSeen}
+      opened={true}
+      onClose={onSkip}
       closeOnClickOutside={false}
       centered
       size="lg"
@@ -67,48 +81,48 @@ export default function InitialOnboardingModal(props: InitialOnboardingModalProp
       withCloseButton={false}
       zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
       styles={{
-        body: { padding: 0 },
-        content: { overflow: 'hidden', border: 'none', background: 'var(--bg-surface)' },
+        body: { padding: 0, maxHeight: '90vh', overflow: 'hidden' },
+        content: { overflow: 'hidden', border: 'none', background: 'var(--bg-surface)', maxHeight: '90vh' },
       }}
     >
       <Stack gap={0} className={styles.modalContent}>
         <div className={styles.heroWrapper}>
           <AnimatedSlideBackground
-            gradientStops={currentSlide.background.gradientStops}
-            circles={currentSlide.background.circles}
+            gradientStops={slideContent.background.gradientStops}
+            circles={slideContent.background.circles}
             isActive
-            slideKey={currentSlide.key}
+            slideKey={slideContent.key}
           />
-          <div className={styles.heroLogo} key={`logo-${currentSlide.key}`}>
+          <div className={styles.heroLogo} key={`logo-${slideContent.key}`}>
             {renderHero()}
           </div>
         </div>
 
-        <div className={styles.modalBody}>
+        <div className={styles.modalBody} style={{ overflowY: 'auto', maxHeight: 'calc(90vh - 220px)' }}>
           <Stack gap={16}>
             <div
-              key={`title-${currentSlide.key}`}
+              key={`title-${slideContent.key}`}
               className={`${styles.title} ${styles.titleText}`}
             >
-              {currentSlide.title}
+              {slideContent.title}
             </div>
 
             <div className={styles.bodyText}>
-              <div key={`body-${currentSlide.key}`} className={`${styles.bodyCopy} ${styles.bodyCopyInner}`}>
-                {currentSlide.body}
+              <div key={`body-${slideContent.key}`} className={`${styles.bodyCopy} ${styles.bodyCopyInner}`}>
+                {slideContent.body}
               </div>
               <style>{`div strong{color: var(--onboarding-title); font-weight: 600;}`}</style>
             </div>
 
-            <OnboardingStepper totalSteps={totalSteps} activeStep={state.step} />
+            <OnboardingStepper totalSteps={modalSlideCount} activeStep={currentModalSlideIndex} />
 
             <div className={styles.buttonContainer}>
-              {renderButtons({
-                slideDefinition,
-                licenseNotice,
-                flowState,
-                onAction: handleButtonAction,
-              })}
+              <SlideButtons
+                slideDefinition={slideDefinition}
+                licenseNotice={runtimeState.licenseNotice}
+                flowState={{ selectedRole: runtimeState.selectedRole }}
+                onAction={onAction}
+              />
             </div>
           </Stack>
         </div>

frontend/src/core/components/onboarding/OnboardingTour.tsx

@@ -1,231 +1,151 @@
-import React, { useEffect, useMemo } from "react";
-import { TourProvider, type StepType } from '@reactour/tour';
-import { useTranslation } from 'react-i18next';
+/**
+ * OnboardingTour Component
+ * 
+ * Reusable tour wrapper that encapsulates all Reactour configuration.
+ * Used by the main Onboarding component for both the 'tour' step and
+ * when the tour is open but onboarding is inactive.
+ */
+
+import React from 'react';
+import { TourProvider, useTour, type StepType } from '@reactour/tour';
 import { CloseButton, ActionIcon } from '@mantine/core';
 import ArrowForwardIcon from '@mui/icons-material/ArrowForward';
-import CheckIcon from '@mui/icons-material/Check';
-import InitialOnboardingModal from '@app/components/onboarding/InitialOnboardingModal';
-import ServerLicenseModal from '@app/components/onboarding/ServerLicenseModal';
-import '@app/components/onboarding/OnboardingTour.css';
-import ToolPanelModePrompt from '@app/components/tools/ToolPanelModePrompt';
-import { useFilesModalContext } from '@app/contexts/FilesModalContext';
-import { useTourOrchestration } from '@app/contexts/TourOrchestrationContext';
-import { useAdminTourOrchestration } from '@app/contexts/AdminTourOrchestrationContext';
-import { useOnboardingFlow } from '@app/components/onboarding/hooks/useOnboardingFlow';
-import { createUserStepsConfig } from '@app/components/onboarding/userStepsConfig';
-import { createAdminStepsConfig } from '@app/components/onboarding/adminStepsConfig';
-import { removeAllGlows } from '@app/components/onboarding/tourGlow';
-import TourContent from '@app/components/onboarding/TourContent';
 import ArrowBackIcon from '@mui/icons-material/ArrowBack';
-import '@app/components/onboarding/OnboardingTour.css';
-import i18n from "@app/i18n";
+import CheckIcon from '@mui/icons-material/Check';
+import type { TFunction } from 'i18next';
+import i18n from '@app/i18n';
 
-export default function OnboardingTour() {
-  const { t } = useTranslation();
-  const flow = useOnboardingFlow();
-  const { openFilesModal, closeFilesModal } = useFilesModalContext();
-  const {
-    saveWorkbenchState,
-    restoreWorkbenchState,
-    backToAllTools,
-    selectCropTool,
-    loadSampleFile,
-    switchToViewer,
-    switchToPageEditor,
-    switchToActiveFiles,
-    selectFirstFile,
-    pinFile,
-    modifyCropSettings,
-    executeTool,
-  } = useTourOrchestration();
-  const {
-    saveAdminState,
-    restoreAdminState,
-    openConfigModal,
-    navigateToSection,
-    scrollNavToSection,
-  } = useAdminTourOrchestration();
+/**
+ * TourContent - Controls the tour visibility
+ * Syncs the forceOpen prop with the reactour tour state.
+ */
+function TourContent({ forceOpen = false }: { forceOpen?: boolean }) {
+  const { setIsOpen, setCurrentStep } = useTour();
+  const previousIsOpenRef = React.useRef(forceOpen);
 
-  const isRTL = typeof document !== 'undefined' ? document.documentElement.dir === 'rtl' : false;
+  React.useEffect(() => {
+    const wasClosedNowOpen = !previousIsOpenRef.current && forceOpen;
+    previousIsOpenRef.current = forceOpen;
 
-  useEffect(() => {
-    if (!flow.isTourOpen) {
-      removeAllGlows();
+    if (wasClosedNowOpen) {
+      setCurrentStep(0);
     }
-    return () => removeAllGlows();
-  }, [flow.isTourOpen]);
+    setIsOpen(forceOpen);
+  }, [forceOpen, setIsOpen, setCurrentStep]);
 
-  const userStepsConfig = useMemo(
-    () =>
-      createUserStepsConfig({
-        t,
-        actions: {
-          saveWorkbenchState,
-          closeFilesModal,
-          backToAllTools,
-          selectCropTool,
-          loadSampleFile,
-          switchToViewer,
-          switchToPageEditor,
-          switchToActiveFiles,
-          selectFirstFile,
-          pinFile,
-          modifyCropSettings,
-          executeTool,
-          openFilesModal,
-        },
-      }),
-    [
-      t,
-      backToAllTools,
-      closeFilesModal,
-      executeTool,
-      loadSampleFile,
-      modifyCropSettings,
-      openFilesModal,
-      pinFile,
-      saveWorkbenchState,
-      selectCropTool,
-      selectFirstFile,
-      switchToActiveFiles,
-      switchToPageEditor,
-      switchToViewer,
-    ],
-  );
+  return null;
+}
 
-  const adminStepsConfig = useMemo(
-    () =>
-      createAdminStepsConfig({
-        t,
-        actions: {
-          saveAdminState,
-          openConfigModal,
-          navigateToSection,
-          scrollNavToSection,
-        },
-      }),
-    [navigateToSection, openConfigModal, saveAdminState, scrollNavToSection, t],
-  );
+interface AdvanceArgs {
+  setCurrentStep: (value: number | ((prev: number) => number)) => void;
+  currentStep: number;
+  steps?: StepType[];
+  setIsOpen: (value: boolean) => void;
+}
 
-  const steps = useMemo<StepType[]>(() => {
-    const config = flow.tourType === 'admin' ? adminStepsConfig : userStepsConfig;
-    return Object.values(config);
-  }, [adminStepsConfig, flow.tourType, userStepsConfig]);
+interface CloseArgs {
+  setIsOpen: (value: boolean) => void;
+}
 
-  const advanceTour = ({
-    setCurrentStep,
-    currentStep,
-    steps,
-    setIsOpen,
-  }: {
-    setCurrentStep: (value: number | ((prev: number) => number)) => void;
-    currentStep: number;
-    steps?: StepType[];
-    setIsOpen: (value: boolean) => void;
-  }) => {
-    if (steps && currentStep === steps.length - 1) {
-      setIsOpen(false);
-      if (flow.tourType === 'admin') {
-        restoreAdminState();
-      } else {
-        restoreWorkbenchState();
-      }
-      flow.handleTourCompletion();
-    } else if (steps) {
-      setCurrentStep((s) => (s === steps.length - 1 ? 0 : s + 1));
-    }
-  };
+interface OnboardingTourProps {
+  tourSteps: StepType[];
+  tourType: 'admin' | 'tools';
+  isRTL: boolean;
+  t: TFunction;
+  isOpen: boolean;
+  onAdvance: (args: AdvanceArgs) => void;
+  onClose: (args: CloseArgs) => void;
+}
 
-  const handleCloseTour = ({ setIsOpen }: { setIsOpen: (value: boolean) => void }) => {
-    setIsOpen(false);
-    if (flow.tourType === 'admin') {
-      restoreAdminState();
-    } else {
-      restoreWorkbenchState();
-    }
-    flow.handleTourCompletion();
-  };
+export default function OnboardingTour({
+  tourSteps,
+  tourType,
+  isRTL,
+  t,
+  isOpen,
+  onAdvance,
+  onClose,
+}: OnboardingTourProps) {
+  if (!isOpen) return null;
 
   return (
-    <>
-      <InitialOnboardingModal {...flow.initialModalProps} />
-      <ToolPanelModePrompt onComplete={flow.handleToolPromptComplete} />
-      <TourProvider
-        key={`${flow.tourType}-${i18n.language}`}
-        steps={steps}
-        maskClassName={flow.maskClassName}
-        onClickClose={handleCloseTour}
-        onClickMask={advanceTour}
-        onClickHighlighted={(e, clickProps) => {
-          e.stopPropagation();
-          advanceTour(clickProps);
-        }}
-        keyboardHandler={(e, clickProps, status) => {
-          if (e.key === 'ArrowRight' && !status?.isRightDisabled && clickProps) {
-            e.preventDefault();
-            advanceTour(clickProps);
-          } else if (e.key === 'Escape' && !status?.isEscDisabled && clickProps) {
-            e.preventDefault();
-            handleCloseTour(clickProps);
-          }
-        }}
-        rtl={isRTL}
-        styles={{
-          popover: (base) => ({
-            ...base,
-            backgroundColor: 'var(--mantine-color-body)',
-            color: 'var(--mantine-color-text)',
-            borderRadius: '8px',
-            padding: '20px',
-            boxShadow: '0 4px 12px rgba(0, 0, 0, 0.15)',
-            maxWidth: '400px',
-          }),
-          maskArea: (base) => ({
-            ...base,
-            rx: 8,
-          }),
-          badge: (base) => ({
-            ...base,
-            backgroundColor: 'var(--mantine-primary-color-filled)',
-          }),
-          controls: (base) => ({
-            ...base,
-            justifyContent: 'center',
-          }),
-        }}
-        highlightedMaskClassName="tour-highlight-glow"
-        showNavigation={true}
-        showBadge={false}
-        showCloseButton={true}
-        disableInteraction={true}
-        disableDotsNavigation={false}
-        prevButton={() => null}
-        nextButton={({ currentStep, stepsLength, setCurrentStep, setIsOpen }) => {
-          const isLast = currentStep === stepsLength - 1;
-          const ArrowIcon = isRTL ? ArrowBackIcon : ArrowForwardIcon;
-          return (
-            <ActionIcon
-              onClick={() => advanceTour({ setCurrentStep, currentStep, steps, setIsOpen })}
-              variant="subtle"
-              size="lg"
-              aria-label={isLast ? t('onboarding.finish', 'Finish') : t('onboarding.next', 'Next')}
-            >
-              {isLast ? <CheckIcon /> : <ArrowIcon />}
-            </ActionIcon>
-          );
-        }}
-        components={{
-          Close: ({ onClick }) => (
-            <CloseButton onClick={onClick} size="md" style={{ position: 'absolute', top: '8px', right: '8px' }} />
-          ),
-          Content: ({ content }: { content: string }) => (
-            <div style={{ paddingRight: '16px' }} dangerouslySetInnerHTML={{ __html: content }} />
-          ),
-        }}
-      >
-        <TourContent />
-      </TourProvider>
-      <ServerLicenseModal {...flow.serverLicenseModalProps} />
-    </>
+    <TourProvider
+      key={`${tourType}-${i18n.language}`}
+      steps={tourSteps}
+      maskClassName={tourType === 'admin' ? 'admin-tour-mask' : undefined}
+      onClickClose={onClose}
+      onClickMask={onAdvance}
+      onClickHighlighted={(e, clickProps) => {
+        e.stopPropagation();
+        onAdvance(clickProps);
+      }}
+      keyboardHandler={(e, clickProps, status) => {
+        if (e.key === 'ArrowRight' && !status?.isRightDisabled && clickProps) {
+          e.preventDefault();
+          onAdvance(clickProps);
+        } else if (e.key === 'Escape' && !status?.isEscDisabled && clickProps) {
+          e.preventDefault();
+          onClose(clickProps);
+        }
+      }}
+      rtl={isRTL}
+      styles={{
+        popover: (base) => ({
+          ...base,
+          backgroundColor: 'var(--mantine-color-body)',
+          color: 'var(--mantine-color-text)',
+          borderRadius: '8px',
+          padding: '20px',
+          boxShadow: '0 4px 12px rgba(0, 0, 0, 0.15)',
+          maxWidth: '400px',
+        }),
+        maskArea: (base) => ({
+          ...base,
+          rx: 8,
+        }),
+        badge: (base) => ({
+          ...base,
+          backgroundColor: 'var(--mantine-primary-color-filled)',
+        }),
+        controls: (base) => ({
+          ...base,
+          justifyContent: 'center',
+        }),
+      }}
+      highlightedMaskClassName="tour-highlight-glow"
+      showNavigation={true}
+      showBadge={false}
+      showCloseButton={true}
+      disableInteraction={true}
+      disableDotsNavigation={false}
+      prevButton={() => null}
+      nextButton={({ currentStep: tourCurrentStep, stepsLength, setCurrentStep, setIsOpen }) => {
+        const isLast = tourCurrentStep === stepsLength - 1;
+        const ArrowIcon = isRTL ? ArrowBackIcon : ArrowForwardIcon;
+        return (
+          <ActionIcon
+            onClick={() => onAdvance({ setCurrentStep, currentStep: tourCurrentStep, steps: tourSteps, setIsOpen })}
+            variant="subtle"
+            size="lg"
+            aria-label={isLast ? t('onboarding.finish', 'Finish') : t('onboarding.next', 'Next')}
+          >
+            {isLast ? <CheckIcon /> : <ArrowIcon />}
+          </ActionIcon>
+        );
+      }}
+      components={{
+        Close: ({ onClick }) => (
+          <CloseButton onClick={onClick} size="md" style={{ position: 'absolute', top: '8px', right: '8px' }} />
+        ),
+        Content: ({ content }: { content: string }) => (
+          <div style={{ paddingRight: '16px' }} dangerouslySetInnerHTML={{ __html: content }} />
+        ),
+      }}
+    >
+      <TourContent forceOpen={true} />
+    </TourProvider>
   );
 }
+
+export type { AdvanceArgs, CloseArgs };
+

frontend/src/core/components/onboarding/ServerLicenseModal.tsx

@@ -1,120 +0,0 @@
-import React from 'react';
-import { Modal, Button, Group, Stack } from '@mantine/core';
-import { useTranslation } from 'react-i18next';
-import AnimatedSlideBackground from '@app/components/onboarding/slides/AnimatedSlideBackground';
-import ServerLicenseSlide from '@app/components/onboarding/slides/ServerLicenseSlide';
-import { LicenseNotice } from '@app/types/types';
-import { Z_INDEX_OVER_FULLSCREEN_SURFACE } from '@app/styles/zIndex';
-import { BASE_PATH } from '@app/constants/app';
-import styles from '@app/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css';
-
-interface ServerLicenseModalProps {
-  opened: boolean;
-  onClose: () => void;
-  onSeePlans?: () => void;
-  licenseNotice: LicenseNotice;
-}
-
-export default function ServerLicenseModal({
-  opened,
-  onClose,
-  onSeePlans,
-  licenseNotice,
-}: ServerLicenseModalProps) {
-  const { t } = useTranslation();
-  const slide = React.useMemo(() => ServerLicenseSlide({ licenseNotice }), [licenseNotice]);
-  const primaryLabel = licenseNotice.isOverLimit
-    ? t('onboarding.serverLicense.upgrade', 'Upgrade now →')
-    : t('onboarding.serverLicense.seePlans', 'See Plans →');
-  const secondaryLabel = t('onboarding.serverLicense.skip', 'Skip for now');
-
-  const handleSeePlans = () => {
-    onSeePlans?.();
-    onClose();
-  };
-
-  const secondaryStyles = {
-    root: {
-      background: 'var(--onboarding-secondary-button-bg)',
-      border: '1px solid var(--onboarding-secondary-button-border)',
-      color: 'var(--onboarding-secondary-button-text)',
-    },
-  };
-
-  const primaryStyles = {
-    root: {
-      background: 'var(--onboarding-primary-button-bg)',
-      color: 'var(--onboarding-primary-button-text)',
-    },
-  };
-
-  return (
-    <Modal
-      opened={opened}
-      onClose={onClose}
-      centered
-      size="lg"
-      radius="lg"
-      withCloseButton={false}
-      zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
-      styles={{
-        body: { padding: 0 },
-        content: { overflow: 'hidden', border: 'none', background: 'var(--bg-surface)' },
-      }}
-    >
-      <Stack gap={0}>
-        <div className={styles.heroWrapper}>
-          <AnimatedSlideBackground
-            gradientStops={slide.background.gradientStops}
-            circles={slide.background.circles}
-            isActive
-            slideKey={slide.key}
-          />
-          <div className={styles.heroLogo}>
-            <div className={styles.heroIconsContainer}>
-              <div className={styles.iconWrapper}>
-                <img src={`${BASE_PATH}/modern-logo/logo512.png`} alt="Stirling icon" className={styles.downloadIcon} />
-              </div>
-            </div>
-          </div>
-        </div>
-
-        <div style={{ padding: 24 }}>
-          <Stack gap={16}>
-            <div
-              className={styles.title}
-              style={{
-                fontFamily: 'Inter, system-ui, -apple-system, Segoe UI, Roboto, Arial, sans-serif',
-                fontWeight: 600,
-                fontSize: 22,
-                color: 'var(--onboarding-title)',
-              }}
-            >
-              {slide.title}
-            </div>
-            <div
-              className={styles.bodyCopy}
-              style={{
-                fontFamily: 'Inter, system-ui, -apple-system, Segoe UI, Roboto, Arial, sans-serif',
-                fontSize: 16,
-                color: 'var(--onboarding-body)',
-                lineHeight: 1.5,
-              }}
-            >
-              {slide.body}
-            </div>
-            <Group justify="space-between">
-              <Button styles={secondaryStyles} onClick={onClose}>
-                {secondaryLabel}
-              </Button>
-              <Button styles={primaryStyles} onClick={handleSeePlans}>
-                {primaryLabel}
-              </Button>
-            </Group>
-          </Stack>
-        </div>
-      </Stack>
-    </Modal>
-  );
-}
-

frontend/src/core/components/onboarding/TourContent.tsx

@@ -1,22 +0,0 @@
-import React from 'react';
-import { useTour } from '@reactour/tour';
-import { useOnboarding } from '@app/contexts/OnboardingContext';
-
-export default function TourContent() {
-  const { isOpen } = useOnboarding();
-  const { setIsOpen, setCurrentStep } = useTour();
-  const previousIsOpenRef = React.useRef(isOpen);
-
-  React.useEffect(() => {
-    const wasClosedNowOpen = !previousIsOpenRef.current && isOpen;
-    previousIsOpenRef.current = isOpen;
-
-    if (wasClosedNowOpen) {
-      setCurrentStep(0);
-    }
-    setIsOpen(isOpen);
-  }, [isOpen, setIsOpen, setCurrentStep]);
-
-  return null;
-}
-

frontend/src/core/components/onboarding/TourWelcomeModal.tsx

@@ -1,82 +0,0 @@
-import { Modal, Title, Text, Button, Stack, Group } from '@mantine/core';
-import { useTranslation } from 'react-i18next';
-import { Z_INDEX_OVER_FULLSCREEN_SURFACE } from '@app/styles/zIndex';
-
-interface TourWelcomeModalProps {
-  opened: boolean;
-  onStartTour: () => void;
-  onMaybeLater: () => void;
-  onDontShowAgain: () => void;
-}
-
-export default function TourWelcomeModal({
-  opened,
-  onStartTour,
-  onMaybeLater,
-  onDontShowAgain,
-}: TourWelcomeModalProps) {
-  const { t } = useTranslation();
-
-  return (
-    <Modal
-      opened={opened}
-      onClose={onMaybeLater}
-      centered
-      size="md"
-      radius="lg"
-      withCloseButton={false}
-      zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
-    >
-      <Stack gap="lg">
-        <Stack gap="xs">
-          <Title order={2}>
-            {t('onboarding.welcomeModal.title', 'Welcome to Stirling PDF!')}
-          </Title>
-          <Text size="md" c="dimmed">
-            {t('onboarding.welcomeModal.description',
-              "Would you like to take a quick 1-minute tour to learn the key features and how to get started?"
-            )}
-          </Text>
-          <Text
-            size="md"
-            c="dimmed"
-            dangerouslySetInnerHTML={{
-              __html: t('onboarding.welcomeModal.helpHint',
-                'You can always access this tour later from the <strong>Help</strong> button in the bottom left.'
-              )
-            }}
-          />
-        </Stack>
-
-        <Stack gap="sm">
-          <Button
-            onClick={onStartTour}
-            size="md"
-            variant="filled"
-            fullWidth
-          >
-            {t('onboarding.welcomeModal.startTour', 'Start Tour')}
-          </Button>
-
-          <Group grow>
-            <Button
-              onClick={onMaybeLater}
-              size="md"
-              variant="light"
-            >
-              {t('onboarding.welcomeModal.maybeLater', 'Maybe Later')}
-            </Button>
-
-            <Button
-              onClick={onDontShowAgain}
-              size="md"
-              variant="light"
-            >
-              {t('onboarding.welcomeModal.dontShowAgain', "Don't Show Again")}
-            </Button>
-          </Group>
-        </Stack>
-      </Stack>
-    </Modal>
-  );
-}

frontend/src/core/components/onboarding/adminStepsConfig.ts

@@ -1,8 +1,19 @@
 import type { StepType } from '@reactour/tour';
 import type { TFunction } from 'i18next';
-import { AdminTourStep } from '@app/components/onboarding/tourSteps';
 import { addGlowToElements, removeAllGlows } from '@app/components/onboarding/tourGlow';
 
+export enum AdminTourStep {
+  WELCOME,
+  CONFIG_BUTTON,
+  SETTINGS_OVERVIEW,
+  TEAMS_AND_USERS,
+  SYSTEM_CUSTOMIZATION,
+  DATABASE_SECTION,
+  CONNECTIONS_SECTION,
+  ADMIN_TOOLS,
+  WRAP_UP,
+}
+
 interface AdminStepActions {  
   saveAdminState: () => void;
   openConfigModal: () => void;

frontend/src/core/components/onboarding/hooks/useOnboardingFlow.ts

@@ -1,304 +0,0 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { usePreferences } from '@app/contexts/PreferencesContext';
-import { useAppConfig } from '@app/contexts/AppConfigContext';
-import { useOnboarding } from '@app/contexts/OnboardingContext';
-import type { LicenseNotice } from '@app/types/types';
-import { useNavigate, useLocation } from 'react-router-dom';
-import {
-  ONBOARDING_SESSION_BLOCK_KEY,
-  ONBOARDING_SESSION_EVENT,
-  SERVER_LICENSE_REQUEST_EVENT,
-  type ServerLicenseRequestPayload,
-} from '@app/constants/events';
-import { useServerExperience } from '@app/hooks/useServerExperience';
-
-// Auth routes where onboarding should NOT show
-const AUTH_ROUTES = ['/login', '/signup', '/auth', '/invite'];
-
-// Check if user has an auth token (to avoid flash before redirect)
-function hasAuthToken(): boolean {
-  if (typeof window === 'undefined') return false;
-  return !!localStorage.getItem('stirling_jwt');
-}
-
-interface InitialModalHandlers {
-  opened: boolean;
-  onLicenseNoticeUpdate: (notice: LicenseNotice) => void;
-  onRequestServerLicense: (options?: { deferUntilTourComplete?: boolean; selfReportedAdmin?: boolean }) => void;
-  onClose: () => void;
-}
-
-interface ServerLicenseModalHandlers {
-  opened: boolean;
-  licenseNotice: LicenseNotice;
-  onClose: () => void;
-  onSeePlans: () => void;
-}
-
-export function useOnboardingFlow() {
-  const { preferences, updatePreference } = usePreferences();
-  const { config, loading: configLoading } = useAppConfig();
-  const { completeTour, tourType, isOpen } = useOnboarding();
-  const location = useLocation();
-  
-  // Check if we're on an auth route (login, signup, etc.)
-  const isOnAuthRoute = AUTH_ROUTES.some(route => location.pathname.startsWith(route));
-  
-  // Check if login is enabled but user doesn't have a token
-  // This prevents a flash of the modal before redirect to /login
-  const loginEnabled = config?.enableLogin === true;
-  const isUnauthenticatedWithLoginEnabled = loginEnabled && !hasAuthToken();
-  
-  // Don't show intro onboarding:
-  // 1. On explicit auth routes (/login, /signup, etc.)
-  // 2. While config is still loading
-  // 3. When login is enabled but user isn't authenticated (would redirect to /login)
-  // This ensures:
-  // - If login is enabled: user must be logged in before seeing onboarding
-  // - If login is disabled: homepage must have rendered first
-  const shouldShowIntro = !preferences.hasSeenIntroOnboarding 
-    && !isOnAuthRoute 
-    && !configLoading
-    && !isUnauthenticatedWithLoginEnabled;
-  const isAdminUser = !!config?.isAdmin;
-  const { hasPaidLicense } = useServerExperience();
-
-  const [licenseNotice, setLicenseNotice] = useState<LicenseNotice>({
-    totalUsers: null,
-    freeTierLimit: 5,
-    isOverLimit: false,
-    requiresLicense: false,
-  });
-  const [serverLicenseIntent, setServerLicenseIntent] = useState<'idle' | 'pending' | 'deferred'>('idle');
-  const [serverLicenseSource, setServerLicenseSource] = useState<'config' | 'self-reported' | null>(null);
-  const [isServerLicenseOpen, setIsServerLicenseOpen] = useState(false);
-  const [hasShownServerLicense, setHasShownServerLicense] = useState(false);
-  const [toolPromptCompleted, setToolPromptCompleted] = useState(
-    preferences.toolPanelModePromptSeen || preferences.hasSelectedToolPanelMode,
-  );
-  const introWasOpenRef = useRef(false);
-  const navigate = useNavigate();
-  const onboardingSessionMarkedRef = useRef(false);
-
-  const handleInitialModalClose = useCallback(() => {
-    if (!preferences.hasSeenIntroOnboarding) {
-      updatePreference('hasSeenIntroOnboarding', true);
-    }
-  }, [preferences.hasSeenIntroOnboarding, updatePreference]);
-
-  const handleLicenseNoticeUpdate = useCallback((notice: LicenseNotice) => {
-    setLicenseNotice(notice);
-  }, []);
-
-  const handleToolPromptComplete = useCallback(() => {
-    setToolPromptCompleted(true);
-  }, []);
-
-  const requestServerLicense = useCallback(
-    ({
-      deferUntilTourComplete = false,
-      selfReportedAdmin = false,
-    }: { deferUntilTourComplete?: boolean; selfReportedAdmin?: boolean } = {}) => {
-      const qualifies = isAdminUser || selfReportedAdmin;
-      if (!qualifies) {
-        return;
-      }
-      if (hasPaidLicense || !licenseNotice.requiresLicense) {
-        return;
-      }
-      setServerLicenseSource(isAdminUser ? 'config' : 'self-reported');
-      setServerLicenseIntent((prev) => {
-        if (prev === 'pending') {
-          return prev;
-        }
-        if (prev === 'deferred') {
-          return deferUntilTourComplete ? prev : 'pending';
-        }
-        if (prev === 'idle') {
-          return deferUntilTourComplete ? 'deferred' : 'pending';
-        }
-        return prev;
-      });
-    },
-    [hasPaidLicense, isAdminUser, licenseNotice.requiresLicense],
-  );
-
-  useEffect(() => {
-    if (typeof window === 'undefined') {
-      return;
-    }
-
-    const handleServerLicenseRequested = (event: Event) => {
-      const { detail } = event as CustomEvent<ServerLicenseRequestPayload>;
-
-      if (detail?.licenseNotice) {
-        setLicenseNotice((prev) => ({
-          ...prev,
-          ...detail.licenseNotice,
-          totalUsers:
-            detail.licenseNotice?.totalUsers ?? prev.totalUsers,
-          freeTierLimit:
-            detail.licenseNotice?.freeTierLimit ?? prev.freeTierLimit,
-          isOverLimit:
-            detail.licenseNotice?.isOverLimit ?? prev.isOverLimit,
-          requiresLicense:
-            detail.licenseNotice?.requiresLicense ?? prev.requiresLicense,
-        }));
-      }
-
-      requestServerLicense({
-        deferUntilTourComplete: detail?.deferUntilTourComplete ?? false,
-        selfReportedAdmin: detail?.selfReportedAdmin ?? false,
-      });
-    };
-
-    window.addEventListener(
-      SERVER_LICENSE_REQUEST_EVENT,
-      handleServerLicenseRequested as EventListener,
-    );
-
-    return () => {
-      window.removeEventListener(
-        SERVER_LICENSE_REQUEST_EVENT,
-        handleServerLicenseRequested as EventListener,
-      );
-    };
-  }, [requestServerLicense]);
-
-  useEffect(() => {
-    const isEligibleAdmin =
-      isAdminUser || serverLicenseSource === 'self-reported' || licenseNotice.requiresLicense;
-    if (
-      introWasOpenRef.current &&
-      !shouldShowIntro &&
-      isEligibleAdmin &&
-      toolPromptCompleted &&
-      !hasShownServerLicense &&
-      licenseNotice.requiresLicense &&
-      serverLicenseIntent === 'idle'
-    ) {
-      if (!serverLicenseSource) {
-        setServerLicenseSource(isAdminUser ? 'config' : 'self-reported');
-      }
-      setServerLicenseIntent('pending');
-    }
-    introWasOpenRef.current = shouldShowIntro;
-  }, [
-    hasShownServerLicense,
-    isAdminUser,
-    serverLicenseIntent,
-    shouldShowIntro,
-    serverLicenseSource,
-    toolPromptCompleted,
-    licenseNotice.requiresLicense,
-  ]);
-
-  useEffect(() => {
-    const isEligibleAdmin =
-      isAdminUser || serverLicenseSource === 'self-reported' || licenseNotice.requiresLicense;
-    if (
-      serverLicenseIntent !== 'idle' &&
-      !shouldShowIntro &&
-      !isOpen &&
-      !isServerLicenseOpen &&
-      isEligibleAdmin &&
-      toolPromptCompleted &&
-      licenseNotice.requiresLicense
-    ) {
-      setIsServerLicenseOpen(true);
-      setServerLicenseIntent(serverLicenseIntent === 'deferred' ? 'pending' : 'idle');
-    }
-  }, [
-    isAdminUser,
-    isOpen,
-    isServerLicenseOpen,
-    serverLicenseIntent,
-    shouldShowIntro,
-    serverLicenseSource,
-    toolPromptCompleted,
-    licenseNotice.requiresLicense,
-  ]);
-
-  const handleServerLicenseClose = useCallback(() => {
-    setIsServerLicenseOpen(false);
-    setHasShownServerLicense(true);
-    setServerLicenseIntent('idle');
-    setServerLicenseSource(null);
-  }, []);
-
-  useEffect(() => {
-    if (onboardingSessionMarkedRef.current) {
-      return;
-    }
-    if (typeof window === 'undefined') {
-      return;
-    }
-    if (shouldShowIntro || isOpen) {
-      onboardingSessionMarkedRef.current = true;
-      window.sessionStorage.setItem(ONBOARDING_SESSION_BLOCK_KEY, 'true');
-      window.dispatchEvent(new CustomEvent(ONBOARDING_SESSION_EVENT));
-    }
-  }, [isOpen, shouldShowIntro]);
-
-  useEffect(() => {
-    if (typeof window === 'undefined') {
-      return;
-    }
-    if (!shouldShowIntro && !isOpen) {
-      window.sessionStorage.removeItem(ONBOARDING_SESSION_BLOCK_KEY);
-      window.dispatchEvent(new CustomEvent(ONBOARDING_SESSION_EVENT));
-    }
-  }, [isOpen, shouldShowIntro]);
-
-  const handleServerLicenseSeePlans = useCallback(() => {
-    handleServerLicenseClose();
-    navigate('/settings/adminPlan');
-  }, [handleServerLicenseClose, navigate]);
-
-  const handleTourCompletion = useCallback(() => {
-    completeTour();
-    if (serverLicenseIntent === 'deferred') {
-      setServerLicenseIntent('pending');
-    } else if (tourType === 'admin' && (isAdminUser || serverLicenseSource === 'self-reported')) {
-      setServerLicenseSource((prev) => prev ?? (isAdminUser ? 'config' : 'self-reported'));
-      setServerLicenseIntent((prev) => (prev === 'pending' ? prev : 'pending'));
-    }
-  }, [
-    completeTour,
-    isAdminUser,
-    serverLicenseIntent,
-    serverLicenseSource,
-    tourType,
-  ]);
-
-  const initialModalProps: InitialModalHandlers = useMemo(
-    () => ({
-      opened: shouldShowIntro,
-      onLicenseNoticeUpdate: handleLicenseNoticeUpdate,
-      onRequestServerLicense: requestServerLicense,
-      onClose: handleInitialModalClose,
-    }),
-    [handleInitialModalClose, handleLicenseNoticeUpdate, requestServerLicense, shouldShowIntro],
-  );
-
-  const serverLicenseModalProps: ServerLicenseModalHandlers = useMemo(
-    () => ({
-      opened: isServerLicenseOpen,
-      licenseNotice,
-      onClose: handleServerLicenseClose,
-      onSeePlans: handleServerLicenseSeePlans,
-    }),
-    [handleServerLicenseClose, handleServerLicenseSeePlans, isServerLicenseOpen, licenseNotice],
-  );
-
-  return {
-    tourType,
-    isTourOpen: isOpen,
-    maskClassName: tourType === 'admin' ? 'admin-tour-mask' : undefined,
-    initialModalProps,
-    handleToolPromptComplete,
-    serverLicenseModalProps,
-    handleTourCompletion,
-  };
-}
-

frontend/src/core/components/onboarding/onboardingFlowConfig.ts

@@ -3,16 +3,18 @@ import DesktopInstallSlide from '@app/components/onboarding/slides/DesktopInstal
 import SecurityCheckSlide from '@app/components/onboarding/slides/SecurityCheckSlide';
 import PlanOverviewSlide from '@app/components/onboarding/slides/PlanOverviewSlide';
 import ServerLicenseSlide from '@app/components/onboarding/slides/ServerLicenseSlide';
+import FirstLoginSlide from '@app/components/onboarding/slides/FirstLoginSlide';
 import { SlideConfig, LicenseNotice } from '@app/types/types';
 
 export type SlideId =
+  | 'first-login'
   | 'welcome'
   | 'desktop-install'
   | 'security-check'
   | 'admin-overview'
   | 'server-license';
 
-export type HeroType = 'rocket' | 'dual-icon' | 'shield' | 'diamond' | 'logo';
+export type HeroType = 'rocket' | 'dual-icon' | 'shield' | 'diamond' | 'logo' | 'lock';
 
 export type ButtonAction =
   | 'next'
@@ -46,6 +48,10 @@ export interface SlideFactoryParams {
   onRoleSelect: (role: 'admin' | 'user' | null) => void;
   licenseNotice?: LicenseNotice;
   loginEnabled?: boolean;
+  // First login params
+  firstLoginUsername?: string;
+  onPasswordChanged?: () => void;
+  usingDefaultCredentials?: boolean;
 }
 
 export interface HeroDefinition {
@@ -71,6 +77,17 @@ export interface SlideDefinition {
 }
 
 export const SLIDE_DEFINITIONS: Record<SlideId, SlideDefinition> = {
+  'first-login': {
+    id: 'first-login',
+    createSlide: ({ firstLoginUsername, onPasswordChanged, usingDefaultCredentials }) => 
+      FirstLoginSlide({ 
+        username: firstLoginUsername || '', 
+        onPasswordChanged: onPasswordChanged || (() => {}),
+        usingDefaultCredentials: usingDefaultCredentials || false,
+      }),
+    hero: { type: 'lock' },
+    buttons: [], // Form has its own submit button
+  },
   'welcome': {
     id: 'welcome',
     createSlide: () => WelcomeSlide(),
@@ -197,11 +214,3 @@ export const SLIDE_DEFINITIONS: Record<SlideId, SlideDefinition> = {
   },
 };
 
-export const FLOW_SEQUENCES = {
-  loginAdmin: ['welcome', 'desktop-install', 'admin-overview'] as SlideId[],
-  loginUser: ['welcome', 'desktop-install'] as SlideId[],
-  noLoginBase: ['welcome', 'desktop-install', 'security-check'] as SlideId[],
-  noLoginAdmin: ['admin-overview'] as SlideId[],
-};
-
-

frontend/src/core/components/onboarding/orchestrator/onboardingConfig.ts

@@ -0,0 +1,127 @@
+export type OnboardingStepId =
+  | 'first-login'
+  | 'welcome'
+  | 'desktop-install'
+  | 'security-check'
+  | 'admin-overview'
+  | 'tool-layout'
+  | 'tour'
+  | 'server-license'
+  | 'analytics-choice';
+
+export type OnboardingStepType =
+  | 'modal-slide'
+  | 'tool-prompt'
+  | 'tour'
+  | 'analytics-modal';
+
+export interface OnboardingRuntimeState {
+  selectedRole: 'admin' | 'user' | null;
+  tourRequested: boolean;
+  tourType: 'admin' | 'tools';
+  isDesktopApp: boolean;
+  analyticsNotConfigured: boolean;
+  analyticsEnabled: boolean;
+  licenseNotice: {
+    totalUsers: number | null;
+    freeTierLimit: number;
+    isOverLimit: boolean;
+    requiresLicense: boolean;
+  };
+  requiresPasswordChange: boolean;
+  firstLoginUsername: string;
+  usingDefaultCredentials: boolean;
+}
+
+export interface OnboardingConditionContext extends OnboardingRuntimeState {
+  loginEnabled: boolean;
+  effectiveIsAdmin: boolean;
+}
+
+export interface OnboardingStep {
+  id: OnboardingStepId;
+  type: OnboardingStepType;
+  condition: (ctx: OnboardingConditionContext) => boolean;
+  slideId?: 'first-login' | 'welcome' | 'desktop-install' | 'security-check' | 'admin-overview' | 'server-license';
+}
+
+export const DEFAULT_RUNTIME_STATE: OnboardingRuntimeState = {
+  selectedRole: null,
+  tourRequested: false,
+  tourType: 'tools',
+  isDesktopApp: false,
+  analyticsNotConfigured: false,
+  analyticsEnabled: false,
+  licenseNotice: {
+    totalUsers: null,
+    freeTierLimit: 5,
+    isOverLimit: false,
+    requiresLicense: false,
+  },
+  requiresPasswordChange: false,
+  firstLoginUsername: '',
+  usingDefaultCredentials: false,
+};
+
+export const ONBOARDING_STEPS: OnboardingStep[] = [
+  {
+    id: 'first-login',
+    type: 'modal-slide',
+    slideId: 'first-login',
+    condition: (ctx) => ctx.requiresPasswordChange,
+  },
+  {
+    id: 'welcome',
+    type: 'modal-slide',
+    slideId: 'welcome',
+    condition: () => true,
+  },
+  {
+    id: 'desktop-install',
+    type: 'modal-slide',
+    slideId: 'desktop-install',
+    condition: (ctx) => !ctx.isDesktopApp,
+  },
+  {
+    id: 'security-check',
+    type: 'modal-slide',
+    slideId: 'security-check',
+    condition: (ctx) => !ctx.loginEnabled && !ctx.isDesktopApp,
+  },
+  {
+    id: 'admin-overview',
+    type: 'modal-slide',
+    slideId: 'admin-overview',
+    condition: (ctx) => ctx.effectiveIsAdmin,
+  },
+  {
+    id: 'tool-layout',
+    type: 'tool-prompt',
+    condition: () => true,
+  },
+  {
+    id: 'tour',
+    type: 'tour',
+    condition: (ctx) => ctx.tourRequested || !ctx.effectiveIsAdmin,
+  },
+  {
+    id: 'server-license',
+    type: 'modal-slide',
+    slideId: 'server-license',
+    condition: (ctx) => ctx.effectiveIsAdmin && ctx.licenseNotice.requiresLicense,
+  },
+  {
+    id: 'analytics-choice',
+    type: 'analytics-modal',
+    condition: (ctx) => ctx.effectiveIsAdmin && ctx.analyticsNotConfigured,
+  },
+];
+
+export function getStepById(id: OnboardingStepId): OnboardingStep | undefined {
+  return ONBOARDING_STEPS.find((step) => step.id === id);
+}
+
+export function getStepIndex(id: OnboardingStepId): number {
+  return ONBOARDING_STEPS.findIndex((step) => step.id === id);
+}
+

frontend/src/core/components/onboarding/orchestrator/onboardingStorage.ts

@@ -0,0 +1,97 @@
+import { type OnboardingStepId, ONBOARDING_STEPS } from '@app/components/onboarding/orchestrator/onboardingConfig';
+
+const STORAGE_PREFIX = 'onboarding';
+
+export function getStorageKey(stepId: OnboardingStepId): string {
+  return `${STORAGE_PREFIX}::${stepId}`;
+}
+
+export function hasSeenStep(stepId: OnboardingStepId): boolean {
+  if (typeof window === 'undefined') return false;
+  try {
+    return localStorage.getItem(getStorageKey(stepId)) === 'true';
+  } catch {
+    return false;
+  }
+}
+
+export function markStepSeen(stepId: OnboardingStepId): void {
+  if (typeof window === 'undefined') return;
+  try {
+    localStorage.setItem(getStorageKey(stepId), 'true');
+  } catch (error) {
+    console.error('[onboardingStorage] Error marking step as seen:', error);
+  }
+}
+
+export function resetStepSeen(stepId: OnboardingStepId): void {
+  if (typeof window === 'undefined') return;
+  try {
+    localStorage.removeItem(getStorageKey(stepId));
+  } catch (error) {
+    console.error('[onboardingStorage] Error resetting step seen:', error);
+  }
+}
+
+export function resetAllOnboardingProgress(): void {
+  if (typeof window === 'undefined') return;
+  try {
+    const prefix = `${STORAGE_PREFIX}::`;
+    const keysToRemove: string[] = [];
+    for (let i = 0; i < localStorage.length; i++) {
+      const key = localStorage.key(i);
+      if (key?.startsWith(prefix)) keysToRemove.push(key);
+    }
+    keysToRemove.forEach((key) => localStorage.removeItem(key));
+  } catch (error) {
+    console.error('[onboardingStorage] Error resetting all onboarding progress:', error);
+  }
+}
+
+export function getOnboardingStorageState(): Record<string, boolean> {
+  const state: Record<string, boolean> = {};
+  ONBOARDING_STEPS.forEach((step) => {
+    state[step.id] = hasSeenStep(step.id);
+  });
+  return state;
+}
+
+export function migrateFromLegacyPreferences(): void {
+  if (typeof window === 'undefined') return;
+  
+  const migrationKey = `${STORAGE_PREFIX}::migrated`;
+  
+  try {
+    // Skip if already migrated
+    if (localStorage.getItem(migrationKey) === 'true') return;
+    
+    const prefsRaw = localStorage.getItem('stirlingpdf_preferences');
+    if (prefsRaw) {
+      const prefs = JSON.parse(prefsRaw) as Record<string, unknown>;
+      
+      // Migrate based on legacy flags
+      if (prefs.hasSeenIntroOnboarding === true) {
+        markStepSeen('welcome');
+        markStepSeen('desktop-install');
+        markStepSeen('security-check');
+        markStepSeen('admin-overview');
+      }
+      
+      if (prefs.toolPanelModePromptSeen === true || prefs.hasSelectedToolPanelMode === true) {
+        markStepSeen('tool-layout');
+      }
+      
+      if (prefs.hasCompletedOnboarding === true) {
+        markStepSeen('tour');
+        markStepSeen('analytics-choice');
+        markStepSeen('server-license');
+      }
+      
+    }
+    
+    // Mark migration complete
+    localStorage.setItem(migrationKey, 'true');
+  } catch {
+    // If migration fails, onboarding will show again - safer than hiding it
+  }
+}

frontend/src/core/components/onboarding/orchestrator/useOnboardingOrchestrator.ts

@@ -0,0 +1,353 @@
+import { useState, useCallback, useMemo, useEffect, useRef } from 'react';
+import { useLocation } from 'react-router-dom';
+import { useServerExperience } from '@app/hooks/useServerExperience';
+import { useAppConfig } from '@app/contexts/AppConfigContext';
+
+import {
+  ONBOARDING_STEPS,
+  type OnboardingStepId,
+  type OnboardingStep,
+  type OnboardingRuntimeState,
+  type OnboardingConditionContext,
+  DEFAULT_RUNTIME_STATE,
+} from '@app/components/onboarding/orchestrator/onboardingConfig';
+import {
+  hasSeenStep,
+  markStepSeen,
+  migrateFromLegacyPreferences,
+} from '@app/components/onboarding/orchestrator/onboardingStorage';
+import { accountService } from '@app/services/accountService';
+
+const AUTH_ROUTES = ['/login', '/signup', '/auth', '/invite'];
+const SESSION_TOUR_REQUESTED = 'onboarding::session::tour-requested';
+const SESSION_TOUR_TYPE = 'onboarding::session::tour-type';
+const SESSION_SELECTED_ROLE = 'onboarding::session::selected-role';
+
+// Check if user has an auth token (to avoid flash before redirect)
+function hasAuthToken(): boolean {
+  if (typeof window === 'undefined') return false;
+  return !!localStorage.getItem('stirling_jwt');
+}
+
+// Get initial runtime state from session storage (survives remounts)
+function getInitialRuntimeState(baseState: OnboardingRuntimeState): OnboardingRuntimeState {
+  if (typeof window === 'undefined') {
+    return baseState;
+  }
+  
+  try {
+    const tourRequested = sessionStorage.getItem(SESSION_TOUR_REQUESTED) === 'true';
+    const tourType = (sessionStorage.getItem(SESSION_TOUR_TYPE) as 'admin' | 'tools') || 'tools';
+    const selectedRole = sessionStorage.getItem(SESSION_SELECTED_ROLE) as 'admin' | 'user' | null;
+    
+    return {
+      ...baseState,
+      tourRequested,
+      tourType,
+      selectedRole,
+    };
+  } catch {
+    return baseState;
+  }
+}
+
+function persistRuntimeState(state: Partial<OnboardingRuntimeState>): void {
+  if (typeof window === 'undefined') return;
+  
+  try {
+    if (state.tourRequested !== undefined) {
+      sessionStorage.setItem(SESSION_TOUR_REQUESTED, state.tourRequested ? 'true' : 'false');
+    }
+    if (state.tourType !== undefined) {
+      sessionStorage.setItem(SESSION_TOUR_TYPE, state.tourType);
+    }
+    if (state.selectedRole !== undefined) {
+      if (state.selectedRole) {
+        sessionStorage.setItem(SESSION_SELECTED_ROLE, state.selectedRole);
+      } else {
+        sessionStorage.removeItem(SESSION_SELECTED_ROLE);
+      }
+    }
+  } catch (error) {
+    console.error('[useOnboardingOrchestrator] Error persisting runtime state:', error);
+  }
+}
+
+function clearRuntimeStateSession(): void {
+  if (typeof window === 'undefined') return;
+  
+  try {
+    sessionStorage.removeItem(SESSION_TOUR_REQUESTED);
+    sessionStorage.removeItem(SESSION_TOUR_TYPE);
+    sessionStorage.removeItem(SESSION_SELECTED_ROLE);
+  } catch {
+    // Ignore errors
+  }
+}
+
+export interface OnboardingOrchestratorState {
+  /** Whether onboarding is currently active */
+  isActive: boolean;
+  /** The current step being shown (null if no step is active) */
+  currentStep: OnboardingStep | null;
+  /** Index of current step in the active flow (for display purposes) */
+  currentStepIndex: number;
+  /** Total number of steps in the active flow */
+  totalSteps: number;
+  /** Runtime state that affects conditions */
+  runtimeState: OnboardingRuntimeState;
+  /** All steps that will be shown in this flow (filtered by conditions) */
+  activeFlow: OnboardingStep[];
+  /** Whether all steps have been seen */
+  isComplete: boolean;
+  /** Whether we're still initializing */
+  isLoading: boolean;
+}
+
+export interface OnboardingOrchestratorActions {
+  /** Move to the next step */
+  next: () => void;
+  /** Move to the previous step */
+  prev: () => void;
+  /** Skip the current step (marks as seen but doesn't complete) */
+  skip: () => void;
+  /** Mark current step as seen and move to next */
+  complete: () => void;
+  /** Update runtime state (e.g., after role selection) */
+  updateRuntimeState: (updates: Partial<OnboardingRuntimeState>) => void;
+  /** Force re-evaluation of the flow (used when conditions change) */
+  refreshFlow: () => void;
+  /** Manually start a specific step (for external triggers) */
+  startStep: (stepId: OnboardingStepId) => void;
+  /** Close/pause onboarding (can be resumed later) */
+  pause: () => void;
+  /** Resume onboarding from where it was paused */
+  resume: () => void;
+}
+
+export interface UseOnboardingOrchestratorResult {
+  state: OnboardingOrchestratorState;
+  actions: OnboardingOrchestratorActions;
+}
+
+export interface UseOnboardingOrchestratorOptions {
+  /** Override the default runtime state (used by desktop to set isDesktopApp: true) */
+  defaultRuntimeState?: OnboardingRuntimeState;
+}
+
+export function useOnboardingOrchestrator(
+  options?: UseOnboardingOrchestratorOptions
+): UseOnboardingOrchestratorResult {
+  const defaultState = options?.defaultRuntimeState ?? DEFAULT_RUNTIME_STATE;
+  const serverExperience = useServerExperience();
+  const { config, loading: configLoading } = useAppConfig();
+  const location = useLocation();
+
+  const [runtimeState, setRuntimeState] = useState<OnboardingRuntimeState>(() => 
+    getInitialRuntimeState(defaultState)
+  );
+  const [isPaused, setIsPaused] = useState(false);
+  const [isInitialized, setIsInitialized] = useState(false);
+  const [currentStepIndex, setCurrentStepIndex] = useState(-1);
+  const migrationDone = useRef(false);
+  const initialIndexSet = useRef(false);
+
+  useEffect(() => {
+    if (!migrationDone.current) {
+      migrateFromLegacyPreferences();
+      migrationDone.current = true;
+    }
+  }, []);
+
+  useEffect(() => {
+    setRuntimeState((prev) => ({
+      ...prev,
+      analyticsEnabled: config?.enableAnalytics === true,
+      analyticsNotConfigured: config?.enableAnalytics == null,
+      licenseNotice: {
+        totalUsers: serverExperience.totalUsers,
+        freeTierLimit: serverExperience.freeTierLimit,
+        isOverLimit: serverExperience.overFreeTierLimit ?? false,
+        requiresLicense: !serverExperience.hasPaidLicense && (
+          serverExperience.overFreeTierLimit === true ||
+          (serverExperience.effectiveIsAdmin && serverExperience.userCountResolved)
+        ),
+      },
+    }));
+  }, [
+    config?.enableAnalytics,
+    serverExperience.totalUsers,
+    serverExperience.freeTierLimit,
+    serverExperience.overFreeTierLimit,
+    serverExperience.hasPaidLicense,
+    serverExperience.effectiveIsAdmin,
+    serverExperience.userCountResolved,
+  ]);
+
+  useEffect(() => {
+    const checkFirstLogin = async () => {
+      if (config?.enableLogin !== true || !hasAuthToken()) return;
+
+      try {
+        const [accountData, loginPageData] = await Promise.all([
+          accountService.getAccountData(),
+          accountService.getLoginPageData(),
+        ]);
+        
+        setRuntimeState((prev) => ({
+          ...prev,
+          requiresPasswordChange: accountData.changeCredsFlag,
+          firstLoginUsername: accountData.username,
+          usingDefaultCredentials: loginPageData.showDefaultCredentials,
+        }));
+      } catch {
+        // Account endpoint failed - user not logged in or security disabled
+      }
+    };
+
+    if (!configLoading) {
+      checkFirstLogin();
+    }
+  }, [config?.enableLogin, configLoading]);
+
+  const isOnAuthRoute = AUTH_ROUTES.some((route) => location.pathname.startsWith(route));
+  const loginEnabled = config?.enableLogin === true;
+  const isUnauthenticatedWithLoginEnabled = loginEnabled && !hasAuthToken();
+  const shouldBlockOnboarding = isOnAuthRoute || configLoading || isUnauthenticatedWithLoginEnabled;
+
+  const conditionContext = useMemo<OnboardingConditionContext>(() => ({
+    ...serverExperience,
+    ...runtimeState,
+    effectiveIsAdmin: serverExperience.effectiveIsAdmin || 
+      (!serverExperience.loginEnabled && runtimeState.selectedRole === 'admin'),
+  }), [serverExperience, runtimeState]);
+
+  const activeFlow = useMemo(() => {
+    return ONBOARDING_STEPS.filter((step) => step.condition(conditionContext));
+  }, [conditionContext]);
+
+  // Wait for config AND admin status before calculating initial step
+  const adminStatusResolved = !configLoading && (
+    config?.enableLogin === false || 
+    config?.enableLogin === undefined || 
+    config?.isAdmin !== undefined
+  );
+  
+  useEffect(() => {
+    if (configLoading || !adminStatusResolved || activeFlow.length === 0) return;
+    
+    let firstUnseenIndex = -1;
+    for (let i = 0; i < activeFlow.length; i++) {
+      if (!hasSeenStep(activeFlow[i].id)) {
+        firstUnseenIndex = i;
+        break;
+      }
+    }
+    
+    if (firstUnseenIndex === -1) {
+      setCurrentStepIndex(activeFlow.length);
+      initialIndexSet.current = true;
+    } else if (!initialIndexSet.current) {
+      setCurrentStepIndex(firstUnseenIndex);
+      initialIndexSet.current = true;
+    }
+  }, [activeFlow, configLoading, adminStatusResolved]);
+
+  const totalSteps = activeFlow.length;
+  
+  const allStepsAlreadySeen = useMemo(() => {
+    if (activeFlow.length === 0) return false;
+    return activeFlow.every(step => hasSeenStep(step.id));
+  }, [activeFlow]);
+  
+  const isComplete = isInitialized && initialIndexSet.current && 
+    (currentStepIndex >= totalSteps || allStepsAlreadySeen);
+  const currentStep = (currentStepIndex >= 0 && currentStepIndex < totalSteps && !allStepsAlreadySeen) 
+    ? activeFlow[currentStepIndex] 
+    : null;
+  const isActive = !shouldBlockOnboarding && !isPaused && !isComplete && isInitialized && currentStep !== null;
+  const isLoading = configLoading || !adminStatusResolved || !isInitialized || 
+    !initialIndexSet.current || (currentStepIndex === -1 && activeFlow.length > 0);
+
+  useEffect(() => {
+    if (!configLoading && !isInitialized) setIsInitialized(true);
+  }, [configLoading, isInitialized]);
+
+  useEffect(() => {
+    if (isComplete) clearRuntimeStateSession();
+  }, [isComplete]);
+
+  const next = useCallback(() => {
+    if (currentStep) markStepSeen(currentStep.id);
+    setCurrentStepIndex((prev) => Math.min(prev + 1, totalSteps));
+  }, [currentStep, totalSteps]);
+
+  const prev = useCallback(() => {
+    setCurrentStepIndex((prev) => Math.max(prev - 1, 0));
+  }, []);
+
+  const skip = useCallback(() => {
+    if (currentStep) markStepSeen(currentStep.id);
+    setCurrentStepIndex((prev) => Math.min(prev + 1, totalSteps));
+  }, [currentStep, totalSteps]);
+
+  const complete = useCallback(() => {
+    if (currentStep) markStepSeen(currentStep.id);
+    setCurrentStepIndex((prev) => Math.min(prev + 1, totalSteps));
+  }, [currentStep, totalSteps]);
+
+  useEffect(() => {
+    if (!currentStep || isLoading) {
+      return;
+    }
+    if (hasSeenStep(currentStep.id)) {
+      complete();
+    }
+  }, [currentStep, isLoading, complete]);
+
+  const updateRuntimeState = useCallback((updates: Partial<OnboardingRuntimeState>) => {
+    persistRuntimeState(updates);
+    setRuntimeState((prev) => ({ ...prev, ...updates }));
+  }, []);
+
+  const refreshFlow = useCallback(() => {
+    initialIndexSet.current = false;
+    setCurrentStepIndex(-1);
+  }, []);
+
+  const startStep = useCallback((stepId: OnboardingStepId) => {
+    const index = activeFlow.findIndex((step) => step.id === stepId);
+    if (index !== -1) {
+      setCurrentStepIndex(index);
+      setIsPaused(false);
+    }
+  }, [activeFlow]);
+
+  const pause = useCallback(() => setIsPaused(true), []);
+  const resume = useCallback(() => setIsPaused(false), []);
+
+  const state: OnboardingOrchestratorState = {
+    isActive,
+    currentStep,
+    currentStepIndex,
+    totalSteps,
+    runtimeState,
+    activeFlow,
+    isComplete,
+    isLoading,
+  };
+
+  const actions: OnboardingOrchestratorActions = {
+    next,
+    prev,
+    skip,
+    complete,
+    updateRuntimeState,
+    refreshFlow,
+    startStep,
+    pause,
+    resume,
+  };
+
+  return { state, actions };
+}

frontend/src/core/components/onboarding/slides/FirstLoginSlide.tsx

@@ -0,0 +1,184 @@
+import React, { useState } from 'react';
+import { Stack, PasswordInput, Button, Alert, Text } from '@mantine/core';
+import { useTranslation } from 'react-i18next';
+import { SlideConfig } from '@app/types/types';
+import LocalIcon from '@app/components/shared/LocalIcon';
+import { UNIFIED_CIRCLE_CONFIG } from '@app/components/onboarding/slides/unifiedBackgroundConfig';
+import { accountService } from '@app/services/accountService';
+import { alert as showToast } from '@app/components/toast';
+import styles from '@app/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css';
+
+interface FirstLoginSlideProps {
+  username: string;
+  onPasswordChanged: () => void;
+  usingDefaultCredentials?: boolean;
+}
+
+const DEFAULT_PASSWORD = 'stirling';
+
+function FirstLoginForm({ username, onPasswordChanged, usingDefaultCredentials = false }: FirstLoginSlideProps) {
+  const { t } = useTranslation();
+  // If using default credentials, pre-fill with "stirling" - user won't see this field
+  const [currentPassword, setCurrentPassword] = useState(usingDefaultCredentials ? DEFAULT_PASSWORD : '');
+  const [newPassword, setNewPassword] = useState('');
+  const [confirmPassword, setConfirmPassword] = useState('');
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState('');
+
+  const handleSubmit = async () => {
+    // Validation
+    if ((!usingDefaultCredentials && !currentPassword) || !newPassword || !confirmPassword) {
+      setError(t('firstLogin.allFieldsRequired', 'All fields are required'));
+      return;
+    }
+
+    if (newPassword !== confirmPassword) {
+      setError(t('firstLogin.passwordsDoNotMatch', 'New passwords do not match'));
+      return;
+    }
+
+    if (newPassword.length < 8) {
+      setError(t('firstLogin.passwordTooShort', 'Password must be at least 8 characters'));
+      return;
+    }
+
+    if (newPassword === currentPassword) {
+      setError(t('firstLogin.passwordMustBeDifferent', 'New password must be different from current password'));
+      return;
+    }
+
+    try {
+      setLoading(true);
+      setError('');
+
+      await accountService.changePasswordOnLogin(currentPassword, newPassword);
+
+      showToast({
+        alertType: 'success',
+        title: t('firstLogin.passwordChangedSuccess', 'Password changed successfully! Please log in again.')
+      });
+
+      // Clear form
+      setCurrentPassword('');
+      setNewPassword('');
+      setConfirmPassword('');
+
+      // Wait a moment for the user to see the success message
+      setTimeout(() => {
+        onPasswordChanged();
+      }, 1500);
+    } catch (err) {
+      console.error('Failed to change password:', err);
+      // Extract error message from axios response if available
+      const axiosError = err as { response?: { data?: { message?: string } } };
+      setError(
+        axiosError.response?.data?.message ||
+        t('firstLogin.passwordChangeFailed', 'Failed to change password. Please check your current password.')
+      );
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <div className={styles.securitySlideContent}>
+      <div className={styles.securityCard}>
+        <Stack gap="md">
+          <div className={styles.securityAlertRow}>
+            <LocalIcon icon="info-rounded" width={20} height={20} style={{ color: '#3B82F6', flexShrink: 0 }} />
+            <span>
+              {t(
+                'firstLogin.welcomeMessage',
+                'For security reasons, you must change your password on your first login.'
+              )}
+            </span>
+          </div>
+
+          <Text size="sm" fw={500}>
+            {t('firstLogin.loggedInAs', 'Logged in as')}: <strong>{username}</strong>
+          </Text>
+
+          {error && (
+            <Alert
+              icon={<LocalIcon icon="error-rounded" width="1rem" height="1rem" />}
+              color="red"
+              variant="light"
+            >
+              {error}
+            </Alert>
+          )}
+
+          {/* Only show current password field if not using default credentials */}
+          {!usingDefaultCredentials && (
+            <PasswordInput
+              label={t('firstLogin.currentPassword', 'Current Password')}
+              placeholder={t('firstLogin.enterCurrentPassword', 'Enter your current password')}
+              value={currentPassword}
+              onChange={(e) => setCurrentPassword(e.currentTarget.value)}
+              required
+              styles={{
+                input: { height: 44 },
+              }}
+            />
+          )}
+
+          <PasswordInput
+            label={t('firstLogin.newPassword', 'New Password')}
+            placeholder={t('firstLogin.enterNewPassword', 'Enter new password (min 8 characters)')}
+            value={newPassword}
+            onChange={(e) => setNewPassword(e.currentTarget.value)}
+            required
+            styles={{
+              input: { height: 44 },
+            }}
+          />
+
+          <PasswordInput
+            label={t('firstLogin.confirmPassword', 'Confirm New Password')}
+            placeholder={t('firstLogin.reEnterNewPassword', 'Re-enter new password')}
+            value={confirmPassword}
+            onChange={(e) => setConfirmPassword(e.currentTarget.value)}
+            required
+            styles={{
+              input: { height: 44 },
+            }}
+          />
+
+          <Button
+            fullWidth
+            onClick={handleSubmit}
+            loading={loading}
+            disabled={!newPassword || !confirmPassword}
+            size="md"
+            mt="xs"
+          >
+            {t('firstLogin.changePassword', 'Change Password')}
+          </Button>
+        </Stack>
+      </div>
+    </div>
+  );
+}
+
+export default function FirstLoginSlide({
+  username,
+  onPasswordChanged,
+  usingDefaultCredentials = false,
+}: FirstLoginSlideProps): SlideConfig {
+  return {
+    key: 'first-login',
+    title: 'Set Your Password',
+    body: (
+      <FirstLoginForm 
+        username={username} 
+        onPasswordChanged={onPasswordChanged} 
+        usingDefaultCredentials={usingDefaultCredentials}
+      />
+    ),
+    background: {
+      gradientStops: ['#059669', '#0891B2'], // Green to teal - security/trust colors
+      circles: UNIFIED_CIRCLE_CONFIG,
+    },
+  };
+}
+

frontend/src/core/components/onboarding/tourSteps.ts

@@ -1,33 +0,0 @@
-export enum TourStep {
-  ALL_TOOLS,
-  SELECT_CROP_TOOL,
-  TOOL_INTERFACE,
-  FILES_BUTTON,
-  FILE_SOURCES,
-  WORKBENCH,
-  VIEW_SWITCHER,
-  VIEWER,
-  PAGE_EDITOR,
-  ACTIVE_FILES,
-  FILE_CHECKBOX,
-  SELECT_CONTROLS,
-  CROP_SETTINGS,
-  RUN_BUTTON,
-  RESULTS,
-  FILE_REPLACEMENT,
-  PIN_BUTTON,
-  WRAP_UP,
-}
-
-export enum AdminTourStep {
-  WELCOME,
-  CONFIG_BUTTON,
-  SETTINGS_OVERVIEW,
-  TEAMS_AND_USERS,
-  SYSTEM_CUSTOMIZATION,
-  DATABASE_SECTION,
-  CONNECTIONS_SECTION,
-  ADMIN_TOOLS,
-  WRAP_UP,
-}
-

frontend/src/core/components/onboarding/useOnboardingDownload.ts

@@ -0,0 +1,79 @@
+/**
+ * useOnboardingDownload Hook
+ * 
+ * Encapsulates OS detection and download URL logic for the desktop install slide.
+ */
+
+import { useState, useEffect, useMemo, useCallback } from 'react';
+import { useOs } from '@app/hooks/useOs';
+import { DOWNLOAD_URLS } from '@app/constants/downloads';
+
+interface OsInfo {
+  label: string;
+  url: string;
+}
+
+interface OsOption {
+  label: string;
+  url: string;
+  value: string;
+}
+
+interface UseOnboardingDownloadResult {
+  osInfo: OsInfo;
+  osOptions: OsOption[];
+  selectedDownloadUrl: string;
+  setSelectedDownloadUrl: (url: string) => void;
+  handleDownloadSelected: () => void;
+}
+
+export function useOnboardingDownload(): UseOnboardingDownloadResult {
+  const osType = useOs();
+  const [selectedDownloadUrl, setSelectedDownloadUrl] = useState<string>('');
+
+  const osInfo = useMemo<OsInfo>(() => {
+    switch (osType) {
+      case 'windows':
+        return { label: 'Windows', url: DOWNLOAD_URLS.WINDOWS };
+      case 'mac-apple':
+        return { label: 'Mac (Apple Silicon)', url: DOWNLOAD_URLS.MAC_APPLE_SILICON };
+      case 'mac-intel':
+        return { label: 'Mac (Intel)', url: DOWNLOAD_URLS.MAC_INTEL };
+      case 'linux-x64':
+      case 'linux-arm64':
+        return { label: 'Linux', url: DOWNLOAD_URLS.LINUX_DOCS };
+      default:
+        return { label: '', url: '' };
+    }
+  }, [osType]);
+
+  const osOptions = useMemo<OsOption[]>(() => [
+    { label: 'Windows', url: DOWNLOAD_URLS.WINDOWS, value: 'windows' },
+    { label: 'Mac (Apple Silicon)', url: DOWNLOAD_URLS.MAC_APPLE_SILICON, value: 'mac-apple' },
+    { label: 'Mac (Intel)', url: DOWNLOAD_URLS.MAC_INTEL, value: 'mac-intel' },
+    { label: 'Linux', url: DOWNLOAD_URLS.LINUX_DOCS, value: 'linux' },
+  ].filter((opt) => opt.url), []);
+
+  // Initialize selected URL from detected OS
+  useEffect(() => {
+    if (!selectedDownloadUrl && osInfo.url) {
+      setSelectedDownloadUrl(osInfo.url);
+    }
+  }, [osInfo.url, selectedDownloadUrl]);
+
+  const handleDownloadSelected = useCallback(() => {
+    const downloadUrl = selectedDownloadUrl || osInfo.url;
+    if (downloadUrl) {
+      window.open(downloadUrl, '_blank', 'noopener');
+    }
+  }, [selectedDownloadUrl, osInfo.url]);
+
+  return {
+    osInfo,
+    osOptions,
+    selectedDownloadUrl,
+    setSelectedDownloadUrl,
+    handleDownloadSelected,
+  };
+}
+

frontend/src/core/components/onboarding/useOnboardingEffects.ts

@@ -0,0 +1,74 @@
+import { useEffect, useCallback, useState } from 'react';
+import {
+  SERVER_LICENSE_REQUEST_EVENT,
+  START_TOUR_EVENT,
+  type ServerLicenseRequestPayload,
+  type TourType,
+  type StartTourPayload,
+} from '@app/constants/events';
+import type { OnboardingRuntimeState } from '@app/components/onboarding/orchestrator/onboardingConfig';
+
+export function useServerLicenseRequest(): {
+  showLicenseSlide: boolean;
+  licenseNotice: OnboardingRuntimeState['licenseNotice'] | null;
+  closeLicenseSlide: () => void;
+} {
+  const [showLicenseSlide, setShowLicenseSlide] = useState(false);
+  const [licenseNotice, setLicenseNotice] = useState<OnboardingRuntimeState['licenseNotice'] | null>(null);
+
+  useEffect(() => {
+    if (typeof window === 'undefined') return;
+
+    const handleLicenseRequest = (event: Event) => {
+      const { detail } = event as CustomEvent<ServerLicenseRequestPayload>;
+      
+      if (detail?.licenseNotice) {
+        setLicenseNotice({
+          totalUsers: detail.licenseNotice.totalUsers ?? null,
+          freeTierLimit: detail.licenseNotice.freeTierLimit ?? 5,
+          isOverLimit: detail.licenseNotice.isOverLimit ?? false,
+          requiresLicense: true,
+        });
+      }
+      
+      setShowLicenseSlide(true);
+    };
+
+    window.addEventListener(SERVER_LICENSE_REQUEST_EVENT, handleLicenseRequest);
+    return () => window.removeEventListener(SERVER_LICENSE_REQUEST_EVENT, handleLicenseRequest);
+  }, []);
+
+  const closeLicenseSlide = useCallback(() => {
+    setShowLicenseSlide(false);
+  }, []);
+
+  return { showLicenseSlide, licenseNotice, closeLicenseSlide };
+}
+
+export function useTourRequest(): {
+  tourRequested: boolean;
+  requestedTourType: TourType;
+  clearTourRequest: () => void;
+} {
+  const [tourRequested, setTourRequested] = useState(false);
+  const [requestedTourType, setRequestedTourType] = useState<TourType>('tools');
+
+  useEffect(() => {
+    if (typeof window === 'undefined') return;
+
+    const handleTourRequest = (event: Event) => {
+      const { detail } = event as CustomEvent<StartTourPayload>;
+      setRequestedTourType(detail?.tourType ?? 'tools');
+      setTourRequested(true);
+    };
+
+    window.addEventListener(START_TOUR_EVENT, handleTourRequest);
+    return () => window.removeEventListener(START_TOUR_EVENT, handleTourRequest);
+  }, []);
+
+  const clearTourRequest = useCallback(() => {
+    setTourRequested(false);
+  }, []);
+
+  return { tourRequested, requestedTourType, clearTourRequest };
+}

frontend/src/core/components/onboarding/userStepsConfig.ts

@@ -1,6 +1,26 @@
 import type { StepType } from '@reactour/tour';
 import type { TFunction } from 'i18next';
-import { TourStep } from '@app/components/onboarding/tourSteps';
+
+export enum TourStep {
+  ALL_TOOLS,
+  SELECT_CROP_TOOL,
+  TOOL_INTERFACE,
+  FILES_BUTTON,
+  FILE_SOURCES,
+  WORKBENCH,
+  VIEW_SWITCHER,
+  VIEWER,
+  PAGE_EDITOR,
+  ACTIVE_FILES,
+  FILE_CHECKBOX,
+  SELECT_CONTROLS,
+  CROP_SETTINGS,
+  RUN_BUTTON,
+  RESULTS,
+  FILE_REPLACEMENT,
+  PIN_BUTTON,
+  WRAP_UP,
+}
 
 interface UserStepActions {
   saveWorkbenchState: () => void;

frontend/src/core/components/shared/AppConfigModal.tsx

@@ -7,7 +7,7 @@ import { NavKey, VALID_NAV_KEYS } from '@app/components/shared/config/types';
 import { useAppConfig } from '@app/contexts/AppConfigContext';
 import '@app/components/shared/AppConfigModal.css';
 import { useIsMobile } from '@app/hooks/useIsMobile';
-import { Z_INDEX_OVER_FULLSCREEN_SURFACE, Z_INDEX_OVER_CONFIG_MODAL } from '@app/styles/zIndex';
+import { Z_INDEX_CONFIG_MODAL, Z_INDEX_OVER_CONFIG_MODAL } from '@app/styles/zIndex';
 import { useLicenseAlert } from '@app/hooks/useLicenseAlert';
 import { UnsavedChangesProvider, useUnsavedChanges } from '@app/contexts/UnsavedChangesContext';
 
@@ -122,7 +122,7 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({ opened, onClose })
       centered
       radius="lg"
       withCloseButton={false}
-      zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
+      zIndex={Z_INDEX_CONFIG_MODAL}
       overlayProps={{ opacity: 0.35, blur: 2 }}
       padding={0}
       fullScreen={isMobile}

frontend/src/core/components/shared/Footer.tsx

@@ -1,6 +1,7 @@
 import { Flex } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
 import { useCookieConsent } from '@app/hooks/useCookieConsent';
+import { useFooterInfo } from '@app/hooks/useFooterInfo';
 
 interface FooterProps {
   privacyPolicy?: string;
@@ -9,6 +10,7 @@ interface FooterProps {
   cookiePolicy?: string;
   impressum?: string;
   analyticsEnabled?: boolean;
+  forceLightMode?: boolean;
 }
 
 export default function Footer({
@@ -17,10 +19,36 @@ export default function Footer({
   accessibilityStatement,
   cookiePolicy,
   impressum,
-  analyticsEnabled = false
+  analyticsEnabled,
+  forceLightMode = false
 }: FooterProps) {
   const { t } = useTranslation();
-  const { showCookiePreferences } = useCookieConsent({ analyticsEnabled });
+  const { footerInfo } = useFooterInfo();
+
+  console.log('[Footer] Props analyticsEnabled:', analyticsEnabled);
+  console.log('[Footer] Fetched footerInfo:', footerInfo);
+
+  // Use props if provided, otherwise fall back to fetched footer info
+  const finalAnalyticsEnabled = analyticsEnabled ?? footerInfo?.analyticsEnabled ?? false;
+  const finalPrivacyPolicy = privacyPolicy ?? footerInfo?.privacyPolicy;
+  const finalTermsAndConditions = termsAndConditions ?? footerInfo?.termsAndConditions;
+  const finalAccessibilityStatement = accessibilityStatement ?? footerInfo?.accessibilityStatement;
+  const finalCookiePolicy = cookiePolicy ?? footerInfo?.cookiePolicy;
+  const finalImpressum = impressum ?? footerInfo?.impressum;
+
+  console.log('[Footer] Final analyticsEnabled:', finalAnalyticsEnabled);
+
+  const { showCookiePreferences } = useCookieConsent({ analyticsEnabled: finalAnalyticsEnabled, forceLightMode });
+
+  // Default URLs
+  const defaultTermsUrl = "https://www.stirling.com/legal/terms-of-service";
+  const defaultPrivacyUrl = "https://www.stirling.com/legal/privacy-policy";
+  const defaultAccessibilityUrl = "https://www.stirling.com/accessibility";
+
+  // Use provided URLs or fall back to defaults
+  const finalTermsUrl = finalTermsAndConditions || defaultTermsUrl;
+  const finalPrivacyUrl = finalPrivacyPolicy || defaultPrivacyUrl;
+  const finalAccessibilityUrl = finalAccessibilityStatement || defaultAccessibilityUrl;
 
   // Helper to check if a value is valid (not null/undefined/empty string)
   const isValidLink = (link?: string) => link && link.trim().length > 0;
@@ -28,8 +56,8 @@ export default function Footer({
   return (
     <div style={{
       height: 'var(--footer-height)',
-      backgroundColor: 'var(--mantine-color-gray-1)',
-      borderTop: '1px solid var(--mantine-color-gray-2)',
+      backgroundColor: forceLightMode ? '#f1f3f5' : 'var(--mantine-color-gray-1)',
+      borderTop: forceLightMode ? '1px solid #e9ecef' : '1px solid var(--mantine-color-gray-2)',
       display: 'flex',
       flexDirection: 'column',
       justifyContent: 'center',
@@ -38,7 +66,10 @@ export default function Footer({
           justify="center"
           align="center"
           direction="row"
-          style={{ fontSize: '0.75rem' }}>
+          style={{
+            fontSize: '0.75rem',
+            color: forceLightMode ? '#495057' : undefined
+          }}>
           <a
             className="footer-link px-3"
             id="survey"
@@ -48,57 +79,51 @@ export default function Footer({
           >
             {t('survey.nav', 'Survey')}
           </a>
-          {isValidLink(privacyPolicy) && (
+          <a
+            className="footer-link px-3"
+            target="_blank"
+            rel="noopener noreferrer"
+            href={finalPrivacyUrl}
+          >
+            {t('legal.privacy', 'Privacy Policy')}
+          </a>
+          <a
+            className="footer-link px-3"
+            target="_blank"
+            rel="noopener noreferrer"
+            href={finalTermsUrl}
+          >
+            {t('legal.terms', 'Terms and Conditions')}
+          </a>
+          <a
+            className="footer-link px-3"
+            target="_blank"
+            rel="noopener noreferrer"
+            href={finalAccessibilityUrl}
+          >
+            {t('legal.accessibility', 'Accessibility')}
+          </a>
+          {isValidLink(finalCookiePolicy) && (
             <a
               className="footer-link px-3"
               target="_blank"
               rel="noopener noreferrer"
-              href={privacyPolicy}
-            >
-              {t('legal.privacy', 'Privacy Policy')}
-            </a>
-          )}
-          {isValidLink(termsAndConditions) && (
-            <a
-              className="footer-link px-3"
-              target="_blank"
-              rel="noopener noreferrer"
-              href={termsAndConditions}
-            >
-              {t('legal.terms', 'Terms and Conditions')}
-            </a>
-          )}
-          {isValidLink(accessibilityStatement) && (
-            <a
-              className="footer-link px-3"
-              target="_blank"
-              rel="noopener noreferrer"
-              href={accessibilityStatement}
-            >
-              {t('legal.accessibility', 'Accessibility')}
-            </a>
-          )}
-          {isValidLink(cookiePolicy) && (
-            <a
-              className="footer-link px-3"
-              target="_blank"
-              rel="noopener noreferrer"
-              href={cookiePolicy}
+              href={finalCookiePolicy}
             >
               {t('legal.cookie', 'Cookie Policy')}
             </a>
           )}
-          {isValidLink(impressum) && (
+          {isValidLink(finalImpressum) && (
             <a
               className="footer-link px-3"
               target="_blank"
               rel="noopener noreferrer"
-              href={impressum}
+              href={finalImpressum}
             >
               {t('legal.impressum', 'Impressum')}
             </a>
           )}
-          {analyticsEnabled && (
+          {finalAnalyticsEnabled && (
             <button
               className="footer-link px-3"
               id="cookieBanner"

frontend/src/core/components/shared/InfoBanner.tsx

@@ -130,11 +130,6 @@ export const InfoBanner: React.FC<InfoBannerProps> = ({
               onClick={onButtonClick}
               loading={loading}
               leftSection={<LocalIcon icon={buttonIcon} width="0.9rem" height="0.9rem" />}
-              styles={{
-                label: {
-                  color: textColor ?? toneStyle.text,
-                },
-              }}
             >
               {buttonText}
             </Button>

frontend/src/core/components/shared/LanguageSelector.tsx

@@ -1,5 +1,6 @@
 import React, { useState, useEffect } from 'react';
-import { Menu, Button, ScrollArea, ActionIcon, Tooltip } from '@mantine/core';
+import { Menu, Button, ActionIcon } from '@mantine/core';
+import { Tooltip } from '@app/components/shared/Tooltip';
 import { useTranslation } from 'react-i18next';
 import { supportedLanguages } from '@app/i18n';
 import LocalIcon from '@app/components/shared/LocalIcon';
@@ -11,6 +12,7 @@ interface LanguageSelectorProps {
   position?: React.ComponentProps<typeof Menu>['position'];
   offset?: number;
   compact?: boolean; // icon-only trigger
+  tooltip?: string; // tooltip text for compact mode
 }
 
 interface LanguageOption {
@@ -51,7 +53,7 @@ const LanguageItem: React.FC<LanguageItemProps> = ({
   const { t } = useTranslation();
 
   const label = disabled ? (
-    <Tooltip label={t('comingSoon', 'Coming soon')} position="left" withArrow>
+    <Tooltip content={t('comingSoon', 'Coming soon')} position="left" arrow>
       <p>{option.label}</p>
     </Tooltip>
   ) : (
@@ -64,7 +66,7 @@ const LanguageItem: React.FC<LanguageItemProps> = ({
       style={{
         opacity: animationTriggered ? 1 : 0,
         transform: animationTriggered ? 'translateY(0px)' : 'translateY(8px)',
-        transition: `opacity 0.3s cubic-bezier(0.25, 0.46, 0.45, 0.94) ${index * 0.02}s, transform 0.3s cubic-bezier(0.25, 0.46, 0.45, 0.94) ${index * 0.02}s`,
+        transition: `opacity 0.15s cubic-bezier(0.25, 0.46, 0.45, 0.94) ${index * 0.01}s, transform 0.15s cubic-bezier(0.25, 0.46, 0.45, 0.94) ${index * 0.01}s`,
       }}
     >
       <Button
@@ -90,7 +92,7 @@ const LanguageItem: React.FC<LanguageItemProps> = ({
               : isSelected
               ? 'light-dark(var(--mantine-color-blue-9), var(--mantine-color-white))'
               : 'light-dark(var(--mantine-color-gray-7), var(--mantine-color-white))',
-            transition: 'all 0.2s cubic-bezier(0.25, 0.46, 0.45, 0.94)',
+            transition: 'all 0.12s cubic-bezier(0.25, 0.46, 0.45, 0.94)',
             cursor: disabled ? 'not-allowed' : 'pointer',
             '&:hover': !disabled ? {
               backgroundColor: isSelected
@@ -126,7 +128,7 @@ const LanguageItem: React.FC<LanguageItemProps> = ({
               backgroundColor: 'var(--mantine-color-blue-4)',
               opacity: 0.6,
               transform: 'translate(-50%, -50%)',
-              animation: 'ripple-expand 0.6s cubic-bezier(0.25, 0.46, 0.45, 0.94)',
+              animation: 'ripple-expand 0.4s cubic-bezier(0.25, 0.46, 0.45, 0.94)',
               zIndex: 1,
             }}
           />
@@ -149,7 +151,12 @@ const RippleStyles: React.FC = () => (
 );
 
 // Main component
-const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-start', offset = 8, compact = false }) => {
+const LanguageSelector: React.FC<LanguageSelectorProps> = ({
+  position = 'bottom-start',
+  offset = 8,
+  compact = false,
+  tooltip
+}) => {
   const { i18n } = useTranslation();
   const [opened, setOpened] = useState(false);
   const [animationTriggered, setAnimationTriggered] = useState(false);
@@ -184,14 +191,14 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-
         setOpened(false);
 
         // Clear ripple effect
-        setTimeout(() => setRippleEffect(null), 100);
+        setTimeout(() => setRippleEffect(null), 50);
 
         // Force a full reload so RTL/LTR layout and tooltips re-evaluate correctly
         if (typeof window !== 'undefined') {
           window.location.reload();
         }
-      }, 300);
-    }, 200);
+      }, 150);
+    }, 100);
   };
 
   const currentLanguage = supportedLanguages[i18n.language as keyof typeof supportedLanguages] ||
@@ -202,7 +209,7 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-
     if (opened) {
       setAnimationTriggered(false);
       // Small delay to ensure DOM is ready
-      setTimeout(() => setAnimationTriggered(true), 50);
+      setTimeout(() => setAnimationTriggered(true), 20);
     }
   }, [opened]);
 
@@ -218,7 +225,7 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-
         zIndex={Z_INDEX_OVER_FULLSCREEN_SURFACE}
         transitionProps={{
           transition: 'scale-y',
-          duration: 200,
+          duration: 120,
           timingFunction: 'cubic-bezier(0.25, 0.46, 0.45, 0.94)'
         }}
       >
@@ -227,8 +234,8 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-
             <ActionIcon
               variant="subtle"
               radius="md"
-              title={currentLanguage}
               className="right-rail-icon"
+              title={!opened && tooltip ? tooltip : undefined}
               styles={{
                 root: {
                   color: 'var(--right-rail-icon)',
@@ -274,8 +281,7 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-
             zIndex: Z_INDEX_OVER_FULLSCREEN_SURFACE,
           }}
         >
-          <ScrollArea h={190} type="scroll">
-            <div className={styles.languageGrid}>
+          <div className={styles.languageGrid}>
               {languageOptions.map((option, index) => {
                 const enabledLanguages = [
                   'en-GB', 'zh-CN', 'zh-TW', 'ar-AR', 'fa-IR', 'tr-TR', 'uk-UA', 'zh-BO', 'sl-SI',
@@ -301,8 +307,7 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({ position = 'bottom-
                   />
                 );
               })}
-            </div>
-          </ScrollArea>
+          </div>
         </Menu.Dropdown>
       </Menu>
     </>

frontend/src/core/components/shared/QuickAccessBar.tsx

@@ -15,8 +15,8 @@ import AllToolsNavButton from '@app/components/shared/AllToolsNavButton';
 import ActiveToolButton from "@app/components/shared/quickAccessBar/ActiveToolButton";
 import AppConfigModal from '@app/components/shared/AppConfigModal';
 import { useAppConfig } from '@app/contexts/AppConfigContext';
-import { useOnboarding } from '@app/contexts/OnboardingContext';
 import { useLicenseAlert } from "@app/hooks/useLicenseAlert";
+import { requestStartTour } from '@app/constants/events';
 
 import {
   isNavButtonActive,
@@ -34,7 +34,6 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
   const { handleReaderToggle, handleToolSelect, selectedToolKey, leftPanelView, toolRegistry, readerMode, resetTool } = useToolWorkflow();
   const { getToolNavigation } = useSidebarNavigation();
   const { config } = useAppConfig();
-  const { startTour } = useOnboarding();
   const licenseAlert = useLicenseAlert();
   const [configModalOpen, setConfigModalOpen] = useState(false);
   const [activeButton, setActiveButton] = useState<string>('tools');
@@ -269,7 +268,7 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
                     <div
                       key={buttonConfig.id}
                       data-tour="help-button"
-                      onClick={() => startTour('tools')}
+                      onClick={() => requestStartTour('tools')}
                     >
                       {renderNavButton(buttonConfig, index)}
                     </div>
@@ -286,7 +285,7 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
                       <Menu.Dropdown>
                         <Menu.Item
                           leftSection={<LocalIcon icon="view-carousel-rounded" width="1.25rem" height="1.25rem" />}
-                          onClick={() => startTour('tools')}
+                          onClick={() => requestStartTour('tools')}
                         >
                           <div>
                             <div style={{ fontWeight: 500 }}>
@@ -299,7 +298,7 @@ const QuickAccessBar = forwardRef<HTMLDivElement>((_, ref) => {
                         </Menu.Item>
                         <Menu.Item
                           leftSection={<LocalIcon icon="admin-panel-settings-rounded" width="1.25rem" height="1.25rem" />}
-                          onClick={() => startTour('admin')}
+                          onClick={() => requestStartTour('admin')}
                         >
                           <div>
                             <div style={{ fontWeight: 500 }}>

frontend/src/core/components/shared/RightRail.tsx

@@ -216,14 +216,12 @@ export default function RightRail() {
             tooltipOffset
           )}
 
-          {renderWithTooltip(
-            <div style={{ display: 'inline-flex' }}>
-              <LanguageSelector position="left-start" offset={6} compact />
-            </div>,
-            t('rightRail.language', 'Language'),
-            tooltipPosition,
-            tooltipOffset
-          )}
+          <LanguageSelector
+            position="left-start"
+            offset={6}
+            compact
+            tooltip={t('rightRail.language', 'Language')}
+          />
 
           {renderWithTooltip(
             <ActionIcon

frontend/src/core/components/tools/ToolPanelModePrompt.tsx

@@ -3,65 +3,39 @@ import { Badge, Button, Card, Group, Modal, Stack, Text } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
 import { useToolWorkflow } from '@app/contexts/ToolWorkflowContext';
 import { usePreferences } from '@app/contexts/PreferencesContext';
-import { useOnboarding } from '@app/contexts/OnboardingContext';
 import '@app/components/tools/ToolPanelModePrompt.css';
 import { type ToolPanelMode } from '@app/constants/toolPanel';
-import { useAppConfig } from '@app/contexts/AppConfigContext';
 
 interface ToolPanelModePromptProps {
   onComplete?: () => void;
+  /** If true, the modal will be forced open (used by orchestrator) */
+  forceOpen?: boolean;
 }
 
-const ToolPanelModePrompt = ({ onComplete }: ToolPanelModePromptProps = {}) => {
+/**
+ * ToolPanelModePrompt - Lets users choose between sidebar and fullscreen tool modes
+ * 
+ * The orchestrator controls this via forceOpen prop. When shown standalone (legacy),
+ * it uses internal state based on preferences.
+ */
+const ToolPanelModePrompt = ({ onComplete, forceOpen }: ToolPanelModePromptProps = {}) => {
   const { t } = useTranslation();
   const { toolPanelMode, setToolPanelMode } = useToolWorkflow();
   const { preferences, updatePreference } = usePreferences();
-  const {
-    startTour,
-    startAfterToolModeSelection,
-    setStartAfterToolModeSelection,
-    pendingTourRequest,
-  } = useOnboarding();
-  const [opened, setOpened] = useState(false);
-  const { config } = useAppConfig();
-  const isAdmin = !!config?.isAdmin;
+  const [internalOpened, setInternalOpened] = useState(false);
 
-  // Only show after the new 3-slide onboarding has been completed
+  // Only show after the intro onboarding has been completed (legacy standalone mode)
   const shouldShowPrompt = !preferences.toolPanelModePromptSeen && preferences.hasSeenIntroOnboarding;
 
   useEffect(() => {
-    if (shouldShowPrompt) {
-      setOpened(true);
+    if (shouldShowPrompt && forceOpen === undefined) {
+      setInternalOpened(true);
     }
-  }, [shouldShowPrompt]);
+  }, [shouldShowPrompt, forceOpen]);
 
-  const resolveRequestedTourType = (): 'admin' | 'tools' => {
-    if (pendingTourRequest?.type) {
-      return pendingTourRequest.type;
-    }
-    if (pendingTourRequest?.metadata && 'selfReportedAdmin' in pendingTourRequest.metadata) {
-      return pendingTourRequest.metadata.selfReportedAdmin ? 'admin' : 'tools';
-    }
-    return isAdmin ? 'admin' : 'tools';
-  };
-
-  const resumeDeferredTour = (context?: { selection?: ToolPanelMode; dismissed?: boolean }) => {
-    if (!startAfterToolModeSelection) {
-      return;
-    }
-    setStartAfterToolModeSelection(false);
-    const targetType = resolveRequestedTourType();
-    startTour(targetType, {
-      skipToolPromptRequirement: true,
-      source: 'tool-panel-mode-prompt',
-      metadata: {
-        ...pendingTourRequest?.metadata,
-        resumedFromToolPrompt: true,
-        ...(context?.selection ? { selection: context.selection } : {}),
-        ...(context?.dismissed ? { dismissed: true } : {}),
-      },
-    });
-  };
+  // If forceOpen is provided, use it; otherwise use internal state
+  const opened = forceOpen ?? internalOpened;
+  const setOpened = forceOpen !== undefined ? () => {} : setInternalOpened;
 
   const handleSelect = (mode: ToolPanelMode) => {
     setToolPanelMode(mode);
@@ -69,8 +43,6 @@ const ToolPanelModePrompt = ({ onComplete }: ToolPanelModePromptProps = {}) => {
     updatePreference('toolPanelModePromptSeen', true);
     updatePreference('hasSelectedToolPanelMode', true);
     setOpened(false);
-
-    resumeDeferredTour({ selection: mode });
     onComplete?.();
   };
 
@@ -83,7 +55,6 @@ const ToolPanelModePrompt = ({ onComplete }: ToolPanelModePromptProps = {}) => {
     updatePreference('hasSelectedToolPanelMode', true);
     updatePreference('toolPanelModePromptSeen', true);
     setOpened(false);
-    resumeDeferredTour({ dismissed: true });
     onComplete?.();
   };
 

frontend/src/core/components/tools/ocr/LanguagePicker.tsx

@@ -1,7 +1,8 @@
 import React, { useState, useEffect } from 'react';
 import { Text, Loader } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
-import { tempOcrLanguages, getAutoOcrLanguage } from '@app/utils/languageMapping';
+import { getAutoOcrLanguage, getBrowserLanguagesForOcr, getOcrDisplayName } from '@app/utils/languageMapping';
+import apiClient from '@app/services/apiClient';
 import DropdownListWithFooter, { DropdownItem } from '@app/components/shared/DropdownListWithFooter';
 
 export interface LanguageOption {
@@ -37,32 +38,41 @@ const LanguagePicker: React.FC<LanguagePickerProps> = ({
     // Fetch available languages from backend
     const fetchLanguages = async () => {
       try {
-        const response = await fetch(languagesEndpoint);
+        const { data } = await apiClient.get<{ languages: string[] }>(languagesEndpoint);
 
+        const displayNames = typeof Intl.DisplayNames !== 'undefined'
+          ? new Intl.DisplayNames([i18n.language], { type: 'language' })
+          : null;
 
-        if (response.ok) {
-          const data: { languages: string[] } = await response.json();
-          const languages = data.languages;
+        const languageOptions = [...new Set(data.languages)]
+          .map((lang) => {
+            const displayName = getOcrDisplayName(lang);
+            const browserLanguageCodes = getBrowserLanguagesForOcr(lang);
 
+            const langKey = `lang.${lang}`;
+            const translatedFromKey = t(langKey);
+            const hasKeyTranslation = translatedFromKey !== langKey;
 
-          const languageOptions = languages.map(lang => {
-            // TODO: Use actual language translations when they become available
-            // For now, use temporary English translations
-            const translatedName = tempOcrLanguages.lang[lang as keyof typeof tempOcrLanguages.lang] || lang;
-            const displayName = translatedName;
+            const intlTranslatedName = displayNames
+              ? browserLanguageCodes
+                  .map((code) => displayNames.of(code))
+                  .find((name): name is string => Boolean(name))
+              : null;
+
+            const translatedName =
+              (hasKeyTranslation ? translatedFromKey : null)
+              || intlTranslatedName
+              || t(`ocr.languages.${lang}`, displayName);
 
             return {
               value: lang,
-              name: displayName
+              name: translatedName,
+              label: translatedName
             };
-          });
+          })
+          .sort((a, b) => a.name.localeCompare(b.name, i18n.language));
 
-          setAvailableLanguages(languageOptions);
-        } else {
-          console.error('[LanguagePicker] Response not OK:', response.status, response.statusText);
-          const errorText = await response.text();
-          console.error('[LanguagePicker] Error response body:', errorText);
-        }
+        setAvailableLanguages(languageOptions);
       } catch (error) {
         console.error('[LanguagePicker] Fetch failed with error:', error);
         console.error('[LanguagePicker] Error details:', {
@@ -76,7 +86,7 @@ const LanguagePicker: React.FC<LanguagePickerProps> = ({
     };
 
     fetchLanguages();
-  }, [languagesEndpoint]);
+  }, [languagesEndpoint, i18n.language, t]);
 
   // Auto-fill OCR language based on browser language when languages are loaded
   useEffect(() => {

frontend/src/core/components/tools/sign/SavedSignaturesSection.tsx

@@ -1,13 +1,15 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { ActionIcon, Alert, Badge, Box, Card, Group, Stack, Text, TextInput, Tooltip } from '@mantine/core';
 import { LocalIcon } from '@app/components/shared/LocalIcon';
 import { MAX_SAVED_SIGNATURES, SavedSignature, SavedSignatureType } from '@app/hooks/tools/sign/useSavedSignatures';
+import type { StorageType } from '@app/services/signatureStorageService';
 
 interface SavedSignaturesSectionProps {
   signatures: SavedSignature[];
   disabled?: boolean;
   isAtCapacity: boolean;
+  storageType?: StorageType | null;
   onUseSignature: (signature: SavedSignature) => void;
   onDeleteSignature: (signature: SavedSignature) => void;
   onRenameSignature: (id: string, label: string) => void;
@@ -24,6 +26,7 @@ export const SavedSignaturesSection = ({
   signatures,
   disabled = false,
   isAtCapacity,
+  storageType: _storageType,
   onUseSignature,
   onDeleteSignature,
   onRenameSignature,
@@ -36,20 +39,30 @@ export const SavedSignaturesSection = ({
     [t, translationScope]
   );
   const [labelDrafts, setLabelDrafts] = useState<Record<string, string>>({});
-  const [activeIndex, setActiveIndex] = useState(0);
-  const activeSignature = signatures[activeIndex];
-  const activeSignatureRef = useRef<SavedSignature | null>(activeSignature ?? null);
-  const appliedSignatureIdRef = useRef<string | null>(null);
+
+  // Group signatures by scope
+  const groupedSignatures = useMemo(() => {
+    const personal = signatures.filter(sig => sig.scope === 'personal');
+    const shared = signatures.filter(sig => sig.scope === 'shared');
+    const localStorage = signatures.filter(sig => sig.scope === 'localStorage');
+    return { personal, shared, localStorage };
+  }, [signatures]);
+
+  // Separate carousel state for each category
+  const [activePersonalIndex, setActivePersonalIndex] = useState(0);
+  const [activeSharedIndex, setActiveSharedIndex] = useState(0);
+  const [activeLocalStorageIndex, setActiveLocalStorageIndex] = useState(0);
+
+  const activePersonalSignature = groupedSignatures.personal[activePersonalIndex];
+  const activeSharedSignature = groupedSignatures.shared[activeSharedIndex];
+  const activeLocalStorageSignature = groupedSignatures.localStorage[activeLocalStorageIndex];
+
   const onUseSignatureRef = useRef(onUseSignature);
 
   useEffect(() => {
     onUseSignatureRef.current = onUseSignature;
   }, [onUseSignature]);
 
-  useEffect(() => {
-    activeSignatureRef.current = activeSignature ?? null;
-  }, [activeSignature]);
-
   useEffect(() => {
     setLabelDrafts(prev => {
       const nextDrafts: Record<string, string> = {};
@@ -60,25 +73,18 @@ export const SavedSignaturesSection = ({
     });
   }, [signatures]);
 
+  // Reset carousel indices when categories change
   useEffect(() => {
-    if (signatures.length === 0) {
-      setActiveIndex(0);
-      return;
-    }
-    setActiveIndex(prev => Math.min(prev, Math.max(signatures.length - 1, 0)));
-  }, [signatures.length]);
+    setActivePersonalIndex(prev => Math.min(prev, Math.max(groupedSignatures.personal.length - 1, 0)));
+  }, [groupedSignatures.personal.length]);
 
-  const handleNavigate = useCallback(
-    (direction: 'prev' | 'next') => {
-      setActiveIndex(prev => {
-        if (direction === 'prev') {
-          return Math.max(0, prev - 1);
-        }
-        return Math.min(signatures.length - 1, prev + 1);
-      });
-    },
-    [signatures.length]
-  );
+  useEffect(() => {
+    setActiveSharedIndex(prev => Math.min(prev, Math.max(groupedSignatures.shared.length - 1, 0)));
+  }, [groupedSignatures.shared.length]);
+
+  useEffect(() => {
+    setActiveLocalStorageIndex(prev => Math.min(prev, Math.max(groupedSignatures.localStorage.length - 1, 0)));
+  }, [groupedSignatures.localStorage.length]);
 
   const renderPreview = (signature: SavedSignature) => {
     if (signature.type === 'text') {
@@ -193,21 +199,6 @@ export const SavedSignaturesSection = ({
     }
   };
 
-  useEffect(() => {
-    const signature = activeSignatureRef.current;
-    if (!signature || disabled) {
-      appliedSignatureIdRef.current = null;
-      return;
-    }
-
-    if (appliedSignatureIdRef.current === signature.id) {
-      return;
-    }
-
-    appliedSignatureIdRef.current = signature.id;
-    onUseSignatureRef.current(signature);
-  }, [activeSignature?.id, disabled]);
-
   return (
     <Stack gap="sm">
       <Group justify="space-between" align="flex-start">
@@ -234,67 +225,253 @@ export const SavedSignaturesSection = ({
       {signatures.length === 0 ? (
         emptyState
       ) : (
-        <Stack gap="xs">
-          <Group justify="space-between" align="center">
-            <Text size="sm" c="dimmed">
-              {translate('saved.carouselPosition', '{{current}} of {{total}}', {
-                current: activeIndex + 1,
-                total: signatures.length,
-              })}
-            </Text>
-            <Group gap={4}>
-              <ActionIcon
-                variant="light"
-                aria-label={translate('saved.prev', 'Previous')}
-                onClick={() => handleNavigate('prev')}
-                disabled={disabled || activeIndex === 0}
-              >
-                <LocalIcon icon="material-symbols:chevron-left-rounded" width={18} height={18} />
-              </ActionIcon>
-              <ActionIcon
-                variant="light"
-                aria-label={translate('saved.next', 'Next')}
-                onClick={() => handleNavigate('next')}
-                disabled={disabled || activeIndex >= signatures.length - 1}
-              >
-                <LocalIcon icon="material-symbols:chevron-right-rounded" width={18} height={18} />
-              </ActionIcon>
-            </Group>
-          </Group>
+        <Stack gap="md">
+          {/* Personal Signatures */}
+          {groupedSignatures.personal.length > 0 && activePersonalSignature && (
+            <Stack gap="xs">
+              <Group gap="xs">
+                <LocalIcon icon="material-symbols:person-rounded" width={18} height={18} />
+                <Text fw={600} size="sm">
+                  {translate('saved.personalHeading', 'Personal Signatures')}
+                </Text>
+              </Group>
+              <Text size="xs" c="dimmed">
+                {translate('saved.personalDescription', 'Only you can see these signatures.')}
+              </Text>
 
-          {activeSignature && (
-            <Card withBorder padding="sm" key={activeSignature.id}>
-              <Stack gap="sm">
-                <Group justify="space-between" align="center">
-                  <Badge color={typeBadgeColor[activeSignature.type]} variant="light">
-                    {typeLabel(activeSignature.type)}
-                  </Badge>
-                  <Tooltip label={translate('saved.delete', 'Remove')}>
-                    <ActionIcon
-                      variant="subtle"
-                      color="red"
-                      aria-label={translate('saved.delete', 'Remove')}
-                      onClick={() => onDeleteSignature(activeSignature)}
-                      disabled={disabled}
-                    >
-                      <LocalIcon icon="material-symbols:delete-outline-rounded" width={18} height={18} />
-                    </ActionIcon>
-                  </Tooltip>
+              <Group justify="space-between" align="center">
+                <Text size="sm" c="dimmed">
+                  {translate('saved.carouselPosition', '{{current}} of {{total}}', {
+                    current: activePersonalIndex + 1,
+                    total: groupedSignatures.personal.length,
+                  })}
+                </Text>
+                <Group gap={4}>
+                  <ActionIcon
+                    variant="light"
+                    aria-label={translate('saved.prev', 'Previous')}
+                    onClick={() => setActivePersonalIndex(prev => Math.max(0, prev - 1))}
+                    disabled={disabled || activePersonalIndex === 0}
+                  >
+                    <LocalIcon icon="material-symbols:chevron-left-rounded" width={18} height={18} />
+                  </ActionIcon>
+                  <ActionIcon
+                    variant="light"
+                    aria-label={translate('saved.next', 'Next')}
+                    onClick={() => setActivePersonalIndex(prev => Math.min(groupedSignatures.personal.length - 1, prev + 1))}
+                    disabled={disabled || activePersonalIndex >= groupedSignatures.personal.length - 1}
+                  >
+                    <LocalIcon icon="material-symbols:chevron-right-rounded" width={18} height={18} />
+                  </ActionIcon>
                 </Group>
+              </Group>
 
-                {renderPreview(activeSignature)}
+              <Card withBorder padding="sm">
+                <Stack gap="sm">
+                  <Group justify="space-between" align="center">
+                    <Badge color={typeBadgeColor[activePersonalSignature.type]} variant="light">
+                      {typeLabel(activePersonalSignature.type)}
+                    </Badge>
+                    <Group gap="xs">
+                      <ActionIcon
+                        variant="subtle"
+                        color="blue"
+                        aria-label="Use signature"
+                        onClick={() => onUseSignature(activePersonalSignature)}
+                        disabled={disabled}
+                      >
+                        <LocalIcon icon="material-symbols:check-circle-outline-rounded" width={18} height={18} />
+                      </ActionIcon>
+                      <Tooltip label={translate('saved.delete', 'Remove')}>
+                        <ActionIcon
+                          variant="subtle"
+                          color="red"
+                          aria-label={translate('saved.delete', 'Remove')}
+                          onClick={() => onDeleteSignature(activePersonalSignature)}
+                          disabled={disabled}
+                        >
+                          <LocalIcon icon="material-symbols:delete-outline-rounded" width={18} height={18} />
+                        </ActionIcon>
+                      </Tooltip>
+                    </Group>
+                  </Group>
+                  {renderPreview(activePersonalSignature)}
+                  <TextInput
+                    label={translate('saved.label', 'Label')}
+                    value={labelDrafts[activePersonalSignature.id] ?? activePersonalSignature.label}
+                    onChange={event => handleLabelChange(event, activePersonalSignature)}
+                    onBlur={() => handleLabelBlur(activePersonalSignature)}
+                    onKeyDown={event => handleLabelKeyDown(event, activePersonalSignature)}
+                    disabled={disabled}
+                  />
+                </Stack>
+              </Card>
+            </Stack>
+          )}
 
-                <TextInput
-                  label={translate('saved.label', 'Label')}
-                  value={labelDrafts[activeSignature.id] ?? activeSignature.label}
-                  onChange={event => handleLabelChange(event, activeSignature)}
-                  onBlur={() => handleLabelBlur(activeSignature)}
-                  onKeyDown={event => handleLabelKeyDown(event, activeSignature)}
-                  disabled={disabled}
-                />
+          {/* Shared Signatures */}
+          {groupedSignatures.shared.length > 0 && activeSharedSignature && (
+            <Stack gap="xs">
+              <Group gap="xs">
+                <LocalIcon icon="material-symbols:groups-rounded" width={18} height={18} />
+                <Text fw={600} size="sm">
+                  {translate('saved.sharedHeading', 'Shared Signatures')}
+                </Text>
+              </Group>
+              <Text size="xs" c="dimmed">
+                {translate('saved.sharedDescription', 'All users can see and use these signatures.')}
+              </Text>
 
-              </Stack>
-            </Card>
+              <Group justify="space-between" align="center">
+                <Text size="sm" c="dimmed">
+                  {translate('saved.carouselPosition', '{{current}} of {{total}}', {
+                    current: activeSharedIndex + 1,
+                    total: groupedSignatures.shared.length,
+                  })}
+                </Text>
+                <Group gap={4}>
+                  <ActionIcon
+                    variant="light"
+                    aria-label={translate('saved.prev', 'Previous')}
+                    onClick={() => setActiveSharedIndex(prev => Math.max(0, prev - 1))}
+                    disabled={disabled || activeSharedIndex === 0}
+                  >
+                    <LocalIcon icon="material-symbols:chevron-left-rounded" width={18} height={18} />
+                  </ActionIcon>
+                  <ActionIcon
+                    variant="light"
+                    aria-label={translate('saved.next', 'Next')}
+                    onClick={() => setActiveSharedIndex(prev => Math.min(groupedSignatures.shared.length - 1, prev + 1))}
+                    disabled={disabled || activeSharedIndex >= groupedSignatures.shared.length - 1}
+                  >
+                    <LocalIcon icon="material-symbols:chevron-right-rounded" width={18} height={18} />
+                  </ActionIcon>
+                </Group>
+              </Group>
+
+              <Card withBorder padding="sm">
+                <Stack gap="sm">
+                  <Group justify="space-between" align="center">
+                    <Badge color={typeBadgeColor[activeSharedSignature.type]} variant="light">
+                      {typeLabel(activeSharedSignature.type)}
+                    </Badge>
+                    <Group gap="xs">
+                      <ActionIcon
+                        variant="subtle"
+                        color="blue"
+                        aria-label="Use signature"
+                        onClick={() => onUseSignature(activeSharedSignature)}
+                        disabled={disabled}
+                      >
+                        <LocalIcon icon="material-symbols:check-circle-outline-rounded" width={18} height={18} />
+                      </ActionIcon>
+                      <Tooltip label={translate('saved.delete', 'Remove')}>
+                        <ActionIcon
+                          variant="subtle"
+                          color="red"
+                          aria-label={translate('saved.delete', 'Remove')}
+                          onClick={() => onDeleteSignature(activeSharedSignature)}
+                          disabled={disabled}
+                        >
+                          <LocalIcon icon="material-symbols:delete-outline-rounded" width={18} height={18} />
+                        </ActionIcon>
+                      </Tooltip>
+                    </Group>
+                  </Group>
+                  {renderPreview(activeSharedSignature)}
+                  <TextInput
+                    label={translate('saved.label', 'Label')}
+                    value={labelDrafts[activeSharedSignature.id] ?? activeSharedSignature.label}
+                    onChange={event => handleLabelChange(event, activeSharedSignature)}
+                    onBlur={() => handleLabelBlur(activeSharedSignature)}
+                    onKeyDown={event => handleLabelKeyDown(event, activeSharedSignature)}
+                    disabled={disabled}
+                  />
+                </Stack>
+              </Card>
+            </Stack>
+          )}
+
+          {/* Browser Storage (localStorage) - Temporary */}
+          {groupedSignatures.localStorage.length > 0 && activeLocalStorageSignature && (
+            <Stack gap="xs">
+              <Alert color="blue" title={translate('saved.tempStorageTitle', 'Temporary browser storage')}>
+                <Text size="xs">
+                  {translate(
+                    'saved.tempStorageDescription',
+                    'Signatures are stored in your browser only. They will be lost if you clear browser data or switch browsers.'
+                  )}
+                </Text>
+              </Alert>
+
+              <Group justify="space-between" align="center">
+                <Text size="sm" c="dimmed">
+                  {translate('saved.carouselPosition', '{{current}} of {{total}}', {
+                    current: activeLocalStorageIndex + 1,
+                    total: groupedSignatures.localStorage.length,
+                  })}
+                </Text>
+                <Group gap={4}>
+                  <ActionIcon
+                    variant="light"
+                    aria-label={translate('saved.prev', 'Previous')}
+                    onClick={() => setActiveLocalStorageIndex(prev => Math.max(0, prev - 1))}
+                    disabled={disabled || activeLocalStorageIndex === 0}
+                  >
+                    <LocalIcon icon="material-symbols:chevron-left-rounded" width={18} height={18} />
+                  </ActionIcon>
+                  <ActionIcon
+                    variant="light"
+                    aria-label={translate('saved.next', 'Next')}
+                    onClick={() => setActiveLocalStorageIndex(prev => Math.min(groupedSignatures.localStorage.length - 1, prev + 1))}
+                    disabled={disabled || activeLocalStorageIndex >= groupedSignatures.localStorage.length - 1}
+                  >
+                    <LocalIcon icon="material-symbols:chevron-right-rounded" width={18} height={18} />
+                  </ActionIcon>
+                </Group>
+              </Group>
+
+              <Card withBorder padding="sm">
+                <Stack gap="sm">
+                  <Group justify="space-between" align="center">
+                    <Badge color={typeBadgeColor[activeLocalStorageSignature.type]} variant="light">
+                      {typeLabel(activeLocalStorageSignature.type)}
+                    </Badge>
+                    <Group gap="xs">
+                      <ActionIcon
+                        variant="subtle"
+                        color="blue"
+                        aria-label="Use signature"
+                        onClick={() => onUseSignature(activeLocalStorageSignature)}
+                        disabled={disabled}
+                      >
+                        <LocalIcon icon="material-symbols:check-circle-outline-rounded" width={18} height={18} />
+                      </ActionIcon>
+                      <Tooltip label={translate('saved.delete', 'Remove')}>
+                        <ActionIcon
+                          variant="subtle"
+                          color="red"
+                          aria-label={translate('saved.delete', 'Remove')}
+                          onClick={() => onDeleteSignature(activeLocalStorageSignature)}
+                          disabled={disabled}
+                        >
+                          <LocalIcon icon="material-symbols:delete-outline-rounded" width={18} height={18} />
+                        </ActionIcon>
+                      </Tooltip>
+                    </Group>
+                  </Group>
+                  {renderPreview(activeLocalStorageSignature)}
+                  <TextInput
+                    label={translate('saved.label', 'Label')}
+                    value={labelDrafts[activeLocalStorageSignature.id] ?? activeLocalStorageSignature.label}
+                    onChange={event => handleLabelChange(event, activeLocalStorageSignature)}
+                    onBlur={() => handleLabelBlur(activeLocalStorageSignature)}
+                    onKeyDown={event => handleLabelKeyDown(event, activeLocalStorageSignature)}
+                    disabled={disabled}
+                  />
+                </Stack>
+              </Card>
+            </Stack>
           )}
         </Stack>
       )}

frontend/src/core/components/tools/sign/SignSettings.tsx

@@ -16,6 +16,7 @@ import { ColorPicker } from "@app/components/annotation/shared/ColorPicker";
 import { LocalIcon } from "@app/components/shared/LocalIcon";
 import { useSavedSignatures, SavedSignature, SavedSignaturePayload, SavedSignatureType, MAX_SAVED_SIGNATURES, AddSignatureResult } from '@app/hooks/tools/sign/useSavedSignatures';
 import { SavedSignaturesSection } from '@app/components/tools/sign/SavedSignaturesSection';
+import { buildSignaturePreview } from '@app/utils/signaturePreview';
 
 type SignatureDrafts = {
   canvas?: string;
@@ -99,6 +100,7 @@ const SignSettings = ({
     removeSignature,
     updateSignatureLabel,
     byTypeCounts,
+    storageType,
   } = useSavedSignatures();
   const [signatureSource, setSignatureSource] = useState<SignatureSource>(() => {
     const paramSource = parameters.signatureType as SignatureSource;
@@ -157,11 +159,11 @@ const SignSettings = ({
   }, [canvasSignatureData, imageSignatureData, buildTextSignatureKey, parameters.signerName, parameters.fontSize, parameters.fontFamily, parameters.textColor]);
 
   const saveSignatureToLibrary = useCallback(
-    (payload: SavedSignaturePayload, type: SavedSignatureType): AddSignatureResult => {
+    async (payload: SavedSignaturePayload, type: SavedSignatureType, scope: 'personal' | 'shared'): Promise<AddSignatureResult> => {
       if (isSavedSignatureLimitReached) {
         return { success: false, reason: 'limit' };
       }
-      return addSignature(payload, getDefaultSavedLabel(type));
+      return await addSignature(payload, getDefaultSavedLabel(type), scope);
     },
     [addSignature, getDefaultSavedLabel, isSavedSignatureLimitReached]
   );
@@ -176,40 +178,57 @@ const SignSettings = ({
     [signatureKeysByType]
   );
 
-  const handleSaveCanvasSignature = useCallback(() => {
+  const handleSaveCanvasSignature = useCallback(async (scope: 'personal' | 'shared') => {
     if (!canvasSignatureData) {
       return;
     }
-    const result = saveSignatureToLibrary({ type: 'canvas', dataUrl: canvasSignatureData }, 'canvas');
+    const result = await saveSignatureToLibrary({ type: 'canvas', dataUrl: canvasSignatureData }, 'canvas', scope);
     if (result.success) {
       setLastSavedKeyForType('canvas');
     }
   }, [canvasSignatureData, saveSignatureToLibrary, setLastSavedKeyForType]);
 
-  const handleSaveImageSignature = useCallback(() => {
+  const handleSaveImageSignature = useCallback(async (scope: 'personal' | 'shared') => {
     if (!imageSignatureData) {
       return;
     }
-    const result = saveSignatureToLibrary({ type: 'image', dataUrl: imageSignatureData }, 'image');
+    const result = await saveSignatureToLibrary({ type: 'image', dataUrl: imageSignatureData }, 'image', scope);
     if (result.success) {
       setLastSavedKeyForType('image');
     }
   }, [imageSignatureData, saveSignatureToLibrary, setLastSavedKeyForType]);
 
-  const handleSaveTextSignature = useCallback(() => {
+  const handleSaveTextSignature = useCallback(async (scope: 'personal' | 'shared') => {
     const signerName = (parameters.signerName ?? '').trim();
     if (!signerName) {
       return;
     }
-    const result = saveSignatureToLibrary(
+
+    // Generate image from text signature
+    const preview = await buildSignaturePreview({
+      signatureType: 'text',
+      signerName,
+      fontFamily: parameters.fontFamily ?? 'Helvetica',
+      fontSize: parameters.fontSize ?? 16,
+      textColor: parameters.textColor ?? '#000000',
+    });
+
+    if (!preview?.dataUrl) {
+      console.error('Failed to generate text signature preview');
+      return;
+    }
+
+    const result = await saveSignatureToLibrary(
       {
         type: 'text',
+        dataUrl: preview.dataUrl,
         signerName,
         fontFamily: parameters.fontFamily ?? 'Helvetica',
         fontSize: parameters.fontSize ?? 16,
         textColor: parameters.textColor ?? '#000000',
       },
-      'text'
+      'text',
+      scope
     );
     if (result.success) {
       setLastSavedKeyForType('text');
@@ -286,16 +305,21 @@ const SignSettings = ({
     [updateSignatureLabel]
   );
 
-  const renderSaveButton = (type: SavedSignatureType, isReady: boolean, onClick: () => void) => {
+  const renderSaveButton = (type: SavedSignatureType, isReady: boolean, onClick: (scope: 'personal' | 'shared') => void, scope: 'personal' | 'shared', icon: string, label: string) => {
     if (!canUseSavedLibrary) {
       return null;
     }
-    const label = translate('saved.saveButton', 'Save signature');
     const currentKey = signatureKeysByType[type];
     const lastSavedKey = lastSavedSignatureKeys[type];
     const hasChanges = Boolean(currentKey && currentKey !== lastSavedKey);
     const isSaved = isReady && !hasChanges;
 
+    // Only show backend storage buttons when backend is available
+    const showButton = storageType === 'backend' || storageType === null;
+    if (!showButton) {
+      return null;
+    }
+
     let tooltipMessage: string | undefined;
     if (!isReady) {
       tooltipMessage = translate('saved.saveUnavailable', 'Create a signature first to save it.');
@@ -312,11 +336,11 @@ const SignSettings = ({
         size="xs"
         variant="outline"
         color={isSaved ? 'green' : undefined}
-        onClick={onClick}
+        onClick={() => onClick(scope)}
         disabled={!isReady || disabled || isSavedSignatureLimitReached || !hasChanges}
-        leftSection={<LocalIcon icon="material-symbols:save-rounded" width={16} height={16} />}
+        leftSection={<LocalIcon icon={icon} width={16} height={16} />}
       >
-        {isSaved ? translate('saved.status.saved', 'Saved') : label}
+        {label}
       </Button>
     );
 
@@ -331,15 +355,38 @@ const SignSettings = ({
     return button;
   };
 
-  const renderSaveButtonRow = (type: SavedSignatureType, isReady: boolean, onClick: () => void) => {
-    const button = renderSaveButton(type, isReady, onClick);
-    if (!button) {
+  const renderSaveButtonRow = (type: SavedSignatureType, isReady: boolean, onClick: (scope: 'personal' | 'shared') => void) => {
+    if (!canUseSavedLibrary) {
       return null;
     }
+
+    const personalButton = renderSaveButton(
+      type,
+      isReady,
+      onClick,
+      'personal',
+      'material-symbols:person-rounded',
+      translate('saved.savePersonal', 'Save Personal')
+    );
+
+    const sharedButton = renderSaveButton(
+      type,
+      isReady,
+      onClick,
+      'shared',
+      'material-symbols:groups-rounded',
+      translate('saved.saveShared', 'Save Shared')
+    );
+
+    if (!personalButton && !sharedButton) {
+      return null;
+    }
+
     return (
-      <Box style={{ alignSelf: 'flex-start', marginTop: '0.4rem' }}>
-        {button}
-      </Box>
+      <Group gap="xs" style={{ alignSelf: 'flex-start', marginTop: '0.4rem' }}>
+        {personalButton}
+        {sharedButton}
+      </Group>
     );
   };
 
@@ -744,6 +791,7 @@ const SignSettings = ({
           signatures={savedSignatures}
           disabled={disabled}
           isAtCapacity={isSavedSignatureLimitReached}
+          storageType={storageType}
           onUseSignature={handleUseSavedSignature}
           onDeleteSignature={handleDeleteSavedSignature}
           onRenameSignature={handleRenameSavedSignature}

frontend/src/core/components/viewer/LinkLayer.tsx

@@ -0,0 +1,244 @@
+import React, { useEffect, useState, useMemo, useCallback } from 'react';
+import { useAnnotationCapability } from '@embedpdf/plugin-annotation/react';
+import { useScroll } from '@embedpdf/plugin-scroll/react';
+
+enum PDFActionType {
+  GoTo = 0,
+  GoToR = 1,
+  GoToE = 2,
+  URI = 3,
+  // Add other types as needed
+}
+
+interface PDFRect {
+  origin: { x: number; y: number };
+  size: { width: number; height: number };
+}
+
+interface PDFDestination {
+  pageIndex: number;
+  view: [number, number];
+}
+
+interface PDFAction {
+  type: string | number;
+  destination?: PDFDestination;
+  uri?: string;
+}
+
+interface LinkAnnotation {
+  id: string;
+  type: number;
+  rect: PDFRect;
+  target?: {
+    type: string;
+    action?: PDFAction;
+    destination?: PDFDestination;
+    uri?: string;
+  };
+}
+
+function isGoToAction(action: PDFAction): boolean {
+  return action.type === 'GoTo' || action.type === PDFActionType.GoTo;
+}
+
+function isURIAction(action: PDFAction): boolean {
+  return action.type === 'URI' || action.type === PDFActionType.URI;
+}
+
+function isInternalLink(link: LinkAnnotation): boolean {
+  return Boolean(link.target?.type === 'destination' ||
+         (link.target?.type === 'action' && link.target.action && isGoToAction(link.target.action)));
+}
+
+function isExternalLink(link: LinkAnnotation): boolean {
+  return Boolean(link.target?.type === 'uri' ||
+         (link.target?.type === 'action' && link.target.action && isURIAction(link.target.action)));
+}
+
+interface LinkLayerProps {
+  pageIndex: number;
+  scale: number;
+  document?: any;
+  pdfFile?: File | Blob;
+  onLinkClick?: (target: any) => void;
+}
+
+const getLinkTitle = (link: LinkAnnotation): string => {
+  if (link.target?.type === 'destination') {
+    return `Go to page ${(link.target.destination?.pageIndex ?? 0) + 1}`;
+  }
+  if (link.target?.type === 'action' && link.target.action?.type === 'GoTo') {
+    return `Go to page ${(link.target.action.destination?.pageIndex ?? 0) + 1}`;
+  }
+  if (link.target?.type === 'action' && (link.target.action?.type === 'URI' || link.target.action?.type === 3)) {
+    return `Open link: ${link.target.action.uri}`;
+  }
+  if (link.target?.uri) {
+    return `Open link: ${link.target.uri}`;
+  }
+  return 'Link';
+};
+
+const getLinkAriaLabel = (link: LinkAnnotation): string => {
+  if (link.target?.type === 'destination') {
+    return `Navigate to page ${(link.target.destination?.pageIndex ?? 0) + 1}`;
+  }
+  if (link.target?.type === 'action' && link.target.action?.type === 'GoTo') {
+    return `Navigate to page ${(link.target.action.destination?.pageIndex ?? 0) + 1}`;
+  }
+  if (link.target?.type === 'action' && (link.target.action?.type === 'URI' || link.target.action?.type === 3)) {
+    return 'Open external link';
+  }
+  return 'Open external link';
+};
+
+export const LinkLayer: React.FC<LinkLayerProps> = ({
+  pageIndex,
+  scale,
+  document: pdfDocument,
+  onLinkClick
+}) => {
+  const { provides: annotation } = useAnnotationCapability();
+  const { provides: scroll } = useScroll();
+  const [links, setLinks] = useState<LinkAnnotation[]>([]);
+  const [isNavigating, setIsNavigating] = useState(false);
+
+  const processedLinks = useMemo(() => {
+    return links.map(link => ({
+      ...link,
+      scaledRect: {
+        left: link.rect.origin.x * scale,
+        top: link.rect.origin.y * scale,
+        width: link.rect.size.width * scale,
+        height: link.rect.size.height * scale,
+      }
+    }));
+  }, [links, scale]);
+
+  useEffect(() => {
+    const fetchLinks = async () => {
+      if (!annotation) return;
+
+      try {
+        // Use the annotation API's built-in filtering if available
+        const pageAnnotations = await annotation
+          .getPageAnnotations({
+            pageIndex,
+            // Try to filter for link annotations (type 2) if the API supports it
+            ...(annotation.getPageAnnotations.length > 1 ? { types: [2] } : {})
+          })
+          .toPromise();
+
+        // Filter for link annotations (type 2 is LINK in PDF spec) as fallback
+        const linkAnnotations = pageAnnotations.filter(
+          (ann: any) => ann.type === 2
+        ) as LinkAnnotation[];
+
+        if (linkAnnotations.length > 0) {
+          setLinks(linkAnnotations);
+          return;
+        }
+      } catch (error) {
+        console.error('[LinkLayer] Failed to fetch links from annotation API:', error);
+      }
+
+      if (pdfDocument) {
+        try {
+          // Try different methods to get link annotations
+          let pdfLinks: any[] = [];
+
+          if (pdfDocument.getPageAnnotations && typeof pdfDocument.getPageAnnotations === 'function') {
+            pdfLinks = await pdfDocument.getPageAnnotations(pageIndex);
+          } else if (pdfDocument.getAnnotations && typeof pdfDocument.getAnnotations === 'function') {
+            const allAnnotations = await pdfDocument.getAnnotations();
+            pdfLinks = allAnnotations.filter((ann: any) => ann.pageIndex === pageIndex && ann.type === 2);
+          } else if (pdfDocument.pages && pdfDocument.pages[pageIndex]) {
+            const page = pdfDocument.pages[pageIndex];
+            if (page.getAnnotations && typeof page.getAnnotations === 'function') {
+              pdfLinks = await page.getAnnotations();
+            }
+          }
+
+          const convertedLinks = pdfLinks.map((ann: any) => ({
+            id: ann.id || `pdf-link-${pageIndex}-${Math.random()}`,
+            type: ann.type || 2,
+            rect: ann.rect || ann,
+            target: ann.target || ann.action
+          })) as LinkAnnotation[];
+
+          setLinks(convertedLinks);
+        } catch (error) {
+          console.warn('[LinkLayer] Failed to get annotations from PDF document:', error);
+        }
+      } else {
+        console.warn('[LinkLayer] No annotation API or PDF document available');
+      }
+    };
+
+    fetchLinks();
+  }, [annotation, pageIndex, pdfDocument]);
+
+  const handleLinkClick = useCallback(async (link: LinkAnnotation) => {
+    if (isNavigating) return; // Prevent multiple simultaneous navigations
+
+    try {
+      setIsNavigating(true);
+
+      if (onLinkClick) {
+        onLinkClick(link.target);
+        return;
+      }
+
+      if (isInternalLink(link)) {
+        const targetPage = link.target?.destination?.pageIndex ??
+                          link.target?.action?.destination?.pageIndex;
+        if (targetPage !== undefined && scroll) {
+          await scroll.scrollToPage({
+            pageNumber: targetPage + 1, // PDF pages are 1-indexed
+            behavior: 'smooth',
+          });
+        }
+      } else if (isExternalLink(link)) {
+        const uri = link.target?.uri ?? link.target?.action?.uri;
+        if (uri) {
+          window.open(uri, '_blank', 'noopener,noreferrer');
+        }
+      } else {
+        throw new Error(`Unsupported link type: ${link.target?.type}`);
+      }
+    } catch (error) {
+      console.error('[LinkLayer] Navigation failed:', error);
+    } finally {
+      setIsNavigating(false);
+    }
+  }, [isNavigating, onLinkClick, scroll]);
+
+  return (
+    <div className="absolute inset-0 pointer-events-none">
+      {processedLinks.map((link) => {
+        const { id } = link;
+        const { left, top, width, height } = link.scaledRect;
+
+        return (
+          <button
+            key={id}
+            onClick={() => handleLinkClick(link)}
+            disabled={isNavigating}
+            className={`absolute opacity-0 hover:opacity-20 bg-blue-500 transition-opacity cursor-pointer pointer-events-auto border border-blue-400 hover:border-blue-600 ${isNavigating ? 'cursor-not-allowed opacity-50' : ''}`}
+            style={{
+              left: `${left}px`,
+              top: `${top}px`,
+              width: `${width}px`,
+              height: `${height}px`,
+              minWidth: '8px',
+              minHeight: '8px',
+            }}
+            title={getLinkTitle(link)}
+            aria-label={getLinkAriaLabel(link)}
+          />
+        );
+      })}
+    </div>
+  );
+};

frontend/src/core/components/viewer/LocalEmbedPDF.tsx

@@ -20,6 +20,7 @@ import { ThumbnailPluginPackage } from '@embedpdf/plugin-thumbnail/react';
 import { RotatePluginPackage, Rotate } from '@embedpdf/plugin-rotate/react';
 import { ExportPluginPackage } from '@embedpdf/plugin-export/react';
 import { BookmarkPluginPackage } from '@embedpdf/plugin-bookmark';
+import { PrintPluginPackage } from '@embedpdf/plugin-print/react';
 
 // Import annotation plugins
 import { HistoryPluginPackage } from '@embedpdf/plugin-history/react';
@@ -41,8 +42,10 @@ import { HistoryAPIBridge } from '@app/components/viewer/HistoryAPIBridge';
 import type { SignatureAPI, HistoryAPI } from '@app/components/viewer/viewerTypes';
 import { ExportAPIBridge } from '@app/components/viewer/ExportAPIBridge';
 import { BookmarkAPIBridge } from '@app/components/viewer/BookmarkAPIBridge';
+import { PrintAPIBridge } from '@app/components/viewer/PrintAPIBridge';
 import { isPdfFile } from '@app/utils/fileUtils';
 import { useTranslation } from 'react-i18next';
+import { LinkLayer } from '@app/components/viewer/LinkLayer';
 
 interface LocalEmbedPDFProps {
   file?: File | Blob;
@@ -94,7 +97,10 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, onSignatur
         strategy: ScrollStrategy.Vertical,
         initialPage: 0,
       }),
-      createPluginRegistration(RenderPluginPackage),
+      createPluginRegistration(RenderPluginPackage, {
+        withForms: true,
+        withAnnotations: true,
+      }),
 
       // Register interaction manager (required for zoom and selection features)
       createPluginRegistration(InteractionManagerPluginPackage),
@@ -103,15 +109,17 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, onSignatur
       createPluginRegistration(SelectionPluginPackage),
 
       // Register history plugin for undo/redo (recommended for annotations)
-      ...(enableAnnotations ? [createPluginRegistration(HistoryPluginPackage)] : []),
+      // Always register for reading existing annotations
+      createPluginRegistration(HistoryPluginPackage),
 
       // Register annotation plugin (depends on InteractionManager, Selection, History)
-      ...(enableAnnotations ? [createPluginRegistration(AnnotationPluginPackage, {
+      // Always register for reading existing annotations like links
+      createPluginRegistration(AnnotationPluginPackage, {
         annotationAuthor: 'Digital Signature',
         autoCommit: true,
         deactivateToolAfterCreate: false,
         selectAfterCreate: true,
-      })] : []),
+      }),
 
       // Register pan plugin (depends on Viewport, InteractionManager)
       createPluginRegistration(PanPluginPackage, {
@@ -153,6 +161,9 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, onSignatur
       createPluginRegistration(ExportPluginPackage, {
         defaultFileName: 'document.pdf',
       }),
+
+      // Register print plugin for printing PDFs
+      createPluginRegistration(PrintPluginPackage),
     ];
   }, [pdfUrl]);
 
@@ -229,68 +240,62 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, onSignatur
       <EmbedPDF
         engine={engine}
         plugins={plugins}
-        onInitialized={enableAnnotations ? async (registry) => {
+        onInitialized={async (registry) => {
           const annotationPlugin = registry.getPlugin('annotation');
           if (!annotationPlugin || !annotationPlugin.provides) return;
 
           const annotationApi = annotationPlugin.provides();
           if (!annotationApi) return;
 
-          // Add custom signature stamp tool for image signatures
-          annotationApi.addTool({
-            id: 'signatureStamp',
-            name: 'Digital Signature',
-            interaction: { exclusive: false, cursor: 'copy' },
-            matchScore: () => 0,
-            defaults: {
-              type: PdfAnnotationSubtype.STAMP,
-              // Image will be set dynamically when signature is created
-            },
-          });
+          if (enableAnnotations) {
+            annotationApi.addTool({
+              id: 'signatureStamp',
+              name: 'Digital Signature',
+              interaction: { exclusive: false, cursor: 'copy' },
+              matchScore: () => 0,
+              defaults: {
+                type: PdfAnnotationSubtype.STAMP,
+              },
+            });
 
-          // Add custom ink signature tool for drawn signatures
-          annotationApi.addTool({
-            id: 'signatureInk',
-            name: 'Signature Draw',
-            interaction: { exclusive: true, cursor: 'crosshair' },
-            matchScore: () => 0,
-            defaults: {
-              type: PdfAnnotationSubtype.INK,
-              color: '#000000',
-              opacity: 1.0,
-              borderWidth: 2,
-            },
-          });
+            annotationApi.addTool({
+              id: 'signatureInk',
+              name: 'Signature Draw',
+              interaction: { exclusive: true, cursor: 'crosshair' },
+              matchScore: () => 0,
+              defaults: {
+                type: PdfAnnotationSubtype.INK,
+                color: '#000000',
+                opacity: 1.0,
+                borderWidth: 2,
+              },
+            });
 
-          // Listen for annotation events to track annotations and notify parent
-          annotationApi.onAnnotationEvent((event: any) => {
-            if (event.type === 'create' && event.committed) {
-              // Add to annotations list
-              setAnnotations(prev => [...prev, {
-                id: event.annotation.id,
-                pageIndex: event.pageIndex,
-                rect: event.annotation.rect
-              }]);
+            annotationApi.onAnnotationEvent((event: any) => {
+              if (event.type === 'create' && event.committed) {
+                setAnnotations(prev => [...prev, {
+                  id: event.annotation.id,
+                  pageIndex: event.pageIndex,
+                  rect: event.annotation.rect
+                }]);
 
 
-              // Notify parent if callback provided
-              if (onSignatureAdded) {
-                onSignatureAdded(event.annotation);
+                if (onSignatureAdded) {
+                  onSignatureAdded(event.annotation);
+                }
+              } else if (event.type === 'delete' && event.committed) {
+                setAnnotations(prev => prev.filter(ann => ann.id !== event.annotation.id));
+              } else if (event.type === 'loaded') {
+                const loadedAnnotations = event.annotations || [];
+                setAnnotations(loadedAnnotations.map((ann: any) => ({
+                  id: ann.id,
+                  pageIndex: ann.pageIndex || 0,
+                  rect: ann.rect
+                })));
               }
-            } else if (event.type === 'delete' && event.committed) {
-              // Remove from annotations list
-              setAnnotations(prev => prev.filter(ann => ann.id !== event.annotation.id));
-            } else if (event.type === 'loaded') {
-              // Handle initial load of annotations
-              const loadedAnnotations = event.annotations || [];
-              setAnnotations(loadedAnnotations.map((ann: any) => ({
-                id: ann.id,
-                pageIndex: ann.pageIndex || 0,
-                rect: ann.rect
-              })));
-            }
-          });
-        } : undefined}
+            });
+          }
+        }}
       >
         <ZoomAPIBridge />
         <ScrollAPIBridge />
@@ -304,6 +309,7 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, onSignatur
         {enableAnnotations && <HistoryAPIBridge ref={historyApiRef} />}
         <ExportAPIBridge />
         <BookmarkAPIBridge />
+        <PrintAPIBridge />
         <GlobalPointerProvider>
           <Viewport
             style={{
@@ -352,6 +358,10 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, onSignatur
 
                       {/* Selection layer for text interaction */}
                       <SelectionLayer pageIndex={pageIndex} scale={scale} />
+
+                      {/* Link layer for clickable PDF links */}
+                      <LinkLayer pageIndex={pageIndex} scale={scale} document={document} pdfFile={file} />
+
                       {/* Annotation layer for signatures (only when enabled) */}
                       {enableAnnotations && (
                         <AnnotationLayer

frontend/src/core/components/viewer/LocalEmbedPDFWithAnnotations.tsx

@@ -85,7 +85,10 @@ export function LocalEmbedPDFWithAnnotations({
         strategy: ScrollStrategy.Vertical,
         initialPage: 0,
       }),
-      createPluginRegistration(RenderPluginPackage),
+      createPluginRegistration(RenderPluginPackage, {
+        withForms: true,
+        withAnnotations: true,
+      }),
 
       // Register interaction manager (required for annotations)
       createPluginRegistration(InteractionManagerPluginPackage),

frontend/src/core/components/viewer/PrintAPIBridge.tsx

@@ -0,0 +1,25 @@
+import { useEffect } from 'react';
+import { usePrintCapability } from '@embedpdf/plugin-print/react';
+import { useViewer } from '@app/contexts/ViewerContext';
+
+/**
+ * Component that runs inside EmbedPDF context and exposes print API to ViewerContext
+ */
+export function PrintAPIBridge() {
+  const { provides: print } = usePrintCapability();
+  const { registerBridge } = useViewer();
+
+  useEffect(() => {
+    if (print) {
+      // Register this bridge with ViewerContext
+      registerBridge('print', {
+        state: {},
+        api: {
+          print: () => print.print(),
+        }
+      });
+    }
+  }, [print, registerBridge]);
+
+  return null;
+}

frontend/src/core/components/viewer/SignatureAPIBridge.tsx

@@ -122,7 +122,7 @@ const createTextStampImage = (
 
 export const SignatureAPIBridge = forwardRef<SignatureAPI>(function SignatureAPIBridge(_, ref) {
   const { provides: annotationApi } = useAnnotationCapability();
-  const { signatureConfig, storeImageData, isPlacementMode, placementPreviewSize } = useSignature();
+  const { signatureConfig, storeImageData, isPlacementMode, placementPreviewSize, setSignaturesApplied } = useSignature();
   const { getZoomState, registerImmediateZoomUpdate } = useViewer();
   const [currentZoom, setCurrentZoom] = useState(() => getZoomState()?.currentZoom ?? 1);
   const lastStampImageRef = useRef<string | null>(null);
@@ -389,6 +389,11 @@ export const SignatureAPIBridge = forwardRef<SignatureAPI>(function SignatureAPI
         return;
       }
 
+      // Mark signatures as not applied when a new signature is placed
+      if (event.type === 'create') {
+        setSignaturesApplied(false);
+      }
+
       const directData =
         extractDataUrl(annotation.imageSrc) ||
         extractDataUrl(annotation.imageData) ||
@@ -408,7 +413,7 @@ export const SignatureAPIBridge = forwardRef<SignatureAPI>(function SignatureAPI
     return () => {
       unsubscribe?.();
     };
-  }, [annotationApi, storeImageData]);
+  }, [annotationApi, storeImageData, setSignaturesApplied]);
 
   useEffect(() => {
     if (!isPlacementMode) {
@@ -443,6 +448,11 @@ export const SignatureAPIBridge = forwardRef<SignatureAPI>(function SignatureAPI
         return;
       }
 
+      // Mark signatures as not applied when a new signature is placed
+      if (event.type === 'create') {
+        setSignaturesApplied(false);
+      }
+
       const directData =
         extractDataUrl(annotation.imageSrc) ||
         extractDataUrl(annotation.imageData) ||
@@ -462,7 +472,7 @@ export const SignatureAPIBridge = forwardRef<SignatureAPI>(function SignatureAPI
     return () => {
       unsubscribe?.();
     };
-  }, [annotationApi, storeImageData]);
+  }, [annotationApi, storeImageData, setSignaturesApplied]);
 
   useEffect(() => {
     if (!isPlacementMode) {

frontend/src/core/components/viewer/useViewerRightRailButtons.tsx

@@ -24,6 +24,7 @@ export function useViewerRightRailButtons() {
   const rotateRightLabel = t('rightRail.rotateRight', 'Rotate Right');
   const sidebarLabel = t('rightRail.toggleSidebar', 'Toggle Sidebar');
   const bookmarkLabel = t('rightRail.toggleBookmarks', 'Toggle Bookmarks');
+  const printLabel = t('rightRail.print', 'Print PDF');
 
   const viewerButtons = useMemo<RightRailButtonWithAction[]>(() => {
     return [
@@ -127,6 +128,17 @@ export function useViewerRightRailButtons() {
           viewer.toggleBookmarkSidebar();
         }
       },
+      {
+        id: 'viewer-print',
+        icon: <LocalIcon icon="print" width="1.5rem" height="1.5rem" />,
+        tooltip: printLabel,
+        ariaLabel: printLabel,
+        section: 'top' as const,
+        order: 56,
+        onClick: () => {
+          viewer.printActions.print();
+        }
+      },
       {
         id: 'viewer-annotation-controls',
         section: 'top' as const,
@@ -136,7 +148,7 @@ export function useViewerRightRailButtons() {
         )
       }
     ];
-  }, [t, i18n.language, viewer, isPanning, searchLabel, panLabel, rotateLeftLabel, rotateRightLabel, sidebarLabel, bookmarkLabel, tooltipPosition]);
+  }, [t, i18n.language, viewer, isPanning, searchLabel, panLabel, rotateLeftLabel, rotateRightLabel, sidebarLabel, bookmarkLabel, printLabel, tooltipPosition]);
 
   useRightRailButtons(viewerButtons);
 }

frontend/src/core/constants/app.ts

@@ -1,7 +1,24 @@
 
-// Base path from Vite config - build-time constant, normalized (no trailing slash)
-// When no subpath, use empty string instead of '.' to avoid relative path issues
-export const BASE_PATH = (import.meta.env.BASE_URL || '/').replace(/\/$/, '').replace(/^\.$/, '');
+// Base path - read from <base> tag at runtime to support dynamic subpaths
+// Falls back to Vite's BASE_URL for build-time subpaths
+// Normalized: no trailing slash, empty string instead of '.' or '/'
+function getBasePath(): string {
+  // Try to read from <base> tag first (runtime subpath support)
+  if (typeof document !== 'undefined') {
+    const baseElement = document.querySelector('base');
+    if (baseElement) {
+      const href = baseElement.getAttribute('href');
+      if (href && href !== '%BASE_URL%') {
+        return href.replace(/\/$/, '').replace(/^\.$/, '').replace(/^\/$/, '');
+      }
+    }
+  }
+
+  // Fall back to Vite's BASE_URL (build-time subpath)
+  return (import.meta.env.BASE_URL || '/').replace(/\/$/, '').replace(/^\.$/, '').replace(/^\/$/, '');
+}
+
+export const BASE_PATH = getBasePath();
 
 // EmbedPDF needs time to remove annotations internally before a recreation runs.
 // Without the buffer we occasionally end up with duplicate annotations or stale image data.

frontend/src/core/constants/events.ts

@@ -1,10 +1,10 @@
 import type { LicenseNotice } from '@app/types/types';
 
-export const ONBOARDING_SESSION_BLOCK_KEY = 'stirling-onboarding-session-active';
-export const ONBOARDING_SESSION_EVENT = 'stirling:onboarding-session-started';
 export const SERVER_LICENSE_REQUEST_EVENT = 'stirling:server-license-requested';
 export const UPGRADE_BANNER_TEST_EVENT = 'stirling:upgrade-banner-test';
 export const UPGRADE_BANNER_ALERT_EVENT = 'stirling:upgrade-banner-alert';
+export const START_TOUR_EVENT = 'stirling:start-tour';
+export const TOUR_STATE_EVENT = 'stirling:tour-state';
 
 export interface ServerLicenseRequestPayload {
   licenseNotice?: Partial<LicenseNotice>;
@@ -25,3 +25,29 @@ export interface UpgradeBannerAlertPayload {
   freeTierLimit?: number;
 }
 
+export type TourType = 'admin' | 'tools';
+
+export interface StartTourPayload {
+  tourType: TourType;
+}
+
+export interface TourStatePayload {
+  isOpen: boolean;
+}
+
+/** Helper to dispatch the start tour event */
+export function requestStartTour(tourType: TourType): void {
+  if (typeof window === 'undefined') return;
+  window.dispatchEvent(
+    new CustomEvent<StartTourPayload>(START_TOUR_EVENT, { detail: { tourType } })
+  );
+}
+
+/** Helper to dispatch tour state changes (for hiding cookie consent during tour) */
+export function dispatchTourState(isOpen: boolean): void {
+  if (typeof window === 'undefined') return;
+  window.dispatchEvent(
+    new CustomEvent<TourStatePayload>(TOUR_STATE_EVENT, { detail: { isOpen } })
+  );
+}
+

frontend/src/core/constants/routes.ts

@@ -0,0 +1,25 @@
+/**
+ * Route constants used across the application
+ */
+
+/**
+ * Routes where onboarding, cookie consent, and upgrade banners should not appear.
+ * These are authentication-related pages where users are not yet logged in or
+ * the main app chrome is not displayed.
+ */
+export const AUTH_ROUTES = [
+  '/login',
+  '/signup',
+  '/auth',
+  '/invite',
+  '/forgot-password',
+  '/reset-password',
+];
+
+/**
+ * Check if a pathname matches any auth route
+ */
+export function isAuthRoute(pathname: string): boolean {
+  return AUTH_ROUTES.some((route) => pathname.startsWith(route));
+}
+

frontend/src/core/contexts/OnboardingContext.tsx

@@ -1,159 +0,0 @@
-import React, { createContext, useContext, useState, useCallback } from 'react';
-import { usePreferences } from '@app/contexts/PreferencesContext';
-
-export type TourType = 'tools' | 'admin';
-
-export interface StartTourOptions {
-  source?: string;
-  skipToolPromptRequirement?: boolean;
-  metadata?: Record<string, unknown>;
-}
-
-interface PendingTourRequest {
-  type: TourType;
-  source?: string;
-  metadata?: Record<string, unknown>;
-  requestedAt: number;
-}
-
-interface OnboardingContextValue {
-  isOpen: boolean;
-  currentStep: number;
-  tourType: TourType;
-  setCurrentStep: (step: number) => void;
-  startTour: (type?: TourType, options?: StartTourOptions) => void;
-  closeTour: () => void;
-  completeTour: () => void;
-  resetTour: (type?: TourType) => void;
-  startAfterToolModeSelection: boolean;
-  setStartAfterToolModeSelection: (value: boolean) => void;
-  pendingTourRequest: PendingTourRequest | null;
-  clearPendingTourRequest: () => void;
-}
-
-const OnboardingContext = createContext<OnboardingContextValue | undefined>(undefined);
-
-export const OnboardingProvider: React.FC<{ children: React.ReactNode }> = ({ children }) => {
-  const { preferences, updatePreference } = usePreferences();
-  const [isOpen, setIsOpen] = useState(false);
-  const [currentStep, setCurrentStep] = useState(0);
-  const [tourType, setTourType] = useState<TourType>('tools');
-  const [startAfterToolModeSelection, setStartAfterToolModeSelection] = useState(false);
-  const [pendingTourRequest, setPendingTourRequest] = useState<PendingTourRequest | null>(null);
-
-  const openTour = useCallback((type: TourType = 'tools') => {
-    setTourType(type);
-    setCurrentStep(0);
-    setIsOpen(true);
-  }, []);
-
-  const startTour = useCallback(
-    (type: TourType = 'tools', options?: StartTourOptions) => {
-      const requestedType = type ?? 'tools';
-      const source = options?.source ?? 'unspecified';
-      const metadata = options?.metadata;
-      const skipToolPromptRequirement = options?.skipToolPromptRequirement ?? false;
-      const toolPromptSeen = preferences.toolPanelModePromptSeen;
-      const hasSelectedToolPanelMode = preferences.hasSelectedToolPanelMode;
-      const hasToolPreference = toolPromptSeen || hasSelectedToolPanelMode;
-      const shouldDefer = !skipToolPromptRequirement && !hasToolPreference;
-
-      console.log('[onboarding] startTour invoked', {
-        requestedType,
-        source,
-        toolPromptSeen,
-        hasSelectedToolPanelMode,
-        shouldDefer,
-        hasPendingTourRequest: !!pendingTourRequest,
-        metadata,
-      });
-
-      if (shouldDefer) {
-        setPendingTourRequest({
-          type: requestedType,
-          source,
-          metadata,
-          requestedAt: Date.now(),
-        });
-        setStartAfterToolModeSelection(true);
-        console.log('[onboarding] deferring tour launch until tool panel mode selection completes', {
-          requestedType,
-          source,
-        });
-        return;
-      }
-
-      if (pendingTourRequest) {
-        console.log('[onboarding] clearing previous pending tour request before starting new tour', {
-          previousRequest: pendingTourRequest,
-          newType: requestedType,
-          source,
-        });
-      }
-
-      setPendingTourRequest(null);
-      setStartAfterToolModeSelection(false);
-      console.log('[onboarding] starting tour', {
-        requestedType,
-        source,
-      });
-      openTour(requestedType);
-    },
-    [openTour, pendingTourRequest, preferences.toolPanelModePromptSeen, preferences.hasSelectedToolPanelMode],
-  );
-
-  const closeTour = useCallback(() => {
-    setIsOpen(false);
-  }, []);
-
-  const completeTour = useCallback(() => {
-    setIsOpen(false);
-    updatePreference('hasCompletedOnboarding', true);
-  }, [updatePreference]);
-
-  const resetTour = useCallback((type: TourType = 'tools') => {
-    updatePreference('hasCompletedOnboarding', false);
-    setTourType(type);
-    setCurrentStep(0);
-    setIsOpen(true);
-  }, [updatePreference]);
-
-  const clearPendingTourRequest = useCallback(() => {
-    if (pendingTourRequest) {
-      console.log('[onboarding] clearing pending tour request manually', {
-        pendingTourRequest,
-      });
-    }
-    setPendingTourRequest(null);
-    setStartAfterToolModeSelection(false);
-  }, [pendingTourRequest]);
-
-  return (
-    <OnboardingContext.Provider
-      value={{
-        isOpen,
-        currentStep,
-        tourType,
-        setCurrentStep,
-        startTour,
-        closeTour,
-        completeTour,
-        resetTour,
-        startAfterToolModeSelection,
-        setStartAfterToolModeSelection,
-        pendingTourRequest,
-        clearPendingTourRequest,
-      }}
-    >
-      {children}
-    </OnboardingContext.Provider>
-  );
-};
-
-export const useOnboarding = (): OnboardingContextValue => {
-  const context = useContext(OnboardingContext);
-  if (!context) {
-    throw new Error('useOnboarding must be used within an OnboardingProvider');
-  }
-  return context;
-};