ui

2026-09-03 13:20:08 +03:00 · 2025-12-22 00:50:27 +00:00
2698 changed files with 336391 additions and 613381 deletions
@@ -1,76 +1,75 @@
-# Version control
-.git/
+# Node modules and build artifacts
+node_modules
+frontend/node_modules
+frontend/dist
+frontend/build
+frontend/.vite
+frontend/.tauri
+frontend/src-tauri/target
+
+# Gradle build artifacts
+.gradle
+build
+bin
+target
+out
+
+# Git
+.git
 .gitignore

-# Build outputs
-build/
-*/build/
-**/build/
-out/
-target/
-**/target/
-bin/
-version_builds/
-
-# Gradle caches (local, not what's in the container)
-.gradle/
-**/.gradle/
-
-# Node / frontend
-node_modules/
-**/node_modules/
-frontend/node_modules/
-frontend/dist/
-.npm/
-.yarn/
-
-# Tauri/desktop builds
-src-tauri/target/
-src-tauri/dist/
-
-# IDE and editor
-.idea/
-.vscode/
+# IDE
+.vscode
+.idea
 *.iml
-*.ipr
 *.iws
+*.ipr

-# Logs and temp files
+# Logs
 *.log
-*.tmp
-*.pid
-.DS_Store
-Thumbs.db
+logs

-# Docker itself
-Dockerfile*
-.dockerignore
-
-# CI / CD configs (not needed in build context)
-.github/
-.circleci/
-.gitlab-ci.yml
-
-# Test reports
-**/test-results/
-**/jacoco/
-
-# Testing and documentation (not needed in build)
-testing/
-docs/
-*.md
-README*
-
-# Local env
+# Environment files
 .env
 .env.*
 !.env.example
-!engine/.env

-# Misc
-*.swp
-*.swo
-*~
+# OS files
 .DS_Store
-.cache/
-.pytest_cache/
+Thumbs.db
+
+# Java compiled files
+*.class
+*.jar
+*.war
+*.ear
+
+# Test reports
+test-results
+coverage
+
+# Docker
+docker-compose.override.yml
+.dockerignore
+
+# Temporary files
+tmp
+temp
+*.tmp
+*.swp
+*~
+
+# Runtime database and config files (locked by running app)
+app/core/configs/**
+stirling/**
+stirling-pdf-DB*.mv.db
+stirling-pdf-DB*.trace.db
+
+# Documentation
+*.md
+!README.md
+docs
+
+# CI/CD
+.github
+.gitlab-ci.yml
@@ -14,8 +14,7 @@ indent_size = 4
 max_line_length = 100

 [*.py]
-indent_size = 4
-max_line_length = 120
+indent_size = 2

 [*.gradle]
 indent_size = 4
@@ -2,17 +2,20 @@
 * @Frooodle @Ludy87 @jbrunton96 @ConnorYoh

 # Backend
-/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs
+/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
+
+#V1 frontend
+/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
+/app/core/src/main/resources/templates/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87

 #V2 frontend
-/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
-/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
+/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle

 #V2 docker
-/docker/backend/** @Frooodle @Ludy87 @DarioGii
+/docker/backend/** @Frooodle @Ludy87 @DarioGii @Ludy87
 /docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
 /docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87


 #GHA (All users)
-/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
+/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
@@ -1,29 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-bin
-pkgver=2.7.3
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (desktop app, prebuilt binary)"
-arch=('x86_64')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('gtk3' 'webkit2gtk' 'libappindicator-gtk3')
-provides=('stirling-pdf')
-conflicts=('stirling-pdf' 'stirling-pdf-git')
-options=('!strip')
-
-source_x86_64=("${pkgname}-${pkgver}.deb::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-linux-x86_64.deb")
-sha256sums_x86_64=('PLACEHOLDER_DEB_SHA256')
-
-package() {
-    # Extract the .deb archive
-    bsdtar -xf data.tar* -C "${pkgdir}"
-
-    # Fix permissions
-    find "${pkgdir}" -type d -exec chmod 755 {} \;
-
-    # Install license
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<EOF
-Copyright (c) 2025 Stirling PDF Inc
-All rights reserved. See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}
@@ -1,90 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-server-bin
-pkgver=2.7.3
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
-arch=('any')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('java-runtime>=21')
-provides=('stirling-pdf-server')
-conflicts=('stirling-pdf-server' 'stirling-pdf-server-git')
-backup=('etc/stirling-pdf-server/settings.yml')
-
-source=("Stirling-PDF-with-login-${pkgver}.jar::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-with-login.jar"
-        "stirling-pdf-server.service"
-        "stirling-pdf-server.sysusers"
-        "stirling-pdf-server.tmpfiles")
-sha256sums=('PLACEHOLDER_JAR_SHA256'
-            'PLACEHOLDER_SERVICE_SHA256'
-            'PLACEHOLDER_SYSUSERS_SHA256'
-            'PLACEHOLDER_TMPFILES_SHA256')
-
-prepare() {
-    cat > stirling-pdf-server.service << 'EOF'
-[Unit]
-Description=Stirling-PDF Server
-After=network.target
-
-[Service]
-Type=simple
-User=stirling-pdf
-Group=stirling-pdf
-WorkingDirectory=/var/lib/stirling-pdf-server
-ExecStart=/usr/bin/java -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar
-Restart=on-failure
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=stirling-pdf-server
-Environment=JAVA_OPTS=-Xmx512m
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-    cat > stirling-pdf-server.sysusers << 'EOF'
-u stirling-pdf - "Stirling-PDF Server" /var/lib/stirling-pdf-server -
-EOF
-
-    cat > stirling-pdf-server.tmpfiles << 'EOF'
-d /var/lib/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-d /var/log/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-EOF
-}
-
-package() {
-    # JAR
-    install -Dm644 "Stirling-PDF-with-login-${pkgver}.jar" \
-        "${pkgdir}/usr/share/stirling-pdf-server/stirling-pdf-server.jar"
-
-    # Wrapper script
-    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/stirling-pdf-server" << 'EOF'
-#!/bin/sh
-exec java $JAVA_OPTS -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar "$@"
-EOF
-
-    # systemd unit
-    install -Dm644 stirling-pdf-server.service \
-        "${pkgdir}/usr/lib/systemd/system/stirling-pdf-server.service"
-
-    # sysusers / tmpfiles
-    install -Dm644 stirling-pdf-server.sysusers \
-        "${pkgdir}/usr/lib/sysusers.d/stirling-pdf-server.conf"
-    install -Dm644 stirling-pdf-server.tmpfiles \
-        "${pkgdir}/usr/lib/tmpfiles.d/stirling-pdf-server.conf"
-
-    # Default config stub
-    install -dm755 "${pkgdir}/etc/stirling-pdf-server"
-    install -Dm644 /dev/stdin "${pkgdir}/etc/stirling-pdf-server/settings.yml" << 'EOF'
-# Stirling-PDF Server configuration
-# See https://github.com/Stirling-Tools/Stirling-PDF for all options
-server:
-  port: 8080
-EOF
-
-    # License
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" << 'EOF'
-MIT License — see https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}
@@ -2,35 +2,26 @@ build: &build
  - build.gradle
  - app/(common|core|proprietary)/build.gradle

-openapi: &openapi
-  - *build
+app: &app
  - app/(common|core|proprietary)/src/main/java/**

-docker-base: &docker-base
-  - docker/base/Dockerfile
-  - ".github/workflows/push-docker-base.yml"
-
-docker: &docker
-  - docker/embedded/Dockerfile
-  - docker/embedded/Dockerfile.fat
-  - docker/embedded/Dockerfile.ultra-lite
-  - ".github/workflows/build.yml"
-  - ".github/workflows/push-docker.yml"
-  - scripts/init.sh
-  - scripts/init-without-ocr.sh
-  - exampleYmlFiles/**
-  - *docker-base
+openapi: &openapi
+  - build.gradle
+  - app/(common|core|proprietary)/build.gradle
+  - app/(common|core|proprietary)/src/main/java/**

 project: &project
  - app/(common|core|proprietary)/src/(main|test)/java/**
-  - *build
-  - "app/(common|core|proprietary)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
+  - app/(common|core|proprietary)/build.gradle
+  - 'app/(common|core|proprietary)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*'
  - exampleYmlFiles/**
  - gradle/**
  - libs/**
-  - "testing/**/!(requirements*.txt|requirements*.in)*"
-  - *docker
-  - *docker-base
+  - testing/**
+  - build.gradle
+  - Dockerfile
+  - Dockerfile.fat
+  - Dockerfile.ultra-lite
  - gradle.properties
  - gradlew
  - gradlew.bat
@@ -38,29 +29,10 @@ project: &project
  - settings.gradle
  - frontend/**
  - docker/**
-  - scripts/RestartHelper.java
+  - testing/**

 frontend: &frontend
  - frontend/**
  - .github/workflows/testdriver.yml
  - testing/**
  - docker/**
-  - scripts/translations/*.py
-  - .taskfiles/desktop.yml
-  - scripts/convert_cff_to_ttf.py
-  - scripts/harvest_type3_fonts.py
-  - scripts/ignore_translation.toml
-  - scripts/index_type3_catalogue.py
-  - scripts/summarize_type3_signatures.py
-  - scripts/type3_to_cff.py
-  - scripts/update_type3_library.py
-
-licenses-frontend: &licenses-frontend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - "frontend/package.json"
-  - "frontend/package-lock.json"
-  - "frontend/scripts/generate-licenses.js"
-
-licenses-backend: &licenses-backend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - *build
@@ -1 +1 @@
-allow-ghsas: GHSA-wrw7-89jp-8q8g
+allow-ghsas: GHSA-wrw7-89jp-8q8g
@@ -1,9 +1,4 @@
 {
-  "label_changer": [
-    "Frooodle",
-    "Ludy87",
-    "balazs-szucs"
-  ],
  "repo_devs": [
    "Frooodle",
    "sf298",
@@ -13,8 +8,6 @@
    "reecebrowne",
    "DarioGii",
    "ConnorYoh",
-    "EthanHealy01",
-    "jbrunton96",
-    "balazs-szucs"
+    "EthanHealy01"
  ]
 }
@@ -6,70 +6,18 @@
 version: 2
 updates:
  - package-ecosystem: "gradle" # See documentation for possible values
-    directories:
-      - "/" # Location of package manifests
-      - "/app/common"
-      - "/app/core"
-      - "/app/proprietary"
+    directory: "/" # Location of package manifests
    schedule:
      interval: "weekly"
+    open-pull-requests-limit: 10
    rebase-strategy: "auto"

  - package-ecosystem: "docker"
    directory: "/" # Location of Dockerfile
    schedule:
      interval: "weekly"
-    rebase-strategy: "auto"

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
-    rebase-strategy: "auto"
-
-  - package-ecosystem: npm
-    directory: /devTools
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/backend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/embedded
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/frontend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: npm
-    directory: /frontend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: cargo
-    directory: /frontend/src-tauri
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: pip
-    directory: /testing/cucumber
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: cargo
-    directory: /frontend/src-tauri/provisioner
-    schedule:
-      interval: daily
@@ -46,31 +46,26 @@ labels:
  - label: 'API'
    title: '.*openapi.*|.*swagger.*|.*api.*'

-  - label: 'v3'
-    base-branch: 'V3'
+  - label: 'v2'
+    base-branch: 'V2'

  - label: 'Translation'
    files:
-      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}.properties'
      - 'scripts/ignore_translation.toml'
-      - 'scripts/remove_translation_keys.sh'
-      - 'scripts/replace_translation_line.sh'
-      - 'scripts/translations/.*'
-      - '.github/scripts/check_language_toml.py'
-      - 'scripts/counter_translation_v3.py'
+      - 'app/core/src/main/resources/templates/fragments/languages.html'
+      - '.github/scripts/check_language_properties.py'

  - label: 'Front End'
    files:
+      - 'app/core/src/main/resources/templates/.*'
+      - 'app/proprietary/src/main/resources/templates/.*'
      - 'app/core/src/main/resources/static/.*'
      - 'app/proprietary/src/main/resources/static/.*'
+      - 'app/core/src/main/java/stirling/software/SPDF/controller/web/.*'
+      - 'app/core/src/main/java/stirling/software/SPDF/UI/.*'
+      - 'app/proprietary/src/main/java/stirling/software/proprietary/security/controller/web/.*'
      - 'frontend/**'
-      - 'frontend/.*'
-      - 'frontend/**/.*'
-
-  - label: 'Tauri'
-    files:
-      - 'frontend/src-tauri/**'
-      - 'frontend/src-tauri/.*'

  - label: 'Java'
    files:
@@ -84,9 +84,6 @@
 - name: "v2"
  color: "FFFF00"
  description: "Issues or pull requests related to the v2 branch"
- name: "v3"
-  color: "FFA500"
-  description: "Issues or pull requests related to the v3 branch"
 - name: "wontfix"
  description: "This will not be worked on"
  color: "FFFFFF"
@@ -187,17 +184,3 @@
 - name: "codex"
  color: "ededed"
  description: "chatgpt AI generated code"
- name: "break-change"
-  color: "FF0000"
-  description: "This PR introduces a breaking API change."
- name: "Rust"
-  color: "DEA584"
-  description: "Pull requests that update Rust code"
-  from_name: "rust"
- name: "Tauri"
-  color: "24C8FF"
-  description: "Pull requests that update Tauri code"
-  from_name: "tauri"
- name: "license-review-required"
-  color: "EDEDED"
-  description: "This PR requires a license review"
@@ -17,7 +17,7 @@ Closes #(issue_number)
 ### General

 - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable)
+- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable)
 - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable)
 - [ ] I have performed a self-review of my own code
 - [ ] My changes generate no new warnings
@@ -27,15 +27,10 @@ Closes #(issue_number)
 - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed)
 - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only)

-### Translations (if applicable)
-
- [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)
-
 ### UI Changes (if applicable)

 - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR)

 ### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests pass
- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details.
+- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details.
@@ -1,9 +1,5 @@
 changelog:
  categories:
-    - title: Breaking Changes
-      labels:
-        - break-change
-
    - title: Bug Fixes
      labels:
        - Bug
@@ -11,16 +11,15 @@ adjusting the format.
 Usage:
    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
-
 # Sample for Windows:
 # python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml

-import argparse
+import copy
 import glob
 import os
+import argparse
 import re
-from pathlib import Path
-
+import json
 import tomllib  # Python 3.11+ (stdlib)
 import tomli_w  # For writing TOML files

@@ -39,8 +38,7 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
    duplicates = []

    # Load TOML file
-    file_path = Path(file_path)
-    with file_path.open("rb") as file:
+    with open(file_path, 'rb') as file:
        data = tomllib.load(file)

    def process_dict(obj, current_prefix=""):
@@ -59,8 +57,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
    return duplicates


-# Maximum size for TOML files (e.g., 1 MB)
-MAX_FILE_SIZE = 1000 * 1024
+# Maximum size for TOML files (e.g., 500 KB)
+MAX_FILE_SIZE = 500 * 1024


 def parse_toml_file(file_path):
@@ -69,8 +67,7 @@ def parse_toml_file(file_path):
    :param file_path: Path to the TOML file.
    :return: Dictionary with flattened keys.
    """
-    file_path = Path(file_path)
-    with file_path.open("rb") as file:
+    with open(file_path, 'rb') as file:
        data = tomllib.load(file)

    def flatten_dict(d, parent_key="", sep="."):
@@ -113,8 +110,7 @@ def write_toml_file(file_path, updated_properties):
    """
    nested_data = unflatten_dict(updated_properties)

-    file_path = Path(file_path)
-    with file_path.open("wb") as file:
+    with open(file_path, "wb") as file:
        tomli_w.dump(nested_data, file)


@@ -125,23 +121,18 @@ def update_missing_keys(reference_file, file_list, branch=""):
    :param file_list: List of translation files to update.
    :param branch: Branch where the files are located.
    """
-    reference_file = Path(reference_file)
    reference_properties = parse_toml_file(reference_file)
-    branch_path = Path(branch) if branch else Path()

    for file_path in file_list:
-        file_path = Path(file_path)
-        language_dir = file_path.parent.name
-        reference_lang_dir = reference_file.parent.name
+        basename_current_file = os.path.basename(os.path.join(branch, file_path))
        if (
-            language_dir == reference_lang_dir
-            or file_path.suffix != ".toml"
-            or file_path.parents[1].name != "locales"
+            basename_current_file == os.path.basename(reference_file)
+            or not file_path.endswith(".toml")
+            or not os.path.dirname(file_path).endswith("locales")
        ):
-            print(f"Skipping file: {file_path}")
            continue

-        current_properties = parse_toml_file(branch_path / file_path)
+        current_properties = parse_toml_file(os.path.join(branch, file_path))
        updated_properties = {}

        for ref_key, ref_value in reference_properties.items():
@@ -152,7 +143,7 @@ def update_missing_keys(reference_file, file_list, branch=""):
                # Add missing key with reference value
                updated_properties[ref_key] = ref_value

-        write_toml_file(branch_path / file_path, updated_properties)
+        write_toml_file(os.path.join(branch, file_path), updated_properties)


 def check_for_missing_keys(reference_file, file_list, branch):
@@ -160,17 +151,14 @@ def check_for_missing_keys(reference_file, file_list, branch):


 def read_toml_keys(file_path):
-    file_path = Path(file_path)
-    if file_path.is_file():
+    if os.path.isfile(file_path) and os.path.exists(file_path):
        return parse_toml_file(file_path)
    return {}


 def check_for_differences(reference_file, file_list, branch, actor):
    reference_branch = branch
-    reference_file = Path(reference_file)
-    basename_reference_file = reference_file.name
-    branch_path = Path(branch) if branch else Path()
+    basename_reference_file = os.path.basename(reference_file)

    report = []
    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
@@ -184,44 +172,39 @@ def check_for_differences(reference_file, file_list, branch, actor):
    if len(file_list) == 1:
        file_arr = file_list[0].split()

-    base_dir = Path.cwd() / "frontend" / "public" / "locales"
+    base_dir = os.path.abspath(
+        os.path.join(os.getcwd(), "frontend", "public", "locales")
+    )

    for file_path in file_arr:
-        file_path = Path(file_path)
-        file_normpath = file_path
-        absolute_path = file_normpath.resolve()
-
-        basename_current_file = (branch_path / file_normpath).name
-        locale_dir = file_normpath.parent.name
-        report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
+        file_normpath = os.path.normpath(file_path)
+        absolute_path = os.path.abspath(file_normpath)

        # Verify that file is within the expected directory
-        if not absolute_path.is_relative_to(base_dir):
-            has_differences = True
-            report.append(
-                f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n"
-            )
-            continue
+        if not absolute_path.startswith(base_dir):
+            raise ValueError(f"Unsafe file found: {file_normpath}")

        # Verify file size before processing
-        if (branch_path / file_normpath).stat().st_size > MAX_FILE_SIZE:
-            has_differences = True
-            report.append(
-                f"\n⚠️ The file `{locale_dir}/{basename_current_file}` is too large and could pose a security risk.\n\n---\n"
+        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
+            raise ValueError(
+                f"The file {file_normpath} is too large and could pose a security risk."
            )
-            continue

-        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
-            continue
+        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
+        locale_dir = os.path.basename(os.path.dirname(file_normpath))

        if (
-            file_normpath.suffix != ".toml"
-            or basename_current_file != "translation.toml"
+            basename_current_file == basename_reference_file
+            and locale_dir == "en-GB"
        ):
            continue

+        if not file_normpath.endswith(".toml") or basename_current_file != "translation.toml":
+            continue
+
        only_reference_file = False
-        current_keys = read_toml_keys(branch_path / file_path)
+        report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
+        current_keys = read_toml_keys(os.path.join(branch, file_path))
        reference_key_count = len(reference_keys)
        current_key_count = len(current_keys)

@@ -259,37 +242,20 @@ def check_for_differences(reference_file, file_list, branch, actor):
                report.append(
                    f"    - **_Extra keys in `{locale_dir}/{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
-                report.append("")
-                report.append("    Use the following command to remove them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
-                )
-                report.append("")
            if extra_keys_list:
                report.append(
                    f"    - **_Missing keys in `{locale_dir}/{basename_current_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
-                report.append("")
-                report.append("    Use the following command to add them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
-                )
-                report.append("")
-
-            if missing_keys_list or extra_keys_list:
-                report.append(
-                    "    See: https://github.com/Stirling-Tools/Stirling-PDF/tree/main/scripts/translations#2-translation_mergerpy"
-                )
        else:
            report.append("2. **Test Status:** ✅ **_Passed_**")

-        if find_duplicate_keys(branch_path / file_normpath):
+        if find_duplicate_keys(os.path.join(branch, file_normpath)):
            has_differences = True
            output = "\n".join(
                [
                    f"      - `{key}`: first at {first}, duplicate at `{duplicate}`"
                    for key, first, duplicate in find_duplicate_keys(
-                        branch_path / file_normpath
+                        os.path.join(branch, file_normpath)
                    )
                ]
            )
@@ -322,9 +288,7 @@ def check_for_differences(reference_file, file_list, branch, actor):


 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(
-        description="Find missing keys in TOML translation files"
-    )
+    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
    parser.add_argument(
        "--actor",
        required=False,
@@ -6,4 +6,3 @@ pillow
 unoserver
 opencv-python-headless
 pre-commit
-brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
@@ -4,33 +4,33 @@
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
 #
-cfgv==3.5.0 \
-    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
-    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+cfgv==3.4.0 \
+    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
+    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
    # via pre-commit
 distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.20.3 \
-    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
-    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
+filelock==3.19.1 \
+    --hash=sha256:66eda1888b0171c998b35be2bcc0f6d75c388a7ce20c3f3f37aa8e96c2dddf58 \
+    --hash=sha256:d38e30481def20772f5baf097c122c3babc4fcdb7e14e57049eb9d88c6dc017d
    # via virtualenv
-identify==2.6.16 \
-    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
-    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
+identify==2.6.15 \
+    --hash=sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757 \
+    --hash=sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf
    # via pre-commit
-nodeenv==1.10.0 \
-    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
-    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+nodeenv==1.9.1 \
+    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
+    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
    # via pre-commit
-platformdirs==4.5.1 \
-    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
-    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
+platformdirs==4.4.0 \
+    --hash=sha256:abd01743f24e5287cd7a5db3752faf1a2d65353f38ec26d98e25a6db65958c85 \
+    --hash=sha256:ca753cf4d81dc309bc67b0ea38fd15dc97bc30ce419a7f58d13eb3bf14c4febf
    # via virtualenv
-pre-commit==4.5.1 \
-    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
-    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
+pre-commit==4.3.0 \
+    --hash=sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8 \
+    --hash=sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16
    # via -r .github/scripts/requirements_pre_commit.in
 pyyaml==6.0.3 \
    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
@@ -107,7 +107,7 @@ pyyaml==6.0.3 \
    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
    # via pre-commit
-virtualenv==20.36.1 \
-    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
-    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
+virtualenv==20.34.0 \
+    --hash=sha256:341f5afa7eee943e4984a9207c025feedd768baff6753cd660c857ceb3e36026 \
+    --hash=sha256:44815b2c9dee7ed86e387b842a84f20b93f7f417f95886ca1996a72a4138eb1a
    # via pre-commit
@@ -1,2 +1 @@
 tomlkit
-tomli-w
@@ -4,11 +4,7 @@
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
 #
-tomli-w==1.2.0 \
-    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
-    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
-    # via -r .github/scripts/requirements_sync_readme.in
-tomlkit==0.14.0 \
-    --hash=sha256:592064ed85b40fa213469f81ac584f67a4f2992509a7c3ea2d632208623a3680 \
-    --hash=sha256:cf00efca415dbd57575befb1f6634c4f42d2d87dbba376128adb42c121b87064
+tomlkit==0.13.3 \
+    --hash=sha256:430cf247ee57df2b94ee3fbe588e71d362a941ebb545dec29b53961d61add2a1 \
+    --hash=sha256:c89c649d79ee40629a9fda55f8ace8c6a1b42deb912b2a8fd8d942ddadb606b0
    # via -r .github/scripts/requirements_sync_readme.in
@@ -11,10 +11,6 @@ on:
      allow_fork:
        description: "Allow deploying fork PR?"
        required: false
-        type: choice
-        options:
-          - "true"
-          - "false"
        default: "false"

 permissions:
@@ -35,18 +31,18 @@ jobs:
      pr_ref: ${{ steps.resolve.outputs.ref }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
        with:
          egress-policy: audit

      - name: Resolve PR info
        id: resolve
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const { owner, repo } = context.repo;
            let prNumber = context.eventName === 'workflow_dispatch'
-              ? parseInt(context.payload.inputs.pr, 10)
+              ? parseInt(process.env.INPUT_PR, 10)
              : context.payload.number;

            if (!Number.isInteger(prNumber)) { core.setFailed('Invalid PR number'); return; }
@@ -111,12 +107,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
        with:
          egress-policy: audit

      - name: Checkout main repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: ${{ github.repository }}
          ref: main
@@ -132,13 +128,13 @@ jobs:

      - name: Add deployment started comment
        id: deployment-started
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
-
+            
            // Delete previous V2 deployment comments to avoid clutter
            const { data: comments } = await github.rest.issues.listComments({
              owner,
@@ -161,7 +157,7 @@ jobs:
                comment_id: comment.id
              });
            }
-
+            
            // Create new deployment started comment
            const { data: newComment } = await github.rest.issues.createComment({
              owner,
@@ -172,15 +168,15 @@ jobs:
            return newComment.id;

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: ${{ needs.check-pr.outputs.pr_repository }}
          ref: ${{ needs.check-pr.outputs.pr_ref }}
          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0 # Fetch full history for commit hash detection
+          fetch-depth: 0  # Fetch full history for commit hash detection

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Get version number
        id: versionNumber
@@ -189,58 +185,93 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Get commit hash for app
-        id: commit-hash
+      - name: Get commit hashes for frontend and backend
+        id: commit-hashes
        run: |
-          # Get last commit that touched the application code
-          APP_HASH=$(git log -1 --format="%H" -- . 2>/dev/null || echo "")
-          if [ -z "$APP_HASH" ]; then
-            APP_HASH="no-changes"
+          # Get last commit that touched the frontend folder, docker/frontend, or docker/compose
+          FRONTEND_HASH=$(git log -1 --format="%H" -- frontend/ docker/frontend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$FRONTEND_HASH" ]; then
+            FRONTEND_HASH="no-frontend-changes"
          fi

-          echo "App hash: $APP_HASH"
-          echo "app_hash=$APP_HASH" >> $GITHUB_OUTPUT
-
-          # Short hash for tags
-          if [ "$APP_HASH" = "no-changes" ]; then
-            echo "app_short=no-changes" >> $GITHUB_OUTPUT
+          # Get last commit that touched backend code, docker/backend, or docker/compose
+          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$BACKEND_HASH" ]; then
+            BACKEND_HASH="no-backend-changes"
+          fi
+          
+          echo "Frontend hash: $FRONTEND_HASH"
+          echo "Backend hash: $BACKEND_HASH"
+          
+          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
+          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
+          
+          # Short hashes for tags
+          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
+            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
          else
-            echo "app_short=${APP_HASH:0:8}" >> $GITHUB_OUTPUT
+            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
+          fi
+          
+          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
+            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
+          else
+            echo "backend_short=${BACKEND_HASH:0:8}" >> $GITHUB_OUTPUT
          fi

-      - name: Check if image exists
-        id: check-image
+      - name: Check if frontend image exists
+        id: check-frontend
        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }} >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Image already exists, skipping build"
+            echo "Frontend image already exists, skipping build"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Image needs to be built"
+            echo "Frontend image needs to be built"
          fi

-      - name: Build and push V2 image
-        if: steps.check-image.outputs.exists == 'false'
+      - name: Check if backend image exists
+        id: check-backend
+        run: |
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }} >/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Backend image already exists, skipping build"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Backend image needs to be built"
+          fi
+
+      - name: Build and push V2 frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./docker/frontend/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Build and push V2 backend image
+        if: steps.check-backend.outputs.exists == 'false'
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          file: ./docker/backend/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Deploy V2 to VPS
@@ -248,16 +279,17 @@ jobs:
        run: |
          # Use same port strategy as regular PRs - just the PR number
          V2_PORT=${{ needs.check-pr.outputs.pr_number }}
-
-          # Create docker-compose for V2 with unified embedded image
+          BACKEND_PORT=$((V2_PORT + 10000))  # Backend on higher port to avoid conflicts
+          
+          # Create docker-compose for V2 with separate frontend and backend
          cat > docker-compose.yml << EOF
          version: '3.3'
          services:
-            stirling-pdf-v2:
-              container_name: stirling-pdf-v2-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
+            stirling-pdf-v2-backend:
+              container_name: stirling-pdf-v2-backend-pr-${{ needs.check-pr.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
              ports:
-                - "${V2_PORT}:8080"
+                - "${BACKEND_PORT}:8080"    # Backend API port
              volumes:
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
@@ -269,7 +301,7 @@ jobs:
                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
-                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
+                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"
                UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                SYSTEM_MAXFILESIZE: "100"
                METRICS_ENABLED: "true"
@@ -277,12 +309,23 @@ jobs:
                SWAGGER_SERVER_URL: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
                baseUrl: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
              restart: on-failure:5
+
+            stirling-pdf-v2-frontend:
+              container_name: stirling-pdf-v2-frontend-pr-${{ needs.check-pr.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+              ports:
+                - "${V2_PORT}:80"          # Frontend port (same as regular PRs)
+              environment:
+                VITE_API_BASE_URL: "http://${{ secrets.VPS_HOST }}:${BACKEND_PORT}"
+              depends_on:
+                - stirling-pdf-v2-backend
+              restart: on-failure:5
          EOF

          # Deploy to VPS
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose-v2.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose-v2.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
            # Create V2 PR-specific directories
            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}

@@ -292,15 +335,15 @@ jobs:
            # Stop any existing container and clean up
            cd /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}
            docker-compose down --remove-orphans 2>/dev/null || true
-
+            
            # Start the new container
            docker-compose pull
            docker-compose up -d
-
+            
            # Clean up unused Docker resources to save space
            docker system prune -af --volumes || true

-            # Clean up old images (older than 2 weeks)
+            # Clean up old backend/frontend images (older than 2 weeks)
            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
          ENDSSH

@@ -309,14 +352,14 @@ jobs:

      - name: Post V2 deployment URL to PR
        if: success()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
            const v2Port = ${{ steps.deploy.outputs.v2_port }};
-
+            
            // Delete the "deploying..." comment since we're posting the final result
            const deploymentStartedId = ${{ steps.deployment-started.outputs.result }};
            if (deploymentStartedId) {
@@ -331,12 +374,12 @@ jobs:
                console.log(`Could not delete deployment started comment: ${error.message}`);
              }
            }
-
-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;
+            
+            const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${v2Port}`;
            const httpsUrl = `https://${v2Port}.ssl.stirlingpdf.cloud`;

            const commentBody = `## 🚀 V2 Auto-Deployment Complete!\n\n` +
-                              `Your V2 PR with embedded architecture has been deployed!\n\n` +
+                              `Your V2 PR with the new frontend/backend split architecture has been deployed!\n\n` +
                              `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
                              `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                              `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
@@ -359,12 +402,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -376,25 +419,25 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Clean up V2 deployment comments
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ github.event.pull_request.number }};
-
+            
            // Find and delete V2 deployment comments
            const { data: comments } = await github.rest.issues.listComments({
              owner,
              repo,
              issue_number: prNumber
            });
-
+            
            const v2Comments = comments.filter(c =>
              c.body?.includes("## 🚀 V2 Auto-Deployment Complete!") &&
              c.user?.type === "Bot"
            );
-
+            
            for (const comment of v2Comments) {
              await github.rest.issues.deleteComment({
                owner,
@@ -407,12 +450,12 @@ jobs:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Cleanup V2 deployment
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << 'ENDSSH'
            if [ -d "/stirling/V2-PR-${{ github.event.pull_request.number }}" ]; then
              echo "Found V2 PR directory, proceeding with cleanup..."

@@ -426,8 +469,9 @@ jobs:
              # Remove V2 PR-specific directories
              rm -rf /stirling/V2-PR-${{ github.event.pull_request.number }}

-              # Clean up V2 container by name (in case compose cleanup missed it)
-              docker rm -f stirling-pdf-v2-pr-${{ github.event.pull_request.number }} || true
+              # Clean up V2 containers by name (in case compose cleanup missed them)
+              docker rm -f stirling-pdf-v2-frontend-pr-${{ github.event.pull_request.number }} || true
+              docker rm -f stirling-pdf-v2-backend-pr-${{ github.event.pull_request.number }} || true

              echo "V2 cleanup completed"
            else
@@ -3,31 +3,6 @@ name: PR Deployment via Comment
 on:
  issue_comment:
    types: [created]
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: "PR number to deploy"
-        required: true
-      enable_prototypes:
-        description: "Build with prototypes frontend"
-        required: false
-        type: boolean
-        default: false
-      enable_pro:
-        description: "Enable pro features"
-        required: false
-        type: boolean
-        default: false
-      enable_enterprise:
-        description: "Enable enterprise features"
-        required: false
-        type: boolean
-        default: false
-      disable_security:
-        description: "Disable security/login"
-        required: false
-        type: boolean
-        default: true

 permissions:
  contents: read
@@ -39,27 +14,24 @@ jobs:
    permissions:
      issues: write
    if: |
-      vars.CI_PROFILE != 'lite' && (
-        github.event_name == 'workflow_dispatch' ||
-        (
-          github.event.issue.pull_request &&
-          (
-            contains(github.event.comment.body, 'prdeploy') ||
-            contains(github.event.comment.body, 'deploypr')
-          )
-          &&
-          (
-            github.event.comment.user.login == 'frooodle' ||
-            github.event.comment.user.login == 'sf298' ||
-            github.event.comment.user.login == 'Ludy87' ||
-            github.event.comment.user.login == 'balazs-szucs' ||
-            github.event.comment.user.login == 'reecebrowne' ||
-            github.event.comment.user.login == 'DarioGii' ||
-            github.event.comment.user.login == 'EthanHealy01' ||
-            github.event.comment.user.login == 'jbrunton96' ||
-            github.event.comment.user.login == 'ConnorYoh'
-          )
-        )
+      vars.CI_PROFILE != 'lite' &&
+      github.event.issue.pull_request &&
+      (
+        contains(github.event.comment.body, 'prdeploy') ||
+        contains(github.event.comment.body, 'deploypr')
+      )
+      &&
+      (
+        github.event.comment.user.login == 'frooodle' ||
+        github.event.comment.user.login == 'sf298' ||
+        github.event.comment.user.login == 'Ludy87' ||
+        github.event.comment.user.login == 'LaserKaspar' ||
+        github.event.comment.user.login == 'sbplat' ||
+        github.event.comment.user.login == 'reecebrowne' ||
+        github.event.comment.user.login == 'DarioGii' ||
+        github.event.comment.user.login == 'EthanHealy01' ||
+        github.event.comment.user.login == 'jbrunton96' ||
+        github.event.comment.user.login == 'ConnorYoh'
      )
    outputs:
      pr_number: ${{ steps.get-pr.outputs.pr_number }}
@@ -67,15 +39,14 @@ jobs:
      disable_security: ${{ steps.check-security-flag.outputs.disable_security }}
      enable_pro: ${{ steps.check-pro-flag.outputs.enable_pro }}
      enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }}
-      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -91,9 +62,7 @@ jobs:
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
-            const prNumber = context.eventName === 'workflow_dispatch'
-              ? context.payload.inputs.pr_number
-              : context.payload.issue.number;
+            const prNumber = context.payload.issue.number;
            console.log(`PR Number: ${prNumber}`);
            core.setOutput('pr_number', prNumber);

@@ -101,14 +70,12 @@ jobs:
        id: check-security-flag
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_DISABLE_SECURITY: ${{ inputs.disable_security }}
        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "disable_security=$DISPATCH_DISABLE_SECURITY" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+          if [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+            echo "Security flags detected in comment"
            echo "disable_security=false" >> $GITHUB_OUTPUT
          else
+            echo "No security flags detected in comment"
            echo "disable_security=true" >> $GITHUB_OUTPUT
          fi

@@ -116,43 +83,22 @@ jobs:
        id: check-pro-flag
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PRO: ${{ inputs.enable_pro }}
-          DISPATCH_ENTERPRISE: ${{ inputs.enable_enterprise }}
        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_pro=$DISPATCH_PRO" >> $GITHUB_OUTPUT
-            echo "enable_enterprise=$DISPATCH_ENTERPRISE" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+          if [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+            echo "pro flags detected in comment"
            echo "enable_pro=true" >> $GITHUB_OUTPUT
            echo "enable_enterprise=false" >> $GITHUB_OUTPUT
          elif [[ "$COMMENT_BODY" == *"enterprise"* ]]; then
+            echo "enterprise flags detected in comment"
            echo "enable_enterprise=true" >> $GITHUB_OUTPUT
            echo "enable_pro=true" >> $GITHUB_OUTPUT
          else
+            echo "No pro or enterprise flags detected in comment"
            echo "enable_pro=false" >> $GITHUB_OUTPUT
            echo "enable_enterprise=false" >> $GITHUB_OUTPUT
          fi

-      - name: Check for prototypes flag
-        id: check-prototypes-flag
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PROTOTYPES: ${{ inputs.enable_prototypes }}
-        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_prototypes=$DISPATCH_PROTOTYPES" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"prototypes"* ]]; then
-            echo "Prototypes flag detected in comment"
-            echo "enable_prototypes=true" >> $GITHUB_OUTPUT
-          else
-            echo "No prototypes flag detected in comment"
-            echo "enable_prototypes=false" >> $GITHUB_OUTPUT
-          fi
-
      - name: Add 'in_progress' reaction to comment
-        if: github.event_name == 'issue_comment'
        id: add-eyes-reaction
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
@@ -183,12 +129,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -200,24 +146,17 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
          token: ${{ steps.setup-bot.outputs.token }}

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "17"
          distribution: "temurin"

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Run Gradle Command
        run: |
          if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -225,18 +164,15 @@ jobs:
          else
            export DISABLE_ADDITIONAL_FEATURES=false
          fi
-          task backend:build
+          ./gradlew clean build
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          STIRLING_PDF_DESKTOP_UI: false

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -247,30 +183,14 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image
-        if: needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-engine
-          cache-to: type=gha,mode=max,scope=stirling-pdf-engine
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          build-args: VERSION_TAG=alpha
          platforms: linux/amd64

      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Deploy to VPS
@@ -302,78 +222,47 @@ jobs:
            PREMIUM_PROFEATURES_AUDIT_ENABLED="false"
          fi

-          ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
-          PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
-          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"
-
-          # Build engine env vars for backend (only set when prototypes enabled)
-          if [ "$ENABLE_PROTOTYPES" == "true" ]; then
-            AI_ENGINE_VARS="
-                SYSTEM_AIENGINE_ENABLED: \"true\"
-                SYSTEM_AIENGINE_URL: \"http://stirling-pdf-engine-pr-${PR_NUMBER}:5001\""
-            ENGINE_SERVICE="
-            stirling-pdf-engine:
-              container_name: stirling-pdf-engine-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
-              environment:
-                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
-              networks:
-                - pr-network
-              restart: on-failure:5"
-            NETWORK_SECTION="
-          networks:
-            pr-network:"
-            BACKEND_NETWORK="
-              networks:
-                - pr-network"
-          else
-            AI_ENGINE_VARS=""
-            ENGINE_SERVICE=""
-            NETWORK_SECTION=""
-            BACKEND_NETWORK=""
-          fi
-
          # First create the docker-compose content locally
          cat > docker-compose.yml << EOF
          version: '3.3'
          services:
            stirling-pdf:
-              container_name: stirling-pdf-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
+              container_name: stirling-pdf-pr-${{ needs.check-comment.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
              ports:
-                - "${PR_NUMBER}:8080"
+                - "${{ needs.check-comment.outputs.pr_number }}:8080"
              volumes:
-                - /stirling/PR-${PR_NUMBER}/data:/usr/share/tessdata:rw
-                - /stirling/PR-${PR_NUMBER}/config:/configs:rw
-                - /stirling/PR-${PR_NUMBER}/logs:/logs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/data:/usr/share/tessdata:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/config:/configs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/logs:/logs:rw
              environment:
                DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
                SYSTEM_DEFAULTLOCALE: en-GB
-                UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
-                UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
-                UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"
+                UI_APPNAME: "Stirling-PDF PR#${{ needs.check-comment.outputs.pr_number }}"
+                UI_HOMEDESCRIPTION: "PR#${{ needs.check-comment.outputs.pr_number }} for Stirling-PDF Latest"
+                UI_APPNAMENAVBAR: "PR#${{ needs.check-comment.outputs.pr_number }}"
                SYSTEM_MAXFILESIZE: "100"
                METRICS_ENABLED: "true"
                SYSTEM_GOOGLEVISIBILITY: "false"
                PREMIUM_KEY:                         "${PREMIUM_KEY}"
                PREMIUM_ENABLED:                     "${PREMIUM_ENABLED}"
-                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"${AI_ENGINE_VARS}
-              restart: on-failure:5${BACKEND_NETWORK}${ENGINE_SERVICE}${NETWORK_SECTION}
+                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"
+              restart: on-failure:5
          EOF

          # Then copy the file and execute commands
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
            # Create PR-specific directories
-            mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}
+            mkdir -p /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/{data,config,logs}

            # Move docker-compose file to correct location
-            mv /tmp/docker-compose.yml /stirling/PR-${PR_NUMBER}/docker-compose.yml
+            mv /tmp/docker-compose.yml /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/docker-compose.yml

            # Start or restart the container
-            cd /stirling/PR-${PR_NUMBER}
+            cd /stirling/PR-${{ needs.check-comment.outputs.pr_number }}
            docker-compose pull
            docker-compose up -d
          ENDSSH
@@ -382,7 +271,7 @@ jobs:
          echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV

      - name: Add success reaction to comment
-        if: success() && github.event_name == 'issue_comment'
+        if: success()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
@@ -417,7 +306,7 @@ jobs:
            }

      - name: Add failure reaction to comment
-        if: failure() && github.event_name == 'issue_comment'
+        if: failure()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
@@ -447,7 +336,7 @@ jobs:
            const prNumber = ${{ needs.check-comment.outputs.pr_number }};
            const securityStatus = process.env.security_status || "Security Disabled";

-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${prNumber}`;
+            const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${prNumber}`;
            const commentBody = `## 🚀 PR Test Deployment\n\n` +
                              `Your PR has been deployed for testing!\n\n` +
                              `🔗 **Test URL:** [${deploymentUrl}](${deploymentUrl})\n` +
@@ -468,149 +357,3 @@ jobs:
          rm -f ../private.key docker-compose.yml
          echo "Cleanup complete."
        continue-on-error: true
-
-  handle-label-commands:
-    if: ${{ github.event.issue.pull_request != null }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Apply label commands
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-
-            const { comment, issue } = context.payload;
-            const commentBody = comment?.body ?? '';
-            if (!commentBody.includes('::label::')) {
-              core.info('No label commands detected in comment.');
-              return;
-            }
-
-            const configPath = path.join(process.env.GITHUB_WORKSPACE, '.github', 'config', 'repo_devs.json');
-            const repoDevsConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-            const label_changer = (repoDevsConfig.label_changer || []).map((login) => login.toLowerCase());
-
-            const commenter = (comment?.user?.login || '').toLowerCase();
-            if (!label_changer.includes(commenter)) {
-              core.info(`User ${commenter} is not authorized to manage labels.`);
-              return;
-            }
-
-            const labelsConfigPath = path.join(process.env.GITHUB_WORKSPACE, '.github', 'labels.yml');
-            const labelsFile = fs.readFileSync(labelsConfigPath, 'utf8');
-
-            const labelNameMap = new Map();
-            for (const match of labelsFile.matchAll(/-\s+name:\s*(?:"([^"]+)"|'([^']+)'|([^\n]+))/g)) {
-              const labelName = (match[1] ?? match[2] ?? match[3] ?? '').trim();
-
-              if (!labelName) {
-                continue;
-              }
-              const normalized = labelName.toLowerCase();
-              if (!labelNameMap.has(normalized)) {
-                labelNameMap.set(normalized, labelName);
-              }
-            }
-
-            if (!labelNameMap.size) {
-              core.warning('No labels could be read from .github/labels.yml; aborting label commands.');
-              return;
-            }
-
-            let allowedLabelNames = new Set(labelNameMap.values());
-
-            const labelsToAdd = new Set();
-            const labelsToRemove = new Set();
-            const commandRegex = /^(\w+)::(label)::"([^"]+)"/gim;
-            let match;
-            while ((match = commandRegex.exec(commentBody)) !== null) {
-              core.info(`Found label command: ${match[0]} (action: ${match[1]}, label: ${match[2]}, labelName: ${match[3]})`);
-              const action = match[1].toLowerCase();
-              const labelName = match[3].trim();
-
-              if (!labelName) {
-                continue;
-              }
-
-              const normalized = labelName.toLowerCase();
-              const resolvedLabelName = labelNameMap.get(normalized);
-              if (action === 'add') {
-                if (!resolvedLabelName) {
-                  core.warning(`Label "${labelName}" is not defined in .github/labels.yml and cannot be added.`);
-                  continue;
-                }
-                if (!allowedLabelNames.has(resolvedLabelName)) {
-                  core.warning(`Label "${resolvedLabelName}" is not allowed for add commands and will be skipped.`);
-                  continue;
-                }
-                labelsToAdd.add(resolvedLabelName);
-              } else if (action === 'rm') {
-                const labelToRemove = resolvedLabelName ?? labelName;
-                if (!resolvedLabelName) {
-                  core.warning(`Label "${labelName}" is not defined in .github/labels.yml; attempting to remove as provided.`);
-                }
-                labelsToRemove.add(labelToRemove);
-              }
-            }
-
-            const addLabels = Array.from(labelsToAdd);
-            const removeLabels = Array.from(labelsToRemove);
-
-            if (!addLabels.length && !removeLabels.length) {
-              core.info('No valid label commands found after parsing.');
-              return;
-            }
-
-            const issueParams = {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issue.number,
-            };
-
-            if (addLabels.length) {
-              core.info(`Adding labels: ${addLabels.join(', ')}`);
-              await github.rest.issues.addLabels({
-                ...issueParams,
-                labels: addLabels,
-              });
-            }
-
-            for (const labelName of removeLabels) {
-              core.info(`Removing label: ${labelName}`);
-              try {
-                await github.rest.issues.removeLabel({
-                  ...issueParams,
-                  name: labelName,
-                });
-              } catch (error) {
-                if (error.status === 404) {
-                  core.warning(`Label "${labelName}" was not present on the pull request.`);
-                } else {
-                  throw error;
-                }
-              }
-            }
-
-            await github.rest.issues.deleteComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: comment.id,
-            });
-            core.info('Processed label commands and deleted the comment.');
@@ -8,7 +8,7 @@ permissions:
  contents: read

 env:
-  SERVER_IP: ${{ secrets.NEW_VPS_IP }} # Add this to your GitHub secrets
+  SERVER_IP: ${{ secrets.VPS_IP }} # Add this to your GitHub secrets
  CLEANUP_PERFORMED: "false" # Add flag to track if cleanup occurred

 jobs:
@@ -21,12 +21,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -96,18 +96,19 @@ jobs:
            const hasDeploymentComment = deploymentComments.length > 0;
            core.setOutput('present', (hasLabel || hasDeploymentComment) ? 'true' : 'false');

+
      - name: Set up SSH
        if: steps.remove-label-comment.outputs.present == 'true'
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Cleanup PR deployment
        if: steps.remove-label-comment.outputs.present == 'true'
        id: cleanup
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << 'ENDSSH'
            if [ -d "/stirling/PR-${{ github.event.pull_request.number }}" ]; then
              echo "Found PR directory, proceeding with cleanup..."

@@ -121,9 +122,8 @@ jobs:
              # Remove PR-specific directories
              rm -rf /stirling/PR-${{ github.event.pull_request.number }}

-              # Remove the Docker images
+              # Remove the Docker image
              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
-              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true

              echo "PERFORMED_CLEANUP"
            else
@@ -1,104 +0,0 @@
-name: AI Engine CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  engine:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-        with:
-          enable-cache: true
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-
-      - name: Regenerate tool models
-        run: task engine:tool-models
-
-      - name: Verify tool models are up to date
-        run: |
-          if ! git diff --exit-code engine/src/stirling/models/tool_models.py; then
-            echo "tool_models.py is out of date."
-            echo "Run 'task engine:tool-models' locally and commit the updated file."
-            exit 1
-          fi
-
-      - name: Run fixers
-        run: task engine:fix
-
-      - name: Verify fixes are committed
-        id: fixer_changes
-        run: |
-          if ! git diff --quiet; then
-            git --no-pager diff --stat
-            echo "::error::There are issues with your Python code that will need to be fixed before they can be merged in. Run 'task engine:fix' to auto-fix what can be fixed automatically, then run 'task engine:check' to see what still needs fixing manually."
-            exit 1
-          fi
-
-      - name: Comment on fixer failures
-        if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const body = [
-              marker,
-              '### Engine Check Failed',
-              '',
-              'There are issues with your Python code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task engine:fix` to auto-fix what can be fixed automatically, then run `task engine:check` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Run linting
-        run: task engine:lint
-
-      - name: Run type checking
-        run: task engine:typecheck
-
-      - name: Run tests
-        run: task engine:test
@@ -5,7 +5,7 @@ on:
    types: [opened, edited]
    branches: [main]

-permissions: # required for secure-repo hardening
+permissions:  # required for secure-repo hardening
  contents: read

 jobs:
@@ -19,11 +19,11 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
+        uses: actions/ai-inference@b81b2afb8390ee6839b494a404766bef6493c7d9 # v1.2.8
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -1,128 +0,0 @@
-name: Publish to AUR
-
-on:
-  release:
-    types: [released]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the AUR push (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
-
-  publish-aur:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@v4
-
-      - name: Update stirling-pdf-bin PKGBUILD
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          DEB_SHA: ${{ needs.get-release-info.outputs.deb_sha256 }}
-        run: |
-          PKGBUILD=".github/aur/stirling-pdf-bin/PKGBUILD"
-          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-          sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-          sed -i "s/'PLACEHOLDER_DEB_SHA256'/'${DEB_SHA}'/" "$PKGBUILD"
-
-      - name: Update stirling-pdf-server-bin PKGBUILD
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          PKGBUILD=".github/aur/stirling-pdf-server-bin/PKGBUILD"
-          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-          sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-          sed -i "s/'PLACEHOLDER_JAR_SHA256'/'${JAR_SHA}'/" "$PKGBUILD"
-
-      - name: Show updated PKGBUILDs (for dry-run visibility)
-        run: |
-          echo "--- stirling-pdf-bin PKGBUILD ---"
-          cat .github/aur/stirling-pdf-bin/PKGBUILD
-          echo ""
-          echo "--- stirling-pdf-server-bin PKGBUILD ---"
-          cat .github/aur/stirling-pdf-server-bin/PKGBUILD
-
-      - name: Publish stirling-pdf-bin to AUR
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
-        with:
-          pkgname: stirling-pdf-bin
-          pkgbuild: .github/aur/stirling-pdf-bin/PKGBUILD
-          commit_username: Stirling PDF Inc
-          commit_email: contact@stirlingpdf.com
-          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-          commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
-
-      - name: Publish stirling-pdf-server-bin to AUR
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@v4.1.1
-        with:
-          pkgname: stirling-pdf-server-bin
-          pkgbuild: .github/aur/stirling-pdf-server-bin/PKGBUILD
-          commit_username: Stirling PDF Inc
-          commit_email: contact@stirlingpdf.com
-          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-          commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
@@ -2,9 +2,6 @@ name: "Auto Pull Request Labeler V2"
 on:
  pull_request_target:
    types: [opened, synchronize]
-    branches:
-      - main
-      - V3

 permissions:
  contents: read
@@ -16,11 +13,11 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -29,7 +26,7 @@ jobs:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

-      - uses: srvaroa/labeler@bf262763a8a8e191f5847873aecc0f29df84f957 # v1.14.0
+      - uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # v1.13.0
        with:
          config_path: .github/labeler-config-srvaroa.yml
          use_local_config: false
@@ -2,7 +2,7 @@ name: Build and Test Workflow

 on:
  pull_request:
-    branches: ["main"]
+    branches: ["main", "V2", "V2-gha"]
  workflow_dispatch:

 # cancel in-progress jobs if a new job is triggered
@@ -27,20 +27,18 @@ jobs:
    timeout-minutes: 3
    outputs:
      build: ${{ steps.changes.outputs.build }}
+      app: ${{ steps.changes.outputs.app }}
      project: ${{ steps.changes.outputs.project }}
      openapi: ${{ steps.changes.outputs.openapi }}
-      frontend: ${{ steps.changes.outputs.frontend }}
-      docker-base: ${{ steps.changes.outputs.docker-base }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Check for file changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: .github/config/.files.yaml
@@ -50,118 +48,32 @@ jobs:
    permissions:
      actions: read
      security-events: write
-      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
-        jdk-version: [21, 25]
+        jdk-version: [17, 21]
        spring-security: [true, false]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          java-version: ${{ matrix.jdk-version }}
          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Check Java formatting (Spotless)
-        if: matrix.jdk-version == 25 && matrix.spring-security == false
-        id: spotless-check
-        run: task backend:format:check
-        continue-on-error: true
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Comment on Java formatting failure
-        if: steps.spotless-check.outcome == 'failure'
-        continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const body = [
-              marker,
-              '### Java Formatting Check Failed',
-              '',
-              'Your code has formatting issues. Run the following command to fix them:',
-              '',
-              '```bash',
-              'task backend:format',
-              '```',
-              '',
-              'Then commit and push the changes.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if Java formatting issues found
-        if: steps.spotless-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Java Formatting Check Failed"
-          echo "============================================"
-          echo ""
-          echo "Your code has formatting issues."
-          echo "Run the following command to fix them:"
-          echo ""
-          echo "  task backend:format"
-          echo ""
-          echo "Then commit and push the changes."
-          echo "============================================"
-          exit 1
-
+          gradle-version: 8.14
      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
-        run: task backend:build:ci
+        run: ./gradlew clean build -PnoSpotless
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
-
      - name: Check Test Reports Exist
        if: always()
        run: |
@@ -179,14 +91,12 @@ jobs:
              exit 1
            fi
          done
-
      - name: Upload Test Reports
        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
          path: |
-            app/**/build/reports/jacoco/test
            app/**/build/reports/tests/
            app/**/build/test-results/
            app/**/build/reports/problems/
@@ -194,228 +104,92 @@ jobs:
          retention-days: 3
          if-no-files-found: warn

-      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
-        id: jacoco
-        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
-        with:
-          paths: |
-            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
-          token: ${{ secrets.GITHUB_TOKEN }}
-          min-coverage-overall: 10
-          min-coverage-changed-files: 0
-          comment-type: summary
-
  check-generateOpenApiDocs:
    if: needs.files-changed.outputs.openapi == 'true'
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "17"
          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
      - name: Generate OpenAPI documentation
-        run: task backend:swagger
+        run: ./gradlew :stirling-pdf:generateOpenApiDocs
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
-
+      
      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: openapi-docs
          path: ./SwaggerDoc.json

  frontend-validation:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
-          node-version: "22"
-          cache: "npm"
+          node-version: '22'
+          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Quality-check frontend
-        id: frontend-check
-        run: task frontend:check:all
-        continue-on-error: true
-      - name: Comment on frontend check failure
-        if: steps.frontend-check.outcome == 'failure'
-        continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const body = [
-              marker,
-              '### Frontend Check Failed',
-              '',
-              'There are issues with your frontend code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-      - name: Fail if frontend check failed
-        if: steps.frontend-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Frontend Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your frontend code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task frontend:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task frontend:check:all'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
+      - name: Install frontend dependencies
+        run: cd frontend && npm ci
+      - name: Type-check frontend
+        run: cd frontend && npm run prebuild && npm run typecheck:all
+      - name: Lint frontend
+        run: cd frontend && npm run lint
+      - name: Build frontend
+        run: cd frontend && npm run build
+      - name: Run frontend tests
+        run: cd frontend && npm run test -- --run
      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: frontend-build
          path: frontend/dist/
          retention-days: 3

-  playwright-e2e:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install Playwright (chromium only)
-        run: task frontend:test:e2e:install -- chromium
-      - name: Run E2E tests (chromium)
-        run: task frontend:test:e2e -- --project=chromium
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: playwright-report-pr-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7
-
  check-licence:
    if: needs.files-changed.outputs.build == 'true'
    needs: [files-changed, build]
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
-
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "17"
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Check licenses for compatibility
-        run: task backend:licenses:check
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+      - name: check the licenses for compatibility
+        run: ./gradlew clean checkLicense

      - name: FAILED - check the licenses for compatibility
        if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dependencies-without-allowed-license.json
          path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -439,47 +213,24 @@ jobs:
    #     )

    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: read
-      checks: write

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up Java 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "17"
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-
-      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
-      - name: Expose GitHub runtime for Buildx cache
-        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Install Docker Compose
        run: |
@@ -487,16 +238,15 @@ jobs:
          sudo chmod +x /usr/local/bin/docker-compose

      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
+          cache: 'pip' # caching pip dependencies
          cache-dependency-path: ./testing/cucumber/requirements.txt

      - name: Pip requirements
        run: |
          pip install --require-hashes -r ./testing/cucumber/requirements.txt
-          pip install behave-html-formatter

      - name: Run Docker Compose Tests
        run: |
@@ -504,38 +254,6 @@ jobs:
          chmod +x ./testing/test.sh
          chmod +x ./testing/test_disabledEndpoints.sh
          ./testing/test.sh
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DOCKER_BASE_CHANGED: ${{ needs.files-changed.outputs.docker-base }}
-
-      - name: Upload Cucumber Report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: cucumber-report
-          path: testing/cucumber/report.html
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: docker-compose-test-reports
-          path: testing/reports/
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Cucumber Test Report
-        if: always()
-        uses: dorny/test-reporter@b082adf0eced0765477756c2a610396589b8c637 # v2.5.0
-        with:
-          name: Cucumber Tests
-          path: testing/cucumber/junit/*.xml
-          reporter: java-junit
-          fail-on-error: false

  test-build-docker-images:
    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
@@ -547,32 +265,18 @@ jobs:
        include:
          - docker-rev: docker/embedded/Dockerfile
            artifact-suffix: Dockerfile
-            cache-scope: stirling-pdf-latest
          - docker-rev: docker/embedded/Dockerfile.ultra-lite
            artifact-suffix: Dockerfile.ultra-lite
-            cache-scope: stirling-pdf-ultra-lite
          - docker-rev: docker/embedded/Dockerfile.fat
            artifact-suffix: Dockerfile.fat
-            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Free disk space on runner
        run: |
@@ -581,60 +285,29 @@ jobs:
          docker system prune -af || true
          echo "Disk space after cleanup:" && df -h

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "17"
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+          gradle-version: 8.14

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Build application
-        run: task backend:build
+        run: ./gradlew clean build
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
          STIRLING_PDF_DESKTOP_UI: false

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-
-      - name: Build base image locally (PR base change only)
-        if: github.event_name == 'pull_request' && needs.files-changed.outputs.docker-base == 'true'
-        run: |
-          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
-
-      - name: Set base image and platform for this build
-        id: build-params
-        run: |
-          if [ "${{ github.event_name }}" == "pull_request" ] && [ "${{ needs.files-changed.outputs.docker-base }}" == "true" ]; then
-            echo "base_image=stirling-pdf-base:pr-test" >> $GITHUB_OUTPUT
-            echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
-          else
-            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> $GITHUB_OUTPUT
-            echo "platforms=linux/amd64,linux/arm64/v8" >> $GITHUB_OUTPUT
-          fi
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Build ${{ matrix.docker-rev }}
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
@@ -643,17 +316,15 @@ jobs:
          context: .
          file: ./${{ matrix.docker-rev }}
          push: false
-          cache-from: type=gha,scope=${{ matrix.cache-scope }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Upload Reports
        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: reports-docker-${{ matrix.artifact-suffix }}
          path: |
@@ -7,8 +7,6 @@ on:
    types: [opened, synchronize, reopened]
    paths:
      - "frontend/public/locales/*/translation.toml"
-      - ".github/scripts/check_language_toml.py"
-      - ".github/workflows/check_toml.yml"

 # cancel in-progress jobs if a new job is triggered
 concurrency:
@@ -27,12 +25,12 @@ jobs:
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout main branch first
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -196,12 +194,13 @@ jobs:
            core.exportVariable("REFERENCE_FILE", referenceFilePath);

      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: "3.12"

      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
+        run: |
+          pip install tomli-w

      - name: Run Python script to check files
        id: run-check
@@ -0,0 +1,79 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+#disable for now
+#on:
+#  push:
+#    branches: ["main"]
+#  pull_request:
+    # The branches below must be a subset of the branches above
+#    branches: ["main"]
+#  schedule:
+#    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["java"]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          category: "/language:${{matrix.language}}"
@@ -17,13 +17,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: "Checkout Repository"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: "Dependency Review"
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
+        uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0
        with:
-          config-file: "./.github/config/dependency-review-config.yml"
+          config-file: './.github/config/dependency-review-config.yml'
@@ -18,15 +18,15 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v3

      - name: Get commit hashes for frontend and backend
        id: commit-hashes
@@ -36,26 +36,26 @@ jobs:
          if [ -z "$FRONTEND_HASH" ]; then
            FRONTEND_HASH="no-frontend-changes"
          fi
-
+          
          # Get last commit that touched backend code, docker/backend, or docker/compose
          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
          if [ -z "$BACKEND_HASH" ]; then
            BACKEND_HASH="no-backend-changes"
          fi
-
+          
          echo "Frontend hash: $FRONTEND_HASH"
          echo "Backend hash: $BACKEND_HASH"
-
+          
          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-
+          
          # Short hashes for tags
          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
          else
            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
          fi
-
+          
          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
          else
@@ -84,52 +84,51 @@ jobs:
            echo "Backend image needs to be built"
          fi

+
      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Build and push frontend image
        if: steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/frontend/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-v2-frontend
-          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
          tags: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64
-
+      
      - name: Build and push backend image
        if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/backend/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-v2-backend
-          cache-to: type=gha,mode=max,scope=stirling-v2-backend
          tags: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

+
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
          chmod 600 ../private.key

+
      - name: Deploy to VPS on port 3000
        run: |
          export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
-
+      
          cat > $UNIQUE_NAME << EOF
          version: '3.3'
          services:
@@ -155,24 +154,24 @@ jobs:
                SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
                baseUrl: "https://demo.stirlingpdf.cloud"
              restart: on-failure:5
-
+      
            frontend:
              container_name: stirling-v2-frontend
              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
              ports:
                - "3000:80"
              environment:
-                VITE_API_BASE_URL: "http://${{ secrets.NEW_VPS_HOST }}:13000"
+                VITE_API_BASE_URL: "http://${{ secrets.VPS_HOST }}:13000"
              depends_on:
                - backend
              restart: on-failure:5
          EOF
-
+      
          # Copy to remote with unique name
-          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/$UNIQUE_NAME
-
+          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/$UNIQUE_NAME
+      
          # SSH and rename/move atomically to avoid interference
-          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
            mkdir -p /stirling/V2/{data,config,logs}
            mv /tmp/$UNIQUE_NAME /stirling/V2/docker-compose.yml
            cd /stirling/V2
@@ -187,3 +186,4 @@ jobs:
        if: always()
        run: |
          rm -f ../private.key
+
@@ -1,520 +0,0 @@
-name: License Report Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  files-changed:
-    name: detect what files changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    outputs:
-      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
-      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          filters: .github/config/.files.yaml
-
-  generate-frontend-license-report:
-    if: needs.files-changed.outputs.licenses-frontend == 'true'
-    name: Generate Frontend License Report
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout PR head (default)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Checkout BASE branch (safe script)
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: base
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install frontend dependencies
-        working-directory: frontend
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        run: npm ci --ignore-scripts --audit=false --fund=false
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Generate frontend license report (internal PR)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        env:
-          PR_IS_FORK: "false"
-        run: task frontend:licenses:generate
-
-      - name: Generate frontend license report (fork PRs, pinned)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        working-directory: frontend
-        run: |
-          mkdir -p src/assets
-          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
-
-      - name: Postprocess with project script (BASE version)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          PR_IS_FORK: "true"
-        run: |
-          node base/frontend/scripts/generate-licenses.js \
-            --input frontend/src/assets/3rdPartyLicenses.json
-
-      - name: Copy postprocessed artifacts back (fork PRs)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        run: |
-          mkdir -p frontend/src/assets
-          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
-          fi
-          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
-            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
-          fi
-
-      - name: Check for license warnings
-        run: |
-          if [ -f "frontend/src/assets/license-warnings.json" ]; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-
-      # PR Event: Check licenses and comment on PR
-      - name: Delete previous license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            // Get all comments on the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            // Filter for license check comments
-            const licenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Frontend License Check Passed') ||
-              comment.body.includes('## ❌ Frontend License Check Failed')
-            );
-
-            // Delete old license check comments
-            for (const comment of licenseComments) {
-              console.log(`Deleting old license check comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Summarize results (fork PRs)
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) || github.actor == 'dependabot[bot]'
-        run: |
-          {
-            echo "## Frontend License Check"
-            echo ""
-            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
-              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/src/assets/license-warnings.json" ]; then
-                echo ""
-                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
-              fi
-            else
-              echo "✅ **Passed** – no license warnings detected."
-            fi
-            echo ""
-            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Comment on PR - License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-
-            let commentBody;
-
-            if (hasWarnings) {
-              // Read warnings file to get specific issues
-              const fs = require('fs');
-              let warningDetails = '';
-              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
-                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
-              } catch (e) {
-                warningDetails = 'Unable to read warning details';
-              }
-
-              commentBody = `## ❌ Frontend License Check Failed
-
-              The frontend license check has detected compatibility warnings that require review:
-
-              ${warningDetails}
-
-              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Frontend License Check Passed
-
-              All frontend licenses have been validated and no compatibility warnings were detected.
-
-              The frontend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ License warnings detected. Failing the workflow."
-          exit 1
-
-      # Push Event: Commit license files and create PR
-      - name: Commit changes (Push only)
-        if: github.event_name == 'push'
-        run: |
-          git add frontend/src/assets/3rdPartyLicenses.json
-          # Note: Do NOT commit license-warnings.json - it's only for PR review
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (Push only)
-        if: github.event_name == 'push'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the frontend license report based on changes to package.json dependencies."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          The following licenses may require review for corporate compatibility:
-
-          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
-
-          Please review these licenses to ensure they are acceptable for your use case."
-          fi
-
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (Push only)
-        id: cpr
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Frontend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-frontend-3rd-party-licenses
-          base: main
-          title: "Update Frontend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,frontend
-          draft: false
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-  generate-backend-license-report:
-    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: files-changed
-    name: Generate Backend License Report
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Check licenses and generate report
-        id: license-check
-        run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: false
-          STIRLING_PDF_DESKTOP_UI: true
-
-      - name: Check for license compatibility issues
-        run: |
-          if [ -f build/reports/dependency-license/dependencies-without-allowed-license.json ] && \
-             jq '.dependenciesWithoutAllowedLicenses | length > 0' build/reports/dependency-license/dependencies-without-allowed-license.json | grep -q true; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-        if: always()
-
-      - name: Upload artifact on license issues
-        if: env.LICENSE_WARNINGS_EXIST == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: backend-dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-
-      - name: Move license file
-        if: env.LICENSE_CHECK_FAILED != 'true' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          mkdir -p app/core/src/main/resources/static
-          cp build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
-
-      - name: Delete previous backend license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            const backendLicenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Backend License Check Passed') ||
-              comment.body.includes('## ❌ Backend License Check Failed')
-            );
-
-            for (const comment of backendLicenseComments) {
-              console.log(`Deleting old backend license comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Comment on PR - Backend License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-            const fs = require('fs');
-            let warningDetails = '';
-
-            if (hasWarnings) {
-              try {
-                const warningsFile = 'build/reports/dependency-license/dependencies-without-allowed-license.json';
-                if (fs.existsSync(warningsFile)) {
-                  const data = JSON.parse(fs.readFileSync(warningsFile, 'utf8'));
-                  if (data.length > 0) {
-                    warningDetails = data.map(dep => `- **${dep.moduleName}@${dep.moduleVersion}** – ${dep.moduleLicenses.map(l => l.licenseName).join(', ')}`).join('\n');
-                  }
-                }
-              } catch (e) {
-                warningDetails = 'Unable to parse warning details.';
-              }
-            }
-
-            let commentBody;
-            if (hasWarnings) {
-              commentBody = `## ❌ Backend License Check Failed
-
-              The backend license check has detected dependencies with incompatible or unallowed licenses:
-
-              ${warningDetails || 'See uploaded artifact for details.'}
-
-              **Action Required:** Please review these licenses and resolve before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Backend License Check Passed
-
-              All backend dependencies have valid and allowed licenses.
-
-              The backend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ Backend license warnings detected. Failing the workflow."
-          exit 1
-
-      - name: Commit changes (push only)
-        if: github.event_name == 'push' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          git config user.name "${{ steps.setup-bot.outputs.committer }}"
-          git config user.email "${{ steps.setup-bot.outputs.committer-email || 'bot@github.com' }}"
-          git add app/core/src/main/resources/static/3rdPartyLicenses.json
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the backend license report based on dependency changes."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          Incompatible licenses detected – manual review required before merge."
-          fi
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        id: cpr
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Backend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-backend-3rd-party-licenses
-          base: main
-          title: "Update Backend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,backend
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (push only, no warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (push only, with warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
@@ -0,0 +1,282 @@
+name: Frontend License Report Workflow
+
+on:
+  push:
+    branches:
+      - V2
+    paths:
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/scripts/generate-licenses.js"
+  pull_request:
+    branches:
+      - V2
+    paths:
+      - ".github/workflows/frontend-licenses-update.yml"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/scripts/generate-licenses.js"
+
+permissions:
+  contents: read
+
+jobs:
+  generate-frontend-license-report:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout PR head (default)
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup GitHub App Bot
+        if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Checkout BASE branch (safe script)
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: base
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        run: npm ci --ignore-scripts --audit=false --fund=false
+
+      - name: Generate frontend license report (internal PR)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        working-directory: frontend
+        env:
+          PR_IS_FORK: "false"
+        run: npm run generate-licenses
+
+      - name: Generate frontend license report (fork PRs, pinned)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        working-directory: frontend
+        run: |
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
+
+      - name: Postprocess with project script (BASE version)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          PR_IS_FORK: "true"
+        run: |
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json
+
+      - name: Copy postprocessed artifacts back (fork PRs)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        run: |
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
+          fi
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
+          fi
+
+      - name: Check for license warnings
+        run: |
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
+            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
+          else
+            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
+          fi
+
+      # PR Event: Check licenses and comment on PR
+      - name: Delete previous license check comments
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+            
+            // Get all comments on the PR
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber,
+              per_page: 100
+            });
+            
+            // Filter for license check comments
+            const licenseComments = comments.filter(comment => 
+              comment.body.includes('## ✅ Frontend License Check Passed') ||
+              comment.body.includes('## ❌ Frontend License Check Failed')
+            );
+            
+            // Delete old license check comments
+            for (const comment of licenseComments) {
+              console.log(`Deleting old license check comment: ${comment.id}`);
+              await github.rest.issues.deleteComment({
+                owner,
+                repo,
+                comment_id: comment.id
+              });
+            }
+
+      - name: Summarize results (fork PRs)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        run: |
+          {
+            echo "## Frontend License Check"
+            echo ""
+            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
+              echo "❌ **Failed** – incompatible or unknown licenses found."
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
+                echo ""
+                echo "### Warnings"
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
+              fi
+            else
+              echo "✅ **Passed** – no license warnings detected."
+            fi
+            echo ""
+            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Comment on PR - License Check Results
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
+            
+            let commentBody;
+            
+            if (hasWarnings) {
+              // Read warnings file to get specific issues
+              const fs = require('fs');
+              let warningDetails = '';
+              try {
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
+                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
+              } catch (e) {
+                warningDetails = 'Unable to read warning details';
+              }
+              
+              commentBody = `## ❌ Frontend License Check Failed
+              
+              The frontend license check has detected compatibility warnings that require review:
+
+              ${warningDetails}
+
+              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
+
+              _This check will fail the PR until license issues are resolved._`;
+            } else {
+              commentBody = `## ✅ Frontend License Check Passed
+              
+              All frontend licenses have been validated and no compatibility warnings were detected.
+
+              The frontend license report has been updated successfully.`;
+            }
+            
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: commentBody
+            });
+
+      - name: Fail workflow if license warnings exist (PR only)
+        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: |
+          echo "❌ License warnings detected. Failing the workflow."
+          exit 1
+
+      # Push Event: Commit license files and create PR
+      - name: Commit changes (Push only)
+        if: github.event_name == 'push'
+        run: |
+          git add frontend/src/assets/3rdPartyLicenses.json
+          # Note: Do NOT commit license-warnings.json - it's only for PR review
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Prepare PR body (Push only)
+        if: github.event_name == 'push'
+        run: |
+          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+
+          This PR updates the frontend license report based on changes to package.json dependencies."
+          
+          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
+            PR_BODY="$PR_BODY
+
+          ## ⚠️ License Compatibility Warnings
+
+          The following licenses may require review for corporate compatibility:
+
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
+
+          Please review these licenses to ensure they are acceptable for your use case."
+          fi
+          
+          echo "PR_BODY<<EOF" >> $GITHUB_ENV
+          echo "$PR_BODY" >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+
+      - name: Create Pull Request (Push only)
+        id: cpr
+        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update Frontend 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-frontend-3rd-party-licenses
+          base: V2
+          title: "Update Frontend 3rd Party Licenses"
+          body: ${{ env.PR_BODY }}
+          labels: Licenses,github-actions,frontend
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+
+      - name: Add review required label (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
@@ -0,0 +1,105 @@
+name: License Report Workflow
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  generate-license-report:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+
+      - name: Check licenses for compatibility
+        run: ./gradlew clean checkLicense
+        env:
+          DISABLE_ADDITIONAL_FEATURES: false
+          STIRLING_PDF_DESKTOP_UI: true
+
+      - name: Upload artifact on failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3
+
+      - name: Move and rename license file
+        run: |
+          mv build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
+
+      - name: Commit changes
+        run: |
+          git add app/core/src/main/resources/static/3rdPartyLicenses.json
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        id: cpr
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-3rd-party-licenses
+          title: "Update 3rd Party Licenses"
+          body: |
+            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+          labels: Licenses,github-actions
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge
+        if: steps.cpr.outputs.pull-request-operation == 'created'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
@@ -15,15 +15,15 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
+        uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          yaml-file: .github/labels.yml
@@ -21,14 +21,8 @@ on:
          - windows
          - macos
          - linux
-      sign:
-        description: "Code sign the binaries (requires signing secrets)"
-        required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
+  push:
+    branches: [main, V2, V2-demo, V2-master]
  release:
    types: [created]

@@ -44,45 +38,30 @@ jobs:
      version: ${{ steps.versionNumber.outputs.versionNumber }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Cache Gradle dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
+          gradle-version: 8.14

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: |
+          echo "Running gradlew printVersion..."
+          ./gradlew printVersion --quiet
          VERSION=$(./gradlew printVersion --quiet | tail -1)
          echo "Extracted version: $VERSION"
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

      - name: Determine build matrix
        id: set-matrix
@@ -127,40 +106,33 @@ jobs:
            file_suffix: "-server"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
-          gradle-version: 9.3.1
+          gradle-version: 8.14

      - name: Setup Node.js
        if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@v4
        with:
-          node-version: 22
-          cache: "npm"
+          node-version: 20
+          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-
      - name: Build JAR
-        run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
          STIRLING_PDF_DESKTOP_UI: false

@@ -173,7 +145,7 @@ jobs:
          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar

      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: jar${{ matrix.variant.file_suffix }}
          path: ./jar-dist/*.jar
@@ -190,15 +162,12 @@ jobs:
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit
-          allowed-endpoints: >
-            one.digicert.com:443
-            clientauth.one.digicert.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -207,45 +176,105 @@ jobs:
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@v4
        with:
-          node-version: 22
-          cache: "npm"
+          node-version: 20
+          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"

-      - name: Prepare desktop build
-        run: task desktop:prepare
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        uses: digicert/ssm-code-signing@v1.1.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -254,7 +283,7 @@ jobs:
          SM_HOST: ${{ secrets.SM_HOST }}

      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        run: |
          Write-Host "Setting up DigiCert KeyLocker environment..."
@@ -289,7 +318,7 @@ jobs:

      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
@@ -320,7 +349,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -341,7 +370,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -352,84 +381,8 @@ jobs:
          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported successfully."

-      # Pre-flight: verify smctl can talk to DigiCert and sync cert before we sign.
-      # Mirrors the setup from working public Tauri+KeyLocker repos (Labric, Meetily).
-      # Without this, signCommand failures are opaque (Tauri captures but drops
-      # smctl's stderr) - running these loudly surfaces auth/env/keypair issues.
-      - name: Preflight smctl
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          & smctl healthcheck
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl healthcheck failed"; exit 1 }
-          & smctl keypair ls
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl keypair ls failed"; exit 1 }
-          & smctl windows certsync --keypair-alias "$env:KEYPAIR_ALIAS"
-          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
-          Write-Host "[SUCCESS] smctl preflight passed"
-
-      # Write platform-specific Tauri config that adds signCommand for Windows.
-      # Tauri auto-merges tauri.windows.conf.json with tauri.conf.json (RFC 7396).
-      # Tauri calls this command on every binary BEFORE bundling into the MSI,
-      # substituting %1 with the file path.
-      #
-      # Why OBJECT form (cmd + args) instead of string:
-      # Tauri's string-form parser does a naive split(' ') with no shell/quote handling.
-      # Args with spaces or quote characters get mangled. The object form passes each
-      # arg directly to Rust's Command::arg which handles Windows CreateProcess quoting.
-      #
-      # Why --keypair-alias instead of --fingerprint:
-      # --fingerprint requires smctl windows certsync to have synced the cert to the
-      # Windows cert store first. --keypair-alias goes direct through PKCS11 and works
-      # without certsync. All real-world working Tauri+smctl examples use this flag.
-      #
-      # smctl reads SM_HOST, SM_API_KEY, SM_CLIENT_CERT_FILE, SM_CLIENT_CERT_PASSWORD
-      # from env (set by prior DigiCert setup step). No --config-file needed.
-      - name: Configure Windows code signing
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
-        shell: bash
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
-          {
-            "bundle": {
-              "windows": {
-                "signCommand": {
-                  "cmd": "smctl",
-                  "args": ["sign", "--keypair-alias", "${KEYPAIR_ALIAS}", "--input", "%1", "--verbose"]
-                }
-              }
-            }
-          }
-          EOF
-          echo "Generated tauri.windows.conf.json (alias masked):"
-          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json
-
-      - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04'
-        env:
-          RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-        run: |
-          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
-          gpg --list-secret-keys --keyid-format=long
-
-      - name: Make libjvm discoverable for linuxdeploy (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
-          if [ -f "$JAVA_LIBJVM" ]; then
-            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
-            echo "Linked libjvm from $JAVA_LIBJVM -> /usr/lib/libjvm.so"
-          else
-            echo "libjvm not found at $JAVA_LIBJVM"
-            exit 1
-          fi
-
      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
+        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -438,115 +391,113 @@ jobs:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          # AppImage signing — three env vars work together:
-          #   SIGN=1                        tells linuxdeploy-plugin-appimage to forward --sign to appimagetool
-          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
-          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
-          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          SIGN: "1"
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          # DigiCert KeyLocker env vars consumed by smctl during signCommand
-          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on release or V2-master
+          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

-      - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04'
-        env:
-          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-        run: |
-          if [ -n "$RELEASE_GPG_FINGERPRINT" ]; then
-            gpg --batch --yes --delete-secret-keys "$RELEASE_GPG_FINGERPRINT" || true
-            gpg --batch --yes --delete-keys "$RELEASE_GPG_FINGERPRINT" || true
-          fi
-
-      # Verify the MSI (outer wrapper users download) AND the inner exe extracted
-      # from it (what actually gets installed and what AV scans). We don't check
-      # target/.../release/stirling-pdf.exe - that's Tauri's intermediate build
-      # artifact. Tauri signs a COPY when bundling into the MSI and leaves the raw
-      # cargo output unsigned, so checking it produces false negatives.
-      - name: Verify Windows Code Signature
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        run: |
-          $allSigned = $true
+          Write-Host "=== DigiCert KeyLocker Signing ==="

-          # Check MSI installer (outer wrapper - what users download)
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          if ($msiFiles.Count -eq 0) {
-            Write-Host "[ERROR] No MSI found under target/"
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
            exit 1
          }
-          foreach ($msi in $msiFiles) {
-            $sig = Get-AuthenticodeSignature -FilePath $msi.FullName
-            Write-Host "MSI: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-            if ($sig.Status -ne "Valid") {
-              Write-Host "[ERROR] MSI is not signed"
-              $allSigned = $false
-            }
-          }

-          # Extract MSI and verify the inner exe (the file that actually gets installed).
-          # This is the critical check - AV flags the installed exe at runtime.
-          $msi = $msiFiles[0].FullName
-          $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
-          if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
-          $proc = Start-Process msiexec.exe -ArgumentList '/a', $msi, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
-          if ($proc.ExitCode -eq 0) {
-            $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
-            if ($innerExe) {
-              $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
-              Write-Host "Inner EXE (from MSI): Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-              if ($sig.Status -ne "Valid") {
-                Write-Host "[ERROR] Inner exe extracted from MSI is NOT signed - AV will flag this at runtime"
-                $allSigned = $false
-              }
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
            } else {
-              Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
-              $allSigned = $false
+              Write-Host "No fingerprint provided, using keypair alias..."
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
            }
-          } else {
-            Write-Host "[ERROR] Failed to extract MSI for verification (exit code: $($proc.ExitCode))"
-            $allSigned = $false
-          }

-          if (-not $allSigned) {
-            Write-Host "[ERROR] Signature verification failed"
-            exit 1
-          }
-          Write-Host "[SUCCESS] MSI and installed exe are properly signed"
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"

-      # Dump smctl log files on failure. Tauri's signCommand captures smctl output
-      # but drops stderr when the command exits non-zero, making failures opaque.
-      # The real errors live in smctl's log files - surface them here for debugging.
-      - name: Dump smctl logs on failure
-        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
-        shell: pwsh
-        run: |
-          $logDir = "$env:USERPROFILE\.signingmanager\logs"
-          if (Test-Path $logDir) {
-            Get-ChildItem $logDir | ForEach-Object {
-              Write-Host "=== $($_.FullName) ==="
-              Get-Content $_.FullName -Tail 200
-              Write-Host ""
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              exit 1
            }
-          } else {
-            Write-Host "smctl log directory not found at $logDir"
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
          }

-      # Rename + Upload: use always() so artifacts are still collected when verify
-      # fails - we need them to manually inspect what actually came out of the build.
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
      - name: Rename artifacts
-        if: always() && steps.digicert-setup.conclusion != 'failure'
        shell: bash
        run: |
          mkdir -p ./dist
@@ -554,21 +505,18 @@ jobs:

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
-            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Upload build artifacts
-        if: always() && steps.digicert-setup.conclusion != 'failure'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
@@ -582,30 +530,30 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Download all Tauri artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          pattern: Stirling-PDF-*
          path: ./artifacts/tauri

      - name: Download JAR artifact (default)
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: jar
          path: ./artifacts/jars

      - name: Download JAR artifact (with login)
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: jar-with-login
          path: ./artifacts/jars

      - name: Download JAR artifact (server only)
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: jar-server
          path: ./artifacts/jars
@@ -614,7 +562,7 @@ jobs:
        run: ls -R ./artifacts

      - name: Upload binaries to Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
        with:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
          generate_release_notes: true
@@ -623,7 +571,6 @@ jobs:
            ./artifacts/**/*.msi
            ./artifacts/**/*.dmg
            ./artifacts/**/*.deb
-            ./artifacts/**/*.rpm
            ./artifacts/**/*.AppImage
          draft: false
          prerelease: false
@@ -1,49 +0,0 @@
-name: Nightly E2E Tests
-
-on:
-  schedule:
-    - cron: "0 2 * * *" # 2 AM UTC every night
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-all-browsers:
-    name: Playwright (chromium + firefox + webkit)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install all Playwright browsers
-        run: task frontend:test:e2e:install
-
-      - name: Run E2E tests (all browsers)
-        run: task frontend:test:e2e
-
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: playwright-nightly-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 14
@@ -1,197 +0,0 @@
-name: Update Package Manager Manifests
-
-on:
-  # release:
-  #   types: [released]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to test (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the git push at the end (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      dmg_arm64_sha256: ${{ steps.hashes.outputs.dmg_arm64_sha256 }}
-      dmg_x86_64_sha256: ${{ steps.hashes.outputs.dmg_x86_64_sha256 }}
-      msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DMG_ARM64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-aarch64.dmg")
-          DMG_X64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-x86_64.dmg")
-          MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "dmg_arm64_sha256=$DMG_ARM64_SHA" >> "$GITHUB_OUTPUT"
-          echo "dmg_x86_64_sha256=$DMG_X64_SHA"  >> "$GITHUB_OUTPUT"
-          echo "msi_sha256=$MSI_SHA"              >> "$GITHUB_OUTPUT"
-          echo "deb_sha256=$DEB_SHA"              >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA"              >> "$GITHUB_OUTPUT"
-
-  update-homebrew:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-
-      - name: Checkout homebrew tap
-        uses: actions/checkout@v4
-        with:
-          repository: Stirling-Tools/homebrew-stirling-pdf
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          path: homebrew-tap
-
-      - name: Update cask (stirling-pdf.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          ARM64_SHA: ${{ needs.get-release-info.outputs.dmg_arm64_sha256 }}
-          X64_SHA: ${{ needs.get-release-info.outputs.dmg_x86_64_sha256 }}
-        run: |
-          CASK="homebrew-tap/Casks/stirling-pdf.rb"
-          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$CASK"
-          # Update ARM64 sha256 (line following on_arm block)
-          awk -v arm="$ARM64_SHA" -v x64="$X64_SHA" '
-            /on_arm/     { in_arm=1 }
-            /on_intel/   { in_arm=0; in_intel=1 }
-            /end/        { in_arm=0; in_intel=0 }
-            in_arm  && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" arm "\"") }
-            in_intel && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" x64 "\"") }
-            { print }
-          ' "$CASK" > tmp && mv tmp "$CASK"
-
-      - name: Update formula (stirling-pdf-server.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          FORMULA="homebrew-tap/Formula/stirling-pdf-server.rb"
-          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$FORMULA"
-          sed -i "s/sha256 \".*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
-
-      - name: Show homebrew tap diff (for dry-run visibility)
-        working-directory: homebrew-tap
-        run: |
-          echo "--- diff --stat ---"
-          git diff --stat
-          echo "--- full diff ---"
-          git diff
-
-      - name: Commit and push homebrew tap updates
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        working-directory: homebrew-tap
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Casks/stirling-pdf.rb Formula/stirling-pdf-server.rb
-          git diff --cached --quiet && echo "No changes" && exit 0
-          git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
-          git push
-
-  update-scoop:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-
-      - name: Checkout Scoop bucket (shared with Homebrew tap)
-        uses: actions/checkout@v4
-        with:
-          repository: Stirling-Tools/homebrew-stirling-pdf
-          token: ${{ secrets.SCOOP_BUCKET_TOKEN }}
-          path: scoop-bucket
-
-      - name: Update stirling-pdf.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          MSI_SHA: ${{ needs.get-release-info.outputs.msi_sha256 }}
-        run: |
-          MANIFEST="scoop-bucket/scoop/stirling-pdf.json"
-          jq --arg v "$VERSION" --arg h "$MSI_SHA" \
-            '.version = $v | .architecture["64bit"].url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-windows-x86_64.msi" | .architecture["64bit"].hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Update stirling-pdf-server.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          MANIFEST="scoop-bucket/scoop/stirling-pdf-server.json"
-          jq --arg v "$VERSION" --arg h "$JAR_SHA" \
-            '.version = $v | .url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-with-login.jar" | .hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Show Scoop bucket diff (for dry-run visibility)
-        working-directory: scoop-bucket
-        run: |
-          echo "--- diff --stat ---"
-          git diff --stat
-          echo "--- full diff ---"
-          git diff
-
-      - name: Commit and push Scoop bucket updates
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        working-directory: scoop-bucket
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add scoop/stirling-pdf.json scoop/stirling-pdf-server.json
-          git diff --cached --quiet && echo "No changes" && exit 0
-          git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
-          git push
@@ -2,7 +2,7 @@ name: Pre-commit

 on:
  workflow_dispatch:
-  pull_request:
+  push:
    branches:
      - main

@@ -16,35 +16,71 @@ jobs:
      # Prevents sdist builds → no tar extraction
      PIP_ONLY_BINARY: ":all:"
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
+    permissions:
+      contents: write
+      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
-          persist-credentials: false
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: 3.12
-          cache: "pip" # caching pip dependencies
+          cache: 'pip' # caching pip dependencies
          cache-dependency-path: ./.github/scripts/requirements_pre_commit.txt

      - name: Run Pre-Commit Hooks
        run: |
          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt

-      - name: Run Pre-Commit
+      - run: pre-commit run --all-files -c .pre-commit-config.yaml
+        continue-on-error: true
+
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: 17
+          distribution: "temurin"
+
+      - name: Build with Gradle
+        run: ./gradlew clean build
+
+      - name: git add
        run: |
-          pre-commit run ruff --all-files -c .pre-commit-config.yaml
-          pre-commit run ruff-format --all-files -c .pre-commit-config.yaml
-          pre-commit run codespell --all-files -c .pre-commit-config.yaml
-          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
-          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
-          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
-          git diff --exit-code
+          git add .
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: ":file_folder: pre-commit"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: pre-commit
+          title: "🤖 format everything with pre-commit by ${{ steps.setup-bot.outputs.app-slug }}"
+          body: |
+            Auto-generated by [create-pull-request][1] with **${{ steps.setup-bot.outputs.app-slug }}**
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true
@@ -1,122 +0,0 @@
-name: Push Docker Base Image
-
-on:
-  push:
-    branches:
-      - baseDockerImage
-      - accessIssueFix
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Base image version (e.g., 1.0.0, 1.0.1)'
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  push-base:
-    if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Verify authorized user
-        run: |
-          if [ "${{ github.actor }}" != "Frooodle" ]; then
-            echo "Error: Only Frooodle is authorized to run this workflow"
-            exit 1
-          fi
-
-      - name: Set version
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${{ github.event.inputs.version }}"
-          elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
-            VERSION="1.0.3"
-          else
-            VERSION="1.0.0"
-          fi
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for base image
-        id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-base
-          tags: |
-            type=raw,value=${{ steps.version.outputs.version }}
-
-      - name: Build and push base image
-        id: build-push-base
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: docker/base
-          file: ./docker/base/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-base
-          cache-to: type=gha,mode=max,scope=stirling-pdf-base
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Install cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Sign base images
-        env:
-          DIGEST: ${{ steps.build-push-base.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --yes \
-                --key env://COSIGN_PRIVATE_KEY \
-                "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping image signing"
-          fi
@@ -0,0 +1,246 @@
+name: Push Docker Image - V2 Branch
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - V2-master
+      - alljavadocker
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-24.04-8core
+    permissions:
+      packages: write
+      id-token: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Get version number
+        id: versionNumber
+        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        with:
+          cosign-release: "v2.4.1"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+
+      - name: Generate tags for latest (V2-master branch - production)
+        id: meta
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Generate tags for latest (alljavadocker branch - test)
+        id: meta-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Build and push Unified Dockerfile (latest variant)
+        id: build-push-latest
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign regular images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --yes \
+              --key env://COSIGN_PRIVATE_KEY \
+              "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for latest-fat (V2-master branch - production)
+        id: meta-fat
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Generate tags for latest-fat (alljavadocker branch - test)
+        id: meta-fat-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Build and push Unified Dockerfile (fat variant)
+        id: build-push-fat
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.fat
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign fat images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
+          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for ultra-lite (V2-master branch - production)
+        id: meta-lite
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Generate tags for ultra-lite (alljavadocker branch - test)
+        id: meta-lite-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Build and push Unified Dockerfile (ultra-lite variant)
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign ultra-lite images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
+          TAGS: ${{ steps.meta-lite.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
@@ -6,8 +6,6 @@ on:
    branches:
      - master
      - main
-      - V2-master
-      - testMain

 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -27,88 +25,72 @@ permissions:
 jobs:
  push:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
+    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "17"
          distribution: "temurin"

-      - name: Cache Gradle dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
+          gradle-version: 8.14

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+      - name: Run Gradle Command
+        run: ./gradlew clean build
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/master'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
        with:
-          gradle-version: 9.3.1
+          cosign-release: "v2.4.1"

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
-        with:
-          cosign-release: "v2.4.1"

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0

      - name: Convert repository owner to lowercase
        id: repoowner
        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT

-      - name: Generate tags for latest
+      - name: Generate tags
        id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref != 'refs/heads/main'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -116,33 +98,31 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testMain' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}

-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
+      - name: Build and push main Dockerfile
+        id: build-push-regular
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-            BASE_VERSION=1.0.0
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Sign regular images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: github.ref == 'refs/heads/master'
        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          DIGEST: ${{ steps.build-push-regular.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -153,10 +133,10 @@ jobs:
              "${tag}@${DIGEST}"
          done

-      - name: Generate tags for latest-fat
-        id: meta-fat
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+      - name: Generate tags ultra-lite
+        id: meta2
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref != 'refs/heads/main'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -164,76 +144,62 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}

-      - name: Build and push Unified Dockerfile (fat variant)
+      - name: Build and push Dockerfile-ultra-lite
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
+        with:
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta2.outputs.tags }}
+          labels: ${{ steps.meta2.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Generate tags fat
+        id: meta3
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push main Dockerfile fat
        id: build-push-fat
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
          file: ./docker/embedded/Dockerfile.fat
          push: true
-          cache-from: type=gha,scope=stirling-pdf-fat
-          cache-to: type=gha,mode=max,scope=stirling-pdf-fat
-          tags: ${{ steps.meta-fat.outputs.tags }}
-          labels: ${{ steps.meta-fat.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta3.outputs.tags }}
+          labels: ${{ steps.meta3.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Sign fat images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: github.ref == 'refs/heads/master'
        env:
          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite
-        id: meta-lite
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-ultra-lite
-          cache-to: type=gha,mode=max,scope=stirling-pdf-ultra-lite
-          tags: ${{ steps.meta-lite.outputs.tags }}
-          labels: ${{ steps.meta-lite.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
+          TAGS: ${{ steps.meta3.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
@@ -0,0 +1,535 @@
+name: Release Artifacts
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: "Platform to build (windows, macos, linux, or all)"
+        required: true
+        default: "all"
+        type: choice
+        options:
+          - all
+          - windows
+          - macos
+          - linux
+  push:
+    branches: [main, V2, V2-demo]
+
+permissions:
+  contents: read
+
+jobs:
+  determine-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+      version: ${{ steps.versionNumber.outputs.versionNumber }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Get version number
+        id: versionNumber
+        run: |
+          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
+          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Determine build matrix
+        id: set-matrix
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
+          else
+            # For push events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+          fi
+
+  build:
+    needs: determine-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
+    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
+      - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
+
+      - name: Verify Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
+
+      - name: Build Tauri app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          CI: true
+        with:
+          projectPath: ./frontend
+          tauriScript: npx tauri
+          args: ${{ matrix.args }}
+
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
+      - name: Rename artifacts
+        shell: bash
+        run: |
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target
+
+          # Find and rename artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          else
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          fi
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: Stirling-PDF-${{ matrix.name }}
+          path: ./dist/*
+          retention-days: 30
+
+  sign_verify:
+    needs: build
+    runs-on: ubuntu-latest
+    if: success()
+    strategy:
+      fail-fast: false
+      matrix:
+        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: Stirling-PDF-${{ matrix.name }}
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+
+      - name: Generate key pair
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        shell: bash
+        run: |
+          # Sign all artifacts for this platform
+          for file in *; do
+            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
+              echo "Signing: $file"
+
+              # Sign the artifact
+              cosign sign-blob \
+                --key ./cosign.key \
+                --yes \
+                --output-signature "${file}.sig" \
+                "$file"
+
+              # Generate attestation
+              cosign attest-blob \
+                --predicate - \
+                --key ./cosign.key \
+                --yes \
+                --output-attestation "${file}.intoto.jsonl" \
+                "$file"
+
+              # Verify the signature
+              cosign verify-blob \
+                --key ./cosign.pub \
+                --signature "${file}.sig" \
+                "$file"
+
+              echo "✅ Signed and verified: $file"
+            fi
+          done
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: Stirling-PDF-${{ matrix.name }}-signed
+          path: |
+            *
+            !cosign.key
+            !cosign.pub
+          retention-days: 30
+
+  release:
+    needs: [determine-matrix, build, sign_verify]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download all signed artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: Stirling-PDF-*-signed
+          path: ./artifacts
+
+      - name: Display structure of downloaded files
+        run: ls -R ./artifacts
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
+        with:
+          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          generate_release_notes: true
+          files: ./artifacts/**/*
+          draft: false
+          prerelease: false
@@ -1,93 +0,0 @@
-name: Rollback Latest Tags to Version
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to rollback to (e.g. 2.8.0)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  rollback:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Install crane
-        uses: imjasonh/setup-crane@31b88afe9de28ae0ffa220711af4b60be9435f6e # v0.4
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Rollback all latest tags to v${{ inputs.version }}
-        env:
-          VERSION: ${{ inputs.version }}
-          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
-          DOCKER_HUB_ORG_USERNAME: ${{ secrets.DOCKER_HUB_ORG_USERNAME }}
-          REPO_OWNER: ${{ steps.repoowner.outputs.lowercase }}
-        run: |
-          set -euo pipefail
-
-          IMAGES=(
-            "${DOCKER_HUB_USERNAME}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/stirling-pdf"
-            "${DOCKER_HUB_ORG_USERNAME}/stirling-pdf"
-          )
-
-          VARIANTS=(
-            "${VERSION}:latest"
-            "${VERSION}-fat:latest-fat"
-            "${VERSION}-ultra-lite:latest-ultra-lite"
-          )
-
-          FAILED=0
-
-          for image in "${IMAGES[@]}"; do
-            for variant in "${VARIANTS[@]}"; do
-              SOURCE_TAG="${variant%%:*}"
-              TARGET_TAG="${variant##*:}"
-
-              echo "::group::${image} — ${SOURCE_TAG} → ${TARGET_TAG}"
-
-              if crane manifest "${image}:${SOURCE_TAG}" > /dev/null 2>&1; then
-                crane cp "${image}:${SOURCE_TAG}" "${image}:${TARGET_TAG}"
-                echo "✅ ${image}:${TARGET_TAG} now points to ${SOURCE_TAG}"
-              else
-                echo "::warning::⚠️ ${image}:${SOURCE_TAG} not found, skipping"
-                FAILED=1
-              fi
-
-              echo "::endgroup::"
-            done
-          done
-
-          if [ "$FAILED" -ne 0 ]; then
-            echo "::warning::Some source tags were not found. This is expected if not all variants exist for this version."
-          fi
-
-          echo ""
-          echo "🎉 Rollback to ${VERSION} complete!"
@@ -35,12 +35,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

@@ -67,7 +67,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: SARIF file
          path: results.sarif
@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
+        uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.29.5
        with:
          sarif_file: results.sarif
@@ -0,0 +1,76 @@
+name: Run Sonarqube
+
+on:
+  push:
+    branches:
+      - master
+  pull_request_target:
+    branches:
+      - main
+  workflow_dispatch:
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: read
+  actions: read
+
+jobs:
+  sonarqube:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+
+      - name: Build and analyze with Gradle
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          DISABLE_ADDITIONAL_FEATURES: false
+          STIRLING_PDF_DESKTOP_UI: true
+        run: |
+          ./gradlew clean build sonar \
+            -Dsonar.projectKey=Stirling-Tools_Stirling-PDF \
+            -Dsonar.organization=stirling-tools \
+            -Dsonar.host.url=https://sonarcloud.io \
+            -Dsonar.login=${SONAR_TOKEN} \
+            -Dsonar.log.level=DEBUG \
+            --info
+
+      - name: Upload Problems Report on Failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: gradle-problems-report
+          path: build/reports/problems/problems-report.html
+          retention-days: 7
+
+      - name: Upload Sonar Logs on Failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: sonar-logs
+          path: |
+            .scannerwork/report-task.txt
+            build/sonar/
+          retention-days: 7
@@ -17,12 +17,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: 30 days stale issues
-        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
+        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-stale: 30
@@ -27,22 +27,19 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "17"
          distribution: "temurin"

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0

      - name: Generate Swagger documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -50,21 +47,12 @@ jobs:
      - name: Upload Swagger Documentation to SwaggerHub
        run: ./gradlew swaggerhubUpload
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }}
          SWAGGERHUB_USER: "Frooodle"

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

      - name: Set API version as published and default on SwaggerHub
        run: |
@@ -5,11 +5,9 @@ on:
  push:
    branches:
      - main
+      - syncLangTest
    paths:
      - "build.gradle"
-      - "app/common/build.gradle"
-      - "app/core/build.gradle"
-      - "app/proprietary/build.gradle"
      - "README.md"
      - "frontend/public/locales/*/translation.toml"
      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
@@ -35,13 +33,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -51,27 +47,27 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
          cache: "pip" # caching pip dependencies

      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt
+        run: |
+          pip install tomli-w

      - name: Sync translation TOML files
        run: |
          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main

-      - name: pre-commit run
-        run: |
-          pre-commit run toml-sort-fix --all-files
-
      - name: Commit translation files
        run: |
          git add frontend/public/locales/*/translation.toml
          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"

+      - name: Install README dependencies
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
+
      - name: Sync README.md
        run: |
          python scripts/counter_translation_v3.py
@@ -83,7 +79,7 @@ jobs:

      - name: Create Pull Request
        if: always()
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: Update files
@@ -125,4 +121,4 @@ jobs:
          add-paths: |
            README.md
            frontend/public/locales/*/translation.toml
-            scripts/ignore_translation.toml
+            scripts/ignore_translation.toml
@@ -14,20 +14,17 @@ on:
          - macos
          - linux
  pull_request:
-    branches: [main]
-    types: [opened, reopened, synchronize, ready_for_review]
+    branches: [main, V2, V2-tauri-windows]
    paths:
-      - "frontend/src-tauri/**"
-      - "frontend/src/desktop/**"
-      - "frontend/tsconfig.desktop.json"
-      - "frontend/package.json"
-      - "frontend/package-lock.json"
-      - "frontend/vite.config.ts"
-      - ".github/workflows/tauri-build.yml"
+      - 'frontend/src-tauri/**'
+      - 'frontend/src/desktop/**'
+      - 'frontend/tsconfig.desktop.json'
+      - '.github/workflows/tauri-build.yml'
+  push:
+    branches: [main, V2]

 permissions:
  contents: read
-  pull-requests: write

 jobs:
  determine-matrix:
@@ -36,49 +33,29 @@ jobs:
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
      - name: Determine build matrix
        id: set-matrix
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
        run: |
-          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
-          MACOS_ARM='{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"}'
-          MACOS_INTEL='{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}'
-          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'
-
-          # Resolve requested platform (non-dispatch events always build all)
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            PLATFORM="${{ github.event.inputs.platform }}"
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
          else
-            PLATFORM="all"
+            # For PR/push events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
          fi

-          # Build candidate list
-          case "$PLATFORM" in
-            windows) ENTRIES=("$WINDOWS") ;;
-            macos)   ENTRIES=("$MACOS_ARM" "$MACOS_INTEL") ;;
-            linux)   ENTRIES=("$LINUX") ;;
-            *)       ENTRIES=("$WINDOWS" "$MACOS_ARM" "$MACOS_INTEL" "$LINUX") ;;
-          esac
-
-          # Drop macOS entries when Apple certificate secret is unavailable
-          if [ -z "$APPLE_CERTIFICATE" ]; then
-            echo "⚠️ APPLE_CERTIFICATE secret not available - skipping macOS builds"
-            FILTERED=()
-            for entry in "${ENTRIES[@]}"; do
-              [[ "$entry" != *'"macos'* ]] && FILTERED+=("$entry")
-            done
-            ENTRIES=("${FILTERED[@]}")
-          fi
-
-          JOINED=$(IFS=','; echo "${ENTRIES[*]}")
-          echo "matrix={\"include\":[$JOINED]}" >> $GITHUB_OUTPUT
-
  build:
    needs: determine-matrix
    strategy:
@@ -88,15 +65,14 @@ jobs:
    env:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -105,44 +81,106 @@ jobs:
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@v4
        with:
-          node-version: 22
-          cache: "npm"
+          node-version: 20
+          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          # STIRLING_PDF_DESKTOP_UI=false ./gradlew clean bootJar --no-daemon
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube

-      - name: Setup Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Prepare desktop build
-        run: task desktop:prepare
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+          
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+          
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+          
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+          
+          # Create custom JRE with jlink (always rebuild)
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+          
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+          
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+          
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+          
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+          
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
+        uses: digicert/ssm-code-signing@v1.1.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -217,7 +255,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -238,7 +276,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -260,60 +298,8 @@ jobs:
          echo "Available tools:"
          ls -la /usr/bin/hd* || echo "No hd* tools found"

-      - name: Preflight smctl
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          & smctl healthcheck
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl healthcheck failed"; exit 1 }
-          & smctl keypair ls
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl keypair ls failed"; exit 1 }
-          & smctl windows certsync --keypair-alias "$env:KEYPAIR_ALIAS"
-          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
-
-      - name: Configure Windows code signing
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: bash
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
-          {
-            "bundle": {
-              "windows": {
-                "signCommand": {
-                  "cmd": "smctl",
-                  "args": ["sign", "--keypair-alias", "${KEYPAIR_ALIAS}", "--input", "%1", "--verbose"]
-                }
-              }
-            }
-          }
-          EOF
-
-      - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04'
-        env:
-          RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-        run: |
-          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
-          gpg --list-secret-keys --keyid-format=long
-
-      - name: Make libjvm discoverable for linuxdeploy (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
-          if [ -f "$JAVA_LIBJVM" ]; then
-            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
-            echo "Linked libjvm from $JAVA_LIBJVM -> /usr/lib/libjvm.so"
-          else
-            echo "libjvm not found at $JAVA_LIBJVM"
-            exit 1
-          fi
-
      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
+        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -322,35 +308,177 @@ jobs:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          # AppImage signing — three env vars work together:
-          #   SIGN=1                        tells linuxdeploy-plugin-appimage to forward --sign to appimagetool
-          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
-          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
-          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          SIGN: "1"
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

-      - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04'
-        env:
-          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
        run: |
-          if [ -n "$RELEASE_GPG_FINGERPRINT" ]; then
-            gpg --batch --yes --delete-secret-keys "$RELEASE_GPG_FINGERPRINT" || true
-            gpg --batch --yes --delete-keys "$RELEASE_GPG_FINGERPRINT" || true
-          fi
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # List available certificates and check if they have certificates attached
+          Write-Host "Checking for available certificates..."
+          $certList = & smctl keypair ls 2>&1
+          Write-Host "Keypair list output:"
+          Write-Host $certList
+          Write-Host ""
+
+          # Parse the output to check certificate status
+          $lines = $certList -split "`n"
+          $foundKeypair = $false
+          $hasCertificate = $false
+
+          foreach ($line in $lines) {
+            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
+              $foundKeypair = $true
+              Write-Host "[SUCCESS] Found keypair in list"
+
+              # Check if this line has certificate info (not just empty spaces after alias)
+              $parts = $line -split "\s+"
+              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
+                $hasCertificate = $true
+                Write-Host "[SUCCESS] Certificate is associated with keypair"
+              }
+            }
+          }
+
+          if (-not $foundKeypair) {
+            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
+            Write-Host "Available keypairs are listed above"
+            Write-Host ""
+            Write-Host "Please verify:"
+            Write-Host "  1. Keypair alias is correct in GitHub secret"
+            Write-Host "  2. API key has access to this keypair"
+            exit 1
+          }
+
+          if (-not $hasCertificate) {
+            Write-Host "[ERROR] No certificate associated with keypair"
+            Write-Host "This usually means:"
+            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
+            Write-Host "  2. Certificate is pending approval"
+            Write-Host "  3. Certificate needs to be attached to the keypair"
+            Write-Host ""
+            Write-Host "Try running in DigiCert ONE portal:"
+            Write-Host "  smctl keypair sync"
+            exit 1
+          }
+
+          Write-Host "[SUCCESS] Certificate check passed"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              Write-Host ""
+              Write-Host "Possible issues:"
+              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
+              Write-Host "  2. Incorrect keypair alias"
+              Write-Host "  3. API key lacks signing permissions"
+              Write-Host ""
+              Write-Host "Please verify in DigiCert ONE portal:"
+              Write-Host "  - Certificate status is 'Issued' (not Pending)"
+              Write-Host "  - Keypair status is 'Online'"
+              Write-Host "  - 'Can sign' is set to 'Yes'"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"

      - name: Verify notarization (macOS only)
        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
@@ -375,89 +503,83 @@ jobs:

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            # Only ship the MSI installer. The loose exe and WiX toolset exes
-            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

-      # Verify the MSI AND the inner exe extracted from it are signed.
-      # The inner exe is what gets installed on users' machines and what AV scans.
      - name: Verify Windows Code Signature
-        if: matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
        shell: pwsh
        run: |
-          $allSigned = $true
+          Write-Host "Verifying Windows code signatures..."
+
+          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"

-          # Check MSI (outer wrapper)
-          if (Test-Path $msiPath) {
-            $sig = Get-AuthenticodeSignature -FilePath $msiPath
-            Write-Host "MSI: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-            if ($sig.Status -ne "Valid") {
-              Write-Host "[ERROR] MSI is not signed"
-              $allSigned = $false
-            }
+          $allSigned = $true
+          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
+          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""

-            # Extract MSI and verify inner exe
-            $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
-            if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
-            $proc = Start-Process msiexec.exe -ArgumentList '/a', $msiPath, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
-            if ($proc.ExitCode -eq 0) {
-              $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
-              if ($innerExe) {
-                $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
-                Write-Host "Inner EXE: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-                if ($sig.Status -ne "Valid") {
-                  Write-Host "[ERROR] Inner exe is NOT signed - AV will flag this at runtime"
-                  $allSigned = $false
-                }
-              } else {
-                Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
+          # Check EXE signature
+          if (Test-Path $exePath) {
+            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
+            Write-Host "EXE Signature Status: $($exeSig.Status)"
+            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
+            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
+
+            if ($exeSig.Status -ne "Valid") {
+              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
              }
            } else {
-              Write-Host "[ERROR] MSI extraction failed (exit code: $($proc.ExitCode))"
-              $allSigned = $false
+              Write-Host "[SUCCESS] EXE is properly signed"
            }
-          } else {
-            Write-Host "[ERROR] MSI not found at $msiPath"
-            $allSigned = $false
          }

-          if (-not $allSigned) {
-            Write-Host "[ERROR] Signature verification failed"
+          # Check MSI signature
+          if (Test-Path $msiPath) {
+            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI Signature Status: $($msiSig.Status)"
+            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
+            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+
+            if ($msiSig.Status -ne "Valid") {
+              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] MSI is properly signed"
+            }
+          }
+
+          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
+            Write-Host "[ERROR] Code signing verification failed"
            exit 1
-          }
-          Write-Host "[SUCCESS] MSI and inner exe are properly signed"
-
-      - name: Dump smctl logs on failure
-        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
-        shell: pwsh
-        run: |
-          $logDir = "$env:USERPROFILE\.signingmanager\logs"
-          if (Test-Path $logDir) {
-            Get-ChildItem $logDir | ForEach-Object {
-              Write-Host "=== $($_.FullName) ==="
-              Get-Content $_.FullName -Tail 200
-              Write-Host ""
-            }
          } else {
-            Write-Host "smctl log directory not found at $logDir"
+            Write-Host "[SUCCESS] Code signature verification completed"
          }

      - name: Upload artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
          retention-days: 7
-
+ 
      - name: Verify build artifacts
        shell: bash
        run: |
@@ -473,15 +595,15 @@ jobs:
            fi
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            echo "Checking for macOS artifacts..."
-            find . -name "*.dmg" | head -5
-            if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
+            find . -name "*.dmg" -o -name "*.app" | head -5
+            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
              echo "❌ No macOS artifacts found"
              exit 1
            fi
          else
            echo "Checking for Linux artifacts..."
-            find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | head -5
-            if [ $(find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
+            find . -name "*.deb" -o -name "*.AppImage" | head -5
+            if [ $(find . -name "*.deb" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
              echo "❌ No Linux artifacts found"
              exit 1
            fi
@@ -494,7 +616,7 @@ jobs:
        run: |
          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
-          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
+          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
              size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
              echo "$file: $size bytes"
@@ -505,110 +627,11 @@ jobs:
            fi
          done

-  pr-comment:
-    needs: build
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && needs.build.result == 'success'
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Post/Update PR Comment with Download Links
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const prNumber = context.issue.number;
-            const runId = context.runId;
-
-            // Fetch artifacts for this workflow run
-            const { data: artifactsList } = await github.rest.actions.listWorkflowRunArtifacts({
-              owner,
-              repo,
-              run_id: runId
-            });
-
-            // Map of expected artifact names to display info
-            const artifactMap = {
-              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
-              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
-              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
-              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
-            };
-
-            let commentBody = `## 📦 Tauri Desktop Builds Ready!\n\n`;
-            commentBody += `The desktop applications have been built and are ready for testing.\n\n`;
-            commentBody += `### Download Artifacts:\n\n`;
-
-            // Add links for each found artifact
-            let foundArtifacts = 0;
-            for (const artifact of artifactsList.artifacts) {
-              const info = artifactMap[artifact.name];
-              if (info) {
-                foundArtifacts++;
-                // GitHub doesn't provide direct download URLs via API, but we can link to the artifact on the Actions page
-                const artifactUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}/artifacts/${artifact.id}`;
-                commentBody += `${info.icon} **${info.platform}**: [Download ${artifact.name}](${artifactUrl}) `;
-                commentBody += `(${info.files}) - ${(artifact.size_in_bytes / 1024 / 1024).toFixed(1)} MB\n`;
-              }
-            }
-
-            if (foundArtifacts === 0) {
-              commentBody += `⚠️ **Warning**: No artifacts found in workflow run.\n`;
-              commentBody += `[View workflow run](https://github.com/${owner}/${repo}/actions/runs/${runId})\n`;
-            }
-
-            commentBody += `\n---\n`;
-            commentBody += `_Built from commit ${context.sha.substring(0, 7)}_\n`;
-            commentBody += `_Artifacts expire in 7 days_`;
-
-            // Find existing comment
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber
-            });
-
-            const botComment = comments.find(comment =>
-              comment.user.type === 'Bot' &&
-              comment.body.includes('📦 Tauri Desktop Builds Ready!')
-            );
-
-            if (botComment) {
-              // Update existing comment
-              await github.rest.issues.updateComment({
-                owner,
-                repo,
-                comment_id: botComment.id,
-                body: commentBody
-              });
-              console.log('Updated existing comment');
-            } else {
-              // Create new comment
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number: prNumber,
-                body: commentBody
-              });
-              console.log('Created new comment');
-            }
-
  report:
    needs: build
    runs-on: ubuntu-latest
    if: always()
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
      - name: Report build results
        run: |
          if [ "${{ needs.build.result }}" = "success" ]; then
@@ -25,34 +25,31 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
-          distribution: "temurin"
+          java-version: '17'
+          distribution: 'temurin'

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
-          gradle-version: 9.3.1
+          gradle-version: 8.14

      - name: Build with Gradle
-        run: ./gradlew build
+        run: ./gradlew clean build
        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Get version number
        id: versionNumber
@@ -61,7 +58,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -72,8 +69,6 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64
@@ -81,7 +76,7 @@ jobs:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Deploy to VPS
@@ -112,9 +107,9 @@ jobs:
              restart: on-failure:5
          EOF

-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
            mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
            mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
            cd /stirling/test-${{ github.sha }}
@@ -130,15 +125,10 @@ jobs:
    outputs:
      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Check for file changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: ".github/config/.files.yaml"
@@ -150,16 +140,16 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Set up Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
-          cache: "npm"
+          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Run TestDriver.ai
@@ -167,11 +157,11 @@ jobs:
        with:
          key: ${{secrets.TESTDRIVER_API_KEY}}
          prerun: |
-            choco install go-task -y
-            task frontend:build
            cd frontend
+            npm install
+            npm run build
            npm install dashcam-chrome --save
-            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
+            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.VPS_HOST }}:1337"
            Start-Sleep -Seconds 20
          prompt: |
            1. /run testing/testdriver/test.yml
@@ -186,20 +176,20 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Cleanup deployment
        if: always()
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
            cd /stirling/test-${{ github.sha }}
            docker-compose down
            cd /stirling
@@ -29,14 +29,8 @@ clientWebUI/
 exampleYmlFiles/stirling/
 /stirling/
 /testing/file_snapshots
-/testing/cucumber/junit/
-/testing/cucumber/report.html
-/testing/.failed_tests
 SwaggerDoc.json

-# Runtime storage for uploaded files and user data (not Java source code)
-app/core/storage/
-
 # Frontend build artifacts copied to backend static resources
 # These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
@@ -49,8 +43,6 @@ app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
 app/core/src/main/resources/static/robots.txt
-app/core/src/main/resources/static/pdfium/
-app/core/src/main/resources/static/vendor/
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.

 # Gradle
@@ -155,7 +147,6 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
-frontend/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -164,8 +155,6 @@ __pycache__/

 # Virtual environments
 .env*
-!.env*.example
-!engine/.env
 .venv*
 env*/
 venv*/
@@ -182,7 +171,6 @@ venv.bak/
 .idea/
 *.iml
 out/
-.junie/

 # Ignore Mac DS_Store files
 .DS_Store
@@ -205,9 +193,6 @@ out/
 *.jks
 *.asc

-# Allow test fixture certificates (synthetic, no real credentials)
-!frontend/src/core/tests/test-fixtures/certs/**
-
 # SSH Keys
 *.pub
 *.priv
@@ -218,21 +203,15 @@ id_ecdsa.pub
 id_ed25519
 id_ed25519.pub
 .ssh/
-
-# Allow the published GPG release signing public key (safe to share)
-!docs/security/signing-key.pub
 *ssh

-# Taskfile checksum cache
-.task/
-
 # cache
 .cache
 .ruff_cache
 .mypy_cache
 .pytest_cache
 .ipynb_checkpoints
-.build-cache
+


 **/jcef-bundle/
@@ -263,5 +242,3 @@ docs/type3/signatures/
 # Type3 sample PDFs (development only)
 **/type3/samples/

-# Claude
-.claude/
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.14
+    rev: v0.12.7
    hooks:
      - id: ruff
        args:
@@ -16,17 +16,17 @@ repos:
    hooks:
      - id: codespell
        args:
-          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment
+          - --ignore-words-list=thirdParty,tabEl,tabEls
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
-        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
  - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.0
+    rev: v8.28.0
    hooks:
      - id: gitleaks
  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: v5.0.0
    hooks:
      - id: end-of-file-fixer
        files: ^.*(\.js|\.java|\.py|\.yml)$
@@ -34,12 +34,6 @@ repos:
      - id: trailing-whitespace
        files: ^.*(\.js|\.java|\.py|\.yml)$
        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
-  - repo: https://github.com/pappasam/toml-sort
-    rev: v0.24.3
-    hooks:
-      - id: toml-sort-fix
-        files: frontend/public/locales/.*\.toml$
-        args: ['--in-place', '--all', '--ignore-case']
  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
  #   rev: v16.21.1
  #   hooks:
@@ -1,117 +0,0 @@
-version: '3'
-
-tasks:
-  dev:
-    desc: "Start backend dev server"
-    ignore_error: true
-    cmds:
-      - cmd: cmd /c gradlew.bat :stirling-pdf:bootRun
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun
-        platforms: [linux, darwin]
-
-  build:
-    desc: "Full backend build"
-    cmds:
-      - cmd: cmd /c gradlew.bat clean build
-        platforms: [windows]
-      - cmd: ./gradlew clean build
-        platforms: [linux, darwin]
-
-  build:fast:
-    desc: "Build without tests"
-    cmds:
-      - cmd: cmd /c gradlew.bat clean build -x test
-        platforms: [windows]
-      - cmd: ./gradlew clean build -x test
-        platforms: [linux, darwin]
-
-  build:ci:
-    desc: "Build for CI (formatting checked separately)"
-    cmds:
-      - cmd: cmd /c gradlew.bat build -PnoSpotless
-        platforms: [windows]
-      - cmd: ./gradlew build -PnoSpotless
-        platforms: [linux, darwin]
-
-  test:
-    desc: "Run backend tests"
-    cmds:
-      - cmd: cmd /c gradlew.bat test
-        platforms: [windows]
-      - cmd: ./gradlew test
-        platforms: [linux, darwin]
-
-  format:
-    desc: "Auto-fix code formatting"
-    cmds:
-      - cmd: cmd /c gradlew.bat spotlessApply
-        platforms: [windows]
-      - cmd: ./gradlew spotlessApply
-        platforms: [linux, darwin]
-
-  format:check:
-    desc: "Check code formatting"
-    cmds:
-      - cmd: cmd /c gradlew.bat spotlessCheck
-        platforms: [windows]
-      - cmd: ./gradlew spotlessCheck
-        platforms: [linux, darwin]
-
-  fix:
-    desc: "Auto-fix backend"
-    cmds:
-      - task: format
-
-  swagger:
-    desc: "Generate OpenAPI docs"
-    cmds:
-      - cmd: cmd /c gradlew.bat :stirling-pdf:copySwaggerDoc
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
-        platforms: [linux, darwin]
-    sources:
-      - app/core/src/main/java/**/*.java
-      - app/proprietary/src/main/java/**/*.java
-      - app/common/src/main/java/**/*.java
-    generates:
-      - SwaggerDoc.json
-
-  check:
-    desc: "Backend quality gate"
-    cmds:
-      - task: format:check
-      - task: test
-
-  version:
-    desc: "Print project version"
-    silent: true
-    cmds:
-      - cmd: cmd /c gradlew.bat printVersion --quiet | tail -1
-        platforms: [windows]
-      - cmd: ./gradlew printVersion --quiet | tail -1
-        platforms: [linux, darwin]
-
-  licenses:check:
-    desc: "Check dependency licenses"
-    cmds:
-      - cmd: cmd /c gradlew.bat checkLicense --no-parallel
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense --no-parallel
-        platforms: [linux, darwin]
-
-  licenses:generate:
-    desc: "Check and generate dependency license report"
-    cmds:
-      - cmd: cmd /c gradlew.bat checkLicense generateLicenseReport --no-parallel
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
-        platforms: [linux, darwin]
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - cmd: cmd /c gradlew.bat clean
-        platforms: [windows]
-      - cmd: ./gradlew clean
-        platforms: [linux, darwin]
@@ -1,105 +0,0 @@
-version: '3'
-
-vars:
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-
-tasks:
-  prepare:
-    desc: "Prepare desktop build dependencies"
-    deps: [jlink, ":frontend:prepare:desktop", provisioner]
-
-  provisioner:
-    desc: "Build installer provisioner"
-    platforms: [windows]
-    cmds:
-      - node scripts/build-provisioner.mjs
-
-  dev:
-    desc: "Start Tauri desktop dev mode"
-    deps: [prepare]
-    ignore_error: true
-    cmds:
-      - npx tauri dev --no-watch
-
-  build:
-    desc: "Build Tauri desktop app (production)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build
-
-  build:dev:
-    desc: "Build Tauri desktop app (dev, no bundling)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --no-bundle
-
-  build:dev:mac:
-    desc: "Build Tauri desktop .app bundle (macOS)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles app
-
-  build:dev:windows:
-    desc: "Build Tauri desktop NSIS installer (Windows)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles nsis
-
-  build:dev:linux:
-    desc: "Build Tauri desktop AppImage (Linux)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles appimage
-
-  clean:
-    desc: "Clean Tauri/Cargo build artifacts"
-    cmds:
-      - task: jlink:clean
-      - cd src-tauri && cargo clean
-      - rm -rf dist build
-
-  # ============================================================
-  # JLink — Build bundled Java runtime for Tauri
-  # ============================================================
-
-  jlink:
-    desc: "Build backend JAR and create JLink runtime for Tauri"
-    deps: [jlink:jar, jlink:runtime]
-
-  jlink:jar:
-    desc: "Build backend JAR for Tauri bundling"
-    run: once
-    dir: ..
-    env:
-      DISABLE_ADDITIONAL_FEATURES: "true"
-    cmds:
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon
-        platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon
-        platforms: [linux, darwin]
-      - mkdir -p frontend/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
-    status:
-      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar
-
-  jlink:runtime:
-    desc: "Create custom JRE with jlink"
-    deps: [jlink:jar]
-    cmds:
-      - rm -rf src-tauri/runtime/jre
-      - mkdir -p src-tauri/runtime
-      - >-
-        jlink
-        --add-modules {{.JLINK_MODULES}}
-        --strip-debug
-        --compress=2
-        --no-header-files
-        --no-man-pages
-        --output src-tauri/runtime/jre
-    status:
-      - test -d src-tauri/runtime/jre
-
-  jlink:clean:
-    desc: "Remove JLink runtime and bundled JARs"
-    cmds:
-      - rm -rf src-tauri/libs src-tauri/runtime
@@ -1,57 +0,0 @@
-version: '3'
-
-vars:
-  COMPOSE_DIR: docker/compose
-  EMBEDDED_DIR: docker/embedded
-
-tasks:
-  build:
-    desc: "Build standard Docker image"
-    cmds:
-      - docker build -t stirling-pdf -f {{.EMBEDDED_DIR}}/Dockerfile .
-
-  build:fat:
-    desc: "Build fat Docker image (all features)"
-    cmds:
-      - docker build -t stirling-pdf-fat -f {{.EMBEDDED_DIR}}/Dockerfile.fat .
-
-  build:ultra-lite:
-    desc: "Build ultra-lite Docker image"
-    cmds:
-      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
-
-  build:frontend:
-    desc: "Build frontend-only Docker image"
-    cmds:
-      - docker build -t stirling-pdf-frontend -f docker/frontend/Dockerfile .
-
-  build:engine:
-    desc: "Build engine Docker image"
-    dir: engine
-    cmds:
-      - docker build -t stirling-pdf-engine .
-
-  up:
-    desc: "Start standard docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml up -d
-
-  up:fat:
-    desc: "Start fat docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.fat.yml up -d
-
-  up:ultra-lite:
-    desc: "Start ultra-lite docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.ultra-lite.yml up -d
-
-  down:
-    desc: "Stop all running docker compose stacks"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml down
-
-  logs:
-    desc: "Tail docker compose logs"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
@@ -1,127 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install engine dependencies"
-    run: once
-    cmds:
-      - uv python install 3.13.8
-      - uv sync
-    sources:
-      - uv.lock
-      - pyproject.toml
-    status:
-      - test -d .venv
-
-  prepare:
-    desc: "Set up engine .env from template"
-    deps: [install]
-    cmds:
-      - uv run scripts/setup_env.py
-    sources:
-      - scripts/setup_env.py
-    generates:
-      - .env.local
-
-  run:
-    desc: "Run engine server"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port 5001
-
-  dev:
-    desc: "Start engine dev server with hot reload"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port 5001 --reload
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - uv run ruff check .
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - uv run ruff check . --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format . --diff
-
-  typecheck:
-    desc: "Run type checking"
-    deps: [install]
-    cmds:
-      - uv run pyright . --warnings
-
-  test:
-    desc: "Run tests"
-    deps: [prepare]
-    cmds:
-      - uv run pytest tests
-
-  fix:
-    desc: "Auto-fix lint + format"
-    cmds:
-      - task: lint:fix
-      - task: format
-
-  check:
-    desc: "Full engine quality gate"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  tool-models:
-    desc: "Generate tool_models.py from Java OpenAPI spec (SwaggerDoc.json)"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py
-    sources:
-      - ../SwaggerDoc.json
-      - scripts/generate_tool_models.py
-    generates:
-      - src/stirling/models/tool_models.py
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - task: '{{if eq .OS "Windows_NT"}}clean-windows{{else}}clean-unix{{end}}'
-
-  clean-unix:
-    internal: true
-    desc: "Clean build artifacts"
-    cmds:
-      - rm -rf .venv data logs output
-
-  # On Windows, use PowerShell as bash failed to delete some dependencies
-  clean-windows:
-    internal: true
-    desc: "Clean build artifacts"
-    ignore_error: true
-    cmds:
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue .venv
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue data
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue logs
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue output
@@ -1,313 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install dependencies"
-    run: once
-    cmds:
-      - '{{ if eq .CI "true" }}npm ci{{ else }}npm install{{ end }}'
-    sources:
-      - package-lock.json
-      - package.json
-    status:
-      - test -d node_modules
-    env:
-      CI: '{{ .CI | default "false" }}'
-
-  prepare:env:
-    desc: "Generate .env from example if missing"
-    run: once
-    deps: [install]
-    cmds:
-      - npx tsx scripts/setup-env.ts
-    sources:
-      - scripts/setup-env.ts
-      - config/.env.example
-    generates:
-      - .env
-
-  prepare:env:saas:
-    desc: "Generate .env and .env.saas from examples if missing"
-    run: once
-    deps: [install]
-    cmds:
-      - npx tsx scripts/setup-env.ts --saas
-    sources:
-      - scripts/setup-env.ts
-      - config/.env.example
-      - config/.env.saas.example
-    generates:
-      - .env
-      - .env.saas
-
-  prepare:env:desktop:
-    desc: "Generate .env and .env.desktop from examples if missing"
-    run: once
-    deps: [install]
-    cmds:
-      - npx tsx scripts/setup-env.ts --desktop
-    sources:
-      - scripts/setup-env.ts
-      - config/.env.example
-      - config/.env.desktop.example
-    generates:
-      - .env
-      - .env.desktop
-
-  prepare:icons:
-    desc: "Generate icon bundle from source references"
-    run: once
-    deps: [install]
-    cmds:
-      - node scripts/generate-icons.js
-
-  prepare:
-    desc: "Set up dev environment"
-    run: once
-    deps: [prepare:env, prepare:icons]
-
-  prepare:saas:
-    desc: "Prepare for SaaS mode"
-    run: once
-    deps: [prepare:env:saas, prepare:icons]
-
-  prepare:desktop:
-    desc: "Prepare for desktop mode"
-    run: once
-    deps: [prepare:env:desktop, prepare:icons]
-
-  # ============================================================
-  # Development
-  # ============================================================
-
-  dev:
-    desc: "Start frontend dev server"
-    deps: [prepare]
-    ignore_error: true
-    cmds:
-      - npx vite
-
-  dev:core:
-    desc: "Start frontend dev server in core mode"
-    deps: [prepare]
-    ignore_error: true
-    cmds:
-      - npx vite --mode core
-
-  dev:proprietary:
-    desc: "Start frontend dev server in proprietary mode"
-    deps: [prepare]
-    ignore_error: true
-    cmds:
-      - npx vite --mode proprietary
-
-  dev:saas:
-    desc: "Start frontend dev server in SaaS mode"
-    deps: [prepare:saas]
-    ignore_error: true
-    cmds:
-      - npx vite --mode saas
-
-  dev:desktop:
-    desc: "Start frontend dev server in desktop mode"
-    deps: [prepare:desktop]
-    ignore_error: true
-    cmds:
-      - npx vite --mode desktop
-
-  dev:prototypes:
-    desc: "Start frontend dev server in prototypes mode"
-    deps: [prepare]
-    ignore_error: true
-    cmds:
-      - npx vite --mode prototypes
-
-  # ============================================================
-  # Build
-  # ============================================================
-
-  build:
-    desc: "Production build (default mode)"
-    deps: [prepare]
-    cmds:
-      - npx vite build
-
-  build:core:
-    desc: "Build for core mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode core
-
-  build:proprietary:
-    desc: "Build for proprietary mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode proprietary
-
-  build:saas:
-    desc: "Build for SaaS mode"
-    deps: [prepare:saas]
-    cmds:
-      - npx vite build --mode saas
-
-  build:desktop:
-    desc: "Build for desktop mode"
-    deps: [prepare:desktop]
-    cmds:
-      - npx vite build --mode desktop
-
-  build:prototypes:
-    desc: "Build for prototypes mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode prototypes
-
-  # ============================================================
-  # Code quality
-  # ============================================================
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - npx eslint --max-warnings=0
-      - npx dpdm src --circular --no-warning --no-tree --exit-code circular:1
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - npx eslint --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --write .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --check .
-
-  fix:
-    desc: "Auto-fix lint and format"
-    cmds:
-      - task: format
-      - task: lint:fix
-
-  typecheck:
-    desc: "Typecheck default build of the app"
-    cmds:
-      - task: typecheck:proprietary
-
-  typecheck:core:
-    desc: "Typecheck core build variant"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project src/core/tsconfig.json
-
-  typecheck:proprietary:
-    desc: "Typecheck proprietary build variant"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project src/proprietary/tsconfig.json
-
-  typecheck:saas:
-    desc: "Typecheck SaaS build variant"
-    deps: [prepare:saas]
-    cmds:
-      - npx tsc --noEmit --project src/saas/tsconfig.json
-
-  typecheck:desktop:
-    desc: "Typecheck desktop build variant"
-    deps: [prepare:desktop]
-    cmds:
-      - npx tsc --noEmit --project src/desktop/tsconfig.json
-
-  typecheck:scripts:
-    desc: "Typecheck scripts"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project scripts/tsconfig.json
-
-  typecheck:prototypes:
-    desc: "Typecheck prototypes build variant"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project src/prototypes/tsconfig.json
-
-  typecheck:all:
-    desc: "Typecheck all build variants"
-    cmds:
-      - task: typecheck:core
-      - task: typecheck:proprietary
-      - task: typecheck:saas
-      - task: typecheck:desktop
-      - task: typecheck:scripts
-
-  # ============================================================
-  # Quality Gate
-  # ============================================================
-
-  check:
-    desc: "Quick quality gate for local development"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  check:all:
-    desc: "Full CI quality gate"
-    cmds:
-      - task: typecheck:all
-      - task: lint
-      - task: format:check
-      - task: build
-      - task: test
-
-  # ============================================================
-  # Test
-  # ============================================================
-
-  test:
-    desc: "Run tests"
-    deps: [install]
-    cmds:
-      - npx vitest run
-
-  test:watch:
-    desc: "Run tests in watch mode"
-    deps: [install]
-    cmds:
-      - npx vitest --watch
-
-  test:coverage:
-    desc: "Run tests with coverage"
-    deps: [install]
-    cmds:
-      - npx vitest --coverage
-
-  test:e2e:
-    desc: "Run E2E tests"
-    deps: [prepare]
-    cmds:
-      - npx playwright test {{.CLI_ARGS}}
-
-  test:e2e:install:
-    desc: "Install E2E test browsers"
-    deps: [install]
-    cmds:
-      - npx playwright install {{.CLI_ARGS}} --with-deps
-
-  # ============================================================
-  # Code Generation
-  # ============================================================
-
-  licenses:generate:
-    desc: "Generate frontend license report"
-    deps: [install]
-    cmds:
-      - node scripts/generate-licenses.js
@@ -13,7 +13,7 @@
    "vscjava.vscode-spring-boot-dashboard", // Spring Boot dashboard for managing and visualizing Spring Boot applications
    "EditorConfig.EditorConfig", // EditorConfig support for maintaining consistent coding styles
    "ms-azuretools.vscode-docker", // Docker extension for Visual Studio Code
-    "GitHub.copilot-chat", // GitHub Copilot AI pair programmer for Visual Studio Code
+    "GitHub.copilot", // GitHub Copilot AI pair programmer for Visual Studio Code
    "GitHub.vscode-pull-request-github", // GitHub Pull Requests extension for Visual Studio Code
    "charliermarsh.ruff", // Ruff code formatter for Python to follow the Ruff Style Guide
    "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing
@@ -1,6 +1,6 @@
 # Adding New React Tools to Stirling PDF

-This guide covers how to add new PDF tools to the React frontend.
+This guide covers how to add new PDF tools to the React frontend, either by migrating existing Thymeleaf templates or creating entirely new tools.

 ## Overview

@@ -188,7 +188,7 @@ import { use[ToolName]Tips } from "../components/tooltips/use[ToolName]Tips";

 const [ToolName] = (props: BaseToolProps) => {
  const tips = use[ToolName]Tips();
-
+  
  // In your steps array:
  steps: [
    {
@@ -257,14 +257,22 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 - Add `options.*` keys if your tool has settings with descriptions

 **Tooltip Writing Guidelines:**
- **Use simple, everyday language** - avoid technical terms like "converts interactive elements"
+- **Use simple, everyday language** - avoid technical terms like "converts interactive elements" 
 - **Focus on benefits** - explain what the user gains, not how it works internally
 - **Use concrete examples** - "text boxes become regular text" vs "form fields are flattened"
 - **Answer user questions** - "What does this do?", "When should I use this?", "What's this option for?"
 - **Keep descriptions concise** - 1-2 sentences maximum per section
 - **Use bullet points** for multiple benefits or features

-## 6. Testing Your Tool
+## 6. Migration from Thymeleaf
+When migrating existing Thymeleaf templates:
+
+1. **Identify Form Parameters**: Look at the original `<form>` inputs to determine parameter structure
+2. **Extract Translation Keys**: Find `#{key.name}` references and add them to JSON translations (For many tools these translations will already exist but some parts will be missing)
+3. **Map API Endpoint**: Note the `th:action` URL for the operation hook
+4. **Preserve Functionality**: Ensure all original form behaviour is replicated which is applicable to V2 react UI
+
+## 7. Testing Your Tool
 - Verify tool appears in UI with correct icon and description
 - Test with various file sizes and types
 - Confirm translations work
@@ -1,385 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to AI Agents when working with code in this repository.
-
-## Taskfile (Recommended)
-
-This project uses [Task](https://taskfile.dev/) as a unified command runner. All build, dev, test, lint, and docker commands can be run from the repo root via `task <command>`. Run `task --list` to see all available commands.
-
-### Quick Reference
- `task install` — install all dependencies
- `task dev` — start backend + frontend concurrently
- `task dev:all` — start backend + frontend + engine concurrently
- `task build` — build all components
- `task test` — run all tests (backend + frontend + engine)
- `task lint` — run all linters
- `task format` — auto-fix formatting across all components
- `task check` — full quality gate (lint + typecheck + test)
- `task clean` — clean all build artifacts
- `task docker:build` — build standard Docker image
- `task docker:up` — start Docker compose stack
-
-## Common Development Commands
-
-### Build and Test
- **Build project**: `task build`
- **Run backend locally**: `task backend:dev`
- **Run all tests**: `task test` (or individually: `task backend:test`, `task frontend:test`, `task engine:test`)
- **Docker integration tests**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
- **Code formatting**: `task format` (or `task backend:format` for Java only)
- **Full quality gate**: `task check` (runs lint + typecheck + test across all components)
-
-After modifying any files in the project, you must run the relevant `task check` command that covers that area of the code. For example, when editing frontend files run `task frontend:check`; for Python engine files run `task engine:check`; for Java backend files run `task backend:check`.
-
-### Docker Development
- **Build standard**: `task docker:build` (or `docker build -t stirling-pdf -f docker/embedded/Dockerfile .`)
- **Build fat version**: `task docker:build:fat`
- **Build ultra-lite**: `task docker:build:ultra-lite`
- **Start compose stack**: `task docker:up` (or `task docker:up:fat`, `task docker:up:ultra-lite`)
- **Stop compose stack**: `task docker:down`
- **View logs**: `task docker:logs`
- **Example compose files**: Located in `exampleYmlFiles/` directory
-
-### Security Mode Development
-Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.
-
-### Python Development
-Development for the AI engine happens in the `engine/` folder. The frontend calls the Python via Java as a proxy.
-
- Follow the engine-specific guidance in [engine/AGENTS.md](engine/AGENTS.md) for Python architecture, code style, and AI usage.
- Use Task commands from the repo root:
-  - `task engine:check` — lint, type-check, test
-  - `task engine:fix` — auto-fix linting and formatting
-  - `task engine:install` — install dependencies
- The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `task engine:install`.
-
-### Frontend Development
- **Frontend dev server**: `task frontend:dev` — requires backend on localhost:8080
- **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
- **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
- **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
- **Package Installation**: `task frontend:install`
- **Deployment Options**:
-  - **Desktop App**: `task desktop:build`
-  - **Web Server**: `task frontend:build` then serve dist/ folder
-  - **Development**: `task desktop:dev` for desktop dev mode
-
-#### Environment Variables
- All `VITE_*` variables must be declared in the appropriate example file:
-  - `frontend/config/.env.example` — core, proprietary, and shared vars
-  - `frontend/config/.env.saas.example` — SaaS-only vars
-  - `frontend/config/.env.desktop.example` — desktop (Tauri)-only vars
- Never use `|| 'hardcoded-fallback'` inline — put defaults in the example files
- `task frontend:prepare` / `prepare:saas` / `prepare:desktop` auto-create the env files from examples on first run, and error if any required keys are missing
- Prepare runs automatically as a dependency of all `dev*`, `build*`, and `desktop*` tasks
- See `frontend/README.md#environment-variables` for full documentation
-
-#### Import Paths - CRITICAL
-**ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
-
-For a broader explanation of the frontend layering and override architecture, see [frontend/DeveloperGuide.md](frontend/DeveloperGuide.md).
-
-```typescript
-// ✅ CORRECT - Use @app/* for all imports
-import { AppLayout } from "@app/components/AppLayout";
-import { useFileContext } from "@app/contexts/FileContext";
-import { FileContext } from "@app/contexts/FileContext";
-
-// ❌ WRONG - Do not use @core/* or @proprietary/* in normal code
-import { AppLayout } from "@core/components/AppLayout";
-import { useFileContext } from "@proprietary/contexts/FileContext";
-```
-
-**Only use explicit aliases when:**
- Building layer-specific override that wraps a lower layer's component
- Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
-
-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.
-
-#### Component Override Pattern (Stub/Shadow)
-Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
-
-**How it works:**
-1. Core defines stub component (returns null or no-op)
-2. Desktop/proprietary overrides with same path/name
-3. Core imports via `@app/*` - higher layer "shadows" core in those builds
-4. No `@ts-ignore`, no `isTauri()` checks, no runtime conditionals!
-
-**Example - Desktop-specific footer:**
-
-```typescript
-// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
-interface RightRailFooterExtensionsProps {
-  className?: string;
-}
-
-export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
-  return null; // Stub - does nothing in web builds
-}
-```
-
-```tsx
-// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
-import { Box } from '@mantine/core';
-import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
-
-interface RightRailFooterExtensionsProps {
-  className?: string;
-}
-
-export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
-  return (
-    <Box className={className}>
-      <BackendHealthIndicator />
-    </Box>
-  );
-}
-```
-
-```tsx
-// core/components/shared/RightRail.tsx (usage - works in ALL builds)
-import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';
-
-export function RightRail() {
-  return (
-    <div>
-      {/* In web builds: renders nothing (stub returns null) */}
-      {/* In desktop builds: renders BackendHealthIndicator */}
-      <RightRailFooterExtensions className="right-rail-footer" />
-    </div>
-  );
-}
-```
-
-**Build resolution:**
- **Core build**: `@app/*` → `core/*` → Gets stub (returns null)
- **Desktop build**: `@app/*` → `desktop/*` → Gets real implementation (shadows core)
-
-**Benefits:**
- No runtime checks or feature flags
- Type-safe across all builds
- Clean, readable code
- Build-time optimization (dead code elimination)
-
-#### Multi-Tool Workflow Architecture
-Frontend designed for **stateful document processing**:
- Users upload PDFs once, then chain tools (split → merge → compress → view)
- File state and processing results persist across tool switches
- No file reloading between tools - performance critical for large PDFs (up to 100GB+)
-
-#### FileContext - Central State Management
-**Location**: `frontend/src/core/contexts/FileContext.tsx`
- **Active files**: Currently loaded PDFs and their variants
- **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
- **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
- **IndexedDB persistence**: File storage with thumbnail caching
- **Preview system**: Tools can preview results (e.g., Split → Viewer → back to Split) without context pollution
-
-**Critical**: All file operations go through FileContext. Don't bypass with direct file handling.
-
-#### Processing Services
- **enhancedPDFProcessingService**: Background PDF parsing and manipulation
- **thumbnailGenerationService**: Web Worker-based with main-thread fallback
- **fileStorage**: IndexedDB with LRU cache management
-
-#### Memory Management Strategy
-**Why manual cleanup exists**: Large PDFs (up to 100GB+) through multiple tools accumulate:
- PDF.js documents that need explicit .destroy() calls
- Blob URLs from tool outputs that need revocation
- Web Workers that need termination
-Without cleanup: browser crashes with memory leaks.
-
-#### Tool Development
-
-**Architecture**: Modular hook-based system with clear separation of concerns:
-
- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
-  - Coordinates all tool operations with consistent interface
-  - Integrates with FileContext for operation tracking
-  - Handles validation, error handling, and UI state management
-
- **Supporting Hooks**:
-  - **useToolState**: UI state management (loading, progress, error, files)
-  - **useToolApiCalls**: HTTP requests and file processing
-  - **useToolResources**: Blob URLs, thumbnails, ZIP downloads
-
- **Utilities**:
-  - **toolErrorHandler**: Standardized error extraction and i18n support
-  - **toolResponseProcessor**: API response handling (single/zip/custom)
-  - **toolOperationTracker**: FileContext integration utilities
-
-**Three Tool Patterns**:
-
-**Pattern 1: Single-File Tools** (Individual processing)
- Backend processes one file per API call
- Set `multiFileEndpoint: false`
- Examples: Compress, Rotate
-```typescript
-return useToolOperation({
-  operationType: 'compress',
-  endpoint: '/api/v1/misc/compress-pdf',
-  buildFormData: (params, file: File) => { /* single file */ },
-  multiFileEndpoint: false,
-});
-```
-
-**Pattern 2: Multi-File Tools** (Batch processing)
- Backend accepts `MultipartFile[]` arrays in single API call
- Set `multiFileEndpoint: true`
- Examples: Split, Merge, Overlay
-```typescript
-return useToolOperation({
-  operationType: 'split',
-  endpoint: '/api/v1/general/split-pages',
-  buildFormData: (params, files: File[]) => { /* all files */ },
-  multiFileEndpoint: true,
-  filePrefix: 'split_',
-});
-```
-
-**Pattern 3: Complex Tools** (Custom processing)
- Tools with complex routing logic or non-standard processing
- Provide `customProcessor` for full control
- Examples: Convert, OCR
-```typescript
-return useToolOperation({
-  operationType: 'convert',
-  customProcessor: async (params, files) => { /* custom logic */ },
-});
-```
-
-**Benefits**:
- **No Timeouts**: Operations run until completion (supports 100GB+ files)
- **Consistent**: All tools follow same pattern and interface
- **Maintainable**: Single responsibility hooks, easy to test and modify
- **i18n Ready**: Built-in internationalization support
- **Type Safe**: Full TypeScript support with generic interfaces
- **Memory Safe**: Automatic resource cleanup and blob URL management
-
-## Architecture Overview
-
-### Project Structure
- **Backend**: Spring Boot application
- **Frontend**: React-based SPA in `/frontend` directory
-  - **File Storage**: IndexedDB for client-side file persistence and thumbnails
-  - **Internationalization**: JSON-based translations (converted from backend .properties)
- **PDF Processing**: PDFBox for core PDF operations, LibreOffice for conversions, PDF.js for client-side rendering
- **Security**: Spring Security with optional authentication (controlled by `DOCKER_ENABLE_SECURITY`)
- **Configuration**: YAML-based configuration with environment variable overrides
-
-### Controller Architecture
- **API Controllers** (`src/main/java/.../controller/api/`): REST endpoints for PDF operations
-  - Organized by function: converters, security, misc, pipeline
-  - Follow pattern: `@RestController` + `@RequestMapping("/api/v1/...")`
-
-### Key Components
- **SPDFApplication.java**: Main application class with desktop UI and browser launching logic
- **ConfigInitializer**: Handles runtime configuration and settings files
- **Pipeline System**: Automated PDF processing workflows via `PipelineController`
- **Security Layer**: Authentication, authorization, and user management (when enabled)
-
-### Frontend Directory Structure
-The frontend is organized with a clear separation of concerns:
-
- **`frontend/src/core/`**: Main application code (shared, production-ready components)
-  - **`core/components/`**: React components organized by feature
-    - `core/components/tools/`: Individual PDF tool implementations
-    - `core/components/viewer/`: PDF viewer components
-    - `core/components/pageEditor/`: Page manipulation UI
-    - `core/components/tooltips/`: Help tooltips for tools
-    - `core/components/shared/`: Reusable UI components
-  - **`core/contexts/`**: React Context providers
-    - `FileContext.tsx`: Central file state management
-    - `file/`: File reducer and selectors
-    - `toolWorkflow/`: Tool workflow state
-  - **`core/hooks/`**: Custom React hooks
-    - `hooks/tools/`: Tool-specific operation hooks (one directory per tool)
-    - `hooks/tools/shared/`: Shared hook utilities (useToolOperation, etc.)
-  - **`core/constants/`**: Application constants and configuration
-  - **`core/data/`**: Static data (tool taxonomy, etc.)
-  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)
-
- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
- **`frontend/src/proprietary/`**: Proprietary/licensed features
- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
- **`frontend/public/`**: Static assets served directly
-  - `public/locales/`: Translation JSON files
-
-### Component Architecture
- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
- **Internationalization**:
-  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
-  - Conversion Script: `scripts/convert_properties_to_json.py`
-
-### Configuration Modes
- **Ultra-lite**: Basic PDF operations only
- **Standard**: Full feature set
- **Fat**: Pre-downloaded dependencies for air-gapped environments
- **Security Mode**: Adds authentication, user management, and enterprise features
-
-### Testing Strategy
- **Integration Tests**: Cucumber tests in `testing/cucumber/`
- **Docker Testing**: `test.sh` validates all Docker variants
- **Manual Testing**: No unit tests currently - relies on UI and API testing
-
-## Development Workflow
-
-1. **Local Development** (using Taskfile):
-   - Backend + frontend: `task dev`
-   - All services (including AI engine): `task dev:all`
-   - Or individually: `task backend:dev` (localhost:8080), `task frontend:dev` (localhost:5173), `task engine:dev` (localhost:5001)
-2. **Quality Gate**: Run `task check` before submitting PRs
-3. **Docker Testing**: Use `./test.sh` for full Docker integration tests
-4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
-5. **Translations**:
-   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
-6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
-
-## Frontend Architecture Status
-
- **Core Status**: React SPA architecture complete with multi-tool workflow support
- **State Management**: FileContext handles all file operations and tool navigation
- **File Processing**: Production-ready with memory management for large PDF workflows (up to 100GB+)
- **Tool Integration**: Modular hook architecture with `useToolOperation` orchestrator
-  - Individual hooks: `useToolState`, `useToolApiCalls`, `useToolResources`
-  - Utilities: `toolErrorHandler`, `toolResponseProcessor`, `toolOperationTracker`
-  - Pattern: Each tool creates focused operation hook, UI consumes state/actions
- **Preview System**: Tool results can be previewed without polluting file context (Split tool example)
- **Performance**: Web Worker thumbnails, IndexedDB persistence, background processing
-
-## Translation Rules
-
- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
- Translation files are located in `frontend/public/locales/`
-
-## Important Notes
-
- **Java Version**: Minimum JDK 21, supports and recommends JDK 25
- **Lombok**: Used extensively - ensure IDE plugin is installed
- **File Persistence**:
-  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
-  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
- **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
- **Import Paths**: ALWAYS use `@app/*` for imports - never use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer
- **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
- **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
- **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
- **Performance Target**: Must handle PDFs up to 100GB+ without browser crashes
- **Preview System**: Tools can preview results without polluting main file context (see Split tool implementation)
- **Adding Tools**: See `ADDING_TOOLS.md` for complete guide to creating new PDF tools
-
-## Communication Style
- Be direct and to the point
- No apologies or conversational filler
- Answer questions directly without preamble
- Explain reasoning concisely when asked
- Avoid unnecessary elaboration
-
-## Decision Making
- Ask clarifying questions before making assumptions
- Stop and ask when uncertain about project-specific details
- Confirm approach before making structural changes
- Request guidance on preferences (cross-platform vs specific tools, etc.)
- Verify understanding of requirements before proceeding
@@ -1 +0,0 @@
-AGENTS.md
@@ -0,0 +1,228 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Common Development Commands
+
+### Build and Test
+- **Build project**: `./gradlew clean build`
+- **Run locally**: `./gradlew bootRun`
+- **Full test suite**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
+- **Code formatting**: `./gradlew spotlessApply` (runs automatically before compilation)
+
+### Docker Development
+- **Build ultra-lite**: `docker build -t stirlingtools/stirling-pdf:latest-ultra-lite -f ./Dockerfile.ultra-lite .`
+- **Build standard**: `docker build -t stirlingtools/stirling-pdf:latest -f ./Dockerfile .`
+- **Build fat version**: `docker build -t stirlingtools/stirling-pdf:latest-fat -f ./Dockerfile.fat .`
+- **Example compose files**: Located in `exampleYmlFiles/` directory
+
+### Security Mode Development
+Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.
+
+### Frontend Development
+- **Frontend dev server**: `cd frontend && npm run dev` (requires backend on localhost:8080)
+- **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
+- **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
+- **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
+- **Package Installation**: DO NOT run npm install commands - package management handled separately
+- **Deployment Options**:
+  - **Desktop App**: `npm run tauri-build` (native desktop application)
+  - **Web Server**: `npm run build` then serve dist/ folder
+  - **Development**: `npm run tauri-dev` for desktop dev mode
+
+#### Multi-Tool Workflow Architecture
+Frontend designed for **stateful document processing**:
+- Users upload PDFs once, then chain tools (split → merge → compress → view)
+- File state and processing results persist across tool switches
+- No file reloading between tools - performance critical for large PDFs (up to 100GB+)
+
+#### FileContext - Central State Management
+**Location**: `src/contexts/FileContext.tsx`
+- **Active files**: Currently loaded PDFs and their variants
+- **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
+- **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
+- **IndexedDB persistence**: File storage with thumbnail caching
+- **Preview system**: Tools can preview results (e.g., Split → Viewer → back to Split) without context pollution
+
+**Critical**: All file operations go through FileContext. Don't bypass with direct file handling.
+
+#### Processing Services
+- **enhancedPDFProcessingService**: Background PDF parsing and manipulation
+- **thumbnailGenerationService**: Web Worker-based with main-thread fallback
+- **fileStorage**: IndexedDB with LRU cache management
+
+#### Memory Management Strategy
+**Why manual cleanup exists**: Large PDFs (up to 100GB+) through multiple tools accumulate:
+- PDF.js documents that need explicit .destroy() calls
+- Blob URLs from tool outputs that need revocation
+- Web Workers that need termination
+Without cleanup: browser crashes with memory leaks.
+
+#### Tool Development
+
+**Architecture**: Modular hook-based system with clear separation of concerns:
+
+- **useToolOperation** (`frontend/src/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+  - Coordinates all tool operations with consistent interface
+  - Integrates with FileContext for operation tracking
+  - Handles validation, error handling, and UI state management
+
+- **Supporting Hooks**:
+  - **useToolState**: UI state management (loading, progress, error, files)
+  - **useToolApiCalls**: HTTP requests and file processing
+  - **useToolResources**: Blob URLs, thumbnails, ZIP downloads
+
+- **Utilities**:
+  - **toolErrorHandler**: Standardized error extraction and i18n support
+  - **toolResponseProcessor**: API response handling (single/zip/custom)
+  - **toolOperationTracker**: FileContext integration utilities
+
+**Three Tool Patterns**:
+
+**Pattern 1: Single-File Tools** (Individual processing)
+- Backend processes one file per API call
+- Set `multiFileEndpoint: false`
+- Examples: Compress, Rotate
+```typescript
+return useToolOperation({
+  operationType: 'compress',
+  endpoint: '/api/v1/misc/compress-pdf',
+  buildFormData: (params, file: File) => { /* single file */ },
+  multiFileEndpoint: false,
+});
+```
+
+**Pattern 2: Multi-File Tools** (Batch processing)
+- Backend accepts `MultipartFile[]` arrays in single API call
+- Set `multiFileEndpoint: true`
+- Examples: Split, Merge, Overlay
+```typescript
+return useToolOperation({
+  operationType: 'split',
+  endpoint: '/api/v1/general/split-pages',
+  buildFormData: (params, files: File[]) => { /* all files */ },
+  multiFileEndpoint: true,
+  filePrefix: 'split_',
+});
+```
+
+**Pattern 3: Complex Tools** (Custom processing)
+- Tools with complex routing logic or non-standard processing
+- Provide `customProcessor` for full control
+- Examples: Convert, OCR
+```typescript
+return useToolOperation({
+  operationType: 'convert',
+  customProcessor: async (params, files) => { /* custom logic */ },
+});
+```
+
+**Benefits**:
+- **No Timeouts**: Operations run until completion (supports 100GB+ files)
+- **Consistent**: All tools follow same pattern and interface
+- **Maintainable**: Single responsibility hooks, easy to test and modify
+- **i18n Ready**: Built-in internationalization support
+- **Type Safe**: Full TypeScript support with generic interfaces
+- **Memory Safe**: Automatic resource cleanup and blob URL management
+
+## Architecture Overview
+
+### Project Structure
+- **Backend**: Spring Boot application with Thymeleaf templating
+- **Frontend**: React-based SPA in `/frontend` directory (Thymeleaf templates fully replaced)
+  - **File Storage**: IndexedDB for client-side file persistence and thumbnails
+  - **Internationalization**: JSON-based translations (converted from backend .properties)
+- **PDF Processing**: PDFBox for core PDF operations, LibreOffice for conversions, PDF.js for client-side rendering
+- **Security**: Spring Security with optional authentication (controlled by `DOCKER_ENABLE_SECURITY`)
+- **Configuration**: YAML-based configuration with environment variable overrides
+
+### Controller Architecture
+- **API Controllers** (`src/main/java/.../controller/api/`): REST endpoints for PDF operations
+  - Organized by function: converters, security, misc, pipeline
+  - Follow pattern: `@RestController` + `@RequestMapping("/api/v1/...")`
+- **Web Controllers** (`src/main/java/.../controller/web/`): Serve Thymeleaf templates
+  - Pattern: `@Controller` + return template names
+
+### Key Components
+- **SPDFApplication.java**: Main application class with desktop UI and browser launching logic
+- **ConfigInitializer**: Handles runtime configuration and settings files
+- **Pipeline System**: Automated PDF processing workflows via `PipelineController`
+- **Security Layer**: Authentication, authorization, and user management (when enabled)
+
+### Component Architecture
+- **React Components**: Located in `frontend/src/components/` and `frontend/src/tools/`
+- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
+- **Internationalization**:
+  - Backend: `messages_*.properties` files
+  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
+  - Conversion Script: `scripts/convert_properties_to_json.py`
+
+### Configuration Modes
+- **Ultra-lite**: Basic PDF operations only
+- **Standard**: Full feature set
+- **Fat**: Pre-downloaded dependencies for air-gapped environments
+- **Security Mode**: Adds authentication, user management, and enterprise features
+
+### Testing Strategy
+- **Integration Tests**: Cucumber tests in `testing/cucumber/`
+- **Docker Testing**: `test.sh` validates all Docker variants
+- **Manual Testing**: No unit tests currently - relies on UI and API testing
+
+## Development Workflow
+
+1. **Local Development**:
+   - Backend: `./gradlew bootRun` (runs on localhost:8080)
+   - Frontend: `cd frontend && npm run dev` (runs on localhost:5173, proxies to backend)
+2. **Docker Testing**: Use `./test.sh` before submitting PRs
+3. **Code Style**: Spotless enforces Google Java Format automatically
+4. **Translations**:
+   - Backend: Use helper scripts in `/scripts` for multi-language updates
+   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
+5. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
+
+## Frontend Architecture Status
+
+- **Core Status**: React SPA architecture complete with multi-tool workflow support
+- **State Management**: FileContext handles all file operations and tool navigation
+- **File Processing**: Production-ready with memory management for large PDF workflows (up to 100GB+)
+- **Tool Integration**: Modular hook architecture with `useToolOperation` orchestrator
+  - Individual hooks: `useToolState`, `useToolApiCalls`, `useToolResources`
+  - Utilities: `toolErrorHandler`, `toolResponseProcessor`, `toolOperationTracker`
+  - Pattern: Each tool creates focused operation hook, UI consumes state/actions
+- **Preview System**: Tool results can be previewed without polluting file context (Split tool example)
+- **Performance**: Web Worker thumbnails, IndexedDB persistence, background processing
+
+## Translation Rules
+
+- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
+- Translation files are located in `frontend/public/locales/`
+
+## Important Notes
+
+- **Java Version**: Minimum JDK 17, supports and recommends JDK 21
+- **Lombok**: Used extensively - ensure IDE plugin is installed
+- **Desktop Mode**: Set `STIRLING_PDF_DESKTOP_UI=true` for desktop application mode
+- **File Persistence**:
+  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
+  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
+- **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
+- **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
+- **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
+- **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
+- **Performance Target**: Must handle PDFs up to 100GB+ without browser crashes
+- **Preview System**: Tools can preview results without polluting main file context (see Split tool implementation)
+- **Adding Tools**: See `ADDING_TOOLS.md` for complete guide to creating new PDF tools
+
+## Communication Style
+- Be direct and to the point
+- No apologies or conversational filler
+- Answer questions directly without preamble
+- Explain reasoning concisely when asked
+- Avoid unnecessary elaboration
+
+## Decision Making
+- Ask clarifying questions before making assumptions
+- Stop and ask when uncertain about project-specific details
+- Confirm approach before making structural changes
+- Request guidance on preferences (cross-platform vs specific tools, etc.)
+- Verify understanding of requirements before proceeding
@@ -15,19 +15,6 @@ Before you start working on an issue, please comment on (or create) the issue an
 Once you have been assigned an issue, you can start working on it. When you are ready to submit your changes, open a pull request.
 For a detailed pull request tutorial, see [this guide](https://www.digitalocean.com/community/tutorials/how-to-create-a-pull-request-on-github).

-## Development Quick Start
-
-This project uses [Task](https://taskfile.dev/) as a unified command runner. After cloning:
-
-1. Install the `task` CLI: https://taskfile.dev/installation/
-2. Run `task install` to install all dependencies
-3. Run `task dev` to start backend + frontend
-4. Run `task check` before submitting a PR
-
-Run `task --list` to see all available commands.
-
-## Pull Request Guidelines
-
 Please make sure your Pull Request adheres to the following guidelines:

 - Use the PR template provided.
@@ -52,10 +39,9 @@ If, at any point in time, you have a question, please feel free to ask in the sa

 ## Developer Documentation

-For technical guides, setup instructions, and development resources:
+For technical guides, setup instructions, and development resources, please see our [Developer Documentation](devGuide/) which includes:

- [Developer Guide](DeveloperGuide.md) - Main setup and architecture guide
- [Taskfile.yml](Taskfile.yml) - Unified task runner for all build/dev/test/lint commands
+- [Developer Guide](devGuide/DeveloperGuide.md) - Main setup and architecture guide
 - [Exception Handling Guide](devGuide/EXCEPTION_HANDLING_GUIDE.md) - Error handling patterns and i18n
 - [Translation Guide](devGuide/HowToAddNewLanguage.md) - Adding new languages
 - And more in the [devGuide folder](devGuide/)
@@ -2,7 +2,7 @@

 ## 1. Introduction

-Stirling-PDF is a robust, locally hosted, web-based PDF manipulation tool. **Stirling 2.0** represents a complete frontend rewrite with a modern React SPA (Single Page Application).
+Stirling-PDF is a robust, locally hosted, web-based PDF manipulation tool. **Stirling 2.0** represents a complete frontend rewrite, replacing the legacy Thymeleaf-based UI with a modern React SPA (Single Page Application).

 This guide focuses on developing for Stirling 2.0, including both the React frontend and Spring Boot backend development workflows.

@@ -11,7 +11,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 **Stirling 2.0** is built using:

 **Backend:**
- Spring Boot (Java 21+, JDK 25 recommended)
+- Spring Boot (Java 17+, JDK 21 recommended)
 - PDFBox for core PDF operations
 - LibreOffice for document conversions
 - qpdf for PDF optimization
@@ -38,17 +38,18 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - PDF file association support
 - Self-contained JRE bundling with JLink

+**Legacy (reference only during development):**
+- Thymeleaf templates (being completely replaced in 2.0)
+
 ## 3. Development Environment Setup

 ### Prerequisites

- [Task](https://taskfile.dev/installation/) — unified command runner (recommended)
 - Docker
 - Git
- Java JDK 21 or later (JDK 25 recommended)
+- Java JDK 17 or later (JDK 21 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
- [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)

@@ -61,7 +62,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
   cd Stirling-PDF
   ```

-2. Install Docker and JDK 21 (or JDK 25 recommended) if not already installed.
+2. Install Docker and JDK17 if not already installed.

 3. Install a recommended Java IDE such as Eclipse, IntelliJ, or VSCode
   1. Only VSCode
@@ -84,29 +85,13 @@ For local testing, you should generally be testing the full 'Security' version o
 5. **Frontend Setup (Required for Stirling 2.0)**
   Navigate to the frontend directory and install dependencies using npm.

-### Verify Setup
-
-Run `task install` to install all project dependencies (frontend npm packages, engine Python packages). Gradle manages its own dependencies automatically. Then run `task check` to verify everything builds and passes.
-
 ## 4. Stirling 2.0 Development Workflow

-### Using Taskfile (Recommended)
-
-The fastest way to start developing:
-
-1. **Start developing**: `task dev` (runs backend + frontend concurrently — Ctrl+C to stop)
-2. **Or start services individually** in separate terminals:
-   - `task backend:dev` — Spring Boot on localhost:8080
-   - `task frontend:dev` — Vite on localhost:5173
-   - `task engine:dev` — FastAPI on localhost:5001
-
-Run `task --list` to see all available commands.
-
 ### Frontend Development (React)
 The frontend is a React SPA that runs independently during development:

-1. **Start the backend**: `task backend:dev` (serves API endpoints on localhost:8080)
-2. **Start the frontend dev server**: `task frontend:dev` (serves UI on localhost:5173)
+1. **Start the backend**: Run the Spring Boot application (serves API endpoints on localhost:8080)
+2. **Start the frontend dev server**: Navigate to the frontend directory and run the development server (serves UI on localhost:5173)
 3. **Development flow**: The Vite dev server automatically proxies API calls to the backend

 ### File Storage Architecture
@@ -115,12 +100,12 @@ Stirling 2.0 uses client-side file storage:
 - **PDF.js**: Handles client-side PDF rendering and processing
 - **URL Parameters**: Support for deep linking and tool state persistence

+### Legacy Code Reference
+The existing Thymeleaf templates remain in the codebase during development as reference material but will be completely removed for the 2.0 release.
+
 ### Tauri Desktop App Development
 Stirling-PDF can be packaged as a cross-platform desktop application using Tauri with PDF file association support and bundled JRE.
-
-Using Taskfile: `task desktop:dev` (development) or `task desktop:build` (production build).
-
-See [the frontend README](frontend/README.md#tauri) for detailed build instructions.
+See [the frontend README](frontend/README.md#tauri) for build instructions.

 ## 5. Project Structure

@@ -169,6 +154,7 @@ Stirling-PDF/
 │   │       │   ├── css/
 │   │       │   ├── js/
 │   │       │   └── pdfjs/
+│   │       └── templates/         # Legacy Thymeleaf templates (reference only)
 │   └── test/
 ├── testing/               # Cucumber and integration tests
 │   └── cucumber/          # Cucumber test files
@@ -208,7 +194,7 @@ services:
        limits:
          memory: 4G
    healthcheck:
-      test: ["CMD-SHELL", "curl -f http://localhost:8080$${SYSTEM_ROOTURIPATH:-''}/api/v1/info/status | grep -q 'UP' && curl -fL http://localhost:8080/ | grep -q 'Please sign in'"]
+      test: ["CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP' && curl -fL http://localhost:8080/ | grep -q 'Please sign in'"]
      interval: 5s
      timeout: 10s
      retries: 16
@@ -243,20 +229,6 @@ docker-compose -f exampleYmlFiles/docker-compose-latest-security.yml up

 ### Building Docker Images

-#### Using Taskfile (Recommended)
-
-```bash
-task docker:build            # standard image
-task docker:build:fat        # fat image (all features)
-task docker:build:ultra-lite # ultra-lite image
-task docker:up               # start standard compose stack
-task docker:up:fat           # start fat compose stack
-task docker:down             # stop all stacks
-task docker:logs             # tail logs
-```
-
-#### Manual Docker Builds
-
 Stirling-PDF uses different Docker images for various configurations. The build process is controlled by environment variables and uses specific Dockerfile variants. Here's how to build the Docker images:

 1. Set the security environment variable:
@@ -265,10 +237,10 @@ Stirling-PDF uses different Docker images for various configurations. The build
   export DISABLE_ADDITIONAL_FEATURES=true  # or false for to enable login and security features for builds
   ```

-2. Build the project:
+2. Build the project with Gradle:

   ```bash
-   task backend:build
+   ./gradlew clean build
   ```

 3. Build the Docker images:
@@ -296,18 +268,9 @@ Note: The `--no-cache` and `--pull` flags ensure that the build process uses the

 ## 7. Testing

-### Quick Testing with Taskfile
-
-Run all unit/integration tests across all components:
-
-```bash
-task test    # run all tests (backend + frontend + engine)
-task check   # full quality gate: lint + typecheck + test
-```
-
 ### Comprehensive Testing Script

-Stirling-PDF also provides a `test.sh` script in the root directory for Docker integration tests. This script builds all versions of Stirling-PDF, checks that each version works, and runs Cucumber tests. It's recommended to run this script before submitting a final pull request.
+Stirling-PDF provides a `test.sh` script in the root directory. This script builds all versions of Stirling-PDF, checks that each version works, and runs Cucumber tests. It's recommended to run this script before submitting a final pull request.

 To run the test script:

@@ -333,11 +296,10 @@ Note: The `test.sh` script will run automatically when you raise a PR. However,

 For React frontend development:

-1. Start the backend: `task backend:dev` (serves API endpoints on localhost:8080)
-2. Start the frontend dev server: `task frontend:dev` (serves UI on localhost:5173)
+1. Start the backend: Run the Spring Boot application to serve API endpoints on localhost:8080
+2. Start the frontend dev server: Navigate to the frontend directory and run the development server on localhost:5173
 3. The Vite dev server automatically proxies API calls to the backend
-4. Run frontend tests: `task frontend:test` (or `task frontend:test:watch` for watch mode)
-5. Test React components, UI interactions, and IndexedDB file operations using browser developer tools
+4. Test React components, UI interactions, and IndexedDB file operations using browser developer tools

 ### Local Testing (Java and UI Components)

@@ -347,13 +309,14 @@ For quick iterations and development of Java backend, JavaScript, and UI compone
 - RESTful API endpoints
 - JavaScript functionality
 - User interface components and styling
+- Thymeleaf templates

 To run Stirling-PDF locally:

 1. Compile and run the project using built-in IDE methods or by running:

   ```bash
-   task backend:dev
+   ./gradlew bootRun
   ```

 2. Access the application at `http://localhost:8080` in your web browser.
@@ -374,11 +337,10 @@ Important notes:
 2. Create a new branch for your feature or bug fix.
 3. Make your changes and commit them with clear, descriptive messages and ensure any documentation is updated related to your changes.
 4. Test your changes thoroughly in the Docker environment.
-5. Run the quality gate and integration tests:
+5. Run the `test.sh` script to ensure all versions build correctly and pass the Cucumber tests:

   ```bash
-   task check   # lint + typecheck + test across all components
-   ./test.sh    # Docker integration tests (builds all variants + Cucumber)
+   ./test.sh
   ```

 6. Push your changes to your fork.
@@ -439,7 +401,7 @@ Remember to test your changes thoroughly to ensure they don't break any existing

 ### React Component Development (Stirling 2.0)

-For Stirling 2.0, new features are built as React components:
+For Stirling 2.0, new features are built as React components instead of Thymeleaf templates:

 #### Creating a New Tool Component

@@ -486,6 +448,61 @@ For Stirling 2.0, new features are built as React components:
 3. **Register in Tool Picker:**
   Update the tool picker component to include the new tool with proper routing and URL parameter support.

+### Legacy Reference: Overview of Thymeleaf
+
+Thymeleaf is a server-side Java HTML template engine. It is used in Stirling-PDF to render dynamic web pages. Thymeleaf integrates heavily with Spring Boot.
+
+### Thymeleaf overview
+
+In Stirling-PDF, Thymeleaf is used to create HTML templates that are rendered on the server side. These templates are located in the `stirling-pdf/src/main/resources/templates` directory. Thymeleaf templates use a combination of HTML and special Thymeleaf attributes to dynamically generate content.
+
+Some examples of this are:
+
+```html
+<th:block th:insert="~{fragments/navbar.html :: navbar}"></th:block>
+```
+or
+```html
+<th:block th:insert="~{fragments/footer.html :: footer}"></th:block>
+```
+
+Where it uses the `th:block`, `th:` indicating it's a special Thymeleaf element to be used server-side in generating the HTML, and block being the actual element type.
+In this case, we are inserting the `navbar` entry within the `fragments/navbar.html` fragment into the `th:block` element.
+
+They can be more complex, such as:
+
+```html
+<th:block th:insert="~{fragments/common :: head(title=#{pageExtracter.title}, header=#{pageExtracter.header})}"></th:block>
+```
+
+Which is the same as above but passes the parameters title and header into the fragment `common.html` to be used in its HTML generation.
+
+Thymeleaf can also be used to loop through objects or pass things from the Java side into the HTML side.
+
+```java
+ @GetMapping
+       public String newFeaturePage(Model model) {
+           model.addAttribute("exampleData", exampleData);
+           return "new-feature";
+       }
+```
+
+In the above example, if exampleData is a list of plain java objects of class Person and within it, you had id, name, age, etc. You can reference it like so
+
+```html
+<tbody>
+   <!-- Use th:each to iterate over the list -->
+   <tr th:each="person : ${exampleData}">
+       <td th:text="${person.id}"></td>
+       <td th:text="${person.name}"></td>
+       <td th:text="${person.age}"></td>
+       <td th:text="${person.email}"></td>
+   </tr>
+</tbody>
+```
+
+This would generate n entries of tr for each person in exampleData
+
 ### Adding a New Feature to the Backend (API)

 1. **Create a New Controller:**
@@ -510,7 +527,7 @@ For Stirling 2.0, new features are built as React components:
       @GetMapping
       @Operation(summary = "New Feature", description = "This is a new feature endpoint.")
       public String newFeature() {
-           return "NewFeatureResponse";
+           return "NewFeatureResponse"; // This refers to the NewFeatureResponse.html template presenting the user with the generated html from that file when they navigate to /api/v1/new-feature
       }
   }
   ```
@@ -565,6 +582,91 @@ For Stirling 2.0, new features are built as React components:
  }
  ```

+### Adding a New Feature to the Frontend (UI)
+
+1. **Create a New Thymeleaf Template:**
+   - Create a new HTML file in the `stirling-pdf/src/main/resources/templates` directory.
+   - Use Thymeleaf attributes to dynamically generate content.
+   - Use `extract-page.html` as a base example for the HTML template, which is useful to ensure importing of the general layout, navbar, and footer.
+
+   ```html
+   <!DOCTYPE html>
+   <html th:lang="${#locale.language}" th:dir="#{language.direction}" th:data-language="${#locale.toString()}" xmlns:th="https://www.thymeleaf.org">
+     <head>
+     <th:block th:insert="~{fragments/common :: head(title=#{newFeature.title}, header=#{newFeature.header})}"></th:block>
+     </head>
+
+     <body>
+       <div id="page-container">
+         <div id="content-wrap">
+           <th:block th:insert="~{fragments/navbar.html :: navbar}"></th:block>
+           <br><br>
+           <div class="container">
+             <div class="row justify-content-center">
+               <div class="col-md-6 bg-card">
+                 <div class="tool-header">
+                   <span class="material-symbols-rounded tool-header-icon organize">upload</span>
+                   <span class="tool-header-text" th:text="#{newFeature.header}"></span>
+                 </div>
+                 <form th:action="@{'/api/v1/new-feature'}" method="post" enctype="multipart/form-data">
+                   <div th:replace="~{fragments/common :: fileSelector(name='fileInput', multipleInputsForSingleRequest=false, accept='application/pdf')}"></div>
+                   <input type="hidden" id="customMode" name="customMode" value="">
+                   <div class="mb-3">
+                     <label for="featureInput" th:text="#{newFeature.prompt}"></label>
+                     <input type="text" class="form-control" id="featureInput" name="featureInput" th:placeholder="#{newFeature.placeholder}" required>
+                   </div>
+
+                   <button type="submit" id="submitBtn" class="btn btn-primary" th:text="#{newFeature.submit}"></button>
+                 </form>
+               </div>
+             </div>
+           </div>
+         </div>
+         <th:block th:insert="~{fragments/footer.html :: footer}"></th:block>
+       </div>
+     </body>
+   </html>
+   ```
+
+2. **Create a New Controller for the UI:**
+   - Create a new Java class in the `stirling-pdf/src/main/java/stirling/software/SPDF/controller/ui` directory.
+   - Annotate the class with `@Controller` and `@RequestMapping` to define the UI endpoint.
+
+   ```java
+   package stirling.software.SPDF.controller.ui;
+
+   import org.springframework.beans.factory.annotation.Autowired;
+   import org.springframework.stereotype.Controller;
+   import org.springframework.ui.Model;
+   import org.springframework.web.bind.annotation.GetMapping;
+   import org.springframework.web.bind.annotation.RequestMapping;
+   import stirling.software.SPDF.service.NewFeatureService;
+
+   @Controller
+   @RequestMapping("/new-feature")
+   public class NewFeatureUIController {
+
+       @Autowired
+       private NewFeatureService newFeatureService;
+
+       @GetMapping
+       public String newFeaturePage(Model model) {
+           model.addAttribute("newFeatureData", newFeatureService.getNewFeatureData());
+           return "new-feature";
+       }
+   }
+   ```
+
+3. **Update the Navigation Bar:**
+   - Add a link to the new feature page in the navigation bar.
+   - Update the `stirling-pdf/src/main/resources/templates/fragments/navbar.html` file.
+
+   ```html
+   <li class="nav-item">
+       <a class="nav-link" th:href="@{'/new-feature'}">New Feature</a>
+   </li>
+   ```
+
 ## Adding New Translations to Existing Language Files in Stirling-PDF

 When adding a new feature or modifying existing ones in Stirling-PDF, you'll need to add new translation entries to the existing language files. Here's a step-by-step guide:
@@ -594,4 +696,15 @@ pdfSplitter.input.pages=Enter page numbers to split

 Add these entries to the default GB language file and any others you wish, translating the values as appropriate for each language.

+### 3. Use Translations in Thymeleaf Templates
+
+In your Thymeleaf templates, use the `#{key}` syntax to reference the new translations:
+
+```html
+<h1 th:text="#{pdfSplitter.title}">PDF Splitter</h1>
+<p th:text="#{pdfSplitter.description}">Split your PDF into multiple documents</p>
+<input type="text" th:placeholder="#{pdfSplitter.input.pages}">
+<button th:text="#{pdfSplitter.button.split}">Split PDF</button>
+```
+
 Remember, never hard-code text in your templates or Java code. Always use translation keys to ensure proper localization.
@@ -1,444 +0,0 @@
-# File Sharing Feature - Architecture & Workflow
-
-## Overview
-
-The File Sharing feature enables users to store files server-side and share them with other registered users or via token-based share links. Files are stored using a pluggable storage provider (local filesystem or database) with optional quota enforcement.
-
-**Key Capabilities:**
- Server-side file storage (upload, update, download, delete)
- Optional history bundle and audit log attachments per file
- Direct user-to-user sharing with access roles
- Token-based share links (requires `system.frontendUrl`)
- Optional email notifications for shares (requires `mail.enabled`)
- Access audit trail (tracks who accessed a share link and how)
- Automatic share link expiration
- Storage quotas (per-user and total)
- Pluggable storage backend (local filesystem or database BLOB)
- Integration with the Shared Signing workflow
-
-## Architecture
-
-### Database Schema
-
-**`stored_files`**
- One record per uploaded file
- Stores file metadata (name, content type, size, storage key)
- Optionally links to a history bundle and audit log as separate stored objects
- `workflow_session_id` — nullable link to a `WorkflowSession` (signing feature)
- `file_purpose` — enum classifying the file's role: `GENERIC`, `SIGNING_ORIGINAL`, `SIGNING_SIGNED`, `SIGNING_HISTORY`
-
-**`file_shares`**
- One record per sharing relationship
- Two share types, distinguished by which fields are set:
-  - **User share**: `shared_with_user_id` is set, `share_token` is null
-  - **Link share**: `share_token` is set (UUID), `shared_with_user_id` is null
- `access_role` — `EDITOR`, `COMMENTER`, or `VIEWER`
- `expires_at` — nullable expiration for link shares
- `workflow_participant_id` — when set, marks this as a **workflow share** (hidden from the file manager, accessible only via workflow endpoints)
-
-**`file_share_accesses`**
- One record per access event on a share link
- Tracks: user, share link, access type (`VIEW` or `DOWNLOAD`), timestamp
-
-**`storage_cleanup_entries`**
- Queue of storage keys to be deleted asynchronously
- Used when a file is deleted but the physical storage object cleanup is deferred
-
-### Access Roles
-
-| Role | Can Read | Can Write |
-|------|----------|-----------|
-| `EDITOR` | ✅ | ✅ |
-| `COMMENTER` | ✅ | ❌ |
-| `VIEWER` | ✅ | ❌ |
-
-Default role when none is specified: `EDITOR`.
-
-Owners always have full access regardless of role.
-
-#### Role Semantics: COMMENTER vs VIEWER
-
-In the file storage layer, `COMMENTER` and `VIEWER` are equivalent — both grant read-only access and neither can replace file content. The distinction is meaningful in the **signing workflow** context:
-
-| Context | COMMENTER | VIEWER |
-|---------|-----------|--------|
-| File storage | Read only (same as VIEWER) | Read only |
-| Signing workflow | Can submit a signing action | Read only |
-
-`WorkflowParticipant.canEdit()` returns `true` for `COMMENTER` (and `EDITOR`) roles, which the signing workflow uses to determine if a participant can still submit a signature. Once a participant has signed or declined, their effective role is automatically downgraded to `VIEWER` regardless of their configured role.
-
-The rationale: "annotating" a document (submitting a signature) is not the same as "replacing" it. COMMENTER grants annotation rights without file-replacement rights.
-
-### Backend Architecture
-
-#### Service Layer
-
-**FileStorageService** (`1137 lines`)
- Core file management service
- Upload, update, download, and delete operations
- User share management (share, revoke, leave)
- Link share management (create, revoke, access)
- Access recording and listing
- Storage quota enforcement
- Configuration feature gate checks
-
-**StorageCleanupService**
- Scheduled daily: deletes orphaned storage keys from `storage_cleanup_entries`
- Scheduled daily: purges expired share links from `file_shares`
- Processes cleanup in batches of 50 entries
-
-#### Storage Providers
-
-**LocalStorageProvider**
- Files stored on the filesystem under `storage.local.basePath` (default: `./storage`)
- Storage key is a path relative to the base directory
-
-**DatabaseStorageProvider**
- Files stored as BLOBs in `stored_file_blobs` table
- No filesystem dependency
-
-Provider is selected at startup via `storage.provider: local | database`.
-
-#### Controller Layer
-
-**FileStorageController** (`/api/v1/storage`)
- All endpoints require authentication
- File CRUD and sharing operations
-
-### Data Flow
-
-```
-User uploads file → StorageProvider stores bytes → StoredFile record created
-       ↓
-Owner shares file → FileShare record created (user or link)
-       ↓
-Recipient accesses file → Access recorded → File bytes streamed
-```
-
-## File Operations
-
-### Upload File
-
-```bash
-POST /api/v1/storage/files
-Content-Type: multipart/form-data
-
-file: document.pdf                # Required — main file
-historyBundle: history.json       # Optional — version history
-auditLog: audit.json              # Optional — audit trail
-```
-
-**Response:**
-```json
-{
-  "id": 42,
-  "fileName": "document.pdf",
-  "contentType": "application/pdf",
-  "sizeBytes": 102400,
-  "owner": "alice",
-  "ownedByCurrentUser": true,
-  "accessRole": "editor",
-  "createdAt": "2025-01-01T12:00:00",
-  "updatedAt": "2025-01-01T12:00:00",
-  "sharedWithUsers": [],
-  "sharedUsers": [],
-  "shareLinks": []
-}
-```
-
-### Update File
-
-Replaces the file content. Only the owner can update.
-
-```bash
-PUT /api/v1/storage/files/{fileId}
-Content-Type: multipart/form-data
-
-file: document_v2.pdf
-historyBundle: history.json       # Optional
-auditLog: audit.json              # Optional
-```
-
-### List Files
-
-Returns all files owned by or shared with the current user. Workflow-shared files (signing participants) are excluded — those are accessible via signing endpoints only.
-
-```bash
-GET /api/v1/storage/files
-```
-
-Response is sorted by `createdAt` descending.
-
-### Download File
-
-```bash
-GET /api/v1/storage/files/{fileId}/download?inline=false
-```
-
- `inline=false` (default) — `Content-Disposition: attachment`
- `inline=true` — `Content-Disposition: inline` (for browser preview)
-
-### Delete File
-
-Only the owner can delete. All associated share links and their access records are deleted first, then the database record, then the physical storage object.
-
-```bash
-DELETE /api/v1/storage/files/{fileId}
-```
-
-## Sharing Operations
-
-### Share with User
-
-```bash
-POST /api/v1/storage/files/{fileId}/shares/users
-Content-Type: application/json
-
-{
-  "username": "bob",          # Username or email address
-  "accessRole": "editor"      # "editor", "commenter", or "viewer" (default: "editor")
-}
-```
-
-**Behaviour:**
- If the target user exists: creates/updates a `FileShare` with `sharedWithUser` set
- If `username` is an email address and the user doesn't exist: creates a share link and sends a notification email (requires `sharing.emailEnabled` and `sharing.linkEnabled`)
- If the target user is the owner: returns 400
- If sharing is disabled: returns 403
-
-### Revoke User Share
-
-Only the owner can revoke.
-
-```bash
-DELETE /api/v1/storage/files/{fileId}/shares/users/{username}
-```
-
-### Leave Shared File
-
-The recipient removes themselves from a shared file.
-
-```bash
-DELETE /api/v1/storage/files/{fileId}/shares/self
-```
-
-### Create Share Link
-
-Creates a token-based link for anonymous/authenticated access. Requires `sharing.linkEnabled` and `system.frontendUrl` to be configured.
-
-```bash
-POST /api/v1/storage/files/{fileId}/shares/links
-Content-Type: application/json
-
-{
-  "accessRole": "viewer"      # Optional (default: "editor")
-}
-```
-
-**Response:**
-```json
-{
-  "token": "550e8400-e29b-41d4-a716-446655440000",
-  "accessRole": "viewer",
-  "createdAt": "2025-01-01T12:00:00",
-  "expiresAt": "2025-01-04T12:00:00"
-}
-```
-
-Expiration is set to `now + sharing.linkExpirationDays` (default: 3 days).
-
-### Revoke Share Link
-
-```bash
-DELETE /api/v1/storage/files/{fileId}/shares/links/{token}
-```
-
-Also deletes all access records for that token.
-
-## Share Link Access
-
-### Download via Share Link
-
-Authentication is required (even for share links). Anonymous access is not permitted.
-
-```bash
-GET /api/v1/storage/share-links/{token}?inline=false
-```
-
- Returns 401 if unauthenticated
- Returns 403 if authenticated but link doesn't permit access
- Returns 410 if the link has expired
- Records a `FileShareAccess` entry on success
-
-> **Token-as-credential semantics:** Any authenticated user who holds the token can access the file — the token is the credential. If you need per-user access control (only a specific person can open it), use "Share with User" instead. Share links are appropriate for broader distribution where possession of the token implies authorization.
-
-### Get Share Link Metadata
-
-```bash
-GET /api/v1/storage/share-links/{token}/metadata
-```
-
-Returns file name, owner, access role, creation/expiry timestamps, and whether the current user owns the file.
-
-### List Accessed Share Links
-
-Returns the most recent access for each non-expired share link the current user has accessed.
-
-```bash
-GET /api/v1/storage/share-links/accessed
-```
-
-### List Accesses for a Link (Owner Only)
-
-```bash
-GET /api/v1/storage/files/{fileId}/shares/links/{token}/accesses
-```
-
-Returns per-user access history (username, VIEW/DOWNLOAD, timestamp), sorted descending by time.
-
-## Workflow Share Integration
-
-Signing workflow participants access documents via their own `WorkflowParticipant.shareToken`. No `FileShare` record is created for participants; access control is self-contained in the `WorkflowParticipant` entity.
-
-The `FileShare.workflow_participant_id` column and the `FileShare.isWorkflowShare()` method are **deprecated**. Legacy data (sessions created before this change) may still have `FileShare` records with `workflow_participant_id` set, which continue to work via the existing token lookup path in `UnifiedAccessControlService`. No new records are created.
-
-`GET /api/v1/storage/files` returns all files owned by or shared with the current user (via `FileShare`). Signing-session PDFs use the `file_purpose` field (`SIGNING_ORIGINAL`, `SIGNING_SIGNED`, etc.) to distinguish them from generic files. The file manager UI can filter on this field if needed.
-
-## API Reference
-
-| Method | Endpoint | Description | Auth |
-|--------|----------|-------------|------|
-| POST | `/api/v1/storage/files` | Upload file | Required |
-| PUT | `/api/v1/storage/files/{id}` | Update file | Required (owner) |
-| GET | `/api/v1/storage/files` | List accessible files | Required |
-| GET | `/api/v1/storage/files/{id}` | Get file metadata | Required |
-| GET | `/api/v1/storage/files/{id}/download` | Download file | Required |
-| DELETE | `/api/v1/storage/files/{id}` | Delete file | Required (owner) |
-| POST | `/api/v1/storage/files/{id}/shares/users` | Share with user | Required (owner) |
-| DELETE | `/api/v1/storage/files/{id}/shares/users/{username}` | Revoke user share | Required (owner) |
-| DELETE | `/api/v1/storage/files/{id}/shares/self` | Leave shared file | Required |
-| POST | `/api/v1/storage/files/{id}/shares/links` | Create share link | Required (owner) |
-| DELETE | `/api/v1/storage/files/{id}/shares/links/{token}` | Revoke share link | Required (owner) |
-| GET | `/api/v1/storage/share-links/{token}` | Download via share link | Required |
-| GET | `/api/v1/storage/share-links/{token}/metadata` | Get share link metadata | Required |
-| GET | `/api/v1/storage/share-links/accessed` | List accessed share links | Required |
-| GET | `/api/v1/storage/files/{id}/shares/links/{token}/accesses` | List share accesses | Required (owner) |
-
-## Configuration
-
-All storage settings live under the `storage:` key in `settings.yml`:
-
-```yaml
-storage:
-  enabled: true                  # Requires security.enableLogin = true
-  provider: local                # 'local' or 'database'
-  local:
-    basePath: './storage'        # Filesystem base directory (local provider only)
-  quotas:
-    maxStorageMbPerUser: -1      # Per-user storage cap in MB; -1 = unlimited
-    maxStorageMbTotal: -1        # Total storage cap in MB; -1 = unlimited
-    maxFileMb: -1                # Max size per upload (main + history + audit) in MB; -1 = unlimited
-  sharing:
-    enabled: false               # Master switch for all sharing (opt-in)
-    linkEnabled: false           # Enable token-based share links (requires system.frontendUrl)
-    emailEnabled: false          # Enable email notifications (requires mail.enabled)
-    linkExpirationDays: 3        # Days until share links expire
-```
-
-**Prerequisites:**
- `storage.enabled` requires `security.enableLogin = true`
- `sharing.linkEnabled` requires `system.frontendUrl` to be set (used to build share link URLs)
- `sharing.emailEnabled` requires `mail.enabled = true`
-
-## Security Considerations
-
-### Access Control
- All endpoints require authentication — there is no anonymous access
- Owner-only operations enforced in service layer (not just controller)
- `requireReadAccess` / `requireEditorAccess` checked on every download
-
-### Share Link Security
- Tokens are UUIDs (random, not guessable)
- Expiration enforced on every access
- Expired links return HTTP 410 Gone
- Revoked links delete all access records
-
-### Quota Enforcement
- Checked before storing (not after)
- Accounts for existing file size when replacing (only the delta counts)
- Covers main file + history bundle + audit log in a single check
-
-## Automatic Cleanup
-
-`StorageCleanupService` runs two scheduled jobs daily:
-
-1. **Orphaned storage cleanup** — processes up to 50 `StorageCleanupEntry` records, deletes the physical storage object, then removes the entry. Failed attempts increment `attemptCount` for retry.
-
-2. **Expired share link cleanup** — deletes all `FileShare` records where `expiresAt` is in the past and `shareToken` is set.
-
-## Troubleshooting
-
-**"Storage is disabled":**
- Check `storage.enabled: true` in settings
- Verify `security.enableLogin: true`
-
-**"Share links are disabled":**
- Check `sharing.linkEnabled: true`
- Verify `system.frontendUrl` is set and non-empty
-
-**"Email sharing is disabled":**
- Check `sharing.emailEnabled: true`
- Verify `mail.enabled: true` and mail configuration
-
-**Signing-session PDF appearing in the general file list:**
- This is expected — signing PDFs are accessible to owners and shared users
- Filter by `file_purpose` (`SIGNING_ORIGINAL`, `SIGNING_SIGNED`) in the UI to distinguish them
-
-**Share link returns 410:**
- Link has expired — check `expires_at` in `file_shares` table
- Owner must create a new link
-
-### Debug Queries
-
-```sql
-- List files and their share counts
-SELECT sf.stored_file_id, sf.original_filename, u.username as owner,
-       COUNT(DISTINCT fs.file_share_id) FILTER (WHERE fs.shared_with_user_id IS NOT NULL) as user_shares,
-       COUNT(DISTINCT fs.file_share_id) FILTER (WHERE fs.share_token IS NOT NULL) as link_shares
-FROM stored_files sf
-LEFT JOIN users u ON sf.owner_id = u.user_id
-LEFT JOIN file_shares fs ON fs.stored_file_id = sf.stored_file_id
-GROUP BY sf.stored_file_id, u.username;
-
-- Check share link expiration
-SELECT share_token, access_role, created_at, expires_at,
-       expires_at < NOW() as is_expired
-FROM file_shares
-WHERE share_token IS NOT NULL;
-
-- Check access history for a share link
-SELECT u.username, fsa.access_type, fsa.accessed_at
-FROM file_share_accesses fsa
-JOIN file_shares fs ON fsa.file_share_id = fs.file_share_id
-JOIN users u ON fsa.user_id = u.user_id
-WHERE fs.share_token = '{token}'
-ORDER BY fsa.accessed_at DESC;
-
-- Pending cleanup entries
-SELECT storage_key, attempt_count, updated_at
-FROM storage_cleanup_entries
-ORDER BY updated_at ASC;
-```
-
-## Summary
-
-The File Sharing feature provides:
- ✅ Server-side file storage with pluggable backend (local/database)
- ✅ History bundle and audit log attachments per file
- ✅ Direct user-to-user sharing with EDITOR/COMMENTER/VIEWER roles
- ✅ Token-based share links with expiration
- ✅ Optional email notifications for shares
- ✅ Per-access audit trail for share links
- ✅ Storage quotas (per-user, total, per-file)
- ✅ Automatic cleanup of expired links and orphaned storage
- ✅ Workflow integration (signing-session PDFs stored via same infrastructure; participant access via `WorkflowParticipant.shareToken`)
@@ -6,16 +6,10 @@ Portions of this software are licensed as follows:

 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "engine/" directory of this repository,
-if that directory exists, is licensed under the license defined in "engine/LICENSE".
 * All content that resides under the "frontend/src/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
 * All content that resides under the "frontend/src/desktop/" directory of this repository,
 if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
-* All content that resides under the "frontend/src/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
-* All content that resides under the "frontend/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.

@@ -60,7 +60,7 @@ For full installation options (including desktop and Kubernetes), see our [Docum

 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

-This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task install` to get started, or see the [Developer Guide](DeveloperGuide.md) for full details.
+For development setup, see the [Developer Guide](DeveloperGuide.md).

 For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).

@@ -1,691 +0,0 @@
-# Shared Signing Feature - Architecture & Workflow
-
-## Overview
-
-The Shared Signing feature enables collaborative document signing workflows where a document owner can request signatures from multiple participants. Each participant receives a secure token to access the document, submit their digital signature (with optional wet signature overlay), and track the signing progress.
-
-**Key Capabilities:**
- Multi-participant signing sessions
- Digital certificate signatures (P12/PKCS12, JKS, SERVER, USER_CERT, PEM/UPLOAD)
- Visual wet signature overlays (drawn, typed, or uploaded) — multiple per participant
- Token-based participant access (no authentication required for participants)
- Authenticated participant access for registered users via sign-requests API
- Progress tracking for session owners
- Optional signature summary page appended to finalized PDF
- Automatic role downgrade after signing (security)
- GDPR-compliant wet signature metadata cleanup
-
-## Architecture
-
-### Database Schema
-
-#### Core Tables
-
-**`workflow_sessions`**
- Tracks signing sessions created by document owners
- Links to original and processed (signed) PDF files
- Stores session metadata (message, due date, status)
-
-**`workflow_participants`**
- One record per participant per session
- Tracks participant status: PENDING → VIEWED → SIGNED/DECLINED
-  - `NOTIFIED` status is reserved for a future email notification feature; no current code path sets it
- Stores participant-specific metadata (certificates, wet signatures) as JSONB
- Each participant holds their own `shareToken` (UUID) for token-based access — no separate `FileShare` record is created
- `accessRole` controls what actions the participant can perform. `COMMENTER` (and `EDITOR`) allow submitting a signature; `VIEWER` does not. After signing/declining, effective role is automatically downgraded to `VIEWER`
-
-**`user_server_certificates`**
- Stores auto-generated certificates per user
- Enables "Use My Personal Certificate" option
-
-#### Extended Tables
-
-**`stored_files`**
- Added `workflow_session_id` to link files to signing sessions
- Added `file_purpose` enum (SIGNING_ORIGINAL, SIGNING_SIGNED, etc.)
-
-**`file_shares`**
- Regular file shares are created when the session owner shares the document with other users via the file manager
- The `workflow_participant_id` column is deprecated; participant access is self-contained in `WorkflowParticipant.shareToken`
-
-### Backend Architecture
-
-#### Service Layer
-
-**WorkflowSessionService** (`816 lines`)
- Core workflow management service
- Creates sessions with participants
- Handles participant status updates
- Stores signature metadata (certificates and wet signatures)
- Finalizes sessions by coordinating signing process
-
-Key responsibilities:
- Session lifecycle management (create, list, get details, delete)
- Participant management (add, remove, notify)
- Certificate submission storage
- Wet signature metadata storage
- Session finalization orchestration
-
-**UnifiedAccessControlService**
- Validates participant tokens
- Checks session status and expiration
- Maps participant status to effective access role
- Automatic role downgrade after signing: SIGNED/DECLINED → VIEWER role
-
-**UserServerCertificateService**
- Auto-generates personal certificates for users
- Manages certificate storage and retrieval
- Enables "Use My Personal Certificate" signing option
-
-#### Controller Layer
-
-**SigningSessionController** (Owner-facing + Authenticated participant endpoints)
- `POST /api/v1/security/cert-sign/sessions` - Create signing session
- `GET /api/v1/security/cert-sign/sessions` - List user's sessions
- `GET /api/v1/security/cert-sign/sessions/{id}` - Get session details
- `GET /api/v1/security/cert-sign/sessions/{id}/pdf` - Download original PDF
- `POST /api/v1/security/cert-sign/sessions/{id}/finalize` - Finalize and apply signatures
- `GET /api/v1/security/cert-sign/sessions/{id}/signed-pdf` - Download signed PDF
- `DELETE /api/v1/security/cert-sign/sessions/{id}` - Delete session
- `POST /api/v1/security/cert-sign/sessions/{id}/participants` - Add participants
- `DELETE /api/v1/security/cert-sign/sessions/{id}/participants/{participantId}` - Remove participant
- `GET /api/v1/security/cert-sign/sign-requests` - List sign requests for authenticated user
- `GET /api/v1/security/cert-sign/sign-requests/{id}` - Get sign request details
- `GET /api/v1/security/cert-sign/sign-requests/{id}/document` - Download document for signing
- `POST /api/v1/security/cert-sign/sign-requests/{id}/sign` - Sign document (authenticated)
- `POST /api/v1/security/cert-sign/sign-requests/{id}/decline` - Decline sign request (authenticated)
-
-**WorkflowParticipantController** (Participant-facing, token-based)
- `GET /api/v1/workflow/participant/session?token={token}` - View session details
- `GET /api/v1/workflow/participant/details?token={token}` - Get participant details
- `GET /api/v1/workflow/participant/document?token={token}` - Download PDF
- `POST /api/v1/workflow/participant/submit-signature` - Submit signature
- `POST /api/v1/workflow/participant/decline?token={token}` - Decline to sign
-
-#### Data Flow
-
-```
-Owner creates session → Participants receive tokens →
-Participants access via token (or authenticated) → Participants submit signatures →
-Owner finalizes → System applies signatures → [Optional: append summary page] → Signed PDF generated
-```
-
-### Frontend Architecture
-
-#### Quick Access Integration
-
-**SignPopout Component**
- Displays in Quick Access Bar (top navigation)
- Shows active and completed signing sessions
- Auto-refreshes every 15 seconds to show signature progress
- Badge indicator shows count of pending sessions
-
-**ActiveSessionsPanel**
- Lists sessions where user is owner or participant
- Shows signature progress: "X/Y signatures" (e.g., "2/5 signatures")
- Color-coded badges:
-  - Blue: No signatures yet (0/X)
-  - Yellow: Partial signatures (X/Y)
-  - Green: Ready to finalize (X/X)
-
-**CompletedSessionsPanel**
- Lists finalized sessions and declined sign requests
- Allows viewing/downloading signed PDFs
-
-#### Workbench Views
-
-**SignRequestWorkbenchView**
- Full-screen view for participants to sign documents
- Integrated PDF viewer with annotation support
- Certificate selection (Personal/Organization/Custom P12)
- Wet signature input (draw, type, or upload)
- Signature placement on PDF pages
-
-**SessionDetailWorkbenchView**
- Owner's view of session details
- Participant list with status indicators
- Ability to add/remove participants
- Finalize button when all signatures collected
- Download original/signed PDF
-
-#### State Management
-
-**FileContext Integration**
- Signing sessions operate within FileContext workflow
- PDFs loaded once, persist across tool switches
- Memory management for large files (up to 100GB+)
-
-**ToolWorkflowContext**
- Registers custom workbench views
- Manages navigation between viewer and signing tools
- Preserves file state during signing operations
-
-#### Services & Hooks
-
-**workflowService.ts**
- API client for all signing endpoints
- Handles session creation, listing, and management
- Participant operations (submit, decline)
-
-**useWorkflowSession.ts**
- React hook for owner session management
- State management for session list and details
-
-**useParticipantSession.ts**
- React hook for participant signing workflow
- Manages signature submission state
-
-## Signing Workflow Process
-
-### 1. Session Creation (Owner)
-
-```
-Owner → Uploads PDF → Selects participants → Creates session
-        ↓
-System creates:
-  - WorkflowSession record
-  - WorkflowParticipant records (one per participant, each with a unique shareToken)
-        ↓
-Participants receive token (via email or share link)
-```
-
-**API Call:**
-```bash
-POST /api/v1/security/cert-sign/sessions
-Content-Type: multipart/form-data
-
-file: document.pdf
-workflowType: SIGNING
-documentName: "contract.pdf"           # Optional display name
-participantUserIds: [1, 2, 3]          # Registered user IDs
-participantEmails: ["a@b.com"]         # External/unregistered users
-participants: [...]                    # Detailed participant configs (optional)
-message: "Please sign this contract"
-dueDate: "2025-12-31"
-ownerEmail: "owner@example.com"        # Optional, for notifications
-workflowMetadata: '{"showSignature": false, "showLogo": false, "includeSummaryPage": true}'
-```
-
-**Session-level `workflowMetadata` fields:**
-| Field | Type | Description |
-|-------|------|-------------|
-| `showSignature` | boolean | Show visible digital signature block on PDF |
-| `pageNumber` | integer | Page to place digital signature on |
-| `showLogo` | boolean | Show logo in digital signature block |
-| `includeSummaryPage` | boolean | Append a signature summary page before digital signing |
-
-**Response:**
-```json
-{
-  "sessionId": "uuid",
-  "documentName": "contract.pdf",
-  "participants": [
-    {
-      "userId": 1,
-      "email": "user1@example.com",
-      "shareToken": "token1",
-      "status": "PENDING"
-    }
-  ],
-  "participantCount": 3,
-  "signedCount": 0
-}
-```
-
-### 2. Participant Access
-
-```
-Participant → Clicks token link → Views session details
-        ↓
-Status changes: PENDING/NOTIFIED → VIEWED
-        ↓
-Participant downloads PDF to review
-```
-
-**Access URL (unauthenticated):**
-```
-https://app.example.com/sign?token={participant_token}
-```
-
-**Authenticated participants** can also use:
-```
-GET /api/v1/security/cert-sign/sign-requests
-GET /api/v1/security/cert-sign/sign-requests/{sessionId}
-GET /api/v1/security/cert-sign/sign-requests/{sessionId}/document
-```
-
-**Automatic Status Update:**
- First access: PENDING/NOTIFIED → VIEWED
- Downloads tracked but don't change status
-
-### 3. Signature Submission
-
-```
-Participant → Selects certificate type → Uploads certificate (if needed)
-           → Draws/uploads wet signatures (optional, multiple supported)
-           → Submits signature
-        ↓
-System stores:
-  - Certificate data (P12/JKS keystore as base64)
-  - Certificate password
-  - Wet signatures metadata (JSON array: base64 image + coordinates per signature)
-        ↓
-Status changes: VIEWED → SIGNED
-Access role: EDITOR → VIEWER (automatic downgrade)
-```
-
-**API Call (token-based, unauthenticated):**
-```bash
-POST /api/v1/workflow/participant/submit-signature
-Content-Type: multipart/form-data
-
-participantToken: {token}
-certType: P12 | JKS | SERVER | USER_CERT
-p12File: certificate.p12 (if certType=P12)
-jksFile: keystore.jks (if certType=JKS)
-password: cert_password
-showSignature: false
-pageNumber: 1
-location: "New York"
-reason: "I approve this contract"
-showLogo: false
-wetSignaturesData: '[{"page":0,"x":100,"y":200,"width":150,"height":50,"type":"IMAGE","data":"base64..."}]'
-```
-
-**API Call (authenticated users):**
-```bash
-POST /api/v1/security/cert-sign/sign-requests/{sessionId}/sign
-Content-Type: multipart/form-data
-
-certType: SERVER | USER_CERT | UPLOAD | PEM | PKCS12 | PFX | JKS
-p12File: certificate.p12 (if applicable)
-password: cert_password
-reason: "I approve this contract"
-location: "New York"
-wetSignaturesData: '[...]'
-```
-
-**Metadata Storage (JSONB):**
-```json
-{
-  "certificateSubmission": {
-    "certType": "P12",
-    "password": "cert_password",
-    "p12Keystore": "base64_encoded_keystore",
-    "showSignature": false,
-    "pageNumber": 1,
-    "location": "New York",
-    "reason": "I approve this contract",
-    "showLogo": false
-  },
-  "wetSignatures": [
-    {
-      "type": "IMAGE",
-      "data": "base64_image",
-      "page": 0,
-      "x": 100,
-      "y": 200,
-      "width": 150,
-      "height": 50
-    }
-  ]
-}
-```
-
-Note: Multiple wet signatures are supported per participant (array).
-
-### 4. Progress Tracking (Owner)
-
-```
-Owner → Views session list → Sees "2/5 signatures"
-      → Clicks session → Views participant status
-        ↓
-Participant list shows:
-  - user1@example.com: SIGNED ✓
-  - user2@example.com: SIGNED ✓
-  - user3@example.com: VIEWED (pending)
-  - user4@example.com: PENDING
-  - user5@example.com: DECLINED ✗
-        ↓
-Auto-refresh every 15 seconds
-```
-
-**Badge Colors:**
- 🔵 Blue: 0/5 signatures (awaiting)
- 🟡 Yellow: 2/5 signatures (partial)
- 🟢 Green: 5/5 signatures (ready to finalize)
-
-### 5. Session Finalization
-
-```
-Owner → Clicks "Finalize" → System processes signatures
-        ↓
-Processing steps:
-  1. Apply wet signatures to PDF (visual overlays)
-  1.5. Append signature summary page (if includeSummaryPage=true)
-  2. Apply digital certificates in participant order
-     - Visual signature block suppressed when summary page is enabled
-  3. Store signed PDF
-  4. Clear wet signature metadata (GDPR compliance)
-        ↓
-Owner downloads signed PDF
-```
-
-**Finalization Process:**
-
-1. **Apply Wet Signatures First**
-   ```java
-   for (WetSignature sig : wetSignatures) {
-     PDPage page = document.getPage(sig.getPage());
-     byte[] imageBytes = Base64.decode(sig.getData());
-     // Convert Y from top-left (UI) to bottom-left (PDF) coordinate system
-     float pdfY = page.getMediaBox().getHeight() - sig.getY() - sig.getHeight();
-     PDImageXObject image = PDImageXObject.createFromByteArray(document, imageBytes, "signature");
-     contentStream.drawImage(image, sig.getX(), pdfY, sig.getWidth(), sig.getHeight());
-   }
-   ```
-
-2. **Append Summary Page (optional, before digital signing)**
-
-   If `includeSummaryPage=true`, a new A4 page is appended showing:
-   - Stirling logo and "Signature Summary" title
-   - Document name and session owner
-   - Finalization timestamp
-   - Per-participant: name, email, status, signed timestamp, reason, location, certificate type
-   - Supports overflow to additional pages
-
-   This step occurs **before** digital certificate signing so signatures are not invalidated.
-   When a summary page is added, the visual digital signature block (`showSignature`) is suppressed — wet signatures (hand-drawn overlays) are unaffected.
-
-3. **Apply Digital Certificates (in participant order)**
-   ```java
-   for (Participant p : participants) {
-     if (p.status == SIGNED) {
-       KeyStore keystore = buildKeystore(p.certificate);
-       // Reason: participant override > owner default > "Document Signing"
-       // Location: participant-provided only (no default)
-       CertSignController.sign(pdfBytes, keystore, password, settings);
-     }
-   }
-   ```
-
-4. **Store and Cleanup**
-   ```java
-   StoredFile signedFile = storeFile(signedPdfBytes, SIGNING_SIGNED);
-   session.setProcessedFile(signedFile);
-   session.setFinalized(true);
-
-   // GDPR: Clear sensitive metadata after finalization
-   for (Participant p : participants) {
-     p.metadata.remove("wetSignatures");         // Clears wet signature image data
-     p.metadata.remove("certificateSubmission"); // Clears keystore bytes + password
-   }
-   ```
-
-**API Call:**
-```bash
-POST /api/v1/security/cert-sign/sessions/{sessionId}/finalize
-Authorization: Bearer {owner_token}
-```
-
-**Response:** Binary PDF file with Content-Disposition header
-
-## Key Technical Features
-
-### 1. Double JSON Encoding Fix (Recent)
-
-**Problem:** JSONB columns were storing JSON strings instead of JSON objects, requiring double-parsing.
-
-**Solution:** Created `JsonMapConverter` JPA AttributeConverter:
-```java
-@Convert(converter = JsonMapConverter.class)
-@Column(name = "participant_metadata", columnDefinition = "jsonb")
-private Map<String, Object> participantMetadata;
-```
-
-**Benefits:**
- Single parse on read
- Proper JSON storage in PostgreSQL
- Type-safe Map access
- Backward compatible with legacy data
-
-### 2. Signature Progress Display (Recent)
-
-**Implementation:**
- `WorkflowSessionResponse` includes `participantCount` and `signedCount`
- `WorkflowMapper` calculates counts when converting to DTO
- Frontend displays "X/Y signatures" in session list
- Auto-refresh every 15 seconds keeps counts updated
-
-### 3. Token-Based Security
-
-**No Authentication Required for Participants:**
- Participants access via secure token (UUID)
- Token linked to specific participant and session
- Automatic expiration support
- One-time signing (cannot sign twice)
-
-**Authenticated Participant Access:**
- Registered users can also access sign requests via `/api/v1/security/cert-sign/sign-requests`
- Standard Spring Security authentication required
- Supports additional cert types: UPLOAD, PEM, PKCS12, PFX
-
-**Automatic Role Downgrade:**
- After signing: EDITOR → VIEWER
- After declining: EDITOR → VIEWER
- Prevents modification after action taken
-
-### 4. Storage Integration
-
-**Unified with File Sharing:**
- All PDFs stored via `StorageProvider` (Database or Local)
- Respects storage quotas
- Supports files up to 100GB+ (with Local storage)
- Consistent with existing file sharing infrastructure
-
-### 5. Certificate Types
-
-**P12/PKCS12/PFX:** User uploads PKCS#12 file + password
-**JKS:** User uploads Java KeyStore + password
-**PEM/UPLOAD:** User uploads PEM certificate + private key
-**SERVER:** Uses organization's server certificate (no upload needed)
-**USER_CERT:** Uses user's auto-generated personal certificate (one-click)
-
-Note: UPLOAD, PEM, PKCS12, PFX are available on the authenticated (`sign-requests`) path. The token-based path uses P12, JKS, SERVER, USER_CERT.
-
-## Frontend Components Overview
-
-### Owner Workflow Components
-
-1. **CreateSessionPanel** - Form to create new signing session
-2. **ActiveSessionsPanel** - List of pending sessions with progress
-3. **SessionDetailWorkbenchView** - Full session management interface
-4. **CompletedSessionsPanel** - History of finalized sessions
-
-### Participant Workflow Components
-
-1. **SignRequestWorkbenchView** - Main signing interface
-2. **SignatureSettingsInput** - Certificate selection and configuration
-3. **WetSignatureInput** - Draw/type/upload signature overlay
-4. **SignatureSettingsDisplay** - Preview of signature settings
-
-### Shared Components
-
-1. **UserSelector** - Multi-select user picker for participants
-2. **LocalEmbedPDFWithAnnotations** - PDF viewer with signature placement
-
-## Configuration
-
-### Backend Configuration
-
-**application.properties:**
-```properties
-# Database (H2 or PostgreSQL)
-spring.jpa.hibernate.ddl-auto=update
-
-# Security
-DOCKER_ENABLE_SECURITY=true
-
-# Storage Provider (DATABASE or LOCAL)
-storage.provider=LOCAL
-storage.maxFileSize=100GB
-```
-
-### Frontend Configuration
-
-**Quick Access Bar:**
- Signing popout accessible from top navigation
- Auto-refresh interval: 15 seconds
- Badge shows pending session count
-
-## API Reference Summary
-
-### Owner Endpoints (Authenticated)
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| POST | `/api/v1/security/cert-sign/sessions` | Create session |
-| GET | `/api/v1/security/cert-sign/sessions` | List sessions |
-| GET | `/api/v1/security/cert-sign/sessions/{id}` | Get details |
-| POST | `/api/v1/security/cert-sign/sessions/{id}/finalize` | Finalize session |
-| GET | `/api/v1/security/cert-sign/sessions/{id}/pdf` | Download original |
-| GET | `/api/v1/security/cert-sign/sessions/{id}/signed-pdf` | Download signed |
-| DELETE | `/api/v1/security/cert-sign/sessions/{id}` | Delete session |
-| POST | `/api/v1/security/cert-sign/sessions/{id}/participants` | Add participants |
-| DELETE | `/api/v1/security/cert-sign/sessions/{id}/participants/{pid}` | Remove participant |
-
-### Authenticated Participant Endpoints
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| GET | `/api/v1/security/cert-sign/sign-requests` | List sign requests |
-| GET | `/api/v1/security/cert-sign/sign-requests/{id}` | Get sign request details |
-| GET | `/api/v1/security/cert-sign/sign-requests/{id}/document` | Download document |
-| POST | `/api/v1/security/cert-sign/sign-requests/{id}/sign` | Sign document |
-| POST | `/api/v1/security/cert-sign/sign-requests/{id}/decline` | Decline signing |
-
-### Token-Based Participant Endpoints (No Auth Required)
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| GET | `/api/v1/workflow/participant/session?token={token}` | View session |
-| GET | `/api/v1/workflow/participant/details?token={token}` | Get participant details |
-| GET | `/api/v1/workflow/participant/document?token={token}` | Download PDF |
-| POST | `/api/v1/workflow/participant/submit-signature` | Submit signature |
-| POST | `/api/v1/workflow/participant/decline?token={token}` | Decline signing |
-
-## Security Considerations
-
-### Data Protection
- Wet signature image data cleared after finalization (GDPR compliance)
- Certificate submission data (keystore bytes + password) cleared after finalization (GDPR compliance)
- Certificate passwords are not encrypted at rest while stored (TODO: encrypt at rest)
- Token expiration support
-
-### Access Control
- Owner authentication required for session management
- Participant access via secure UUID tokens (no auth) or standard auth (sign-requests)
- Automatic role downgrade prevents re-signing
- Session status checks prevent unauthorized actions
-
-### Audit Trail
- All participant actions tracked
- FileShare access logged
- Status transitions recorded
- Notification history maintained
-
-## Performance Characteristics
-
-### Scalability
- Supports PDFs up to 100GB+ (with Local storage provider)
- Memory-efficient streaming for large files
- IndexedDB caching on frontend
- Database indexes on session_id, share_token, workflow_session_id
-
-### Response Times
- Session creation: ~500ms (10MB file)
- Session listing: ~100ms
- Token validation: ~50ms
- Finalization: ~2s per MB of PDF (varies by certificate operations)
-
-## Future Enhancements
-
-### Planned Features
- Email notifications for participants
- Reminder system for pending signatures
- Bulk signing operations
- Template-based signing workflows
- Signature validation/verification UI
- Certificate password encryption at rest
- Certificate keystore cleanup after finalization (GDPR)
- Webhook support for external integrations
- Analytics dashboard for signing metrics
-
-### Additional Workflow Types
- **REVIEW** - Document review with comments
- **APPROVAL** - Multi-level approval chains
- **COLLABORATION** - Real-time collaborative editing
-
-## Troubleshooting
-
-### Common Issues
-
-**"Token invalid" error:**
- Check token exists in workflow_participants table
- Verify session is not finalized
- Check expiration date (expires_at)
-
-**Signature not appearing on PDF:**
- Verify certificate type is correct
- Check certificate password
- Review logs for signing errors
- Ensure PDFDocumentFactory is available
-
-**"Awaiting signatures" not updating:**
- Backend should return participantCount and signedCount
- Frontend auto-refresh every 15 seconds
- Check network tab for API errors
-
-**Wet signatures not visible after finalization:**
- Wet signatures are applied first as image overlays (Step 1)
- Check `wetSignaturesData` was sent as valid JSON array
- Verify page index is within document bounds
- Note: wet signatures survive regardless of `includeSummaryPage` setting
-
-### Debug Queries
-
-```sql
-- Check session status
-SELECT session_id, status, finalized,
-       (SELECT COUNT(*) FROM workflow_participants WHERE workflow_session_id = ws.id) as participant_count,
-       (SELECT COUNT(*) FROM workflow_participants WHERE workflow_session_id = ws.id AND status = 'SIGNED') as signed_count
-FROM workflow_sessions ws;
-
-- Check participant tokens
-SELECT email, status, share_token, expires_at
-FROM workflow_participants
-WHERE workflow_session_id = (SELECT id FROM workflow_sessions WHERE session_id = '{session_id}');
-
-- Check metadata storage
-SELECT email,
-       participant_metadata->'certificateSubmission'->>'certType' as cert_type,
-       jsonb_array_length(participant_metadata->'wetSignatures') as wet_sig_count
-FROM workflow_participants;
-```
-
-## Summary
-
-The Shared Signing feature provides a complete collaborative signing workflow with:
- ✅ Multi-participant support with progress tracking
- ✅ Multiple certificate types (P12/PKCS12/PFX, JKS, PEM, SERVER, USER_CERT)
- ✅ Visual wet signature overlays (multiple per participant)
- ✅ Token-based security for unauthenticated participants
- ✅ Authenticated participant access via sign-requests API
- ✅ Automatic role management
- ✅ Large file support (100GB+)
- ✅ GDPR-compliant wet signature metadata cleanup
- ✅ Real-time progress updates
- ✅ Full frontend integration with Quick Access Bar
- ✅ Optional signature summary page with logo and participant details
-
-The architecture leverages existing file sharing infrastructure while adding workflow-specific features, ensuring consistency and maintainability across the application.
@@ -1,128 +0,0 @@
-version: '3'
-
-output: prefixed
-
-includes:
-  backend:
-    taskfile: .taskfiles/backend.yml
-    dir: .
-  frontend:
-    taskfile: .taskfiles/frontend.yml
-    dir: frontend
-  engine:
-    taskfile: .taskfiles/engine.yml
-    dir: engine
-  docker:
-    taskfile: .taskfiles/docker.yml
-    dir: .
-  desktop:
-    taskfile: .taskfiles/desktop.yml
-    dir: frontend
-
-tasks:
-  # ============================================================
-  # Setup & Prerequisites
-  # ============================================================
-
-  install:
-    desc: "Install all project dependencies"
-    cmds:
-      - task: frontend:install
-      - task: engine:install
-
-  # ============================================================
-  # Development
-  # ============================================================
-
-  dev:
-    desc: "Start backend + frontend concurrently"
-    deps:
-      - backend:dev
-      - frontend:dev
-
-  dev:all:
-    desc: "Start backend + frontend + engine concurrently"
-    deps:
-      - backend:dev
-      - frontend:dev:prototypes
-      - engine:dev
-
-  # ============================================================
-  # Build
-  # ============================================================
-
-  build:
-    desc: "Build all components"
-    cmds:
-      - task: backend:build
-      - task: frontend:build
-
-  # ============================================================
-  # Test
-  # ============================================================
-
-  test:
-    desc: "Run ALL tests (backend + frontend + engine)"
-    cmds:
-      - task: backend:test
-      - task: frontend:test
-      - task: engine:test
-
-  # ============================================================
-  # Lint & Format
-  # ============================================================
-
-  lint:
-    desc: "Run all linters"
-    cmds:
-      - task: frontend:lint
-      - task: engine:lint
-
-  fix:
-    desc: "Auto-fix all components"
-    cmds:
-      - task: backend:fix
-      - task: frontend:fix
-      - task: engine:fix
-
-  format:
-    desc: "Auto-fix formatting across all components"
-    cmds:
-      - task: backend:format
-      - task: frontend:format
-      - task: engine:format
-
-  format:check:
-    desc: "Check formatting across all components"
-    cmds:
-      - task: backend:format:check
-      - task: frontend:format:check
-      - task: engine:format:check
-
-  # ============================================================
-  # Quality Gate
-  # ============================================================
-
-  check:
-    desc: "Quick quality gate for local development"
-    cmds:
-      - task: backend:check
-      - task: frontend:check
-      - task: engine:check
-
-  check:all:
-    desc: "Full CI quality gate"
-    cmds:
-      - task: backend:check
-      - task: frontend:check:all
-      - task: engine:check
-
-  # ============================================================
-  # Clean
-  # ============================================================
-
-  clean:
-    desc: "Clean all build artifacts"
-    cmds:
-      - task: backend:clean
-      - task: engine:clean
@@ -96,22 +96,6 @@
      "moduleName": ".*",
      "moduleLicense": "MPL 2.0"
    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "Mozilla Public License, Version 2.0"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "Mozilla Public License 2.0 (MPL-2.0)"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": 	"CDDL+GPL License"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "BSD"
-    },
    {
      "moduleName": ".*",
      "moduleLicense": "UnboundID SCIM2 SDK Free Use License"
@@ -5,12 +5,10 @@ bootRun {
 spotless {
    java {
        target 'src/**/java/**/*.java'
-        targetExclude 'src/main/java/org/apache/**'
        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
-        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
-        suppressLintsFor { setStep('google-java-format') }

        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
+        toggleOffOn()
        trimTrailingWhitespace()
        leadingTabsToSpaces()
        endWithNewline()
@@ -29,26 +27,22 @@ spotless {
    }
 }
 dependencies {
-    api 'com.google.guava:guava:33.5.0-jre'
-    api 'org.springframework.boot:spring-boot-starter-webmvc'
-    api 'org.springframework.boot:spring-boot-starter-aspectj'
-    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
+    api 'org.springframework.boot:spring-boot-starter-web'
+    api 'org.springframework.boot:spring-boot-starter-aop'
+    // api 'org.springframework.boot:spring-boot-starter-thymeleaf' // Deprecated - UI moved to React frontend
+    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
    api 'com.fathzer:javaluator:3.0.6'
    api 'com.posthog.java:posthog:1.2.0'
-    api 'org.apache.commons:commons-lang3:3.20.0'
+    api 'org.apache.commons:commons-lang3:3.19.0'
    api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
    api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
    api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
-    api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
    api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.8' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.5' // RAR archive support for CBR files
    api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
-    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.2"
-    // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
-    api 'org.simplejavamail:simple-java-mail:8.12.6'
-    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
+    api 'org.snakeyaml:snakeyaml-engine:2.10'
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.13"
    api 'jakarta.mail:jakarta.mail-api:2.1.5'
    runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
 }
@@ -103,9 +103,8 @@ public class EndpointConfiguration {

        // Rule 2: Functional-group override - check if endpoint belongs to any disabled functional
        // group
-        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
-            String group = entry.getKey();
-            if (disabledGroups.contains(group) && entry.getValue().contains(endpoint)) {
+        for (String group : endpointGroups.keySet()) {
+            if (disabledGroups.contains(group) && endpointGroups.get(group).contains(endpoint)) {
                // Skip tool groups (qpdf, OCRmyPDF, Ghostscript, LibreOffice, etc.)
                if (!isToolGroup(group)) {
                    log.debug(
@@ -132,11 +131,10 @@ public class EndpointConfiguration {

        // Rule 4: Single-dependency check - if no alternatives defined, check if endpoint belongs
        // to any disabled tool groups
-        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
-            String group = entry.getKey();
+        for (String group : endpointGroups.keySet()) {
            if (isToolGroup(group)
                    && disabledGroups.contains(group)
-                    && entry.getValue().contains(endpoint)) {
+                    && endpointGroups.get(group).contains(endpoint)) {
                log.debug(
                        "isEndpointEnabled('{}') -> false (single tool group '{}' disabled, no alternatives)",
                        original,
@@ -158,19 +156,19 @@ public class EndpointConfiguration {
            return false;
        }

-        // Rule 2: For tool groups, they're enabled unless explicitly disabled (handled above)
-        if (isToolGroup(group)) {
-            log.debug("isGroupEnabled('{}') -> true (tool group not disabled)", group);
-            return true;
-        }
-
-        // Rule 3: For functional groups, check if all endpoints are enabled
        Set<String> endpoints = endpointGroups.get(group);
        if (endpoints == null || endpoints.isEmpty()) {
            log.debug("isGroupEnabled('{}') -> false (no endpoints)", group);
            return false;
        }

+        // Rule 2: For functional groups, check if all endpoints are enabled
+        // Rule 3: For tool groups, they're enabled unless explicitly disabled (handled above)
+        if (isToolGroup(group)) {
+            log.debug("isGroupEnabled('{}') -> true (tool group not disabled)", group);
+            return true;
+        }
+
        // For functional groups, check each endpoint individually
        for (String endpoint : endpoints) {
            if (!isEndpointEnabledDirectly(endpoint)) {
@@ -305,23 +303,22 @@ public class EndpointConfiguration {
        // Adding endpoints to "PageOps" group
        addEndpointToGroup("PageOps", "remove-pages");
        addEndpointToGroup("PageOps", "merge-pdfs");
-        addEndpointToGroup("PageOps", "split-pages");
-        addEndpointToGroup("PageOps", "rearrange-pages");
+        addEndpointToGroup("PageOps", "split-pdfs");
+        addEndpointToGroup("PageOps", "pdf-organizer");
        addEndpointToGroup("PageOps", "rotate-pdf");
        addEndpointToGroup("PageOps", "multi-page-layout");
        addEndpointToGroup("PageOps", "booklet-imposition");
        addEndpointToGroup("PageOps", "scale-pages");
        addEndpointToGroup("PageOps", "crop");
+        addEndpointToGroup("PageOps", "extract-page");
        addEndpointToGroup("PageOps", "pdf-to-single-page");
        addEndpointToGroup("PageOps", "auto-split-pdf");
        addEndpointToGroup("PageOps", "split-by-size-or-count");
        addEndpointToGroup("PageOps", "overlay-pdf");
        addEndpointToGroup("PageOps", "split-pdf-by-sections");
        addEndpointToGroup("PageOps", "split-pdf-by-chapters");
-        addEndpointToGroup("PageOps", "add-page-numbers");
-        addEndpointToGroup("PageOps", "extract-pages");

-        // Adding endpoints to "Convert" group (Frontend has 15 convert endpoints)
+        // Adding endpoints to "Convert" group
        addEndpointToGroup("Convert", "pdf-to-img");
        addEndpointToGroup("Convert", "img-to-pdf");
        addEndpointToGroup("Convert", "pdf-to-pdfa");
@@ -337,16 +334,10 @@ public class EndpointConfiguration {
        addEndpointToGroup("Convert", "pdf-to-csv");
        addEndpointToGroup("Convert", "pdf-to-markdown");
        addEndpointToGroup("Convert", "eml-to-pdf");
-        addEndpointToGroup("Convert", "pdf-to-epub");
-        // Backend-only endpoints (not in frontend tool registry)
-        addEndpointToGroup("Convert", "pdf-to-vector");
-        addEndpointToGroup("Convert", "vector-to-pdf");
-        addEndpointToGroup("Convert", "pdf-to-video");
        addEndpointToGroup("Convert", "cbz-to-pdf");
        addEndpointToGroup("Convert", "pdf-to-cbz");
        addEndpointToGroup("Convert", "pdf-to-json");
        addEndpointToGroup("Convert", "json-to-pdf");
-        addEndpointToGroup("Convert", "pdf-to-rtf");

        // Adding endpoints to "Security" group
        addEndpointToGroup("Security", "add-password");
@@ -356,61 +347,51 @@ public class EndpointConfiguration {
        addEndpointToGroup("Security", "cert-sign");
        addEndpointToGroup("Security", "remove-cert-sign");
        addEndpointToGroup("Security", "sanitize-pdf");
-        addEndpointToGroup("Security", "timestamp-pdf");
        addEndpointToGroup("Security", "auto-redact");
-        addEndpointToGroup("Security", "validate-signature");
-        addEndpointToGroup("Security", "add-stamp");
-        addEndpointToGroup("Security", "unlock-pdf-forms");
-        // Backend-only endpoints (not in frontend tool registry endpoints)
        addEndpointToGroup("Security", "redact");
-        addEndpointToGroup("Security", "verify-pdf");
+        addEndpointToGroup("Security", "validate-signature");
+        addEndpointToGroup("Security", "stamp");
        addEndpointToGroup("Security", "sign");

        // Adding endpoints to "Other" group
        addEndpointToGroup("Other", "ocr-pdf");
+        addEndpointToGroup("Other", "add-image");
        addEndpointToGroup("Other", "extract-images");
-        addEndpointToGroup("Other", "update-metadata");
+        addEndpointToGroup("Other", "change-metadata");
        addEndpointToGroup("Other", "flatten");
+        addEndpointToGroup("Other", "unlock-pdf-forms");
        addEndpointToGroup("Other", REMOVE_BLANKS);
        addEndpointToGroup("Other", "remove-annotations");
-        addEndpointToGroup("Other", "get-info-on-pdf");
-        addEndpointToGroup("Other", "add-attachments");
-        addEndpointToGroup("Other", "replace-invert-pdf");
-        addEndpointToGroup("Other", "edit-table-of-contents");
-        addEndpointToGroup("Other", "text-editor-pdf");
-        // Backend-only endpoints (not in frontend tool registry endpoints)
-        addEndpointToGroup("Other", "add-image");
        addEndpointToGroup("Other", "compare");
+        addEndpointToGroup("Other", "add-page-numbers");
+        addEndpointToGroup("Other", "get-info-on-pdf");
+        addEndpointToGroup("Other", "remove-image-pdf");
+        addEndpointToGroup("Other", "add-attachments");
        addEndpointToGroup("Other", "view-pdf");
+        addEndpointToGroup("Other", "replace-and-invert-color-pdf");
        addEndpointToGroup("Other", "multi-tool");
+
+        // Adding form-related endpoints to "Other" group
        addEndpointToGroup("Other", "fields");
        addEndpointToGroup("Other", "modify-fields");
        addEndpointToGroup("Other", "delete-fields");
        addEndpointToGroup("Other", "fill");

        // Adding endpoints to "Advance" group
+        addEndpointToGroup("Advance", "adjust-contrast");
        addEndpointToGroup("Advance", "compress-pdf");
        addEndpointToGroup("Advance", "extract-image-scans");
        addEndpointToGroup("Advance", "repair");
        addEndpointToGroup("Advance", "auto-rename");
+        addEndpointToGroup("Advance", "pipeline");
        addEndpointToGroup("Advance", "scanner-effect");
+        addEndpointToGroup("Advance", "auto-split-pdf");
+        addEndpointToGroup("Advance", "show-javascript");
+        addEndpointToGroup("Advance", "split-by-size-or-count");
        addEndpointToGroup("Advance", "overlay-pdf");
-        // Backend-only endpoints
-        addEndpointToGroup("Advance", "adjust-contrast");
-
-        // Adding endpoints to "Automation" group
-        addEndpointToGroup("Automation", "handleData");
-        addEndpointToGroup("Automation", "automate"); // Alias for handleData (user-friendly name)
-        addEndpointToGroup("Automation", "pipeline");
-
-        // Adding endpoints to "DeveloperTools" group
-        addEndpointToGroup("DeveloperTools", "show-javascript");
-
-        // Adding endpoints to "DeveloperDocs" group (fake endpoints for link-only tools)
-        addEndpointToGroup("DeveloperDocs", "dev-api-docs");
-        addEndpointToGroup("DeveloperDocs", "dev-folder-scanning-docs");
-        addEndpointToGroup("DeveloperDocs", "dev-sso-guide-docs");
-        addEndpointToGroup("DeveloperDocs", "dev-airgapped-docs");
+        addEndpointToGroup("Advance", "split-pdf-by-sections");
+        addEndpointToGroup("Advance", "edit-table-of-contents");
+        addEndpointToGroup("Advance", "split-pdf-by-chapters");

        // CLI
        addEndpointToGroup("CLI", "compress-pdf");
@@ -451,8 +432,8 @@ public class EndpointConfiguration {
        // Java
        addEndpointToGroup("Java", "merge-pdfs");
        addEndpointToGroup("Java", "remove-pages");
-        addEndpointToGroup("Java", "split-pages");
-        addEndpointToGroup("Java", "rearrange-pages");
+        addEndpointToGroup("Java", "split-pdfs");
+        addEndpointToGroup("Java", "pdf-organizer");
        addEndpointToGroup("Java", "rotate-pdf");
        addEndpointToGroup("Java", "pdf-to-img");
        addEndpointToGroup("Java", "img-to-pdf");
@@ -460,10 +441,9 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "remove-password");
        addEndpointToGroup("Java", "change-permissions");
        addEndpointToGroup("Java", "add-watermark");
-        addEndpointToGroup("Java", "add-stamp");
        addEndpointToGroup("Java", "add-image");
        addEndpointToGroup("Java", "extract-images");
-        addEndpointToGroup("Java", "update-metadata");
+        addEndpointToGroup("Java", "change-metadata");
        addEndpointToGroup("Java", "cert-sign");
        addEndpointToGroup("Java", "remove-cert-sign");
        addEndpointToGroup("Java", "multi-page-layout");
@@ -473,9 +453,9 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "auto-rename");
        addEndpointToGroup("Java", "auto-split-pdf");
        addEndpointToGroup("Java", "sanitize-pdf");
-        addEndpointToGroup("Java", "timestamp-pdf");
        addEndpointToGroup("Java", "crop");
        addEndpointToGroup("Java", "get-info-on-pdf");
+        addEndpointToGroup("Java", "extract-page");
        addEndpointToGroup("Java", "pdf-to-single-page");
        addEndpointToGroup("Java", "markdown-to-pdf");
        addEndpointToGroup("Java", "show-javascript");
@@ -485,10 +465,9 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "split-by-size-or-count");
        addEndpointToGroup("Java", "overlay-pdf");
        addEndpointToGroup("Java", "split-pdf-by-sections");
-        addEndpointToGroup("Java", "split-pdf-by-chapters");
        addEndpointToGroup("Java", REMOVE_BLANKS);
-        addEndpointToGroup("Java", "remove-annotations");
        addEndpointToGroup("Java", "pdf-to-text");
+        addEndpointToGroup("Java", "remove-image-pdf");
        addEndpointToGroup("Java", "pdf-to-markdown");
        addEndpointToGroup("Java", "add-attachments");
        addEndpointToGroup("Java", "compress-pdf");
@@ -496,24 +475,13 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "pdf-to-cbz");
        addEndpointToGroup("Java", "pdf-to-json");
        addEndpointToGroup("Java", "json-to-pdf");
-        addEndpointToGroup("Java", "pdf-to-video");
-        addEndpointToGroup("Java", "verify-pdf");
-        addEndpointToGroup("Java", "flatten");
-        addEndpointToGroup("Java", "unlock-pdf-forms");
-        addEndpointToGroup("Java", "validate-signature");
-        addEndpointToGroup("Java", "text-editor-pdf");
-        addEndpointToGroup("Java", "edit-table-of-contents");
-        addEndpointToGroup("Java", "pdf-to-epub");
-        addEndpointToGroup("Java", "eml-to-pdf");
-        addEndpointToGroup("Java", "handleData");
        addEndpointToGroup("rar", "pdf-to-cbr");

        // Javascript
-        addEndpointToGroup("Javascript", "rearrange-pages");
+        addEndpointToGroup("Javascript", "pdf-organizer");
        addEndpointToGroup("Javascript", "sign");
        addEndpointToGroup("Javascript", "compare");
        addEndpointToGroup("Javascript", "adjust-contrast");
-        addEndpointToGroup("Javascript", "text-editor-pdf");

        /* qpdf */
        addEndpointToGroup("qpdf", "repair");
@@ -522,11 +490,6 @@ public class EndpointConfiguration {
        /* Ghostscript */
        addEndpointToGroup("Ghostscript", "repair");
        addEndpointToGroup("Ghostscript", "compress-pdf");
-        addEndpointToGroup("Ghostscript", "crop");
-        addEndpointToGroup("Ghostscript", "replace-invert-pdf");
-        addEndpointToGroup("Ghostscript", "scanner-effect");
-        addEndpointToGroup("Ghostscript", "pdf-to-vector");
-        addEndpointToGroup("Ghostscript", "vector-to-pdf");

        /* ImageMagick */
        addEndpointToGroup("ImageMagick", "compress-pdf");
@@ -543,8 +506,6 @@ public class EndpointConfiguration {
        addEndpointAlternative("compress-pdf", "qpdf");
        addEndpointAlternative("compress-pdf", "Ghostscript");
        addEndpointAlternative("compress-pdf", "Java");
-        addEndpointAlternative("crop", "Ghostscript");
-        addEndpointAlternative("crop", "Java");
        addEndpointAlternative("ocr-pdf", "tesseract");
        addEndpointAlternative("ocr-pdf", "OCRmyPDF");

@@ -567,15 +528,9 @@ public class EndpointConfiguration {
        addEndpointToGroup("Weasyprint", "markdown-to-pdf");
        addEndpointToGroup("Weasyprint", "eml-to-pdf");

-        // veraPDF dependent endpoints
-        addEndpointToGroup("veraPDF", "verify-pdf");
-
        // Pdftohtml dependent endpoints
        addEndpointToGroup("Pdftohtml", "pdf-to-html");
        addEndpointToGroup("Pdftohtml", "pdf-to-markdown");
-
-        // Calibre dependent endpoints
-        addEndpointToGroup("Calibre", "pdf-to-epub");
    }

    private void processEnvironmentConfigs() {
@@ -599,7 +554,7 @@ public class EndpointConfiguration {
            disableGroup("enterprise");
        }

-        if (!applicationProperties.getSystem().isEnableUrlToPDF()) {
+        if (!applicationProperties.getSystem().getEnableUrlToPDF()) {
            disableEndpoint("url-to-pdf");
        }
    }
@@ -608,12 +563,6 @@ public class EndpointConfiguration {
        return endpointGroups.getOrDefault(group, new HashSet<>());
    }

-    public Set<String> getAllEndpoints() {
-        return endpointGroups.values().stream()
-                .flatMap(Set::stream)
-                .collect(java.util.stream.Collectors.toSet());
-    }
-
    private boolean isToolGroup(String group) {
        return "qpdf".equals(group)
                || "OCRmyPDF".equals(group)
@@ -629,10 +578,7 @@ public class EndpointConfiguration {
                || "Weasyprint".equals(group)
                || "Pdftohtml".equals(group)
                || "ImageMagick".equals(group)
-                || "rar".equals(group)
-                || "Calibre".equals(group)
-                || "FFmpeg".equals(group)
-                || "veraPDF".equals(group);
+                || "rar".equals(group);
    }

    private boolean isEndpointEnabledDirectly(String endpoint) {
@@ -647,9 +593,8 @@ public class EndpointConfiguration {
        }

        // Check if endpoint belongs to any disabled functional group
-        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
-            String group = entry.getKey();
-            if (disabledGroups.contains(group) && entry.getValue().contains(endpoint)) {
+        for (String group : endpointGroups.keySet()) {
+            if (disabledGroups.contains(group) && endpointGroups.get(group).contains(endpoint)) {
                if (!isToolGroup(group)) {
                    return false;
                }
@@ -2,14 +2,12 @@ package stirling.software.common.aop;

 import java.io.IOException;
 import java.time.Duration;
-import java.util.HashMap;
-import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.Supplier;

 import org.aspectj.lang.ProceedingJoinPoint;
 import org.aspectj.lang.annotation.*;
-import org.slf4j.MDC;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 import org.springframework.web.multipart.MultipartFile;
@@ -28,7 +26,7 @@ import stirling.software.common.service.JobExecutorService;
@Component
@RequiredArgsConstructor
@Slf4j
-@Order(20) // Lower precedence - executes AFTER audit aspects populate MDC
+@Order(0) // Highest precedence - executes before audit aspects
 public class AutoJobAspect {

    private static final Duration RETRY_BASE_DELAY = Duration.ofMillis(100);
@@ -39,7 +37,7 @@ public class AutoJobAspect {

    @Around("@annotation(autoJobPostMapping)")
    public Object wrapWithJobExecution(
-            ProceedingJoinPoint joinPoint, AutoJobPostMapping autoJobPostMapping) throws Exception {
+            ProceedingJoinPoint joinPoint, AutoJobPostMapping autoJobPostMapping) {
        // This aspect will run before any audit aspects due to @Order(0)
        // Extract parameters from the request and annotation
        boolean async = Boolean.parseBoolean(request.getParameter("async"));
@@ -72,29 +70,20 @@ public class AutoJobAspect {
            // No retries needed, simple execution
            return jobExecutorService.runJobGeneric(
                    async,
-                    wrapWithMDC(
-                            () -> {
-                                try {
-                                    // Note: Progress tracking is handled in
-                                    // TaskManager/JobExecutorService
-                                    // The trackProgress flag controls whether detailed progress is
-                                    // stored
-                                    // for REST API queries, not WebSocket notifications
-                                    return joinPoint.proceed(args);
-                                } catch (Throwable ex) {
-                                    log.error(
-                                            "AutoJobAspect caught exception during job execution: {}",
-                                            ex.getMessage(),
-                                            ex);
-                                    // Rethrow RuntimeException as-is to preserve exception type
-                                    if (ex instanceof RuntimeException) {
-                                        throw (RuntimeException) ex;
-                                    }
-                                    // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                                    // BaseAppException
-                                    throw new RuntimeException(ex);
-                                }
-                            }),
+                    () -> {
+                        try {
+                            // Note: Progress tracking is handled in TaskManager/JobExecutorService
+                            // The trackProgress flag controls whether detailed progress is stored
+                            // for REST API queries, not WebSocket notifications
+                            return joinPoint.proceed(args);
+                        } catch (Throwable ex) {
+                            log.error(
+                                    "AutoJobAspect caught exception during job execution: {}",
+                                    ex.getMessage(),
+                                    ex);
+                            throw new RuntimeException(ex);
+                        }
+                    },
                    timeout,
                    queueable,
                    resourceWeight);
@@ -120,116 +109,115 @@ public class AutoJobAspect {
            int maxRetries,
            boolean trackProgress,
            boolean queueable,
-            int resourceWeight)
-            throws Exception {
+            int resourceWeight) {

        // Keep jobId reference for progress tracking in TaskManager
        AtomicReference<String> jobIdRef = new AtomicReference<>();

        return jobExecutorService.runJobGeneric(
                async,
-                wrapWithMDC(
-                        () -> {
-                            // Use iterative approach instead of recursion to avoid stack overflow
-                            Throwable lastException = null;
+                () -> {
+                    // Use iterative approach instead of recursion to avoid stack overflow
+                    Throwable lastException = null;

-                            // Attempt counter starts at 1 for first try
-                            for (int currentAttempt = 1;
-                                    currentAttempt <= maxRetries;
-                                    currentAttempt++) {
-                                try {
-                                    if (trackProgress && async) {
-                                        // Get jobId for progress tracking in TaskManager
-                                        // This enables REST API progress queries, not WebSocket
-                                        if (jobIdRef.get() == null) {
-                                            jobIdRef.set(getJobIdFromContext());
-                                        }
-                                        String jobId = jobIdRef.get();
-                                        if (jobId != null) {
-                                            log.debug(
-                                                    "Tracking progress for job {} (attempt {}/{})",
-                                                    jobId,
-                                                    currentAttempt,
-                                                    maxRetries);
-                                            // Progress is tracked in TaskManager for REST API
-                                            // access
-                                            // No WebSocket notifications sent here
-                                        }
-                                    }
-
-                                    // Attempt to execute the operation
-                                    return joinPoint.proceed(args);
-
-                                } catch (Throwable ex) {
-                                    lastException = ex;
-                                    log.error(
-                                            "AutoJobAspect caught exception during job execution (attempt"
-                                                    + " {}/{}): {}",
+                    // Attempt counter starts at 1 for first try
+                    for (int currentAttempt = 1; currentAttempt <= maxRetries; currentAttempt++) {
+                        try {
+                            if (trackProgress && async) {
+                                // Get jobId for progress tracking in TaskManager
+                                // This enables REST API progress queries, not WebSocket
+                                if (jobIdRef.get() == null) {
+                                    jobIdRef.set(getJobIdFromContext());
+                                }
+                                String jobId = jobIdRef.get();
+                                if (jobId != null) {
+                                    log.debug(
+                                            "Tracking progress for job {} (attempt {}/{})",
+                                            jobId,
                                            currentAttempt,
-                                            maxRetries,
-                                            ex.getMessage(),
-                                            ex);
+                                            maxRetries);
+                                    // Progress is tracked in TaskManager for REST API access
+                                    // No WebSocket notifications sent here
+                                }
+                            }

-                                    // Check if we should retry
-                                    if (currentAttempt < maxRetries) {
-                                        log.info(
-                                                "Retrying operation, attempt {}/{}",
-                                                currentAttempt + 1,
-                                                maxRetries);
+                            // Attempt to execute the operation
+                            return joinPoint.proceed(args);

-                                        if (trackProgress && async) {
-                                            String jobId = jobIdRef.get();
-                                            if (jobId != null) {
-                                                log.debug(
-                                                        "Recording retry attempt for job {} in TaskManager",
-                                                        jobId);
-                                                // Retry info is tracked in TaskManager for REST API
-                                                // access
-                                            }
-                                        }
+                        } catch (Throwable ex) {
+                            lastException = ex;
+                            log.error(
+                                    "AutoJobAspect caught exception during job execution (attempt"
+                                            + " {}/{}): {}",
+                                    currentAttempt,
+                                    maxRetries,
+                                    ex.getMessage(),
+                                    ex);

-                                        // Use sleep for retry delay
-                                        // For sync jobs, both sleep and async are blocking at this
-                                        // point
-                                        // For async jobs, the delay occurs in the executor thread
-                                        long delayMs = RETRY_BASE_DELAY.toMillis() * currentAttempt;
+                            // Check if we should retry
+                            if (currentAttempt < maxRetries) {
+                                log.info(
+                                        "Retrying operation, attempt {}/{}",
+                                        currentAttempt + 1,
+                                        maxRetries);

-                                        try {
-                                            Thread.sleep(delayMs);
-                                        } catch (InterruptedException e) {
-                                            Thread.currentThread().interrupt();
-                                            log.debug(
-                                                    "Retry delay interrupted for attempt {}/{}",
-                                                    currentAttempt,
-                                                    maxRetries);
-                                            break;
-                                        }
-                                    } else {
-                                        // No more retries, we'll throw the exception after the loop
-                                        break;
+                                if (trackProgress && async) {
+                                    String jobId = jobIdRef.get();
+                                    if (jobId != null) {
+                                        log.debug(
+                                                "Recording retry attempt for job {} in TaskManager",
+                                                jobId);
+                                        // Retry info is tracked in TaskManager for REST API access
                                    }
                                }
-                            }

-                            // If we get here, all retries failed
-                            if (lastException != null) {
-                                // Rethrow RuntimeException as-is to preserve exception type
-                                if (lastException instanceof RuntimeException) {
-                                    throw (RuntimeException) lastException;
+                                // Use non-blocking delay for all retry attempts to avoid blocking
+                                // threads
+                                // For sync jobs this avoids starving the tomcat thread pool under
+                                // load
+                                long delayMs = RETRY_BASE_DELAY.toMillis() * currentAttempt;
+
+                                // Execute the retry after a delay through the JobExecutorService
+                                // rather than blocking the current thread with sleep
+                                CompletableFuture<Object> delayedRetry = new CompletableFuture<>();
+
+                                // Use a delayed executor for non-blocking delay
+                                CompletableFuture.delayedExecutor(delayMs, TimeUnit.MILLISECONDS)
+                                        .execute(
+                                                () -> {
+                                                    // Continue the retry loop in the next iteration
+                                                    // We can't return from here directly since
+                                                    // we're in a Runnable
+                                                    delayedRetry.complete(null);
+                                                });
+
+                                // Wait for the delay to complete before continuing
+                                try {
+                                    delayedRetry.join();
+                                } catch (Exception e) {
+                                    Thread.currentThread().interrupt();
+                                    break;
                                }
-                                // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                                // BaseAppException
-                                throw new RuntimeException(
-                                        "Job failed after "
-                                                + maxRetries
-                                                + " attempts: "
-                                                + lastException.getMessage(),
-                                        lastException);
+                            } else {
+                                // No more retries, we'll throw the exception after the loop
+                                break;
                            }
+                        }
+                    }

-                            // This should never happen if lastException is properly tracked
-                            throw new RuntimeException("Job failed but no exception was recorded");
-                        }),
+                    // If we get here, all retries failed
+                    if (lastException != null) {
+                        throw new RuntimeException(
+                                "Job failed after "
+                                        + maxRetries
+                                        + " attempts: "
+                                        + lastException.getMessage(),
+                                lastException);
+                    }
+
+                    // This should never happen if lastException is properly tracked
+                    throw new RuntimeException("Job failed but no exception was recorded");
+                },
                timeout,
                queueable,
                resourceWeight);
@@ -298,32 +286,4 @@ public class AutoJobAspect {
            return null;
        }
    }
-
-    /**
-     * Wraps a supplier to propagate MDC context to background threads. Captures MDC on request
-     * thread and restores it in the background thread. Ensures proper cleanup to prevent context
-     * leakage across jobs in thread pools.
-     */
-    private <T> Supplier<T> wrapWithMDC(Supplier<T> supplier) {
-        final Map<String, String> captured = MDC.getCopyOfContextMap();
-        return () -> {
-            final Map<String, String> previous = MDC.getCopyOfContextMap();
-            try {
-                // Set the captured context (or clear if none was captured)
-                if (captured != null) {
-                    MDC.setContextMap(new HashMap<>(captured));
-                } else {
-                    MDC.clear();
-                }
-                return supplier.get();
-            } finally {
-                // Restore previous state (or clear if there was none)
-                if (previous != null) {
-                    MDC.setContextMap(previous);
-                } else {
-                    MDC.clear();
-                }
-            }
-        };
-    }
 }
@@ -64,9 +64,19 @@ public class AppConfig {
        return v2Enabled;
    }

+    /* Commented out Thymeleaf template engine bean - to be removed when frontend migration is complete
+    @Bean
+    @ConditionalOnProperty(name = "system.customHTMLFiles", havingValue = "true")
+    public SpringTemplateEngine templateEngine(ResourceLoader resourceLoader) {
+        SpringTemplateEngine templateEngine = new SpringTemplateEngine();
+        templateEngine.addTemplateResolver(new FileFallbackTemplateResolver(resourceLoader));
+        return templateEngine;
+    }
+    */
+
    @Bean(name = "loginEnabled")
    public boolean loginEnabled() {
-        return applicationProperties.getSecurity().isEnableLogin();
+        return applicationProperties.getSecurity().getEnableLogin();
    }

    @Bean(name = "appName")
@@ -110,7 +120,9 @@ public class AppConfig {

    @Bean(name = "enableAlphaFunctionality")
    public boolean enableAlphaFunctionality() {
-        return applicationProperties.getSystem().isEnableAlphaFunctionality();
+        return applicationProperties.getSystem().getEnableAlphaFunctionality() != null
+                ? applicationProperties.getSystem().getEnableAlphaFunctionality()
+                : false;
    }

    @Bean(name = "rateLimit")
@@ -253,14 +265,9 @@ public class AppConfig {
        return "NORMAL";
    }

-    @Bean(name = "scarfEnabled")
-    public boolean scarfEnabled() {
-        return applicationProperties.getSystem().isScarfEnabled();
-    }
-
-    @Bean(name = "posthogEnabled")
-    public boolean posthogEnabled() {
-        return applicationProperties.getSystem().isPosthogEnabled();
+    @Bean(name = "disablePixel")
+    public boolean disablePixel() {
+        return Boolean.parseBoolean(env.getProperty("DISABLE_PIXEL", "false"));
    }

    @Bean(name = "machineType")
@@ -0,0 +1,49 @@
+package stirling.software.common.configuration;
+
+/* Commented out entire FileFallbackTemplateResolver class - Thymeleaf dependency removed
+ * This class will be removed when frontend migration to React is complete
+
+
+@Slf4j
+public class FileFallbackTemplateResolver extends AbstractConfigurableTemplateResolver {
+
+    private final ResourceLoader resourceLoader;
+
+    public FileFallbackTemplateResolver(ResourceLoader resourceLoader) {
+        super();
+        this.resourceLoader = resourceLoader;
+        setSuffix(".html");
+    }
+
+    // Note this does not work in local IDE, Prod jar only.
+    @Override
+    protected ITemplateResource computeTemplateResource(
+            IEngineConfiguration configuration,
+            String ownerTemplate,
+            String template,
+            String resourceName,
+            String characterEncoding,
+            Map<String, Object> templateResolutionAttributes) {
+        Resource resource =
+                resourceLoader.getResource(
+                        "file:" + InstallationPathConfig.getTemplatesPath() + resourceName);
+        try {
+            if (resource.exists() && resource.isReadable()) {
+                return new FileTemplateResource(resource.getFile().getPath(), characterEncoding);
+            }
+        } catch (IOException e) {
+            // Log the exception to help with debugging issues loading external templates
+            log.warn("Unable to read template '{}' from file system", resourceName, e);
+        }
+
+        InputStream inputStream =
+                Thread.currentThread()
+                        .getContextClassLoader()
+                        .getResourceAsStream("templates/" + resourceName);
+        if (inputStream != null) {
+            return new InputStreamTemplateResource(inputStream, "UTF-8");
+        }
+        return null;
+    }
+}
+*/
@@ -1,6 +1,7 @@
 package stirling.software.common.configuration;

 import java.io.File;
+import java.nio.file.Paths;

 import lombok.extern.slf4j.Slf4j;

@@ -59,6 +60,28 @@ public class InstallationPathConfig {
    }

    private static String initializeBasePath() {
+        if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_DESKTOP_UI", "false"))) {
+            String os = System.getProperty("os.name").toLowerCase();
+            if (os.contains("win")) {
+                return Paths.get(
+                                System.getenv("APPDATA"), // parent path
+                                "Stirling-PDF")
+                        + File.separator;
+            } else if (os.contains("mac")) {
+                return Paths.get(
+                                System.getProperty("user.home"),
+                                "Library",
+                                "Application Support",
+                                "Stirling-PDF")
+                        + File.separator;
+            } else {
+                return Paths.get(
+                                System.getProperty("user.home"), // parent path
+                                ".config",
+                                "Stirling-PDF")
+                        + File.separator;
+            }
+        }
        return "." + File.separator;
    }

@@ -1,14 +1,7 @@
 package stirling.software.common.configuration;

 import java.nio.file.Files;
-import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Set;

 import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.annotation.Configuration;
@@ -17,12 +10,8 @@ import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.CustomPaths;
 import stirling.software.common.model.ApplicationProperties.CustomPaths.Operations;
 import stirling.software.common.model.ApplicationProperties.CustomPaths.Pipeline;
-import stirling.software.common.model.ApplicationProperties.System;
-import stirling.software.common.util.ProcessExecutor;
-import stirling.software.common.util.UnoServerPool;

@Slf4j
@Configuration
@@ -30,22 +19,11 @@ import stirling.software.common.util.UnoServerPool;
 public class RuntimePathConfig {
    private final ApplicationProperties properties;
    private final String basePath;
-
-    // Operation paths
    private final String weasyPrintPath;
    private final String unoConvertPath;
-    private final String calibrePath;
-    private final String ocrMyPdfPath;
-    private final String sOfficePath;
-
-    // Tesseract data path
-    private final String tessDataPath;
-
-    private final List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> unoServerEndpoints;

    // Pipeline paths
    private final String pipelineWatchedFoldersPath;
-    private final List<String> pipelineWatchedFoldersPaths;
    private final String pipelineFinishedFoldersPath;
    private final String pipelineDefaultWebUiConfigs;
    private final String pipelinePath;
@@ -54,27 +32,17 @@ public class RuntimePathConfig {
        this.properties = properties;
        this.basePath = InstallationPathConfig.getPath();

-        System system = properties.getSystem();
-        CustomPaths customPaths = system.getCustomPaths();
-
-        Pipeline pipeline = customPaths.getPipeline();
-
-        this.pipelinePath =
-                resolvePath(
-                        Path.of(basePath, "pipeline").toString(),
-                        pipeline != null ? pipeline.getPipelineDir() : null);
+        this.pipelinePath = Path.of(basePath, "pipeline").toString();
        String defaultWatchedFolders = Path.of(this.pipelinePath, "watchedFolders").toString();
        String defaultFinishedFolders = Path.of(this.pipelinePath, "finishedFolders").toString();
        String defaultWebUIConfigs = Path.of(this.pipelinePath, "defaultWebUIConfigs").toString();

-        List<String> watchedFoldersDirs =
-                sanitizePathList(pipeline != null ? pipeline.getWatchedFoldersDirs() : null);
-        this.pipelineWatchedFoldersPaths =
-                resolveWatchedFolderPaths(
+        Pipeline pipeline = properties.getSystem().getCustomPaths().getPipeline();
+
+        this.pipelineWatchedFoldersPath =
+                resolvePath(
                        defaultWatchedFolders,
-                        watchedFoldersDirs,
                        pipeline != null ? pipeline.getWatchedFoldersDir() : null);
-        this.pipelineWatchedFoldersPath = this.pipelineWatchedFoldersPaths.get(0);
        this.pipelineFinishedFoldersPath =
                resolvePath(
                        defaultFinishedFolders,
@@ -84,19 +52,13 @@ public class RuntimePathConfig {
                        defaultWebUIConfigs,
                        pipeline != null ? pipeline.getWebUIConfigsDir() : null);

-        // Validate path conflicts after all paths are resolved
-        validatePipelinePaths();
-
        boolean isDocker = isRunningInDocker();

        // Initialize Operation paths
        String defaultWeasyPrintPath = isDocker ? "/opt/venv/bin/weasyprint" : "weasyprint";
-        String defaultUnoConvertPath = isDocker ? "/usr/local/bin/unoconvert" : "unoconvert";
-        String defaultCalibrePath = isDocker ? "/opt/calibre/ebook-convert" : "ebook-convert";
-        String defaultOcrMyPdfPath = isDocker ? "/opt/venv/bin/ocrmypdf" : "ocrmypdf";
-        String defaultSOfficePath = isDocker ? "/usr/bin/soffice" : "soffice";
+        String defaultUnoConvertPath = isDocker ? "/opt/venv/bin/unoconvert" : "unoconvert";

-        Operations operations = customPaths.getOperations();
+        Operations operations = properties.getSystem().getCustomPaths().getOperations();
        this.weasyPrintPath =
                resolvePath(
                        defaultWeasyPrintPath,
@@ -105,245 +67,13 @@ public class RuntimePathConfig {
                resolvePath(
                        defaultUnoConvertPath,
                        operations != null ? operations.getUnoconvert() : null);
-        this.calibrePath =
-                resolvePath(
-                        defaultCalibrePath, operations != null ? operations.getCalibre() : null);
-        this.ocrMyPdfPath =
-                resolvePath(
-                        defaultOcrMyPdfPath, operations != null ? operations.getOcrmypdf() : null);
-        this.sOfficePath =
-                resolvePath(
-                        defaultSOfficePath, operations != null ? operations.getSoffice() : null);
-
-        // Initialize Tesseract data path
-        // Priority: config setting > TESSDATA_PREFIX env var > default path
-        String tessPath = system.getTessdataDir();
-        String tessdataPrefix = java.lang.System.getenv("TESSDATA_PREFIX");
-        String defaultPath = "/usr/share/tesseract-ocr/5/tessdata";
-
-        if (tessPath != null && !tessPath.isEmpty()) {
-            this.tessDataPath = tessPath;
-        } else if (tessdataPrefix != null && !tessdataPrefix.isEmpty()) {
-            this.tessDataPath = tessdataPrefix;
-        } else {
-            this.tessDataPath = defaultPath;
-        }
-
-        log.info("Using Tesseract data path: {}", this.tessDataPath);
-
-        ApplicationProperties.ProcessExecutor processExecutor = properties.getProcessExecutor();
-        int libreOfficeLimit = 1;
-        if (processExecutor != null && processExecutor.getSessionLimit() != null) {
-            libreOfficeLimit = processExecutor.getSessionLimit().getLibreOfficeSessionLimit();
-        }
-        this.unoServerEndpoints = buildUnoServerEndpoints(processExecutor, libreOfficeLimit);
-        ProcessExecutor.setUnoServerPool(new UnoServerPool(this.unoServerEndpoints));
    }

    private String resolvePath(String defaultPath, String customPath) {
        return StringUtils.isNotBlank(customPath) ? customPath : defaultPath;
    }

-    private List<String> resolveWatchedFolderPaths(
-            String defaultPath, List<String> watchedFoldersDirs, String legacyWatchedFolder) {
-        List<String> rawPaths = new ArrayList<>();
-
-        // Collect paths from new config
-        if (watchedFoldersDirs != null && !watchedFoldersDirs.isEmpty()) {
-            rawPaths.addAll(watchedFoldersDirs);
-        }
-        // Fall back to legacy config
-        else if (StringUtils.isNotBlank(legacyWatchedFolder)) {
-            rawPaths.add(legacyWatchedFolder);
-        }
-        // Fall back to default
-        else {
-            rawPaths.add(defaultPath);
-        }
-
-        // Validate, normalize, and deduplicate paths
-        List<String> validatedPaths = validateAndNormalizePaths(rawPaths);
-
-        // Ensure we have at least one valid path (critical for system to function)
-        if (validatedPaths.isEmpty()) {
-            log.warn(
-                    "No valid watched folder paths configured, falling back to default: {}",
-                    defaultPath);
-            validatedPaths.add(defaultPath);
-        }
-
-        // Detect overlapping paths (warning only, not blocking)
-        detectOverlappingPaths(validatedPaths);
-
-        return validatedPaths;
-    }
-
-    private List<String> sanitizePathList(List<String> paths) {
-        if (paths == null || paths.isEmpty()) {
-            return Collections.emptyList();
-        }
-        List<String> sanitized = new ArrayList<>();
-        for (String path : paths) {
-            if (StringUtils.isNotBlank(path)) {
-                sanitized.add(path.trim());
-            }
-        }
-        return sanitized;
-    }
-
-    private List<String> validateAndNormalizePaths(List<String> paths) {
-        Set<String> normalizedPaths = new LinkedHashSet<>(); // Preserves order, prevents duplicates
-
-        for (String pathStr : paths) {
-            if (StringUtils.isBlank(pathStr)) {
-                continue;
-            }
-
-            try {
-                // Normalize to absolute path
-                Path path = Paths.get(pathStr.trim()).toAbsolutePath().normalize();
-                String normalizedPath = path.toString();
-
-                // Check for duplicates
-                if (normalizedPaths.contains(normalizedPath)) {
-                    log.debug("Skipping duplicate watched folder path: {}", pathStr);
-                    continue;
-                }
-
-                normalizedPaths.add(normalizedPath);
-                log.info("Registered watched folder path: {}", normalizedPath);
-
-            } catch (InvalidPathException e) {
-                log.error(
-                        "Invalid watched folder path '{}' - skipping: {}", pathStr, e.getMessage());
-            }
-        }
-
-        return new ArrayList<>(normalizedPaths);
-    }
-
-    private void detectOverlappingPaths(List<String> paths) {
-        for (int i = 0; i < paths.size(); i++) {
-            Path path1 = Paths.get(paths.get(i));
-            for (int j = i + 1; j < paths.size(); j++) {
-                Path path2 = Paths.get(paths.get(j));
-
-                // Check if one path is a parent of the other
-                if (path1.startsWith(path2)) {
-                    log.warn(
-                            "Watched folder path '{}' is nested inside '{}' - this may cause duplicate processing",
-                            path1,
-                            path2);
-                } else if (path2.startsWith(path1)) {
-                    log.warn(
-                            "Watched folder path '{}' is nested inside '{}' - this may cause duplicate processing",
-                            path2,
-                            path1);
-                }
-            }
-        }
-    }
-
-    private void validatePipelinePaths() {
-        try {
-            Path finishedPath = Paths.get(pipelineFinishedFoldersPath).toAbsolutePath().normalize();
-
-            for (String watchedPathStr : pipelineWatchedFoldersPaths) {
-                Path watchedPath = Paths.get(watchedPathStr).toAbsolutePath().normalize();
-
-                // Check if watched folder is same as finished folder
-                if (watchedPath.equals(finishedPath)) {
-                    log.error(
-                            "CRITICAL: Watched folder '{}' is the same as finished folder '{}' - this will cause processing loops!",
-                            watchedPath,
-                            finishedPath);
-                }
-                // Check if watched folder contains finished folder
-                else if (finishedPath.startsWith(watchedPath)) {
-                    log.warn(
-                            "Finished folder '{}' is nested inside watched folder '{}' - this may cause issues",
-                            finishedPath,
-                            watchedPath);
-                }
-                // Check if finished folder contains watched folder
-                else if (watchedPath.startsWith(finishedPath)) {
-                    log.error(
-                            "CRITICAL: Watched folder '{}' is nested inside finished folder '{}' - this will cause processing loops!",
-                            watchedPath,
-                            finishedPath);
-                }
-            }
-        } catch (Exception e) {
-            log.error("Error validating pipeline paths: {}", e.getMessage());
-        }
-    }
-
    private boolean isRunningInDocker() {
        return Files.exists(Path.of("/.dockerenv"));
    }
-
-    private List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> buildUnoServerEndpoints(
-            ApplicationProperties.ProcessExecutor processExecutor, int sessionLimit) {
-        if (processExecutor == null) {
-            log.warn("ProcessExecutor config missing; defaulting to a single UNO endpoint.");
-            return Collections.singletonList(
-                    new ApplicationProperties.ProcessExecutor.UnoServerEndpoint());
-        }
-        if (!processExecutor.isAutoUnoServer()) {
-            List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> configured =
-                    sanitizeUnoServerEndpoints(processExecutor.getUnoServerEndpoints());
-            if (!configured.isEmpty()) {
-                // Warn if manual endpoint count doesn't match sessionLimit
-                if (configured.size() != sessionLimit) {
-                    log.warn(
-                            "Manual UNO endpoint count ({}) differs from libreOfficeSessionLimit ({}). "
-                                    + "Concurrency will be limited by endpoint count, not sessionLimit.",
-                            configured.size(),
-                            sessionLimit);
-                }
-                return configured;
-            }
-            log.warn(
-                    "autoUnoServer disabled but no unoServerEndpoints configured; defaulting to 127.0.0.1:2003.");
-            return Collections.singletonList(
-                    new ApplicationProperties.ProcessExecutor.UnoServerEndpoint());
-        }
-        int count = sessionLimit > 0 ? sessionLimit : 1;
-        return buildAutoUnoServerEndpoints(count);
-    }
-
-    private List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint>
-            buildAutoUnoServerEndpoints(int count) {
-        List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> endpoints = new ArrayList<>();
-        int basePort = 2003;
-        for (int i = 0; i < count; i++) {
-            ApplicationProperties.ProcessExecutor.UnoServerEndpoint endpoint =
-                    new ApplicationProperties.ProcessExecutor.UnoServerEndpoint();
-            endpoint.setHost("127.0.0.1");
-            endpoint.setPort(basePort + (i * 2));
-            endpoints.add(endpoint);
-        }
-        return endpoints;
-    }
-
-    private List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint>
-            sanitizeUnoServerEndpoints(
-                    List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> endpoints) {
-        if (endpoints == null || endpoints.isEmpty()) {
-            return Collections.emptyList();
-        }
-        List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> sanitized = new ArrayList<>();
-        for (ApplicationProperties.ProcessExecutor.UnoServerEndpoint endpoint : endpoints) {
-            if (endpoint == null) {
-                continue;
-            }
-            String host = endpoint.getHost();
-            int port = endpoint.getPort();
-            if (host == null || host.isBlank() || port <= 0) {
-                continue;
-            }
-            sanitized.add(endpoint);
-        }
-        return sanitized;
-    }
 }
@@ -1,23 +0,0 @@
-package stirling.software.common.configuration;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.scheduling.TaskScheduler;
-import org.springframework.scheduling.concurrent.SimpleAsyncTaskScheduler;
-
-/**
- * Configures the scheduler used by all {@code @Scheduled} methods. Uses virtual threads so that
- * long-running scheduled tasks (e.g. cleanup, license checks, file monitoring) never block each
- * other — each runs on its own lightweight virtual thread.
- */
-@Configuration
-public class SchedulingConfig {
-
-    @Bean
-    public TaskScheduler taskScheduler() {
-        SimpleAsyncTaskScheduler scheduler = new SimpleAsyncTaskScheduler();
-        scheduler.setVirtualThreads(true);
-        scheduler.setThreadNamePrefix("scheduled-vt-");
-        return scheduler;
-    }
-}
@@ -1,49 +0,0 @@
-package stirling.software.common.constants;
-
-/**
- * Centralized constants for JWT token management.
- *
- * <p>These defaults are used when configuration values are not explicitly set.
- */
-public final class JwtConstants {
-
-    private JwtConstants() {
-        throw new UnsupportedOperationException("Utility class");
-    }
-
-    /** Default JWT access token lifetime in minutes (24 hours). */
-    public static final int DEFAULT_TOKEN_EXPIRY_MINUTES = 1440;
-
-    /** Default desktop client token lifetime in minutes (30 days). */
-    public static final int DEFAULT_DESKTOP_TOKEN_EXPIRY_MINUTES = 43200;
-
-    /**
-     * Default refresh grace period in minutes.
-     *
-     * <p>Allows refresh of expired tokens within this window after expiration.
-     */
-    public static final int DEFAULT_REFRESH_GRACE_MINUTES = 15;
-
-    /**
-     * Default allowed clock skew in seconds.
-     *
-     * <p>Tolerates small time drift between client and server clocks during validation.
-     */
-    public static final int DEFAULT_CLOCK_SKEW_SECONDS = 60;
-
-    /** Milliseconds per minute. */
-    public static final long MILLIS_PER_MINUTE = 60_000L;
-
-    /** Seconds per minute. */
-    public static final long SECONDS_PER_MINUTE = 60L;
-
-    /** JWT issuer identifier. */
-    public static final String ISSUER = "https://stirling.com";
-
-    /**
-     * Maximum refresh attempts allowed within the grace period window.
-     *
-     * <p>Prevents abuse of expired tokens by limiting refresh attempts.
-     */
-    public static final int MAX_REFRESH_ATTEMPTS_IN_GRACE = 3;
-}
@@ -12,7 +12,6 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
-import java.util.Locale;

 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Bean;
@@ -29,8 +28,6 @@ import org.springframework.stereotype.Component;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;

-import jakarta.annotation.PostConstruct;
-
 import lombok.Data;
 import lombok.Getter;
 import lombok.Setter;
@@ -39,7 +36,6 @@ import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.YamlPropertySourceFactory;
-import stirling.software.common.constants.JwtConstants;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
@@ -58,14 +54,12 @@ public class ApplicationProperties {
    private Legal legal = new Legal();
    private Security security = new Security();
    private System system = new System();
-    private Storage storage = new Storage();
    private Ui ui = new Ui();
    private Endpoints endpoints = new Endpoints();
    private Metrics metrics = new Metrics();
    private AutomaticallyGenerated automaticallyGenerated = new AutomaticallyGenerated();

    private Mail mail = new Mail();
-    private Telegram telegram = new Telegram();

    private Premium premium = new Premium();

@@ -75,7 +69,6 @@ public class ApplicationProperties {
    private AutoPipeline autoPipeline = new AutoPipeline();
    private ProcessExecutor processExecutor = new ProcessExecutor();
    private PdfEditor pdfEditor = new PdfEditor();
-    private AiEngine aiEngine = new AiEngine();

    @Bean
    public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -103,93 +96,9 @@ public class ApplicationProperties {
        return propertySource;
    }

-    /**
-     * Initialize fileUploadLimit from environment variables if not set in settings.yml. Supports
-     * SYSTEMFILEUPLOADLIMIT (format: "100MB") and SYSTEM_MAXFILESIZE (format: "100" in MB).
-     */
-    @PostConstruct
-    public void initializeFileUploadLimitFromEnv() {
-        // Only override if fileUploadLimit is not already set in settings.yml
-        if (system.getFileUploadLimit() == null || system.getFileUploadLimit().isEmpty()) {
-            String fileUploadLimit = null;
-
-            // Check SYSTEMFILEUPLOADLIMIT first (format: "100MB", "1GB", etc.)
-            String systemFileUploadLimit = java.lang.System.getenv("SYSTEMFILEUPLOADLIMIT");
-            if (systemFileUploadLimit != null && !systemFileUploadLimit.trim().isEmpty()) {
-                fileUploadLimit = systemFileUploadLimit.trim();
-                log.info("Setting fileUploadLimit from SYSTEMFILEUPLOADLIMIT: {}", fileUploadLimit);
-            } else {
-                // Check SYSTEM_MAXFILESIZE (format: number in MB, e.g., "100")
-                String systemMaxFileSize = java.lang.System.getenv("SYSTEM_MAXFILESIZE");
-                if (systemMaxFileSize != null && !systemMaxFileSize.trim().isEmpty()) {
-                    try {
-                        // Validate it's a number
-                        long sizeInMB = Long.parseLong(systemMaxFileSize.trim());
-                        if (sizeInMB > 0 && sizeInMB <= 999) {
-                            fileUploadLimit = sizeInMB + "MB";
-                            log.info(
-                                    "Setting fileUploadLimit from SYSTEM_MAXFILESIZE: {}MB",
-                                    sizeInMB);
-                        } else {
-                            log.warn(
-                                    "SYSTEM_MAXFILESIZE value {} is out of valid range (1-999), ignoring",
-                                    sizeInMB);
-                        }
-                    } catch (NumberFormatException e) {
-                        log.warn(
-                                "SYSTEM_MAXFILESIZE value '{}' is not a valid number, ignoring",
-                                systemMaxFileSize);
-                    }
-                }
-            }
-
-            if (fileUploadLimit != null) {
-                system.setFileUploadLimit(fileUploadLimit);
-            }
-        }
-    }
-
    @Data
    public static class AutoPipeline {
        private String outputFolder;
-        private FileReadiness fileReadiness = new FileReadiness();
-
-        /**
-         * Configuration for the {@link stirling.software.common.util.FileReadinessChecker}.
-         * Controls how the pipeline determines whether a file is fully written and stable before
-         * processing begins.
-         */
-        @Data
-        public static class FileReadiness {
-            /**
-             * Master toggle. When {@code false} every readiness check is skipped and all files are
-             * considered immediately ready (preserves legacy behaviour).
-             */
-            private boolean enabled = true;
-
-            /**
-             * How long (in milliseconds) a file must remain unmodified before it is considered
-             * stable. Files modified more recently than this threshold are skipped and retried on
-             * the next scan cycle. Default: 5 000 ms (5 seconds).
-             */
-            private long settleTimeMillis = 5000;
-
-            /**
-             * How long (in milliseconds) to pause between two consecutive file-size reads when
-             * checking whether a file is still being written. If the size differs between the two
-             * reads the file is considered unstable. This catches active copies on Linux/macOS
-             * where advisory locking alone cannot detect a mid-copy file. Default: 500 ms.
-             */
-            private long sizeCheckDelayMillis = 500;
-
-            /**
-             * Optional list of file extensions (without the leading dot, case-insensitive) that are
-             * allowed through the readiness check. An empty list means all extensions are accepted.
-             * Example: {@code ["pdf", "tiff"]} will skip any file whose extension is not {@code
-             * pdf} or {@code tiff}.
-             */
-            private List<String> allowedExtensions = new java.util.ArrayList<>();
-        }
    }

    @Data
@@ -232,13 +141,6 @@ public class ApplicationProperties {
        }
    }

-    @Data
-    public static class AiEngine {
-        private boolean enabled = false;
-        private String url = "http://localhost:5001";
-        private int timeoutSeconds = 120;
-    }
-
    @Data
    public static class Legal {
        private String termsAndConditions;
@@ -250,7 +152,7 @@ public class ApplicationProperties {

    @Data
    public static class Security {
-        private boolean enableLogin;
+        private Boolean enableLogin;
        private InitialLogin initialLogin = new InitialLogin();
        private OAUTH2 oauth2 = new OAUTH2();
        private SAML2 saml2 = new SAML2();
@@ -260,8 +162,6 @@ public class ApplicationProperties {
        private String customGlobalAPIKey;
        private Jwt jwt = new Jwt();
        private Validation validation = new Validation();
-        private Timestamp timestamp = new Timestamp();
-        private String xFrameOptions = "DENY";

        public Boolean isAltLogin() {
            return saml2.getEnabled() || oauth2.getEnabled();
@@ -413,11 +313,11 @@ public class ApplicationProperties {
            }

            public boolean isSettingsValid() {
-                return !ValidationUtils.isStringEmpty(this.issuer)
-                        && !ValidationUtils.isStringEmpty(this.clientId)
-                        && !ValidationUtils.isStringEmpty(this.clientSecret)
-                        && !ValidationUtils.isCollectionEmpty(this.scopes)
-                        && !ValidationUtils.isStringEmpty(this.useAsUsername);
+                return !ValidationUtils.isStringEmpty(this.getIssuer())
+                        && !ValidationUtils.isStringEmpty(this.getClientId())
+                        && !ValidationUtils.isStringEmpty(this.getClientSecret())
+                        && !ValidationUtils.isCollectionEmpty(this.getScopes())
+                        && !ValidationUtils.isStringEmpty(this.getUseAsUsername());
            }

            @Data
@@ -427,7 +327,7 @@ public class ApplicationProperties {
                private KeycloakProvider keycloak = new KeycloakProvider();

                public Provider get(String registrationId) throws UnsupportedProviderException {
-                    return switch (registrationId.toLowerCase(Locale.ROOT)) {
+                    return switch (registrationId.toLowerCase()) {
                        case "google" -> getGoogle();
                        case "github" -> getGithub();
                        case "keycloak" -> getKeycloak();
@@ -435,114 +335,19 @@ public class ApplicationProperties {
                                throw new UnsupportedProviderException(
                                        "Logout from the provider "
                                                + registrationId
-                                                + " is not supported. Report it at"
-                                                + " https://github.com/Stirling-Tools/Stirling-PDF/issues");
+                                                + " is not supported. "
+                                                + "Report it at https://github.com/Stirling-Tools/Stirling-PDF/issues");
                    };
                }
            }
        }

-        /**
-         * JWT token configuration.
-         *
-         * <p><b>BREAKING CHANGE (v2.0):</b> Default token expiry increased from 12 hours (720
-         * minutes) to 24 hours (1440 minutes). If you require the previous behavior, explicitly set
-         * {@code tokenExpiryMinutes: 720} in your configuration.
-         */
        @Data
        public static class Jwt {
            private boolean enableKeystore = true;
            private boolean enableKeyRotation = false;
            private boolean enableKeyCleanup = true;
-
-            /**
-             * JWT access token lifetime in minutes for web clients.
-             *
-             * <p>Default: {@value JwtConstants#DEFAULT_TOKEN_EXPIRY_MINUTES} minutes (24 hours).
-             *
-             * <p><b>BREAKING CHANGE:</b> Previously hardcoded to 720 minutes (12 hours). Now
-             * defaults to 1440 minutes (24 hours).
-             */
-            private int tokenExpiryMinutes = JwtConstants.DEFAULT_TOKEN_EXPIRY_MINUTES;
-
-            /**
-             * JWT access token lifetime in minutes for desktop clients (Tauri app).
-             *
-             * <p>Desktop clients are automatically detected via User-Agent header and receive
-             * longer-lived tokens because they run on personal devices with OS-level encrypted
-             * storage (macOS Keychain, Windows Credential Manager, Linux Secret Service).
-             *
-             * <p>This provides better UX (login once per month) while maintaining security through
-             * device encryption and secure storage, matching the behavior of popular desktop apps
-             * like Slack, Discord, VS Code, etc.
-             *
-             * <p>Default: 43200 minutes (30 days).
-             */
-            private int desktopTokenExpiryMinutes = 43200;
-
-            /**
-             * Allowed clock skew in seconds for JWT validation.
-             *
-             * <p>Tolerates small time drift between client and server clocks. Tokens that are
-             * slightly expired or slightly in the future (within this window) will still be
-             * accepted.
-             *
-             * <p>Default: {@value JwtConstants#DEFAULT_CLOCK_SKEW_SECONDS} seconds.
-             */
-            private int allowedClockSkewSeconds = JwtConstants.DEFAULT_CLOCK_SKEW_SECONDS;
-
-            /**
-             * Grace period in minutes for refreshing expired tokens.
-             *
-             * <p>Allows token refresh using an expired access token if the token expired within
-             * this many minutes. This provides better UX by allowing users to refresh slightly
-             * expired tokens without re-authentication.
-             *
-             * <p>Rate limiting is applied to prevent abuse of expired tokens within the grace
-             * window (max {@value JwtConstants#MAX_REFRESH_ATTEMPTS_IN_GRACE} attempts).
-             *
-             * <p>Default: {@value JwtConstants#DEFAULT_REFRESH_GRACE_MINUTES} minutes.
-             */
-            private int refreshGraceMinutes = JwtConstants.DEFAULT_REFRESH_GRACE_MINUTES;
-
-            /**
-             * Calculate number of days to retain old JWT signing keys.
-             *
-             * <p>Automatically calculated based on the longest token lifetime plus a proportional
-             * safety buffer. Keys must be retained for at least as long as the tokens they signed
-             * remain valid, otherwise token verification will fail.
-             *
-             * <p>Formula: ceil((maxTokenExpiry + 10% buffer + refreshGrace + clockSkew) / 1440)
-             *
-             * <p>The buffer includes:
-             *
-             * <ul>
-             *   <li>10% of token lifetime (scales with token duration)
-             *   <li>Token refresh grace period ({@link #refreshGraceMinutes})
-             *   <li>Clock skew tolerance ({@link #allowedClockSkewSeconds} converted to minutes)
-             * </ul>
-             *
-             * @return calculated key retention period in days
-             */
-            public int getKeyRetentionDays() {
-                final int MINUTES_PER_DAY = 1440;
-                final double BUFFER_PERCENTAGE = 0.10; // 10% buffer
-
-                int maxTokenExpiryMinutes = Math.max(tokenExpiryMinutes, desktopTokenExpiryMinutes);
-
-                // Add 10% buffer (scales with token lifetime)
-                int bufferMinutes = (int) Math.ceil(maxTokenExpiryMinutes * BUFFER_PERCENTAGE);
-
-                // Add refresh grace period
-                bufferMinutes += refreshGraceMinutes;
-
-                // Add clock skew (convert seconds to minutes, round up)
-                bufferMinutes += (int) Math.ceil(allowedClockSkewSeconds / 60.0);
-
-                // Total retention in minutes, convert to days (round up)
-                int totalMinutes = maxTokenExpiryMinutes + bufferMinutes;
-                return (int) Math.ceil(totalMinutes / (double) MINUTES_PER_DAY);
-            }
+            private int keyRetentionDays = 7;
        }

        @Data
@@ -579,32 +384,25 @@ public class ApplicationProperties {
                private boolean hardFail = false;
            }
        }
-
-        @Data
-        public static class Timestamp {
-            private String defaultTsaUrl = "http://timestamp.digicert.com";
-            private List<String> customTsaUrls = new ArrayList<>();
-        }
    }

    @Data
    public static class System {
        private String defaultLocale;
-        private boolean googlevisibility;
+        private Boolean googlevisibility;
        private boolean showUpdate;
-        private boolean showUpdateOnlyAdmin;
-        private boolean showSettingsWhenNoLogin = true;
+        private Boolean showUpdateOnlyAdmin;
        private boolean customHTMLFiles;
        private String tessdataDir;
-        private boolean enableAlphaFunctionality;
+        private Boolean enableAlphaFunctionality;
        private Boolean enableAnalytics;
        private Boolean enablePosthog;
        private Boolean enableScarf;
        private Boolean enableDesktopInstallSlide;
        private Datasource datasource;
-        private boolean disableSanitize;
+        private Boolean disableSanitize;
        private int maxDPI;
-        private boolean enableUrlToPDF;
+        private Boolean enableUrlToPDF;
        private Html html = new Html();
        private CustomPaths customPaths = new CustomPaths();
        private String fileUploadLimit;
@@ -617,64 +415,21 @@ public class ApplicationProperties {
        private String frontendUrl; // Frontend URL for invite email links (e.g.

        // 'https://app.example.com'). If not set, falls back to backendUrl.
-        private boolean enableMobileScanner = false; // Enable mobile phone QR code upload feature
-        private MobileScannerSettings mobileScannerSettings = new MobileScannerSettings();
-
-        @Data
-        public static class MobileScannerSettings {
-            private boolean convertToPdf = true; // Whether to automatically convert images to PDF
-            private String imageResolution = "full"; // Options: "full", "reduced"
-            private String pageFormat = "A4"; // Options: "keep", "A4", "letter"
-            private boolean stretchToFit = false; // Whether to stretch image to fill page
-        }

        public boolean isAnalyticsEnabled() {
-            return this.enableAnalytics != null && this.enableAnalytics;
+            return this.getEnableAnalytics() != null && this.getEnableAnalytics();
        }

        public boolean isPosthogEnabled() {
            // Treat null as enabled when analytics is enabled
-            return this.isAnalyticsEnabled() && (this.enablePosthog == null || this.enablePosthog);
+            return this.isAnalyticsEnabled()
+                    && (this.getEnablePosthog() == null || this.getEnablePosthog());
        }

        public boolean isScarfEnabled() {
            // Treat null as enabled when analytics is enabled
-            return this.isAnalyticsEnabled() && (this.enableScarf == null || this.enableScarf);
-        }
-    }
-
-    @Data
-    public static class Storage {
-        private boolean enabled = false;
-        private String provider = "local";
-        private Local local = new Local();
-        private Quotas quotas = new Quotas();
-        private Sharing sharing = new Sharing();
-        private Signing signing = new Signing();
-
-        @Data
-        public static class Local {
-            private String basePath = InstallationPathConfig.getPath() + "storage";
-        }
-
-        @Data
-        public static class Sharing {
-            private boolean enabled = false;
-            private boolean linkEnabled = false;
-            private boolean emailEnabled = false;
-            private int linkExpirationDays = 3;
-        }
-
-        @Data
-        public static class Quotas {
-            private long maxStorageMbPerUser = -1;
-            private long maxStorageMbTotal = -1;
-            private long maxFileMb = -1;
-        }
-
-        @Data
-        public static class Signing {
-            private boolean enabled = false;
+            return this.isAnalyticsEnabled()
+                    && (this.getEnableScarf() == null || this.getEnableScarf());
        }
    }

@@ -690,9 +445,7 @@ public class ApplicationProperties {

        @Data
        public static class Pipeline {
-            private String pipelineDir;
            private String watchedFoldersDir;
-            private List<String> watchedFoldersDirs = new ArrayList<>();
            private String finishedFoldersDir;
            private String webUIConfigsDir;
        }
@@ -701,9 +454,6 @@ public class ApplicationProperties {
        public static class Operations {
            private String weasyprint;
            private String unoconvert;
-            private String calibre;
-            private String ocrmypdf;
-            private String soffice;
        }
    }

@@ -786,10 +536,10 @@ public class ApplicationProperties {
        @Override
        public String toString() {
            return """
-            Driver {
-              driverName='%s'
-            }
-            """
+                Driver {
+                  driverName='%s'
+                }
+                """
                    .formatted(driverName);
        }
    }
@@ -799,9 +549,6 @@ public class ApplicationProperties {
        private String appNameNavbar;
        private List<String> languages;
        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
-        private boolean defaultHideUnavailableTools = false;
-        private boolean defaultHideUnavailableConversions = false;
-        private HideDisabledTools hideDisabledTools = new HideDisabledTools();

        public String getAppNameNavbar() {
            return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
@@ -814,12 +561,6 @@ public class ApplicationProperties {
            }
            return "classic"; // default
        }
-
-        @Data
-        public static class HideDisabledTools {
-            private boolean googleDrive = false;
-            private boolean mobileQRScanner = false;
-        }
    }

    @Data
@@ -830,7 +571,7 @@ public class ApplicationProperties {

    @Data
    public static class Metrics {
-        private boolean enabled;
+        private Boolean enabled;
    }

    @Data
@@ -851,7 +592,6 @@ public class ApplicationProperties {
        private boolean ssoAutoLogin;
        private CustomMetadata customMetadata = new CustomMetadata();

-        @Deprecated
        @Data
        public static class CustomMetadata {
            private boolean autoUpdateMetadata;
@@ -859,23 +599,16 @@ public class ApplicationProperties {
            private String creator;
            private String producer;

-            @Deprecated
            public String getCreator() {
                return creator == null || creator.trim().isEmpty() ? "Stirling-PDF" : creator;
            }

-            @Deprecated
            public String getProducer() {
                return producer == null || producer.trim().isEmpty() ? "Stirling-PDF" : producer;
            }
        }
    }

-    /**
-     * Mail server configuration properties.
-     *
-     * @since 0.46.1
-     */
    @Data
    public static class Mail {
        private boolean enabled;
@@ -898,102 +631,6 @@ public class ApplicationProperties {
        private Boolean sslCheckServerIdentity;
    }

-    /**
-     * Telegram bot configuration properties.
-     *
-     * @since 2.2.x
-     */
-    @Data
-    public static class Telegram {
-        private Boolean enabled = false;
-        @ToString.Exclude private String botToken;
-        private String botUsername;
-        private String pipelineInboxFolder = "telegram";
-        private Boolean customFolderSuffix = false;
-        private Boolean enableAllowUserIDs = false;
-        private List<Long> allowUserIDs = new ArrayList<>();
-        private Boolean enableAllowChannelIDs = false;
-        private List<Long> allowChannelIDs = new ArrayList<>();
-        private long processingTimeoutSeconds = 180;
-        private long pollingIntervalMillis = 2000;
-        private Feedback feedback = new Feedback();
-
-        /**
-         * Configuration for feedback messages sent by the Telegram bot.
-         *
-         * @since 2.2.x
-         */
-        @Data
-        public static class Feedback {
-            private Channel channel = new Channel();
-            private User user = new User();
-
-            /**
-             * Channel-specific feedback settings.
-             *
-             * @since 2.2.x
-             */
-            @Data
-            public static class Channel {
-                /**
-                 * Set to {@code false} to hide/suppress "no valid document" feedback messages to
-                 * the channel (to avoid spam).
-                 */
-                private Boolean noValidDocument = true;
-
-                /**
-                 * Set to {@code false} to hide/suppress generic error feedback messages to the
-                 * channel (to avoid spam).
-                 */
-                private Boolean errorMessage = true;
-
-                /**
-                 * Set to {@code false} to hide/suppress processing error feedback messages to the
-                 * channel (to avoid spam).
-                 */
-                private Boolean errorProcessing = true;
-
-                /**
-                 * Set to {@code false} to hide/suppress "processing" feedback messages to the
-                 * channel (to avoid spam).
-                 */
-                private Boolean processing = true;
-            }
-
-            /**
-             * User-specific feedback settings.
-             *
-             * @since 2.2.x
-             */
-            @Data
-            public static class User {
-                /**
-                 * Set to {@code false} to hide/suppress "no valid document" feedback messages to
-                 * users (to avoid spam).
-                 */
-                private Boolean noValidDocument = true;
-
-                /**
-                 * Set to {@code false} to hide/suppress generic error feedback messages to users
-                 * (to avoid spam).
-                 */
-                private Boolean errorMessage = true;
-
-                /**
-                 * Set to {@code false} to hide/suppress processing error feedback messages to users
-                 * (to avoid spam).
-                 */
-                private Boolean errorProcessing = true;
-
-                /**
-                 * Set to {@code false} to hide/suppress "processing" feedback messages to users (to
-                 * avoid spam).
-                 */
-                private Boolean processing = true;
-            }
-        }
-    }
-
    @Data
    public static class Premium {
        private boolean enabled;
@@ -1007,15 +644,6 @@ public class ApplicationProperties {
            private boolean ssoAutoLogin;
            private boolean database;
            private CustomMetadata customMetadata = new CustomMetadata();
-            private GoogleDrive googleDrive = new GoogleDrive();
-
-            @Data
-            public static class GoogleDrive {
-                private boolean enabled = false;
-                private String clientId = "";
-                private String apiKey = "";
-                private String appId = "";
-            }

            @Data
            public static class CustomMetadata {
@@ -1040,37 +668,12 @@ public class ApplicationProperties {
        public static class EnterpriseFeatures {
            private PersistentMetrics persistentMetrics = new PersistentMetrics();
            private Audit audit = new Audit();
-            private DatabaseNotifications databaseNotifications = new DatabaseNotifications();
-
-            @Data
-            public static class DatabaseNotifications {
-                private Backup backups = new Backup();
-                private Imports imports = new Imports();
-
-                @Data
-                public static class Backup {
-                    private boolean successful = false;
-                    private boolean failed = false;
-                }
-
-                @Data
-                public static class Imports {
-                    private boolean successful = false;
-                    private boolean failed = false;
-                }
-            }

            @Data
            public static class Audit {
                private boolean enabled = true;
                private int level = 2; // 0=OFF, 1=BASIC, 2=STANDARD, 3=VERBOSE
                private int retentionDays = 90;
-                private boolean captureFileHash =
-                        false; // Capture SHA-256 hash of files (increases processing time)
-                private boolean capturePdfAuthor =
-                        false; // Capture PDF author metadata (increases processing time)
-                private boolean captureOperationResults =
-                        false; // Capture operation return values (not recommended, high volume)
            }

            @Data
@@ -1085,16 +688,6 @@ public class ApplicationProperties {
    public static class ProcessExecutor {
        private SessionLimit sessionLimit = new SessionLimit();
        private TimeoutMinutes timeoutMinutes = new TimeoutMinutes();
-        private boolean autoUnoServer = true;
-        private List<UnoServerEndpoint> unoServerEndpoints = new ArrayList<>();
-
-        @Data
-        public static class UnoServerEndpoint {
-            private String host = "127.0.0.1";
-            private int port = 2003;
-            private String hostLocation = "auto"; // auto|local|remote
-            private String protocol = "http"; // http|https
-        }

        @Data
        public static class SessionLimit {
@@ -1109,7 +702,6 @@ public class ApplicationProperties {
            private int tesseractSessionLimit;
            private int ghostscriptSessionLimit;
            private int ocrMyPdfSessionLimit;
-            private int ffmpegSessionLimit;

            public int getQpdfSessionLimit() {
                return qpdfSessionLimit > 0 ? qpdfSessionLimit : 2;
@@ -1154,10 +746,6 @@ public class ApplicationProperties {
            public int getOcrMyPdfSessionLimit() {
                return ocrMyPdfSessionLimit > 0 ? ocrMyPdfSessionLimit : 2;
            }
-
-            public int getFfmpegSessionLimit() {
-                return ffmpegSessionLimit > 0 ? ffmpegSessionLimit : 2;
-            }
        }

        @Data
@@ -1186,7 +774,6 @@ public class ApplicationProperties {
            private long qpdfTimeoutMinutes;
            private long ghostscriptTimeoutMinutes;
            private long ocrMyPdfTimeoutMinutes;
-            private long ffmpegTimeoutMinutes;

            public long getTesseractTimeoutMinutes() {
                return tesseractTimeoutMinutes > 0 ? tesseractTimeoutMinutes : 30;
@@ -1231,10 +818,6 @@ public class ApplicationProperties {
            public long getOcrMyPdfTimeoutMinutes() {
                return ocrMyPdfTimeoutMinutes > 0 ? ocrMyPdfTimeoutMinutes : 30;
            }
-
-            public long getFfmpegTimeoutMinutes() {
-                return ffmpegTimeoutMinutes > 0 ? ffmpegTimeoutMinutes : 30;
-            }
        }
    }
 }
@@ -30,11 +30,11 @@ public class FileInfo {
    // Formats the file size into a human-readable string.
    public String getFormattedFileSize() {
        if (fileSize >= 1024 * 1024 * 1024) {
-            return String.format(Locale.ROOT, "%.2f GB", fileSize / (1024.0 * 1024 * 1024));
+            return String.format(Locale.US, "%.2f GB", fileSize / (1024.0 * 1024 * 1024));
        } else if (fileSize >= 1024 * 1024) {
-            return String.format(Locale.ROOT, "%.2f MB", fileSize / (1024.0 * 1024));
+            return String.format(Locale.US, "%.2f MB", fileSize / (1024.0 * 1024));
        } else if (fileSize >= 1024) {
-            return String.format(Locale.ROOT, "%.2f KB", fileSize / 1024.0);
+            return String.format(Locale.US, "%.2f KB", fileSize / 1024.0);
        } else {
            return String.format("%d Bytes", fileSize);
        }
@@ -1,98 +0,0 @@
-package stirling.software.common.model;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/** Form field information with coordinates for interactive form viewer. */
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-@Schema(description = "Form field with coordinates and metadata")
-public class FormFieldWithCoordinates {
-
-    @Schema(description = "Fully qualified field name", example = "form1.firstName")
-    private String name;
-
-    @Schema(description = "Display label for the field", example = "First Name")
-    private String label;
-
-    @Schema(description = "Field type: text, checkbox, radio, combobox, listbox, button, signature")
-    private String type;
-
-    @Schema(description = "Current field value")
-    private String value;
-
-    @Schema(
-            description =
-                    "Available options (export values) for choice fields"
-                            + " (dropdown, radio, listbox)")
-    private List<String> options;
-
-    @Schema(
-            description =
-                    "Human-readable display labels for choice field options,"
-                            + " parallel to the 'options' list. Null when identical to options.")
-    private List<String> displayOptions;
-
-    @Schema(description = "Whether the field is required")
-    private boolean required;
-
-    @Schema(description = "Whether the field is read-only")
-    private boolean readOnly;
-
-    @Schema(description = "Whether this is a multi-select list box")
-    private boolean multiSelect;
-
-    @Schema(description = "Whether this is a multi-line text field")
-    private boolean multiline;
-
-    @Schema(description = "Tooltip/alternate name for the field")
-    private String tooltip;
-
-    @Schema(description = "Widget coordinates on each page (fields can have multiple widgets)")
-    private List<WidgetCoordinates> widgets;
-
-    /**
-     * Coordinates for a single widget annotation (visual representation of the field). A field can
-     * have multiple widgets if it appears on multiple pages.
-     */
-    @Data
-    @Builder
-    @NoArgsConstructor
-    @AllArgsConstructor
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    @Schema(description = "Widget coordinates in PDF space")
-    public static class WidgetCoordinates {
-
-        @Schema(description = "Page index (0-based)", example = "0")
-        private int pageIndex;
-
-        @Schema(description = "X coordinate in PDF points (lower-left origin)")
-        private float x;
-
-        @Schema(description = "Y coordinate in PDF points (lower-left origin)")
-        private float y;
-
-        @Schema(description = "Width in PDF points")
-        private float width;
-
-        @Schema(description = "Height in PDF points")
-        private float height;
-
-        @Schema(description = "Export value for this widget (radio/checkbox buttons only)")
-        private String exportValue;
-
-        @Schema(description = "Font size in PDF points")
-        private Float fontSize;
-    }
-}
@@ -0,0 +1,40 @@
+package stirling.software.common.model;
+
+/* Commented out entire InputStreamTemplateResource class - Thymeleaf dependency removed
+ * This class will be removed when frontend migration to React is complete
+
+
+
+@RequiredArgsConstructor
+@Getter
+public class InputStreamTemplateResource implements ITemplateResource {
+    private final InputStream inputStream;
+    private final String characterEncoding;
+
+    @Override
+    public Reader reader() throws IOException {
+        return new InputStreamReader(inputStream, characterEncoding);
+    }
+
+    @Override
+    public ITemplateResource relative(String relativeLocation) {
+        // Implement logic for relative resources, if needed
+        throw new UnsupportedOperationException("Relative resources not supported");
+    }
+
+    @Override
+    public String getDescription() {
+        return "InputStream resource [Stream]";
+    }
+
+    @Override
+    public String getBaseName() {
+        return "streamResource";
+    }
+
+    @Override
+    public boolean exists() {
+        return inputStream != null;
+    }
+}
+*/
@@ -1,16 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class UserSummaryDTO {
-    private Long userId;
-    private String username;
-    private String displayName;
-    private String teamName;
-    private boolean enabled;
-}
@@ -42,7 +42,7 @@ public enum Role {
        // Using the fromString method to get the Role enum based on the roleId
        Role role = fromString(roleId);
        // Return the roleName of the found Role enum
-        return role.roleName;
+        return role.getRoleName();
    }

    // Method to retrieve all role IDs and role names
@@ -50,14 +50,14 @@ public enum Role {
        // Using LinkedHashMap to preserve order
        Map<String, String> roleDetails = new LinkedHashMap<>();
        for (Role role : Role.values()) {
-            roleDetails.put(role.roleId, role.roleName);
+            roleDetails.put(role.getRoleId(), role.getRoleName());
        }
        return roleDetails;
    }

    public static Role fromString(String roleId) {
        for (Role role : Role.values()) {
-            if (role.roleId.equalsIgnoreCase(roleId)) {
+            if (role.getRoleId().equalsIgnoreCase(roleId)) {
                return role;
            }
        }
@@ -117,13 +117,13 @@ public class Provider {
                + ", clientName="
                + getClientName()
                + ", clientId="
-                + clientId
+                + getClientId()
                + ", clientSecret="
-                + (clientSecret != null && !clientSecret.isEmpty() ? "*****" : "NULL")
+                + (getClientSecret() != null && !getClientSecret().isEmpty() ? "*****" : "NULL")
                + ", scopes="
                + getScopes()
                + ", useAsUsername="
-                + useAsUsername
+                + getUseAsUsername()
                + "]";
    }
 }
@@ -1,10 +1,6 @@
 package stirling.software.common.service;

-import java.io.BufferedInputStream;
-import java.io.BufferedOutputStream;
 import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;
@@ -12,7 +8,6 @@ import java.util.UUID;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -26,9 +21,6 @@ import lombok.extern.slf4j.Slf4j;
@Slf4j
 public class FileStorage {

-    /** Holds the result of a stream-to-disk store operation: the file ID and the bytes written. */
-    public record StoredFile(String fileId, long size) {}
-
    @Value("${stirling.tempDir:/tmp/stirling-files}")
    private String tempDirPath;

@@ -112,58 +104,6 @@ public class FileStorage {
        return Files.readAllBytes(filePath);
    }

-    /**
-     * Retrieve a file by its ID as a streaming InputStream. The caller is responsible for closing
-     * the returned stream.
-     *
-     * @param fileId The ID of the file to retrieve
-     * @return A buffered InputStream for the file
-     * @throws IOException If the file doesn't exist or can't be read
-     */
-    public InputStream retrieveInputStream(String fileId) throws IOException {
-        Path filePath = getFilePath(fileId);
-        // Let Files.newInputStream throw NoSuchFileException naturally — avoids TOCTOU race
-        // between exists-check and open when another thread may delete concurrently.
-        return new BufferedInputStream(Files.newInputStream(filePath));
-    }
-
-    /**
-     * Store data from an InputStream as a file and return its unique ID and byte count. Streams
-     * directly to disk without buffering the entire content in heap.
-     *
-     * @param inputStream The input stream to read from
-     * @param originalName The original name of the file (unused, kept for API symmetry)
-     * @return A {@link StoredFile} containing the file ID and the number of bytes written
-     * @throws IOException If there is an error storing the file
-     */
-    public StoredFile storeInputStream(InputStream inputStream, String originalName)
-            throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        long size = Files.copy(inputStream, filePath);
-        log.debug("Stored input stream with ID: {}", fileId);
-        return new StoredFile(fileId, size);
-    }
-
-    public String storeFromStreamingBody(StreamingResponseBody body, String originalName)
-            throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        boolean success = false;
-        try (OutputStream os = new BufferedOutputStream(Files.newOutputStream(filePath))) {
-            body.writeTo(os);
-            success = true;
-        } finally {
-            if (!success) {
-                Files.deleteIfExists(filePath);
-            }
-        }
-        log.debug("Stored StreamingResponseBody with ID: {}", fileId);
-        return fileId;
-    }
-
    /**
     * Delete a file by its ID
     *
@@ -1,184 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-import java.io.UncheckedIOException;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.util.regex.Pattern;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.env.Environment;
-import org.springframework.core.io.FileSystemResource;
-import org.springframework.core.io.Resource;
-import org.springframework.http.*;
-import org.springframework.stereotype.Service;
-import org.springframework.util.MultiValueMap;
-import org.springframework.web.client.RequestCallback;
-import org.springframework.web.client.RestTemplate;
-
-import jakarta.servlet.ServletContext;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.enumeration.Role;
-import stirling.software.common.util.TempFile;
-import stirling.software.common.util.TempFileManager;
-
-/**
- * Dispatches HTTP POST requests to internal Stirling API endpoints via loopback. Used by
- * PipelineProcessor and AiWorkflowService to execute tool operations programmatically without
- * leaving the JVM network stack.
- */
-@Service
-@Slf4j
-public class InternalApiClient {
-
-    // Allowlist for internal dispatch. Matches a fixed namespace prefix,
-    // but rejects traversal (..), URL-encoding (%), query/fragment, backslashes, and any other
-    // character that could alter the resolved endpoint on the local Spring server.
-    private static final Pattern ALLOWED_ENDPOINT_PATH =
-            Pattern.compile("^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$");
-
-    private final ServletContext servletContext;
-    private final UserServiceInterface userService;
-    private final TempFileManager tempFileManager;
-    private final Environment environment;
-
-    public InternalApiClient(
-            ServletContext servletContext,
-            @Autowired(required = false) UserServiceInterface userService,
-            TempFileManager tempFileManager,
-            Environment environment) {
-        this.servletContext = servletContext;
-        this.userService = userService;
-        this.tempFileManager = tempFileManager;
-        this.environment = environment;
-    }
-
-    /**
-     * POST to an internal API endpoint. The endpointPath must start with one of the allowed
-     * prefixes (e.g. {@code /api/v1/misc/compress-pdf}).
-     *
-     * @param endpointPath API path (e.g. {@code /api/v1/general/rotate-pdf})
-     * @param body multipart form body (fileInput + parameters)
-     * @return response with the result file as a {@link TempFileResource} body
-     */
-    public ResponseEntity<Resource> post(String endpointPath, MultiValueMap<String, Object> body) {
-        validateUrl(endpointPath);
-        String url = getBaseUrl() + endpointPath;
-
-        RestTemplate restTemplate = new RestTemplate();
-        HttpHeaders headers = new HttpHeaders();
-        String apiKey = getApiKeyForUser();
-        if (apiKey != null && !apiKey.isEmpty()) {
-            headers.add("X-API-KEY", apiKey);
-        }
-
-        HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
-        RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);
-
-        return restTemplate.execute(
-                url,
-                HttpMethod.POST,
-                requestCallback,
-                response -> {
-                    try {
-                        TempFile tempFile = tempFileManager.createManagedTempFile("internal-api");
-                        Files.copy(
-                                response.getBody(),
-                                tempFile.getPath(),
-                                java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-                        String filename = extractFilename(response.getHeaders());
-                        TempFileResource resource = new TempFileResource(tempFile, filename);
-                        return ResponseEntity.status(response.getStatusCode())
-                                .headers(response.getHeaders())
-                                .body(resource);
-                    } catch (IOException e) {
-                        throw new UncheckedIOException(e);
-                    }
-                });
-    }
-
-    /**
-     * Extract the filename from a response's {@code Content-Disposition} header. Returns {@code
-     * null} if the header is missing or has no filename.
-     */
-    private static String extractFilename(HttpHeaders headers) {
-        String contentDisposition = headers.getFirst(HttpHeaders.CONTENT_DISPOSITION);
-        if (contentDisposition == null || contentDisposition.isBlank()) {
-            return null;
-        }
-        for (String part : contentDisposition.split(";")) {
-            String trimmed = part.trim();
-            if (trimmed.startsWith("filename")) {
-                String[] kv = trimmed.split("=", 2);
-                if (kv.length != 2) {
-                    continue;
-                }
-                String value = kv[1].trim().replace("\"", "");
-                return URLDecoder.decode(value, StandardCharsets.UTF_8);
-            }
-        }
-        return null;
-    }
-
-    private String getBaseUrl() {
-        // Resolve the port lazily so desktop mode (server.port=0, OS-assigned) dispatches to the
-        // actual bound port. Spring publishes local.server.port once the web server is up; fall
-        // back to the configured server.port for early calls (tests, non-web contexts).
-        String port = environment.getProperty("local.server.port");
-        if (port == null) {
-            port = environment.getProperty("server.port", "8080");
-        }
-        return "http://localhost:" + port + servletContext.getContextPath();
-    }
-
-    private String getApiKeyForUser() {
-        if (userService == null) return "";
-        String username = userService.getCurrentUsername();
-        if (username != null && !username.equals("anonymousUser")) {
-            return userService.getApiKeyForUser(username);
-        }
-        return userService.getApiKeyForUser(Role.INTERNAL_API_USER.getRoleId());
-    }
-
-    private void validateUrl(String endpointPath) {
-        if (endpointPath == null || !ALLOWED_ENDPOINT_PATH.matcher(endpointPath).matches()) {
-            log.warn("Blocked internal API request to disallowed path: {}", endpointPath);
-            throw new SecurityException(
-                    "Internal API dispatch not permitted for endpoint: " + endpointPath);
-        }
-    }
-
-    /**
-     * A {@link FileSystemResource} that holds a reference to its backing {@link TempFile}.
-     *
-     * <p>If a display filename is supplied (typically parsed from the upstream response's {@code
-     * Content-Disposition} header), it is returned from {@link #getFilename()} instead of the
-     * underlying temp file's path-based name.
-     */
-    public static class TempFileResource extends FileSystemResource {
-        private final TempFile tempFile;
-        private final String displayFilename;
-
-        public TempFileResource(TempFile tempFile) {
-            this(tempFile, null);
-        }
-
-        public TempFileResource(TempFile tempFile, String displayFilename) {
-            super(tempFile.getFile());
-            this.tempFile = tempFile;
-            this.displayFilename = displayFilename;
-        }
-
-        public TempFile getTempFile() {
-            return tempFile;
-        }
-
-        @Override
-        public String getFilename() {
-            return displayFilename != null ? displayFilename : super.getFilename();
-        }
-    }
-}
@@ -16,7 +16,6 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import jakarta.servlet.http.HttpServletRequest;

@@ -36,7 +35,7 @@ public class JobExecutorService {
    private final HttpServletRequest request;
    private final ResourceMonitor resourceMonitor;
    private final JobQueue jobQueue;
-    private final ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
+    private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
    private final long effectiveTimeoutMs;

    @Autowired(required = false)
@@ -254,25 +253,6 @@ public class JobExecutorService {
                log.error("Synchronous job timed out after {} ms", timeoutToUse);
                return ResponseEntity.internalServerError()
                        .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
-            } catch (RuntimeException e) {
-                // Check if this is a typed exception that should be handled by
-                // GlobalExceptionHandler (either directly or wrapped)
-                Throwable cause = e.getCause();
-                if (e instanceof IllegalArgumentException
-                        || cause
-                                instanceof
-                                stirling.software.common.util.ExceptionUtils.BaseAppException
-                        || cause
-                                instanceof
-                                stirling.software.common.util.ExceptionUtils
-                                        .BaseValidationException) {
-                    // Rethrow so GlobalExceptionHandler can handle with proper HTTP status codes
-                    throw e;
-                }
-                // Handle other RuntimeExceptions as generic errors
-                log.error("Error executing synchronous job: {}", e.getMessage(), e);
-                return ResponseEntity.internalServerError()
-                        .body(Map.of("error", "Job failed: " + e.getMessage()));
            } catch (Exception e) {
                log.error("Error executing synchronous job: {}", e.getMessage(), e);
                // Construct a JSON error response
@@ -306,21 +286,33 @@ public class JobExecutorService {
                Object body = response.getBody();

                if (body instanceof byte[]) {
-                    String filename = extractResponseFilename(response);
-                    String contentType = extractResponseContentType(response);
+                    // Extract filename from content-disposition header if available
+                    String filename = "result.pdf";
+                    String contentType = MediaType.APPLICATION_PDF_VALUE;

+                    if (response.getHeaders().getContentDisposition() != null) {
+                        String disposition =
+                                response.getHeaders().getContentDisposition().toString();
+                        if (disposition.contains("filename=")) {
+                            filename =
+                                    disposition.substring(
+                                            disposition.indexOf("filename=") + 9,
+                                            disposition.lastIndexOf("\""));
+                        }
+                    }
+
+                    MediaType mediaType = response.getHeaders().getContentType();
+
+                    if (mediaType != null) {
+                        contentType = mediaType.toString();
+                    }
+
+                    // Store byte array directly to disk
                    String fileId = fileStorage.storeBytes((byte[]) body, filename);
                    taskManager.setFileResult(jobId, fileId, filename, contentType);
                    log.debug("Stored ResponseEntity<byte[]> result with fileId: {}", fileId);
-                } else if (body instanceof StreamingResponseBody streamingBody) {
-                    String filename = extractResponseFilename(response);
-                    String contentType = extractResponseContentType(response);

-                    String fileId = fileStorage.storeFromStreamingBody(streamingBody, filename);
-                    taskManager.setFileResult(jobId, fileId, filename, contentType);
-                    log.debug(
-                            "Stored ResponseEntity<StreamingResponseBody> result with fileId: {}",
-                            fileId);
+                    // Let the GC handle the memory naturally
                } else {
                    // Check if the response body contains a fileId
                    if (body != null && body.toString().contains("fileId")) {
@@ -470,21 +462,6 @@ public class JobExecutorService {
        }
    }

-    private static String extractResponseFilename(ResponseEntity<?> response) {
-        if (response.getHeaders().getContentDisposition() != null) {
-            String filename = response.getHeaders().getContentDisposition().getFilename();
-            if (filename != null && !filename.isEmpty()) {
-                return filename;
-            }
-        }
-        return "result.pdf";
-    }
-
-    private static String extractResponseContentType(ResponseEntity<?> response) {
-        MediaType mediaType = response.getHeaders().getContentType();
-        return mediaType != null ? mediaType.toString() : MediaType.APPLICATION_PDF_VALUE;
-    }
-
    /**
     * Parse session timeout string (e.g., "30m", "1h") to milliseconds
     *
@@ -44,10 +44,8 @@ public class JobQueue implements SmartLifecycle {

    private volatile BlockingQueue<QueuedJob> jobQueue;
    private final Map<String, QueuedJob> jobMap = new ConcurrentHashMap<>();
-    private final ScheduledExecutorService scheduler =
-            Executors.newSingleThreadScheduledExecutor(
-                    Thread.ofVirtual().name("job-queue-scheduler-", 0).factory());
-    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualThreadExecutor();
+    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
    private final Object queueLock = new Object(); // Lock for synchronizing queue operations

    private boolean shuttingDown = false;
@@ -401,7 +399,7 @@ public class JobQueue implements SmartLifecycle {
     * @throws Exception If there is an execution error
     */
    private <T> T executeWithTimeout(Supplier<T> supplier, long timeoutMs) throws Exception {
-        CompletableFuture<T> future = CompletableFuture.supplyAsync(supplier, jobExecutor);
+        CompletableFuture<T> future = CompletableFuture.supplyAsync(supplier);

        try {
            if (timeoutMs <= 0) {
@@ -1,29 +0,0 @@
-package stirling.software.common.service;
-
-/**
- * Interface for checking license status dynamically. Implementation provided by proprietary module
- * when available.
- */
-public interface LicenseServiceInterface {
-
-    /**
-     * Get the license type as a string.
-     *
-     * @return "NORMAL", "SERVER", or "ENTERPRISE"
-     */
-    String getLicenseTypeName();
-
-    /**
-     * Check if running Pro or higher (SERVER or ENTERPRISE license).
-     *
-     * @return true if SERVER or ENTERPRISE license is active
-     */
-    boolean isRunningProOrHigher();
-
-    /**
-     * Check if running Enterprise edition.
-     *
-     * @return true if ENTERPRISE license is active
-     */
-    boolean isRunningEE();
-}
@@ -1,443 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.regex.Pattern;
-
-import org.springframework.scheduling.annotation.Scheduled;
-import org.springframework.stereotype.Service;
-import org.springframework.web.multipart.MultipartFile;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Service for handling mobile scanner file uploads and temporary storage. Files are stored
- * temporarily and automatically cleaned up after 10 minutes or upon retrieval.
- */
-@Service
-@Slf4j
-public class MobileScannerService {
-
-    private static final long SESSION_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
-    private static final Pattern FILENAME_SANITIZE_PATTERN = Pattern.compile("[^a-zA-Z0-9._-]");
-    private static final Pattern SESSION_ID_VALIDATION_PATTERN = Pattern.compile("[a-zA-Z0-9-]+");
-    private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
-    private final Map<String, SessionData> activeSessions = new ConcurrentHashMap<>();
-    private final Path tempDirectory;
-
-    public MobileScannerService() throws IOException {
-        // Create temp directory for mobile scanner uploads
-        this.tempDirectory =
-                Paths.get(System.getProperty("java.io.tmpdir"), "stirling-mobile-scanner");
-        Files.createDirectories(tempDirectory);
-        log.info("Mobile scanner temp directory: {}", tempDirectory);
-    }
-
-    /**
-     * Register a new session (called by desktop when QR code is generated)
-     *
-     * @param sessionId Unique session identifier
-     * @return SessionInfo with creation time and expiry
-     */
-    public SessionInfo createSession(String sessionId) {
-        validateSessionId(sessionId);
-
-        SessionData session = new SessionData(sessionId);
-        activeSessions.put(sessionId, session);
-
-        log.info("Created mobile scanner session: {}", sessionId);
-        return new SessionInfo(
-                sessionId,
-                session.createdAt,
-                session.createdAt + SESSION_TIMEOUT_MS,
-                SESSION_TIMEOUT_MS);
-    }
-
-    /**
-     * Validate if a session exists and is not expired
-     *
-     * @param sessionId Session identifier to validate
-     * @return SessionInfo if valid, null if invalid/expired
-     */
-    public SessionInfo validateSession(String sessionId) {
-        SessionData session = activeSessions.get(sessionId);
-        if (session == null) {
-            return null;
-        }
-
-        long now = System.currentTimeMillis();
-        long expiryTime = session.getLastAccessTime() + SESSION_TIMEOUT_MS;
-
-        // Check if expired
-        if (now > expiryTime) {
-            deleteSession(sessionId);
-            return null;
-        }
-
-        session.updateLastAccess();
-        return new SessionInfo(sessionId, session.createdAt, expiryTime, SESSION_TIMEOUT_MS);
-    }
-
-    /**
-     * Stores uploaded files for a session
-     *
-     * @param sessionId Unique session identifier
-     * @param files Files to upload
-     * @throws IOException If file storage fails
-     */
-    public void uploadFiles(String sessionId, List<MultipartFile> files) throws IOException {
-        validateSessionId(sessionId);
-
-        SessionData session =
-                activeSessions.computeIfAbsent(sessionId, id -> new SessionData(sessionId));
-
-        // Create session directory
-        Path sessionDir = getSafeSessionDirectory(sessionId);
-        Files.createDirectories(sessionDir);
-
-        // Save each file
-        for (MultipartFile file : files) {
-            if (file.isEmpty()) {
-                continue;
-            }
-
-            String originalFilename = file.getOriginalFilename();
-            if (originalFilename == null || originalFilename.isBlank()) {
-                originalFilename = "upload-" + System.currentTimeMillis();
-            }
-
-            // Sanitize filename
-            String safeFilename = sanitizeFilename(originalFilename);
-            Path filePath = sessionDir.resolve(safeFilename).normalize().toAbsolutePath();
-
-            // Ensure resulting path stays within the session directory
-            if (!filePath.startsWith(sessionDir)) {
-                throw new IOException("Invalid filename");
-            }
-
-            // Handle duplicate filenames
-            int counter = 1;
-            while (Files.exists(filePath)) {
-                String nameWithoutExt =
-                        FILE_EXTENSION_PATTERN.matcher(safeFilename).replaceFirst("");
-                String ext =
-                        safeFilename.contains(".")
-                                ? safeFilename.substring(safeFilename.lastIndexOf('.'))
-                                : "";
-                safeFilename = nameWithoutExt + "-" + counter + ext;
-                filePath = sessionDir.resolve(safeFilename).normalize().toAbsolutePath();
-                if (!filePath.startsWith(sessionDir)) {
-                    throw new IOException("Invalid filename");
-                }
-                counter++;
-            }
-
-            file.transferTo(filePath);
-            session.addFile(new FileMetadata(safeFilename, file.getSize(), file.getContentType()));
-            log.info(
-                    "Uploaded file for session {}: {} ({} bytes)",
-                    sessionId,
-                    safeFilename,
-                    file.getSize());
-        }
-
-        session.updateLastAccess();
-    }
-
-    /**
-     * Retrieves file metadata for a session
-     *
-     * @param sessionId Session identifier
-     * @return List of file metadata, or empty list if session doesn't exist
-     */
-    public List<FileMetadata> getSessionFiles(String sessionId) {
-        SessionData session = activeSessions.get(sessionId);
-        if (session == null) {
-            return List.of();
-        }
-        session.updateLastAccess();
-        return new ArrayList<>(session.getFiles());
-    }
-
-    /**
-     * Retrieves actual file data for download
-     *
-     * @param sessionId Session identifier
-     * @param filename Filename to retrieve
-     * @return File path
-     * @throws IOException If file not found or session doesn't exist
-     */
-    public Path getFile(String sessionId, String filename) throws IOException {
-        SessionData session = activeSessions.get(sessionId);
-        if (session == null) {
-            throw new IOException("Session not found: " + sessionId);
-        }
-
-        Path filePath = getSafeFilePath(sessionId, filename);
-        if (!Files.exists(filePath)) {
-            throw new IOException("File not found: " + filename);
-        }
-
-        session.updateLastAccess();
-        session.markFileAsDownloaded(filename);
-        return filePath;
-    }
-
-    /**
-     * Deletes a file after it has been served to the client. Should be called after successful
-     * download.
-     *
-     * @param sessionId Session identifier
-     * @param filename Filename to delete
-     */
-    public void deleteFileAfterDownload(String sessionId, String filename) {
-        try {
-            Path filePath = getSafeFilePath(sessionId, filename);
-            Files.deleteIfExists(filePath);
-            log.info("Deleted file after download: {}/{}", sessionId, filename);
-
-            // Check if all files have been downloaded - if so, delete the entire session
-            SessionData session = activeSessions.get(sessionId);
-            if (session != null && session.allFilesDownloaded()) {
-                deleteSession(sessionId);
-                log.info("All files downloaded - deleted session: {}", sessionId);
-            }
-        } catch (IOException | IllegalArgumentException e) {
-            log.warn("Failed to delete file after download: {}/{}", sessionId, filename, e);
-        }
-    }
-
-    /**
-     * Deletes a session and all its files
-     *
-     * @param sessionId Session to delete
-     */
-    public void deleteSession(String sessionId) {
-        SessionData session = activeSessions.remove(sessionId);
-        if (session != null) {
-            try {
-                Path sessionDir = getSafeSessionDirectory(sessionId);
-                if (Files.exists(sessionDir)) {
-                    // Delete all files in session directory
-                    Files.walk(sessionDir)
-                            .sorted(
-                                    (a, b) ->
-                                            -a.compareTo(b)) // Reverse order to delete files before
-                            // directory
-                            .forEach(
-                                    path -> {
-                                        try {
-                                            Files.deleteIfExists(path);
-                                        } catch (IOException e) {
-                                            log.warn("Failed to delete file: {}", path, e);
-                                        }
-                                    });
-                }
-                log.info("Deleted session: {}", sessionId);
-            } catch (IllegalArgumentException e) {
-                log.warn(
-                        "Refused to delete session with invalid sessionId '{}': {}",
-                        sessionId,
-                        e.getMessage());
-            } catch (IOException e) {
-                log.error("Error deleting session directory: {}", sessionId, e);
-            }
-        }
-    }
-
-    /** Scheduled cleanup of expired sessions (runs every 5 minutes) */
-    @Scheduled(fixedRate = 5 * 60 * 1000)
-    public void cleanupExpiredSessions() {
-        long now = System.currentTimeMillis();
-        List<String> expiredSessions = new ArrayList<>();
-
-        activeSessions.forEach(
-                (sessionId, session) -> {
-                    if (now - session.getLastAccessTime() > SESSION_TIMEOUT_MS) {
-                        expiredSessions.add(sessionId);
-                    }
-                });
-
-        if (!expiredSessions.isEmpty()) {
-            log.info("Cleaning up {} expired mobile scanner sessions", expiredSessions.size());
-            expiredSessions.forEach(this::deleteSession);
-        }
-    }
-
-    private void validateSessionId(String sessionId) {
-        if (sessionId == null || sessionId.isBlank()) {
-            throw new IllegalArgumentException("Session ID cannot be empty");
-        }
-        // Basic validation: alphanumeric and hyphens only
-        if (!SESSION_ID_VALIDATION_PATTERN.matcher(sessionId).matches()) {
-            throw new IllegalArgumentException("Invalid session ID format");
-        }
-    }
-
-    private String sanitizeFilename(String filename) {
-        // Remove path traversal attempts and dangerous characters
-        String sanitized = FILENAME_SANITIZE_PATTERN.matcher(filename).replaceAll("_");
-        // Ensure we have a non-empty, safe filename
-        if (sanitized.isBlank()) {
-            sanitized = "upload-" + System.currentTimeMillis();
-        }
-        return sanitized;
-    }
-
-    /**
-     * Safely resolves and validates a session directory path to prevent directory traversal
-     * attacks.
-     *
-     * @param sessionId Session identifier
-     * @return Normalized absolute path to the session directory
-     * @throws IllegalArgumentException if the resolved path escapes the temp directory
-     */
-    private Path getSafeSessionDirectory(String sessionId) {
-        validateSessionId(sessionId);
-
-        Path baseDir = tempDirectory.normalize().toAbsolutePath();
-        Path sessionDir = baseDir.resolve(sessionId).normalize().toAbsolutePath();
-
-        // Verify the resolved path is still within the temp directory
-        if (!sessionDir.startsWith(baseDir)) {
-            throw new IllegalArgumentException("Invalid session ID: path traversal detected");
-        }
-
-        return sessionDir;
-    }
-
-    /**
-     * Safely resolves and validates a file path within a session directory to prevent directory
-     * traversal attacks.
-     *
-     * @param sessionId Session identifier
-     * @param filename Filename within the session
-     * @return Normalized absolute path to the file
-     * @throws IOException if the resolved path escapes the session directory
-     */
-    private Path getSafeFilePath(String sessionId, String filename) throws IOException {
-        if (filename == null || filename.isBlank()) {
-            throw new IOException("Filename cannot be empty");
-        }
-
-        // Additional validation: reject filenames with path separators or parent references
-        if (filename.contains("..") || filename.contains("/") || filename.contains("\\")) {
-            throw new IOException(
-                    "Invalid filename: contains path separators or parent references");
-        }
-
-        Path sessionDir = getSafeSessionDirectory(sessionId);
-        Path filePath = sessionDir.resolve(filename).normalize().toAbsolutePath();
-
-        // Verify the resolved path is still within the session directory
-        if (!filePath.startsWith(sessionDir)) {
-            throw new IOException("Invalid filename: path traversal detected");
-        }
-
-        return filePath;
-    }
-
-    /** Session information for client */
-    public static class SessionInfo {
-        private final String sessionId;
-        private final long createdAt;
-        private final long expiresAt;
-        private final long timeoutMs;
-
-        public SessionInfo(String sessionId, long createdAt, long expiresAt, long timeoutMs) {
-            this.sessionId = sessionId;
-            this.createdAt = createdAt;
-            this.expiresAt = expiresAt;
-            this.timeoutMs = timeoutMs;
-        }
-
-        public String getSessionId() {
-            return sessionId;
-        }
-
-        public long getCreatedAt() {
-            return createdAt;
-        }
-
-        public long getExpiresAt() {
-            return expiresAt;
-        }
-
-        public long getTimeoutMs() {
-            return timeoutMs;
-        }
-    }
-
-    /** File metadata for client */
-    public static class FileMetadata {
-        private final String filename;
-        private final long size;
-        private final String contentType;
-
-        public FileMetadata(String filename, long size, String contentType) {
-            this.filename = filename;
-            this.size = size;
-            this.contentType = contentType;
-        }
-
-        public String getFilename() {
-            return filename;
-        }
-
-        public long getSize() {
-            return size;
-        }
-
-        public String getContentType() {
-            return contentType;
-        }
-    }
-
-    /** Session data tracking */
-    private static class SessionData {
-        private final String sessionId;
-        private final List<FileMetadata> files = new ArrayList<>();
-        private final Map<String, Boolean> downloadedFiles = new HashMap<>();
-        private final long createdAt;
-        private long lastAccessTime;
-
-        public SessionData(String sessionId) {
-            this.sessionId = sessionId;
-            this.createdAt = System.currentTimeMillis();
-            this.lastAccessTime = createdAt;
-        }
-
-        public void addFile(FileMetadata file) {
-            files.add(file);
-            downloadedFiles.put(file.getFilename(), false);
-        }
-
-        public List<FileMetadata> getFiles() {
-            return files;
-        }
-
-        public void markFileAsDownloaded(String filename) {
-            downloadedFiles.put(filename, true);
-        }
-
-        public boolean allFilesDownloaded() {
-            return !downloadedFiles.isEmpty()
-                    && downloadedFiles.values().stream().allMatch(downloaded -> downloaded);
-        }
-
-        public void updateLastAccess() {
-            this.lastAccessTime = System.currentTimeMillis();
-        }
-
-        public long getLastAccessTime() {
-            return lastAccessTime;
-        }
-    }
-}
@@ -169,10 +169,7 @@ public class PdfMetadataService {
                            .getAuthor();

            if (userService != null) {
-                String username = userService.getCurrentUsername();
-                if (username != null) {
-                    author = author.replace("username", username);
-                }
+                author = author.replace("username", userService.getCurrentUsername());
            }
        }
        pdf.getDocumentInformation().setAuthor(author);
@@ -1,37 +0,0 @@
-package stirling.software.common.service;
-
-import java.security.KeyStore;
-
-/**
- * Abstraction for PDF digital signature operations. Defined in common so that proprietary services
- * can use it without creating a circular dependency on core.
- */
-public interface PdfSigningService {
-
-    /**
-     * Signs a PDF document using the provided KeyStore.
-     *
-     * @param pdfBytes raw PDF bytes to sign
-     * @param keystore the KeyStore containing the signing key and certificate chain
-     * @param password keystore password
-     * @param showSignature whether to render a visible signature block
-     * @param pageNumber 0-indexed page on which to render the visible signature (may be null)
-     * @param name signer name embedded in the signature
-     * @param location location string embedded in the signature
-     * @param reason reason string embedded in the signature
-     * @param showLogo whether to include the Stirling-PDF logo in the visible signature
-     * @return signed PDF bytes
-     * @throws Exception on any signing failure
-     */
-    byte[] signWithKeystore(
-            byte[] pdfBytes,
-            KeyStore keystore,
-            char[] password,
-            boolean showSignature,
-            Integer pageNumber,
-            String name,
-            String location,
-            String reason,
-            boolean showLogo)
-            throws Exception;
-}
@@ -7,8 +7,11 @@ import java.lang.management.MemoryMXBean;
 import java.lang.management.OperatingSystemMXBean;
 import java.lang.management.RuntimeMXBean;
 import java.lang.management.ThreadMXBean;
+import java.net.InetAddress;
+import java.net.NetworkInterface;
 import java.nio.file.Files;
 import java.nio.file.Paths;
+import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
@@ -91,12 +94,21 @@ public class PostHogService {
            metrics.put("os_name", System.getProperty("os.name"));
            metrics.put("os_version", System.getProperty("os.version"));
            metrics.put("java_version", System.getProperty("java.version"));
+            metrics.put("user_name", System.getProperty("user.name"));
+            metrics.put("user_home", System.getProperty("user.home"));
+            metrics.put("user_dir", System.getProperty("user.dir"));

            // CPU and Memory
            metrics.put("cpu_cores", Runtime.getRuntime().availableProcessors());
            metrics.put("total_memory", Runtime.getRuntime().totalMemory());
            metrics.put("free_memory", Runtime.getRuntime().freeMemory());

+            // Network and Server Identity
+            InetAddress localHost = InetAddress.getLocalHost();
+            metrics.put("ip_address", localHost.getHostAddress());
+            metrics.put("hostname", localHost.getHostName());
+            metrics.put("mac_address", getMacAddress());
+
            // JVM info
            metrics.put("jvm_vendor", System.getProperty("java.vendor"));
            metrics.put("jvm_version", System.getProperty("java.vm.version"));
@@ -141,6 +153,9 @@ public class PostHogService {
                metrics.put("gc_" + gcBean.getName() + "_time", gcBean.getCollectionTime());
            }

+            // Network interfaces
+            metrics.put("network_interfaces", getNetworkInterfacesInfo());
+
            // Docker detection and stats
            boolean isDocker = isRunningInDocker();
            if (isDocker) {
@@ -238,7 +253,7 @@ public class PostHogService {
        addIfNotEmpty(
                properties,
                "security_enableLogin",
-                applicationProperties.getSecurity().isEnableLogin());
+                applicationProperties.getSecurity().getEnableLogin());
        addIfNotEmpty(properties, "security_csrfDisabled", true);
        addIfNotEmpty(
                properties,
@@ -284,13 +299,13 @@ public class PostHogService {
        addIfNotEmpty(
                properties,
                "system_googlevisibility",
-                applicationProperties.getSystem().isGooglevisibility());
+                applicationProperties.getSystem().getGooglevisibility());
        addIfNotEmpty(
                properties, "system_showUpdate", applicationProperties.getSystem().isShowUpdate());
        addIfNotEmpty(
                properties,
                "system_showUpdateOnlyAdmin",
-                applicationProperties.getSystem().isShowUpdateOnlyAdmin());
+                applicationProperties.getSystem().getShowUpdateOnlyAdmin());
        addIfNotEmpty(
                properties,
                "system_customHTMLFiles",
@@ -302,7 +317,7 @@ public class PostHogService {
        addIfNotEmpty(
                properties,
                "system_enableAlphaFunctionality",
-                applicationProperties.getSystem().isEnableAlphaFunctionality());
+                applicationProperties.getSystem().getEnableAlphaFunctionality());
        addIfNotEmpty(
                properties,
                "system_enableAnalytics",
@@ -322,7 +337,7 @@ public class PostHogService {

        // Capture Metrics properties
        addIfNotEmpty(
-                properties, "metrics_enabled", applicationProperties.getMetrics().isEnabled());
+                properties, "metrics_enabled", applicationProperties.getMetrics().getEnabled());

        // Capture EnterpriseEdition properties
        addIfNotEmpty(
@@ -338,6 +353,30 @@ public class PostHogService {
                            .getProFeatures()
                            .getCustomMetadata()
                            .isAutoUpdateMetadata());
+            addIfNotEmpty(
+                    properties,
+                    "enterpriseEdition_customMetadata_author",
+                    applicationProperties
+                            .getPremium()
+                            .getProFeatures()
+                            .getCustomMetadata()
+                            .getAuthor());
+            addIfNotEmpty(
+                    properties,
+                    "enterpriseEdition_customMetadata_creator",
+                    applicationProperties
+                            .getPremium()
+                            .getProFeatures()
+                            .getCustomMetadata()
+                            .getCreator());
+            addIfNotEmpty(
+                    properties,
+                    "enterpriseEdition_customMetadata_producer",
+                    applicationProperties
+                            .getPremium()
+                            .getProFeatures()
+                            .getCustomMetadata()
+                            .getProducer());
        }
        // Capture AutoPipeline properties
        addIfNotEmpty(
@@ -347,4 +386,39 @@ public class PostHogService {

        return properties;
    }
+
+    private String getMacAddress() {
+        try {
+            Enumeration<NetworkInterface> networkInterfaces =
+                    NetworkInterface.getNetworkInterfaces();
+            while (networkInterfaces.hasMoreElements()) {
+                NetworkInterface ni = networkInterfaces.nextElement();
+                byte[] hardwareAddress = ni.getHardwareAddress();
+                if (hardwareAddress != null) {
+                    String[] hexadecimal = new String[hardwareAddress.length];
+                    for (int i = 0; i < hardwareAddress.length; i++) {
+                        hexadecimal[i] = String.format("%02X", hardwareAddress[i]);
+                    }
+                    return String.join("-", hexadecimal);
+                }
+            }
+        } catch (Exception e) {
+            // Handle exception
+        }
+        return "Unknown";
+    }
+
+    private Map<String, String> getNetworkInterfacesInfo() {
+        Map<String, String> interfacesInfo = new HashMap<>();
+        try {
+            Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
+            while (nets.hasMoreElements()) {
+                NetworkInterface netint = nets.nextElement();
+                interfacesInfo.put(netint.getName(), netint.getDisplayName());
+            }
+        } catch (Exception e) {
+            interfacesInfo.put("error", e.getMessage());
+        }
+        return interfacesInfo;
+    }
 }
@@ -5,7 +5,6 @@ import java.lang.management.MemoryMXBean;
 import java.lang.management.OperatingSystemMXBean;
 import java.time.Duration;
 import java.time.Instant;
-import java.util.Locale;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -43,9 +42,7 @@ public class ResourceMonitor {
    @Value("${stirling.resource.monitor.interval-ms:60000}")
    private long monitorIntervalMs = 60000; // 60 seconds

-    private final ScheduledExecutorService scheduler =
-            Executors.newSingleThreadScheduledExecutor(
-                    Thread.ofVirtual().name("resource-monitor-", 0).factory());
+    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
    private final MemoryMXBean memoryMXBean = ManagementFactory.getMemoryMXBean();
    private final OperatingSystemMXBean osMXBean = ManagementFactory.getOperatingSystemMXBean();

@@ -176,8 +173,8 @@ public class ResourceMonitor {
                log.info("System resource status changed from {} to {}", oldStatus, newStatus);
                log.info(
                        "Current metrics - CPU: {}%, Memory: {}%, Free Memory: {} MB",
-                        String.format(Locale.ROOT, "%.1f", cpuUsage * 100),
-                        String.format(Locale.ROOT, "%.1f", memoryUsage * 100),
+                        String.format("%.1f", cpuUsage * 100),
+                        String.format("%.1f", memoryUsage * 100),
                        freeMemory / (1024 * 1024));
            }
        } catch (Exception e) {
@@ -5,7 +5,6 @@ import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.URI;
 import java.net.UnknownHostException;
-import java.util.Locale;
 import java.util.regex.Pattern;

 import org.springframework.stereotype.Service;
@@ -84,7 +83,7 @@ public class SsrfProtectionService {
                return false;
            }

-            return config.getAllowedDomains().contains(host.toLowerCase(Locale.ROOT));
+            return config.getAllowedDomains().contains(host.toLowerCase());

        } catch (Exception e) {
            log.debug("Failed to parse URL for MAX security check: {}", url, e);
@@ -102,7 +101,7 @@ public class SsrfProtectionService {
                return false;
            }

-            String hostLower = host.toLowerCase(Locale.ROOT);
+            String hostLower = host.toLowerCase();

            // Check explicit blocked domains
            if (config.getBlockedDomains().contains(hostLower)) {
@@ -112,7 +111,7 @@ public class SsrfProtectionService {

            // Check internal TLD patterns
            for (String tld : config.getInternalTlds()) {
-                if (hostLower.endsWith(tld.toLowerCase(Locale.ROOT))) {
+                if (hostLower.endsWith(tld.toLowerCase())) {
                    log.debug("URL blocked by internal TLD pattern '{}': {}", tld, url);
                    return false;
                }
@@ -124,11 +123,9 @@ public class SsrfProtectionService {
                        config.getAllowedDomains().stream()
                                .anyMatch(
                                        domain ->
-                                                hostLower.equals(domain.toLowerCase(Locale.ROOT))
+                                                hostLower.equals(domain.toLowerCase())
                                                        || hostLower.endsWith(
-                                                                "."
-                                                                        + domain.toLowerCase(
-                                                                                Locale.ROOT)));
+                                                                "." + domain.toLowerCase()));

                if (!isAllowed) {
                    log.debug("URL not in allowed domains list: {}", url);
@@ -226,11 +223,10 @@ public class SsrfProtectionService {
    }

    private boolean isPrivateIPv4Range(String ip) {
-        // Includes RFC1918, RFC6598, loopback, link-local, and unspecified addresses
+        // Includes RFC1918, loopback, link-local, and unspecified addresses
        return ip.startsWith("10.")
                || ip.startsWith("192.168.")
                || (ip.startsWith("172.") && isInRange172(ip))
-                || (ip.startsWith("100.") && isInRange100(ip))
                || ip.startsWith("169.254.")
                || ip.startsWith("127.")
                || "0.0.0.0".equals(ip);
@@ -248,18 +244,6 @@ public class SsrfProtectionService {
        return false;
    }

-    private boolean isInRange100(String ip) {
-        String[] parts = ip.split("\\.");
-        if (parts.length >= 2) {
-            try {
-                int secondOctet = Integer.parseInt(parts[1]);
-                return secondOctet >= 64 && secondOctet <= 127;
-            } catch (NumberFormatException e) {
-            }
-        }
-        return false;
-    }
-
    private boolean isCloudMetadataAddress(String ip) {
        String normalizedIp = normalizeIpv4MappedAddress(ip);
        // Cloud metadata endpoints for AWS, GCP, Azure, Oracle Cloud, and IBM Cloud
@@ -1,13 +1,12 @@
 package stirling.software.common.service;

-import java.io.BufferedInputStream;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.time.LocalDateTime;
 import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Locale;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Executors;
@@ -19,6 +18,7 @@ import java.util.zip.ZipInputStream;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;

 import io.github.pixee.security.ZipSecurity;

@@ -41,8 +41,7 @@ public class TaskManager {

    private final FileStorage fileStorage;
    private final ScheduledExecutorService cleanupExecutor =
-            Executors.newSingleThreadScheduledExecutor(
-                    Thread.ofVirtual().name("task-cleanup-", 0).factory());
+            Executors.newSingleThreadScheduledExecutor();

    /** Initialize the task manager and start the cleanup scheduler */
    public TaskManager(FileStorage fileStorage) {
@@ -102,16 +101,14 @@ public class TaskManager {
                if (!extractedFiles.isEmpty()) {
                    jobResult.completeWithFiles(extractedFiles);
                    log.debug(
-                            "Set multiple file results for job ID: {} with {} files extracted from"
-                                    + " ZIP",
+                            "Set multiple file results for job ID: {} with {} files extracted from ZIP",
                            jobId,
                            extractedFiles.size());
                    return;
                }
            } catch (Exception e) {
                log.warn(
-                        "Failed to extract ZIP file for job {}: {}. Falling back to single file"
-                                + " result.",
+                        "Failed to extract ZIP file for job {}: {}. Falling back to single file result.",
                        jobId,
                        e.getMessage());
            }
@@ -345,12 +342,12 @@ public class TaskManager {
    /** Check if a file is a ZIP file based on content type and filename */
    private boolean isZipFile(String contentType, String fileName) {
        if (contentType != null
-                && ("application/zip".equals(contentType)
-                        || "application/x-zip-compressed".equals(contentType))) {
+                && (contentType.equals("application/zip")
+                        || contentType.equals("application/x-zip-compressed"))) {
            return true;
        }

-        if (fileName != null && fileName.toLowerCase(Locale.ROOT).endsWith(".zip")) {
+        if (fileName != null && fileName.toLowerCase().endsWith(".zip")) {
            return true;
        }

@@ -362,29 +359,39 @@ public class TaskManager {
            String zipFileId, String originalZipFileName) throws IOException {
        List<ResultFile> extractedFiles = new ArrayList<>();

-        try (InputStream fileStream = fileStorage.retrieveInputStream(zipFileId);
-                ZipInputStream zipIn =
-                        ZipSecurity.createHardenedInputStream(
-                                new BufferedInputStream(fileStream))) {
+        MultipartFile zipFile = fileStorage.retrieveFile(zipFileId);
+
+        try (ZipInputStream zipIn =
+                ZipSecurity.createHardenedInputStream(
+                        new ByteArrayInputStream(zipFile.getBytes()))) {
            ZipEntry entry;
            while ((entry = zipIn.getNextEntry()) != null) {
                if (!entry.isDirectory()) {
+                    // Use buffered reading for memory safety
+                    ByteArrayOutputStream out = new ByteArrayOutputStream();
+                    byte[] buffer = new byte[4096];
+                    int bytesRead;
+                    while ((bytesRead = zipIn.read(buffer)) != -1) {
+                        out.write(buffer, 0, bytesRead);
+                    }
+                    byte[] fileContent = out.toByteArray();
+
                    String contentType = determineContentType(entry.getName());
-                    // storeInputStream returns the fileId and byte count — no extra stat needed
-                    FileStorage.StoredFile stored =
-                            fileStorage.storeInputStream(zipIn, entry.getName());
+                    String individualFileId = fileStorage.storeBytes(fileContent, entry.getName());

                    ResultFile resultFile =
                            ResultFile.builder()
-                                    .fileId(stored.fileId())
+                                    .fileId(individualFileId)
                                    .fileName(entry.getName())
                                    .contentType(contentType)
-                                    .fileSize(stored.size())
+                                    .fileSize(fileContent.length)
                                    .build();

                    extractedFiles.add(resultFile);
                    log.debug(
-                            "Extracted file: {} (size: {} bytes)", entry.getName(), stored.size());
+                            "Extracted file: {} (size: {} bytes)",
+                            entry.getName(),
+                            fileContent.length);
                }
                zipIn.closeEntry();
            }
@@ -407,7 +414,7 @@ public class TaskManager {
            return MediaType.APPLICATION_OCTET_STREAM_VALUE;
        }

-        String lowerName = fileName.toLowerCase(Locale.ROOT);
+        String lowerName = fileName.toLowerCase();
        if (lowerName.endsWith(".pdf")) {
            return MediaType.APPLICATION_PDF_VALUE;
        } else if (lowerName.endsWith(".txt")) {
@@ -456,24 +463,4 @@ public class TaskManager {
        }
        return null;
    }
-
-    /**
-     * Find the job key that owns a given file ID.
-     *
-     * @param fileId file identifier to look up
-     * @return scoped job key if found, otherwise null
-     */
-    public String findJobKeyByFileId(String fileId) {
-        for (Map.Entry<String, JobResult> entry : jobResults.entrySet()) {
-            JobResult jobResult = entry.getValue();
-            if (jobResult.hasFiles()) {
-                for (ResultFile resultFile : jobResult.getAllResultFiles()) {
-                    if (fileId.equals(resultFile.getFileId())) {
-                        return entry.getKey();
-                    }
-                }
-            }
-        }
-        return null;
-    }
 }
--- a/Show More
+++ b/Show More