Merge branch 'V2' into fix-analytics-v2

Added posthog variables directly to code
fix the text color for the first time setup with default credentials (#5023 )
2026-09-03 13:20:08 +03:00 · 2025-11-26 12:28:27 +00:00 · 2025-11-26 12:22:39 +00:00 · 2025-11-26 12:14:04 +00:00 · 2025-11-26 10:02:38 +00:00 · 2025-11-25 22:10:38 +00:00
634 changed files with 85806 additions and 11203 deletions
@@ -306,8 +306,10 @@ jobs:
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
              environment:
-                DISABLE_ADDITIONAL_FEATURES: "true"
-                SECURITY_ENABLELOGIN: "false"
+                DISABLE_ADDITIONAL_FEATURES: "false"
+                SECURITY_ENABLELOGIN: "true"
+                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
+                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"
@@ -14,7 +14,7 @@ on:
          - macos
          - linux
  pull_request:
-    branches: [main, V2]
+    branches: [main, V2, V2-tauri-windows]
    paths:
      - 'frontend/src-tauri/**'
      - 'frontend/src/desktop/**'
@@ -61,6 +61,9 @@ jobs:
      fail-fast: false
      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
@@ -89,8 +92,6 @@ jobs:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

-
-
      - name: Set up JDK 21
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
@@ -174,6 +175,84 @@ jobs:
        working-directory: ./frontend
        run: npm install

+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
      - name: Import Apple Developer Certificate
        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        env:
@@ -229,13 +308,177 @@ jobs:
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          SIGN: 1
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # List available certificates and check if they have certificates attached
+          Write-Host "Checking for available certificates..."
+          $certList = & smctl keypair ls 2>&1
+          Write-Host "Keypair list output:"
+          Write-Host $certList
+          Write-Host ""
+
+          # Parse the output to check certificate status
+          $lines = $certList -split "`n"
+          $foundKeypair = $false
+          $hasCertificate = $false
+
+          foreach ($line in $lines) {
+            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
+              $foundKeypair = $true
+              Write-Host "[SUCCESS] Found keypair in list"
+
+              # Check if this line has certificate info (not just empty spaces after alias)
+              $parts = $line -split "\s+"
+              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
+                $hasCertificate = $true
+                Write-Host "[SUCCESS] Certificate is associated with keypair"
+              }
+            }
+          }
+
+          if (-not $foundKeypair) {
+            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
+            Write-Host "Available keypairs are listed above"
+            Write-Host ""
+            Write-Host "Please verify:"
+            Write-Host "  1. Keypair alias is correct in GitHub secret"
+            Write-Host "  2. API key has access to this keypair"
+            exit 1
+          }
+
+          if (-not $hasCertificate) {
+            Write-Host "[ERROR] No certificate associated with keypair"
+            Write-Host "This usually means:"
+            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
+            Write-Host "  2. Certificate is pending approval"
+            Write-Host "  3. Certificate needs to be attached to the keypair"
+            Write-Host ""
+            Write-Host "Try running in DigiCert ONE portal:"
+            Write-Host "  smctl keypair sync"
+            exit 1
+          }
+
+          Write-Host "[SUCCESS] Certificate check passed"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              Write-Host ""
+              Write-Host "Possible issues:"
+              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
+              Write-Host "  2. Incorrect keypair alias"
+              Write-Host "  3. API key lacks signing permissions"
+              Write-Host ""
+              Write-Host "Please verify in DigiCert ONE portal:"
+              Write-Host "  - Certificate status is 'Issued' (not Pending)"
+              Write-Host "  - Keypair status is 'Online'"
+              Write-Host "  - 'Can sign' is set to 'Yes'"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
      - name: Verify notarization (macOS only)
        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        run: |
@@ -269,6 +512,66 @@ jobs:
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

+      - name: Verify Windows Code Signature
+        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
+        shell: pwsh
+        run: |
+          Write-Host "Verifying Windows code signatures..."
+
+          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
+          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
+
+          $allSigned = $true
+          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
+          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
+
+          # Check EXE signature
+          if (Test-Path $exePath) {
+            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
+            Write-Host "EXE Signature Status: $($exeSig.Status)"
+            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
+            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
+
+            if ($exeSig.Status -ne "Valid") {
+              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] EXE is properly signed"
+            }
+          }
+
+          # Check MSI signature
+          if (Test-Path $msiPath) {
+            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI Signature Status: $($msiSig.Status)"
+            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
+            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+
+            if ($msiSig.Status -ne "Valid") {
+              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] MSI is properly signed"
+            }
+          }
+
+          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
+            Write-Host "[ERROR] Code signing verification failed"
+            exit 1
+          } else {
+            Write-Host "[SUCCESS] Code signature verification completed"
+          }
+
      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
@@ -33,6 +33,7 @@ SwaggerDoc.json

 # Gradle
 .gradle
+.gradle-home
 .lock

 # External tool builders
@@ -213,3 +214,17 @@ node_modules/
 test_batch.json
 *.backup.*.json
 frontend/public/locales/*/translation.backup*.json
+
+# Development/build artifacts
+.gradle-cache/
+scripts/pdf-collection/
+**/tmp/
+*.backup
+
+# Type3 development data
+docs/type3/signatures/
+
+
+# Type3 sample PDFs (development only)
+**/type3/samples/
+
@@ -115,46 +115,46 @@ Stirling-PDF currently supports 40 languages!

 | Language                                     | Progress                               |
 | -------------------------------------------- | -------------------------------------- |
-| Arabic (العربية) (ar_AR)                        | ![64%](https://geps.dev/progress/64)   |
-| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![24%](https://geps.dev/progress/24)   |
-| Basque (Euskara) (eu_ES)                     | ![14%](https://geps.dev/progress/14)   |
-| Bulgarian (Български) (bg_BG)                | ![26%](https://geps.dev/progress/26)   |
-| Catalan (Català) (ca_CA)                     | ![26%](https://geps.dev/progress/26)   |
-| Croatian (Hrvatski) (hr_HR)                  | ![24%](https://geps.dev/progress/24)   |
-| Czech (Česky) (cs_CZ)                        | ![26%](https://geps.dev/progress/26)   |
-| Danish (Dansk) (da_DK)                       | ![23%](https://geps.dev/progress/23)   |
-| Dutch (Nederlands) (nl_NL)                   | ![23%](https://geps.dev/progress/23)   |
+| Arabic (العربية) (ar_AR)                        | ![87%](https://geps.dev/progress/87)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![86%](https://geps.dev/progress/86)   |
+| Basque (Euskara) (eu_ES)                     | ![86%](https://geps.dev/progress/86)   |
+| Bulgarian (Български) (bg_BG)                | ![86%](https://geps.dev/progress/86)   |
+| Catalan (Català) (ca_CA)                     | ![85%](https://geps.dev/progress/85)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![86%](https://geps.dev/progress/86)   |
+| Czech (Česky) (cs_CZ)                        | ![84%](https://geps.dev/progress/84)   |
+| Danish (Dansk) (da_DK)                       | ![85%](https://geps.dev/progress/85)   |
+| Dutch (Nederlands) (nl_NL)                   | ![85%](https://geps.dev/progress/85)   |
 | English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
 | English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
-| French (Français) (fr_FR)                    | ![63%](https://geps.dev/progress/63)   |
-| German (Deutsch) (de_DE)                     | ![64%](https://geps.dev/progress/64)   |
-| Greek (Ελληνικά) (el_GR)                     | ![26%](https://geps.dev/progress/26)   |
-| Hindi (हिंदी) (hi_IN)                          | ![26%](https://geps.dev/progress/26)   |
-| Hungarian (Magyar) (hu_HU)                   | ![29%](https://geps.dev/progress/29)   |
-| Indonesian (Bahasa Indonesia) (id_ID)        | ![24%](https://geps.dev/progress/24)   |
-| Irish (Gaeilge) (ga_IE)                      | ![26%](https://geps.dev/progress/26)   |
-| Italian (Italiano) (it_IT)                   | ![64%](https://geps.dev/progress/64)   |
-| Japanese (日本語) (ja_JP)                    | ![47%](https://geps.dev/progress/47)   |
-| Korean (한국어) (ko_KR)                      | ![26%](https://geps.dev/progress/26)   |
-| Norwegian (Norsk) (no_NB)                    | ![24%](https://geps.dev/progress/24)   |
-| Persian (فارسی) (fa_IR)                      | ![26%](https://geps.dev/progress/26)   |
-| Polish (Polski) (pl_PL)                      | ![27%](https://geps.dev/progress/27)   |
-| Portuguese (Português) (pt_PT)               | ![26%](https://geps.dev/progress/26)   |
-| Portuguese Brazilian (Português) (pt_BR)     | ![64%](https://geps.dev/progress/64)   |
-| Romanian (Română) (ro_RO)                    | ![22%](https://geps.dev/progress/22)   |
-| Russian (Русский) (ru_RU)                    | ![63%](https://geps.dev/progress/63)   |
-| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![28%](https://geps.dev/progress/28)   |
-| Simplified Chinese (简体中文) (zh_CN)         | ![65%](https://geps.dev/progress/65)   |
-| Slovakian (Slovensky) (sk_SK)                | ![19%](https://geps.dev/progress/19)   |
-| Slovenian (Slovenščina) (sl_SI)              | ![27%](https://geps.dev/progress/27)   |
-| Spanish (Español) (es_ES)                    | ![64%](https://geps.dev/progress/64)   |
-| Swedish (Svenska) (sv_SE)                    | ![25%](https://geps.dev/progress/25)   |
-| Thai (ไทย) (th_TH)                           | ![23%](https://geps.dev/progress/23)   |
+| French (Français) (fr_FR)                    | ![85%](https://geps.dev/progress/85)   |
+| German (Deutsch) (de_DE)                     | ![86%](https://geps.dev/progress/86)   |
+| Greek (Ελληνικά) (el_GR)                     | ![86%](https://geps.dev/progress/86)   |
+| Hindi (हिंदी) (hi_IN)                          | ![86%](https://geps.dev/progress/86)   |
+| Hungarian (Magyar) (hu_HU)                   | ![86%](https://geps.dev/progress/86)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![85%](https://geps.dev/progress/85)   |
+| Irish (Gaeilge) (ga_IE)                      | ![86%](https://geps.dev/progress/86)   |
+| Italian (Italiano) (it_IT)                   | ![85%](https://geps.dev/progress/85)   |
+| Japanese (日本語) (ja_JP)                    | ![86%](https://geps.dev/progress/86)   |
+| Korean (한국어) (ko_KR)                      | ![86%](https://geps.dev/progress/86)   |
+| Norwegian (Norsk) (no_NB)                    | ![86%](https://geps.dev/progress/86)   |
+| Persian (فارسی) (fa_IR)                      | ![86%](https://geps.dev/progress/86)   |
+| Polish (Polski) (pl_PL)                      | ![86%](https://geps.dev/progress/86)   |
+| Portuguese (Português) (pt_PT)               | ![86%](https://geps.dev/progress/86)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![86%](https://geps.dev/progress/86)   |
+| Romanian (Română) (ro_RO)                    | ![85%](https://geps.dev/progress/85)   |
+| Russian (Русский) (ru_RU)                    | ![86%](https://geps.dev/progress/86)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![86%](https://geps.dev/progress/86)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![87%](https://geps.dev/progress/87)   |
+| Slovakian (Slovensky) (sk_SK)                | ![86%](https://geps.dev/progress/86)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![86%](https://geps.dev/progress/86)   |
+| Spanish (Español) (es_ES)                    | ![86%](https://geps.dev/progress/86)   |
+| Swedish (Svenska) (sv_SE)                    | ![86%](https://geps.dev/progress/86)   |
+| Thai (ไทย) (th_TH)                           | ![86%](https://geps.dev/progress/86)   |
 | Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
-| Traditional Chinese (繁體中文) (zh_TW)        | ![29%](https://geps.dev/progress/29)   |
-| Turkish (Türkçe) (tr_TR)                     | ![28%](https://geps.dev/progress/28)   |
-| Ukrainian (Українська) (uk_UA)               | ![28%](https://geps.dev/progress/28)   |
-| Vietnamese (Tiếng Việt) (vi_VN)              | ![21%](https://geps.dev/progress/21)   |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![87%](https://geps.dev/progress/87)   |
+| Turkish (Türkçe) (tr_TR)                     | ![86%](https://geps.dev/progress/86)   |
+| Ukrainian (Українська) (uk_UA)               | ![86%](https://geps.dev/progress/86)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![86%](https://geps.dev/progress/86)   |
 | Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |

 ## Stirling PDF Enterprise
@@ -0,0 +1,258 @@
+# Windows Code Signing Setup Guide
+
+This guide explains how to set up Windows code signing for Stirling-PDF desktop application builds.
+
+## Overview
+
+Windows code signing is essential for:
+- Preventing Windows SmartScreen warnings
+- Building trust with users
+- Enabling Microsoft Store distribution
+- Professional application distribution
+
+## Certificate Types
+
+### OV Certificate (Organization Validated)
+- More affordable option
+- Requires business verification
+- May trigger SmartScreen warnings initially until reputation builds
+- Suitable for most independent software vendors
+
+### EV Certificate (Extended Validation)
+- Premium option with immediate SmartScreen reputation
+- Requires hardware security module (HSM) or cloud-based signing
+- Higher cost but provides immediate trust
+- Required since June 2023 for new certificates
+
+## Obtaining a Certificate
+
+### Certificate Authorities
+Popular certificate authorities for Windows code signing:
+- DigiCert
+- Sectigo (formerly Comodo)
+- GlobalSign
+- SSL.com
+
+### Certificate Format
+You'll receive a certificate in one of these formats:
+- `.pfx` or `.p12` (preferred - contains both certificate and private key)
+- `.cer` + private key (needs conversion to .pfx)
+
+### Converting to PFX (if needed)
+If you have separate certificate and private key files:
+
+```bash
+openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cer
+```
+
+## Setting Up GitHub Secrets
+
+### Required Secrets
+
+Navigate to your GitHub repository → Settings → Secrets and variables → Actions
+
+Add the following secrets:
+
+#### 1. `WINDOWS_CERTIFICATE`
+- **Description**: Base64-encoded .pfx certificate file
+- **How to create**:
+
+**On macOS/Linux:**
+```bash
+base64 -i certificate.pfx | pbcopy  # Copies to clipboard
+```
+
+**On Windows (PowerShell):**
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
+```
+
+Paste the entire base64 string into the GitHub secret.
+
+#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
+- **Description**: Password for the .pfx certificate
+- **Value**: The password you set when creating/exporting the .pfx file
+
+### Optional Secrets for Tauri Updater
+
+If you're using Tauri's built-in updater feature:
+
+#### `TAURI_SIGNING_PRIVATE_KEY`
+- Generated using Tauri CLI: `npm run tauri signer generate`
+- Used for update package verification
+
+#### `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
+- Password for the Tauri signing key
+
+## Configuration Files
+
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
+
+The Windows signing configuration is already set up:
+
+```json
+"windows": {
+  "certificateThumbprint": null,
+  "digestAlgorithm": "sha256",
+  "timestampUrl": "http://timestamp.digicert.com"
+}
+```
+
+**Configuration Options:**
+- `certificateThumbprint`: Automatically extracted from imported certificate (leave as `null`)
+- `digestAlgorithm`: Hashing algorithm - `sha256` is recommended
+- `timestampUrl`: Timestamp server to prove signing time (survives certificate expiration)
+
+**Alternative Timestamp Servers:**
+- DigiCert: `http://timestamp.digicert.com`
+- Sectigo: `http://timestamp.sectigo.com`
+- GlobalSign: `http://timestamp.globalsign.com`
+
+### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
+
+The workflow includes three Windows signing steps:
+
+1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
+2. **Build Tauri App**: Builds and signs the application using the imported certificate
+3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
+
+## Testing the Setup
+
+### 1. Local Testing (Windows Only)
+
+Before pushing to GitHub, test locally:
+
+```powershell
+# Set environment variables
+$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
+$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
+
+# Build the application
+cd frontend
+npm run tauri build
+
+# Verify the signature
+Get-AuthenticodeSignature "./src-tauri/target/release/bundle/msi/Stirling-PDF_*.msi"
+```
+
+### 2. GitHub Actions Testing
+
+1. Push your changes to a branch
+2. Manually trigger the workflow:
+   - Go to Actions → Build Tauri Applications
+   - Click "Run workflow"
+   - Select "windows" platform
+3. Check the build logs for:
+   - ✅ Certificate import success
+   - ✅ Build completion
+   - ✅ Signature verification
+
+### 3. Verifying Signed Binaries
+
+After downloading the built artifacts:
+
+**Windows (PowerShell):**
+```powershell
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.exe"
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.msi"
+```
+
+Look for:
+- Status: `Valid`
+- Signer: Your organization name
+- Timestamp: Recent date/time
+
+**Windows (GUI):**
+1. Right-click the .exe or .msi file
+2. Select "Properties"
+3. Go to "Digital Signatures" tab
+4. Verify signature details
+
+## Troubleshooting
+
+### "HashMismatch" Status
+- Certificate doesn't match the binary
+- Possible file corruption during download
+- Re-download and verify
+
+### "NotSigned" Status
+- Certificate wasn't imported correctly
+- Check GitHub secrets are set correctly
+- Verify base64 encoding is complete (no truncation)
+
+### "UnknownError" Status
+- Timestamp server unreachable
+- Try alternative timestamp URL in tauri.conf.json
+- Check network connectivity in GitHub Actions
+
+### SmartScreen Still Shows Warnings
+- Normal for OV certificates initially
+- Reputation builds over time with user downloads
+- Consider EV certificate for immediate reputation
+
+### Certificate Not Found During Build
+- Verify `WINDOWS_CERTIFICATE` secret is set
+- Check base64 encoding is correct (no extra whitespace)
+- Ensure password is correct
+
+## Security Best Practices
+
+1. **Never commit certificates to version control**
+   - Keep .pfx files secure and backed up
+   - Use GitHub secrets for CI/CD
+
+2. **Rotate certificates before expiration**
+   - Set calendar reminders
+   - Update GitHub secrets with new certificate
+
+3. **Use strong passwords**
+   - Certificate password should be complex
+   - Store securely (password manager)
+
+4. **Monitor certificate usage**
+   - Review GitHub Actions logs
+   - Set up notifications for failed builds
+
+5. **Limit access to secrets**
+   - Only repository admins should access secrets
+   - Audit secret access regularly
+
+## Certificate Lifecycle
+
+### Before Expiration
+1. Obtain new certificate from CA (typically annual renewal)
+2. Convert to .pfx format if needed
+3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
+4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
+5. Test build to verify new certificate works
+
+### Expired Certificates
+- Signed binaries remain valid (timestamp proves signing time)
+- New builds will fail until certificate is renewed
+- Users can still install previously signed versions
+
+## Cost Considerations
+
+### Certificate Costs (Annual, as of 2024)
+- **OV Certificate**: $100-400/year
+- **EV Certificate**: $400-1000/year
+
+### Choosing the Right Certificate
+- **Open source / early stage**: Start with OV
+- **Commercial / enterprise**: Consider EV for better trust
+- **Microsoft Store**: EV certificate required
+
+## Additional Resources
+
+- [Tauri Windows Signing Documentation](https://v2.tauri.app/distribute/sign/windows/)
+- [Microsoft Code Signing Overview](https://docs.microsoft.com/windows/win32/seccrypto/cryptography-tools)
+- [DigiCert Code Signing Guide](https://www.digicert.com/signing/code-signing-certificates)
+- [Windows SmartScreen FAQ](https://support.microsoft.com/windows/smartscreen-faq)
+
+## Support
+
+If you encounter issues with Windows code signing:
+1. Check GitHub Actions logs for detailed error messages
+2. Verify all secrets are set correctly
+3. Test certificate locally first (Windows environment required)
+4. Open an issue in the repository with relevant logs (remove sensitive data)
@@ -37,6 +37,8 @@ dependencies {
    api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
    api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
    api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
+    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
+    api "org.apache.pdfbox:preflight:$pdfboxVersion"
    api 'com.github.junrar:junrar:7.5.5' // RAR archive support for CBR files
    api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
    api 'org.snakeyaml:snakeyaml-engine:2.10'
@@ -18,11 +18,37 @@ import stirling.software.common.model.ApplicationProperties;
@Slf4j
 public class EndpointConfiguration {

+    public enum DisableReason {
+        CONFIG,
+        DEPENDENCY,
+        UNKNOWN
+    }
+
+    public static class EndpointAvailability {
+        private final boolean enabled;
+        private final DisableReason reason;
+
+        public EndpointAvailability(boolean enabled, DisableReason reason) {
+            this.enabled = enabled;
+            this.reason = reason;
+        }
+
+        public boolean isEnabled() {
+            return enabled;
+        }
+
+        public DisableReason getReason() {
+            return reason;
+        }
+    }
+
    private static final String REMOVE_BLANKS = "remove-blanks";
    private final ApplicationProperties applicationProperties;
    @Getter private Map<String, Boolean> endpointStatuses = new ConcurrentHashMap<>();
    private Map<String, Set<String>> endpointGroups = new ConcurrentHashMap<>();
    private Set<String> disabledGroups = new HashSet<>();
+    private Map<String, DisableReason> endpointDisableReasons = new ConcurrentHashMap<>();
+    private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
    private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
    private final boolean runningProOrHigher;

@@ -35,16 +61,31 @@ public class EndpointConfiguration {
        processEnvironmentConfigs();
    }

+    private String normalizeEndpoint(String endpoint) {
+        if (endpoint == null) {
+            return null;
+        }
+        return endpoint.startsWith("/") ? endpoint.substring(1) : endpoint;
+    }
+
    public void enableEndpoint(String endpoint) {
-        endpointStatuses.put(endpoint, true);
-        log.debug("Enabled endpoint: {}", endpoint);
+        String normalized = normalizeEndpoint(endpoint);
+        endpointStatuses.put(normalized, true);
+        endpointDisableReasons.remove(normalized);
+        log.debug("Enabled endpoint: {}", normalized);
    }

    public void disableEndpoint(String endpoint) {
-        if (!Boolean.FALSE.equals(endpointStatuses.get(endpoint))) {
-            log.debug("Disabling endpoint: {}", endpoint);
+        disableEndpoint(endpoint, DisableReason.CONFIG);
+    }
+
+    public void disableEndpoint(String endpoint, DisableReason reason) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (!Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            log.debug("Disabling endpoint: {}", normalized);
        }
-        endpointStatuses.put(endpoint, false);
+        endpointStatuses.put(normalized, false);
+        endpointDisableReasons.put(normalized, reason);
    }

    public boolean isEndpointEnabled(String endpoint) {
@@ -150,6 +191,10 @@ public class EndpointConfiguration {
    }

    public void disableGroup(String group) {
+        disableGroup(group, DisableReason.CONFIG);
+    }
+
+    public void disableGroup(String group, DisableReason reason) {
        if (disabledGroups.add(group)) {
            if (isToolGroup(group)) {
                log.debug(
@@ -161,11 +206,12 @@ public class EndpointConfiguration {
                        group);
            }
        }
+        groupDisableReasons.put(group, reason);
        // Only cascade to endpoints for *functional* groups
        if (!isToolGroup(group)) {
            Set<String> endpoints = endpointGroups.get(group);
            if (endpoints != null) {
-                endpoints.forEach(this::disableEndpoint);
+                endpoints.forEach(endpoint -> disableEndpoint(endpoint, reason));
            }
        }
    }
@@ -174,12 +220,39 @@ public class EndpointConfiguration {
        if (disabledGroups.remove(group)) {
            log.debug("Enabling group: {}", group);
        }
+        groupDisableReasons.remove(group);
        Set<String> endpoints = endpointGroups.get(group);
        if (endpoints != null) {
            endpoints.forEach(this::enableEndpoint);
        }
    }

+    public EndpointAvailability getEndpointAvailability(String endpoint) {
+        boolean enabled = isEndpointEnabled(endpoint);
+        DisableReason reason = enabled ? null : determineDisableReason(endpoint);
+        return new EndpointAvailability(enabled, reason);
+    }
+
+    private DisableReason determineDisableReason(String endpoint) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            return endpointDisableReasons.getOrDefault(normalized, DisableReason.CONFIG);
+        }
+
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            Set<String> endpoints = entry.getValue();
+            if (!disabledGroups.contains(group) || endpoints == null) {
+                continue;
+            }
+            if (endpoints.contains(normalized)) {
+                return groupDisableReasons.getOrDefault(group, DisableReason.CONFIG);
+            }
+        }
+
+        return DisableReason.UNKNOWN;
+    }
+
    public Set<String> getDisabledGroups() {
        return new HashSet<>(disabledGroups);
    }
@@ -261,6 +334,10 @@ public class EndpointConfiguration {
        addEndpointToGroup("Convert", "pdf-to-csv");
        addEndpointToGroup("Convert", "pdf-to-markdown");
        addEndpointToGroup("Convert", "eml-to-pdf");
+        addEndpointToGroup("Convert", "cbz-to-pdf");
+        addEndpointToGroup("Convert", "pdf-to-cbz");
+        addEndpointToGroup("Convert", "pdf-to-json");
+        addEndpointToGroup("Convert", "json-to-pdf");

        // Adding endpoints to "Security" group
        addEndpointToGroup("Security", "add-password");
@@ -394,6 +471,10 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "pdf-to-markdown");
        addEndpointToGroup("Java", "add-attachments");
        addEndpointToGroup("Java", "compress-pdf");
+        addEndpointToGroup("Java", "cbz-to-pdf");
+        addEndpointToGroup("Java", "pdf-to-cbz");
+        addEndpointToGroup("Java", "pdf-to-json");
+        addEndpointToGroup("Java", "json-to-pdf");
        addEndpointToGroup("rar", "pdf-to-cbr");

        // Javascript
@@ -41,7 +41,7 @@ public class CustomPDFDocumentFactory {

    // Memory thresholds and limits

-    private static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
+    public static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
    // Files smaller than this threshold are loaded entirely in memory for better performance.
    // These files use IOUtils.createMemoryOnlyStreamCache() which keeps all document data in RAM.
    // No temp files are created for document data, reducing I/O operations but consuming more
@@ -9,6 +9,7 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Supplier;

+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
@@ -37,6 +38,9 @@ public class JobExecutorService {
    private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
    private final long effectiveTimeoutMs;

+    @Autowired(required = false)
+    private JobOwnershipService jobOwnershipService;
+
    public JobExecutorService(
            TaskManager taskManager,
            FileStorage fileStorage,
@@ -98,11 +102,17 @@ public class JobExecutorService {
            long customTimeoutMs,
            boolean queueable,
            int resourceWeight) {
-        String jobId = UUID.randomUUID().toString();
+        // Generate base UUID
+        String baseJobId = UUID.randomUUID().toString();

-        // Store the job ID in the request for potential use by other components
+        // Scope job to authenticated user if security is enabled
+        String scopedJobKey = getScopedJobKey(baseJobId);
+
+        log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
+
+        // Store the scoped job ID in the request for potential use by other components
        if (request != null) {
-            request.setAttribute("jobId", jobId);
+            request.setAttribute("jobId", scopedJobKey);

            // Also track this job ID in the user's session for authorization purposes
            // This ensures users can only cancel their own jobs
@@ -116,11 +126,13 @@ public class JobExecutorService {
                    request.getSession().setAttribute("userJobIds", userJobIds);
                }

-                userJobIds.add(jobId);
-                log.debug("Added job ID {} to user session", jobId);
+                userJobIds.add(scopedJobKey);
+                log.debug("Added scoped job ID {} to user session", scopedJobKey);
            }
        }

+        String jobId = scopedJobKey;
+
        // Determine which timeout to use
        long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;

@@ -149,17 +161,31 @@ public class JobExecutorService {
            taskManager.createTask(jobId);

            // Create a specialized wrapper that updates the TaskManager
+            final String capturedJobIdForQueue = jobId;
            Supplier<Object> wrappedWork =
                    () -> {
                        try {
+                            // Set jobId in ThreadLocal context for the queued job
+                            stirling.software.common.util.JobContext.setJobId(
+                                    capturedJobIdForQueue);
+                            log.debug(
+                                    "Set jobId {} in JobContext for queued job execution",
+                                    capturedJobIdForQueue);
+
                            Object result = work.get();
-                            processJobResult(jobId, result);
+                            processJobResult(capturedJobIdForQueue, result);
                            return result;
                        } catch (Exception e) {
                            log.error(
-                                    "Error executing queued job {}: {}", jobId, e.getMessage(), e);
-                            taskManager.setError(jobId, e.getMessage());
+                                    "Error executing queued job {}: {}",
+                                    capturedJobIdForQueue,
+                                    e.getMessage(),
+                                    e);
+                            taskManager.setError(capturedJobIdForQueue, e.getMessage());
                            throw e;
+                        } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
+                            stirling.software.common.util.JobContext.clear();
                        }
                    };

@@ -171,21 +197,36 @@ public class JobExecutorService {
            return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
        } else if (async) {
            taskManager.createTask(jobId);
+
+            // Capture the jobId for the async thread
+            final String capturedJobId = jobId;
+
            executor.execute(
                    () -> {
                        try {
                            log.debug(
-                                    "Running async job {} with timeout {} ms", jobId, timeoutToUse);
+                                    "Running async job {} with timeout {} ms",
+                                    capturedJobId,
+                                    timeoutToUse);
+
+                            // Set jobId in ThreadLocal context for the async thread
+                            stirling.software.common.util.JobContext.setJobId(capturedJobId);
+                            log.debug(
+                                    "Set jobId {} in JobContext for async execution",
+                                    capturedJobId);

                            // Execute with timeout
                            Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
-                            processJobResult(jobId, result);
+                            processJobResult(capturedJobId, result);
                        } catch (TimeoutException te) {
                            log.error("Job {} timed out after {} ms", jobId, timeoutToUse);
                            taskManager.setError(jobId, "Job timed out");
                        } catch (Exception e) {
                            log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                            taskManager.setError(jobId, e.getMessage());
+                        } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
+                            stirling.software.common.util.JobContext.clear();
                        }
                    });

@@ -194,6 +235,10 @@ public class JobExecutorService {
            try {
                log.debug("Running sync job with timeout {} ms", timeoutToUse);

+                // Make jobId available to downstream components on the worker thread
+                stirling.software.common.util.JobContext.setJobId(jobId);
+                log.debug("Set jobId {} in JobContext for sync execution", jobId);
+
                // Execute with timeout
                Object result = executeWithTimeout(() -> work.get(), timeoutToUse);

@@ -213,6 +258,8 @@ public class JobExecutorService {
                // Construct a JSON error response
                return ResponseEntity.internalServerError()
                        .body(Map.of("error", "Job failed: " + e.getMessage()));
+            } finally {
+                stirling.software.common.util.JobContext.clear();
            }
        }
    }
@@ -466,8 +513,23 @@ public class JobExecutorService {
            throws TimeoutException, Exception {
        // Use the same executor as other async jobs for consistency
        // This ensures all operations run on the same thread pool
+        String currentJobId = stirling.software.common.util.JobContext.getJobId();
+
        java.util.concurrent.CompletableFuture<T> future =
-                java.util.concurrent.CompletableFuture.supplyAsync(supplier, executor);
+                java.util.concurrent.CompletableFuture.supplyAsync(
+                        () -> {
+                            if (currentJobId != null) {
+                                stirling.software.common.util.JobContext.setJobId(currentJobId);
+                            }
+                            try {
+                                return supplier.get();
+                            } finally {
+                                if (currentJobId != null) {
+                                    stirling.software.common.util.JobContext.clear();
+                                }
+                            }
+                        },
+                        executor);

        try {
            return future.get(timeoutMs, TimeUnit.MILLISECONDS);
@@ -483,4 +545,18 @@ public class JobExecutorService {
            throw new Exception("Execution was interrupted", e);
        }
    }
+
+    /**
+     * Get a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param baseJobId the base job identifier
+     * @return scoped job key, or just baseJobId if no ownership service available
+     */
+    private String getScopedJobKey(String baseJobId) {
+        if (jobOwnershipService != null) {
+            return jobOwnershipService.createScopedJobKey(baseJobId);
+        }
+        // Security disabled, return unsecured job key
+        return baseJobId;
+    }
 }
@@ -0,0 +1,42 @@
+package stirling.software.common.service;
+
+import java.util.Optional;
+
+/**
+ * Service interface for managing job ownership and access control. Implementations can provide
+ * user-scoped job isolation when security is enabled, or no-op behavior when security is disabled.
+ */
+public interface JobOwnershipService {
+
+    /**
+     * Get the current authenticated user's identifier.
+     *
+     * @return Optional containing user identifier, or empty if not authenticated
+     */
+    Optional<String> getCurrentUserId();
+
+    /**
+     * Create a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param jobId the base job identifier
+     * @return scoped job key in format "userId:jobId", or just jobId if no user authenticated
+     */
+    String createScopedJobKey(String jobId);
+
+    /**
+     * Validate that the current user has access to the given job.
+     *
+     * @param scopedJobKey the scoped job key to validate
+     * @return true if current user owns the job or no authentication is required
+     * @throws SecurityException if current user does not own the job
+     */
+    boolean validateJobAccess(String scopedJobKey);
+
+    /**
+     * Extract the base job ID from a scoped job key.
+     *
+     * @param scopedJobKey the scoped job key
+     * @return the base job ID without user prefix
+     */
+    String extractJobId(String scopedJobKey);
+}
@@ -38,6 +38,7 @@ public class GeneralUtils {
            Set.of(
                    "OCR images.json",
                    "Prepare-pdfs-for-email.json",
+                    "Pre-publish-sanitization.json",
                    "split-rotate-auto-rename.json");

    private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";
@@ -0,0 +1,18 @@
+package stirling.software.common.util;
+
+/** Thread-local context for passing job ID across async boundaries */
+public class JobContext {
+    private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
+
+    public static void setJobId(String jobId) {
+        CURRENT_JOB_ID.set(jobId);
+    }
+
+    public static String getJobId() {
+        return CURRENT_JOB_ID.get();
+    }
+
+    public static void clear() {
+        CURRENT_JOB_ID.remove();
+    }
+}
@@ -96,6 +96,7 @@ public class ProcessExecutor {
                                                .getProcessExecutor()
                                                .getSessionLimit()
                                                .getOcrMyPdfSessionLimit();
+                                case CFF_CONVERTER -> 1;
                            };

                    long timeoutMinutes =
@@ -150,6 +151,7 @@ public class ProcessExecutor {
                                                .getProcessExecutor()
                                                .getTimeoutMinutes()
                                                .getOcrMyPdfTimeoutMinutes();
+                                case CFF_CONVERTER -> 5L;
                            };
                    return new ProcessExecutor(semaphoreLimit, liveUpdates, timeoutMinutes);
                });
@@ -302,7 +304,8 @@ public class ProcessExecutor {
        TESSERACT,
        QPDF,
        GHOSTSCRIPT,
-        OCR_MY_PDF
+        OCR_MY_PDF,
+        CFF_CONVERTER
    }

    @Setter
@@ -78,6 +78,23 @@ class JobExecutorServiceTest {
        verify(request).setAttribute(eq("jobId"), anyString());
    }

+    @Test
+    void shouldExposeJobIdInJobContextDuringSyncExecution() throws Exception {
+        // Given
+        Supplier<Object> work = stirling.software.common.util.JobContext::getJobId;
+
+        // When
+        ResponseEntity<?> response = jobExecutorService.runJobGeneric(false, work);
+
+        // Then
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        assertNotNull(response.getBody());
+
+        var requestJobIdCaptor = ArgumentCaptor.forClass(String.class);
+        verify(request).setAttribute(eq("jobId"), requestJobIdCaptor.capture());
+        assertEquals(requestJobIdCaptor.getValue(), response.getBody());
+    }
+
    @Test
    void shouldRunAsyncJobSuccessfully() throws Exception {
        // Given
@@ -12,6 +12,8 @@ import java.util.Properties;

 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;

@@ -198,6 +200,14 @@ public class SPDFApplication {
        // }
    }

+    @EventListener
+    public void onWebServerInitialized(WebServerInitializedEvent event) {
+        int actualPort = event.getWebServer().getPort();
+        serverPortStatic = String.valueOf(actualPort);
+        // Log the actual runtime port for Tauri to parse
+        log.info("Stirling-PDF running on port: {}", actualPort);
+    }
+
    private static void printStartupLogs() {
        log.info("Stirling-PDF Started.");
        String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;
@@ -12,6 +12,7 @@ import jakarta.annotation.PostConstruct;

 import lombok.extern.slf4j.Slf4j;

+import stirling.software.SPDF.config.EndpointConfiguration.DisableReason;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.RegexPatternUtils;

@@ -24,6 +25,7 @@ public class ExternalAppDepConfig {
    private final String weasyprintPath;
    private final String unoconvPath;
    private final Map<String, List<String>> commandToGroupMapping;
+    private volatile boolean dependenciesChecked = false;

    public ExternalAppDepConfig(
            EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -97,7 +99,7 @@ public class ExternalAppDepConfig {
            if (affectedGroups != null) {
                for (String group : affectedGroups) {
                    List<String> affectedFeatures = getAffectedFeatures(group);
-                    endpointConfiguration.disableGroup(group);
+                    endpointConfiguration.disableGroup(group, DisableReason.DEPENDENCY);
                    log.warn(
                            "Missing dependency: {} - Disabling group: {} (Affected features: {})",
                            command,
@@ -110,6 +112,10 @@ public class ExternalAppDepConfig {
        }
    }

+    public boolean isDependenciesChecked() {
+        return dependenciesChecked;
+    }
+
    @PostConstruct
    public void checkDependencies() {
        // Check core dependencies
@@ -127,8 +133,8 @@ public class ExternalAppDepConfig {
        if (!pythonAvailable) {
            List<String> pythonFeatures = getAffectedFeatures("Python");
            List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-            endpointConfiguration.disableGroup("Python");
-            endpointConfiguration.disableGroup("OpenCV");
+            endpointConfiguration.disableGroup("Python", DisableReason.DEPENDENCY);
+            endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
            log.warn(
                    "Missing dependency: Python - Disabling Python features: {} and OpenCV features: {}",
                    String.join(", ", pythonFeatures),
@@ -146,14 +152,14 @@ public class ExternalAppDepConfig {
                int exitCode = process.waitFor();
                if (exitCode != 0) {
                    List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                    endpointConfiguration.disableGroup("OpenCV");
+                    endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                    log.warn(
                            "OpenCV not available in Python - Disabling OpenCV features: {}",
                            String.join(", ", openCVFeatures));
                }
            } catch (Exception e) {
                List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                endpointConfiguration.disableGroup("OpenCV");
+                endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                log.warn(
                        "Error checking OpenCV: {} - Disabling OpenCV features: {}",
                        e.getMessage(),
@@ -161,5 +167,7 @@ public class ExternalAppDepConfig {
            }
        }
        endpointConfiguration.logDisabledEndpointsSummary();
+        dependenciesChecked = true;
+        log.info("Dependency checks completed");
    }
 }
@@ -2,6 +2,9 @@ package stirling.software.SPDF.config;

 import java.io.IOException;

+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
 import jakarta.servlet.Filter;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
@@ -9,17 +12,14 @@ import jakarta.servlet.ServletRequest;
 import jakarta.servlet.ServletResponse;
 import jakarta.servlet.http.HttpServletRequest;

-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.stereotype.Component;
-
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.service.WeeklyActiveUsersService;

 /**
- * Filter to track browser IDs for Weekly Active Users (WAU) counting.
- * Only active when security is disabled (no-login mode).
+ * Filter to track browser IDs for Weekly Active Users (WAU) counting. Only active when security is
+ * disabled (no-login mode).
 */
@Component
@ConditionalOnProperty(name = "security.enableLogin", havingValue = "false")
@@ -42,7 +42,7 @@ public class WebMvcConfig implements WebMvcConfigurer {
            // Tauri v1 uses tauri://localhost, v2 uses http(s)://tauri.localhost
            logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
            registry.addMapping("/**")
-                    .allowedOrigins(
+                    .allowedOriginPatterns(
                            "tauri://localhost",
                            "http://tauri.localhost",
                            "https://tauri.localhost")
@@ -1,6 +1,7 @@
 package stirling.software.SPDF.controller.api.misc;

 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;

 import org.springframework.context.ApplicationContext;
@@ -10,9 +11,13 @@ import org.springframework.web.bind.annotation.RequestParam;

 import io.swagger.v3.oas.annotations.Hidden;

+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.config.EndpointConfiguration;
+import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
 import stirling.software.SPDF.config.InitialSetup;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
@@ -30,6 +35,7 @@ public class ConfigController {
    private final EndpointConfiguration endpointConfiguration;
    private final ServerCertificateServiceInterface serverCertificateService;
    private final UserServiceInterface userService;
+    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;

    public ConfigController(
            ApplicationProperties applicationProperties,
@@ -38,12 +44,14 @@ public class ConfigController {
            @org.springframework.beans.factory.annotation.Autowired(required = false)
                    ServerCertificateServiceInterface serverCertificateService,
            @org.springframework.beans.factory.annotation.Autowired(required = false)
-                    UserServiceInterface userService) {
+                    UserServiceInterface userService,
+            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
        this.applicationProperties = applicationProperties;
        this.applicationContext = applicationContext;
        this.endpointConfiguration = endpointConfiguration;
        this.serverCertificateService = serverCertificateService;
        this.userService = userService;
+        this.externalAppDepConfig = externalAppDepConfig;
    }

    @GetMapping("/app-config")
@@ -51,6 +59,9 @@ public class ConfigController {
        Map<String, Object> configData = new HashMap<>();

        try {
+            // Add dependency check status
+            configData.put("dependenciesReady", externalAppDepConfig.isDependenciesChecked());
+
            // Get AppConfig bean
            AppConfig appConfig = applicationContext.getBean(AppConfig.class);

@@ -200,4 +211,19 @@ public class ConfigController {
        }
        return ResponseEntity.ok(result);
    }
+
+    @GetMapping("/endpoints-availability")
+    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
+            @RequestParam(name = "endpoints")
+                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
+                    List<@NotBlank String> endpoints) {
+        Map<String, EndpointAvailability> result = new HashMap<>();
+        for (String endpoint : endpoints) {
+            String trimmedEndpoint = endpoint.trim();
+            result.put(
+                    trimmedEndpoint,
+                    endpointConfiguration.getEndpointAvailability(trimmedEndpoint));
+        }
+        return ResponseEntity.ok(result);
+    }
 }
@@ -196,9 +196,9 @@ public class StampController {
        resourceDir =
                switch (alphabet) {
                    case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/Meiryo.ttf";
-                    case "korean" -> "static/fonts/malgun.ttf";
-                    case "chinese" -> "static/fonts/SimSun.ttf";
+                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
+                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
+                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
                    case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                    case "roman" -> "static/fonts/NotoSans-Regular.ttf";
                    default -> "static/fonts/NotoSans-Regular.ttf";
@@ -171,9 +171,9 @@ public class WatermarkController {
        resourceDir =
                switch (alphabet) {
                    case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/Meiryo.ttf";
-                    case "korean" -> "static/fonts/malgun.ttf";
-                    case "chinese" -> "static/fonts/SimSun.ttf";
+                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
+                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
+                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
                    case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                    default -> "static/fonts/NotoSans-Regular.ttf";
                };
@@ -369,7 +369,8 @@ public class MetricsController {
        // Check if WAU service is available (only when security.enableLogin=false)
        if (wauService.isEmpty()) {
            return ResponseEntity.status(HttpStatus.NOT_FOUND)
-                    .body("WAU tracking is only available when security is disabled (no-login mode)");
+                    .body(
+                            "WAU tracking is only available when security is disabled (no-login mode)");
        }

        WeeklyActiveUsersService service = wauService.get();
@@ -10,8 +10,8 @@ import org.springframework.stereotype.Service;
 import lombok.extern.slf4j.Slf4j;

 /**
- * Service for tracking Weekly Active Users (WAU) in no-login mode.
- * Uses in-memory storage with automatic cleanup of old entries.
+ * Service for tracking Weekly Active Users (WAU) in no-login mode. Uses in-memory storage with
+ * automatic cleanup of old entries.
 */
@Service
@Slf4j
@@ -28,6 +28,7 @@ public class WeeklyActiveUsersService {

    /**
     * Records a browser access with the current timestamp
+     *
     * @param browserId Unique browser identifier from X-Browser-Id header
     */
    public void recordBrowserAccess(String browserId) {
@@ -46,6 +47,7 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the count of unique browsers seen in the last 7 days
+     *
     * @return Weekly Active Users count
     */
    public long getWeeklyActiveUsers() {
@@ -55,6 +57,7 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the total count of unique browsers ever seen
+     *
     * @return Total unique browsers count
     */
    public long getTotalUniqueBrowsers() {
@@ -63,6 +66,7 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the number of days the service has been running
+     *
     * @return Days online
     */
    public long getDaysOnline() {
@@ -71,23 +75,20 @@ public class WeeklyActiveUsersService {

    /**
     * Gets the timestamp when tracking started
+     *
     * @return Start time
     */
    public Instant getStartTime() {
        return startTime;
    }

-    /**
-     * Removes entries older than 7 days
-     */
+    /** Removes entries older than 7 days */
    private void cleanupOldEntries() {
        Instant sevenDaysAgo = Instant.now().minus(7, ChronoUnit.DAYS);
        activeBrowsers.entrySet().removeIf(entry -> entry.getValue().isBefore(sevenDaysAgo));
    }

-    /**
-     * Manual cleanup trigger (can be called by scheduled task if needed)
-     */
+    /** Manual cleanup trigger (can be called by scheduled task if needed) */
    public void performCleanup() {
        int sizeBefore = activeBrowsers.size();
        cleanupOldEntries();
@@ -5,6 +5,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;

+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.DeleteMapping;
@@ -24,6 +25,7 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.job.JobResult;
 import stirling.software.common.model.job.ResultFile;
 import stirling.software.common.service.FileStorage;
+import stirling.software.common.service.JobOwnershipService;
 import stirling.software.common.service.JobQueue;
 import stirling.software.common.service.TaskManager;
 import stirling.software.common.util.RegexPatternUtils;
@@ -41,6 +43,9 @@ public class JobController {
    private final JobQueue jobQueue;
    private final HttpServletRequest request;

+    @Autowired(required = false)
+    private JobOwnershipService jobOwnershipService;
+
    /**
     * Get the status of a job
     *
@@ -50,6 +55,13 @@ public class JobController {
    @GetMapping("/job/{jobId}")
    @Operation(summary = "Get job status")
    public ResponseEntity<?> getJobStatus(@PathVariable("jobId") String jobId) {
+        // Validate job ownership
+        if (!validateJobAccess(jobId)) {
+            log.warn("Unauthorized attempt to access job status: {}", jobId);
+            return ResponseEntity.status(403)
+                    .body(Map.of("message", "You are not authorized to access this job"));
+        }
+
        JobResult result = taskManager.getJobResult(jobId);
        if (result == null) {
            return ResponseEntity.notFound().build();
@@ -79,6 +91,13 @@ public class JobController {
    @GetMapping("/job/{jobId}/result")
    @Operation(summary = "Get job result")
    public ResponseEntity<?> getJobResult(@PathVariable("jobId") String jobId) {
+        // Validate job ownership
+        if (!validateJobAccess(jobId)) {
+            log.warn("Unauthorized attempt to access job result: {}", jobId);
+            return ResponseEntity.status(403)
+                    .body(Map.of("message", "You are not authorized to access this job"));
+        }
+
        JobResult result = taskManager.getJobResult(jobId);
        if (result == null) {
            return ResponseEntity.notFound().build();
@@ -144,13 +163,8 @@ public class JobController {
    public ResponseEntity<?> cancelJob(@PathVariable("jobId") String jobId) {
        log.debug("Request to cancel job: {}", jobId);

-        // Verify that this job belongs to the current user
-        // We can use the current request's session to validate ownership
-        Object sessionJobIds = request.getSession().getAttribute("userJobIds");
-        if (sessionJobIds == null
-                || !(sessionJobIds instanceof java.util.Set)
-                || !((java.util.Set<?>) sessionJobIds).contains(jobId)) {
-            // Either no jobs in session or jobId doesn't match user's jobs
+        // Validate job ownership
+        if (!validateJobAccess(jobId)) {
            log.warn("Unauthorized attempt to cancel job: {}", jobId);
            return ResponseEntity.status(403)
                    .body(Map.of("message", "You are not authorized to cancel this job"));
@@ -210,6 +224,13 @@ public class JobController {
    @GetMapping("/job/{jobId}/result/files")
    @Operation(summary = "Get job result files")
    public ResponseEntity<?> getJobFiles(@PathVariable("jobId") String jobId) {
+        // Validate job ownership
+        if (!validateJobAccess(jobId)) {
+            log.warn("Unauthorized attempt to access job files: {}", jobId);
+            return ResponseEntity.status(403)
+                    .body(Map.of("message", "You are not authorized to access this job"));
+        }
+
        JobResult result = taskManager.getJobResult(jobId);
        if (result == null) {
            return ResponseEntity.notFound().build();
@@ -330,4 +351,26 @@ public class JobController {
            return "attachment; filename=\"" + fileName + "\"";
        }
    }
+
+    /**
+     * Validate that the current user has access to the given job.
+     *
+     * @param jobId the job identifier to validate
+     * @return true if user has access, false otherwise
+     */
+    private boolean validateJobAccess(String jobId) {
+        // If JobOwnershipService is available (security enabled), use it
+        if (jobOwnershipService != null) {
+            try {
+                return jobOwnershipService.validateJobAccess(jobId);
+            } catch (SecurityException e) {
+                log.warn("Job ownership validation failed for jobId {}: {}", jobId, e.getMessage());
+                return false;
+            }
+        }
+
+        // Security disabled - allow all access (backwards compatibility)
+        // When security is not enabled, any user can access any job by jobId
+        return true;
+    }
 }
@@ -1,5 +1,6 @@
 multipart.enabled=true
 logging.level.org.springframework=WARN
+logging.level.org.springframework.security=WARN
 logging.level.org.hibernate=WARN
 logging.level.org.eclipse.jetty=WARN
 #logging.level.org.springframework.security.oauth2=DEBUG
@@ -7,6 +8,9 @@ logging.level.org.eclipse.jetty=WARN
 #logging.level.org.opensaml=DEBUG
 #logging.level.stirling.software.proprietary.security=DEBUG
 logging.level.com.zaxxer.hikari=WARN
+logging.level.stirling.software.SPDF.service.PdfJsonConversionService=INFO
+logging.level.stirling.software.common.service.JobExecutorService=INFO
+logging.level.stirling.software.common.service.TaskManager=INFO
 spring.jpa.open-in-view=false
 server.forward-headers-strategy=NATIVE
 server.error.path=/error
@@ -11,7 +11,7 @@
 #############################################################################################################

 security:
-  enableLogin: false # set to 'true' to enable login
+  enableLogin: true # set to 'true' to enable login
  csrfDisabled: false # set to 'true' to disable CSRF protection (not recommended for production)
  loginAttemptCount: 5 # lock user account after 5 tries; when using e.g. Fail2Ban you can deactivate the function with -1
  loginResetTimeMinutes: 120 # lock account for 2 hours after x attempts
@@ -174,6 +174,23 @@ system:
  databaseBackup:
    cron: '0 0 0 * * ?' # Cron expression for automatic database backups "0 0 0 * * ?" daily at midnight

+stirling:
+  pdf:
+    fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
+    json:
+      font-normalization:
+        enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
+      cff-converter:
+        enabled: true # Wrap CFF/Type1C fonts as OpenType-CFF for browser compatibility
+        method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
+        python-command: /opt/venv/bin/python3 # Python interpreter path
+        python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
+        fontforge-command: fontforge # Override if FontForge is installed under a different name/path
+      type3:
+        library:
+          enabled: true # Match common Type3 fonts against the built-in library of converted programs
+          index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)
+
 ui:
  appNameNavbar: '' # name displayed on the navigation bar
  logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)
@@ -0,0 +1,54 @@
+{
+  "name": "Pre-publish-sanitization",
+  "pipeline": [
+    {
+      "operation": "/api/v1/security/sanitize-pdf",
+      "parameters": {
+        "removeJavaScript": true,
+        "removeEmbeddedFiles": true,
+        "removeXMPMetadata": true,
+        "removeMetadata": true,
+        "removeLinks": true,
+        "removeFonts": false
+      }
+    },
+    {
+      "operation": "/api/v1/misc/flatten",
+      "parameters": {
+        "flattenOnlyForms": true
+      }
+    },
+    {
+      "operation": "/api/v1/general/remove-annotations",
+      "parameters": {}
+    },
+    {
+      "operation": "/api/v1/misc/update-metadata",
+      "parameters": {
+        "deleteAll": true,
+        "author": "",
+        "creationDate": "",
+        "creator": "",
+        "keywords": "",
+        "modificationDate": "",
+        "producer": "",
+        "subject": "",
+        "title": "",
+        "trapped": ""
+      }
+    },
+    {
+      "operation": "/api/v1/misc/compress-pdf",
+      "parameters": {
+        "optimizeLevel": 3,
+        "expectedOutputSize": ""
+      }
+    }
+  ],
+  "_examples": {
+    "outputDir": "{outputFolder}/{folderName}",
+    "outputFileName": "{filename}-{pipelineName}-{date}-{time}"
+  },
+  "outputDir": "{outputFolder}",
+  "outputFileName": "pre_publish_{filename}.PDF"
+}
@@ -0,0 +1,592 @@
+[
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "1867"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "1888"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "2029"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "2069"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "2089"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "2116"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSansMono",
+    "encoding": "2174"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans-Oblique",
+    "encoding": "2192"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "2209"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "Cmsy10",
+    "encoding": "2228"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "STIXSizeThreeSym-Regular",
+    "encoding": "2233"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSansDisplay",
+    "encoding": "2239"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4403"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4438"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4519"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4685"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4733"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4782"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4813"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4834"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSansMono",
+    "encoding": "4878"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4906"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4929"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "4971"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5001"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5030"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5052"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5083"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5116"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5143"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5175"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5207"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5243"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "Cmr10",
+    "encoding": "5263"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "Cmex10",
+    "encoding": "5270"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "Cmsy10",
+    "encoding": "5275"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "Cmmi10",
+    "encoding": "5280"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5295"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans-Oblique",
+    "encoding": "5313"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSansDisplay",
+    "encoding": "5319"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5334"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5370"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5399"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5427"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5459"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5486"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5513"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5554"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5601"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5647"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5694"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5732"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5771"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5803"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5861"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5904"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5924"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "5951"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "6084"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "6445"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "7195"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "7409"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "7474"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "7708"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "7747"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "7885"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "9029"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "9617"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "10460"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "11445"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans-Bold",
+    "encoding": "11486"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "11497"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "11543"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "12280"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "12301"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "12350"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "12372"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "12395"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "12416"
+  },
+  {
+    "source": "01_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "13324"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "3214"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "3251"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "7190"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "9937"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "10792"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "10852"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "14712"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "18396"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "18719"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans-Bold",
+    "encoding": "18741"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "18778"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "18804"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "20974"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "20993"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "21093"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "21117"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "21141"
+  },
+  {
+    "source": "02_Matplotlib.pdf",
+    "fontName": "DejaVuSans",
+    "encoding": "21174"
+  },
+  {
+    "source": "03_handout-beginner.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "17"
+  },
+  {
+    "source": "03_handout-beginner.pdf",
+    "fontName": "EVICAO+DejaVuSans-Bold",
+    "encoding": "133"
+  },
+  {
+    "source": "03_handout-beginner.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "152"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "13"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "85"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "104"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "121"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "135"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "159"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "179"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "198"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "NVMZUP+SourceCodePro-Regular",
+    "encoding": "208"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "BMQQDV+DejaVuSans",
+    "encoding": "231"
+  },
+  {
+    "source": "04_handout-intermediate.pdf",
+    "fontName": "NVMZUP+SourceCodePro-Regular",
+    "encoding": "241"
+  },
+  {
+    "source": "07_matplotlib.pdf",
+    "fontName": "SauceCodePowerline-Bold",
+    "encoding": "22"
+  },
+  {
+    "source": "07_matplotlib.pdf",
+    "fontName": "SauceCodePowerline-Regular",
+    "encoding": "47"
+  },
+  {
+    "source": "07_matplotlib.pdf",
+    "fontName": "SauceCodePowerline-Regular",
+    "encoding": "65"
+  },
+  {
+    "source": "07_matplotlib.pdf",
+    "fontName": "SauceCodePowerline-Bold",
+    "encoding": "110"
+  },
+  {
+    "source": "08_matplotlib.pdf",
+    "fontName": "F36",
+    "encoding": "12"
+  },
+  {
+    "source": "08_matplotlib.pdf",
+    "fontName": "F59",
+    "encoding": "42"
+  }
+]
--- a/Show More
+++ b/Show More