Update ConfigController.java

Merge branch 'main' into add_java_plugin
fix publishing for tauri author (#5757 )
2026-09-03 13:20:08 +03:00 · 2026-02-20 10:23:22 +01:00 · 2026-02-20 09:14:40 +01:00 · 2026-02-19 16:11:10 +00:00 · 2026-02-19 15:58:03 +00:00 · 2026-02-19 10:26:01 +00:00
960 changed files with 320320 additions and 286780 deletions
@@ -2,20 +2,17 @@
 * @Frooodle @Ludy87 @jbrunton96 @ConnorYoh

 # Backend
-/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
-
-#V1 frontend
-/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
-/app/core/src/main/resources/templates/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
+/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs

 #V2 frontend
-/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle
+/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
+/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs

 #V2 docker
-/docker/backend/** @Frooodle @Ludy87 @DarioGii @Ludy87
+/docker/backend/** @Frooodle @Ludy87 @DarioGii
 /docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
 /docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87


 #GHA (All users)
-/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
+/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
@@ -2,12 +2,9 @@ build: &build
  - build.gradle
  - app/(common|core|proprietary)/build.gradle

-app: &app
-  - app/(common|core|proprietary)/src/main/java/**
-
 openapi: &openapi
  - *build
-  - *app
+  - app/(common|core|proprietary)/src/main/java/**

 docker: &docker
  - Dockerfile
@@ -34,9 +31,30 @@ project: &project
  - settings.gradle
  - frontend/**
  - docker/**
+  - scripts/RestartHelper.java

 frontend: &frontend
  - frontend/**
  - .github/workflows/testdriver.yml
  - testing/**
  - docker/**
+  - scripts/translations/*.py
+  - scripts/build-tauri-jlink.bat
+  - scripts/build-tauri-jlink.sh
+  - scripts/convert_cff_to_ttf.py
+  - scripts/harvest_type3_fonts.py
+  - scripts/ignore_translation.toml
+  - scripts/index_type3_catalogue.py
+  - scripts/summarize_type3_signatures.py
+  - scripts/type3_to_cff.py
+  - scripts/update_type3_library.py
+
+licenses-frontend: &licenses-frontend
+  - ".github/workflows/frontend-backend-licenses-update.yml"
+  - "frontend/package.json"
+  - "frontend/package-lock.json"
+  - "frontend/scripts/generate-licenses.js"
+
+licenses-backend: &licenses-backend
+  - ".github/workflows/frontend-backend-licenses-update.yml"
+  - *build
@@ -13,6 +13,8 @@
    "reecebrowne",
    "DarioGii",
    "ConnorYoh",
-    "EthanHealy01"
+    "EthanHealy01",
+    "jbrunton96",
+    "balazs-szucs"
  ]
 }
@@ -6,18 +6,65 @@
 version: 2
 updates:
  - package-ecosystem: "gradle" # See documentation for possible values
-    directory: "/" # Location of package manifests
+    directories:
+      - "/" # Location of package manifests
+      - "/app/common"
+      - "/app/core"
+      - "/app/proprietary"
    schedule:
      interval: "weekly"
-    open-pull-requests-limit: 10
    rebase-strategy: "auto"

  - package-ecosystem: "docker"
    directory: "/" # Location of Dockerfile
    schedule:
      interval: "weekly"
+    rebase-strategy: "auto"

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
+    rebase-strategy: "auto"
+
+  - package-ecosystem: npm
+    directory: /devTools
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/backend
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/embedded
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/frontend
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: npm
+    directory: /frontend
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: cargo
+    directory: /frontend/src-tauri
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: pip
+    directory: /testing/cucumber
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
@@ -46,26 +46,31 @@ labels:
  - label: 'API'
    title: '.*openapi.*|.*swagger.*|.*api.*'

-  - label: 'v2'
-    base-branch: 'V2'
+  - label: 'v3'
+    base-branch: 'V3'

  - label: 'Translation'
    files:
-      - 'app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}.properties'
+      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
      - 'scripts/ignore_translation.toml'
-      - 'app/core/src/main/resources/templates/fragments/languages.html'
-      - '.github/scripts/check_language_properties.py'
+      - 'scripts/remove_translation_keys.sh'
+      - 'scripts/replace_translation_line.sh'
+      - 'scripts/translations/.*'
+      - '.github/scripts/check_language_toml.py'
+      - 'scripts/counter_translation_v3.py'

  - label: 'Front End'
    files:
-      - 'app/core/src/main/resources/templates/.*'
-      - 'app/proprietary/src/main/resources/templates/.*'
      - 'app/core/src/main/resources/static/.*'
      - 'app/proprietary/src/main/resources/static/.*'
-      - 'app/core/src/main/java/stirling/software/SPDF/controller/web/.*'
-      - 'app/core/src/main/java/stirling/software/SPDF/UI/.*'
-      - 'app/proprietary/src/main/java/stirling/software/proprietary/security/controller/web/.*'
      - 'frontend/**'
+      - 'frontend/.*'
+      - 'frontend/**/.*'
+
+  - label: 'Tauri'
+    files:
+      - 'frontend/src-tauri/**'
+      - 'frontend/src-tauri/.*'

  - label: 'Java'
    files:
@@ -84,6 +84,9 @@
 - name: "v2"
  color: "FFFF00"
  description: "Issues or pull requests related to the v2 branch"
+- name: "v3"
+  color: "FFA500"
+  description: "Issues or pull requests related to the v3 branch"
 - name: "wontfix"
  description: "This will not be worked on"
  color: "FFFFFF"
@@ -187,3 +190,14 @@
 - name: "break-change"
  color: "FF0000"
  description: "This PR introduces a breaking API change."
+- name: "Rust"
+  color: "DEA584"
+  description: "Pull requests that update Rust code"
+  from_name: "rust"
+- name: "Tauri"
+  color: "24C8FF"
+  description: "Pull requests that update Tauri code"
+  from_name: "tauri"
+- name: "license-review-required"
+  color: "EDEDED"
+  description: "This PR requires a license review"
@@ -11,13 +11,16 @@ adjusting the format.
 Usage:
    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
+
 # Sample for Windows:
 # python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml

+import argparse
 import glob
 import os
-import argparse
 import re
+from pathlib import Path
+
 import tomllib  # Python 3.11+ (stdlib)
 import tomli_w  # For writing TOML files

@@ -36,7 +39,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
    duplicates = []

    # Load TOML file
-    with open(file_path, "rb") as file:
+    file_path = Path(file_path)
+    with file_path.open("rb") as file:
        data = tomllib.load(file)

    def process_dict(obj, current_prefix=""):
@@ -55,8 +59,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
    return duplicates


-# Maximum size for TOML files (e.g., 500 KB)
-MAX_FILE_SIZE = 500 * 1024
+# Maximum size for TOML files (e.g., 1 MB)
+MAX_FILE_SIZE = 1000 * 1024


 def parse_toml_file(file_path):
@@ -65,7 +69,8 @@ def parse_toml_file(file_path):
    :param file_path: Path to the TOML file.
    :return: Dictionary with flattened keys.
    """
-    with open(file_path, "rb") as file:
+    file_path = Path(file_path)
+    with file_path.open("rb") as file:
        data = tomllib.load(file)

    def flatten_dict(d, parent_key="", sep="."):
@@ -108,7 +113,8 @@ def write_toml_file(file_path, updated_properties):
    """
    nested_data = unflatten_dict(updated_properties)

-    with open(file_path, "wb") as file:
+    file_path = Path(file_path)
+    with file_path.open("wb") as file:
        tomli_w.dump(nested_data, file)


@@ -119,18 +125,23 @@ def update_missing_keys(reference_file, file_list, branch=""):
    :param file_list: List of translation files to update.
    :param branch: Branch where the files are located.
    """
+    reference_file = Path(reference_file)
    reference_properties = parse_toml_file(reference_file)
+    branch_path = Path(branch) if branch else Path()

    for file_path in file_list:
-        basename_current_file = os.path.basename(os.path.join(branch, file_path))
+        file_path = Path(file_path)
+        language_dir = file_path.parent.name
+        reference_lang_dir = reference_file.parent.name
        if (
-            basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".toml")
-            or not os.path.dirname(file_path).endswith("locales")
+            language_dir == reference_lang_dir
+            or file_path.suffix != ".toml"
+            or file_path.parents[1].name != "locales"
        ):
+            print(f"Skipping file: {file_path}")
            continue

-        current_properties = parse_toml_file(os.path.join(branch, file_path))
+        current_properties = parse_toml_file(branch_path / file_path)
        updated_properties = {}

        for ref_key, ref_value in reference_properties.items():
@@ -141,7 +152,7 @@ def update_missing_keys(reference_file, file_list, branch=""):
                # Add missing key with reference value
                updated_properties[ref_key] = ref_value

-        write_toml_file(os.path.join(branch, file_path), updated_properties)
+        write_toml_file(branch_path / file_path, updated_properties)


 def check_for_missing_keys(reference_file, file_list, branch):
@@ -149,14 +160,17 @@ def check_for_missing_keys(reference_file, file_list, branch):


 def read_toml_keys(file_path):
-    if os.path.isfile(file_path) and os.path.exists(file_path):
+    file_path = Path(file_path)
+    if file_path.is_file():
        return parse_toml_file(file_path)
    return {}


 def check_for_differences(reference_file, file_list, branch, actor):
    reference_branch = branch
-    basename_reference_file = os.path.basename(reference_file)
+    reference_file = Path(reference_file)
+    basename_reference_file = reference_file.name
+    branch_path = Path(branch) if branch else Path()

    report = []
    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
@@ -170,39 +184,44 @@ def check_for_differences(reference_file, file_list, branch, actor):
    if len(file_list) == 1:
        file_arr = file_list[0].split()

-    base_dir = os.path.abspath(
-        os.path.join(os.getcwd(), "frontend", "public", "locales")
-    )
+    base_dir = Path.cwd() / "frontend" / "public" / "locales"

    for file_path in file_arr:
-        file_normpath = os.path.normpath(file_path)
-        absolute_path = os.path.abspath(file_normpath)
+        file_path = Path(file_path)
+        file_normpath = file_path
+        absolute_path = file_normpath.resolve()
+
+        basename_current_file = (branch_path / file_normpath).name
+        locale_dir = file_normpath.parent.name
+        report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")

        # Verify that file is within the expected directory
-        if not absolute_path.startswith(base_dir):
-            raise ValueError(f"Unsafe file found: {file_normpath}")
+        if not absolute_path.is_relative_to(base_dir):
+            has_differences = True
+            report.append(
+                f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n"
+            )
+            continue

        # Verify file size before processing
-        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
-            raise ValueError(
-                f"The file {file_normpath} is too large and could pose a security risk."
+        if (branch_path / file_normpath).stat().st_size > MAX_FILE_SIZE:
+            has_differences = True
+            report.append(
+                f"\n⚠️ The file `{locale_dir}/{basename_current_file}` is too large and could pose a security risk.\n\n---\n"
            )
-
-        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
-        locale_dir = os.path.basename(os.path.dirname(file_normpath))
+            continue

        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
            continue

        if (
-            not file_normpath.endswith(".toml")
+            file_normpath.suffix != ".toml"
            or basename_current_file != "translation.toml"
        ):
            continue

        only_reference_file = False
-        report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-        current_keys = read_toml_keys(os.path.join(branch, file_path))
+        current_keys = read_toml_keys(branch_path / file_path)
        reference_key_count = len(reference_keys)
        current_key_count = len(current_keys)

@@ -240,20 +259,37 @@ def check_for_differences(reference_file, file_list, branch, actor):
                report.append(
                    f"    - **_Extra keys in `{locale_dir}/{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
+                report.append("")
+                report.append("    Use the following command to remove them:")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
+                )
+                report.append("")
            if extra_keys_list:
                report.append(
                    f"    - **_Missing keys in `{locale_dir}/{basename_current_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
+                report.append("")
+                report.append("    Use the following command to add them:")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
+                )
+                report.append("")
+
+            if missing_keys_list or extra_keys_list:
+                report.append(
+                    "    See: https://github.com/Stirling-Tools/Stirling-PDF/tree/main/scripts/translations#2-translation_mergerpy"
+                )
        else:
            report.append("2. **Test Status:** ✅ **_Passed_**")

-        if find_duplicate_keys(os.path.join(branch, file_normpath)):
+        if find_duplicate_keys(branch_path / file_normpath):
            has_differences = True
            output = "\n".join(
                [
                    f"      - `{key}`: first at {first}, duplicate at `{duplicate}`"
                    for key, first, duplicate in find_duplicate_keys(
-                        os.path.join(branch, file_normpath)
+                        branch_path / file_normpath
                    )
                ]
            )
@@ -97,9 +97,9 @@ cffi==2.0.0 \
    --hash=sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453 \
    --hash=sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf
    # via weasyprint
-cfgv==3.4.0 \
-    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
-    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
+    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
    # via pre-commit
 cssselect2==0.8.0 \
    --hash=sha256:46fc70ebc41ced7a32cd42d58b1884d72ade23d21e5a4eaaf022401c13f0e76e \
@@ -109,259 +109,269 @@ distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.20.0 \
-    --hash=sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2 \
-    --hash=sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4
+filelock==3.20.3 \
+    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
+    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
    # via virtualenv
-fonttools==4.60.1 \
-    --hash=sha256:022beaea4b73a70295b688f817ddc24ed3e3418b5036ffcd5658141184ef0d0c \
-    --hash=sha256:026290e4ec76583881763fac284aca67365e0be9f13a7fb137257096114cb3bc \
-    --hash=sha256:0b0835ed15dd5b40d726bb61c846a688f5b4ce2208ec68779bc81860adb5851a \
-    --hash=sha256:0eae96373e4b7c9e45d099d7a523444e3554360927225c1cdae221a58a45b856 \
-    --hash=sha256:122e1a8ada290423c493491d002f622b1992b1ab0b488c68e31c413390dc7eb2 \
-    --hash=sha256:1410155d0e764a4615774e5c2c6fc516259fe3eca5882f034eb9bfdbee056259 \
-    --hash=sha256:145daa14bf24824b677b9357c5e44fd8895c2a8f53596e1b9ea3496081dc692c \
-    --hash=sha256:1525796c3ffe27bb6268ed2a1bb0dcf214d561dfaf04728abf01489eb5339dce \
-    --hash=sha256:154cb6ee417e417bf5f7c42fe25858c9140c26f647c7347c06f0cc2d47eff003 \
-    --hash=sha256:2299df884c11162617a66b7c316957d74a18e3758c0274762d2cc87df7bc0272 \
-    --hash=sha256:2409d5fb7b55fd70f715e6d34e7a6e4f7511b8ad29a49d6df225ee76da76dd77 \
-    --hash=sha256:268ecda8ca6cb5c4f044b1fb9b3b376e8cd1b361cef275082429dc4174907038 \
-    --hash=sha256:282dafa55f9659e8999110bd8ed422ebe1c8aecd0dc396550b038e6c9a08b8ea \
-    --hash=sha256:2ee06fc57512144d8b0445194c2da9f190f61ad51e230f14836286470c99f854 \
-    --hash=sha256:3630e86c484263eaac71d117085d509cbcf7b18f677906824e4bace598fb70d2 \
-    --hash=sha256:398447f3d8c0c786cbf1209711e79080a40761eb44b27cdafffb48f52bcec258 \
-    --hash=sha256:4ba4bd646e86de16160f0fb72e31c3b9b7d0721c3e5b26b9fa2fc931dfdb2652 \
-    --hash=sha256:5664fd1a9ea7f244487ac8f10340c4e37664675e8667d6fee420766e0fb3cf08 \
-    --hash=sha256:583b7f8e3c49486e4d489ad1deacfb8d5be54a8ef34d6df824f6a171f8511d99 \
-    --hash=sha256:596ecaca36367027d525b3b426d8a8208169d09edcf8c7506aceb3a38bfb55c7 \
-    --hash=sha256:5c1015318e4fec75dd4943ad5f6a206d9727adf97410d58b7e32ab644a807914 \
-    --hash=sha256:66929e2ea2810c6533a5184f938502cfdaea4bc3efb7130d8cc02e1c1b4108d6 \
-    --hash=sha256:6ec722ee589e89a89f5b7574f5c45604030aa6ae24cb2c751e2707193b466fed \
-    --hash=sha256:6f68576bb4bbf6060c7ab047b1574a1ebe5c50a17de62830079967b211059ebb \
-    --hash=sha256:7473a8ed9ed09aeaa191301244a5a9dbe46fe0bf54f9d6cd21d83044c3321217 \
-    --hash=sha256:7b0c6d57ab00dae9529f3faf187f2254ea0aa1e04215cf2f1a8ec277c96661bc \
-    --hash=sha256:7b4c32e232a71f63a5d00259ca3d88345ce2a43295bb049d21061f338124246f \
-    --hash=sha256:8177ec9676ea6e1793c8a084a90b65a9f778771998eb919d05db6d4b1c0b114c \
-    --hash=sha256:839565cbf14645952d933853e8ade66a463684ed6ed6c9345d0faf1f0e868877 \
-    --hash=sha256:875cb7764708b3132637f6c5fb385b16eeba0f7ac9fa45a69d35e09b47045801 \
-    --hash=sha256:8a44788d9d91df72d1a5eac49b31aeb887a5f4aab761b4cffc4196c74907ea85 \
-    --hash=sha256:8b4eb332f9501cb1cd3d4d099374a1e1306783ff95489a1026bde9eb02ccc34a \
-    --hash=sha256:906306ac7afe2156fcf0042173d6ebbb05416af70f6b370967b47f8f00103bbb \
-    --hash=sha256:992775c9fbe2cf794786fa0ffca7f09f564ba3499b8fe9f2f80bd7197db60383 \
-    --hash=sha256:996a4d1834524adbb423385d5a629b868ef9d774670856c63c9a0408a3063401 \
-    --hash=sha256:9a52f254ce051e196b8fe2af4634c2d2f02c981756c6464dc192f1b6050b4e28 \
-    --hash=sha256:9d0ced62b59e0430b3690dbc5373df1c2aa7585e9a8ce38eff87f0fd993c5b01 \
-    --hash=sha256:a140761c4ff63d0cb9256ac752f230460ee225ccef4ad8f68affc723c88e2036 \
-    --hash=sha256:a184b2ea57b13680ab6d5fbde99ccef152c95c06746cb7718c583abd8f945ccc \
-    --hash=sha256:a3db56f153bd4c5c2b619ab02c5db5192e222150ce5a1bc10f16164714bc39ac \
-    --hash=sha256:a46b2f450bc79e06ef3b6394f0c68660529ed51692606ad7f953fc2e448bc903 \
-    --hash=sha256:a884aef09d45ba1206712c7dbda5829562d3fea7726935d3289d343232ecb0d3 \
-    --hash=sha256:b2cf105cee600d2de04ca3cfa1f74f1127f8455b71dbad02b9da6ec266e116d6 \
-    --hash=sha256:b33a7884fabd72bdf5f910d0cf46be50dce86a0362a65cfc746a4168c67eb96c \
-    --hash=sha256:b42d86938e8dda1cd9a1a87a6d82f1818eaf933348429653559a458d027446da \
-    --hash=sha256:b6379e7546ba4ae4b18f8ae2b9bc5960936007a1c0e30b342f662577e8bc3299 \
-    --hash=sha256:c7420a2696a44650120cdd269a5d2e56a477e2bfa9d95e86229059beb1c19e15 \
-    --hash=sha256:c8651e0d4b3bdeda6602b85fdc2abbefc1b41e573ecb37b6779c4ca50753a199 \
-    --hash=sha256:d066ea419f719ed87bc2c99a4a4bfd77c2e5949cb724588b9dd58f3fd90b92bf \
-    --hash=sha256:e6c58beb17380f7c2ea181ea11e7db8c0ceb474c9dd45f48e71e2cb577d146a1 \
-    --hash=sha256:e852d9dda9f93ad3651ae1e3bb770eac544ec93c3807888798eccddf84596537 \
-    --hash=sha256:ec3681a0cb34c255d76dd9d865a55f260164adb9fa02628415cdc2d43ee2c05d \
-    --hash=sha256:ee0c0b3b35b34f782afc673d503167157094a16f442ace7c6c5e0ca80b08f50c \
-    --hash=sha256:eedacb5c5d22b7097482fa834bda0dafa3d914a4e829ec83cdea2a01f8c813c4 \
-    --hash=sha256:ef00af0439ebfee806b25f24c8f92109157ff3fac5731dc7867957812e87b8d9 \
-    --hash=sha256:f0e8817c7d1a0c2eedebf57ef9a9896f3ea23324769a9a2061a80fe8852705ed \
-    --hash=sha256:f3d5be054c461d6a2268831f04091dc82753176f6ea06dc6047a5e168265a987 \
-    --hash=sha256:f4b5c37a5f40e4d733d3bbaaef082149bee5a5ea3156a785ff64d949bd1353fa
+fonttools==4.61.1 \
+    --hash=sha256:0de30bfe7745c0d1ffa2b0b7048fb7123ad0d71107e10ee090fa0b16b9452e87 \
+    --hash=sha256:10d88e55330e092940584774ee5e8a6971b01fc2f4d3466a1d6c158230880796 \
+    --hash=sha256:11f35ad7805edba3aac1a3710d104592df59f4b957e30108ae0ba6c10b11dd75 \
+    --hash=sha256:15acc09befd16a0fb8a8f62bc147e1a82817542d72184acca9ce6e0aeda9fa6d \
+    --hash=sha256:17d2bf5d541add43822bcf0c43d7d847b160c9bb01d15d5007d84e2217aaa371 \
+    --hash=sha256:2180f14c141d2f0f3da43f3a81bc8aa4684860f6b0e6f9e165a4831f24e6a23b \
+    --hash=sha256:21e7c8d76f62ab13c9472ccf74515ca5b9a761d1bde3265152a6dc58700d895b \
+    --hash=sha256:41a7170d042e8c0024703ed13b71893519a1a6d6e18e933e3ec7507a2c26a4b2 \
+    --hash=sha256:41ed4b5ec103bd306bb68f81dc166e77409e5209443e5773cb4ed837bcc9b0d3 \
+    --hash=sha256:497c31ce314219888c0e2fce5ad9178ca83fe5230b01a5006726cdf3ac9f24d9 \
+    --hash=sha256:4c1b526c8d3f615a7b1867f38a9410849c8f4aef078535742198e942fba0e9bd \
+    --hash=sha256:4d7092bb38c53bbc78e9255a59158b150bcdc115a1e3b3ce0b5f267dc35dd63c \
+    --hash=sha256:4f5686e1fe5fce75d82d93c47a438a25bf0d1319d2843a926f741140b2b16e0c \
+    --hash=sha256:58b0ee0ab5b1fc9921eccfe11d1435added19d6494dde14e323f25ad2bc30c56 \
+    --hash=sha256:5ce02f38a754f207f2f06557523cd39a06438ba3aafc0639c477ac409fc64e37 \
+    --hash=sha256:5fade934607a523614726119164ff621e8c30e8fa1ffffbbd358662056ba69f0 \
+    --hash=sha256:5fe9fd43882620017add5eabb781ebfbc6998ee49b35bd7f8f79af1f9f99a958 \
+    --hash=sha256:64102ca87e84261419c3747a0d20f396eb024bdbeb04c2bfb37e2891f5fadcb5 \
+    --hash=sha256:664c5a68ec406f6b1547946683008576ef8b38275608e1cee6c061828171c118 \
+    --hash=sha256:6675329885c44657f826ef01d9e4fb33b9158e9d93c537d84ad8399539bc6f69 \
+    --hash=sha256:75c1a6dfac6abd407634420c93864a1e274ebc1c7531346d9254c0d8f6ca00f9 \
+    --hash=sha256:75da8f28eff26defba42c52986de97b22106cb8f26515b7c22443ebc9c2d3261 \
+    --hash=sha256:77efb033d8d7ff233385f30c62c7c79271c8885d5c9657d967ede124671bbdfb \
+    --hash=sha256:78a7d3ab09dc47ac1a363a493e6112d8cabed7ba7caad5f54dbe2f08676d1b47 \
+    --hash=sha256:7c7db70d57e5e1089a274cbb2b1fd635c9a24de809a231b154965d415d6c6d24 \
+    --hash=sha256:8c56c488ab471628ff3bfa80964372fc13504ece601e0d97a78ee74126b2045c \
+    --hash=sha256:91669ccac46bbc1d09e9273546181919064e8df73488ea087dcac3e2968df9ba \
+    --hash=sha256:9b666a475a65f4e839d3d10473fad6d47e0a9db14a2f4a224029c5bfde58ad2c \
+    --hash=sha256:9cfef3ab326780c04d6646f68d4b4742aae222e8b8ea1d627c74e38afcbc9d91 \
+    --hash=sha256:a13fc8aeb24bad755eea8f7f9d409438eb94e82cf86b08fe77a03fbc8f6a96b1 \
+    --hash=sha256:a75c301f96db737e1c5ed5fd7d77d9c34466de16095a266509e13da09751bd19 \
+    --hash=sha256:a76d4cb80f41ba94a6691264be76435e5f72f2cb3cab0b092a6212855f71c2f6 \
+    --hash=sha256:aed04cabe26f30c1647ef0e8fbb207516fd40fe9472e9439695f5c6998e60ac5 \
+    --hash=sha256:b148b56f5de675ee16d45e769e69f87623a4944f7443850bf9a9376e628a89d2 \
+    --hash=sha256:b501c862d4901792adaec7c25b1ecc749e2662543f68bb194c42ba18d6eec98d \
+    --hash=sha256:b846a1fcf8beadeb9ea4f44ec5bdde393e2f1569e17d700bfc49cd69bde75881 \
+    --hash=sha256:b931ae8f62db78861b0ff1ac017851764602288575d65b8e8ff1963fed419063 \
+    --hash=sha256:c33ab3ca9d3ccd581d58e989d67554e42d8d4ded94ab3ade3508455fe70e65f7 \
+    --hash=sha256:c6604b735bb12fef8e0efd5578c9fb5d3d8532d5001ea13a19cddf295673ee09 \
+    --hash=sha256:d8db08051fc9e7d8bc622f2112511b8107d8f27cd89e2f64ec45e9825e8288da \
+    --hash=sha256:d9203500f7c63545b4ce3799319fe4d9feb1a1b89b28d3cb5abd11b9dd64147e \
+    --hash=sha256:dc492779501fa723b04d0ab1f5be046797fee17d27700476edc7ee9ae535a61e \
+    --hash=sha256:e6bcdf33aec38d16508ce61fd81838f24c83c90a1d1b8c68982857038673d6b8 \
+    --hash=sha256:e76ce097e3c57c4bcb67c5aa24a0ecdbd9f74ea9219997a707a4061fbe2707aa \
+    --hash=sha256:eff1ac3cc66c2ac7cda1e64b4e2f3ffef474b7335f92fc3833fc632d595fcee6 \
+    --hash=sha256:f3cb4a569029b9f291f88aafc927dd53683757e640081ca8c412781ea144565e \
+    --hash=sha256:f79b168428351d11e10c5aeb61a74e1851ec221081299f4cf56036a95431c43a \
+    --hash=sha256:fa646ecec9528bef693415c79a86e733c70a4965dd938e9a226b0fc64c9d2e6c \
+    --hash=sha256:fe2efccb324948a11dd09d22136fe2ac8a97d6c1347cf0b58a911dcd529f66b7 \
+    --hash=sha256:fff4f534200a04b4a36e7ae3cb74493afe807b517a09e99cb4faa89a34ed6ecd
    # via weasyprint
-identify==2.6.15 \
-    --hash=sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757 \
-    --hash=sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf
+identify==2.6.16 \
+    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
+    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
    # via pre-commit
-nodeenv==1.9.1 \
-    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
-    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
+    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
    # via pre-commit
-numpy==2.2.6 \
-    --hash=sha256:038613e9fb8c72b0a41f025a7e4c3f0b7a1b5d768ece4796b674c8f3fe13efff \
-    --hash=sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47 \
-    --hash=sha256:0811bb762109d9708cca4d0b13c4f67146e3c3b7cf8d34018c722adb2d957c84 \
-    --hash=sha256:0b605b275d7bd0c640cad4e5d30fa701a8d59302e127e5f79138ad62762c3e3d \
-    --hash=sha256:0bca768cd85ae743b2affdc762d617eddf3bcf8724435498a1e80132d04879e6 \
-    --hash=sha256:1bc23a79bfabc5d056d106f9befb8d50c31ced2fbc70eedb8155aec74a45798f \
-    --hash=sha256:287cc3162b6f01463ccd86be154f284d0893d2b3ed7292439ea97eafa8170e0b \
-    --hash=sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49 \
-    --hash=sha256:37e990a01ae6ec7fe7fa1c26c55ecb672dd98b19c3d0e1d1f326fa13cb38d163 \
-    --hash=sha256:389d771b1623ec92636b0786bc4ae56abafad4a4c513d36a55dce14bd9ce8571 \
-    --hash=sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42 \
-    --hash=sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff \
-    --hash=sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491 \
-    --hash=sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4 \
-    --hash=sha256:55a4d33fa519660d69614a9fad433be87e5252f4b03850642f88993f7b2ca566 \
-    --hash=sha256:5a6429d4be8ca66d889b7cf70f536a397dc45ba6faeb5f8c5427935d9592e9cf \
-    --hash=sha256:5bd4fc3ac8926b3819797a7c0e2631eb889b4118a9898c84f585a54d475b7e40 \
-    --hash=sha256:5beb72339d9d4fa36522fc63802f469b13cdbe4fdab4a288f0c441b74272ebfd \
-    --hash=sha256:6031dd6dfecc0cf9f668681a37648373bddd6421fff6c66ec1624eed0180ee06 \
-    --hash=sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282 \
-    --hash=sha256:74d4531beb257d2c3f4b261bfb0fc09e0f9ebb8842d82a7b4209415896adc680 \
-    --hash=sha256:7befc596a7dc9da8a337f79802ee8adb30a552a94f792b9c9d18c840055907db \
-    --hash=sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3 \
-    --hash=sha256:8e41fd67c52b86603a91c1a505ebaef50b3314de0213461c7a6e99c9a3beff90 \
-    --hash=sha256:8e9ace4a37db23421249ed236fdcdd457d671e25146786dfc96835cd951aa7c1 \
-    --hash=sha256:8fc377d995680230e83241d8a96def29f204b5782f371c532579b4f20607a289 \
-    --hash=sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab \
-    --hash=sha256:b0544343a702fa80c95ad5d3d608ea3599dd54d4632df855e4c8d24eb6ecfa1c \
-    --hash=sha256:b093dd74e50a8cba3e873868d9e93a85b78e0daf2e98c6797566ad8044e8363d \
-    --hash=sha256:b412caa66f72040e6d268491a59f2c43bf03eb6c96dd8f0307829feb7fa2b6fb \
-    --hash=sha256:b4f13750ce79751586ae2eb824ba7e1e8dba64784086c98cdbbcc6a42112ce0d \
-    --hash=sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a \
-    --hash=sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf \
-    --hash=sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1 \
-    --hash=sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2 \
-    --hash=sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a \
-    --hash=sha256:ce47521a4754c8f4593837384bd3424880629f718d87c5d44f8ed763edd63543 \
-    --hash=sha256:d042d24c90c41b54fd506da306759e06e568864df8ec17ccc17e9e884634fd00 \
-    --hash=sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c \
-    --hash=sha256:e1dda9c7e08dc141e0247a5b8f49cf05984955246a327d4c48bda16821947b2f \
-    --hash=sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd \
-    --hash=sha256:e3143e4451880bed956e706a3220b4e5cf6172ef05fcc397f6f36a550b1dd868 \
-    --hash=sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303 \
-    --hash=sha256:efd28d4e9cd7d7a8d39074a4d44c63eda73401580c5c76acda2ce969e0a38e83 \
-    --hash=sha256:f0fd6321b839904e15c46e0d257fdd101dd7f530fe03fd6359c1ea63738703f3 \
-    --hash=sha256:f1372f041402e37e5e633e586f62aa53de2eac8d98cbfb822806ce4bbefcb74d \
-    --hash=sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87 \
-    --hash=sha256:f447e6acb680fd307f40d3da4852208af94afdfab89cf850986c3ca00562f4fa \
-    --hash=sha256:f92729c95468a2f4f15e9bb94c432a9229d0d50de67304399627a943201baa2f \
-    --hash=sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae \
-    --hash=sha256:fc0c5673685c508a142ca65209b4e79ed6740a4ed6b2267dbba90f34b0b3cfda \
-    --hash=sha256:fc7b73d02efb0e18c000e9ad8b83480dfcd5dfd11065997ed4c6747470ae8915 \
-    --hash=sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249 \
-    --hash=sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de \
-    --hash=sha256:fee4236c876c4e8369388054d02d0e9bb84821feb1a64dd59e137e6511a551f8
+numpy==2.4.1 \
+    --hash=sha256:0093e85df2960d7e4049664b26afc58b03236e967fb942354deef3208857a04c \
+    --hash=sha256:09aa8a87e45b55a1c2c205d42e2808849ece5c484b2aab11fecabec3841cafba \
+    --hash=sha256:0cce2a669e3c8ba02ee563c7835f92c153cf02edff1ae05e1823f1dde21b16a5 \
+    --hash=sha256:0e6e8f9d9ecf95399982019c01223dc130542960a12edfa8edd1122dfa66a8a8 \
+    --hash=sha256:0f118ce6b972080ba0758c6087c3617b5ba243d806268623dc34216d69099ba0 \
+    --hash=sha256:178de8f87948163d98a4c9ab5bee4ce6519ca918926ec8df195af582de28544d \
+    --hash=sha256:18e14c4d09d55eef39a6ab5b08406e84bc6869c1e34eef45564804f90b7e0574 \
+    --hash=sha256:2023ef86243690c2791fd6353e5b4848eedaa88ca8a2d129f462049f6d484696 \
+    --hash=sha256:20d4649c773f66cc2fc36f663e091f57c3b7655f936a4c681b4250855d1da8f5 \
+    --hash=sha256:2302dc0224c1cbc49bb94f7064f3f923a971bfae45c33870dcbff63a2a550505 \
+    --hash=sha256:26f0bcd9c79a00e339565b303badc74d3ea2bd6d52191eeca5f95936cad107d0 \
+    --hash=sha256:297c72b1b98100c2e8f873d5d35fb551fce7040ade83d67dd51d38c8d42a2162 \
+    --hash=sha256:2f44de05659b67d20499cbc96d49f2650769afcb398b79b324bb6e297bfe3844 \
+    --hash=sha256:2ffd257026eb1b34352e749d7cc1678b5eeec3e329ad8c9965a797e08ccba205 \
+    --hash=sha256:382ad67d99ef49024f11d1ce5dcb5ad8432446e4246a4b014418ba3a1175a1f4 \
+    --hash=sha256:3869ea1ee1a1edc16c29bbe3a2f2a4e515cc3a44d43903ad41e0cacdbaf733dc \
+    --hash=sha256:3d1a100e48cb266090a031397863ff8a30050ceefd798f686ff92c67a486753d \
+    --hash=sha256:423797bdab2eeefbe608d7c1ec7b2b4fd3c58d51460f1ee26c7500a1d9c9ee93 \
+    --hash=sha256:42d7dd5fa36d16d52a84f821eb96031836fd405ee6955dd732f2023724d0aa01 \
+    --hash=sha256:49e792ec351315e16da54b543db06ca8a86985ab682602d90c60ef4ff4db2a9c \
+    --hash=sha256:4e53170557d37ae404bf8d542ca5b7c629d6efa1117dac6a83e394142ea0a43f \
+    --hash=sha256:4f1b68ff47680c2925f8063402a693ede215f0257f02596b1318ecdfb1d79e33 \
+    --hash=sha256:4f9c360ecef085e5841c539a9a12b883dff005fbd7ce46722f5e9cef52634d82 \
+    --hash=sha256:529050522e983e00a6c1c6b67411083630de8b57f65e853d7b03d9281b8694d2 \
+    --hash=sha256:52b5f61bdb323b566b528899cc7db2ba5d1015bda7ea811a8bcf3c89c331fa42 \
+    --hash=sha256:538bf4ec353709c765ff75ae616c34d3c3dca1a68312727e8f2676ea644f8509 \
+    --hash=sha256:5adf01965456a664fc727ed69cc71848f28d063217c63e1a0e200a118d5eec9a \
+    --hash=sha256:5b55aa56165b17aaf15520beb9cbd33c9039810e0d9643dd4379e44294c7303e \
+    --hash=sha256:5d558123217a83b2d1ba316b986e9248a1ed1971ad495963d555ccd75dcb1556 \
+    --hash=sha256:5de60946f14ebe15e713a6f22850c2372fa72f4ff9a432ab44aa90edcadaa65a \
+    --hash=sha256:62fea415f83ad8fdb6c20840578e5fbaf5ddd65e0ec6c3c47eda0f69da172510 \
+    --hash=sha256:6436cffb4f2bf26c974344439439c95e152c9a527013f26b3577be6c2ca64295 \
+    --hash=sha256:6461de5113088b399d655d45c3897fa188766415d0f568f175ab071c8873bd73 \
+    --hash=sha256:69e7419c9012c4aaf695109564e3387f1259f001b4326dfa55907b098af082d3 \
+    --hash=sha256:71abbea030f2cfc3092a0ff9f8c8fdefdc5e0bf7d9d9c99663538bb0ecdac0b9 \
+    --hash=sha256:7211b95ca365519d3596a1d8688a95874cc94219d417504d9ecb2df99fa7bfa8 \
+    --hash=sha256:727c6c3275ddefa0dc078524a85e064c057b4f4e71ca5ca29a19163c607be745 \
+    --hash=sha256:79e9e06c4c2379db47f3f6fc7a8652e7498251789bf8ff5bd43bf478ef314ca2 \
+    --hash=sha256:7ad270f438cbdd402c364980317fb6b117d9ec5e226fff5b4148dd9aa9fc6e02 \
+    --hash=sha256:7d5d7999df434a038d75a748275cd6c0094b0ecdb0837342b332a82defc4dc4d \
+    --hash=sha256:8097529164c0f3e32bb89412a0905d9100bf434d9692d9fc275e18dcf53c9344 \
+    --hash=sha256:82c55962006156aeef1629b953fd359064aa47e4d82cfc8e67f0918f7da3344f \
+    --hash=sha256:8361ea4220d763e54cff2fbe7d8c93526b744f7cd9ddab47afeff7e14e8503be \
+    --hash=sha256:899d2c18024984814ac7e83f8f49d8e8180e2fbe1b2e252f2e7f1d06bea92425 \
+    --hash=sha256:8ad35f20be147a204e28b6a0575fbf3540c5e5f802634d4258d55b1ff5facce1 \
+    --hash=sha256:8f085da926c0d491ffff3096f91078cc97ea67e7e6b65e490bc8dcda65663be2 \
+    --hash=sha256:9171a42fcad32dcf3fa86f0a4faa5e9f8facefdb276f54b8b390d90447cff4e2 \
+    --hash=sha256:92a0e65272fd60bfa0d9278e0484c2f52fe03b97aedc02b357f33fe752c52ffb \
+    --hash=sha256:941c2a93313d030f219f3a71fd3d91a728b82979a5e8034eb2e60d394a2b83f9 \
+    --hash=sha256:98b35775e03ab7f868908b524fc0a84d38932d8daf7b7e1c3c3a1b6c7a2c9f15 \
+    --hash=sha256:a1ceafc5042451a858231588a104093474c6a5c57dcc724841f5c888d237d690 \
+    --hash=sha256:a73044b752f5d34d4232f25f18160a1cc418ea4507f5f11e299d8ac36875f8a0 \
+    --hash=sha256:a7870e8c5fc11aef57d6fea4b4085e537a3a60ad2cdd14322ed531fdca68d261 \
+    --hash=sha256:a92f227dbcdc9e4c3e193add1a189a9909947d4f8504c576f4a732fd0b54240a \
+    --hash=sha256:ac08c63cb7779b85e9d5318e6c3518b424bc1f364ac4cb2c6136f12e5ff2dccc \
+    --hash=sha256:b6bcf39112e956594b3331316d90c90c90fb961e39696bda97b89462f5f3943f \
+    --hash=sha256:c0faba4a331195bfa96f93dd9dfaa10b2c7aa8cda3a02b7fd635e588fe821bf5 \
+    --hash=sha256:ce9ce141a505053b3c7bce3216071f3bf5c182b8b28930f14cd24d43932cd2df \
+    --hash=sha256:cf6470d91d34bf669f61d515499859fa7a4c2f7c36434afb70e82df7217933f9 \
+    --hash=sha256:d3703409aac693fa82c0aee023a1ae06a6e9d065dba10f5e8e80f642f1e9d0a2 \
+    --hash=sha256:d3e3087f53e2b4428766b54932644d148613c5a595150533ae7f00dab2f319a8 \
+    --hash=sha256:d3f8f0df9f4b8be57b3bf74a1d087fec68f927a2fab68231fdb442bf2c12e426 \
+    --hash=sha256:d797454e37570cfd61143b73b8debd623c3c0952959adb817dd310a483d58a1b \
+    --hash=sha256:e1a27bb1b2dee45a2a53f5ca6ff2d1a7f135287883a1689e930d44d1ff296c87 \
+    --hash=sha256:e3bd2cb07841166420d2fa7146c96ce00cb3410664cbc1a6be028e456c4ee220 \
+    --hash=sha256:e7b6b5e28bbd47b7532698e5db2fe1db693d84b58c254e4389d99a27bb9b8f6b \
+    --hash=sha256:e867df947d427cdd7a60e3e271729090b0f0df80f5f10ab7dd436f40811699c3 \
+    --hash=sha256:ea66d2b41ca4a1630aae5507ee0a71647d3124d1741980138aa8f28f44dac36e \
+    --hash=sha256:edee228f76ee2dab4579fad6f51f6a305de09d444280109e0f75df247ff21501 \
+    --hash=sha256:f0a90aba7d521e6954670550e561a4cb925713bd944445dbe9e729b71f6cabee \
+    --hash=sha256:f93bc6892fe7b0663e5ffa83b61aab510aacffd58c16e012bb9352d489d90cb7 \
+    --hash=sha256:fb1461c99de4d040666ca0444057b06541e5642f800b71c56e6ea92d6a853a0c
    # via opencv-python-headless
-opencv-python-headless==4.12.0.88 \
-    --hash=sha256:1e58d664809b3350c1123484dd441e1667cd7bed3086db1b9ea1b6f6cb20b50e \
-    --hash=sha256:236c8df54a90f4d02076e6f9c1cc763d794542e886c576a6fee46ec8ff75a7a9 \
-    --hash=sha256:365bb2e486b50feffc2d07a405b953a8f3e8eaa63865bc650034e5c71e7a5154 \
-    --hash=sha256:86b413bdd6c6bf497832e346cd5371995de148e579b9774f8eba686dee3f5528 \
-    --hash=sha256:aeb4b13ecb8b4a0beb2668ea07928160ea7c2cd2d9b5ef571bbee6bafe9cc8d0 \
-    --hash=sha256:cfdc017ddf2e59b6c2f53bc12d74b6b0be7ded4ec59083ea70763921af2b6c09 \
-    --hash=sha256:fde2cf5c51e4def5f2132d78e0c08f9c14783cd67356922182c6845b9af87dbd
+opencv-python-headless==4.13.0.90 \
+    --hash=sha256:0e0c8c9f620802fddc4fa7f471a1d263c7b0dca16cd9e7e2f996bb8bd2128c0c \
+    --hash=sha256:12a28674f215542c9bf93338de1b5bffd76996d32da9acb9e739fdb9c8bbd738 \
+    --hash=sha256:32255203040dc98803be96362e13f9e4bce20146898222d2e5c242f80de50da5 \
+    --hash=sha256:96060fc57a1abb1144b0b8129e2ff3bfcdd0ccd8e8bd05bd85256ff4ed587d3b \
+    --hash=sha256:dbc1f4625e5af3a80ebdbd84380227c0f445228588f2521b11af47710caca1ba \
+    --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
+    --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
+    --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
    # via -r .github/scripts/requirements_dev.in
 pdf2image==1.17.0 \
    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
    # via -r .github/scripts/requirements_dev.in
-pillow==12.0.0 \
-    --hash=sha256:0869154a2d0546545cde61d1789a6524319fc1897d9ee31218eae7a60ccc5643 \
-    --hash=sha256:09f2d0abef9e4e2f349305a4f8cc784a8a6c2f58a8c4892eea13b10a943bd26e \
-    --hash=sha256:0b817e7035ea7f6b942c13aa03bb554fc44fea70838ea21f8eb31c638326584e \
-    --hash=sha256:0fd00cac9c03256c8b2ff58f162ebcd2587ad3e1f2e397eab718c47e24d231cc \
-    --hash=sha256:110486b79f2d112cf6add83b28b627e369219388f64ef2f960fef9ebaf54c642 \
-    --hash=sha256:1979f4566bb96c1e50a62d9831e2ea2d1211761e5662afc545fa766f996632f6 \
-    --hash=sha256:1ac11e8ea4f611c3c0147424eae514028b5e9077dd99ab91e1bd7bc33ff145e1 \
-    --hash=sha256:1b1b133e6e16105f524a8dec491e0586d072948ce15c9b914e41cdadd209052b \
-    --hash=sha256:1ee80a59f6ce048ae13cda1abf7fbd2a34ab9ee7d401c46be3ca685d1999a399 \
-    --hash=sha256:21f241bdd5080a15bc86d3466a9f6074a9c2c2b314100dd896ac81ee6db2f1ba \
-    --hash=sha256:266cd5f2b63ff316d5a1bba46268e603c9caf5606d44f38c2873c380950576ad \
-    --hash=sha256:26d9f7d2b604cd23aba3e9faf795787456ac25634d82cd060556998e39c6fa47 \
-    --hash=sha256:27f95b12453d165099c84f8a8bfdfd46b9e4bda9e0e4b65f0635430027f55739 \
-    --hash=sha256:2c54c1a783d6d60595d3514f0efe9b37c8808746a66920315bfd34a938d7994b \
-    --hash=sha256:2fa5f0b6716fc88f11380b88b31fe591a06c6315e955c096c35715788b339e3f \
-    --hash=sha256:32ed80ea8a90ee3e6fa08c21e2e091bba6eda8eccc83dbc34c95169507a91f10 \
-    --hash=sha256:3830c769decf88f1289680a59d4f4c46c72573446352e2befec9a8512104fa52 \
-    --hash=sha256:38df9b4bfd3db902c9c2bd369bcacaf9d935b2fff73709429d95cc41554f7b3d \
-    --hash=sha256:3adfb466bbc544b926d50fe8f4a4e6abd8c6bffd28a26177594e6e9b2b76572b \
-    --hash=sha256:3e42edad50b6909089750e65c91aa09aaf1e0a71310d383f11321b27c224ed8a \
-    --hash=sha256:4078242472387600b2ce8d93ade8899c12bf33fa89e55ec89fe126e9d6d5d9e9 \
-    --hash=sha256:455247ac8a4cfb7b9bc45b7e432d10421aea9fc2e74d285ba4072688a74c2e9d \
-    --hash=sha256:4cc6b3b2efff105c6a1656cfe59da4fdde2cda9af1c5e0b58529b24525d0a098 \
-    --hash=sha256:4cf7fed4b4580601c4345ceb5d4cbf5a980d030fd5ad07c4d2ec589f95f09905 \
-    --hash=sha256:5193fde9a5f23c331ea26d0cf171fbf67e3f247585f50c08b3e205c7aeb4589b \
-    --hash=sha256:5269cc1caeedb67e6f7269a42014f381f45e2e7cd42d834ede3c703a1d915fe3 \
-    --hash=sha256:53561a4ddc36facb432fae7a9d8afbfaf94795414f5cdc5fc52f28c1dca90371 \
-    --hash=sha256:55f818bd74fe2f11d4d7cbc65880a843c4075e0ac7226bc1a23261dbea531953 \
-    --hash=sha256:58eea5ebe51504057dd95c5b77d21700b77615ab0243d8152793dc00eb4faf01 \
-    --hash=sha256:5d5c411a8eaa2299322b647cd932586b1427367fd3184ffbb8f7a219ea2041ca \
-    --hash=sha256:6846bd2d116ff42cba6b646edf5bf61d37e5cbd256425fa089fee4ff5c07a99e \
-    --hash=sha256:6ace95230bfb7cd79ef66caa064bbe2f2a1e63d93471c3a2e1f1348d9f22d6b7 \
-    --hash=sha256:6e51b71417049ad6ab14c49608b4a24d8fb3fe605e5dfabfe523b58064dc3d27 \
-    --hash=sha256:71db6b4c1653045dacc1585c1b0d184004f0d7e694c7b34ac165ca70c0838082 \
-    --hash=sha256:7438839e9e053ef79f7112c881cef684013855016f928b168b81ed5835f3e75e \
-    --hash=sha256:759de84a33be3b178a64c8ba28ad5c135900359e85fb662bc6e403ad4407791d \
-    --hash=sha256:792a2c0be4dcc18af9d4a2dfd8a11a17d5e25274a1062b0ec1c2d79c76f3e7f8 \
-    --hash=sha256:7d87ef5795da03d742bf49439f9ca4d027cde49c82c5371ba52464aee266699a \
-    --hash=sha256:7dfb439562f234f7d57b1ac6bc8fe7f838a4bd49c79230e0f6a1da93e82f1fad \
-    --hash=sha256:7fa22993bac7b77b78cae22bad1e2a987ddf0d9015c63358032f84a53f23cdc3 \
-    --hash=sha256:805ebf596939e48dbb2e4922a1d3852cfc25c38160751ce02da93058b48d252a \
-    --hash=sha256:82240051c6ca513c616f7f9da06e871f61bfd7805f566275841af15015b8f98d \
-    --hash=sha256:87d4f8125c9988bfbed67af47dd7a953e2fc7b0cc1e7800ec6d2080d490bb353 \
-    --hash=sha256:8d8ca2b210ada074d57fcee40c30446c9562e542fc46aedc19baf758a93532ee \
-    --hash=sha256:8dc232e39d409036af549c86f24aed8273a40ffa459981146829a324e0848b4b \
-    --hash=sha256:90387104ee8400a7b4598253b4c406f8958f59fcf983a6cea2b50d59f7d63d0b \
-    --hash=sha256:905b0365b210c73afb0ebe9101a32572152dfd1c144c7e28968a331b9217b94a \
-    --hash=sha256:99353a06902c2e43b43e8ff74ee65a7d90307d82370604746738a1e0661ccca7 \
-    --hash=sha256:99a7f72fb6249302aa62245680754862a44179b545ded638cf1fef59befb57ef \
-    --hash=sha256:9f0b04c6b8584c2c193babcccc908b38ed29524b29dd464bc8801bf10d746a3a \
-    --hash=sha256:9fe611163f6303d1619bbcb653540a4d60f9e55e622d60a3108be0d5b441017a \
-    --hash=sha256:a3475b96f5908b3b16c47533daaa87380c491357d197564e0ba34ae75c0f3257 \
-    --hash=sha256:a6597ff2b61d121172f5844b53f21467f7082f5fb385a9a29c01414463f93b07 \
-    --hash=sha256:a7921c5a6d31b3d756ec980f2f47c0cfdbce0fc48c22a39347a895f41f4a6ea4 \
-    --hash=sha256:aa5129de4e174daccbc59d0a3b6d20eaf24417d59851c07ebb37aeb02947987c \
-    --hash=sha256:aeaefa96c768fc66818730b952a862235d68825c178f1b3ffd4efd7ad2edcb7c \
-    --hash=sha256:afbefa430092f71a9593a99ab6a4e7538bc9eabbf7bf94f91510d3503943edc4 \
-    --hash=sha256:aff9e4d82d082ff9513bdd6acd4f5bd359f5b2c870907d2b0a9c5e10d40c88fe \
-    --hash=sha256:b22bd8c974942477156be55a768f7aa37c46904c175be4e158b6a86e3a6b7ca8 \
-    --hash=sha256:b290fd8aa38422444d4b50d579de197557f182ef1068b75f5aa8558638b8d0a5 \
-    --hash=sha256:b2e4b27a6e15b04832fe9bf292b94b5ca156016bbc1ea9c2c20098a0320d6cf6 \
-    --hash=sha256:b583dc9070312190192631373c6c8ed277254aa6e6084b74bdd0a6d3b221608e \
-    --hash=sha256:b87843e225e74576437fd5b6a4c2205d422754f84a06942cfaf1dc32243e45a8 \
-    --hash=sha256:bc91a56697869546d1b8f0a3ff35224557ae7f881050e99f615e0119bf934b4e \
-    --hash=sha256:bd87e140e45399c818fac4247880b9ce719e4783d767e030a883a970be632275 \
-    --hash=sha256:bde737cff1a975b70652b62d626f7785e0480918dece11e8fef3c0cf057351c3 \
-    --hash=sha256:bdee52571a343d721fb2eb3b090a82d959ff37fc631e3f70422e0c2e029f3e76 \
-    --hash=sha256:bee2a6db3a7242ea309aa7ee8e2780726fed67ff4e5b40169f2c940e7eb09227 \
-    --hash=sha256:beeae3f27f62308f1ddbcfb0690bf44b10732f2ef43758f169d5e9303165d3f9 \
-    --hash=sha256:c50f36a62a22d350c96e49ad02d0da41dbd17ddc2e29750dbdba4323f85eb4a5 \
-    --hash=sha256:c607c90ba67533e1b2355b821fef6764d1dd2cbe26b8c1005ae84f7aea25ff79 \
-    --hash=sha256:c7b2a63fd6d5246349f3d3f37b14430d73ee7e8173154461785e43036ffa96ca \
-    --hash=sha256:c828a1ae702fc712978bda0320ba1b9893d99be0badf2647f693cc01cf0f04fa \
-    --hash=sha256:c85de1136429c524e55cfa4e033b4a7940ac5c8ee4d9401cc2d1bf48154bbc7b \
-    --hash=sha256:c98fa880d695de164b4135a52fd2e9cd7b7c90a9d8ac5e9e443a24a95ef9248e \
-    --hash=sha256:cae81479f77420d217def5f54b5b9d279804d17e982e0f2fa19b1d1e14ab5197 \
-    --hash=sha256:d034140032870024e6b9892c692fe2968493790dd57208b2c37e3fb35f6df3ab \
-    --hash=sha256:d120c38a42c234dc9a8c5de7ceaaf899cf33561956acb4941653f8bdc657aa79 \
-    --hash=sha256:d4827615da15cd59784ce39d3388275ec093ae3ee8d7f0c089b76fa87af756c2 \
-    --hash=sha256:d49e2314c373f4c2b39446fb1a45ed333c850e09d0c59ac79b72eb3b95397363 \
-    --hash=sha256:d52610d51e265a51518692045e372a4c363056130d922a7351429ac9f27e70b0 \
-    --hash=sha256:d64317d2587c70324b79861babb9c09f71fbb780bad212018874b2c013d8600e \
-    --hash=sha256:d77153e14b709fd8b8af6f66a3afbb9ed6e9fc5ccf0b6b7e1ced7b036a228782 \
-    --hash=sha256:d7e091d464ac59d2c7ad8e7e08105eaf9dafbc3883fd7265ffccc2baad6ac925 \
-    --hash=sha256:dd333073e0cacdc3089525c7df7d39b211bcdf31fc2824e49d01c6b6187b07d0 \
-    --hash=sha256:e5d8efac84c9afcb40914ab49ba063d94f5dbdf5066db4482c66a992f47a3a3b \
-    --hash=sha256:f135c702ac42262573fe9714dfe99c944b4ba307af5eb507abef1667e2cbbced \
-    --hash=sha256:f13711b1a5ba512d647a0e4ba79280d3a9a045aaf7e0cc6fbe96b91d4cdf6b0c \
-    --hash=sha256:f4f1231b7dec408e8670264ce63e9c71409d9583dd21d32c163e25213ee2a344 \
-    --hash=sha256:fa3ed2a29a9e9d2d488b4da81dcb54720ac3104a20bf0bd273f1e4648aff5af9 \
-    --hash=sha256:fb3096c30df99fd01c7bf8e544f392103d0795b9f98ba71a8054bcbf56b255f1
+pillow==12.1.0 \
+    --hash=sha256:00162e9ca6d22b7c3ee8e61faa3c3253cd19b6a37f126cad04f2f88b306f557d \
+    --hash=sha256:079af2fb0c599c2ec144ba2c02766d1b55498e373b3ac64687e43849fbbef5bc \
+    --hash=sha256:0b022eaaf709541b391ee069f0022ee5b36c709df71986e3f7be312e46f42c84 \
+    --hash=sha256:0c27407a2d1b96774cbc4a7594129cc027339fd800cd081e44497722ea1179de \
+    --hash=sha256:0ddedfaa8b5f0b4ffbc2fa87b556dc59f6bb4ecb14a53b33f9189713ae8053c0 \
+    --hash=sha256:0deedf2ea233722476b3a81e8cdfbad786f7adbed5d848469fa59fe52396e4ef \
+    --hash=sha256:0ed07dca4a8464bada6139ab38f5382f83e5f111698caf3191cb8dbf27d908b4 \
+    --hash=sha256:0fde7ec5538ab5095cc02df38ee99b0443ff0e1c847a045554cf5f9af1f4aa82 \
+    --hash=sha256:15c794d74303828eaa957ff8070846d0efe8c630901a1c753fdc63850e19ecd9 \
+    --hash=sha256:1a949604f73eb07a8adab38c4fe50791f9919344398bdc8ac6b307f755fc7030 \
+    --hash=sha256:1f345e7bc9d7f368887c712aa5054558bad44d2a301ddf9248599f4161abc7c0 \
+    --hash=sha256:1fcc52d86ce7a34fd17cb04e87cfdb164648a3662a6f20565910a99653d66c18 \
+    --hash=sha256:21e686a21078b0f9cb8c8a961d99e6a4ddb88e0fc5ea6e130172ddddc2e5221a \
+    --hash=sha256:2415373395a831f53933c23ce051021e79c8cd7979822d8cc478547a3f4da8ef \
+    --hash=sha256:277518bf4fe74aa91489e1b20577473b19ee70fb97c374aa50830b279f25841b \
+    --hash=sha256:27b9baecb428899db6c0de572d6d305cfaf38ca1596b5c0542a5182e3e74e8c6 \
+    --hash=sha256:29a4cef9cb672363926f0470afc516dbf7305a14d8c54f7abbb5c199cd8f8179 \
+    --hash=sha256:3413c2ae377550f5487991d444428f1a8ae92784aac79caa8b1e3b89b175f77e \
+    --hash=sha256:351889afef0f485b84078ea40fe33727a0492b9af3904661b0abbafee0355b72 \
+    --hash=sha256:3ffaa2f0659e2f740473bcf03c702c39a8d4b2b7ffc629052028764324842c64 \
+    --hash=sha256:40a8e3b9e8773876d6e30daed22f016509e3987bab61b3b7fe309d7019a87451 \
+    --hash=sha256:414b9a78e14ffeb98128863314e62c3f24b8a86081066625700b7985b3f529bd \
+    --hash=sha256:43aca0a55ce1eefc0aefa6253661cb54571857b1a7b2964bd8a1e3ef4b729924 \
+    --hash=sha256:43b4899cfd091a9693a1278c4982f3e50f7fb7cff5153b05174b4afc9593b616 \
+    --hash=sha256:461f9dfdafa394c59cd6d818bdfdbab4028b83b02caadaff0ffd433faf4c9a7a \
+    --hash=sha256:4f9f6a650743f0ddee5593ac9e954ba1bdbc5e150bc066586d4f26127853ab94 \
+    --hash=sha256:53d8b764726d3af1a138dd353116f774e3862ec7e3794e0c8781e30db0f35dfc \
+    --hash=sha256:565c986f4b45c020f5421a4cea13ef294dde9509a8577f29b2fc5edc7587fff8 \
+    --hash=sha256:5c5ae0a06e9ea030ab786b0251b32c7e4ce10e58d983c0d5c56029455180b5b9 \
+    --hash=sha256:5cb7bc1966d031aec37ddb9dcf15c2da5b2e9f7cc3ca7c54473a20a927e1eb91 \
+    --hash=sha256:5da841d81b1a05ef940a8567da92decaa15bc4d7dedb540a8c219ad83d91808a \
+    --hash=sha256:5fee4c04aad8932da9f8f710af2c1a15a83582cfb884152a9caa79d4efcdbf9c \
+    --hash=sha256:609e89d9f90b581c8d16358c9087df76024cf058fa693dd3e1e1620823f39670 \
+    --hash=sha256:6258f3260986990ba2fa8a874f8b6e808cf5abb51a94015ca3dc3c68aa4f30ea \
+    --hash=sha256:64efdf00c09e31efd754448a383ea241f55a994fd079866b92d2bbff598aad91 \
+    --hash=sha256:65b80c1ee7e14a87d6a068dd3b0aea268ffcabfe0498d38661b00c5b4b22e74c \
+    --hash=sha256:6741e6f3074a35e47c77b23a4e4f2d90db3ed905cb1c5e6e0d49bff2045632bc \
+    --hash=sha256:681088909d7e8fa9e31b9799aaa59ba5234c58e5e4f1951b4c4d1082a2e980e0 \
+    --hash=sha256:6b7a9d1db5dad90e2991645874f708e87d9a3c370c243c2d7684d28f7e133e6b \
+    --hash=sha256:7315f9137087c4e0ee73a761b163fc9aa3b19f5f606a7fc08d83fd3e4379af65 \
+    --hash=sha256:742aea052cf5ab5034a53c3846165bc3ce88d7c38e954120db0ab867ca242661 \
+    --hash=sha256:75af0b4c229ac519b155028fa1be632d812a519abba9b46b20e50c6caa184f19 \
+    --hash=sha256:7b5dd7cbae20285cdb597b10eb5a2c13aa9de6cde9bb64a3c1317427b1db1ae1 \
+    --hash=sha256:7d6daa89a00b58c37cb1747ec9fb7ac3bc5ffd5949f5888657dfddde6d1312e0 \
+    --hash=sha256:800429ac32c9b72909c671aaf17ecd13110f823ddb7db4dfef412a5587c2c24e \
+    --hash=sha256:806f3987ffe10e867bab0ddad45df1148a2b98221798457fa097ad85d6e8bc75 \
+    --hash=sha256:808b99604f7873c800c4840f55ff389936ef1948e4e87645eaf3fccbc8477ac4 \
+    --hash=sha256:80941e6d573197a0c28f394753de529bb436b1ca990ed6e765cf42426abc39f8 \
+    --hash=sha256:84cabc7095dd535ca934d57e9ce2a72ffd216e435a84acb06b2277b1de2689bd \
+    --hash=sha256:8637e29d13f478bc4f153d8daa9ffb16455f0a6cb287da1b432fdad2bfbd66c7 \
+    --hash=sha256:896866d2d436563fa2a43a9d72f417874f16b5545955c54a64941e87c1376c61 \
+    --hash=sha256:8e178e3e99d3c0ea8fc64b88447f7cac8ccf058af422a6cedc690d0eadd98c51 \
+    --hash=sha256:907bfa8a9cb790748a9aa4513e37c88c59660da3bcfffbd24a7d9e6abf224551 \
+    --hash=sha256:9212d6b86917a2300669511ed094a9406888362e085f2431a7da985a6b124f45 \
+    --hash=sha256:92a7fe4225365c5e3a8e598982269c6d6698d3e783b3b1ae979e7819f9cd55c1 \
+    --hash=sha256:935b9d1aed48fcfb3f838caac506f38e29621b44ccc4f8a64d575cb1b2a88644 \
+    --hash=sha256:97e9993d5ed946aba26baf9c1e8cf18adbab584b99f452ee72f7ee8acb882796 \
+    --hash=sha256:983976c2ab753166dc66d36af6e8ec15bb511e4a25856e2227e5f7e00a160587 \
+    --hash=sha256:9f5fefaca968e700ad1a4a9de98bf0869a94e397fe3524c4c9450c1445252304 \
+    --hash=sha256:a332ac4ccb84b6dde65dbace8431f3af08874bf9770719d32a635c4ef411b18b \
+    --hash=sha256:a40905599d8079e09f25027423aed94f2823adaf2868940de991e53a449e14a8 \
+    --hash=sha256:a6dfc2af5b082b635af6e08e0d1f9f1c4e04d17d4e2ca0ef96131e85eda6eb17 \
+    --hash=sha256:a786bf667724d84aa29b5db1c61b7bfdde380202aaca12c3461afd6b71743171 \
+    --hash=sha256:a83e0850cb8f5ac975291ebfc4170ba481f41a28065277f7f735c202cd8e0af3 \
+    --hash=sha256:aa0c9cc0b82b14766a99fbe6084409972266e82f459821cd26997a488a7261a7 \
+    --hash=sha256:b17fbdbe01c196e7e159aacb889e091f28e61020a8abeac07b68079b6e626988 \
+    --hash=sha256:b63e13dd27da389ed9475b3d28510f0f954bca0041e8e551b2a4eb1eab56a39a \
+    --hash=sha256:b6e53e82ec2db0717eabb276aa56cf4e500c9a7cec2c2e189b55c24f65a3e8c0 \
+    --hash=sha256:bb0984b30e973f7e2884362b7d23d0a348c7143ee559f38ef3eaab640144204c \
+    --hash=sha256:bc11908616c8a283cf7d664f77411a5ed2a02009b0097ff8abbba5e79128ccf2 \
+    --hash=sha256:bdec5e43377761c5dbca620efb69a77f6855c5a379e32ac5b158f54c84212b14 \
+    --hash=sha256:bef9768cab184e7ae6e559c032e95ba8d07b3023c289f79a2bd36e8bf85605a5 \
+    --hash=sha256:c990547452ee2800d8506c4150280757f88532f3de2a58e3022e9b179107862a \
+    --hash=sha256:ca94b6aac0d7af2a10ba08c0f888b3d5114439b6b3ef39968378723622fed377 \
+    --hash=sha256:cad302dc10fac357d3467a74a9561c90609768a6f73a1923b0fd851b6486f8b0 \
+    --hash=sha256:d0a7735df32ccbcc98b98a1ac785cc4b19b580be1bdf0aeb5c03223220ea09d5 \
+    --hash=sha256:d70347c8a5b7ccd803ec0c85c8709f036e6348f1e6a5bf048ecd9c64d3550b8b \
+    --hash=sha256:d70534cea9e7966169ad29a903b99fc507e932069a881d0965a1a84bb57f6c6d \
+    --hash=sha256:db44d5c160a90df2d24a24760bbd37607d53da0b34fb546c4c232af7192298ac \
+    --hash=sha256:e115c15e3bc727b1ca3e641a909f77f8ca72a64fff150f666fcc85e57701c26c \
+    --hash=sha256:e2479c7f02f9d505682dc47df8c0ea1fc5e264c4d1629a5d63fe3e2334b89554 \
+    --hash=sha256:e5dcbe95016e88437ecf33544ba5db21ef1b8dd6e1b434a2cb2a3d605299e643 \
+    --hash=sha256:e6bdb408f7c9dd2a5ff2b14a3b0bb6d4deb29fb9961e6eb3ae2031ae9a5cec13 \
+    --hash=sha256:e75d3dba8fc1ddfec0cd752108f93b83b4f8d6ab40e524a95d35f016b9683b09 \
+    --hash=sha256:efdc140e7b63b8f739d09a99033aa430accce485ff78e6d311973a67b6bf3208 \
+    --hash=sha256:f10c98f49227ed8383d28174ee95155a675c4ed7f85e2e573b04414f7e371bda \
+    --hash=sha256:f188028b5af6b8fb2e9a76ac0f841a575bd1bd396e46ef0840d9b88a48fdbcea \
+    --hash=sha256:f188d580bd870cda1e15183790d1cc2fa78f666e76077d103edf048eed9c356e \
+    --hash=sha256:f45bd71d1fa5e5749587613037b172e0b3b23159d1c00ef2fc920da6f470e6f0 \
+    --hash=sha256:f61333d817698bdcdd0f9d7793e365ac3d2a21c1f1eb02b32ad6aefb8d8ea831 \
+    --hash=sha256:fb125d860738a09d363a88daa0f59c4533529a90e564785e20fe875b200b6dbd
    # via
    #   -r .github/scripts/requirements_dev.in
    #   pdf2image
    #   weasyprint
-platformdirs==4.5.0 \
-    --hash=sha256:70ddccdd7c99fc5942e9fc25636a8b34d04c24b335100223152c2803e4063312 \
-    --hash=sha256:e578a81bb873cbb89a41fcc904c7ef523cc18284b7e3b3ccf06aca1403b7ebd3
+platformdirs==4.5.1 \
+    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
+    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
    # via virtualenv
-pre-commit==4.3.0 \
-    --hash=sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8 \
-    --hash=sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16
+pre-commit==4.5.1 \
+    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
+    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
    # via -r .github/scripts/requirements_dev.in
-pycparser==2.23 \
-    --hash=sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2 \
-    --hash=sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934
+pycparser==3.0 \
+    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
+    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
    # via cffi
-pydyf==0.11.0 \
-    --hash=sha256:0aaf9e2ebbe786ec7a78ec3fbffa4cdcecde53fd6f563221d53c6bc1328848a3 \
-    --hash=sha256:394dddf619cca9d0c55715e3c55ea121a9bf9cbc780cdc1201a2427917b86b64
+pydyf==0.12.1 \
+    --hash=sha256:ea25b4e1fe7911195cb57067560daaa266639184e8335365cc3ee5214e7eaadc \
+    --hash=sha256:fbd7e759541ac725c29c506612003de393249b94310ea78ae44cb1d04b220095
    # via weasyprint
 pyphen==0.17.2 \
    --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
@@ -442,9 +452,9 @@ pyyaml==6.0.3 \
    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
    # via pre-commit
-tinycss2==1.4.0 \
-    --hash=sha256:10c0972f6fc0fbee87c3edb76549357415e94548c1ae10ebccdea16fb404a9b7 \
-    --hash=sha256:3a49cf47b7675da0b15d0c6e1df8df4ebd96e9394bb905a5775adb0d884c5289
+tinycss2==1.5.1 \
+    --hash=sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661 \
+    --hash=sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957
    # via
    #   cssselect2
    #   weasyprint
@@ -452,17 +462,17 @@ tinyhtml5==2.0.0 \
    --hash=sha256:086f998833da24c300c414d9fe81d9b368fd04cb9d2596a008421cbc705fcfcc \
    --hash=sha256:13683277c5b176d070f82d099d977194b7a1e26815b016114f581a74bbfbf47e
    # via weasyprint
-unoserver==3.4 \
-    --hash=sha256:3dcf2204013def1d1ddd3671f38b11346bdf349fef9728277462666a8a634419 \
-    --hash=sha256:64c24d33d4f65d680a2d9f676518cb28e7fd6c1f9d9a745c33e4a4cb59afdfcd
+unoserver==3.6 \
+    --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
+    --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
    # via -r .github/scripts/requirements_dev.in
-virtualenv==20.35.4 \
-    --hash=sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c \
-    --hash=sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b
+virtualenv==20.36.1 \
+    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
+    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
    # via pre-commit
-weasyprint==66.0 \
-    --hash=sha256:82b0783b726fcd318e2c977dcdddca76515b30044bc7a830cc4fbe717582a6d0 \
-    --hash=sha256:da71dc87dc129ac9cffdc65e5477e90365ab9dbae45c744014ec1d06303dde40
+weasyprint==68.0 \
+    --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
+    --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
    # via -r .github/scripts/requirements_dev.in
 webencodings==0.5.1 \
    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
@@ -471,86 +481,27 @@ webencodings==0.5.1 \
    #   cssselect2
    #   tinycss2
    #   tinyhtml5
-zopfli==0.2.3.post1 \
-    --hash=sha256:0aa5f90d6298bda02a95bc8dc8c3c19004d5a4e44bda00b67ca7431d857b4b54 \
-    --hash=sha256:0cc20b02a9531559945324c38302fd4ba763311632d0ec8a1a0aa9c10ea363e6 \
-    --hash=sha256:1d8cc06605519e82b16df090e17cb3990d1158861b2872c3117f1168777b81e4 \
-    --hash=sha256:1f990634fd5c5c8ced8edddd8bd45fab565123b4194d6841e01811292650acae \
-    --hash=sha256:2345e713260a350bea0b01a816a469ea356bc2d63d009a0d777691ecbbcf7493 \
-    --hash=sha256:2768c877f76c8a0e7519b1c86c93757f3c01492ddde55751e9988afb7eff64e1 \
-    --hash=sha256:29ea74e72ffa6e291b8c6f2504ce6c146b4fe990c724c1450eb8e4c27fd31431 \
-    --hash=sha256:34a99592f3d9eb6f737616b5bd74b48a589fdb3cb59a01a50d636ea81d6af272 \
-    --hash=sha256:3654bfc927bc478b1c3f3ff5056ed7b20a1a37fa108ca503256d0a699c03bbb1 \
-    --hash=sha256:3657e416ffb8f31d9d3424af12122bb251befae109f2e271d87d825c92fc5b7b \
-    --hash=sha256:37d011e92f7b9622742c905fdbed9920a1d0361df84142807ea2a528419dea7f \
-    --hash=sha256:3827170de28faf144992d3d4dcf8f3998fe3c8a6a6f4a08f1d42c2ec6119d2bb \
-    --hash=sha256:39e576f93576c5c223b41d9c780bbb91fd6db4babf3223d2a4fe7bf568e2b5a8 \
-    --hash=sha256:3a89277ed5f8c0fb2d0b46d669aa0633123aa7381f1f6118c12f15e0fb48f8ca \
-    --hash=sha256:3c163911f8bad94b3e1db0a572e7c28ba681a0c91d0002ea1e4fa9264c21ef17 \
-    --hash=sha256:3f0197b6aa6eb3086ae9e66d6dd86c4d502b6c68b0ec490496348ae8c05ecaef \
-    --hash=sha256:48dba9251060289101343110ab47c0756f66f809bb4d1ddbb6d5c7e7752115c5 \
-    --hash=sha256:4915a41375bdee4db749ecd07d985a0486eb688a6619f713b7bf6fbfd145e960 \
-    --hash=sha256:4c1226a7e2c7105ac31503a9bb97454743f55d88164d6d46bc138051b77f609b \
-    --hash=sha256:4e50ffac74842c1c1018b9b73875a0d0a877c066ab06bf7cccbaa84af97e754f \
-    --hash=sha256:518f1f4ed35dd69ce06b552f84e6d081f07c552b4c661c5312d950a0b764a58a \
-    --hash=sha256:5aad740b4d4fcbaaae4887823925166ffd062db3b248b3f432198fc287381d1a \
-    --hash=sha256:5f272186e03ad55e7af09ab78055535c201b1a0bcc2944edb1768298d9c483a4 \
-    --hash=sha256:5fcfc0dc2761e4fcc15ad5d273b4d58c2e8e059d3214a7390d4d3c8e2aee644e \
-    --hash=sha256:60db20f06c3d4c5934b16cfa62a2cc5c3f0686bffe0071ed7804d3c31ab1a04e \
-    --hash=sha256:615a8ac9dda265e9cc38b2a76c3142e4a9f30fea4a79c85f670850783bc6feb4 \
-    --hash=sha256:6482db9876c68faac2d20a96b566ffbf65ddaadd97b222e4e73641f4f8722fc4 \
-    --hash=sha256:6617fb10f9e4393b331941861d73afb119cd847e88e4974bdbe8068ceef3f73f \
-    --hash=sha256:676919fba7311125244eb0c4393679ac5fe856e5864a15d122bd815205369fa0 \
-    --hash=sha256:6c2d2bc8129707e34c51f9352c4636ca313b52350bbb7e04637c46c1818a2a70 \
-    --hash=sha256:71390dbd3fbf6ebea9a5d85ffed8c26ee1453ee09248e9b88486e30e0397b775 \
-    --hash=sha256:716cdbfc57bfd3d3e31a58e6246e8190e6849b7dbb7c4ce39ef8bbf0edb8f6d5 \
-    --hash=sha256:75a26a2307b10745a83b660c404416e984ee6fca515ec7f0765f69af3ce08072 \
-    --hash=sha256:7be5cc6732eb7b4df17305d8a7b293223f934a31783a874a01164703bc1be6cd \
-    --hash=sha256:7cce242b5df12b2b172489daf19c32e5577dd2fac659eb4b17f6a6efb446fd5c \
-    --hash=sha256:81c341d9bb87a6dbbb0d45d6e272aca80c7c97b4b210f9b6e233bf8b87242f29 \
-    --hash=sha256:89899641d4de97dbad8e0cde690040d078b6aea04066dacaab98e0b5a23573f2 \
-    --hash=sha256:8d5ab297d660b75c159190ce6d73035502310e40fd35170aed7d1a1aea7ddd65 \
-    --hash=sha256:8fbe5bcf10d01aab3513550f284c09fef32f342b36f56bfae2120a9c4d12c130 \
-    --hash=sha256:91a2327a4d7e77471fa4fbb26991c6de4a738c6fc6a33e09bb25f56a870a4b7b \
-    --hash=sha256:95a260cafd56b8fffa679918937401c80bb38e1681c448b988022e4c3610965d \
-    --hash=sha256:96484dc0f48be1c5d7ae9f38ed1ce41e3675fd506b27c11a6607f14b49101e99 \
-    --hash=sha256:9a6aec38a989bad7ddd1ef53f1265699e49e294d08231b5313d61293f3cd6237 \
-    --hash=sha256:9ba214f4f45bec195ee8559651154d3ac2932470b9d91c5715fc29c013349f8c \
-    --hash=sha256:9f4a7ec2770e6af05f5a02733fd3900f30a9cd58e5d6d3727e14c5bcd6e7d587 \
-    --hash=sha256:a1cf720896d2ce998bc8e051d4b4ce0d8bec007aab6243102e8e1d22a0b2fb3f \
-    --hash=sha256:a241a68581d34d67b40c425cce3d1fd211c092f99d9250947824ccba9f491949 \
-    --hash=sha256:a53b18797cdef27e019db595d66c4b077325afe2fd62145953275f53d84ce40c \
-    --hash=sha256:a82fc2dbebe6eb908b9c665e71496f8525c1bc4d2e3a7a7722ef2b128b6227c8 \
-    --hash=sha256:a86eb88e06bd87e1fff31dac878965c26b0c26db59ddcf78bb0379a954b120de \
-    --hash=sha256:aa588b21044f8a74e423d8c8a4c7fc9988501878aacced793467010039c50734 \
-    --hash=sha256:b05296e8bc88c92e2b21e0a9bae4740c1551ee613c1d93a51fd28a7a0b2b6fbb \
-    --hash=sha256:b0ec13f352ea5ae0fc91f98a48540512eed0767d0ec4f7f3cb92d92797983d18 \
-    --hash=sha256:b3df42f52502438ee973042cc551877d24619fa1cd38ef7b7e9ac74200daca8b \
-    --hash=sha256:b78008a69300d929ca2efeffec951b64a312e9a811e265ea4a907ab546d79fa6 \
-    --hash=sha256:b9026a21b6d41eb0e2e63f5bc1242c3fcc43ecb770963cda99a4307863dac12e \
-    --hash=sha256:bbe429fc50686bb2a2608a30843e36fbaa123462a5284f136c7d9e0145220bfd \
-    --hash=sha256:bfa1eb759e07d8b7aa7a310a2bc535e127ee70addf90dc8d4b946b593c3e51a8 \
-    --hash=sha256:c1e0ed5d84ffa2d677cc9582fc01e61dab2e7ef8b8996e055f0a76167b1b94df \
-    --hash=sha256:c4278d1873ce6e803e5d4f8d702fd3026bd67fca744aa98881324d1157ddf748 \
-    --hash=sha256:cac2b37ab21c2b36a10b685b1893ebd6b0f83ae26004838ac817680881576567 \
-    --hash=sha256:cbe6df25807227519debd1a57ab236f5f6bad441500e85b13903e51f93a43214 \
-    --hash=sha256:cd2c002f160502608dcc822ed2441a0f4509c52e86fcfd1a09e937278ed1ca14 \
-    --hash=sha256:e0137dd64a493ba6a4be37405cfd6febe650a98cc1e9dca8f6b8c63b1db11b41 \
-    --hash=sha256:e63d558847166543c2c9789e6f985400a520b7eacc4b99181668b2c3aeadd352 \
-    --hash=sha256:eb45a34f23da4f8bc712b6376ca5396914b0b7c09adbb001dad964eb7f3132f8 \
-    --hash=sha256:ecb7572df5372abce8073df078207d9d1749f20b8b136089916a4a0868d56051 \
-    --hash=sha256:f12000a6accdd4bf0a3fa6eaa1b1c7a7bc80af0a2edf3f89d770d3dcce1d0e22 \
-    --hash=sha256:f7d69c1a7168ad0e9cb864e8663acb232986a0c9c9cb9801f56bf6214f53a54d \
-    --hash=sha256:f815fcc2b2a457977724bad97fb4854022980f51ce7b136925e336b530545ae1 \
-    --hash=sha256:fc39f5c27f962ec8660d8d20c24762431131b5d8c672b44b0a54cf2b5bcde9b9
+zopfli==0.4.0 \
+    --hash=sha256:03181d48e719fcb6cf8340189c61e8f9883d8bbbdf76bf5212a74457f7d083c1 \
+    --hash=sha256:18b5f1570f64d4988482e4466f10ef5f2a30f687c19ad62a64560f2152dc89eb \
+    --hash=sha256:25e4863b8dc30e5d5309f87c106b0b7d3da4ed0e340b8a52b36d4471e797589f \
+    --hash=sha256:7d66337be6d5613dec55213e9ac28f378c41e2cc04fbad4a10748e4df774ca85 \
+    --hash=sha256:9097e8e1dfdb7f5aea5464e469946857e80502b6d29ba1b232450916bd4a74d1 \
+    --hash=sha256:a8ee992b2549e090cd3f0178bf606dd41a29e0613a04cdf5054224662c72dce6 \
+    --hash=sha256:b72a010d205d00b2855acc2302772067362f9ab5a012e3550662aec60d28e6b3 \
+    --hash=sha256:b8bdb41fbfdc4738b7bdc09ed7c1e951579fae192391a5e694d59bb186cdbec7 \
+    --hash=sha256:c3ba02a9a6ca90481d2b2f68bab038b310d63a1e3b5ae305e95a6599787ed941 \
+    --hash=sha256:d1b98ad47c434ef213444a03ef2f826eeec100144d64f6a57504b9893d3931ce \
+    --hash=sha256:f67d04280065e24cb9a4174cb6b3d1f763687f8cb2963aa135ad8f57c6995f5a \
+    --hash=sha256:f94e4dd7d76b4fe9f5d9229372be20d7f786164eea5152d1af1c34298c3d5975
    # via fonttools

 # The following packages are considered to be unsafe in a requirements file:
-pip==25.3 \
-    --hash=sha256:8d0538dbbd7babbd207f261ed969c65de439f6bc9e5dbd3b3b9a77f25d95f343 \
-    --hash=sha256:9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd
+pip==26.0 \
+    --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
+    --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
    # via -r .github/scripts/requirements_dev.in
-setuptools==80.9.0 \
-    --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922 \
-    --hash=sha256:f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c
+setuptools==80.10.2 \
+    --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
+    --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
    # via -r .github/scripts/requirements_dev.in
@@ -4,33 +4,33 @@
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
 #
-cfgv==3.4.0 \
-    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
-    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
+    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
    # via pre-commit
 distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.20.0 \
-    --hash=sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2 \
-    --hash=sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4
+filelock==3.20.3 \
+    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
+    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
    # via virtualenv
-identify==2.6.15 \
-    --hash=sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757 \
-    --hash=sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf
+identify==2.6.16 \
+    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
+    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
    # via pre-commit
-nodeenv==1.9.1 \
-    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
-    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
+    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
    # via pre-commit
-platformdirs==4.5.0 \
-    --hash=sha256:70ddccdd7c99fc5942e9fc25636a8b34d04c24b335100223152c2803e4063312 \
-    --hash=sha256:e578a81bb873cbb89a41fcc904c7ef523cc18284b7e3b3ccf06aca1403b7ebd3
+platformdirs==4.5.1 \
+    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
+    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
    # via virtualenv
-pre-commit==4.3.0 \
-    --hash=sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8 \
-    --hash=sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16
+pre-commit==4.5.1 \
+    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
+    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
    # via -r .github/scripts/requirements_pre_commit.in
 pyyaml==6.0.3 \
    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
@@ -107,7 +107,7 @@ pyyaml==6.0.3 \
    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
    # via pre-commit
-virtualenv==20.35.4 \
-    --hash=sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c \
-    --hash=sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b
+virtualenv==20.36.1 \
+    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
+    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
    # via pre-commit
@@ -1 +1,2 @@
 tomlkit
+tomli-w
@@ -4,7 +4,11 @@
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
 #
-tomlkit==0.13.3 \
-    --hash=sha256:430cf247ee57df2b94ee3fbe588e71d362a941ebb545dec29b53961d61add2a1 \
-    --hash=sha256:c89c649d79ee40629a9fda55f8ace8c6a1b42deb912b2a8fd8d942ddadb606b0
+tomli-w==1.2.0 \
+    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
+    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
+    # via -r .github/scripts/requirements_sync_readme.in
+tomlkit==0.14.0 \
+    --hash=sha256:592064ed85b40fa213469f81ac584f67a4f2992509a7c3ea2d632208623a3680 \
+    --hash=sha256:cf00efca415dbd57575befb1f6634c4f42d2d87dbba376128adb42c121b87064
    # via -r .github/scripts/requirements_sync_readme.in
@@ -11,6 +11,10 @@ on:
      allow_fork:
        description: "Allow deploying fork PR?"
        required: false
+        type: choice
+        options:
+          - "true"
+          - "false"
        default: "false"

 permissions:
@@ -31,7 +35,7 @@ jobs:
      pr_ref: ${{ steps.resolve.outputs.ref }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

@@ -42,7 +46,7 @@ jobs:
          script: |
            const { owner, repo } = context.repo;
            let prNumber = context.eventName === 'workflow_dispatch'
-              ? parseInt(process.env.INPUT_PR, 10)
+              ? parseInt(context.payload.inputs.pr, 10)
              : context.payload.number;

            if (!Number.isInteger(prNumber)) { core.setFailed('Invalid PR number'); return; }
@@ -107,12 +111,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout main repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ github.repository }}
          ref: main
@@ -134,7 +138,7 @@ jobs:
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
-            
+
            // Delete previous V2 deployment comments to avoid clutter
            const { data: comments } = await github.rest.issues.listComments({
              owner,
@@ -157,7 +161,7 @@ jobs:
                comment_id: comment.id
              });
            }
-            
+
            // Create new deployment started comment
            const { data: newComment } = await github.rest.issues.createComment({
              owner,
@@ -168,15 +172,15 @@ jobs:
            return newComment.id;

      - name: Checkout PR
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ needs.check-pr.outputs.pr_repository }}
          ref: ${{ needs.check-pr.outputs.pr_ref }}
          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0  # Fetch full history for commit hash detection
+          fetch-depth: 0 # Fetch full history for commit hash detection

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Get version number
        id: versionNumber
@@ -185,93 +189,56 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Get commit hashes for frontend and backend
-        id: commit-hashes
+      - name: Get commit hash for app
+        id: commit-hash
        run: |
-          # Get last commit that touched the frontend folder, docker/frontend, or docker/compose
-          FRONTEND_HASH=$(git log -1 --format="%H" -- frontend/ docker/frontend/ docker/compose/ 2>/dev/null || echo "")
-          if [ -z "$FRONTEND_HASH" ]; then
-            FRONTEND_HASH="no-frontend-changes"
+          # Get last commit that touched the application code
+          APP_HASH=$(git log -1 --format="%H" -- . 2>/dev/null || echo "")
+          if [ -z "$APP_HASH" ]; then
+            APP_HASH="no-changes"
          fi

-          # Get last commit that touched backend code, docker/backend, or docker/compose
-          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
-          if [ -z "$BACKEND_HASH" ]; then
-            BACKEND_HASH="no-backend-changes"
-          fi
-          
-          echo "Frontend hash: $FRONTEND_HASH"
-          echo "Backend hash: $BACKEND_HASH"
-          
-          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
-          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-          
-          # Short hashes for tags
-          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
-            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
+          echo "App hash: $APP_HASH"
+          echo "app_hash=$APP_HASH" >> $GITHUB_OUTPUT
+
+          # Short hash for tags
+          if [ "$APP_HASH" = "no-changes" ]; then
+            echo "app_short=no-changes" >> $GITHUB_OUTPUT
          else
-            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
-          fi
-          
-          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
-            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
-          else
-            echo "backend_short=${BACKEND_HASH:0:8}" >> $GITHUB_OUTPUT
+            echo "app_short=${APP_HASH:0:8}" >> $GITHUB_OUTPUT
          fi

-      - name: Check if frontend image exists
-        id: check-frontend
+      - name: Check if image exists
+        id: check-image
        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }} >/dev/null 2>&1; then
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Frontend image already exists, skipping build"
+            echo "Image already exists, skipping build"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Frontend image needs to be built"
+            echo "Image needs to be built"
          fi

-      - name: Check if backend image exists
-        id: check-backend
-        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }} >/dev/null 2>&1; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Backend image already exists, skipping build"
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Backend image needs to be built"
-          fi
-
-      - name: Build and push V2 frontend image
-        if: steps.check-frontend.outputs.exists == 'false'
+      - name: Build and push V2 image
+        if: steps.check-image.outputs.exists == 'false'
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
-          file: ./docker/frontend/Dockerfile
+          file: ./docker/embedded/Dockerfile
          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push V2 backend image
-        if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Deploy V2 to VPS
@@ -279,17 +246,16 @@ jobs:
        run: |
          # Use same port strategy as regular PRs - just the PR number
          V2_PORT=${{ needs.check-pr.outputs.pr_number }}
-          BACKEND_PORT=$((V2_PORT + 10000))  # Backend on higher port to avoid conflicts
-          
-          # Create docker-compose for V2 with separate frontend and backend
+
+          # Create docker-compose for V2 with unified embedded image
          cat > docker-compose.yml << EOF
          version: '3.3'
          services:
-            stirling-pdf-v2-backend:
-              container_name: stirling-pdf-v2-backend-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+            stirling-pdf-v2:
+              container_name: stirling-pdf-v2-pr-${{ needs.check-pr.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
              ports:
-                - "${BACKEND_PORT}:8080"    # Backend API port
+                - "${V2_PORT}:8080"
              volumes:
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
@@ -301,7 +267,7 @@ jobs:
                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
-                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"
+                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
                UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                SYSTEM_MAXFILESIZE: "100"
                METRICS_ENABLED: "true"
@@ -309,23 +275,12 @@ jobs:
                SWAGGER_SERVER_URL: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
                baseUrl: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
              restart: on-failure:5
-
-            stirling-pdf-v2-frontend:
-              container_name: stirling-pdf-v2-frontend-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-              ports:
-                - "${V2_PORT}:80"          # Frontend port (same as regular PRs)
-              environment:
-                VITE_API_BASE_URL: "http://${{ secrets.VPS_HOST }}:${BACKEND_PORT}"
-              depends_on:
-                - stirling-pdf-v2-backend
-              restart: on-failure:5
          EOF

          # Deploy to VPS
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose-v2.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose-v2.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create V2 PR-specific directories
            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}

@@ -335,15 +290,15 @@ jobs:
            # Stop any existing container and clean up
            cd /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}
            docker-compose down --remove-orphans 2>/dev/null || true
-            
+
            # Start the new container
            docker-compose pull
            docker-compose up -d
-            
+
            # Clean up unused Docker resources to save space
            docker system prune -af --volumes || true

-            # Clean up old backend/frontend images (older than 2 weeks)
+            # Clean up old images (older than 2 weeks)
            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
          ENDSSH

@@ -359,7 +314,7 @@ jobs:
            const { owner, repo } = context.repo;
            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
            const v2Port = ${{ steps.deploy.outputs.v2_port }};
-            
+
            // Delete the "deploying..." comment since we're posting the final result
            const deploymentStartedId = ${{ steps.deployment-started.outputs.result }};
            if (deploymentStartedId) {
@@ -374,12 +329,12 @@ jobs:
                console.log(`Could not delete deployment started comment: ${error.message}`);
              }
            }
-            
-            const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${v2Port}`;
+
+            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;
            const httpsUrl = `https://${v2Port}.ssl.stirlingpdf.cloud`;

            const commentBody = `## 🚀 V2 Auto-Deployment Complete!\n\n` +
-                              `Your V2 PR with the new frontend/backend split architecture has been deployed!\n\n` +
+                              `Your V2 PR with embedded architecture has been deployed!\n\n` +
                              `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
                              `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                              `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
@@ -402,12 +357,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -425,19 +380,19 @@ jobs:
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ github.event.pull_request.number }};
-            
+
            // Find and delete V2 deployment comments
            const { data: comments } = await github.rest.issues.listComments({
              owner,
              repo,
              issue_number: prNumber
            });
-            
+
            const v2Comments = comments.filter(c =>
              c.body?.includes("## 🚀 V2 Auto-Deployment Complete!") &&
              c.user?.type === "Bot"
            );
-            
+
            for (const comment of v2Comments) {
              await github.rest.issues.deleteComment({
                owner,
@@ -450,12 +405,12 @@ jobs:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Cleanup V2 deployment
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
            if [ -d "/stirling/V2-PR-${{ github.event.pull_request.number }}" ]; then
              echo "Found V2 PR directory, proceeding with cleanup..."

@@ -469,9 +424,8 @@ jobs:
              # Remove V2 PR-specific directories
              rm -rf /stirling/V2-PR-${{ github.event.pull_request.number }}

-              # Clean up V2 containers by name (in case compose cleanup missed them)
-              docker rm -f stirling-pdf-v2-frontend-pr-${{ github.event.pull_request.number }} || true
-              docker rm -f stirling-pdf-v2-backend-pr-${{ github.event.pull_request.number }} || true
+              # Clean up V2 container by name (in case compose cleanup missed it)
+              docker rm -f stirling-pdf-v2-pr-${{ github.event.pull_request.number }} || true

              echo "V2 cleanup completed"
            else
@@ -25,8 +25,7 @@ jobs:
        github.event.comment.user.login == 'frooodle' ||
        github.event.comment.user.login == 'sf298' ||
        github.event.comment.user.login == 'Ludy87' ||
-        github.event.comment.user.login == 'LaserKaspar' ||
-        github.event.comment.user.login == 'sbplat' ||
+        github.event.comment.user.login == 'balazs-szucs' ||
        github.event.comment.user.login == 'reecebrowne' ||
        github.event.comment.user.login == 'DarioGii' ||
        github.event.comment.user.login == 'EthanHealy01' ||
@@ -41,12 +40,12 @@ jobs:
      enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -129,12 +128,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -146,17 +145,22 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
          token: ${{ steps.setup-bot.outputs.token }}

-      - name: Set up JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "17"
+          java-version: "21"
          distribution: "temurin"

+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
      - name: Run Gradle Command
        run: |
          if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -164,15 +168,18 @@ jobs:
          else
            export DISABLE_ADDITIONAL_FEATURES=false
          fi
-          ./gradlew clean build
+          ./gradlew build
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          STIRLING_PDF_DESKTOP_UI: false

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -190,7 +197,7 @@ jobs:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Deploy to VPS
@@ -252,9 +259,9 @@ jobs:
          EOF

          # Then copy the file and execute commands
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create PR-specific directories
            mkdir -p /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/{data,config,logs}

@@ -336,7 +343,7 @@ jobs:
            const prNumber = ${{ needs.check-comment.outputs.pr_number }};
            const securityStatus = process.env.security_status || "Security Disabled";

-            const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${prNumber}`;
+            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${prNumber}`;
            const commentBody = `## 🚀 PR Test Deployment\n\n` +
                              `Your PR has been deployed for testing!\n\n` +
                              `🔗 **Test URL:** [${deploymentUrl}](${deploymentUrl})\n` +
@@ -363,12 +370,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -8,7 +8,7 @@ permissions:
  contents: read

 env:
-  SERVER_IP: ${{ secrets.VPS_IP }} # Add this to your GitHub secrets
+  SERVER_IP: ${{ secrets.NEW_VPS_IP }} # Add this to your GitHub secrets
  CLEANUP_PERFORMED: "false" # Add flag to track if cleanup occurred

 jobs:
@@ -21,12 +21,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -96,19 +96,18 @@ jobs:
            const hasDeploymentComment = deploymentComments.length > 0;
            core.setOutput('present', (hasLabel || hasDeploymentComment) ? 'true' : 'false');

-
      - name: Set up SSH
        if: steps.remove-label-comment.outputs.present == 'true'
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Cleanup PR deployment
        if: steps.remove-label-comment.outputs.present == 'true'
        id: cleanup
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
            if [ -d "/stirling/PR-${{ github.event.pull_request.number }}" ]; then
              echo "Found PR directory, proceeding with cleanup..."

@@ -5,7 +5,7 @@ on:
    types: [opened, edited]
    branches: [main]

-permissions:  # required for secure-repo hardening
+permissions: # required for secure-repo hardening
  contents: read

 jobs:
@@ -19,11 +19,11 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v2.0.4
+        uses: actions/ai-inference@a6101c89c6feaecc585efdd8d461f18bb7896f20 # v2.0.5
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -4,7 +4,7 @@ on:
    types: [opened, synchronize]
    branches:
      - main
-      - V2
+      - V3

 permissions:
  contents: read
@@ -16,11 +16,11 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -2,7 +2,7 @@ name: Build and Test Workflow

 on:
  pull_request:
-    branches: ["main", "V2", "V2-gha"]
+    branches: ["main"]
  workflow_dispatch:

 # cancel in-progress jobs if a new job is triggered
@@ -27,15 +27,16 @@ jobs:
    timeout-minutes: 3
    outputs:
      build: ${{ steps.changes.outputs.build }}
-      app: ${{ steps.changes.outputs.app }}
      project: ${{ steps.changes.outputs.project }}
      openapi: ${{ steps.changes.outputs.openapi }}
+      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -55,25 +56,31 @@ jobs:
        spring-security: [true, false]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: ${{ matrix.jdk-version }}
          distribution: "temurin"
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14
+
      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
-        run: ./gradlew clean build -PnoSpotless
+        run: ./gradlew build -PnoSpotless
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
+
      - name: Check Test Reports Exist
        if: always()
        run: |
@@ -91,12 +98,14 @@ jobs:
              exit 1
            fi
          done
+
      - name: Upload Test Reports
        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
          path: |
+            app/**/build/reports/jacoco/test
            app/**/build/reports/tests/
            app/**/build/test-results/
            app/**/build/reports/problems/
@@ -104,51 +113,71 @@ jobs:
          retention-days: 3
          if-no-files-found: warn

+      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
+        id: jacoco
+        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
+        with:
+          paths: |
+            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
+          token: ${{ secrets.GITHUB_TOKEN }}
+          min-coverage-overall: 10
+          min-coverage-changed-files: 0
+          comment-type: summary
+
  check-generateOpenApiDocs:
    if: needs.files-changed.outputs.openapi == 'true'
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "17"
+          java-version: "21"
          distribution: "temurin"
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
      - name: Generate OpenAPI documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
-      
+
      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: openapi-docs
          path: ./SwaggerDoc.json

  frontend-validation:
+    if: needs.files-changed.outputs.frontend == 'true'
+    needs: files-changed
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
-          node-version: '22'
-          cache: 'npm'
+          node-version: "22"
+          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install frontend dependencies
        run: cd frontend && npm ci
@@ -161,7 +190,7 @@ jobs:
      - name: Run frontend tests
        run: cd frontend && npm run test -- --run
      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: frontend-build
          path: frontend/dist/
@@ -173,23 +202,34 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit
+
      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "17"
+          java-version: "21"
          distribution: "temurin"

+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
      - name: check the licenses for compatibility
-        run: ./gradlew clean checkLicense
+        run: ./gradlew checkLicense
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

      - name: FAILED - check the licenses for compatibility
        if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: dependencies-without-allowed-license.json
          path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -216,21 +256,26 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up Java 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "17"
+          java-version: "21"
          distribution: "temurin"

+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Install Docker Compose
        run: |
@@ -241,7 +286,7 @@ jobs:
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: "3.12"
-          cache: 'pip' # caching pip dependencies
+          cache: "pip" # caching pip dependencies
          cache-dependency-path: ./testing/cucumber/requirements.txt

      - name: Pip requirements
@@ -254,6 +299,10 @@ jobs:
          chmod +x ./testing/test.sh
          chmod +x ./testing/test_disabledEndpoints.sh
          ./testing/test.sh
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

  test-build-docker-images:
    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
@@ -271,12 +320,12 @@ jobs:
            artifact-suffix: Dockerfile.fat
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Free disk space on runner
        run: |
@@ -285,29 +334,32 @@ jobs:
          docker system prune -af || true
          echo "Disk space after cleanup:" && df -h

-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "17"
+          java-version: "21"
          distribution: "temurin"

-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

      - name: Build application
-        run: ./gradlew clean build
+        run: ./gradlew build
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
          STIRLING_PDF_DESKTOP_UI: false

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Build ${{ matrix.docker-rev }}
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
@@ -316,15 +368,15 @@ jobs:
          context: .
          file: ./${{ matrix.docker-rev }}
          push: false
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.artifact-suffix }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.artifact-suffix }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Upload Reports
        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: reports-docker-${{ matrix.artifact-suffix }}
          path: |
@@ -7,6 +7,8 @@ on:
    types: [opened, synchronize, reopened]
    paths:
      - "frontend/public/locales/*/translation.toml"
+      - ".github/scripts/check_language_toml.py"
+      - ".github/workflows/check_toml.yml"

 # cancel in-progress jobs if a new job is triggered
 concurrency:
@@ -25,12 +27,12 @@ jobs:
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout main branch first
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -199,8 +201,7 @@ jobs:
          python-version: "3.12"

      - name: Install Python dependencies
-        run: |
-          pip install tomli-w
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt

      - name: Run Python script to check files
        id: run-check
@@ -1,79 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
-
-#disable for now
-#on:
-#  push:
-#    branches: ["main"]
-#  pull_request:
-    # The branches below must be a subset of the branches above
-#    branches: ["main"]
-#  schedule:
-#    - cron: "0 0 * * 1"
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ["java"]
-        # CodeQL supports [ $supported-codeql-languages ]
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
-        with:
-          languages: ${{ matrix.language }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-
-      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-      # If this step fails, then you should remove it and run the build manually (see below)
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
-
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-      #   If the Autobuild fails above, remove it and uncomment the following three lines.
-      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-      # - run: |
-      #   echo "Run, Build Application using script"
-      #   ./location_of_script_within_repo/buildscript.sh
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
-        with:
-          category: "/language:${{matrix.language}}"
@@ -17,13 +17,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: "Checkout Repository"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Dependency Review"
        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
        with:
-          config-file: './.github/config/dependency-review-config.yml'
+          config-file: "./.github/config/dependency-review-config.yml"
@@ -18,15 +18,15 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Get commit hashes for frontend and backend
        id: commit-hashes
@@ -36,26 +36,26 @@ jobs:
          if [ -z "$FRONTEND_HASH" ]; then
            FRONTEND_HASH="no-frontend-changes"
          fi
-          
+
          # Get last commit that touched backend code, docker/backend, or docker/compose
          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
          if [ -z "$BACKEND_HASH" ]; then
            BACKEND_HASH="no-backend-changes"
          fi
-          
+
          echo "Frontend hash: $FRONTEND_HASH"
          echo "Backend hash: $BACKEND_HASH"
-          
+
          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-          
+
          # Short hashes for tags
          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
          else
            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
          fi
-          
+
          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
          else
@@ -84,16 +84,15 @@ jobs:
            echo "Backend image needs to be built"
          fi

-
      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Build and push frontend image
        if: steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: ./docker/frontend/Dockerfile
@@ -103,10 +102,10 @@ jobs:
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64
-      
+
      - name: Build and push backend image
        if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: ./docker/backend/Dockerfile
@@ -117,18 +116,16 @@ jobs:
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

-
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          chmod 600 ../private.key

-
      - name: Deploy to VPS on port 3000
        run: |
          export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
-      
+
          cat > $UNIQUE_NAME << EOF
          version: '3.3'
          services:
@@ -154,24 +151,24 @@ jobs:
                SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
                baseUrl: "https://demo.stirlingpdf.cloud"
              restart: on-failure:5
-      
+
            frontend:
              container_name: stirling-v2-frontend
              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
              ports:
                - "3000:80"
              environment:
-                VITE_API_BASE_URL: "http://${{ secrets.VPS_HOST }}:13000"
+                VITE_API_BASE_URL: "http://${{ secrets.NEW_VPS_HOST }}:13000"
              depends_on:
                - backend
              restart: on-failure:5
          EOF
-      
+
          # Copy to remote with unique name
-          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/$UNIQUE_NAME
-      
+          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/$UNIQUE_NAME
+
          # SSH and rename/move atomically to avoid interference
-          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            mkdir -p /stirling/V2/{data,config,logs}
            mv /tmp/$UNIQUE_NAME /stirling/V2/docker-compose.yml
            cd /stirling/V2
@@ -186,4 +183,3 @@ jobs:
        if: always()
        run: |
          rm -f ../private.key
-
@@ -0,0 +1,518 @@
+name: License Report Workflow
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  files-changed:
+    name: detect what files changed
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    outputs:
+      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
+      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check for file changes
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: changes
+        with:
+          filters: .github/config/.files.yaml
+
+  generate-frontend-license-report:
+    if: needs.files-changed.outputs.licenses-frontend == 'true'
+    name: Generate Frontend License Report
+    needs: files-changed
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout PR head (default)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup GitHub App Bot
+        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Checkout BASE branch (safe script)
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: base
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        run: npm ci --ignore-scripts --audit=false --fund=false
+
+      - name: Generate frontend license report (internal PR)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        working-directory: frontend
+        env:
+          PR_IS_FORK: "false"
+        run: npm run generate-licenses
+
+      - name: Generate frontend license report (fork PRs, pinned)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        working-directory: frontend
+        run: |
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
+
+      - name: Postprocess with project script (BASE version)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          PR_IS_FORK: "true"
+        run: |
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json
+
+      - name: Copy postprocessed artifacts back (fork PRs)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        run: |
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
+          fi
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
+          fi
+
+      - name: Check for license warnings
+        run: |
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
+            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
+          else
+            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
+          fi
+
+      # PR Event: Check licenses and comment on PR
+      - name: Delete previous license check comments
+        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+
+            // Get all comments on the PR
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber,
+              per_page: 100
+            });
+
+            // Filter for license check comments
+            const licenseComments = comments.filter(comment => 
+              comment.body.includes('## ✅ Frontend License Check Passed') ||
+              comment.body.includes('## ❌ Frontend License Check Failed')
+            );
+
+            // Delete old license check comments
+            for (const comment of licenseComments) {
+              console.log(`Deleting old license check comment: ${comment.id}`);
+              await github.rest.issues.deleteComment({
+                owner,
+                repo,
+                comment_id: comment.id
+              });
+            }
+
+      - name: Summarize results (fork PRs)
+        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) || github.actor == 'dependabot[bot]'
+        run: |
+          {
+            echo "## Frontend License Check"
+            echo ""
+            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
+              echo "❌ **Failed** – incompatible or unknown licenses found."
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
+                echo ""
+                echo "### Warnings"
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
+              fi
+            else
+              echo "✅ **Passed** – no license warnings detected."
+            fi
+            echo ""
+            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Comment on PR - License Check Results
+        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
+
+            let commentBody;
+
+            if (hasWarnings) {
+              // Read warnings file to get specific issues
+              const fs = require('fs');
+              let warningDetails = '';
+              try {
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
+                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
+              } catch (e) {
+                warningDetails = 'Unable to read warning details';
+              }
+
+              commentBody = `## ❌ Frontend License Check Failed
+
+              The frontend license check has detected compatibility warnings that require review:
+
+              ${warningDetails}
+
+              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
+
+              _This check will fail the PR until license issues are resolved._`;
+            } else {
+              commentBody = `## ✅ Frontend License Check Passed
+
+              All frontend licenses have been validated and no compatibility warnings were detected.
+
+              The frontend license report has been updated successfully.`;
+            }
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: commentBody
+            });
+
+      - name: Fail workflow if license warnings exist (PR only)
+        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: |
+          echo "❌ License warnings detected. Failing the workflow."
+          exit 1
+
+      # Push Event: Commit license files and create PR
+      - name: Commit changes (Push only)
+        if: github.event_name == 'push'
+        run: |
+          git add frontend/src/assets/3rdPartyLicenses.json
+          # Note: Do NOT commit license-warnings.json - it's only for PR review
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Prepare PR body (Push only)
+        if: github.event_name == 'push'
+        run: |
+          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+
+          This PR updates the frontend license report based on changes to package.json dependencies."
+
+          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
+            PR_BODY="$PR_BODY
+
+          ## ⚠️ License Compatibility Warnings
+
+          The following licenses may require review for corporate compatibility:
+
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
+
+          Please review these licenses to ensure they are acceptable for your use case."
+          fi
+
+          echo "PR_BODY<<EOF" >> $GITHUB_ENV
+          echo "$PR_BODY" >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+
+      - name: Create Pull Request (Push only)
+        id: cpr
+        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update Frontend 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-frontend-3rd-party-licenses
+          base: main
+          title: "Update Frontend 3rd Party Licenses"
+          body: ${{ env.PR_BODY }}
+          labels: Licenses,github-actions,frontend
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+
+      - name: Add review required label (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+
+  generate-backend-license-report:
+    if: needs.files-changed.outputs.licenses-backend == 'true'
+    needs: files-changed
+    name: Generate Backend License Report
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup GitHub App Bot
+        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
+      - name: Check licenses and generate report
+        id: license-check
+        run: |
+          ./gradlew checkLicense generateLicenseReport || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: false
+          STIRLING_PDF_DESKTOP_UI: true
+
+      - name: Check for license compatibility issues
+        run: |
+          if [ -f build/reports/dependency-license/dependencies-without-allowed-license.json ] && \
+             jq '.dependenciesWithoutAllowedLicenses | length > 0' build/reports/dependency-license/dependencies-without-allowed-license.json | grep -q true; then
+            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
+          else
+            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
+          fi
+        if: always()
+
+      - name: Upload artifact on license issues
+        if: env.LICENSE_WARNINGS_EXIST == 'true'
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: backend-dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+
+      - name: Move license file
+        if: env.LICENSE_CHECK_FAILED != 'true' && env.LICENSE_WARNINGS_EXIST == 'false'
+        run: |
+          mkdir -p app/core/src/main/resources/static
+          cp build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
+
+      - name: Delete previous backend license check comments
+        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber,
+              per_page: 100
+            });
+
+            const backendLicenseComments = comments.filter(comment => 
+              comment.body.includes('## ✅ Backend License Check Passed') ||
+              comment.body.includes('## ❌ Backend License Check Failed')
+            );
+
+            for (const comment of backendLicenseComments) {
+              console.log(`Deleting old backend license comment: ${comment.id}`);
+              await github.rest.issues.deleteComment({
+                owner,
+                repo,
+                comment_id: comment.id
+              });
+            }
+
+      - name: Comment on PR - Backend License Check Results
+        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
+            const fs = require('fs');
+            let warningDetails = '';
+
+            if (hasWarnings) {
+              try {
+                const warningsFile = 'build/reports/dependency-license/dependencies-without-allowed-license.json';
+                if (fs.existsSync(warningsFile)) {
+                  const data = JSON.parse(fs.readFileSync(warningsFile, 'utf8'));
+                  if (data.length > 0) {
+                    warningDetails = data.map(dep => `- **${dep.moduleName}@${dep.moduleVersion}** – ${dep.moduleLicenses.map(l => l.licenseName).join(', ')}`).join('\n');
+                  }
+                }
+              } catch (e) {
+                warningDetails = 'Unable to parse warning details.';
+              }
+            }
+
+            let commentBody;
+            if (hasWarnings) {
+              commentBody = `## ❌ Backend License Check Failed
+
+              The backend license check has detected dependencies with incompatible or unallowed licenses:
+
+              ${warningDetails || 'See uploaded artifact for details.'}
+
+              **Action Required:** Please review these licenses and resolve before merging.
+
+              _This check will fail the PR until license issues are resolved._`;
+            } else {
+              commentBody = `## ✅ Backend License Check Passed
+
+              All backend dependencies have valid and allowed licenses.
+
+              The backend license report has been updated successfully.`;
+            }
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: commentBody
+            });
+
+      - name: Fail workflow if license warnings exist (PR only)
+        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: |
+          echo "❌ Backend license warnings detected. Failing the workflow."
+          exit 1
+
+      - name: Commit changes (push only)
+        if: github.event_name == 'push' && env.LICENSE_WARNINGS_EXIST == 'false'
+        run: |
+          git config user.name "${{ steps.setup-bot.outputs.committer }}"
+          git config user.email "${{ steps.setup-bot.outputs.committer-email || 'bot@github.com' }}"
+          git add app/core/src/main/resources/static/3rdPartyLicenses.json
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Prepare PR body (push only)
+        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
+        run: |
+          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+
+          This PR updates the backend license report based on dependency changes."
+
+          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
+            PR_BODY="$PR_BODY
+
+          ## ⚠️ License Compatibility Warnings
+
+          Incompatible licenses detected – manual review required before merge."
+          fi
+          echo "PR_BODY<<EOF" >> $GITHUB_ENV
+          echo "$PR_BODY" >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+
+      - name: Create Pull Request (push only)
+        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
+        id: cpr
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update Backend 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-backend-3rd-party-licenses
+          base: main
+          title: "Update Backend 3rd Party Licenses"
+          body: ${{ env.PR_BODY }}
+          labels: Licenses,github-actions,backend
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge (push only, no warnings)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+
+      - name: Add review required label (push only, with warnings)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
@@ -1,282 +0,0 @@
-name: Frontend License Report Workflow
-
-on:
-  push:
-    branches:
-      - V2
-    paths:
-      - "frontend/package.json"
-      - "frontend/package-lock.json"
-      - "frontend/scripts/generate-licenses.js"
-  pull_request:
-    branches:
-      - V2
-    paths:
-      - ".github/workflows/frontend-licenses-update.yml"
-      - "frontend/package.json"
-      - "frontend/package-lock.json"
-      - "frontend/scripts/generate-licenses.js"
-
-permissions:
-  contents: read
-
-jobs:
-  generate-frontend-license-report:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout PR head (default)
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Checkout BASE branch (safe script)
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: base
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install frontend dependencies
-        working-directory: frontend
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        run: npm ci --ignore-scripts --audit=false --fund=false
-
-      - name: Generate frontend license report (internal PR)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        working-directory: frontend
-        env:
-          PR_IS_FORK: "false"
-        run: npm run generate-licenses
-
-      - name: Generate frontend license report (fork PRs, pinned)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        working-directory: frontend
-        run: |
-          mkdir -p src/assets
-          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
-
-      - name: Postprocess with project script (BASE version)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          PR_IS_FORK: "true"
-        run: |
-          node base/frontend/scripts/generate-licenses.js \
-            --input frontend/src/assets/3rdPartyLicenses.json
-
-      - name: Copy postprocessed artifacts back (fork PRs)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        run: |
-          mkdir -p frontend/src/assets
-          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
-          fi
-          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
-            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
-          fi
-
-      - name: Check for license warnings
-        run: |
-          if [ -f "frontend/src/assets/license-warnings.json" ]; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-
-      # PR Event: Check licenses and comment on PR
-      - name: Delete previous license check comments
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-            
-            // Get all comments on the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-            
-            // Filter for license check comments
-            const licenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Frontend License Check Passed') ||
-              comment.body.includes('## ❌ Frontend License Check Failed')
-            );
-            
-            // Delete old license check comments
-            for (const comment of licenseComments) {
-              console.log(`Deleting old license check comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Summarize results (fork PRs)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        run: |
-          {
-            echo "## Frontend License Check"
-            echo ""
-            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
-              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/src/assets/license-warnings.json" ]; then
-                echo ""
-                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
-              fi
-            else
-              echo "✅ **Passed** – no license warnings detected."
-            fi
-            echo ""
-            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Comment on PR - License Check Results
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-            
-            let commentBody;
-            
-            if (hasWarnings) {
-              // Read warnings file to get specific issues
-              const fs = require('fs');
-              let warningDetails = '';
-              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
-                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
-              } catch (e) {
-                warningDetails = 'Unable to read warning details';
-              }
-              
-              commentBody = `## ❌ Frontend License Check Failed
-              
-              The frontend license check has detected compatibility warnings that require review:
-
-              ${warningDetails}
-
-              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Frontend License Check Passed
-              
-              All frontend licenses have been validated and no compatibility warnings were detected.
-
-              The frontend license report has been updated successfully.`;
-            }
-            
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ License warnings detected. Failing the workflow."
-          exit 1
-
-      # Push Event: Commit license files and create PR
-      - name: Commit changes (Push only)
-        if: github.event_name == 'push'
-        run: |
-          git add frontend/src/assets/3rdPartyLicenses.json
-          # Note: Do NOT commit license-warnings.json - it's only for PR review
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (Push only)
-        if: github.event_name == 'push'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the frontend license report based on changes to package.json dependencies."
-          
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          The following licenses may require review for corporate compatibility:
-
-          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
-
-          Please review these licenses to ensure they are acceptable for your use case."
-          fi
-          
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (Push only)
-        id: cpr
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Frontend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-frontend-3rd-party-licenses
-          base: V2
-          title: "Update Frontend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,frontend
-          draft: false
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
@@ -1,105 +0,0 @@
-name: License Report Workflow
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "build.gradle"
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  generate-license-report:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      - name: Check out code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-        with:
-          fetch-depth: 0
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "17"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-
-      - name: Check licenses for compatibility
-        run: ./gradlew clean checkLicense
-        env:
-          DISABLE_ADDITIONAL_FEATURES: false
-          STIRLING_PDF_DESKTOP_UI: true
-
-      - name: Upload artifact on failure
-        if: failure()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-        with:
-          name: dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-          retention-days: 3
-
-      - name: Move and rename license file
-        run: |
-          mv build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
-
-      - name: Commit changes
-        run: |
-          git add app/core/src/main/resources/static/3rdPartyLicenses.json
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Create Pull Request
-        id: cpr
-        if: env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-3rd-party-licenses
-          title: "Update 3rd Party Licenses"
-          body: |
-            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-          labels: Licenses,github-actions
-          draft: false
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge
-        if: steps.cpr.outputs.pull-request-operation == 'created'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
@@ -15,12 +15,12 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Run Labeler
        uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
@@ -22,7 +22,7 @@ on:
          - macos
          - linux
  push:
-    branches: [main, V2, V2-demo, V2-master]
+    branches: [main, V2-master]
  release:
    types: [created]

@@ -38,19 +38,20 @@ jobs:
      version: ${{ steps.versionNumber.outputs.versionNumber }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "21"
          distribution: "temurin"

-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -62,6 +63,10 @@ jobs:
          VERSION=$(./gradlew printVersion --quiet | tail -1)
          echo "Extracted version: $VERSION"
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

      - name: Determine build matrix
        id: set-matrix
@@ -106,33 +111,37 @@ jobs:
            file_suffix: "-server"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "21"
          distribution: "temurin"

-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

      - name: Setup Node.js
        if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
-          node-version: 20
-          cache: 'npm'
+          node-version: 22
+          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Build JAR
-        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+        run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
          STIRLING_PDF_DESKTOP_UI: false

@@ -145,7 +154,7 @@ jobs:
          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar

      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: jar${{ matrix.variant.file_suffix }}
          path: ./jar-dist/*.jar
@@ -162,12 +171,12 @@ jobs:
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -176,31 +185,36 @@ jobs:
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
-          node-version: 20
-          cache: 'npm'
+          node-version: 22
+          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "21"
          distribution: "temurin"

+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
      - name: Build Java backend with JLink
        working-directory: ./
        shell: bash
        run: |
          chmod +x ./gradlew
          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+          ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube

          # Find the built JAR
          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
@@ -264,17 +278,20 @@ jobs:
          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
          echo "📊 Custom JRE size: $RUNTIME_SIZE"
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

      - name: Install frontend dependencies
        working-directory: ./frontend
-        run: npm install
+        run: npm ci

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@v1.1.0
+        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -382,7 +399,7 @@ jobs:
          echo "Certificate imported successfully."

      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -516,7 +533,7 @@ jobs:
          fi

      - name: Upload build artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
@@ -530,30 +547,30 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Download all Tauri artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          pattern: Stirling-PDF-*
          path: ./artifacts/tauri

      - name: Download JAR artifact (default)
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: jar
          path: ./artifacts/jars

      - name: Download JAR artifact (with login)
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: jar-with-login
          path: ./artifacts/jars

      - name: Download JAR artifact (server only)
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: jar-server
          path: ./artifacts/jars
@@ -21,14 +21,15 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -41,24 +42,40 @@ jobs:
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: 3.12
-          cache: 'pip' # caching pip dependencies
+          cache: "pip" # caching pip dependencies
          cache-dependency-path: ./.github/scripts/requirements_pre_commit.txt

      - name: Run Pre-Commit Hooks
        run: |
          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt

-      - run: pre-commit run --all-files -c .pre-commit-config.yaml
+      - name: Run Pre-Commit
+        run: |
+          pre-commit run ruff --all-files -c .pre-commit-config.yaml
+          pre-commit run ruff-format --all-files -c .pre-commit-config.yaml
+          pre-commit run codespell --all-files -c .pre-commit-config.yaml
+          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
+          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
+          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
        continue-on-error: true

-      - name: Set up JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: 17
+          java-version: 21
          distribution: "temurin"

+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
      - name: Build with Gradle
-        run: ./gradlew clean build
+        run: ./gradlew build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

      - name: git add
        run: |
@@ -67,7 +84,7 @@ jobs:

      - name: Create Pull Request
        if: env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: ":file_folder: pre-commit"
@@ -1,246 +0,0 @@
-name: Push Docker Image - V2 Branch
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - V2-master
-      - V1_V2_merge
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-
-      - name: Get version number
-        id: versionNumber
-        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for latest (V2-master branch - production)
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Generate tags for latest (V1_V2_merge branch - test)
-        id: meta-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign regular images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --yes \
-              --key env://COSIGN_PRIVATE_KEY \
-              "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for latest-fat (V2-master branch - production)
-        id: meta-fat
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Generate tags for latest-fat (V1_V2_merge branch - test)
-        id: meta-fat-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Build and push Unified Dockerfile (fat variant)
-        id: build-push-fat
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.fat
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign fat images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite (V2-master branch - production)
-        id: meta-lite
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Generate tags for ultra-lite (V1_V2_merge branch - test)
-        id: meta-lite-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
@@ -6,6 +6,8 @@ on:
    branches:
      - master
      - main
+      - V2-master
+      - testMain

 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -25,56 +27,61 @@ permissions:
 jobs:
  push:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-8core
    permissions:
      packages: write
      id-token: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "17"
+          java-version: "21"
          distribution: "temurin"

-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

-      - name: Run Gradle Command
-        run: ./gradlew clean build
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master'
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-        with:
-          cosign-release: "v2.4.1"
-
      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: "v2.4.1"
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: "v2.4.1"

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -87,10 +94,9 @@ jobs:
        id: repoowner
        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT

-      - name: Generate tags
+      - name: Generate tags for latest
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref != 'refs/heads/main'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -98,13 +104,13 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testMain' }}

-      - name: Build and push main Dockerfile
-        id: build-push-regular
+      - name: Build and push Unified Dockerfile (latest variant)
+        id: build-push-latest
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -120,9 +126,9 @@ jobs:
          sbom: true

      - name: Sign regular images
-        if: github.ref == 'refs/heads/master'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
        env:
-          DIGEST: ${{ steps.build-push-regular.outputs.digest }}
+          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -133,10 +139,10 @@ jobs:
              "${tag}@${DIGEST}"
          done

-      - name: Generate tags ultra-lite
-        id: meta2
+      - name: Generate tags for latest-fat
+        id: meta-fat
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref != 'refs/heads/main'
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -144,43 +150,13 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}

-      - name: Build and push Dockerfile-ultra-lite
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main'
-        with:
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ steps.meta2.outputs.tags }}
-          labels: ${{ steps.meta2.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Generate tags fat
-        id: meta3
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' }}
-
-      - name: Build and push main Dockerfile fat
+      - name: Build and push Unified Dockerfile (fat variant)
        id: build-push-fat
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -188,18 +164,62 @@ jobs:
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
-          tags: ${{ steps.meta3.outputs.tags }}
-          labels: ${{ steps.meta3.outputs.labels }}
+          tags: ${{ steps.meta-fat.outputs.tags }}
+          labels: ${{ steps.meta-fat.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Sign fat images
-        if: github.ref == 'refs/heads/master'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
        env:
          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta3.outputs.tags }}
+          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for ultra-lite
+        id: meta-lite
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+
+      - name: Build and push Unified Dockerfile (ultra-lite variant)
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta-lite.outputs.tags }}
+          labels: ${{ steps.meta-lite.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign ultra-lite images
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
+          TAGS: ${{ steps.meta-lite.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
@@ -1,535 +0,0 @@
-name: Release Artifacts
-
-on:
-  workflow_dispatch:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2, V2-demo]
-
-permissions:
-  contents: read
-
-jobs:
-  determine-matrix:
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
-      version: ${{ steps.versionNumber.outputs.versionNumber }}
-    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-
-      - name: Get version number
-        id: versionNumber
-        run: |
-          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
-          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Determine build matrix
-        id: set-matrix
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
-
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign (not build scripts)
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path (set by DigiCert action)
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              Write-Host "DigiCert KeyLocker action may not have run correctly"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              # Use smctl to sign with keypair alias
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            # Check if output contains "FAILED" even with exit code 0
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host ""
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              Write-Host "[ERROR] smctl returned success but output indicates failure"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
-
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
-          retention-days: 30
-
-  sign_verify:
-    needs: build
-    runs-on: ubuntu-latest
-    if: success()
-    strategy:
-      fail-fast: false
-      matrix:
-        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-        with:
-          name: Stirling-PDF-${{ matrix.name }}
-
-      - name: Display structure of downloaded files
-        run: ls -R
-
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
-
-      - name: Generate key pair
-        run: cosign generate-key-pair
-
-      - name: Sign and generate attestations
-        shell: bash
-        run: |
-          # Sign all artifacts for this platform
-          for file in *; do
-            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
-              echo "Signing: $file"
-
-              # Sign the artifact
-              cosign sign-blob \
-                --key ./cosign.key \
-                --yes \
-                --output-signature "${file}.sig" \
-                "$file"
-
-              # Generate attestation
-              cosign attest-blob \
-                --predicate - \
-                --key ./cosign.key \
-                --yes \
-                --output-attestation "${file}.intoto.jsonl" \
-                "$file"
-
-              # Verify the signature
-              cosign verify-blob \
-                --key ./cosign.pub \
-                --signature "${file}.sig" \
-                "$file"
-
-              echo "✅ Signed and verified: $file"
-            fi
-          done
-
-      - name: Upload signed artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: Stirling-PDF-${{ matrix.name }}-signed
-          path: |
-            *
-            !cosign.key
-            !cosign.pub
-          retention-days: 30
-
-  release:
-    needs: [determine-matrix, build, sign_verify]
-    runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Download all signed artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-        with:
-          pattern: Stirling-PDF-*-signed
-          path: ./artifacts
-
-      - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
-        with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
-          generate_release_notes: true
-          files: ./artifacts/**/*
-          draft: false
-          prerelease: false
@@ -35,12 +35,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

@@ -67,7 +67,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: SARIF file
          path: results.sarif
@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v3.29.5
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.29.5
        with:
          sarif_file: results.sarif
@@ -17,7 +17,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

@@ -27,19 +27,22 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "17"
+          java-version: "21"
          distribution: "temurin"

-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14

      - name: Generate Swagger documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -47,12 +50,19 @@ jobs:
      - name: Upload Swagger Documentation to SwaggerHub
        run: ./gradlew swaggerhubUpload
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }}
          SWAGGERHUB_USER: "Frooodle"

      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

      - name: Set API version as published and default on SwaggerHub
        run: |
@@ -5,9 +5,11 @@ on:
  push:
    branches:
      - main
-      - syncLangTest
    paths:
      - "build.gradle"
+      - "app/common/build.gradle"
+      - "app/core/build.gradle"
+      - "app/proprietary/build.gradle"
      - "README.md"
      - "frontend/public/locales/*/translation.toml"
      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
@@ -33,11 +35,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -53,21 +57,21 @@ jobs:
          cache: "pip" # caching pip dependencies

      - name: Install Python dependencies
-        run: |
-          pip install tomli-w
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt

      - name: Sync translation TOML files
        run: |
          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main

+      - name: pre-commit run
+        run: |
+          pre-commit run toml-sort-fix --all-files
+
      - name: Commit translation files
        run: |
          git add frontend/public/locales/*/translation.toml
          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"

-      - name: Install README dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
-
      - name: Sync README.md
        run: |
          python scripts/counter_translation_v3.py
@@ -79,7 +83,7 @@ jobs:

      - name: Create Pull Request
        if: always()
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: Update files
@@ -121,4 +125,4 @@ jobs:
          add-paths: |
            README.md
            frontend/public/locales/*/translation.toml
-            scripts/ignore_translation.toml
+            scripts/ignore_translation.toml
@@ -14,17 +14,18 @@ on:
          - macos
          - linux
  pull_request:
-    branches: [main, V2, V2-tauri-windows]
+    branches: [main, V2-tauri-windows]
    paths:
-      - 'frontend/src-tauri/**'
-      - 'frontend/src/desktop/**'
-      - 'frontend/tsconfig.desktop.json'
-      - '.github/workflows/tauri-build.yml'
+      - "frontend/src-tauri/**"
+      - "frontend/src/desktop/**"
+      - "frontend/tsconfig.desktop.json"
+      - ".github/workflows/tauri-build.yml"
  push:
-    branches: [main, V2]
+    branches: [main]

 permissions:
  contents: read
+  pull-requests: write

 jobs:
  determine-matrix:
@@ -33,6 +34,11 @@ jobs:
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
      - name: Determine build matrix
        id: set-matrix
        run: |
@@ -67,12 +73,12 @@ jobs:
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -81,45 +87,50 @@ jobs:
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
-          node-version: 20
-          cache: 'npm'
+          node-version: 22
+          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "21"
          distribution: "temurin"

+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 8.14
+
      - name: Build Java backend with JLink
        working-directory: ./
        shell: bash
        run: |
          chmod +x ./gradlew
          echo "🔧 Building Stirling-PDF JAR..."
-          # STIRLING_PDF_DESKTOP_UI=false ./gradlew clean bootJar --no-daemon
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+          # STIRLING_PDF_DESKTOP_UI=false ./gradlew bootJar --no-daemon
+          ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube

          # Find the built JAR
          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
          echo "✅ Built JAR: $STIRLING_JAR"
-          
+
          # Create Tauri directories
          mkdir -p ./frontend/src-tauri/libs
          mkdir -p ./frontend/src-tauri/runtime
-          
+
          # Copy JAR to Tauri libs
          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
          echo "✅ JAR copied to Tauri libs"
-          
+
          # Analyze JAR dependencies for jlink modules
          echo "🔍 Analyzing JAR dependencies..."
          if command -v jdeps &> /dev/null; then
@@ -135,14 +146,14 @@ jobs:
            echo "⚠️ jdeps not available, using predefined modules"
            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
          fi
-          
+
          # Create custom JRE with jlink (always rebuild)
          echo "🔧 Creating custom JRE with jlink..."
          echo "📋 Using modules: $MODULES"
-          
+
          # Remove any existing JRE
          rm -rf ./frontend/src-tauri/runtime/jre
-          
+
          # Create the custom JRE
          jlink \
            --add-modules "$MODULES" \
@@ -151,12 +162,12 @@ jobs:
            --no-header-files \
            --no-man-pages \
            --output ./frontend/src-tauri/runtime/jre
-          
+
          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
            echo "❌ Failed to create JLink runtime"
            exit 1
          fi
-          
+
          # Test the bundled runtime
          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
@@ -165,22 +176,25 @@ jobs:
            echo "❌ Custom JRE executable not found"
            exit 1
          fi
-          
+
          # Calculate runtime size
          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
          echo "📊 Custom JRE size: $RUNTIME_SIZE"
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

      - name: Install frontend dependencies
        working-directory: ./frontend
-        run: npm install
+        run: npm ci

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@v1.1.0
+        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -299,7 +313,7 @@ jobs:
          ls -la /usr/bin/hd* || echo "No hd* tools found"

      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -507,7 +521,6 @@ jobs:
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
@@ -574,12 +587,12 @@ jobs:
          }

      - name: Upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
          retention-days: 7
- 
+
      - name: Verify build artifacts
        shell: bash
        run: |
@@ -595,8 +608,8 @@ jobs:
            fi
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            echo "Checking for macOS artifacts..."
-            find . -name "*.dmg" -o -name "*.app" | head -5
-            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
+            find . -name "*.dmg" | head -5
+            if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
              echo "❌ No macOS artifacts found"
              exit 1
            fi
@@ -627,11 +640,110 @@ jobs:
            fi
          done

+  pr-comment:
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' && needs.build.result == 'success'
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Post/Update PR Comment with Download Links
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const prNumber = context.issue.number;
+            const runId = context.runId;
+
+            // Fetch artifacts for this workflow run
+            const { data: artifactsList } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner,
+              repo,
+              run_id: runId
+            });
+
+            // Map of expected artifact names to display info
+            const artifactMap = {
+              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
+              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
+              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
+              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .AppImage' }
+            };
+
+            let commentBody = `## 📦 Tauri Desktop Builds Ready!\n\n`;
+            commentBody += `The desktop applications have been built and are ready for testing.\n\n`;
+            commentBody += `### Download Artifacts:\n\n`;
+
+            // Add links for each found artifact
+            let foundArtifacts = 0;
+            for (const artifact of artifactsList.artifacts) {
+              const info = artifactMap[artifact.name];
+              if (info) {
+                foundArtifacts++;
+                // GitHub doesn't provide direct download URLs via API, but we can link to the artifact on the Actions page
+                const artifactUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}/artifacts/${artifact.id}`;
+                commentBody += `${info.icon} **${info.platform}**: [Download ${artifact.name}](${artifactUrl}) `;
+                commentBody += `(${info.files}) - ${(artifact.size_in_bytes / 1024 / 1024).toFixed(1)} MB\n`;
+              }
+            }
+
+            if (foundArtifacts === 0) {
+              commentBody += `⚠️ **Warning**: No artifacts found in workflow run.\n`;
+              commentBody += `[View workflow run](https://github.com/${owner}/${repo}/actions/runs/${runId})\n`;
+            }
+
+            commentBody += `\n---\n`;
+            commentBody += `_Built from commit ${context.sha.substring(0, 7)}_\n`;
+            commentBody += `_Artifacts expire in 7 days_`;
+
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber
+            });
+
+            const botComment = comments.find(comment =>
+              comment.user.type === 'Bot' &&
+              comment.body.includes('📦 Tauri Desktop Builds Ready!')
+            );
+
+            if (botComment) {
+              // Update existing comment
+              await github.rest.issues.updateComment({
+                owner,
+                repo,
+                comment_id: botComment.id,
+                body: commentBody
+              });
+              console.log('Updated existing comment');
+            } else {
+              // Create new comment
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: prNumber,
+                body: commentBody
+              });
+              console.log('Created new comment');
+            }
+
  report:
    needs: build
    runs-on: ubuntu-latest
    if: always()
    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
      - name: Report build results
        run: |
          if [ "${{ needs.build.result }}" = "success" ]; then
@@ -25,31 +25,34 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: "21"
+          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

      - name: Build with Gradle
-        run: ./gradlew clean build
+        run: ./gradlew build
        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Get version number
        id: versionNumber
@@ -58,7 +61,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -76,7 +79,7 @@ jobs:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Deploy to VPS
@@ -107,9 +110,9 @@ jobs:
              restart: on-failure:5
          EOF

-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
            mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
            mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
            cd /stirling/test-${{ github.sha }}
@@ -125,7 +128,12 @@ jobs:
    outputs:
      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -140,16 +148,16 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
-          cache: 'npm'
+          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Run TestDriver.ai
@@ -161,7 +169,7 @@ jobs:
            npm install
            npm run build
            npm install dashcam-chrome --save
-            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.VPS_HOST }}:1337"
+            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
            Start-Sleep -Seconds 20
          prompt: |
            1. /run testing/testdriver/test.yml
@@ -176,20 +184,20 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

      - name: Cleanup deployment
        if: always()
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
            cd /stirling/test-${{ github.sha }}
            docker-compose down
            cd /stirling
@@ -31,11 +31,6 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 SwaggerDoc.json

-# Docker bind-mount volumes (local data)
-AI-Document-Generator-main/backend/data/
-AI-Document-Generator-main/backend/output/
-docker/compose/stirling/
-
 # Frontend build artifacts copied to backend static resources
 # These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
@@ -48,6 +43,8 @@ app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
 app/core/src/main/resources/static/robots.txt
+app/core/src/main/resources/static/pdfium/
+app/core/src/main/resources/static/vendor/
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.

 # Gradle
@@ -152,6 +149,7 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
+frontend/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -216,7 +214,7 @@ id_ed25519.pub
 .mypy_cache
 .pytest_cache
 .ipynb_checkpoints
-
+.build-cache


 **/jcef-bundle/
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.2
+    rev: v0.14.14
    hooks:
      - id: ruff
        args:
@@ -16,13 +16,13 @@ repos:
    hooks:
      - id: codespell
        args:
-          - --ignore-words-list=thirdParty,tabEl,tabEls
+          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
-        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
  - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.28.0
+    rev: v8.30.0
    hooks:
      - id: gitleaks
  - repo: https://github.com/pre-commit/pre-commit-hooks
@@ -34,6 +34,12 @@ repos:
      - id: trailing-whitespace
        files: ^.*(\.js|\.java|\.py|\.yml)$
        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+  - repo: https://github.com/pappasam/toml-sort
+    rev: v0.24.3
+    hooks:
+      - id: toml-sort-fix
+        files: frontend/public/locales/.*\.toml$
+        args: ['--in-place', '--all', '--ignore-case']
  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
  #   rev: v16.21.1
  #   hooks:
@@ -13,7 +13,7 @@
    "vscjava.vscode-spring-boot-dashboard", // Spring Boot dashboard for managing and visualizing Spring Boot applications
    "EditorConfig.EditorConfig", // EditorConfig support for maintaining consistent coding styles
    "ms-azuretools.vscode-docker", // Docker extension for Visual Studio Code
-    "GitHub.copilot", // GitHub Copilot AI pair programmer for Visual Studio Code
+    "GitHub.copilot-chat", // GitHub Copilot AI pair programmer for Visual Studio Code
    "GitHub.vscode-pull-request-github", // GitHub Pull Requests extension for Visual Studio Code
    "charliermarsh.ruff", // Ruff code formatter for Python to follow the Ruff Style Guide
    "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing
@@ -1,6 +1,6 @@
 # Adding New React Tools to Stirling PDF

-This guide covers how to add new PDF tools to the React frontend, either by migrating existing Thymeleaf templates or creating entirely new tools.
+This guide covers how to add new PDF tools to the React frontend.

 ## Overview

@@ -188,7 +188,7 @@ import { use[ToolName]Tips } from "../components/tooltips/use[ToolName]Tips";

 const [ToolName] = (props: BaseToolProps) => {
  const tips = use[ToolName]Tips();
-  
+
  // In your steps array:
  steps: [
    {
@@ -257,22 +257,14 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 - Add `options.*` keys if your tool has settings with descriptions

 **Tooltip Writing Guidelines:**
- **Use simple, everyday language** - avoid technical terms like "converts interactive elements" 
+- **Use simple, everyday language** - avoid technical terms like "converts interactive elements"
 - **Focus on benefits** - explain what the user gains, not how it works internally
 - **Use concrete examples** - "text boxes become regular text" vs "form fields are flattened"
 - **Answer user questions** - "What does this do?", "When should I use this?", "What's this option for?"
 - **Keep descriptions concise** - 1-2 sentences maximum per section
 - **Use bullet points** for multiple benefits or features

-## 6. Migration from Thymeleaf
-When migrating existing Thymeleaf templates:
-
-1. **Identify Form Parameters**: Look at the original `<form>` inputs to determine parameter structure
-2. **Extract Translation Keys**: Find `#{key.name}` references and add them to JSON translations (For many tools these translations will already exist but some parts will be missing)
-3. **Map API Endpoint**: Note the `th:action` URL for the operation hook
-4. **Preserve Functionality**: Ensure all original form behaviour is replicated which is applicable to V2 react UI
-
-## 7. Testing Your Tool
+## 6. Testing Your Tool
 - Verify tool appears in UI with correct icon and description
 - Test with various file sizes and types
 - Confirm translations work
@@ -1,45 +0,0 @@
-# Python
-__pycache__/
-*.py[cod]
-*$py.class
-*.so
-.Python
-env/
-venv/
-ENV/
-build/
-dist/
-*.egg-info/
-
-# Node
-node_modules/
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-dist/
-.vite/
-
-# Environment
-.env
-.env.local
-
-# LaTeX outputs
-*.aux
-*.log
-*.out
-*.toc
-*.pdf
-*.tex
-backend/output/
-backend/data/user_styles.json
-
-# IDE
-.vscode/
-.idea/
-*.swp
-*.swo
-*~
-
-# OS
-.DS_Store
-Thumbs.db
@@ -1,32 +0,0 @@
-# syntax=docker/dockerfile:1.5
-FROM python:3.11-slim
-
-# Install full TeXLive so LLM outputs (siunitx, paracol, tikz, etc.) compile reliably.
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-      texlive-full \
-      latexmk \
-      ghostscript \
-      poppler-utils \
-      ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-# Set working directory
-WORKDIR /app
-
-# Copy backend files
-COPY backend/requirements.txt .
-RUN --mount=type=cache,target=/root/.cache/pip \
-    pip install -r requirements.txt
-
-COPY backend/ .
-
-# Create output directories
-RUN mkdir -p /app/output /app/data
-
-# Expose port
-EXPOSE 5000
-
-# Run the Flask app
-CMD ["python", "app.py"]
@@ -1,173 +0,0 @@
-# LaTeX PDF Generator
-
-AI-powered document generator using LaTeX. Creates professional documents (invoices, resumes, contracts, etc.) from natural language prompts with conversational editing.
-
-## Features
-
- 🎨 ChatGPT-like interface with split-screen PDF preview (main window only)
- 📝 Generates LaTeX documents from natural language and compiles to PDF in Docker
- 🔄 Conversational editing with PDF regeneration on every turn
- 💾 Style memory + template reuse per user/team and document type
- 🗂️ Version history with per-iteration PDFs you can reopen
- 📄 Supports: Invoices, Resumes, Contracts, Letters, Reports, poems, proposals, and more
-
-## Quick Start
-
-### Option 1: Docker (Recommended)
-
-```bash
-# Build the Docker image
-docker build -t latex-generator .
-
-# Run the backend
-docker run -p 5000:5000 latex-generator
-```
-
-### Option 2: Local Development
-
-#### Backend Setup
-
-```bash
-cd backend
-
-# Install Python dependencies
-pip install -r requirements.txt
-
-# Install LaTeX (if not already installed)
-# On Ubuntu/Debian:
-sudo apt-get install texlive-latex-base texlive-latex-extra
-
-# On Mac:
-brew install --cask mactex
-
-# On Windows:
-# Download and install MiKTeX from https://miktex.org/download
-
-# Run the backend
-python app.py
-```
-
-Backend will run on `http://localhost:5000`
-
-#### Frontend Setup
-
-```bash
-cd frontend
-
-# Install dependencies
-npm install
-
-# Run the dev server
-npm run dev
-```
-
-Frontend will run on `http://localhost:3000`
-
-## Usage
-
-1. Open `http://localhost:3000` in your browser
-2. Type a prompt like "Create an invoice for web development services"
-3. The AI generates LaTeX code and compiles it to PDF
-4. Continue chatting to refine the document
-5. Download the final PDF
-
-## Example Prompts
-
- "Create a professional invoice for $1,500 in consulting services"
- "Generate a resume for a senior software engineer with 5 years experience"
- "Make a business letter to a client about project completion"
- "Create a contract for freelance web development"
-
-## Configuration
-
-### OpenAI API (Optional)
-
-To use real AI generation instead of mock templates:
-
-1. Copy `.env.example` to `.env`
-2. Add your OpenAI API key: `OPENAI_API_KEY=sk-...`
-3. (Optional) Choose models:
-   - Smart (full generation): `SMART_MODEL=gpt-5.1` (default)
-   - Fast (intent/pre checks): `FAST_MODEL=gpt-4.1-nano` (default)
-3. (Legacy SDK) We pin `openai==0.28.1` in Docker to avoid client init issues. No code changes needed.
-
-## Project Structure
-
-```
-latex-pdf-generator/
-├── frontend/          # React + TypeScript + Tailwind
-│   ├── src/
-│   │   ├── components/
-│   │   │   ├── landing/         # Landing hero + CTA
-│   │   │   ├── modals/          # Reusable modal(s)
-│   │   │   ├── workspace/       # Chat panel, preview, history
-│   │   │   └── ui/              # Buttons, button groups, etc.
-│   │   ├── hooks/               # Workflow + speech capture hooks
-│   │   ├── types/               # Shared TypeScript interfaces
-│   │   ├── App.tsx              # Thin orchestrator
-│   │   └── main.tsx
-│   ├── .eslintrc.cjs            # ESLint config (React + TS)
-│   ├── package.json
-│   └── vite.config.ts
-├── backend/           # Flask + LaTeX
-│   ├── app.py                   # Routes + Flask app factory
-│   ├── ai_generation.py         # OpenAI + mock generation helpers
-│   ├── briefs.py                # Guided brief collection utilities
-│   ├── config.py                # Logging + environment setup
-│   ├── document_types.py        # Doc-type heuristics
-│   ├── latex_utils.py           # LaTeX sanitizers + layout helpers
-│   ├── pdf_utils.py             # PDF compilation + render helpers
-│   ├── storage.py               # JSON persistence for users/templates
-│   ├── styles.py                # Style preference heuristics
-│   ├── vision.py                # Layout extraction via multimodal GPT
-│   ├── requirements.txt
-│   └── data/          # User style storage
-├── Dockerfile
-└── README.md
-```
-
-### Linting
-
-The frontend now ships with ESLint + TypeScript rules that keep the new modular structure tidy:
-
-```bash
-cd frontend
-npm run lint
-```
-
-Backend linting can be added with your preferred tool (e.g., ruff or flake8) by pointing it at the new small modules in `backend/`.
-
-## Troubleshooting
-
-### LaTeX compilation fails
-
- Ensure `pdflatex` is in your PATH
- Check logs in the backend console
- Verify LaTeX packages are installed
-
-### CORS errors
-
- Make sure both frontend and backend are running
- Frontend proxy is configured in `vite.config.ts`
-
-### PDF not displaying
-
- Check browser console for errors
- Ensure the backend `/output` endpoint is accessible
- Try opening the PDF URL directly
-
-## Development
-
-### Mock Mode (Current)
-
-The app currently uses mock LaTeX templates for quick testing. To enable real AI:
-
-1. Get an OpenAI API key
-2. Set `OPENAI_API_KEY` and optionally override:
-   - `SMART_MODEL` (default `gpt-5.1`)
-   - `FAST_MODEL` (default `gpt-4.1-nano`)
-3. Restart the backend; it auto-detects whether to call the live model or the bundled mock templates
-
-## License
-
-MIT
@@ -1,659 +0,0 @@
-from __future__ import annotations
-
-import json
-import re
-from typing import Any, Dict, List, Optional
-import time
-
-from config import CLIENT_MODE, SMART_MODEL, STREAMING_ENABLED, get_chat_model, logger
-from langchain_utils import to_lc_messages
-from storage import save_user_style
-from prompts import latex_system_prompt, latex_context_messages
-
-
-def generate_outline_with_llm(
-    prompt: str,
-    document_type: str,
-    constraints: Optional[Dict[str, Any]] = None,
-) -> str:
-    if CLIENT_MODE == "langchain":
-        constraint_text = ""
-        if constraints:
-            tone = constraints.get("tone")
-            audience = constraints.get("audience")
-            pages = constraints.get("pageCount")
-            constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
-        system_prompt = (
-            "You are an outline generator for document creation.\n"
-            f"Document type: {document_type}\n"
-            f"{constraint_text}\n"
-            "Return a concise outline with section titles and short descriptions.\n"
-            "Keep each description to roughly 6-12 words.\n"
-            "Ensure the outline scope fits the target page count.\n"
-            "Output plain text only, using a numbered list with 5-9 sections."
-        )
-        messages: List[Dict[str, Any]] = [
-            {"role": "system", "content": system_prompt},
-            {"role": "user", "content": prompt},
-        ]
-        try:
-            llm = get_chat_model(SMART_MODEL)
-            if llm:
-                start = time.perf_counter()
-                response = llm.invoke(to_lc_messages(messages))
-                elapsed = time.perf_counter() - start
-                content = response.content or ""
-                usage = getattr(response, "usage_metadata", None)
-                logger.info(
-                    "[AI] outline model=%s elapsed=%.2fs chars=%s usage=%s",
-                    SMART_MODEL,
-                    elapsed,
-                    len(str(content)),
-                    usage,
-                )
-                if content:
-                    return str(content).strip()
-        except Exception as exc:
-            logger.error("[AI] Outline generation failed, falling back: %s", exc)
-
-    safe_prompt = prompt.strip() or "Document"
-    return (
-        "1) Introduction - Summary of the document goals.\n"
-        "2) Background - Context and key assumptions.\n"
-        "3) Main Content - Core points and supporting details.\n"
-        "4) Evidence - Data, examples, or references.\n"
-        "5) Conclusion - Wrap-up and next steps.\n"
-        f"Notes: Tailor details to '{safe_prompt}'."
-    )
-
-
-def _parse_outline_to_sections(outline_text: str) -> List[Dict[str, str]]:
-    lines = [
-        line.strip()
-        for line in outline_text.split("\n")
-        if line.strip() and not re.match(r"^(section|details)$", line.strip(), re.IGNORECASE)
-    ]
-    sections: List[Dict[str, str]] = []
-    i = 0
-    while i < len(lines):
-        cleaned = re.sub(r"^\d+[\).\s-]+", "", lines[i]).strip()
-        if not cleaned:
-            i += 1
-            continue
-
-        split = re.split(r"[-–:]+", cleaned, maxsplit=1)
-        if len(split) > 1:
-            sections.append({"label": split[0].strip() or "Section", "value": split[1].strip()})
-            i += 1
-            continue
-
-        next_line = lines[i + 1].strip() if i + 1 < len(lines) else ""
-        if next_line and not re.match(r"^\d+[\).\s-]+", next_line):
-            sections.append({"label": cleaned, "value": next_line})
-            i += 2
-            continue
-
-        sections.append({"label": cleaned, "value": ""})
-        i += 1
-
-    return sections
-
-
-def _extract_fields_from_prompt(prompt: str, fields: List[Dict[str, Any]]) -> List[Dict[str, str]]:
-    lines = [line.strip() for line in prompt.split("\n") if line.strip()]
-    kv_pairs: Dict[str, str] = {}
-    for line in lines:
-        match = re.match(r"^([^:]{2,40}):\s*(.+)$", line)
-        if match:
-            kv_pairs[match.group(1).strip().lower()] = match.group(2).strip()
-
-    email_match = re.search(r"[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}", prompt, re.IGNORECASE)
-    phone_match = re.search(r"(\+?\d[\d\s().-]{7,})", prompt)
-    date_match = re.search(r"\b\d{1,2}[\/.-]\d{1,2}[\/.-]\d{2,4}\b", prompt)
-    money_match = re.search(r"\$\s?\d[\d,]*(?:\.\d{2})?", prompt)
-
-    filled: List[Dict[str, str]] = []
-    for field in fields:
-        label = str(field.get("label", "Field"))
-        value = str(field.get("value", "") or "")
-        if value.strip():
-            filled.append({"label": label, "value": value})
-            continue
-        label_lower = label.lower()
-        for key, val in kv_pairs.items():
-            if key in label_lower:
-                value = val
-                break
-        if not value and email_match and "email" in label_lower:
-            value = email_match.group(0)
-        if not value and phone_match and "phone" in label_lower:
-            value = phone_match.group(0)
-        if not value and date_match and ("date" in label_lower or "due" in label_lower):
-            value = date_match.group(0)
-        if not value and money_match and ("total" in label_lower or "amount" in label_lower):
-            value = money_match.group(0)
-        filled.append({"label": label, "value": value})
-    return filled
-
-
-def generate_field_values(
-    prompt: str,
-    document_type: str,
-    fields: List[Dict[str, Any]],
-    constraints: Optional[Dict[str, Any]] = None,
-) -> List[Dict[str, str]]:
-    if CLIENT_MODE == "langchain":
-        constraint_text = ""
-        if constraints:
-            tone = constraints.get("tone")
-            audience = constraints.get("audience")
-            pages = constraints.get("pageCount")
-            constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
-        system_prompt = (
-            "You are extracting field values from a user prompt.\n"
-            "Return a JSON array of objects with keys: label, value.\n"
-            "Only fill values that are explicitly stated or strongly implied.\n"
-            "If unknown, return an empty string.\n"
-            f"{constraint_text}\n"
-            "Output JSON only."
-        )
-        messages: List[Dict[str, Any]] = [
-            {"role": "system", "content": system_prompt},
-            {"role": "user", "content": f"Document type: {document_type}"},
-            {"role": "user", "content": f"Prompt:\n{prompt}"},
-            {"role": "user", "content": f"Fields:\n{json.dumps(fields, ensure_ascii=True)}"},
-        ]
-        try:
-            llm = get_chat_model(SMART_MODEL)
-            if llm:
-                start = time.perf_counter()
-                response = llm.invoke(to_lc_messages(messages))
-                elapsed = time.perf_counter() - start
-                content = response.content or ""
-                usage = getattr(response, "usage_metadata", None)
-                logger.info(
-                    "[AI] field-extract model=%s elapsed=%.2fs chars=%s usage=%s",
-                    SMART_MODEL,
-                    elapsed,
-                    len(str(content)),
-                    usage,
-                )
-                if content:
-                    parsed = _extract_json_array(str(content))
-                    if parsed:
-                        return [
-                            {
-                                "label": str(item.get("label", "Field")),
-                                "value": str(item.get("value", "")),
-                            }
-                            for item in parsed
-                            if isinstance(item, dict)
-                        ]
-        except Exception as exc:
-            logger.error("[AI] Field extraction failed, falling back: %s", exc)
-
-    return _extract_fields_from_prompt(prompt, fields)
-
-def _extract_json_array(payload: str) -> Optional[List[Dict[str, Any]]]:
-    try:
-        return json.loads(payload)
-    except json.JSONDecodeError:
-        match = re.search(r"\[[\s\S]*\]", payload)
-        if not match:
-            return None
-        try:
-            return json.loads(match.group(0))
-        except json.JSONDecodeError:
-            return None
-
-
-def generate_section_draft(
-    prompt: str,
-    document_type: str,
-    outline_text: str,
-    constraints: Optional[Dict[str, Any]] = None,
-) -> List[Dict[str, str]]:
-    if CLIENT_MODE == "langchain":
-        constraint_text = ""
-        if constraints:
-            tone = constraints.get("tone")
-            audience = constraints.get("audience")
-            pages = constraints.get("pageCount")
-            constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
-        system_prompt = (
-            "You are generating section content for a document.\n"
-            "Return a JSON array of objects with keys: label, value.\n"
-            "Use the provided outline sections as labels; values should be polished draft text.\n"
-            f"{constraint_text}\n"
-            "Keep the total length appropriate to the target pages.\n"
-            "Output JSON only."
-        )
-        messages: List[Dict[str, Any]] = [
-            {"role": "system", "content": system_prompt},
-            {"role": "user", "content": f"Document type: {document_type}"},
-            {"role": "user", "content": f"Outline:\n{outline_text}"},
-            {"role": "user", "content": f"Prompt:\n{prompt}"},
-        ]
-        try:
-            llm = get_chat_model(SMART_MODEL)
-            if llm:
-                start = time.perf_counter()
-                response = llm.invoke(to_lc_messages(messages))
-                elapsed = time.perf_counter() - start
-                content = response.content or ""
-                usage = getattr(response, "usage_metadata", None)
-                logger.info(
-                    "[AI] section-draft model=%s elapsed=%.2fs chars=%s usage=%s",
-                    SMART_MODEL,
-                    elapsed,
-                    len(str(content)),
-                    usage,
-                )
-                if content:
-                    parsed = _extract_json_array(str(content))
-                    if parsed:
-                        return [
-                            {
-                                "label": str(item.get("label", "Section")),
-                                "value": str(item.get("value", "")),
-                            }
-                            for item in parsed
-                            if isinstance(item, dict)
-                        ]
-        except Exception as exc:
-            logger.error("[AI] Section draft generation failed, falling back: %s", exc)
-
-    if outline_text.strip():
-        return _parse_outline_to_sections(outline_text)
-
-    fallback_label = "Main Content"
-    return [{"label": fallback_label, "value": prompt.strip() or "Draft content"}]
-
-
-def _fallback_template_fill(template_latex: str, outline_text: str, draft_text: Optional[str] = None) -> str:
-    default_text = draft_text or outline_text or "Details pending."
-    replacements = {
-        "TITLE": "Project Overview",
-        "SUBTITLE": "Executive Summary",
-        "AUTHOR": "Jane Doe",
-        "AUTHOR_LIST": "Jane Doe, John Smith",
-        "AFFILIATIONS": "John Smith Consulting",
-        "ABSTRACT": default_text,
-        "KEYWORDS": "keyword1, keyword2, keyword3",
-        "INTRODUCTION": default_text,
-        "RELATED_WORK": default_text,
-        "METHODOLOGY": default_text,
-        "RESULTS": default_text,
-        "DISCUSSION": default_text,
-        "CONCLUSION": default_text,
-        "REFERENCES": default_text,
-        "MAIN_TEXT": default_text,
-        "FIGURES_TABLES": default_text,
-        "REPORT_TITLE": "Business Report",
-        "DATE": "2025-01-01",
-        "EXEC_SUMMARY": default_text,
-        "BACKGROUND": default_text,
-        "FINDINGS": default_text,
-        "RECOMMENDATIONS": default_text,
-        "APPENDIX": default_text,
-        "NEWSLETTER_TITLE": "Doe Consulting Monthly",
-        "TOP_STORY": default_text,
-        "UPDATES": default_text,
-        "SPOTLIGHT": default_text,
-        "FOOTER": "Contact: info@example.com",
-        "RECIPE_TITLE": "Recipe Title",
-        "SERVINGS": "Serves 4",
-        "TIME": "30 minutes",
-        "INGREDIENTS": "\\\\begin{itemize}\\\\item Ingredient A\\\\item Ingredient B\\\\end{itemize}",
-        "INSTRUCTIONS": default_text,
-        "NOTES": "Notes and tips.",
-        "BUSINESS_NAME": "John Smith Consulting",
-        "BUSINESS_ADDRESS": "123 Example Street, Example City",
-        "BUSINESS_CONTACT": "billing@example.com | (555) 000-0000",
-        "INVOICE_NUMBER": "INV-1001",
-        "ISSUE_DATE": "2025-01-01",
-        "DUE_DATE": "2025-01-15",
-        "CLIENT_NAME": "Doe Corporation",
-        "CLIENT_ADDRESS": "456 Sample Avenue, Example City",
-        "CLIENT_CONTACT": "ap@example.com",
-        "LINE_ITEMS": "Service & 1 & $1000 & $1000 \\\\\\\\",
-        "SUBTOTAL": "$1000",
-        "TAXES": "$0",
-        "TOTAL": "$1000",
-        "PAYMENT_TERMS": "Net 15",
-        "PAYMENT_METHODS": "Bank transfer, credit card",
-        "STUDENT_NAME": "Jane Doe",
-        "COURSE_NAME": "Business Communications",
-        "INSTRUCTOR_NAME": "Dr. Rivera",
-        "ASSIGNMENT_TITLE": "Market Analysis",
-        "PROMPT": default_text,
-        "RESPONSE": default_text,
-        "CHAPTER_ONE_TITLE": "Chapter One",
-        "CHAPTER_ONE": default_text,
-        "CHAPTER_TWO_TITLE": "Chapter Two",
-        "CHAPTER_TWO": default_text,
-        "PREFACE": default_text,
-        "PUBLISHER": "Doe Press",
-        "NAME": "Jane Doe",
-        "TITLE_PAGE": "Project Overview",
-        "EMAIL": "jane.doe@example.com",
-        "PHONE": "(555) 000-0000",
-        "LOCATION": "Example City, USA",
-        "SUMMARY": default_text,
-        "EXPERIENCE": default_text,
-        "EDUCATION": default_text,
-        "SKILLS": default_text,
-        "PROJECTS": default_text,
-        "SUBJECT": "Subject",
-        "BODY": default_text,
-        "RECIPIENT_NAME": "John Smith",
-        "RECIPIENT_TITLE": "Hiring Manager",
-        "RECIPIENT_COMPANY": "Doe Corporation",
-        "RECIPIENT_ADDRESS": "456 Sample Avenue, Example City",
-        "SENDER_NAME": "Jane Doe",
-        "SENDER_ADDRESS": "123 Example Street, Example City",
-        "SENDER_EMAIL": "jane.doe@example.com",
-        "MONTH_YEAR": "January 2025",
-        "THEME": "Theme",
-        "WEEK_ROWS": "1 & 2 & 3 & 4 & 5 & 6 & 7 \\\\\\\\ \\\\hline",
-        "HEADLINE": "Launch Announcement",
-        "SUBTEXT": "Introducing our latest release.",
-        "CALL_TO_ACTION": "Visit example.com to learn more.",
-        "CONTACT": "contact@example.com",
-        "EXPERIMENT_TITLE": "Experiment",
-        "OBJECTIVE": default_text,
-        "MATERIALS": default_text,
-        "PROCEDURE": default_text,
-        "OBSERVATIONS": default_text,
-        "INSTITUTION": "Doe Institute",
-        "PRESENTER": "Jane Doe",
-        "AGENDA": default_text,
-        "KEY_POINTS": default_text,
-        "DATA_VISUALS": default_text,
-    }
-
-    def replace(match: re.Match[str]) -> str:
-        key = match.group(1).strip()
-        return replacements.get(key, default_text)
-
-    return re.sub(r"<<([A-Z0-9_]+)>>", replace, template_latex)
-
-
-def generate_template_fill_stream(
-    template_latex: str,
-    document_type: str,
-    outline_text: str,
-    draft_sections: Optional[List[Dict[str, str]]] = None,
-    constraints: Optional[Dict[str, Any]] = None,
-    style_profile: Optional[Dict[str, Any]] = None,
-):
-    """Fill a LaTeX template by replacing placeholders."""
-    if CLIENT_MODE == "langchain":
-        constraints_text = ""
-        if constraints:
-            tone = constraints.get("tone")
-            audience = constraints.get("audience")
-            pages = constraints.get("pageCount")
-            constraints_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
-        style_text = ""
-        if style_profile:
-            font = style_profile.get("font_preference")
-            layout = style_profile.get("layout_preference")
-            accent = style_profile.get("color_accent")
-            style_text = f"Style preferences: font={font}, layout={layout}, accent={accent}."
-        if draft_sections:
-            constraints_text = f"{constraints_text}\nUse the section content to inform placeholder values."
-        system_prompt = (
-            "You are a LaTeX template filler.\n"
-            "Return the full LaTeX document with placeholders filled.\n"
-            "Rules:\n"
-            "1) Only replace placeholders like <<PLACEHOLDER>>.\n"
-            "2) Do not change any other LaTeX layout/commands.\n"
-            "3) Output ONLY LaTeX (no markdown).\n"
-            "4) If you add color, use the accent token name 'accent'.\n"
-            f"{constraints_text}\n"
-            f"{style_text}\n"
-            "Keep the final output within the target page count.\n"
-        )
-        messages: List[Dict[str, Any]] = [
-            {"role": "system", "content": system_prompt},
-            {"role": "user", "content": f"Document type: {document_type}"},
-            {"role": "user", "content": f"Outline/context:\n{outline_text}"},
-            {"role": "user", "content": f"Template:\n{template_latex}"},
-        ]
-        if draft_sections:
-            messages.append(
-                {
-                    "role": "user",
-                    "content": f"Section content (JSON):\n{json.dumps(draft_sections, ensure_ascii=True)}",
-                }
-            )
-
-        try:
-            llm = get_chat_model(SMART_MODEL, streaming=True)
-            if llm:
-                start = time.perf_counter()
-                total_chars = 0
-                chunk_count = 0
-                first_chunk = None
-                for chunk in llm.stream(to_lc_messages(messages)):
-                    if chunk.content:
-                        if first_chunk is None:
-                            first_chunk = time.perf_counter()
-                        chunk_count += 1
-                        total_chars += len(str(chunk.content))
-                        yield chunk.content
-                elapsed = time.perf_counter() - start
-                logger.info(
-                    "[AI] template-fill-stream model=%s elapsed=%.2fs first_chunk=%.2fs chunks=%s chars=%s",
-                    SMART_MODEL,
-                    elapsed,
-                    (first_chunk - start) if first_chunk else -1.0,
-                    chunk_count,
-                    total_chars,
-                )
-                return
-        except Exception as exc:
-            logger.error("[AI] Template fill failed, falling back: %s", exc)
-
-    draft_text = None
-    if draft_sections:
-        draft_text = "\n".join(
-            f"{section.get('label', 'Section')}: {section.get('value', '')}"
-            for section in draft_sections
-        )
-    filled = _fallback_template_fill(template_latex, outline_text, draft_text)
-    chunk_size = 200
-    for i in range(0, len(filled), chunk_size):
-        yield filled[i : i + chunk_size]
-
-
-def generate_latex_with_llm(
-    prompt: str,
-    history: List[Dict[str, str]],
-    style_profile: Dict[str, Any],
-    document_type: str,
-    template_hint: Optional[str] = None,
-    current_latex: Optional[str] = None,
-    structured_brief: Optional[str] = None,
-    edit_mode: bool = False,
-) -> str:
-    """Call the LLM (when available) or fall back to deterministic templates."""
-    if CLIENT_MODE == "langchain":
-        messages: List[Dict[str, Any]] = [{"role": "system", "content": latex_system_prompt(style_profile, document_type, template_hint)}]
-        messages.extend(history)
-        messages.extend(latex_context_messages(template_hint, current_latex, structured_brief))
-        messages.append({"role": "user", "content": prompt})
-
-        try:
-            logger.info(
-                "[AI] Using live model=%s doc_type=%s template_hint=%s",
-                SMART_MODEL,
-                document_type,
-                "yes" if template_hint else "no",
-            )
-            llm = get_chat_model(SMART_MODEL)
-            if llm:
-                start = time.perf_counter()
-                response = llm.invoke(to_lc_messages(messages))
-                elapsed = time.perf_counter() - start
-                content = response.content or ""
-                usage = getattr(response, "usage_metadata", None)
-                logger.info(
-                    "[AI] latex-generate model=%s elapsed=%.2fs chars=%s usage=%s",
-                    SMART_MODEL,
-                    elapsed,
-                    len(str(content)),
-                    usage,
-                )
-                return content
-        except Exception as exc:
-            logger.error("[AI] LangChain generation failed, falling back to mock: %s", exc)
-
-    lower_prompt = prompt.lower()
-
-    if "invoice" in lower_prompt:
-        save_user_style("default_user", {"last_doc_type": "invoice"})
-        details = structured_brief or prompt or "Invoice details provided by user."
-        return r"""\documentclass{article}
-\usepackage[utf8]{inputenc}
-\usepackage{geometry}
-\geometry{a4paper, margin=1in}
-
-\begin{document}
-
-\begin{center}
-    {\LARGE \textbf{INVOICE}}\\[0.5cm]
-    \#1023\\
-    \today
-\end{center}
-
-\section*{Bill To:}
-Client Name \\
-123 Business Rd.
-
-\section*{Items}
-\begin{tabular}{lr}
-    \textbf{Service} & \textbf{Amount} \\
-    \hline
-    % Replace with your line items
-    Description & \$0.00 \\
-    Description & \$0.00 \\
-    \hline
-    \textbf{Total Due} & \textbf{\$0.00} \\
-\end{tabular}
-
-\section*{Notes}
-""" + details + r"""
-
-\end{document}"""
-
-    if "resume" in lower_prompt or "cv" in lower_prompt:
-        save_user_style("default_user", {"last_doc_type": "resume"})
-        details = structured_brief or prompt or "Resume details provided by user."
-        return r"""\documentclass{article}
-\usepackage[utf8]{inputenc}
-\usepackage{geometry}
-\geometry{a4paper, margin=0.75in}
-
-\begin{document}
-
-\section*{Details}
-""" + details + r"""
-
-\end{document}"""
-
-    base_doc = r"""\documentclass{article}
-\usepackage[utf8]{inputenc}
-\usepackage{geometry}
-\geometry{a4paper, margin=1in}
-
-\begin{document}
-
-"""
-    content = structured_brief or prompt or ""
-    base_doc += r"""\section*{Document}
-
-""" + content + r"""
-
-\end{document}"""
-
-    return base_doc
-
-
-def generate_latex_with_llm_stream(
-    prompt: str,
-    history: List[Dict[str, str]],
-    style_profile: Dict[str, Any],
-    document_type: str,
-    template_hint: Optional[str] = None,
-    current_latex: Optional[str] = None,
-    structured_brief: Optional[str] = None,
-    edit_mode: bool = False,
-):
-    """Stream LaTeX generation from LLM, yielding chunks as they arrive."""
-    if not STREAMING_ENABLED:
-        full_latex = generate_latex_with_llm(
-            prompt, history, style_profile, document_type, template_hint, current_latex, structured_brief, edit_mode=edit_mode
-        )
-        chunk_size = 100
-        for i in range(0, len(full_latex), chunk_size):
-            yield full_latex[i:i + chunk_size]
-        return
-    if CLIENT_MODE == "langchain":
-        messages: List[Dict[str, Any]] = [{"role": "system", "content": latex_system_prompt(style_profile, document_type, template_hint)}]
-        messages.extend(history)
-        messages.extend(latex_context_messages(template_hint, current_latex, structured_brief))
-        messages.append({"role": "user", "content": prompt})
-
-        try:
-            logger.info(
-                "[AI] Streaming from model=%s doc_type=%s template_hint=%s",
-                SMART_MODEL,
-                document_type,
-                "yes" if template_hint else "no",
-            )
-            llm = get_chat_model(SMART_MODEL, streaming=True)
-            if llm:
-                start = time.perf_counter()
-                total_chars = 0
-                chunk_count = 0
-                first_chunk = None
-                for chunk in llm.stream(to_lc_messages(messages)):
-                    if chunk.content:
-                        if first_chunk is None:
-                            first_chunk = time.perf_counter()
-                        chunk_count += 1
-                        total_chars += len(str(chunk.content))
-                        yield chunk.content
-                elapsed = time.perf_counter() - start
-                logger.info(
-                    "[AI] latex-stream model=%s elapsed=%.2fs first_chunk=%.2fs chunks=%s chars=%s",
-                    SMART_MODEL,
-                    elapsed,
-                    (first_chunk - start) if first_chunk else -1.0,
-                    chunk_count,
-                    total_chars,
-                )
-                return
-        except Exception as exc:
-            logger.error("[AI] LangChain streaming failed, falling back to mock: %s", exc)
-    
-    # Fallback to non-streaming for mock mode
-    full_latex = generate_latex_with_llm(
-        prompt, history, style_profile, document_type, template_hint, current_latex, structured_brief, edit_mode=edit_mode
-    )
-    # Simulate streaming by yielding chunks
-    chunk_size = 100
-    for i in range(0, len(full_latex), chunk_size):
-        yield full_latex[i:i + chunk_size]
-
-
-__all__ = [
-    "generate_outline_with_llm",
-    "generate_section_draft",
-    "generate_field_values",
-    "generate_latex_with_llm",
-    "generate_latex_with_llm_stream",
-    "generate_template_fill_stream",
-]
@@ -1,964 +0,0 @@
-import os
-import mimetypes
-import subprocess
-import uuid
-from pathlib import Path
-from datetime import datetime
-from typing import Any, Dict, List, Optional, Tuple
-import re
-import time
-import threading
-import queue
-import urllib.error
-import urllib.request
-from concurrent.futures import ThreadPoolExecutor
-
-from flask import Flask, jsonify, request, send_file, Response, stream_with_context
-from flask_cors import CORS
-import json
-
-from ai_generation import (
-    generate_latex_with_llm,
-    generate_latex_with_llm_stream,
-    generate_outline_with_llm,
-    generate_section_draft,
-    generate_field_values,
-    generate_template_fill_stream,
-)
-from briefs import gather_brief, _preprocess_intent
-from config import (
-    CLIENT_MODE,
-    SMART_MODEL,
-    OUTPUT_DIR,
-    ASSETS_DIR,
-    TEMPLATE_DIR,
-    JAVA_BACKEND_URL,
-    PREVIEW_MAX_INFLIGHT,
-    get_chat_model,
-    logger,
-)
-from langchain_utils import to_lc_messages
-from document_types import detect_document_type
-from latex_utils import apply_style_overrides, clean_generated_latex
-from pdf_utils import compile_latex_to_pdf, render_pdf_to_images
-from pdf_text_editor import convert_pdf_to_text_editor_document
-from storage import (
-    load_user_style,
-    load_user_templates,
-    load_versions,
-    save_user_style,
-    save_user_template,
-    save_version,
-)
-from styles import update_style_profile_from_prompt
-from vision import vision_layout_from_images
-from prompts import pdf_qa_system_prompt
-
-
-app = Flask(__name__)
-CORS(app)
-
-
-@app.before_request
-def log_job_request_sequence() -> None:
-    job_id = request.headers.get("X-Job-Id")
-    if not job_id:
-        return
-    seq = request.headers.get("X-Job-Seq", "?")
-    total = request.headers.get("X-Job-Total", "?")
-    logger.info("[HTTP] job_id=%s req=%s/%s %s %s", job_id, seq, total, request.method, request.path)
-
-
-def _json_body() -> Dict[str, Any]:
-    return request.get_json(silent=True) or {}
-
-def _require_ai_enabled() -> Optional[Any]:
-    if CLIENT_MODE != "langchain":
-        return jsonify({"error": "AI is disabled. Set OPENAI_API_KEY to enable AI features."}), 503
-    return None
-
-
-def _java_url(path: str) -> str:
-    base = JAVA_BACKEND_URL.rstrip("/")
-    if not path.startswith("/"):
-        path = "/" + path
-    return f"{base}{path}"
-
-
-def _java_request_json(method: str, path: str, payload: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
-    url = _java_url(path)
-    data = None
-    headers = {"Content-Type": "application/json"}
-    if payload is not None:
-        data = json.dumps(payload).encode("utf-8")
-    req = urllib.request.Request(url, data=data, headers=headers, method=method)
-    try:
-        with urllib.request.urlopen(req, timeout=10) as resp:
-            body = resp.read().decode("utf-8")
-            return json.loads(body) if body else {}
-    except urllib.error.HTTPError as exc:
-        detail = exc.read().decode("utf-8") if exc.fp else ""
-        logger.error("[JAVA] %s %s failed status=%s detail=%s", method, path, exc.code, detail)
-        raise
-
-
-def _fetch_ai_session(session_id: str) -> Dict[str, Any]:
-    return _java_request_json("GET", f"/api/v1/ai/create/internal/sessions/{session_id}")
-
-
-def _update_ai_session(session_id: str, payload: Dict[str, Any]) -> None:
-    _java_request_json("POST", f"/api/v1/ai/create/internal/sessions/{session_id}/update", payload)
-
-
-def _sanitize_doc_type(value: str) -> str:
-    cleaned = re.sub(r"[^a-zA-Z0-9_]+", "", (value or "").lower())
-    return cleaned or "miscellaneous"
-
-
-def _select_template(doc_type: str, template_id: Optional[str]) -> Optional[str]:
-    safe_doc_type = _sanitize_doc_type(doc_type)
-    base_dir = Path(TEMPLATE_DIR) / safe_doc_type
-    if not base_dir.exists() or not base_dir.is_dir():
-        return None
-
-    if template_id:
-        safe_template = re.sub(r"[^a-zA-Z0-9_-]+", "", template_id)
-        if safe_template:
-            candidate = base_dir / f"{safe_template}.tex"
-            if candidate.exists():
-                return candidate.read_text(encoding="utf-8", errors="replace")
-
-    default_path = base_dir / "default.tex"
-    if default_path.exists():
-        return default_path.read_text(encoding="utf-8", errors="replace")
-
-    for tex_file in sorted(base_dir.glob("*.tex")):
-        return tex_file.read_text(encoding="utf-8", errors="replace")
-    return None
-
-
-@app.route("/api/intent/check", methods=["POST"])
-def intent_check() -> Any:
-    try:
-        data = _json_body()
-        prompt: str = data.get("prompt", "")
-        history: List[Dict[str, str]] = data.get("conversationHistory") or []
-        current_latex: Optional[str] = data.get("currentLatex")
-        current_pdf_url: Optional[str] = data.get("currentPdfUrl")
-        doc_type = detect_document_type(prompt, current_latex)
-        intent = _preprocess_intent(prompt, history, bool(current_pdf_url), current_latex)
-        intent["documentType"] = doc_type
-        intent["hasPdf"] = bool(current_pdf_url)
-        return jsonify(intent)
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[INTENT] intent_check failed: %s", exc, exc_info=True)
-        return jsonify({"wants_pdf": True, "has_enough_info": True, "allow_makeup": False, "reason": str(exc)}), 500
-
-
-@app.route("/api/pdf/answer", methods=["POST"])
-def pdf_answer() -> Any:
-    data = _json_body()
-    pdf_url = data.get("pdfUrl")
-    question = data.get("question")
-    if not pdf_url or not question:
-        return jsonify({"error": "Missing pdfUrl or question"}), 400
-
-    filename = os.path.basename(pdf_url.split("?")[0])
-    if not filename.lower().endswith(".pdf"):
-        return jsonify({"error": "Invalid pdf file"}), 400
-
-    pdf_path = os.path.join(OUTPUT_DIR, filename)
-    if not os.path.exists(pdf_path):
-        return jsonify({"error": "PDF not found"}), 404
-
-    try:
-        doc = convert_pdf_to_text_editor_document(pdf_path)
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[PDF-ANSWER] failed to parse pdf: %s", exc, exc_info=True)
-        return jsonify({"error": "Failed to read PDF content"}), 500
-
-    pages = doc.get("document", {}).get("pages", []) if doc else []
-    snippets: List[str] = []
-    for page in pages:
-        for elem in page.get("textElements", []) or []:
-            text = elem.get("text")
-            if text:
-                snippets.append(str(text))
-    if not snippets:
-        return jsonify({"error": "No readable text in PDF"}), 400
-
-    # Normalize and limit context
-    context = " ".join(snippets)
-    context = " ".join(context.split())  # normalize whitespace
-    max_context = 10000
-    if len(context) > max_context:
-        context = context[:max_context]
-
-    # Heuristic helpers
-    def _sentences(text: str) -> List[str]:
-        return [s.strip() for s in re.split(r"(?<=[.!?])\s+", text) if s.strip()]
-
-    def _heuristic_summary(text: str, limit: int = 480) -> str:
-        sentences = _sentences(text)
-        hits = [s for s in sentences if re.search(r"\b(difficult|challenge|problem|issue|hard)\b", s, re.IGNORECASE)]
-        chosen = hits[:3] if hits else sentences[:3]
-        summary = " ".join(chosen).strip()
-        return summary[:limit] + ("…" if len(summary) > limit else "")
-
-    def _heuristic_first_difficulty(text: str) -> str:
-        sentences = _sentences(text)
-        for s in sentences:
-            if re.search(r"\b(difficult|challenge|problem|issue|hard)\b", s, re.IGNORECASE):
-                return s
-        return sentences[0] if sentences else "No difficulty found in PDF text."
-
-    if CLIENT_MODE != "langchain":
-        return jsonify({"error": "PDF Q&A unavailable (no AI client configured)."}), 503
-
-    model_name = SMART_MODEL
-    system_prompt = pdf_qa_system_prompt()
-    user_prompt = f"Question: {question}\n\nPDF text:\n{context}"
-    try:
-        llm = get_chat_model(model_name, max_tokens=220)
-        if not llm:
-            return jsonify({"error": "PDF Q&A unavailable (no AI client configured)."}), 503
-        start = time.perf_counter()
-        response = llm.invoke(
-            to_lc_messages(
-                [
-                    {"role": "system", "content": system_prompt},
-                    {"role": "user", "content": user_prompt},
-                ]
-            )
-        )
-        elapsed = time.perf_counter() - start
-        content = response.content or ""
-        usage = getattr(response, "usage_metadata", None)
-        logger.info(
-            "[PDF-ANSWER] model=%s elapsed=%.2fs chars=%s usage=%s",
-            model_name,
-            elapsed,
-            len(str(content)),
-            usage,
-        )
-        answer = response.content
-        if not answer or not str(answer).strip():
-            answer = _heuristic_summary(context)
-        # If model parrots title/metadata, replace with heuristic
-        title_like = re.match(r"^why pdfs|^minimalist|^author:", answer.strip(), re.IGNORECASE) if answer else None
-        normalized_answer = re.sub(r"\s+", " ", answer or "").strip().lower()
-        normalized_context = re.sub(r"\s+", " ", context).strip().lower()
-        copied_context = bool(normalized_answer) and normalized_answer in normalized_context
-        if title_like or copied_context:
-            answer = _heuristic_summary(context)
-        return jsonify({"answer": answer, "mode": "model"})
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[PDF-ANSWER] model failed: %s", exc, exc_info=True)
-        answer = _heuristic_first_difficulty(context)
-        return jsonify({"answer": answer, "mode": "heuristic"})
-
-
-@app.route("/api/generate", methods=["POST"])
-def generate() -> Any:
-    """Generate LaTeX + PDF in a single call."""
-    data = _json_body()
-    user_id = data.get("userId", "default_user")
-    prompt: str = data.get("prompt", "")
-    history: List[Dict[str, str]] = data.get("conversationHistory") or []
-    current_latex: str | None = data.get("currentLatex")
-    skip_template = bool(data.get("skipTemplate"))
-    force_new_document: Optional[bool] = data.get("forceNewDocument")
-    edit_mode = bool(current_latex) and not bool(force_new_document)
-    latex_source = current_latex if edit_mode else None
-
-    style_profile = update_style_profile_from_prompt(user_id, prompt)
-
-    doc_type = detect_document_type(prompt, latex_source or current_latex)
-    brief = gather_brief(doc_type, prompt, history)
-    if brief.get("needsInfo"):
-        logger.info("[REQ] brief incomplete doc_type=%s missing=%s", doc_type, brief.get("missing"))
-        return jsonify(
-            {
-                "needsInfo": True,
-                "message": brief.get("message"),
-                "missing": brief.get("missing", []),
-                "collected": brief.get("collected", {}),
-                "documentType": doc_type,
-            }
-        )
-
-    templates = load_user_templates(user_id)
-    template_hint = None if (skip_template or edit_mode) else templates.get(doc_type)
-
-    logger.info(
-        "[REQ] user=%s doc_type=%s template=%s history_len=%s current_latex=%s skip_template=%s edit_mode=%s",
-        user_id,
-        doc_type,
-        "yes" if template_hint else "no",
-        len(history),
-        bool(current_latex),
-        skip_template,
-        edit_mode,
-    )
-
-    mode = "live" if CLIENT_MODE == "langchain" else "mock"
-    latex_code_raw = generate_latex_with_llm(
-        prompt,
-        history,
-        style_profile,
-        doc_type,
-        template_hint,
-        latex_source,
-        brief.get("structured_brief"),
-        edit_mode=edit_mode,
-    )
-    latex_code = apply_style_overrides(clean_generated_latex(latex_code_raw), style_profile)
-
-    doc_type = detect_document_type(prompt, latex_code)
-    save_user_style(user_id, {"last_doc_type": doc_type})
-    if not skip_template and not edit_mode:
-        save_user_template(user_id, doc_type, latex_code)
-    elif skip_template:
-        logger.info("[TEMPLATE] skip flag set; not persisting template for %s", doc_type)
-    else:
-        logger.info("[TEMPLATE] edit mode active; not updating template for %s", doc_type)
-    template_used = bool(template_hint)
-
-    job_id = str(uuid.uuid4())
-    pdf_path = compile_latex_to_pdf(latex_code, job_id)
-    if pdf_path and os.path.exists(pdf_path):
-        pdf_url = f"/output/{job_id}.pdf"
-        version_entry = {
-            "id": job_id,
-            "prompt": prompt,
-            "documentType": doc_type,
-            "pdfUrl": pdf_url,
-            "latex": latex_code,
-            "createdAt": datetime.utcnow().isoformat() + "Z",
-            "styleProfile": style_profile,
-            "templateUsed": template_used,
-            "editMode": edit_mode,
-        }
-        save_version(user_id, version_entry)
-
-        logger.info("[OK] job_id=%s doc_type=%s pdf_url=%s", job_id, doc_type, pdf_url)
-        return jsonify(
-            {
-                "latex": latex_code,
-                "pdfUrl": pdf_url,
-                "documentType": doc_type,
-                "message": f"Generated {doc_type} successfully! mode={mode}",
-                "version": version_entry,
-                "styleProfile": style_profile,
-                "mode": mode,
-                "templateUsed": template_used,
-                "editingExisting": edit_mode,
-            }
-        )
-
-    logger.error("[FAIL] job_id=%s doc_type=%s compile_failed", job_id, doc_type)
-    return jsonify(
-        {
-            "error": "LaTeX compilation failed. Check logs.",
-            "latex": latex_code,
-            "mode": mode,
-            "editingExisting": edit_mode,
-        }
-    ), 500
-
-
-@app.route("/api/generate_stream", methods=["POST"])
-def generate_stream() -> Any:
-    """Stream LaTeX generation and compile PDFs incrementally."""
-    try:
-        data = _json_body()
-        user_id = data.get("userId", "default_user")
-        prompt: str = data.get("prompt", "")
-        history: List[Dict[str, str]] = data.get("conversationHistory") or []
-        current_latex: str | None = data.get("currentLatex")
-        skip_template = bool(data.get("skipTemplate"))
-        force_new_document: Optional[bool] = data.get("forceNewDocument")
-        edit_mode = bool(current_latex) and not bool(force_new_document)
-        latex_source = current_latex if edit_mode else None
-        style_profile = update_style_profile_from_prompt(user_id, prompt)
-        doc_type = detect_document_type(prompt, latex_source or current_latex)
-        brief = gather_brief(doc_type, prompt, history, current_latex, bool(current_latex))
-        logger.info(
-            "[STREAM] brief gate doc_type=%s needsInfo=%s missing=%s allowFabrication=%s",
-            doc_type,
-            brief.get("needsInfo"),
-            brief.get("missing"),
-            brief.get("allowFabrication"),
-        )
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[STREAM] Failed to prepare generation request: %s", exc, exc_info=True)
-        return jsonify({"error": "Failed to start generation", "detail": str(exc)}), 500
-    
-    if brief.get("needsInfo"):
-        # Return a normal 200 with guidance so the assistant can ask follow-up questions
-        return jsonify(
-            {
-                "needsInfo": True,
-                "message": brief.get("message"),
-                "missing": brief.get("missing", []),
-                "collected": brief.get("collected", {}),
-                "documentType": doc_type,
-                "allowFabrication": brief.get("allowFabrication", False),
-            }
-        )
-
-    templates = load_user_templates(user_id)
-    template_hint = None if (skip_template or edit_mode) else templates.get(doc_type)
-
-    job_id = str(uuid.uuid4())
-    accumulated_latex = ""
-    last_compile_idx = 0
-    compile_interval = 250  # Compile every ~250 characters for faster previews
-    compile_time_budget = 2.0  # Or every ~2 seconds, whichever comes first
-    last_compile_time = time.perf_counter()
-    last_heartbeat_time = time.perf_counter()
-    stream_start = time.perf_counter()
-    first_chunk_time: Optional[float] = None
-    last_chunk_time: Optional[float] = None
-    total_chunk_chars = 0
-    total_chunks = 0
-
-    preview_executor = ThreadPoolExecutor(max_workers=2)
-    preview_tasks: Dict[str, Tuple[Any, int]] = {}
-    chunk_queue: "queue.Queue[Tuple[str, Optional[str]]]" = queue.Queue()
-
-    def stream_latex():
-        try:
-            for chunk in generate_latex_with_llm_stream(
-                prompt,
-                history,
-                style_profile,
-                doc_type,
-                template_hint,
-                latex_source,
-                brief.get("structured_brief"),
-                edit_mode=edit_mode,
-            ):
-                chunk_queue.put(("chunk", chunk))
-        except Exception as exc:
-            logger.error("[STREAM] LLM streaming failed: %s", exc, exc_info=True)
-            chunk_queue.put(("error", str(exc)))
-        finally:
-            chunk_queue.put(("done", None))
-
-    def submit_preview(latex: str, progress: int) -> None:
-        if len(preview_tasks) >= PREVIEW_MAX_INFLIGHT:
-            return
-        preview_job_id = f"{job_id}-preview-{progress}"
-
-        def _run_compile() -> Optional[str]:
-            return compile_latex_to_pdf(latex, preview_job_id, log_errors=False)
-
-        fut = preview_executor.submit(_run_compile)
-        preview_tasks[preview_job_id] = (fut, progress)
-
-    def drain_previews():
-        nonlocal last_compile_idx, last_compile_time
-        completed = []
-        for pid, (fut, progress) in list(preview_tasks.items()):
-            if fut.done():
-                completed.append(pid)
-                try:
-                    pdf_path = fut.result()
-                    if pdf_path and os.path.exists(pdf_path):
-                        pdf_url = f"/output/{pid}.pdf"
-                        yield f"data: {json.dumps({'type': 'pdf_update', 'pdfUrl': pdf_url, 'progress': progress})}\n\n"
-                        last_compile_idx = progress
-                        last_compile_time = time.perf_counter()
-                except Exception as e:  # noqa: BLE001
-                    logger.error("[STREAM] Preview compile failed (async): %s", e, exc_info=True)
-        for pid in completed:
-            preview_tasks.pop(pid, None)
-
-    def generate():
-        nonlocal accumulated_latex, last_compile_time, last_heartbeat_time
-        nonlocal total_chunk_chars, total_chunks, first_chunk_time, last_chunk_time
-
-        # Send initial metadata
-        yield f"data: {json.dumps({'type': 'start', 'jobId': job_id, 'documentType': doc_type, 'editingExisting': edit_mode})}\n\n"
-
-        streamer = threading.Thread(target=stream_latex, daemon=True)
-        streamer.start()
-
-        try:
-            while True:
-                try:
-                    item_type, payload = chunk_queue.get(timeout=0.5)
-                except queue.Empty:
-                    now = time.perf_counter()
-                    if now - last_heartbeat_time >= 1.0:
-                        yield f"data: {json.dumps({'type': 'heartbeat', 'ts': now})}\n\n"
-                        last_heartbeat_time = now
-                    yield from drain_previews()
-                    continue
-
-                if item_type == "chunk":
-                    chunk = payload or ""
-                    accumulated_latex += chunk
-                    total_chunks += 1
-                    total_chunk_chars += len(chunk)
-                    last_chunk_time = time.perf_counter()
-                    if first_chunk_time is None:
-                        first_chunk_time = last_chunk_time
-                    yield f"data: {json.dumps({'type': 'latex_chunk', 'chunk': chunk, 'accumulated': accumulated_latex})}\n\n"
-
-                    elapsed = time.perf_counter() - last_compile_time
-                    if (len(accumulated_latex) - last_compile_idx >= compile_interval) or elapsed >= compile_time_budget:
-                        compile_latex = accumulated_latex
-                        if "\\begin{document}" in compile_latex and "\\end{document}" not in compile_latex:
-                            if compile_latex.count("\\begin{") > compile_latex.count("\\end{"):
-                                temp_latex = compile_latex
-                                last_begin = compile_latex.rfind("\\begin{")
-                                if last_begin != -1:
-                                    env_start = last_begin + len("\\begin{")
-                                    env_end = compile_latex.find("}", env_start)
-                                    if env_end != -1:
-                                        env_name = compile_latex[env_start:env_end]
-                                        temp_latex += f"\\end{{{env_name}}}\n"
-                                temp_latex += "\\end{document}\n"
-                                compile_latex = temp_latex
-                            else:
-                                compile_latex += "\\end{document}\n"
-
-                        if "\\begin{document}" in compile_latex and "\\end{document}" in compile_latex:
-                            submit_preview(compile_latex, len(accumulated_latex))
-
-                    now = time.perf_counter()
-                    if now - last_heartbeat_time >= 1.0:
-                        yield f"data: {json.dumps({'type': 'heartbeat', 'ts': now})}\n\n"
-                        last_heartbeat_time = now
-                    yield from drain_previews()
-
-                elif item_type == "error":
-                    message = payload or "Streaming failed"
-                    yield f"data: {json.dumps({'type': 'error', 'message': message})}\n\n"
-                    break
-                elif item_type == "done":
-                    break
-
-            stream_end = time.perf_counter()
-            if first_chunk_time is None:
-                logger.info(
-                    "[STREAM] LLM finished with no chunks job_id=%s elapsed=%.2fs",
-                    job_id,
-                    stream_end - stream_start,
-                )
-            else:
-                logger.info(
-                    "[STREAM] LLM stats job_id=%s chunks=%s chars=%s first_chunk=%.2fs last_chunk=%.2fs elapsed=%.2fs",
-                    job_id,
-                    total_chunks,
-                    total_chunk_chars,
-                    first_chunk_time - stream_start,
-                    (last_chunk_time or stream_end) - stream_start,
-                    stream_end - stream_start,
-                )
-
-            # Final compilation with complete LaTeX
-            latex_code = apply_style_overrides(clean_generated_latex(accumulated_latex), style_profile)
-            final_doc_type = detect_document_type(prompt, latex_code)
-            save_user_style(user_id, {"last_doc_type": final_doc_type})
-            if not skip_template and not edit_mode:
-                save_user_template(user_id, final_doc_type, latex_code)
-            elif skip_template:
-                logger.info("[TEMPLATE] skip flag set; not persisting template for %s", final_doc_type)
-            else:
-                logger.info("[TEMPLATE] edit mode active; not updating template for %s", final_doc_type)
-            template_used = bool(template_hint)
-
-            pdf_path = compile_latex_to_pdf(latex_code, job_id)
-            if pdf_path and os.path.exists(pdf_path):
-                pdf_url = f"/output/{job_id}.pdf"
-                version_entry = {
-                    "id": job_id,
-                    "prompt": prompt,
-                    "documentType": final_doc_type,
-                    "pdfUrl": pdf_url,
-                    "latex": latex_code,
-                    "createdAt": datetime.utcnow().isoformat() + "Z",
-                    "styleProfile": style_profile,
-                    "templateUsed": template_used,
-                    "editMode": edit_mode,
-                }
-                save_version(user_id, version_entry)
-
-                yield f"data: {json.dumps({'type': 'complete', 'pdfUrl': pdf_url, 'latex': latex_code, 'version': version_entry, 'documentType': final_doc_type, 'templateUsed': template_used, 'styleProfile': style_profile, 'editingExisting': edit_mode})}\n\n"
-            else:
-                logger.error("[STREAM] Final PDF compilation failed for job_id=%s", job_id)
-                yield f"data: {json.dumps({'type': 'error', 'message': 'Final PDF compilation failed'})}\n\n"
-
-        except Exception as e:  # noqa: BLE001
-            logger.error("[STREAM] Generation error job_id=%s: %s", job_id, e, exc_info=True)
-            yield f"data: {json.dumps({'type': 'error', 'message': str(e)})}\n\n"
-        finally:
-            try:
-                preview_executor.shutdown(wait=False, cancel_futures=True)
-            except Exception:
-                pass
-
-    try:
-        return Response(
-            stream_with_context(generate()),
-            mimetype="text/event-stream",
-            headers={
-                "Cache-Control": "no-cache",
-                "X-Accel-Buffering": "no",
-            },
-        )
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[STREAM] Failed to start response: %s", exc, exc_info=True)
-        return jsonify({"error": "Unable to start streaming response", "detail": str(exc)}), 500
-
-
-@app.route("/api/create/sessions/<session_id>/stream", methods=["GET"])
-def create_stream(session_id: str) -> Any:
-    disabled = _require_ai_enabled()
-    if disabled:
-        return disabled
-    phase = (request.args.get("phase") or "outline").strip().lower()
-    try:
-        session = _fetch_ai_session(session_id)
-    except Exception:  # noqa: BLE001
-        return jsonify({"error": "Session not found"}), 404
-
-    user_id = session.get("userId", "default_user")
-    prompt = session.get("promptLatest") or session.get("promptInitial") or ""
-    doc_type = session.get("docType") or detect_document_type(prompt, None)
-    template_id = session.get("templateId")
-    outline_text = session.get("outlineText") or ""
-    constraints = session.get("outlineConstraints")
-    if isinstance(constraints, str) and constraints.strip():
-        try:
-            constraints = json.loads(constraints)
-        except json.JSONDecodeError:
-            constraints = None
-    draft_sections_raw = session.get("draftSections")
-    draft_sections = None
-    if isinstance(draft_sections_raw, list):
-        draft_sections = draft_sections_raw
-    elif isinstance(draft_sections_raw, str) and draft_sections_raw.strip():
-        try:
-            draft_sections = json.loads(draft_sections_raw)
-        except json.JSONDecodeError:
-            draft_sections = None
-    style_profile = load_user_style(user_id)
-
-    def sse(data: Dict[str, Any]) -> str:
-        return f"data: {json.dumps(data)}\n\n"
-
-    def generate():
-        yield sse({"type": "phase_changed", "phase": phase})
-
-        if phase == "outline":
-            outline = generate_outline_with_llm(prompt, doc_type, constraints)
-            _update_ai_session(
-                session_id,
-                {
-                    "outlineText": outline,
-                    "outlineConstraints": json.dumps(constraints, ensure_ascii=True) if constraints else None,
-                    "docType": doc_type,
-                    "status": "OUTLINE_PENDING",
-                },
-            )
-            yield sse({"type": "outline_ready", "outlineText": outline})
-            yield sse({"type": "phase_complete", "phase": "outline"})
-            return
-
-        if phase == "draft":
-            base_outline = outline_text or prompt
-            sections = generate_section_draft(prompt, doc_type, base_outline, constraints)
-            _update_ai_session(
-                session_id,
-                {
-                    "draftSections": json.dumps(sections, ensure_ascii=True),
-                    "outlineConstraints": json.dumps(constraints, ensure_ascii=True) if constraints else None,
-                    "docType": doc_type,
-                    "status": "DRAFT_READY",
-                },
-            )
-            yield sse({"type": "draft_sections", "sections": sections})
-            yield sse({"type": "phase_complete", "phase": "draft", "sections": sections})
-            return
-
-        if phase == "polish":
-            accumulated = ""
-            template_latex = _select_template(doc_type, template_id)
-            if template_latex:
-                for chunk in generate_template_fill_stream(
-                    template_latex,
-                    doc_type,
-                    outline_text or prompt,
-                    draft_sections=draft_sections,
-                    constraints=constraints,
-                    style_profile=style_profile,
-                ):
-                    accumulated += chunk
-                    yield sse({"type": "latex_delta", "phase": "polish", "delta": chunk})
-            else:
-                section_text = ""
-                if draft_sections:
-                    section_text = "\n".join(
-                        f"{section.get('label', 'Section')}: {section.get('value', '')}"
-                        for section in draft_sections
-                    )
-                constraint_text = ""
-                if constraints:
-                    tone = constraints.get("tone")
-                    audience = constraints.get("audience")
-                    pages = constraints.get("pageCount")
-                    constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
-                polish_prompt = (
-                    f"Create a polished LaTeX document for a {doc_type}.\n"
-                    "Use the provided section content and keep the substance consistent.\n"
-                    f"{constraint_text}\n"
-                    "Keep the final document within the target page count.\n"
-                )
-                for chunk in generate_latex_with_llm_stream(
-                    polish_prompt,
-                    [],
-                    style_profile,
-                    doc_type,
-                    None,
-                    None,
-                    section_text or outline_text or prompt,
-                    edit_mode=True,
-                ):
-                    accumulated += chunk
-                    yield sse({"type": "latex_delta", "phase": "polish", "delta": chunk})
-
-            accumulated = apply_style_overrides(accumulated, style_profile)
-            _update_ai_session(
-                session_id,
-                {"polishedLatex": accumulated, "docType": doc_type, "status": "POLISHED_READY"},
-            )
-
-            pdf_job_id = f"{session_id}-polished"
-            pdf_path = compile_latex_to_pdf(accumulated, pdf_job_id, log_errors=False)
-            if pdf_path and os.path.exists(pdf_path):
-                pdf_url = f"/output/{pdf_job_id}.pdf"
-                yield sse({"type": "save_complete", "docId": session_id, "pdfUrl": pdf_url})
-
-            yield sse({"type": "phase_complete", "phase": "polish", "latex": accumulated})
-            return
-
-        yield sse({"type": "error", "message": f"Unknown phase: {phase}"})
-
-    return Response(
-        stream_with_context(generate()),
-        mimetype="text/event-stream",
-        headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
-    )
-
-
-@app.route("/api/create/sessions/<session_id>/fields", methods=["POST"])
-def fill_fields(session_id: str) -> Any:
-    disabled = _require_ai_enabled()
-    if disabled:
-        return disabled
-    try:
-        logger.info("[AI create] fill_fields session_id=%s", session_id)
-        session = _fetch_ai_session(session_id)
-    except Exception as exc:  # noqa: BLE001
-        logger.warning("[AI create] fill_fields session lookup failed session_id=%s error=%s", session_id, exc)
-        return jsonify({"error": "Session not found"}), 404
-
-    data = _json_body()
-    fields = data.get("fields") or []
-    extra_prompt = data.get("extraPrompt") or ""
-    if not isinstance(fields, list):
-        return jsonify({"error": "Fields must be a list"}), 400
-
-    prompt = session.get("promptLatest") or session.get("promptInitial") or ""
-    if extra_prompt:
-        prompt = f"{prompt}\n{extra_prompt}"
-    doc_type = session.get("docType") or detect_document_type(prompt, None)
-    constraints = session.get("outlineConstraints")
-    if isinstance(constraints, str) and constraints.strip():
-        try:
-            constraints = json.loads(constraints)
-        except json.JSONDecodeError:
-            constraints = None
-
-    filled = generate_field_values(prompt, doc_type, fields, constraints)
-    return jsonify({"fields": filled})
-
-
-
-
-@app.route("/api/progressive_render", methods=["POST"])
-def progressive_render() -> Any:
-    """Compile arbitrary LaTeX (partial or masked) for progressive previews."""
-    data = _json_body()
-    latex = data.get("latex")
-    if not latex or not isinstance(latex, str):
-        return jsonify({"error": "Missing LaTeX payload"}), 400
-
-    job_id = data.get("jobId") or str(uuid.uuid4())
-    pdf_path = compile_latex_to_pdf(latex, job_id)
-    if pdf_path and os.path.exists(pdf_path):
-        return jsonify({"pdfUrl": f"/output/{job_id}.pdf"})
-
-    return jsonify({"error": "Progressive compilation failed"}), 500
-
-
-@app.route("/output/<path:filename>", methods=["GET"])
-def serve_output_file(filename: str) -> Any:
-    """Serve generated PDF files and stored assets."""
-    file_path = os.path.join(OUTPUT_DIR, filename)
-    if os.path.exists(file_path):
-        mime_type, _ = mimetypes.guess_type(file_path)
-        return send_file(file_path, mimetype=mime_type or "application/octet-stream")
-    return jsonify({"error": "File not found"}), 404
-
-
-@app.route("/api/versions/<user_id>", methods=["GET"])
-def list_versions(user_id: str) -> Any:
-    return jsonify({"versions": load_versions(user_id)})
-
-
-@app.route("/api/style/<user_id>", methods=["GET"])
-def get_style(user_id: str) -> Any:
-    return jsonify({"style": load_user_style(user_id)})
-
-
-@app.route("/api/style/<user_id>", methods=["POST"])
-def update_style(user_id: str) -> Any:
-    data = _json_body()
-    if not isinstance(data, dict):
-        return jsonify({"error": "Style payload must be an object"}), 400
-    current = load_user_style(user_id) or {}
-    merged = {**current, **data}
-    save_user_style(user_id, merged)
-    return jsonify({"style": merged})
-
-
-@app.route("/api/style/apply", methods=["POST"])
-def apply_style() -> Any:
-    data = _json_body()
-    latex = data.get("latex")
-    style = data.get("style") or {}
-    if not latex or not isinstance(latex, str):
-        return jsonify({"error": "Missing LaTeX payload"}), 400
-    if not isinstance(style, dict):
-        return jsonify({"error": "Style payload must be an object"}), 400
-    updated = apply_style_overrides(latex, style)
-    return jsonify({"latex": updated})
-
-
-@app.route("/api/import_template", methods=["POST"])
-def import_template() -> Any:
-    """Accept a PDF upload, extract layout via vision model, and save as a template."""
-    user_id = request.form.get("userId", "default_user")
-    doc_type = request.form.get("docType", "document")
-    file = request.files.get("file")
-
-    if not file:
-        return jsonify({"error": "No file uploaded"}), 400
-
-    pdf_bytes = file.read()
-    images = render_pdf_to_images(pdf_bytes, max_pages=2, dpi=170)
-    if not images:
-        return jsonify({"error": "Failed to render PDF"}), 400
-
-    layout_latex = vision_layout_from_images(images, doc_type) or ""
-    if not layout_latex:
-        layout_latex = f"""\\documentclass{{article}}
-\\usepackage[margin=1in]{{geometry}}
-\\usepackage{{tabularx}}
-\\usepackage{{multicol}}
-\\begin{{document}}
-% Fallback template for {doc_type}
-\\section*{{Title placeholder}}
-Body text goes here.
-\\end{{document}}
-"""
-
-    sanitized = clean_generated_latex(layout_latex)
-    save_user_template(user_id, doc_type, sanitized)
-    return jsonify({"message": "Template imported", "docType": doc_type, "pages": len(images)})
-
-
-@app.route("/api/assets/upload", methods=["POST"])
-def upload_asset() -> Any:
-    file = request.files.get("file")
-    if not file:
-        return jsonify({"error": "Missing file"}), 400
-
-    _, ext = os.path.splitext(file.filename or "")
-    ext = ext.lower()
-    if ext not in {".png", ".jpg", ".jpeg", ".gif"}:
-        return jsonify({"error": "Unsupported file type"}), 400
-
-    asset_id = f"{uuid.uuid4().hex}{ext}"
-    output_path = os.path.join(ASSETS_DIR, asset_id)
-    os.makedirs(ASSETS_DIR, exist_ok=True)
-    file.save(output_path)
-
-    return jsonify(
-        {
-            "assetId": asset_id,
-            "assetUrl": f"/output/assets/{asset_id}",
-            "latexPath": f"assets/{asset_id}",
-        }
-    )
-
-
-@app.route("/api/pdf-editor/document", methods=["GET"])
-def pdf_editor_document() -> Any:
-    """Expose a JSON snapshot of the PDF for rich text editing."""
-    pdf_url = request.args.get("pdfUrl")
-    if not pdf_url:
-        return jsonify({"error": "Missing pdfUrl"}), 400
-
-    filename = os.path.basename(pdf_url.split("?")[0])
-    if not filename:
-        return jsonify({"error": "Invalid pdf file"}), 400
-    if not filename.lower().endswith(".pdf"):
-        return jsonify({"error": "Invalid pdf file"}), 400
-
-    pdf_path = os.path.join(OUTPUT_DIR, filename)
-    if not os.path.exists(pdf_path):
-        return jsonify({"error": "PDF not found"}), 404
-
-    try:
-        document = convert_pdf_to_text_editor_document(pdf_path)
-        return jsonify(document)
-    except FileNotFoundError:
-        return jsonify({"error": "Conversion failed"}), 500
-    except subprocess.CalledProcessError as exc:
-        logger.error("[PDF-EDITOR] Conversion failed: %s", exc)
-        return jsonify({"error": "Conversion failed"}), 500
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[PDF-EDITOR] Unexpected conversion failure: %s", exc)
-        return jsonify({"error": "Conversion failed"}), 500
-
-
-@app.route("/api/pdf-editor/upload", methods=["POST"])
-def pdf_editor_upload() -> Any:
-    """Accept an edited PDF and save it so the preview can refresh."""
-    file = request.files.get("file")
-    if not file:
-        return jsonify({"error": "Missing file"}), 400
-
-    job_id = str(uuid.uuid4())
-    filename = f"{job_id}-edited.pdf"
-    output_path = os.path.join(OUTPUT_DIR, filename)
-    os.makedirs(OUTPUT_DIR, exist_ok=True)
-    file.save(output_path)
-
-    logger.info("[PDF-EDITOR] uploaded edited PDF job_id=%s -> %s", job_id, filename)
-    return jsonify({"pdfUrl": f"/output/{filename}"})
-
-
-@app.route("/health", methods=["GET"])
-def health() -> Any:
-    return jsonify({"status": "ok", "engine": "pdflatex"})
-
-
-if __name__ == "__main__":
-    app.run(host="0.0.0.0", port=5000, debug=True)
@@ -1,525 +0,0 @@
-from __future__ import annotations
-
-import re
-import json
-from typing import Any, Dict, List, Optional
-import time
-
-from config import CLIENT_MODE, FAST_MODEL, SMART_MODEL, get_chat_model, logger
-from langchain_utils import to_lc_messages
-from prompts import brief_missing_info_system_prompt
-
-
-BRIEF_SCHEMAS: Dict[str, Dict[str, Any]] = {
-    "resume": {
-        "field_order": [
-            "name",
-            "contact",
-            "location",
-            "target_role",
-            "summary",
-            "work_history",
-            "education",
-            "skills",
-            "achievements",
-            "links",
-            "constraints",
-        ],
-        "labels": {
-            "name": ["name", "full name"],
-            "contact": ["contact", "contact info", "contact information", "email/phone"],
-            "location": ["location", "city/country"],
-            "target_role": ["target role", "role", "title", "headline"],
-            "summary": ["summary", "objective", "about"],
-            "work_history": ["experience", "work history", "roles"],
-            "education": ["education", "studies"],
-            "skills": ["skills", "stack"],
-            "achievements": ["achievements", "certifications", "awards"],
-            "links": ["links", "profiles", "linkedin/github"],
-            "constraints": ["constraints", "tone/length/style"],
-        },
-        "questions": {
-            "name": "What's your name as you'd like it on the page?",
-            "contact": "How can someone reach you (email/phone)?",
-            "location": "Where are you based (or remote)?",
-            "target_role": "What role/title and industry are you aiming for?",
-            "summary": "Give me a 1–2 sentence summary about you.",
-            "work_history": "Recent roles: company, title, dates, location, and a few bullets with impact.",
-            "education": "Degree(s), school, and graduation year?",
-            "skills": "Key skills/stack (tech + relevant soft skills)?",
-            "achievements": "Awards/certifications/major achievements?",
-            "links": "Any LinkedIn/GitHub/portfolio links?",
-            "constraints": "Any tone/length constraints (ATS, one-page, etc.)?",
-        },
-        "intro": "Hey! To build a strong resume, you can paste your old resume or just dump everything you remember—name, how to reach you, where you're based, what you're aiming for, your roles, education, skills, links. Share whatever you have and I'll work with it.",
-    },
-    "invoice": {
-        "field_order": [
-            "your_business",
-            "client",
-            "issue_date",
-            "due_date",
-            "line_items",
-            "currency",
-            "payment_terms",
-            "notes",
-            "constraints",
-        ],
-        "labels": {
-            "your_business": ["your business", "seller", "from"],
-            "client": ["client", "bill to"],
-            "issue_date": ["issue date", "invoice date"],
-            "due_date": ["due date"],
-            "line_items": ["line items", "services/items"],
-            "currency": ["currency"],
-            "payment_terms": ["payment terms"],
-            "notes": ["notes"],
-            "constraints": ["constraints", "layout/style"],
-        },
-        "questions": {
-            "your_business": "Who is issuing the invoice (business name + contact)?",
-            "client": "Who is being billed (name + contact)?",
-            "issue_date": "Invoice issue date?",
-            "due_date": "Due date?",
-            "line_items": "Line items with description, qty, rate, tax (if any)?",
-            "currency": "Currency?",
-            "payment_terms": "Payment terms and payment methods?",
-            "notes": "Notes to include (late fees, thank you, PO #)?",
-            "constraints": "Branding/layout preferences?",
-        },
-        "intro": "I'll draft an accurate invoice if I know who is billing, who is paying, and the line items. Paste an old invoice or list the details.",
-    },
-}
-
-
-def classify_intent_with_llm(prompt: str, history: List[Dict[str, str]], current_latex: Optional[str], has_pdf: bool) -> Optional[Dict[str, Any]]:
-    """
-    Use a small model to classify intent instead of brittle regex.
-
-    Returns a dict like:
-    {
-      "documentType": "invoice|resume|contract|letter|report|form|document",
-      "action": "new|edit|question",
-      "allowFabrication": bool,
-      "wantsPdf": bool,
-      "hasEnoughInfo": bool,
-      "missingFields": [str],
-      "notes": str
-    }
-    """
-    if CLIENT_MODE != "langchain":
-        logger.info("[INTENT] skip llm classify: client_mode=%s", CLIENT_MODE)
-        return None
-
-    system = (
-        "You classify user requests about documents. "
-        "Output strict JSON. "
-        "documentType must be one of: academic, agenda, brochure, business_card, case_study, checklist, "
-        "contract, creative, datasheet, document, flyer, invoice, letter, manual, menu, minutes, newsletter, "
-        "one_pager, poster, presentation, press_release, proposal, recipe, report, resume, timeline, whitepaper. "
-        "action: 'new' (make/generate), 'edit' (modify existing), 'question' (asking about it). "
-        "allowFabrication: true if the user invites making up/placeholder/dummy/random details "
-        "OR asks you to use your knowledge about a fictional/real character (e.g., 'use what you know about James Bond', "
-        "'make it for agent 007', 'create resume for Sherlock Holmes', etc.). "
-        "Basically, if they're NOT providing their own personal details and expect you to fill in from common knowledge or imagination, set this to true. "
-        "wantsPdf: true if they expect/gave permission to generate a PDF. "
-        "hasEnoughInfo: true if there is enough info to proceed without asking questions (or if allowFabrication is true). "
-        "missingFields: key details still needed (e.g., for invoice: seller, client, line items; resume: name, contact, work). "
-        "notes: short free-form note."
-    )
-
-    conversation = [{"role": "system", "content": system}]
-    # Trim history to keep request small
-    trimmed_history = history[-6:] if len(history) > 6 else history
-    for msg in trimmed_history:
-        if msg.get("content") and msg.get("role") in {"user", "assistant", "system"}:
-            conversation.append({"role": msg["role"], "content": msg["content"]})
-    conversation.append({"role": "user", "content": prompt})
-
-    try:
-        llm = get_chat_model(
-            FAST_MODEL or SMART_MODEL,
-            max_tokens=800,
-            model_kwargs={"response_format": {"type": "json_object"}},
-        )
-        if not llm:
-            logger.info("[INTENT] skip llm classify: no LangChain client")
-            return None
-        start = time.perf_counter()
-        response = llm.invoke(to_lc_messages(conversation))
-        elapsed = time.perf_counter() - start
-        content = response.content or ""
-        usage = getattr(response, "usage_metadata", None)
-        logger.info(
-            "[INTENT] llm_classify model=%s elapsed=%.2fs chars=%s usage=%s",
-            FAST_MODEL or SMART_MODEL,
-            elapsed,
-            len(str(content)),
-            usage,
-        )
-        content = response.content
-        if not content:
-            logger.info("[INTENT] llm_classify empty content")
-            return None
-        data = json.loads(content)
-        # Normalize
-        doc_type = str(data.get("documentType") or "document").lower()
-        allowed_types = {
-            "academic", "agenda", "brochure", "business_card", "case_study", "checklist",
-            "contract", "creative", "datasheet", "document", "flyer", "invoice", "letter",
-            "manual", "menu", "minutes", "newsletter", "one_pager", "poster", "presentation",
-            "press_release", "proposal", "recipe", "report", "resume", "timeline", "whitepaper"
-        }
-        if doc_type not in allowed_types:
-            doc_type = "document"
-        action = str(data.get("action") or "new").lower()
-        if action not in {"new", "edit", "question"}:
-            action = "new"
-        result = {
-          "documentType": doc_type,
-          "action": action,
-          "allowFabrication": bool(data.get("allowFabrication")),
-          "wantsPdf": bool(data.get("wantsPdf", True)),
-          "hasEnoughInfo": bool(data.get("hasEnoughInfo", True)),
-          "missingFields": data.get("missingFields") or [],
-          "notes": data.get("notes") or "",
-        }
-        logger.info(
-            "[INTENT] llm_classify doc_type=%s action=%s allowFabrication=%s wantsPdf=%s hasEnoughInfo=%s missing=%s notes=%s",
-            result["documentType"],
-            result["action"],
-            result["allowFabrication"],
-            result["wantsPdf"],
-            result["hasEnoughInfo"],
-            result["missingFields"],
-            (result["notes"] or "")[:120],
-        )
-        return result
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[INTENT] LLM classify failed: %s", exc, exc_info=True)
-        return None
-
-
-def detect_fabrication_opt_in(prompt: str, history: List[Dict[str, str]]) -> bool:
-    """
-    Ask a small model to decide if the user has permitted invention of missing details.
-
-    Returns True when the user says to make things up / whatever is fine /
-    no preference, even if they haven't provided concrete fields.
-    """
-    if CLIENT_MODE != "langchain":
-        return False
-
-    system = (
-        "Decide if the user has explicitly permitted you to invent or make up missing details. "
-        "Reply with strict JSON: {\"allowFabrication\": true|false}. "
-        "Consider any user instruction like 'make it up', 'whatever you want', 'use dummy info', "
-        "'fabricate the rest', 'fill in anything' as permission. "
-        "Do not require specific keywords; infer intent from the conversation. "
-        "If unclear, set allowFabrication to false."
-    )
-
-    conversation = [{"role": "system", "content": system}]
-    trimmed_history = history[-8:] if len(history) > 8 else history
-    for msg in trimmed_history:
-        if msg.get("content") and msg.get("role") in {"user", "assistant", "system"}:
-            conversation.append({"role": msg["role"], "content": msg["content"]})
-    conversation.append({"role": "user", "content": prompt})
-
-    try:
-        llm = get_chat_model(
-            FAST_MODEL or SMART_MODEL,
-            max_tokens=100,
-            model_kwargs={"response_format": {"type": "json_object"}},
-        )
-        if not llm:
-            return False
-        start = time.perf_counter()
-        response = llm.invoke(to_lc_messages(conversation))
-        elapsed = time.perf_counter() - start
-        content = response.content or ""
-        usage = getattr(response, "usage_metadata", None)
-        logger.info(
-            "[INTENT] fabrication-check model=%s elapsed=%.2fs chars=%s usage=%s",
-            FAST_MODEL or SMART_MODEL,
-            elapsed,
-            len(str(content)),
-            usage,
-        )
-        content = response.content
-        if not content:
-            return False
-        data = json.loads(content)
-        return bool(data.get("allowFabrication"))
-    except Exception as exc:  # noqa: BLE001
-        logger.error("[INTENT] fabrication opt-in check failed: %s", exc)
-        return False
-
-
-def _preprocess_intent(
-    prompt: str,
-    history: List[Dict[str, str]],
-    has_pdf: bool,
-    current_latex: Optional[str],
-) -> Dict[str, Any]:
-    """
-    Lightweight intent classifier used by /api/intent/check.
-
-    It is intentionally heuristic-only to avoid extra model calls. The goal is to
-    decide whether we should proceed with PDF generation and whether it's OK to
-    fabricate placeholder content when the user explicitly asks for it.
-    """
-    user_texts = [entry.get("content", "") for entry in history if entry.get("role") == "user"]
-    user_texts.append(prompt or "")
-    combined_text = " ".join([t for t in user_texts if t]).strip().lower()
-
-    llm = classify_intent_with_llm(prompt, history, current_latex, has_pdf)
-    if llm:
-        return {
-            "wants_pdf": llm.get("wantsPdf", True),
-            "has_enough_info": llm.get("hasEnoughInfo", True),
-            "allow_makeup": llm.get("allowFabrication", False),
-            "document_type": llm.get("documentType"),
-            "missing_fields": llm.get("missingFields", []),
-        }
-
-    # Fallback heuristics (only if no LLM)
-    avoid_pdf = bool(re.search(r"\b(no pdf|text only|markdown only|dont (make|generate) pdf)\b", combined_text))
-    wants_pdf = not avoid_pdf or bool(current_latex) or has_pdf
-    has_meaningful_text = len(combined_text) > 20
-    return {
-        "wants_pdf": wants_pdf,
-        "has_enough_info": bool(current_latex or has_pdf or has_meaningful_text),
-        "allow_makeup": False,
-        "document_type": None,
-        "missing_fields": [],
-    }
-
-def _extract_structured_fields(text: str, schema: Dict[str, Any]) -> Dict[str, str]:
-    """Naively parse user text to pull schema fields."""
-    found: Dict[str, str] = {}
-    lower = text.lower()
-
-    if schema.get("field_order") == BRIEF_SCHEMAS["resume"]["field_order"]:
-        work_matches = re.findall(
-            r"(?:experience|work history|role|company|position)\s*[:\-]\s*(.+?)(?=\n\n|\Z)",
-            text,
-            flags=re.IGNORECASE | re.DOTALL,
-        )
-        if work_matches:
-            found["work_history"] = "\n".join(work_matches[:3])
-        education_matches = re.findall(
-            r"(?:education|degree)\s*[:\-]\s*(.+?)(?=\n\n|\Z)",
-            text,
-            flags=re.IGNORECASE | re.DOTALL,
-        )
-        if education_matches:
-            found["education"] = "\n".join(education_matches[:2])
-        skills_match = re.search(r"(?:skills|stack)\s*[:\-]\s*(.+)", text, flags=re.IGNORECASE)
-        if skills_match:
-            found["skills"] = skills_match.group(1).strip()
-
-    for field, labels in schema.get("labels", {}).items():
-        for label in labels:
-            pattern = rf"{label}\s*[:\-]\s*(.+?)(?=\n[A-Z][a-zA-Z ]+[:\-]|\Z)"
-            match = re.search(pattern, text, flags=re.IGNORECASE | re.DOTALL)
-            if match:
-                found[field] = match.group(1).strip()
-                break
-    if not found.get("summary") and len(lower) < 200:
-        found["summary"] = text.strip()
-    return {k: v for k, v in found.items() if v}
-
-
-def _format_missing_message(
-    doc_type: str,
-    schema: Dict[str, Any],
-    collected: Dict[str, str],
-    missing: List[str],
-    preface: Optional[str] = None,
-) -> str:
-    """Fallback text asking the user for missing fields."""
-    intro = schema.get("intro") or f"Need a few details to finish your {doc_type}."
-    lines = [intro]
-    if preface:
-        lines.append(preface)
-    if collected:
-        lines.append("Already have:")
-        for field, value in collected.items():
-            label = schema.get("labels", {}).get(field, [field])[0]
-            lines.append(f"- {label}: {value}")
-    if missing:
-        lines.append("Still need:")
-        questions = schema.get("questions", {})
-        for field in missing[:4]:
-            ask = questions.get(field) or f"{field}?"
-            lines.append(f"- {ask}")
-    lines.append("Partial info is fine—share whatever you remember.")
-    return "\n".join(lines)
-
-
-def _ai_missing_message(
-    doc_type: str,
-    schema: Dict[str, Any],
-    collected: Dict[str, str],
-    missing: List[str],
-) -> Optional[str]:
-    """Let the model craft clarifying questions when available."""
-    if CLIENT_MODE != "langchain" or not missing:
-        return None
-
-    collected_lines = [f"- {schema.get('labels', {}).get(field, [field])[0]}: {value}" for field, value in collected.items()]
-    missing_labels = [schema.get("labels", {}).get(field, [field])[0] for field in missing]
-    user_text = "We already have:\n" + "\n".join(collected_lines) if collected_lines else "We have nothing yet."
-    user_text += "\nNeed to ask for: " + ", ".join(missing_labels)
-    if not collected_lines:
-        user_text += "\nInvite them to paste an old resume or dump all details if they have them."
-
-    system_prompt = brief_missing_info_system_prompt(doc_type)
-    try:
-        llm = get_chat_model(SMART_MODEL, max_tokens=400)
-        if not llm:
-            return None
-        start = time.perf_counter()
-        response = llm.invoke(
-            to_lc_messages(
-                [
-                    {"role": "system", "content": system_prompt},
-                    {"role": "user", "content": user_text},
-                ]
-            )
-        )
-        elapsed = time.perf_counter() - start
-        content = response.content or ""
-        usage = getattr(response, "usage_metadata", None)
-        logger.info(
-            "[AI] missing-questions model=%s elapsed=%.2fs chars=%s usage=%s",
-            SMART_MODEL,
-            elapsed,
-            len(str(content)),
-            usage,
-        )
-        return response.content
-    except Exception as exc:
-        logger.error("[AI] missing-questions failed: %s", exc)
-        return None
-
-
-def gather_brief(doc_type: str, prompt: str, history: List[Dict[str, str]], current_latex: Optional[str] = None, has_pdf: bool = False) -> Dict[str, Any]:
-    """
-    Determine whether we have enough structured details to generate without fabricating.
-    Returns needsInfo + a formatted message when details are missing, or a structured brief.
-    """
-    classifier = classify_intent_with_llm(prompt, history, current_latex, has_pdf)
-    if classifier:
-        doc_type = classifier.get("documentType", doc_type)
-        logger.info(
-            "[BRIEF] using llm doc_type=%s allowFabrication=%s missing=%s hasEnoughInfo=%s wantsPdf=%s",
-            doc_type,
-            classifier.get("allowFabrication"),
-            classifier.get("missingFields"),
-            classifier.get("hasEnoughInfo"),
-            classifier.get("wantsPdf"),
-        )
-    else:
-        logger.info("[BRIEF] llm classifier unavailable, using fallback schema doc_type=%s", doc_type)
-
-    schema = BRIEF_SCHEMAS.get(doc_type)
-    if not schema:
-        return {"needsInfo": False, "structured_brief": None, "collected": {}, "missing": []}
-
-    user_texts = [entry.get("content", "") for entry in history if entry.get("role") == "user"]
-    user_texts.append(prompt or "")
-    combined_text = "\n".join(user_texts)
-    collected = _extract_structured_fields(combined_text, schema)
-    missing = [field for field in schema.get("field_order", []) if field not in collected]
-    classifier_has_enough = bool(classifier.get("hasEnoughInfo")) if classifier else True
-    allow_makeup = bool(classifier.get("allowFabrication")) if classifier else False
-    if not allow_makeup:
-        allow_makeup = detect_fabrication_opt_in(prompt, history)
-    if classifier and classifier.get("missingFields"):
-        # If the model provided missing fields, respect that list.
-        missing = classifier.get("missingFields") or missing
-
-    # If the user gave no usable content, do not allow fabrication shortcuts.
-    # Force the flow to ask for the required fields instead of silently proceeding.
-    missing_all_fields = len(missing) == len(schema.get("field_order", []))
-    low_signal_request = not collected and len(combined_text.strip()) < 12
-    if missing_all_fields and low_signal_request:
-        allow_makeup = False
-
-    def has_minimum_resume(data: Dict[str, str]) -> bool:
-        has_name = bool(data.get("name"))
-        has_core = any(data.get(key) for key in ["work_history", "education", "skills", "contact", "target_role"])
-        return has_name and has_core
-
-    def has_minimum_invoice(data: Dict[str, str]) -> bool:
-        has_parties = data.get("your_business") and data.get("client")
-        has_items = bool(data.get("line_items"))
-        return bool(has_parties and has_items)
-
-    has_minimum = True
-    if doc_type == "resume":
-        has_minimum = has_minimum_resume(collected)
-    elif doc_type == "invoice":
-        has_minimum = has_minimum_invoice(collected)
-
-    # Decide if we must pause to ask for details. Avoid regex "ready" guesses;
-    # rely on the classifier's allowFabrication flag and collected data.
-    must_ask_first = bool(missing) and ((not allow_makeup and not has_minimum) or not classifier_has_enough)
-    if must_ask_first:
-        preface = None
-        if doc_type == "resume" and not has_minimum:
-            preface = (
-                "I only have a tiny bit so far. I need at least your name plus one of: contact, "
-                "a role snippet, education, skills, or target role."
-            )
-        if doc_type == "invoice" and not has_minimum:
-            preface = "Need who is billing, who is paying, and the line items so I don't invent details."
-        logger.info(
-            "[BRIEF] gating doc_type=%s missing=%s has_minimum=%s allowFabrication=%s",
-            doc_type,
-            missing,
-            has_minimum,
-            allow_makeup,
-        )
-        message = _ai_missing_message(doc_type, schema, collected, missing) or _format_missing_message(
-            doc_type, schema, collected, missing, preface=preface
-        )
-        message += "\nIf you'd like me to invent anything you didn't share, just say so."
-        return {
-            "needsInfo": True,
-            "message": message,
-            "collected": collected,
-            "missing": missing,
-            "allowFabrication": allow_makeup,
-        }
-
-    # If fabrication is allowed but fields are missing, let downstream generation
-    # know which areas to fill in plausibly.
-    fabrication_hint = ""
-    if allow_makeup and missing:
-        fabrication_hint = "\n\nIf details are absent, invent plausible, clearly fictional details for: " + ", ".join(missing) + "."
-
-    structured_lines = []
-    for field in schema.get("field_order", []):
-        value = collected.get(field)
-        if value:
-            label = schema.get("labels", {}).get(field, [field])[0]
-            structured_lines.append(f"{label}: {value}")
-    structured_brief = "\n".join(structured_lines)
-    if fabrication_hint:
-        structured_brief = (structured_brief + fabrication_hint).strip()
-    if combined_text.strip():
-        structured_brief = (structured_brief + "\n\nRaw user notes:\n" + combined_text).strip()
-
-    return {
-        "needsInfo": False,
-        "structured_brief": structured_brief or None,
-        "collected": collected,
-        "missing": missing,
-        "allowFabrication": allow_makeup,
-    }
-
-
-__all__ = ["gather_brief", "BRIEF_SCHEMAS", "_preprocess_intent"]
@@ -1,94 +0,0 @@
-import logging
-import os
-from typing import Optional
-
-
-logging.basicConfig(level=logging.INFO)
-logger = logging.getLogger(__name__)
-
-BASE_DIR = os.path.dirname(os.path.abspath(__file__))
-OUTPUT_DIR = os.path.join(BASE_DIR, "output")
-ASSETS_DIR = os.path.join(OUTPUT_DIR, "assets")
-DATA_DIR = os.path.join(BASE_DIR, "data")
-TEMPLATE_DIR = os.path.join(BASE_DIR, "templates")
-STYLE_DB_PATH = os.path.join(DATA_DIR, "user_styles.json")
-TEMPLATE_DB_PATH = os.path.join(DATA_DIR, "user_templates.json")
-VERSIONS_DB_PATH = os.path.join(DATA_DIR, "versions.json")
-
-os.makedirs(OUTPUT_DIR, exist_ok=True)
-os.makedirs(ASSETS_DIR, exist_ok=True)
-os.makedirs(DATA_DIR, exist_ok=True)
-os.makedirs(TEMPLATE_DIR, exist_ok=True)
-
-OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")
-OPENAI_BASE_URL = os.environ.get("OPENAI_BASE_URL")
-JAVA_BACKEND_URL = os.environ.get("JAVA_BACKEND_URL", "http://localhost:8080")
-
-if not OPENAI_API_KEY:
-    raise RuntimeError("OPENAI_API_KEY is required to start the AI backend.")
-# Default to GPT-5.1 for full document generation (smart model).
-# Allow override via SMART_MODEL or legacy OPENAI_MODEL.
-SMART_MODEL = os.environ.get("SMART_MODEL") or os.environ.get("OPENAI_MODEL") or "gpt-5.1"
-# Default to the nano/ultra-fast tier for intent/pre checks (fast model).
-# Allow override via FAST_MODEL or legacy FAST_INTENT_MODEL.
-FAST_MODEL = os.environ.get("FAST_MODEL") or os.environ.get("FAST_INTENT_MODEL") or "gpt-4.1-nano"
-
-CLIENT_MODE: Optional[str] = None
-LANGCHAIN_AVAILABLE = False
-_ChatOpenAI = None
-STREAMING_ENABLED = os.environ.get("AI_STREAMING", "true").lower() not in {"0", "false", "no"}
-if OPENAI_BASE_URL and "ollama" in OPENAI_BASE_URL and "AI_STREAMING" not in os.environ:
-    STREAMING_ENABLED = False
-PREVIEW_MAX_INFLIGHT = int(os.environ.get("AI_PREVIEW_MAX_INFLIGHT", "3"))
-
-if OPENAI_API_KEY:
-    try:
-        from langchain_openai import ChatOpenAI  # type: ignore
-
-        _ChatOpenAI = ChatOpenAI
-        LANGCHAIN_AVAILABLE = True
-        CLIENT_MODE = "langchain"
-    except Exception as client_exc:  # pragma: no cover - import guard
-        logger.warning("LangChain OpenAI init failed: %s", client_exc)
-
-if CLIENT_MODE == "langchain":
-    logger.info("AI mode: LIVE (fast_model=%s smart_model=%s)", FAST_MODEL, SMART_MODEL)
-else:
-    logger.info("AI mode: MOCK (no OpenAI key or LangChain init failure)")
-
-
-def get_chat_model(
-    model_name: str,
-    streaming: bool = False,
-    max_tokens: Optional[int] = None,
-    model_kwargs: Optional[dict] = None,
-):
-    if not LANGCHAIN_AVAILABLE or not _ChatOpenAI:
-        return None
-    kwargs = {"model": model_name, "api_key": OPENAI_API_KEY, "streaming": streaming}
-    if max_tokens is not None:
-        kwargs["max_tokens"] = max_tokens
-    if model_kwargs:
-        kwargs["model_kwargs"] = model_kwargs
-    return _ChatOpenAI(**kwargs)
-
-__all__ = [
-    "logger",
-    "OUTPUT_DIR",
-    "ASSETS_DIR",
-    "DATA_DIR",
-    "TEMPLATE_DIR",
-    "STYLE_DB_PATH",
-    "TEMPLATE_DB_PATH",
-    "VERSIONS_DB_PATH",
-    "OPENAI_API_KEY",
-    "OPENAI_BASE_URL",
-    "JAVA_BACKEND_URL",
-    "SMART_MODEL",
-    "CLIENT_MODE",
-    "LANGCHAIN_AVAILABLE",
-    "get_chat_model",
-    "FAST_MODEL",
-    "STREAMING_ENABLED",
-    "PREVIEW_MAX_INFLIGHT",
-]
@@ -1,57 +0,0 @@
-from __future__ import annotations
-
-from typing import List, Tuple
-
-
-KEYWORDS: List[Tuple[str, str]] = [
-    ("business card", "business_card"),
-    ("business-card", "business_card"),
-    ("card", "business_card"),
-    ("recipe", "recipe"),
-    ("cookbook", "recipe"),
-    ("menu", "menu"),
-    ("flyer", "flyer"),
-    ("brochure", "brochure"),
-    ("poster", "poster"),
-    ("slide", "presentation"),
-    ("deck", "presentation"),
-    ("presentation", "presentation"),
-    ("pitch", "presentation"),
-    ("whitepaper", "whitepaper"),
-    ("datasheet", "datasheet"),
-    ("case study", "case_study"),
-    ("press release", "press_release"),
-    ("agenda", "agenda"),
-    ("minutes", "minutes"),
-    ("checklist", "checklist"),
-    ("newsletter", "newsletter"),
-    ("proposal", "proposal"),
-    ("one-pager", "one_pager"),
-    ("one pager", "one_pager"),
-    ("invoice", "invoice"),
-    ("resume", "resume"),
-    ("cv", "resume"),
-    ("contract", "contract"),
-    ("agreement", "contract"),
-    ("letter", "letter"),
-    ("report", "report"),
-    ("paper", "academic"),
-    ("research", "academic"),
-    ("thesis", "academic"),
-    ("poem", "creative"),
-    ("manual", "manual"),
-    ("timeline", "timeline"),
-]
-
-
-def detect_document_type(prompt: str, latex_code: str | None = None) -> str:
-    """Heuristic classifier for document types based on prompt/latex text."""
-    text = (prompt or "").lower()
-    latex_text = (latex_code or "").lower()
-    for keyword, label in KEYWORDS:
-        if keyword in text or keyword in latex_text:
-            return label
-    return "document"
-
-
-__all__ = ["detect_document_type"]
@@ -1,22 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, Dict, List
-
-from langchain_core.messages import AIMessage, HumanMessage, SystemMessage
-
-
-def to_lc_messages(messages: List[Dict[str, Any]]):
-    lc_messages = []
-    for msg in messages:
-        role = msg.get("role")
-        content = msg.get("content")
-        if role == "system":
-            lc_messages.append(SystemMessage(content=content))
-        elif role == "assistant":
-            lc_messages.append(AIMessage(content=content))
-        else:
-            lc_messages.append(HumanMessage(content=content))
-    return lc_messages
-
-
-__all__ = ["to_lc_messages"]
@@ -1,547 +0,0 @@
-from __future__ import annotations
-
-import re
-from functools import lru_cache
-from typing import List, Optional
-
-ALLOWED_LATEX_PACKAGES = {
-    "courier",
-    "graphicx",
-    "geometry",
-    "helvet",
-    "lmodern",
-    "mathpazo",
-    "xcolor",
-    "tabularx",
-    "paracol",
-    "multicol",
-    "longtable",
-    "setspace",
-    "enumitem",
-    "titlesec",
-    "array",
-    "inputenc",
-    "fontenc",
-    "tikz",
-}
-
-
-def _strip_body_content(body: str) -> str:
-    """
-    Remove user data while keeping layout/structure commands.
-    Keeps \begin/\end blocks, command scaffolding, and drops plain text.
-    """
-    lines: List[str] = []
-    for line in body.splitlines():
-        stripped = line.strip()
-        if not stripped:
-            lines.append("")
-            continue
-        if stripped.startswith("%"):
-            continue
-        if "\\begin" in stripped or "\\end" in stripped:
-            lines.append(line)
-            continue
-        if stripped.startswith("\\"):
-            line_no_comments = line.split("%", 1)[0]
-            line_sections = re.sub(
-                r"(\\(?:section|subsection|subsubsection|paragraph|subparagraph|chapter|part)\*?)\{[^}]*\}",
-                r"\\1{}",
-                line_no_comments,
-            )
-            line_items = re.sub(r"^\\item.*", r"\\item {}", line_sections)
-            line_text_cmds = re.sub(
-                r"\\text(?:bf|it|tt|sc|sf|normal|emph)\{[^}]*\}",
-                lambda match: match.group(0).split("{")[0] + "{}",
-                line_items,
-            )
-            cleaned = re.sub(r"(?<!\\)[A-Za-z][A-Za-z0-9 ,.;:'\"!?-]*", "", line_text_cmds).strip()
-            if cleaned:
-                lines.append(cleaned)
-            continue
-        cleaned = re.sub(r"[A-Za-z0-9]+", "", line).strip()
-        if cleaned:
-            lines.append(cleaned)
-    return "\n".join(lines)
-
-
-def extract_layout_hint(latex_code: str, max_chars: Optional[int] = None) -> str:
-    """Keep layout-defining LaTeX while stripping user text."""
-    if not latex_code:
-        return ""
-
-    preamble, body = "", latex_code
-    split_doc = latex_code.split(r"\begin{document}", 1)
-    if len(split_doc) == 2:
-        preamble, body = split_doc
-    sanitized_body = _strip_body_content(body)
-
-    hint = f"{preamble}\n% --- layout only (data stripped) ---\n{sanitized_body}"
-    return hint if max_chars is None else hint[:max_chars]
-
-
-@lru_cache(maxsize=64)
-def _word_to_int(word: str) -> Optional[int]:
-    """Convert simple English number words to int (0-100)."""
-    words = {
-        "zero": 0,
-        "one": 1,
-        "two": 2,
-        "three": 3,
-        "four": 4,
-        "five": 5,
-        "six": 6,
-        "seven": 7,
-        "eight": 8,
-        "nine": 9,
-        "ten": 10,
-        "twenty": 20,
-        "thirty": 30,
-        "forty": 40,
-        "fifty": 50,
-        "sixty": 60,
-        "seventy": 70,
-        "eighty": 80,
-        "ninety": 90,
-        "hundred": 100,
-    }
-    return words.get(word.strip().lower())
-
-
-def _sanitize_color_mix(match: re.Match[str]) -> str:
-    token = match.group(1)
-    if token.isdigit():
-        val = int(token)
-    else:
-        converted = _word_to_int(token)
-        if converted is None:
-            digits = "".join(ch for ch in token if ch.isdigit())
-            val = int(digits) if digits else 80
-        else:
-            val = converted
-    val = max(0, min(100, val))
-    return f"!{val}!"
-
-
-def sanitize_latex(latex_code: str) -> str:
-    """Normalize invalid xcolor syntax like '!eighty!' to '!80!'."""
-    if not latex_code:
-        return latex_code
-    return re.sub(r"!\s*([A-Za-z0-9]+)\s*!", _sanitize_color_mix, latex_code)
-
-
-def strip_missing_packages(latex_code: str) -> str:
-    """Remove packages unavailable in the runtime environment."""
-    if not latex_code:
-        return latex_code
-    code = latex_code
-    code = re.sub(r"^\\usepackage\{siunitx\}\s*$", "", code, flags=re.MULTILINE)
-    code = re.sub(r"\\sisetup\{[^}]*\}", "", code, flags=re.DOTALL)
-    code = re.sub(r"\\num\{([^}]*)\}", r"\\1", code)
-    code = re.sub(
-        r"^\\(setmainfont|setsansfont|setmonofont|newfontfamily)\b.*$",
-        "",
-        code,
-        flags=re.MULTILINE,
-    )
-
-    def _filter_packages(match: re.Match[str]) -> str:
-        options = match.group(1) or ""
-        packages = [pkg.strip() for pkg in match.group(2).split(",") if pkg.strip()]
-        allowed = [pkg for pkg in packages if pkg in ALLOWED_LATEX_PACKAGES]
-        if not allowed:
-            return ""
-        return f"\\usepackage{options}{{{', '.join(allowed)}}}"
-
-    return re.sub(
-        r"^\\usepackage(\[[^\]]*\])?\{([^}]*)\}\s*$",
-        _filter_packages,
-        code,
-        flags=re.MULTILINE,
-    )
-
-
-def remove_leading_pagebreaks(latex_code: str) -> str:
-    """Strip explicit page breaks at the start of the document body."""
-    if not latex_code:
-        return latex_code
-    parts = latex_code.split(r"\begin{document}", 1)
-    if len(parts) == 2:
-        preamble, body = parts
-        cleaned_body = re.sub(
-            r"^\s*(\\(newpage|clearpage|pagebreak|vfill)\b\s*)+",
-            "\n",
-            body,
-            flags=re.IGNORECASE | re.MULTILINE,
-        )
-        return f"{preamble}\\begin{{document}}{cleaned_body}"
-    return re.sub(
-        r"^\s*(\\(newpage|clearpage|pagebreak|vfill)\b\s*)+",
-        "\n",
-        latex_code,
-        flags=re.IGNORECASE | re.MULTILINE,
-    )
-
-
-def strip_leading_pagebreaks(latex_code: str) -> str:
-    """Drop accidental leading page breaks that cause empty first pages."""
-    if not latex_code:
-        return latex_code
-    parts = latex_code.split(r"\begin{document}", 1)
-    if len(parts) == 2:
-        preamble, body = parts
-        cleaned_body = re.sub(
-            r"^\s*(\\clearpage|\\newpage|\\pagebreak|\\vfill)+\s*",
-            "",
-            body,
-            flags=re.MULTILINE,
-        )
-        return f"{preamble}\\begin{{document}}{cleaned_body}"
-    return re.sub(
-        r"^\s*(\\clearpage|\\newpage|\\pagebreak|\\vfill)+\s*",
-        "",
-        latex_code,
-        flags=re.MULTILINE,
-    )
-
-
-def fix_tabular_row_endings(latex_code: str) -> str:
-    """Ensure tabular environments close rows before \\end{tabular}."""
-    pattern = re.compile(r"(&[^\n]*)\n\\end{tabular}", re.MULTILINE)
-    return pattern.sub(r"\\1 \\\\ \n\\end{tabular}", latex_code)
-
-def strip_placeholder_rules(latex_code: str) -> str:
-    """Remove placeholder boxes like \\rule/\\colorbox used as fake images."""
-    code = re.sub(r"\\rule\s*\{\s*[\d\.]+[a-zA-Z]*\s*\}\s*\{\s*[\d\.]+[a-zA-Z]*\s*\}", "", latex_code)
-    code = re.sub(r"\\fcolorbox\{[^}]*\}\{[^}]*\}\{[^}]*\}", "", code)
-    code = re.sub(r"\\colorbox\{[^}]*\}\{[^}]*\}", "", code)
-    # Strip simple tikz pictures that are just boxes/fills
-    code = re.sub(
-        r"\\begin\{tikzpicture\}[\s\S]*?\\end\{tikzpicture\}",
-        "",
-        code,
-        flags=re.MULTILINE,
-    )
-    return code
-
-
-def strip_number_grouping_junk(latex_code: str) -> str:
-    """Remove stray siunitx options text that may leak into the document body."""
-    if not latex_code:
-        return latex_code
-    # Drop standalone lines/paragraphs that look like siunitx option lists (common when chunks split)
-    return re.sub(
-        r"(?im)^\s*,\s*(group-minimum-digits|detect-all|table-number-alignment|round-mode|round-precision)\b.*$",
-        "",
-        latex_code,
-    )
-
-
-def rebalance_invoice_tables(latex_code: str) -> str:
-    """Use wrapped columns for common invoice tables to avoid overflow."""
-    if not latex_code:
-        return latex_code
-
-    # Legacy 4-col invoices (Item, Desc, Price, Total)
-    code = latex_code.replace(
-        r"\\begin{tabularx}{\\textwidth}{@{}l l r r@{}}",
-        r"\\begin{tabularx}{\\textwidth}{@{}>{\\raggedright\\arraybackslash}p{0.30\\textwidth}>{\\raggedright\\arraybackslash}X>{\\raggedleft\\arraybackslash}p{1.5cm}>{\\raggedleft\\arraybackslash}p{2.3cm}@{}}",
-    )
-
-    # Current 5-col invoices (Item, Description, Qty, Unit, Line Total)
-    wrapped_invoice_five = (
-        r"@{}"
-        r">{\\raggedright\\arraybackslash}p{0.16\\textwidth}"
-        r">{\\raggedright\\arraybackslash}p{0.50\\textwidth}"
-        r">{\\raggedleft\\arraybackslash}p{0.09\\textwidth}"
-        r">{\\raggedleft\\arraybackslash}p{0.12\\textwidth}"
-        r">{\\raggedleft\\arraybackslash}p{0.13\\textwidth}"
-        r"@{}"
-    )
-
-    five_col_patterns = [
-        (
-            # tabularx with first col l/c, X desc, then three p{} numeric cols (matches default invoice template)
-            r"(\\begin{tabularx}\{\s*\\textwidth\s*\}\{)\s*@?\{\}?\s*[cl]\s+X\s+p\{[^}]+\}\s+p\{[^}]+\}\s+p\{[^}]+\}\s*@?\{\}?\s*(\})",
-            r"\1" + wrapped_invoice_five + r"\2",
-        ),
-        (
-            # longtable version of the same layout (after upgrades)
-            r"(\\begin{longtable}\{)\s*@?\{\}?\s*[cl]\s+X\s+p\{[^}]+\}\s+p\{[^}]+\}\s+p\{[^}]+\}\s*@?\{\}?\s*(\})",
-            r"\1" + wrapped_invoice_five + r"\2",
-        ),
-    ]
-
-    for pattern, replacement in five_col_patterns:
-        code = re.sub(pattern, replacement, code, flags=re.IGNORECASE)
-
-    return code
-
-
-def normalize_tabular_like_begins(latex_code: str) -> str:
-    """
-    Fix common malformed tabular/tabularx/longtable begins where the colspec
-    is not passed as a braced argument (e.g. `\\begin{tabularx}\\textwidth{...}`
-    or `\\begin{tabularx}{\\textwidth}\\ItemsColSpec`).
-    """
-    if not latex_code:
-        return latex_code
-
-    code = latex_code
-
-    # \begin{tabularx}\textwidth{...} -> \begin{tabularx}{\textwidth}{...}
-    code = re.sub(
-        r"\\begin{tabularx}\s*\\textwidth\s*\{([^}]*)\}",
-        lambda m: f"\\begin{{tabularx}}{{\\textwidth}}{{{m.group(1).strip()}}}",
-        code,
-    )
-
-    # \begin{tabularx}{\textwidth}\ItemsColSpec -> wrap colspec in braces
-    code = re.sub(
-        r"\\begin{tabularx}\s*\{\s*\\textwidth\s*\}\s*\\([A-Za-z@][\w@]*)",
-        lambda m: f"\\begin{{tabularx}}{{\\textwidth}}{{\\{m.group(1)}}}",
-        code,
-    )
-
-    # \begin{tabularx}{\textwidth}\colspecliteral -> wrap literal spec
-    code = re.sub(
-        r"\\begin{tabularx}\s*\{\s*\\textwidth\s*\}\s*([@A-Za-z].*)",
-        lambda m: f"\\begin{{tabularx}}{{\\textwidth}}{{{m.group(1).strip()}}}",
-        code,
-    )
-
-    # \begin{tabular}\colspecliteral  OR  \begin{longtable}\colspecliteral
-    def _wrap_simple(env: str, text: str) -> str:
-        return re.sub(
-            rf"\\begin{{{env}}}\s*([@A-Za-z].*)",
-            lambda m: f"\\begin{{{env}}}{{{m.group(1).strip()}}}",
-            text,
-        )
-
-    code = _wrap_simple("tabular", code)
-    code = _wrap_simple("longtable", code)
-    return code
-
-
-def ensure_longtable_support(latex_code: str) -> str:
-    """
-    Guarantee longtable availability and default centering.
-
-    - Injects \\usepackage{longtable} if missing.
-    - Sets \\LTleft/\\LTright to 0pt so longtable spans the text width without manual centering.
-    """
-    if not latex_code:
-        return latex_code
-
-    code = latex_code
-    if r"\usepackage{longtable}" not in code:
-        code = re.sub(
-            r"(\\documentclass[^\n]*\n)",
-            r"\1\\usepackage{longtable}\n",
-            code,
-            count=1,
-        )
-    if r"\setlength\LTleft" not in code:
-        # Use a lambda so backslashes are treated literally (avoid \L escape errors).
-        code = re.sub(
-            r"(\\usepackage\{longtable\}[^\n]*\n)",
-            lambda m: f"{m.group(1)}\\setlength\\LTleft{{0pt}}\n\\setlength\\LTright{{0pt}}\n",
-            code,
-            count=1,
-        )
-    return code
-
-
-def _normalize_alignment_to_wrapped_columns(spec: str) -> str:
-    """
-    Convert simple l/c/r specs to wrapped p-columns that respect text width.
-    Keeps existing p/m/b/X columns unchanged.
-    """
-    if re.search(r"[pmb]\{|\bX\b", spec):
-        return spec
-
-    cols = [ch for ch in spec if ch in ("l", "c", "r")]
-    if not cols:
-        return spec
-
-    width = max(0.05, min(0.98, 0.98 / len(cols)))
-    parts: List[str] = []
-    for ch in cols:
-        if ch == "r":
-            parts.append(r">{\raggedleft\arraybackslash}p{" + f"{width:.3f}\\textwidth" + "}")
-        else:
-            parts.append(r">{\raggedright\arraybackslash}p{" + f"{width:.3f}\\textwidth" + "}")
-    return "@{}" + "".join(parts) + "@{}"
-
-
-def upgrade_tabular_tables_to_longtable(latex_code: str) -> str:
-    """
-    Replace table+tabular blocks with longtable so large tables break across pages,
-    stay centered, and repeat headers on each page.
-    """
-    if not latex_code:
-        return latex_code
-
-    pattern = re.compile(
-        r"\\begin{table}.*?\\begin{tabular}\{([^}]*)\}(.*?)\\end{tabular}.*?\\end{table}",
-        re.DOTALL,
-    )
-
-    def _build_longtable(match: re.Match[str]) -> str:
-        align_spec = match.group(1)
-        body = match.group(2).strip()
-        normalized_spec = _normalize_alignment_to_wrapped_columns(align_spec)
-
-        header_block = ""
-        body_block = body
-
-        hline_split = re.split(r"\\hline", body, maxsplit=1)
-        if len(hline_split) == 2:
-            header_block = hline_split[0].strip() + r"\\\hline"
-            body_block = hline_split[1].lstrip()
-        else:
-            first_row_split = re.split(r"\\\\", body, maxsplit=1)
-            header_block = (first_row_split[0].strip() + r"\\") if first_row_split else ""
-            body_block = first_row_split[1].lstrip() if len(first_row_split) == 2 else body
-
-        header_block = header_block.strip()
-        body_block = body_block.strip()
-
-        return (
-            "\n\\setlength\\LTleft{0pt}\n"
-            "\\setlength\\LTright{0pt}\n"
-            f"\\begin{{longtable}}{{{normalized_spec}}}\n"
-            f"{header_block}\n"
-            "\\endfirsthead\n"
-            f"{header_block}\n"
-            "\\endhead\n"
-            f"{body_block}\n"
-            "\\end{longtable}\n"
-        )
-
-    return pattern.sub(_build_longtable, latex_code)
-
-
-def clean_generated_latex(latex_code: str) -> str:
-    """Apply all sanitizers used both for compilation and template storage."""
-    return rebalance_invoice_tables(
-        upgrade_tabular_tables_to_longtable(
-            ensure_longtable_support(
-                normalize_tabular_like_begins(
-                    strip_number_grouping_junk(
-                        fix_tabular_row_endings(
-                            strip_leading_pagebreaks(
-                                remove_leading_pagebreaks(
-                                    strip_missing_packages(
-                                        sanitize_latex(
-                                            ensure_full_latex_document(latex_code)
-                                        )
-                                    )
-                                )
-                            )
-                        )
-                    )
-                )
-            )
-        )
-    )
-
-
-def apply_style_overrides(latex_code: str, style_profile: dict) -> str:
-    """Apply deterministic font + accent styling without altering layout."""
-    if not latex_code:
-        return latex_code
-
-    code = latex_code
-    font = (style_profile or {}).get("font_preference") or ""
-    accent = (style_profile or {}).get("color_accent") or ""
-
-    font_map = {
-        "serif": ("mathpazo", "\\renewcommand{\\familydefault}{\\rmdefault}"),
-        "sans": ("helvet", "\\renewcommand{\\familydefault}{\\sfdefault}"),
-        "helvet": ("helvet", "\\renewcommand{\\familydefault}{\\sfdefault}"),
-        "mono": ("courier", "\\renewcommand{\\familydefault}{\\ttdefault}"),
-        "modern": ("lmodern", None),
-    }
-    pkg = None
-    family_cmd = None
-    if isinstance(font, str):
-        pkg, family_cmd = font_map.get(font.lower(), (None, None))
-
-    if pkg:
-        code = re.sub(
-            r"^\\usepackage\{(helvet|mathpazo|lmodern|courier)\}\s*$",
-            "",
-            code,
-            flags=re.MULTILINE,
-        )
-        code = re.sub(
-            r"^\\renewcommand\{\\familydefault\}\{\\(sfdefault|rmdefault|ttdefault)\}\s*$",
-            "",
-            code,
-            flags=re.MULTILINE,
-        )
-
-    def _ensure_package_and_command(text: str) -> str:
-        if not pkg:
-            return text
-        insert = f"\\usepackage{{{pkg}}}\n"
-        if family_cmd:
-            insert += family_cmd + "\n"
-        if r"\begin{document}" in text:
-            return re.sub(r"(\\begin\{document\})", insert + r"\1", text, count=1)
-        return insert + text
-
-    code = _ensure_package_and_command(code)
-
-    if accent:
-        accent_hex_match = re.fullmatch(r"#?([0-9a-fA-F]{6})", str(accent).strip())
-        if accent_hex_match:
-            accent_line = f"\\definecolor{{accent}}{{HTML}}{{{accent_hex_match.group(1).upper()}}}"
-        else:
-            accent_name = re.sub(r"[^A-Za-z]+", "", str(accent)) or "blue"
-            accent_line = f"\\colorlet{{accent}}{{{accent_name}}}"
-
-        if re.search(r"^\\definecolor\{accent\}|^\\colorlet\{accent\}", code, flags=re.MULTILINE):
-            code = re.sub(r"^\\definecolor\{accent\}.*$", accent_line, code, flags=re.MULTILINE)
-            code = re.sub(r"^\\colorlet\{accent\}.*$", accent_line, code, flags=re.MULTILINE)
-        else:
-            needs_xcolor = r"\usepackage{xcolor}" not in code
-            insert = ""
-            if needs_xcolor:
-                insert += "\\usepackage{xcolor}\n"
-            insert += accent_line + "\n"
-            if r"\usepackage{xcolor}" in code:
-                code = re.sub(r"(\\usepackage\{xcolor\}[^\n]*\n)", r"\1" + insert, code, count=1)
-            elif r"\begin{document}" in code:
-                code = re.sub(r"(\\begin\{document\})", insert + r"\1", code, count=1)
-            else:
-                code = insert + code
-
-    return code
-
-
-def ensure_full_latex_document(text: str) -> str:
-    """Trim output to a single LaTeX document starting at \\documentclass and ending at \\end{document}."""
-    if not text:
-        return text
-    start = text.find(r"\documentclass")
-    end = text.rfind(r"\end{document}")
-    if start == -1 or end == -1:
-        return text
-    end += len(r"\end{document}")
-    return text[start:end]
-
-
-__all__ = [
-    "extract_layout_hint",
-    "sanitize_latex",
-    "strip_missing_packages",
-    "remove_leading_pagebreaks",
-    "strip_leading_pagebreaks",
-    "fix_tabular_row_endings",
-    "rebalance_invoice_tables",
-    "clean_generated_latex",
-    "apply_style_overrides",
-    "ensure_full_latex_document",
-]
@@ -1,491 +0,0 @@
-from __future__ import annotations
-
-import base64
-import os
-import re
-import subprocess
-import tempfile
-import xml.etree.ElementTree as ET
-from typing import Any, Dict, List, Optional
-
-from config import logger
-
-
-def _safe_float(value: Optional[str], fallback: float = 0.0) -> float:
-    """Convert an attribute value to float while handling bad input."""
-    try:
-        if value is None:
-            return fallback
-        return float(value)
-    except (TypeError, ValueError):
-        return fallback
-
-
-def _read_image_as_data_url(path: str) -> Optional[str]:
-    """Return a data URL for the image if it exists."""
-    if not os.path.exists(path):
-        return None
-    mime = "image/png"
-    _, ext = os.path.splitext(path)
-    if ext.lower() in {".jpg", ".jpeg"}:
-        mime = "image/jpeg"
-    elif ext.lower() == ".gif":
-        mime = "image/gif"
-    try:
-        with open(path, "rb") as img_handle:
-            encoded = base64.b64encode(img_handle.read()).decode("ascii")
-            return f"data:{mime};base64,{encoded}"
-    except OSError as exc:
-        logger.warning("[PDF-EDITOR] Failed to read image %s: %s", path, exc)
-        return None
-
-
-def _parse_fonts(root: ET.Element) -> List[Dict[str, Any]]:
-    fonts: List[Dict[str, Any]] = []
-    for spec in root.findall(".//fontspec"):
-        font_id = spec.attrib.get("id")
-        base_name = spec.attrib.get("family")
-        size = _safe_float(spec.attrib.get("size"), 12.0)
-        color = spec.attrib.get("color")
-        name_lower = (base_name or "").lower()
-        flags = 0
-        if "bold" in name_lower:
-            flags |= 0x100  # ForceBold
-        if "italic" in name_lower or "oblique" in name_lower:
-            flags |= 0x40  # Italic
-        fonts.append(
-            {
-                "id": font_id,
-                "uid": font_id,
-                "baseName": base_name,
-                "embedded": True,
-                "program": None,
-                "programFormat": None,
-                "webProgram": None,
-                "webProgramFormat": None,
-                "pdfProgram": None,
-                "pdfProgramFormat": None,
-                "ascent": size,
-                "descent": -size * 0.25,
-                "unitsPerEm": max(size, 1),
-                "standard14Name": None,
-                "color": color,
-                "fontDescriptorFlags": flags or None,
-            }
-        )
-    return fonts
-
-
-def _parse_color_components(color: Optional[str]) -> Optional[List[float]]:
-    """Convert a hex/rgb color string into normalized RGB components."""
-    if not color:
-        return None
-
-    color = color.strip()
-    hex_match = re.fullmatch(r"#?([0-9a-fA-F]{6})", color)
-    short_hex_match = re.fullmatch(r"#?([0-9a-fA-F]{3})", color)
-    rgb_match = re.fullmatch(r"rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)", color, re.IGNORECASE)
-
-    if hex_match:
-        hex_value = hex_match.group(1)
-        r = int(hex_value[0:2], 16)
-        g = int(hex_value[2:4], 16)
-        b = int(hex_value[4:6], 16)
-        return [r / 255.0, g / 255.0, b / 255.0]
-
-    if short_hex_match:
-        hex_value = short_hex_match.group(1)
-        r = int(hex_value[0] * 2, 16)
-        g = int(hex_value[1] * 2, 16)
-        b = int(hex_value[2] * 2, 16)
-        return [r / 255.0, g / 255.0, b / 255.0]
-
-    if rgb_match:
-        r = min(max(int(rgb_match.group(1)), 0), 255)
-        g = min(max(int(rgb_match.group(2)), 0), 255)
-        b = min(max(int(rgb_match.group(3)), 0), 255)
-        return [r / 255.0, g / 255.0, b / 255.0]
-
-    return None
-
-
-# --------------------
-# Table normalization
-# --------------------
-
-def _cluster(values: List[float], tol: float) -> List[List[float]]:
-    clusters: List[List[float]] = []
-    for v in sorted(values):
-        if not clusters or abs(v - clusters[-1][-1]) > tol:
-            clusters.append([v])
-        else:
-            clusters[-1].append(v)
-    return clusters
-
-def _dedupe_by_xy_text(elements: List[Dict[str, Any]], eps: float = 1.0) -> List[Dict[str, Any]]:
-    """
-    Dedupe using quantized x,y and normalized text (ignores width/height jitter).
-    Keeps the better scoring text; if equal text, keeps the first.
-    """
-    if not elements:
-        return elements
-
-    def _key(el: Dict[str, Any]) -> tuple[int, int, str]:
-        x = el.get("x") or 0.0
-        y = el.get("y") or 0.0
-        t = (el.get("text") or "").strip().replace("\u00a0", " ")
-        return (int(round(x / eps)), int(round(y / eps)), t)
-
-    def _score_text_global(t: str) -> tuple[int, int, int]:
-        stripped = t.strip()
-        has_currency = 1 if any(sym in stripped for sym in ("$", "€", "£", "¥")) else 0
-        non_space = sum(1 for ch in stripped if not ch.isspace())
-        digits = sum(1 for ch in stripped if ch.isdigit())
-        return (has_currency, non_space, digits)
-
-    deduped: Dict[tuple[int, int, str], Dict[str, Any]] = {}
-    for el in elements:
-        key = _key(el)
-        existing = deduped.get(key)
-        if existing is None:
-            deduped[key] = el
-            continue
-        t_new = key[2]
-        t_old = (existing.get("text") or "").strip().replace("\u00a0", " ")
-        score_new = _score_text_global(t_new)
-        score_old = _score_text_global(t_old)
-        if score_new > score_old:
-            deduped[key] = el
-    return list(deduped.values())
-
-
-def _detect_table_region(text_elements: List[Dict[str, Any]], page_width: float) -> Optional[Dict[str, Any]]:
-    """
-    Header-agnostic table detection via x clustering.
-    Returns dict with anchors, boundaries, observed_left/right, y_min/y_max.
-    """
-    candidates = [
-        el
-        for el in text_elements
-        if el.get("text") not in (None, "")
-        and isinstance(el.get("x"), (int, float))
-        and isinstance(el.get("y"), (int, float))
-        and isinstance(el.get("height"), (int, float))
-    ]
-    if len(candidates) < 8:
-        return None
-
-    heights = [c["height"] for c in candidates if c.get("height")]
-    if not heights:
-        return None
-    med_h = sorted(heights)[len(heights) // 2]
-    short_candidates = [c for c in candidates if c["height"] <= med_h * 1.8]
-    if len(short_candidates) < 8:
-        return None
-
-    x_centers = [c["x"] + (c.get("width") or 0) * 0.5 for c in short_candidates]
-    x_clusters = _cluster(x_centers, tol=12.0)
-    x_clusters = [c for c in x_clusters if len(c) >= 3]
-    if len(x_clusters) < 4:
-        return None
-
-    anchors = [sum(c) / len(c) for c in x_clusters]
-    anchors.sort()
-
-    y_vals = sorted(c["y"] for c in short_candidates)
-    y_clusters = _cluster(y_vals, tol=3.0)
-    if len(y_clusters) < 3:
-        return None
-    y_clusters.sort(key=lambda c: len(c), reverse=True)
-    y_min = min(y_clusters[0])
-    y_max = max(y_clusters[0])
-
-    min_anchor = min(anchors)
-    max_anchor = max(anchors)
-    PAD = 12.0
-
-    band_elems = []
-    for el in short_candidates:
-        cx = el["x"] + (el.get("width") or 0) * 0.5
-        if y_min - PAD <= el["y"] <= y_max + PAD and (min_anchor - PAD) <= cx <= (max_anchor + PAD):
-            band_elems.append(el)
-    if not band_elems:
-        return None
-    observed_left = min(n["x"] for n in band_elems)
-    observed_right = max(n["x"] + (n.get("width") or 0) for n in band_elems)
-
-    raw_bounds: List[float] = []
-    for i, ax in enumerate(anchors):
-        if i == 0:
-            gap = anchors[1] - anchors[0]
-            raw_bounds.append(ax - gap * 0.5)
-        else:
-            raw_bounds.append((anchors[i - 1] + ax) * 0.5)
-    gap_last = anchors[-1] - anchors[-2] if len(anchors) > 1 else 40.0
-    raw_bounds.append(anchors[-1] + gap_last * 0.5)
-
-    # translate boundaries to align left edge; no scaling to preserve spacing
-    delta = observed_left - raw_bounds[0]
-    boundaries = [b + delta for b in raw_bounds]
-
-    info = {
-        "anchors": anchors,
-        "boundaries": boundaries,
-        "observed_left": observed_left,
-        "observed_right": observed_right,
-        "y_min": y_min,
-        "y_max": y_max,
-    }
-    if os.getenv("PDF_EDITOR_TABLE_DEBUG"):
-        logger.debug(
-            "[PDF-EDITOR] table detected anchors=%s boundaries=%s y=(%.2f, %.2f) span=(%.2f, %.2f)",
-            anchors,
-            boundaries,
-            y_min,
-            y_max,
-            observed_left,
-            observed_right,
-        )
-    span = boundaries[-1] - boundaries[0]
-    if span <= 0 or page_width <= 0:
-        return None
-    target_left = max(0.0, (page_width - span) * 0.5)
-    offset = target_left - boundaries[0]
-    info.update({"offset": offset, "page_width": page_width})
-    return info
-
-
-def _snap_table_elements(text_elements: List[Dict[str, Any]], info: Dict[str, Any]) -> List[Dict[str, Any]]:
-    anchors = info["anchors"]
-    base_boundaries = info["boundaries"]
-    offset = info.get("offset", 0.0)
-    boundaries = [b + offset for b in base_boundaries]
-    y_min = info["y_min"]
-    y_max = info["y_max"]
-    left = info["observed_left"] + offset
-    right = info["observed_right"] + offset
-
-    def _assign_col(cx: float) -> int:
-        return min(range(len(anchors)), key=lambda i: abs(anchors[i] - cx))
-
-    EPS = 1.0
-    PAD = 6.0
-
-    for el in text_elements:
-        x = el.get("x")
-        w = el.get("width") or 0
-        y = el.get("y")
-        if not isinstance(x, (int, float)) or not isinstance(y, (int, float)):
-            continue
-        cx = x + w * 0.5 + offset
-        if not (left - PAD <= cx <= right + PAD and y_min - PAD <= y <= y_max + PAD):
-            continue
-
-        col = _assign_col(cx - offset)
-        col_left = boundaries[col]
-        col_right = boundaries[col + 1]
-
-        new_left = x + offset
-        new_right = x + w + offset
-        if new_left < col_left - EPS:
-            new_left = col_left
-        if new_right > col_right + EPS:
-            new_right = col_right
-        if new_right <= new_left:
-            mid = (col_left + col_right) * 0.5
-            new_left = mid - 0.5
-            new_right = mid + 0.5
-
-        el["x"] = new_left
-        el["width"] = max(1.0, new_right - new_left)
-        el["textMatrix"] = [1, 0, 0, 1, el["x"], el["y"]]
-
-    return text_elements
-
-
-def _parse_page(page_elem: ET.Element, base_dir: str, font_colors: Dict[str, Optional[str]]) -> Dict[str, Any]:
-    page_width = _safe_float(page_elem.attrib.get("width"), 612.0)
-    page_height = _safe_float(page_elem.attrib.get("height"), 792.0)
-    text_elements: List[Dict[str, Any]] = []
-    image_elements: List[Dict[str, Any]] = []
-
-    # Cluster near-identical text draws on the same baseline and keep the best candidate.
-    EPS = 1.0
-    best_by_pos: Dict[tuple[int, int], Dict[str, Any]] = {}
-
-    def _q(value: float) -> int:
-        try:
-            return int(round(value / EPS))
-        except Exception:
-            return 0
-
-    def _score_text(t: str) -> tuple[int, int, int]:
-        stripped = t.strip()
-        has_currency = 1 if any(sym in stripped for sym in ("$", "€", "£", "¥")) else 0
-        non_space = sum(1 for ch in stripped if not ch.isspace())
-        digits = sum(1 for ch in stripped if ch.isdigit())
-        return (has_currency, non_space, digits)
-
-    for index, text_elem in enumerate(page_elem.findall("text")):
-        raw_text = "".join(text_elem.itertext()).replace("\u00A0", " ")
-        text = raw_text.strip("\n")
-        left = _safe_float(text_elem.attrib.get("left"))
-        top = _safe_float(text_elem.attrib.get("top"))
-        width = _safe_float(text_elem.attrib.get("width"))
-        height = _safe_float(text_elem.attrib.get("height"))
-        font_id = text_elem.attrib.get("font")
-        font_color = font_colors.get(font_id) if font_id else None
-        fill_components = _parse_color_components(font_color)
-
-        candidate = {
-            "id": f"t-{index}",
-            "text": text,
-            "fontId": font_id,
-            "fontSize": height if height > 0 else None,
-            "x": left,
-            "y": page_height - top,
-            "width": width,
-            "height": height,
-            "textMatrix": [1, 0, 0, 1, left, page_height - top],
-            "fillColor": {"colorSpace": "RGB", "components": fill_components} if fill_components else None,
-        }
-
-        pos_key = (_q(left), _q(page_height - top))
-
-        existing = best_by_pos.get(pos_key)
-        if existing is None:
-            best_by_pos[pos_key] = candidate
-        else:
-            if _score_text(candidate["text"]) > _score_text(existing["text"]):
-                best_by_pos[pos_key] = candidate
-
-    # Optional merge of adjacent runs on the same baseline (e.g., "$" + "38.00")
-    merged: List[Dict[str, Any]] = []
-    base_elements = _dedupe_by_xy_text(sorted(best_by_pos.values(), key=lambda i: (i["y"], i["x"])), eps=1.0)
-    # Sort by baseline (y) then x to make merges stable and ordering deterministic
-    for item in sorted(base_elements, key=lambda i: (i["y"], i["x"])):
-        if not merged:
-            merged.append(item)
-            continue
-        prev = merged[-1]
-        same_line = _q(prev["y"]) == _q(item["y"])
-        if not same_line:
-            merged.append(item)
-            continue
-        prev_right = prev["x"] + (prev.get("width") or 0)
-        gap = item["x"] - prev_right
-        max_h = max(prev.get("height") or 0, item.get("height") or 0)
-        allowed_gap = max(2.0, 0.25 * max_h)
-        if gap <= allowed_gap and gap >= -allowed_gap:
-            # Merge
-            needs_space = (
-                prev["text"].strip() != ""
-                and item["text"].strip() != ""
-                and not prev["text"].endswith(" ")
-                and not item["text"].startswith(" ")
-                and not prev["text"].rstrip().endswith(("$", "€", "£", "¥"))
-            )
-            merged_text = prev["text"] + (" " if needs_space else "") + item["text"]
-            new_left = min(prev["x"], item["x"])
-            new_right = max(prev_right, item["x"] + (item.get("width") or 0))
-            prev.update(
-                {
-                    "text": merged_text,
-                    "x": new_left,
-                    "width": new_right - new_left,
-                    "height": max_h,
-                    # keep y and fontId from the left-most run
-                }
-            )
-        else:
-            merged.append(item)
-
-    # Phase A: dedupe by xy+text to remove duplicate draws
-    deduped = _dedupe_by_xy_text(merged, eps=1.0)
-
-    # Phase B: table detection + snapping (header-agnostic)
-    table_info = _detect_table_region(deduped, page_width)
-    if table_info:
-        snapped = _snap_table_elements(deduped, table_info)
-        text_elements = _dedupe_by_xy_text(snapped, eps=1.0)
-    else:
-        text_elements = deduped
-
-    for img_index, image_elem in enumerate(page_elem.findall("image")):
-        left = _safe_float(image_elem.attrib.get("left"))
-        top = _safe_float(image_elem.attrib.get("top"))
-        width = _safe_float(image_elem.attrib.get("width"))
-        height = _safe_float(image_elem.attrib.get("height"))
-        src = image_elem.attrib.get("src")
-        image_path = os.path.join(base_dir, src) if src else None
-        data_url = _read_image_as_data_url(image_path) if image_path else None
-        image_elements.append(
-            {
-                "id": src or f"image-{img_index}",
-                "objectName": src,
-                "x": left,
-                "y": max(page_height - top - height, 0),
-                "width": width,
-                "height": height,
-                "left": left,
-                "top": top,
-                "bottom": max(page_height - top, 0),
-                "right": left + width,
-                "imageData": data_url,
-                "imageFormat": os.path.splitext(src)[1][1:] if src else None,
-            }
-        )
-
-    return {
-        "width": page_width,
-        "height": page_height,
-        "pageNumber": _safe_float(page_elem.attrib.get("number"), 0),
-        "textElements": text_elements,
-        "imageElements": image_elements,
-    }
-
-
-def convert_pdf_to_text_editor_document(pdf_path: str) -> Dict[str, Any]:
-    """Convert a PDF to a JSON payload usable by the PDF text editor."""
-    if not os.path.exists(pdf_path):
-        raise FileNotFoundError(pdf_path)
-
-    with tempfile.TemporaryDirectory() as tmpdir:
-        output_base = os.path.join(tmpdir, "doc")
-        command = [
-            "pdftohtml",
-            "-xml",
-            "-enc",
-            "UTF-8",
-            "-nodrm",
-            "-q",
-            pdf_path,
-            output_base,
-        ]
-        try:
-            subprocess.run(command, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-        except (FileNotFoundError, subprocess.CalledProcessError) as exc:
-            logger.error("[PDF-EDITOR] pdftohtml failed for %s: %s", pdf_path, exc)
-            raise
-
-        xml_path = f"{output_base}.xml"
-        if not os.path.exists(xml_path):
-            raise FileNotFoundError(xml_path)
-
-        tree = ET.parse(xml_path)
-        root = tree.getroot()
-
-        fonts = _parse_fonts(root)
-        font_colors = {font["id"]: font.get("color") for font in fonts if font.get("id")}
-        pages = [_parse_page(page_elem, tmpdir, font_colors) for page_elem in root.findall("page")]
-
-        document: Dict[str, Any] = {
-            "metadata": {"numberOfPages": len(pages)},
-            "fonts": fonts,
-            "pages": pages,
-            "lazyImages": False,
-        }
-        return {"document": document}
-
-
-__all__ = ["convert_pdf_to_text_editor_document"]
@@ -1,147 +0,0 @@
-from __future__ import annotations
-
-import base64
-import os
-import subprocess
-import tempfile
-import time
-from typing import List, Optional
-
-from config import OUTPUT_DIR, logger
-
-
-_FONT_SPEC_MARKERS = (
-    "\\usepackage{fontspec}",
-    "\\setmainfont",
-    "\\setsansfont",
-    "\\setmonofont",
-    "\\newfontfamily",
-)
-
-
-def _needs_unicode_engine(latex_code: str) -> bool:
-    return any(marker in latex_code for marker in _FONT_SPEC_MARKERS)
-
-
-def _run_latex(engine: str, tex_filename: str) -> subprocess.CompletedProcess:
-    return subprocess.run(
-        [engine, "-interaction=nonstopmode", "-output-directory", OUTPUT_DIR, tex_filename],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        timeout=30,
-        cwd=OUTPUT_DIR,
-    )
-
-
-def render_pdf_to_images(pdf_bytes: bytes, max_pages: int = 2, dpi: int = 160) -> List[str]:
-    """Render the first N pages of a PDF to base64-encoded PNG data URLs."""
-    images: List[str] = []
-    with tempfile.TemporaryDirectory() as tmpdir:
-        pdf_path = os.path.join(tmpdir, "upload.pdf")
-        with open(pdf_path, "wb") as handle:
-            handle.write(pdf_bytes)
-
-        output_prefix = os.path.join(tmpdir, "page")
-        try:
-            subprocess.run(
-                [
-                    "pdftoppm",
-                    "-png",
-                    "-r",
-                    str(dpi),
-                    "-f",
-                    "1",
-                    "-l",
-                    str(max_pages),
-                    pdf_path,
-                    output_prefix,
-                ],
-                check=True,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                timeout=30,
-            )
-        except Exception as exc:
-            logger.error("[IMPORT] pdftoppm failed: %s", exc)
-            return images
-
-        for idx in range(1, max_pages + 1):
-            img_path = f"{output_prefix}-{idx}.png"
-            if os.path.exists(img_path):
-                with open(img_path, "rb") as img_handle:
-                    encoded = base64.b64encode(img_handle.read()).decode("utf-8")
-                    images.append(f"data:image/png;base64,{encoded}")
-    return images
-
-
-def compile_latex_to_pdf(
-    latex_code: str,
-    job_id: str,
-    *,
-    log_errors: bool = True,
-    raise_on_error: bool = False,
-) -> Optional[str]:
-    """Compile a LaTeX document and return the PDF path."""
-    tex_filename = os.path.join(OUTPUT_DIR, f"{job_id}.tex")
-    pdf_filename = f"{job_id}.pdf"
-    pdf_path = os.path.join(OUTPUT_DIR, pdf_filename)
-
-    with open(tex_filename, "w", encoding="utf-8") as handle:
-        handle.write(latex_code)
-
-    try:
-        t_start = time.perf_counter()
-        engine = "xelatex" if _needs_unicode_engine(latex_code) else "pdflatex"
-        first = _run_latex(engine, tex_filename)
-        if first.returncode != 0 and engine == "pdflatex":
-            error_output = first.stderr.decode() or first.stdout.decode()
-            if "fontspec" in error_output and ("XeTeX" in error_output or "LuaTeX" in error_output):
-                logger.info("[PDF] pdflatex failed due to fontspec; retrying with xelatex")
-                engine = "xelatex"
-                first = _run_latex(engine, tex_filename)
-        t_first = time.perf_counter()
-        if first.returncode == 0:
-            _run_latex(engine, tex_filename)
-        t_end = time.perf_counter()
-
-        if os.path.exists(pdf_path):
-            logger.info(
-                "[PDF] compiled job_id=%s -> %s (engine=%s first_pass=%.2fs total=%.2fs)",
-                job_id,
-                pdf_filename,
-                engine,
-                t_first - t_start,
-                t_end - t_start,
-            )
-            return pdf_path
-
-        error_output = first.stderr.decode() or first.stdout.decode()
-        message = error_output.strip() or f"{engine} failed without stderr output"
-        if log_errors:
-            logger.error(
-                "[PDF] not generated job_id=%s code=%s engine=%s after %.2fs: %s",
-                job_id,
-                first.returncode,
-                engine,
-                t_first - t_start,
-                message,
-            )
-        if raise_on_error:
-            raise RuntimeError(message)
-        return None
-    except subprocess.TimeoutExpired:
-        message = f"LaTeX compilation timed out for job_id={job_id}"
-        if log_errors:
-            logger.error(message)
-        if raise_on_error:
-            raise
-        return None
-    except Exception as exc:
-        if log_errors:
-            logger.error("LaTeX compilation failed: %s", exc)
-        if raise_on_error:
-            raise
-        return None
-
-
-__all__ = ["render_pdf_to_images", "compile_latex_to_pdf"]
@@ -1,134 +0,0 @@
-from __future__ import annotations
-
-import json
-from typing import Dict, List, Optional, Any
-
-
-# Shared rules
-ALLOWED_LATEX_PACKAGES = [
-    "courier",
-    "graphicx",
-    "geometry",
-    "helvet",
-    "lmodern",
-    "mathpazo",
-    "xcolor",
-    "tabularx",
-    "paracol",
-    "multicol",
-    "longtable",
-    "setspace",
-    "enumitem",
-    "titlesec",
-    "array",
-    "inputenc",
-    "fontenc",
-    "tikz",
-]
-
-LATEX_RULES = [
-    r"Output must start with \documentclass.",
-    r"Output must contain exactly one \begin{document} and one \end{document}.",
-    r"Do not output anything before \documentclass.",
-    r"Do not output anything after \end{document}.",
-    "Do not include commentary, apologies, or markdown fences.",
-    "If uncertain, prefer simpler LaTeX over complex packages.",
-    "Only use LaTeX packages from the allowlist in this prompt.",
-    "Do not use fontspec or custom font commands.",
-]
-
-
-def latex_system_prompt(style_profile: Dict[str, Any], document_type: str, template_hint: Optional[str]) -> str:
-    safe_style = {
-        "font_preference": style_profile.get("font_preference", "default"),
-        "tone": style_profile.get("tone", "professional"),
-        "color_accent": style_profile.get("color_accent", "blue"),
-        "layout_preference": style_profile.get("layout_preference", "clean"),
-    }
-    return (
-        "You are a LaTeX document generator for PDFs.\n"
-        f"User Style Profile (trimmed): {json.dumps(safe_style, sort_keys=True)}\n"
-        f"Document Type: {document_type}\n"
-        f"Template Hint present: {'yes' if template_hint else 'no'}\n"
-        "Rules:\n"
-        "1) Output ONLY valid LaTeX code.\n"
-        f"- " + "\n- ".join(LATEX_RULES) + "\n"
-        "2) Use only the allowlisted packages:\n"
-        f"- " + "\n- ".join(ALLOWED_LATEX_PACKAGES) + "\n"
-        f"3) Respect preferred font ({safe_style['font_preference']}), tone ({safe_style['tone']}), and color accent ({safe_style['color_accent']}). Use the accent token name 'accent' (e.g., \\color{{accent}} or \\textcolor{{accent}}{{...}}).\n"
-        "4) If a template hint is provided, stay close to its layout and styling.\n"
-        "5) Do NOT add placeholder images or black boxes; omit images entirely unless an explicit path or real image content is provided. Do not use \\rule, tikz, or colored rectangles as image stand-ins.\n"
-        "6) Return a full compilable document."
-    )
-
-
-def latex_context_messages(
-    template_hint: Optional[str],
-    current_latex: Optional[str],
-    structured_brief: Optional[str],
-) -> List[Dict[str, str]]:
-    messages: List[Dict[str, str]] = []
-    if template_hint:
-        messages.append(
-          {
-              "role": "user",
-              "content": f"REFERENCE TEMPLATE (keep style/layout, do not copy data):\n---\n{template_hint[:2000]}\n---",
-          }
-        )
-    if current_latex:
-        messages.append(
-          {
-              "role": "user",
-              "content": f"CURRENT LATEX DRAFT (keep structure, apply edits):\n---\n{current_latex[:2000]}\n---",
-          }
-        )
-    if structured_brief:
-        messages.append(
-          {
-              "role": "user",
-              "content": (
-                  "Structured details gathered from the user (authoritative; do not invent beyond this):\n"
-                  f"---\n{structured_brief}\n---"
-              ),
-          }
-        )
-    return messages
-
-
-def pdf_qa_system_prompt() -> str:
-    return (
-        "You are a helpful assistant. Read the provided PDF text and answer the user's question.\n"
-        "Respond with:\n"
-        "Answer: 2–4 sentences summarizing the answer from the text.\n"
-        "Evidence: 1–3 short quotes/snippets from the provided text (must be exact substrings).\n"
-        "If the answer is not in the text, say: 'Not found in the provided text.' and give a best-effort summary."
-    )
-
-
-def brief_missing_info_system_prompt(doc_type: str) -> str:
-    return (
-        f"You are a brief-gathering assistant for generating a {doc_type}.\n"
-        "Be conversational and concise. Ask at most 3 short questions; no multi-part questions.\n"
-        "If the user hasn't given much, invite them to paste prior material or dump everything they remember.\n"
-        "Do not invent data; only ask."
-    )
-
-
-def vision_layout_system_prompt() -> str:
-    return (
-        "You are a LaTeX layout extractor. Given page images of a PDF, return a LaTeX skeleton matching the layout and styling while blanking user content.\n"
-        "Do NOT copy any readable text from images. Replace all text with placeholders like TITLE HERE, LOREM, XXXX.\n"
-        "Infer margins, columns, header/footer, tables. Use \\rule{width}{height} placeholders sized to match blocks.\n"
-        "Use common packages (geometry, xcolor, tabularx, multicol, paracol, tikz). Replace text with placeholders and output a full compilable document.\n"
-        "Output ONLY LaTeX."
-    )
-
-
-__all__ = [
-    "latex_system_prompt",
-    "latex_context_messages",
-    "pdf_qa_system_prompt",
-    "brief_missing_info_system_prompt",
-    "vision_layout_system_prompt",
-    "LATEX_RULES",
-]
@@ -1,6 +0,0 @@
-Flask==3.0.0
-Flask-CORS==4.0.0
-# Use modern OpenAI SDK (v1 interface)
-openai>=1.12.0
-langchain-core==1.2.5
-langchain-openai==1.1.6
@@ -1,18 +0,0 @@
-from prompts import (
-    pdf_qa_system_prompt,
-    vision_layout_system_prompt,
-    latex_system_prompt,
-)
-
-
-def main():
-    assert pdf_qa_system_prompt(), "pdf_qa_system_prompt is empty"
-    assert "Do NOT copy" in vision_layout_system_prompt(), "vision prompt missing no-copy rule"
-    latex_prompt = latex_system_prompt({}, "document", None)
-    assert "\\end{document}" in latex_prompt, "latex prompt missing end document mention"
-    print("prompts OK")
-
-
-if __name__ == "__main__":
-    main()
-
@@ -1,262 +0,0 @@
-import re
-import shutil
-import subprocess
-import tempfile
-from pathlib import Path
-
-
-ROOT_DIR = Path(__file__).resolve().parents[2]
-TEMPLATE_ROOT = ROOT_DIR / "backend" / "templates"
-FRONTEND_PUBLIC = ROOT_DIR / "frontend" / "public" / "templates"
-FRONTEND_CATALOG = ROOT_DIR / "frontend" / "src" / "templateCatalog.ts"
-TIMEOUT_SEC = 60
-
-LOREM_SENTENCE = (
-    "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt "
-    "ut labore et dolore magna aliqua."
-)
-LOREM_PARAGRAPH = (
-    "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt "
-    "ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco "
-    "laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in "
-    "voluptate velit esse cillum dolore eu fugiat nulla pariatur."
-)
-LOREM_SHORT = "Lorem ipsum dolor sit amet, consectetur adipiscing elit."
-
-PLACEHOLDER_REPLACEMENTS = {
-    "TITLE": "Sample Title",
-    "SUBTITLE": "Sample Subtitle",
-    "AUTHOR": "Sample Author",
-    "AUTHOR_LIST": "Sample Author One, Sample Author Two",
-    "AFFILIATIONS": "Sample Organization",
-    "ABSTRACT": LOREM_PARAGRAPH,
-    "KEYWORDS": "keyword1, keyword2, keyword3, keyword4",
-    "INTRODUCTION": LOREM_PARAGRAPH,
-    "RELATED_WORK": LOREM_PARAGRAPH,
-    "METHODOLOGY": LOREM_PARAGRAPH,
-    "RESULTS": LOREM_PARAGRAPH,
-    "DISCUSSION": LOREM_PARAGRAPH,
-    "CONCLUSION": LOREM_SHORT,
-    "REFERENCES": "Doe, J. (2024). Example Reference. Journal of Examples.",
-    "MAIN_TEXT": f"{LOREM_PARAGRAPH} {LOREM_PARAGRAPH}",
-    "FIGURES_TABLES": "Figure 1: Example chart. Table 1: Summary of results.",
-    "REPORT_TITLE": "Business Report",
-    "DATE": "2025-01-01",
-    "EXEC_SUMMARY": LOREM_PARAGRAPH,
-    "BACKGROUND": LOREM_PARAGRAPH,
-    "FINDINGS": f"{LOREM_SENTENCE} {LOREM_SENTENCE}",
-    "RECOMMENDATIONS": "Recommendation 1: Improve efficiency. Recommendation 2: Reduce costs.",
-    "APPENDIX": LOREM_SHORT,
-    "NEWSLETTER_TITLE": "Monthly Newsletter",
-    "TOP_STORY": LOREM_PARAGRAPH,
-    "UPDATES": f"{LOREM_SENTENCE} {LOREM_SENTENCE}",
-    "SPOTLIGHT": LOREM_PARAGRAPH,
-    "FOOTER": "Contact: info@example.com | 123 Main Street",
-    "RECIPE_TITLE": "Sample Recipe",
-    "SERVINGS": "Serves 4",
-    "TIME": "30 minutes",
-    "INGREDIENTS": r"\begin{itemize}\item Ingredient A\item Ingredient B\item Ingredient C\end{itemize}",
-    "INSTRUCTIONS": LOREM_PARAGRAPH,
-    "NOTES": "Notes and tips: adjust seasoning to taste.",
-    "BUSINESS_NAME": "Your Company",
-    "BUSINESS_ADDRESS": "123 Main Street, Springfield",
-    "BUSINESS_CONTACT": "email@example.com | (555) 555-5555",
-    "INVOICE_NUMBER": "INV-001",
-    "ISSUE_DATE": "2025-01-01",
-    "DUE_DATE": "2025-01-15",
-    "CLIENT_NAME": "Client Name",
-    "CLIENT_ADDRESS": "456 Client Ave, Metropolis",
-    "CLIENT_CONTACT": "client@example.com",
-    "LINE_ITEMS": r"Design Services & 8 & 120 & 960 \\ Consulting & 4 & 150 & 600 \\",
-    "SUBTOTAL": "1560",
-    "TAXES": "124.80",
-    "TOTAL": "1684.80",
-    "PAYMENT_TERMS": "Net 15",
-    "PAYMENT_METHODS": "Bank transfer, credit card",
-    "STUDENT_NAME": "Student Name",
-    "COURSE_NAME": "Course Name",
-    "INSTRUCTOR_NAME": "Instructor Name",
-    "ASSIGNMENT_TITLE": "Assignment Title",
-    "PROMPT": LOREM_SHORT,
-    "RESPONSE": LOREM_PARAGRAPH,
-    "CHAPTER_ONE_TITLE": "Chapter One",
-    "CHAPTER_ONE": LOREM_PARAGRAPH,
-    "CHAPTER_TWO_TITLE": "Chapter Two",
-    "CHAPTER_TWO": LOREM_PARAGRAPH,
-    "PREFACE": LOREM_SHORT,
-    "PUBLISHER": "Publisher",
-    "NAME": "Name",
-    "EMAIL": "email@example.com",
-    "PHONE": "(555) 555-5555",
-    "LOCATION": "City, Country",
-    "SUMMARY": LOREM_SENTENCE,
-    "EXPERIENCE": f"{LOREM_SENTENCE} {LOREM_SENTENCE}",
-    "EDUCATION": "University Name, B.S. in Example Studies",
-    "SKILLS": "Skills: Analysis, Design, Communication",
-    "PROJECTS": LOREM_SHORT,
-    "SUBJECT": "Subject",
-    "BODY": LOREM_PARAGRAPH,
-    "RECIPIENT_NAME": "Recipient Name",
-    "RECIPIENT_TITLE": "Recipient Title",
-    "RECIPIENT_COMPANY": "Recipient Company",
-    "RECIPIENT_ADDRESS": "Recipient Address",
-    "SENDER_NAME": "Sender Name",
-    "SENDER_ADDRESS": "Sender Address",
-    "SENDER_EMAIL": "sender@example.com",
-    "MONTH_YEAR": "January 2025",
-    "THEME": "Theme",
-    "WEEK_ROWS": "1 & 2 & 3 & 4 & 5 & 6 & 7 \\\\\\\\ \\\\hline",
-    "HEADLINE": "Headline",
-    "SUBTEXT": "Supporting message with a clear benefit.",
-    "CALL_TO_ACTION": "Call to action",
-    "CONTACT": "contact@example.com",
-    "EXPERIMENT_TITLE": "Experiment Title",
-    "OBJECTIVE": LOREM_SHORT,
-    "MATERIALS": "Materials list goes here.",
-    "PROCEDURE": LOREM_PARAGRAPH,
-    "OBSERVATIONS": LOREM_SHORT,
-    "INSTITUTION": "Institution",
-    "PRESENTER": "Presenter",
-    "AGENDA": "Agenda goes here.",
-    "KEY_POINTS": "Key points go here.",
-    "DATA_VISUALS": "Data visuals go here.",
-    "SUBTITLE": "Subtitle",
-    "ORGANIZATION": "Organization",
-}
-
-
-def render_template_latex(raw_latex: str) -> str:
-    def replace(match: re.Match[str]) -> str:
-        key = match.group(1).strip()
-        return PLACEHOLDER_REPLACEMENTS.get(key, key.replace("_", " ").title())
-
-    return re.sub(r"<<([A-Z0-9_]+)>>", replace, raw_latex)
-
-
-def find_converter() -> str | None:
-    if shutil.which("pdftoppm"):
-        return "pdftoppm"
-    if shutil.which("magick"):
-        return "magick"
-    if shutil.which("convert"):
-        return "convert"
-    return None
-
-
-def pdf_to_jpg(pdf_path: Path, jpg_path: Path, converter: str) -> None:
-    if converter == "pdftoppm":
-        subprocess.run(
-            ["pdftoppm", "-jpeg", "-f", "1", "-singlefile", str(pdf_path), str(jpg_path.with_suffix(''))],
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            timeout=TIMEOUT_SEC,
-        )
-        return
-    if converter == "magick":
-        subprocess.run(
-            ["magick", "convert", "-density", "150", str(pdf_path), "-quality", "90", str(jpg_path)],
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            timeout=TIMEOUT_SEC,
-        )
-        return
-    subprocess.run(
-        ["convert", "-density", "150", str(pdf_path), "-quality", "90", str(jpg_path)],
-        check=True,
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-        timeout=TIMEOUT_SEC,
-    )
-
-
-def main() -> None:
-    if not shutil.which("pdflatex"):
-        raise SystemExit("pdflatex not found. Install TeX Live or MikTeX to generate thumbnails.")
-
-    converter = find_converter()
-    if not converter:
-        raise SystemExit("No PDF-to-image converter found. Install poppler-utils or ImageMagick.")
-
-    tex_files = list(TEMPLATE_ROOT.rglob("*.tex"))
-    if not tex_files:
-        raise SystemExit(f"No templates found in {TEMPLATE_ROOT}")
-
-    FRONTEND_PUBLIC.mkdir(parents=True, exist_ok=True)
-    catalog: dict[str, list[str]] = {}
-
-    failures: list[str] = []
-    for tex_file in tex_files:
-        doc_type = tex_file.parent.name
-        template_id = tex_file.stem
-        target_dir = FRONTEND_PUBLIC / doc_type
-        target_dir.mkdir(parents=True, exist_ok=True)
-        target_jpg = target_dir / f"{template_id}.jpg"
-
-        catalog.setdefault(doc_type, [])
-        if template_id not in catalog[doc_type]:
-            catalog[doc_type].append(template_id)
-        with tempfile.TemporaryDirectory() as tmpdir:
-            tmpdir_path = Path(tmpdir)
-            rendered = render_template_latex(tex_file.read_text(encoding="ascii"))
-            tmp_tex = tmpdir_path / "template.tex"
-            tmp_tex.write_text(rendered, encoding="ascii")
-
-            try:
-                subprocess.run(
-                    ["pdflatex", "-interaction=nonstopmode", "-halt-on-error", tmp_tex.name],
-                    check=True,
-                    cwd=tmpdir_path,
-                    stdout=subprocess.DEVNULL,
-                    stderr=subprocess.DEVNULL,
-                    timeout=TIMEOUT_SEC,
-                )
-            except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as exc:
-                failures.append(f"{tex_file}: pdflatex failed ({exc})")
-                continue
-
-            pdf_path = tmpdir_path / "template.pdf"
-            if not pdf_path.exists():
-                failures.append(f"{tex_file}: PDF not generated")
-                continue
-
-            try:
-                pdf_to_jpg(pdf_path, target_jpg, converter)
-                print(f"Wrote {target_jpg}")
-            except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as exc:
-                failures.append(f"{tex_file}: image conversion failed ({exc})")
-                continue
-
-    if failures:
-        print("\nFailures:")
-        for failure in failures:
-            print(f"- {failure}")
-        raise SystemExit("Template thumbnail generation completed with errors.")
-
-    entries = []
-    for doc_type in sorted(catalog.keys()):
-        templates = sorted(catalog[doc_type])
-        if "default" in templates:
-            templates = ["default"] + [t for t in templates if t != "default"]
-        entries.append(
-            f"  {{ docType: '{doc_type}', templateCount: {len(templates)}, templates: {templates} }}"
-        )
-
-    FRONTEND_CATALOG.write_text(
-        "// Auto-generated by generate_template_thumbnails.py\n"
-        "export type TemplateCatalogEntry = {\n"
-        "  docType: string\n"
-        "  templateCount: number\n"
-        "  templates: string[]\n"
-        "}\n\n"
-        "export const templateCatalog: TemplateCatalogEntry[] = [\n"
-        + ",\n".join(entries)
-        + "\n]\n",
-        encoding="ascii",
-    )
-    print(f"Wrote catalog {FRONTEND_CATALOG}")
-
-
-if __name__ == "__main__":
-    main()
@@ -1,86 +0,0 @@
-from __future__ import annotations
-
-import json
-import os
-from typing import Any, Dict, List
-
-from config import STYLE_DB_PATH, TEMPLATE_DB_PATH, VERSIONS_DB_PATH
-from latex_utils import clean_generated_latex, extract_layout_hint
-
-
-def _read_json(path: str) -> Dict[str, Any]:
-    if not os.path.exists(path):
-        return {}
-    try:
-        with open(path, "r", encoding="utf-8") as handle:
-            return json.load(handle)
-    except Exception:
-        return {}
-
-
-def _write_json(path: str, data: Dict[str, Any]) -> None:
-    with open(path, "w", encoding="utf-8") as handle:
-        json.dump(data, handle, indent=2)
-
-
-def load_user_style(user_id: str) -> Dict[str, Any]:
-    """Load (or bootstrap) an individual user's preferred style."""
-    data = _read_json(STYLE_DB_PATH)
-    return data.get(
-        user_id,
-        {
-            "layout_preference": "clean",
-            "font_preference": "helvet",
-            "tone": "professional",
-            "color_accent": "blue",
-            "last_doc_type": None,
-        },
-    )
-
-
-def save_user_style(user_id: str, style_data: Dict[str, Any]) -> Dict[str, Any]:
-    """Persist style preferences for a user."""
-    all_data = _read_json(STYLE_DB_PATH)
-    current = all_data.get(user_id, load_user_style(user_id))
-    current.update(style_data)
-    all_data[user_id] = current
-    _write_json(STYLE_DB_PATH, all_data)
-    return current
-
-
-def load_user_templates(user_id: str) -> Dict[str, str]:
-    templates = _read_json(TEMPLATE_DB_PATH)
-    return templates.get(user_id, {})
-
-
-def save_user_template(user_id: str, doc_type: str, latex_code: str) -> None:
-    """Persist sanitized layout hints per doc type."""
-    templates = _read_json(TEMPLATE_DB_PATH)
-    user_templates = templates.get(user_id, {})
-    sanitized = clean_generated_latex(latex_code)
-    user_templates[doc_type] = extract_layout_hint(sanitized)
-    templates[user_id] = user_templates
-    _write_json(TEMPLATE_DB_PATH, templates)
-
-
-def load_versions(user_id: str) -> List[Dict[str, Any]]:
-    data = _read_json(VERSIONS_DB_PATH)
-    return data.get(user_id, [])
-
-
-def save_version(user_id: str, entry: Dict[str, Any]) -> None:
-    data = _read_json(VERSIONS_DB_PATH)
-    versions = data.get(user_id, [])
-    versions.insert(0, entry)
-    data[user_id] = versions[:20]
-    _write_json(VERSIONS_DB_PATH, data)
-
-
-__all__ = [
-    "load_user_style",
-    "save_user_style",
-    "load_user_templates",
-    "save_user_template",
-    "load_versions",
-    "save_version",
-]
@@ -1,33 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, Dict
-
-from storage import load_user_style, save_user_style
-
-
-def update_style_profile_from_prompt(user_id: str, prompt: str) -> Dict[str, Any]:
-    """Simple heuristics to remember color/font/tone preferences from prompt text."""
-    style = load_user_style(user_id)
-    lower = (prompt or "").lower()
-
-    if "modern" in lower or "minimal" in lower:
-        style["layout_preference"] = "modern"
-        style["tone"] = "minimalist"
-    if "classic" in lower or "formal" in lower:
-        style["layout_preference"] = "classic"
-        style["tone"] = "formal"
-    if "serif" in lower:
-        style["font_preference"] = "serif"
-    if "sans" in lower:
-        style["font_preference"] = "helvet"
-    if "blue" in lower:
-        style["color_accent"] = "blue"
-    if "red" in lower:
-        style["color_accent"] = "red"
-    if "green" in lower:
-        style["color_accent"] = "green"
-
-    return save_user_style(user_id, style)
-
-
-__all__ = ["update_style_profile_from_prompt"]
@@ -1,52 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, List, Optional
-import time
-
-from config import CLIENT_MODE, SMART_MODEL, get_chat_model, logger
-from langchain_utils import to_lc_messages
-from prompts import vision_layout_system_prompt
-
-
-def vision_layout_from_images(image_urls: List[str], doc_type: str) -> Optional[str]:
-    """Call the multimodal model to recover a LaTeX skeleton from page images."""
-    if CLIENT_MODE != "langchain" or not image_urls:
-        return None
-
-    system_prompt = vision_layout_system_prompt()
-
-    user_content: List[Any] = [
-        {"type": "text", "text": f"Extract layout for document type: {doc_type}. Return LaTeX skeleton only."}
-    ]
-    for url in image_urls:
-        user_content.append({"type": "image_url", "image_url": {"url": url}})
-
-    messages = [
-        {"role": "system", "content": system_prompt},
-        {"role": "user", "content": user_content},
-    ]
-
-    try:
-        logger.info("[IMPORT] vision call pages=%s doc_type=%s", len(image_urls), doc_type)
-        llm = get_chat_model(SMART_MODEL, max_tokens=2800)
-        if not llm:
-            return None
-        start = time.perf_counter()
-        response = llm.invoke(to_lc_messages(messages))
-        elapsed = time.perf_counter() - start
-        content = response.content or ""
-        usage = getattr(response, "usage_metadata", None)
-        logger.info(
-            "[IMPORT] vision model=%s elapsed=%.2fs chars=%s usage=%s",
-            SMART_MODEL,
-            elapsed,
-            len(str(content)),
-            usage,
-        )
-        return response.content
-    except Exception as exc:
-        logger.error("[IMPORT] vision generation failed: %s", exc)
-        return None
-
-
-__all__ = ["vision_layout_from_images"]
@@ -1,36 +0,0 @@
-module.exports = {
-  root: true,
-  env: {
-    browser: true,
-    es2021: true,
-  },
-  extends: [
-    'eslint:recommended',
-    'plugin:react/recommended',
-    'plugin:react-hooks/recommended',
-    'plugin:@typescript-eslint/recommended',
-    'prettier',
-  ],
-  parser: '@typescript-eslint/parser',
-  parserOptions: {
-    ecmaVersion: 'latest',
-    sourceType: 'module',
-    ecmaFeatures: {
-      jsx: true,
-    },
-    jsxPragma: null,
-  },
-  plugins: ['react', 'react-hooks', '@typescript-eslint'],
-  settings: {
-    react: {
-      version: 'detect',
-      runtime: 'automatic',
-    },
-  },
-  ignorePatterns: ['dist', 'node_modules'],
-  rules: {
-    'react/prop-types': 'off',
-    'react/react-in-jsx-scope': 'off',
-    '@typescript-eslint/no-explicit-any': 'off',
-  },
-}
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link rel="icon" type="image/x-icon" href="/favicon.ico" />
-    <title>Stirling - Intelligent Document 1.0</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.tsx"></script>
-  </body>
-</html>
@@ -1,34 +0,0 @@
-{
-  "name": "latex-pdf-generator-frontend",
-  "version": "1.0.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "preview": "vite preview",
-    "lint": "eslint \"src/**/*.{ts,tsx}\"",
-    "typecheck": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@xenova/transformers": "^2.17.0",
-    "pdfjs-dist": "^4.10.38",
-    "pdf-lib": "^1.17.1",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
-  },
-  "devDependencies": {
-    "@types/react": "^18.2.43",
-    "@types/react-dom": "^18.2.17",
-    "@typescript-eslint/eslint-plugin": "^6.14.0",
-    "@typescript-eslint/parser": "^6.14.0",
-    "@vitejs/plugin-react": "^4.2.1",
-    "autoprefixer": "^10.4.16",
-    "eslint": "^8.56.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-react": "^7.34.1",
-    "eslint-plugin-react-hooks": "^4.6.0",
-    "postcss": "^8.4.32",
-    "tailwindcss": "^3.4.0",
-    "vite": "^5.0.8"
-  }
-}
@@ -1,6 +0,0 @@
-export default {
-  plugins: {
-    tailwindcss: {},
-    autoprefixer: {},
-  },
-}
@@ -1,134 +0,0 @@
-import { LandingView } from './components/landing/LandingView'
-import { ImportLayoutModal } from './components/modals/ImportLayoutModal'
-import { WorkspaceView } from './components/workspace/WorkspaceView'
-import { useDocumentWorkflow } from './hooks/useDocumentWorkflow'
-import { useSpeechCapture } from './hooks/useSpeechCapture'
-
-function App() {
-  const workflow = useDocumentWorkflow()
-  const speech = useSpeechCapture({ appendPrompt: workflow.appendPrompt })
-
-  const importModal = (
-    <ImportLayoutModal
-      isOpen={workflow.showImportModal}
-      docType={workflow.importDocType}
-      onDocTypeChange={workflow.setImportDocType}
-      onClose={() => workflow.setShowImportModal(false)}
-      onFileSelected={workflow.handleImportTemplate}
-      isImporting={workflow.isImporting}
-      status={workflow.importStatus}
-    />
-  )
-
-  if (workflow.view === 'landing') {
-    return (
-      <>
-      <LandingView
-        prompt={workflow.prompt}
-        onPromptChange={workflow.setPrompt}
-        onSubmit={workflow.handleInitialSubmit}
-        onKeyDown={workflow.handleKeyDown}
-        uploadedPdfFile={workflow.uploadedPdfFile}
-        onFileSelect={workflow.setUploadedPdfFile}
-        isImporting={workflow.isImporting}
-        onToggleRecording={speech.toggleRecording}
-        onCancelRecording={speech.cancelRecording}
-        onAcceptRecording={speech.acceptRecording}
-        isRecording={speech.isRecording}
-        whisperStatus={speech.whisperStatus}
-        waveformHistory={speech.waveformHistory}
-        docTypes={workflow.docTypes}
-        templateCounts={workflow.templateCounts}
-        templateCatalog={workflow.templateCatalog}
-        selectedDocType={workflow.selectedDocType}
-        selectedTemplateId={workflow.selectedTemplateId}
-        templatesForSelected={workflow.templatesForSelected}
-        isTemplateLoading={workflow.isTemplateLoading}
-        isTemplatePanelOpen={workflow.isTemplatePanelOpen}
-        onToggleTemplatePanel={() =>
-          workflow.setIsTemplatePanelOpen(!workflow.isTemplatePanelOpen)
-        }
-        onSelectTemplate={workflow.applyTemplateSelection}
-        templateThumbnailUrl={workflow.templateThumbnailUrl}
-        formatDocLabel={(value: string) =>
-          value
-            .split('_')
-            .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
-            .join(' ')
-        }
-      />
-        {importModal}
-      </>
-    )
-  }
-
-  return (
-    <>
-      <WorkspaceView
-        isGenerating={workflow.isGenerating}
-        isLivePreviewing={workflow.isLivePreviewing}
-        isStageLoading={workflow.isStageLoading}
-        prompt={workflow.prompt}
-        onPromptChange={workflow.setPrompt}
-        onChatSubmit={workflow.handleChatSubmit}
-        onKeyDown={workflow.handleKeyDown}
-        currentDoc={workflow.currentDoc}
-        onBack={() => workflow.setView('landing')}
-        stage={workflow.stage}
-        outlineRows={workflow.outlineRows}
-        outlineSections={workflow.outlineSections}
-        excludedFields={workflow.excludedFields}
-        outlineConstraints={workflow.outlineConstraints}
-        draftRows={workflow.draftRows}
-        setOutlineRows={workflow.setOutlineRows}
-        setOutlineSections={workflow.setOutlineSections}
-        setExcludedFields={workflow.setExcludedFields}
-        setOutlineConstraints={workflow.setOutlineConstraints}
-        setDraftRows={workflow.setDraftRows}
-        docTypes={workflow.docTypes}
-        templateCounts={workflow.templateCounts}
-        selectedDocType={workflow.selectedDocType}
-        selectedTemplateId={workflow.selectedTemplateId}
-        templatesForSelected={workflow.templatesForSelected}
-        isTemplateLoading={workflow.isTemplateLoading}
-        onSelectTemplate={workflow.applyTemplateSelection}
-        templateThumbnailUrl={workflow.templateThumbnailUrl}
-        approveOutline={workflow.approveOutline}
-        onAiOutline={() => {
-          workflow.fillFieldsFromAI()
-        }}
-        approveDraft={workflow.approveDraft}
-        saveAndReview={workflow.saveAndReview}
-        styleDraft={workflow.styleDraft}
-        setStyleDraft={workflow.setStyleDraft}
-        applyStyleAndRegenerate={workflow.applyStyleAndRegenerate}
-        onAddPromptInfo={workflow.addPromptForFields}
-        onStageSelect={(nextStage) => {
-          if (workflow.isGenerating || workflow.isStageLoading) return
-          if (nextStage === 'text' && workflow.stage === 'outline') {
-            workflow.approveOutline()
-            return
-          }
-          if (nextStage === 'styling' && workflow.stage === 'text') {
-            workflow.approveDraft()
-            return
-          }
-          if (nextStage === 'review' && workflow.stage === 'styling') {
-            workflow.saveAndReview()
-            return
-          }
-          workflow.setStage(nextStage)
-        }}
-        imagePlaceholdersCount={workflow.imagePlaceholdersCount}
-        isAssetUploading={workflow.isAssetUploading}
-        assetError={workflow.assetError}
-        onAddPlaceholderImage={workflow.addImageToPlaceholders}
-        onRemovePlaceholders={workflow.stripImagePlaceholders}
-        onOpenImportTemplate={() => workflow.openImportTemplate(workflow.selectedDocType)}
-      />
-      {importModal}
-    </>
-  )
-}
-
-export default App
@@ -1,360 +0,0 @@
-import { FormEvent, KeyboardEvent, useMemo, useState } from 'react'
-import { AudioWaveform } from '../ui/AudioWaveform'
-
-interface LandingViewProps {
-  prompt: string
-  onPromptChange: (value: string) => void
-  onSubmit: (event: FormEvent<HTMLFormElement>) => void
-  onKeyDown: (event: KeyboardEvent<HTMLTextAreaElement>) => void
-  uploadedPdfFile: File | null
-  onFileSelect: (file: File | null) => void
-  isImporting: boolean
-  onToggleRecording: () => void
-  onCancelRecording: () => void
-  onAcceptRecording: () => void
-  isRecording: boolean
-  whisperStatus: string | null
-  waveformHistory: number[][]
-  docTypes: string[]
-  templateCounts: Record<string, number>
-  templateCatalog: { docType: string; templateCount: number; templates: string[] }[]
-  selectedDocType: string
-  selectedTemplateId: string
-  templatesForSelected: string[]
-  isTemplateLoading: boolean
-  isTemplatePanelOpen: boolean
-  onToggleTemplatePanel: () => void
-  onSelectTemplate: (docType: string, templateId: string) => void
-  templateThumbnailUrl: (docType: string, templateId: string) => string
-  formatDocLabel: (value: string) => string
-}
-
-export function LandingView({
-  prompt,
-  onPromptChange,
-  onSubmit,
-  onKeyDown,
-  uploadedPdfFile,
-  onFileSelect,
-  isImporting,
-  onToggleRecording,
-  onCancelRecording,
-  onAcceptRecording,
-  isRecording,
-  whisperStatus,
-  waveformHistory,
-  docTypes,
-  templateCounts,
-  templateCatalog,
-  selectedDocType,
-  selectedTemplateId,
-  templatesForSelected,
-  isTemplateLoading,
-  isTemplatePanelOpen,
-  onToggleTemplatePanel,
-  onSelectTemplate,
-  templateThumbnailUrl,
-  formatDocLabel,
-}: LandingViewProps) {
-  const [templateSearch, setTemplateSearch] = useState('')
-  const [activeTemplateTab, setActiveTemplateTab] = useState<'popular' | 'legal' | 'financial' | 'academic' | 'marketing' | 'operations'>('popular')
-  const [expandedDocType, setExpandedDocType] = useState<string | null>(null)
-  const [hoveredTemplate, setHoveredTemplate] = useState<{ docType: string; templateId: string; x: number; y: number } | null>(null)
-
-  const popularDocTypes = new Set(['cvs_and_resumes', 'invoices', 'cover_letters', 'business_reports', 'presentations'])
-  const legalDocTypes = new Set(['formal_letters', 'theses'])
-  const financialDocTypes = new Set(['invoices', 'business_reports', 'calendars'])
-  const academicDocTypes = new Set(['academic_articles', 'academic_journals', 'assignments', 'theses'])
-  const marketingDocTypes = new Set(['newsletters', 'signs', 'presentations'])
-  const operationsDocTypes = new Set(['laboratory_reports', 'laboratory_books', 'business_reports'])
-
-  const visibleDocTypes = useMemo(() => {
-    const filtered = docTypes.filter((docType) =>
-      formatDocLabel(docType).toLowerCase().includes(templateSearch.toLowerCase()),
-    )
-    if (activeTemplateTab === 'legal') {
-      return filtered.filter((docType) => legalDocTypes.has(docType))
-    }
-    if (activeTemplateTab === 'financial') {
-      return filtered.filter((docType) => financialDocTypes.has(docType))
-    }
-    if (activeTemplateTab === 'academic') {
-      return filtered.filter((docType) => academicDocTypes.has(docType))
-    }
-    if (activeTemplateTab === 'marketing') {
-      return filtered.filter((docType) => marketingDocTypes.has(docType))
-    }
-    if (activeTemplateTab === 'operations') {
-      return filtered.filter((docType) => operationsDocTypes.has(docType))
-    }
-    return filtered.filter((docType) => popularDocTypes.has(docType))
-  }, [
-    academicDocTypes,
-    activeTemplateTab,
-    docTypes,
-    financialDocTypes,
-    formatDocLabel,
-    legalDocTypes,
-    marketingDocTypes,
-    operationsDocTypes,
-    popularDocTypes,
-    templateSearch,
-  ])
-
-  const docTypeIcon = (docType: string) => {
-    switch (docType) {
-      case 'cvs_and_resumes':
-        return '📄'
-      case 'invoices':
-        return '🧾'
-      case 'cover_letters':
-        return '✉️'
-      case 'business_reports':
-        return '📊'
-      case 'formal_letters':
-        return '📝'
-      case 'theses':
-        return '🎓'
-      case 'presentations':
-        return '🖥️'
-      case 'recipes':
-        return '🍲'
-      default:
-        return '📁'
-    }
-  }
-  return (
-    <div className="min-h-screen bg-gradient-to-b from-slate-50 to-slate-100 text-slate-900">
-      <header className="flex items-center justify-between px-8 py-6">
-        <div className="flex items-center gap-2 text-sm font-semibold text-slate-700">
-          <span className="text-base">Stirling</span>
-        </div>
-        <div className="flex items-center gap-2">
-          <button className="rounded-full border border-slate-200 px-4 py-1.5 text-xs text-slate-500">
-            Log in
-          </button>
-          <button className="rounded-full bg-slate-900 px-4 py-1.5 text-xs text-white">
-            Get Stirling free
-          </button>
-        </div>
-      </header>
-
-      <main className="flex flex-1 items-center justify-center px-6 pb-16">
-        <div className="w-full max-w-4xl rounded-[32px] border border-slate-200 bg-white p-10 shadow-lg">
-          <div className="flex flex-col items-center text-center gap-4">
-            <div className="text-3xl font-semibold text-slate-900">Stirling PDF</div>
-            <p className="text-sm text-slate-500">Create any PDF you can imagine with AI</p>
-          </div>
-
-          <form onSubmit={onSubmit} className="mt-10">
-            <div className="rounded-2xl border border-slate-200 bg-white px-5 py-4 shadow-sm">
-              {isRecording ? (
-                <div className="space-y-3">
-                  <AudioWaveform history={waveformHistory} />
-                  <div className="flex items-center justify-between text-xs text-slate-500">
-                    <span>{whisperStatus || 'Listening...'}</span>
-                    <div className="flex gap-2">
-                      <button
-                        type="button"
-                        className="rounded-full border border-slate-200 px-3 py-1"
-                        onClick={onCancelRecording}
-                      >
-                        Cancel
-                      </button>
-                      <button
-                        type="button"
-                        className="rounded-full bg-blue-600 px-3 py-1 text-white"
-                        onClick={onAcceptRecording}
-                      >
-                        Accept
-                      </button>
-                    </div>
-                  </div>
-                </div>
-              ) : (
-                <>
-                  <textarea
-                    className="w-full resize-none text-sm text-slate-700 placeholder:text-slate-400 focus:outline-none"
-                    rows={1}
-                    value={prompt}
-                    onChange={(event) => onPromptChange(event.target.value)}
-                    onKeyDown={onKeyDown}
-                    placeholder="Make an invoice for me to bill a client for $1500 in consulting fees"
-                  />
-                  {uploadedPdfFile && (
-                    <div className="mt-2 text-xs text-emerald-600">{uploadedPdfFile.name}</div>
-                  )}
-                  <div className="mt-4 flex items-center justify-between">
-                    <div className="flex items-center gap-2 relative">
-                      <label
-                        htmlFor="pdf-upload-landing"
-                        className="flex h-8 w-8 items-center justify-center rounded-full border border-slate-200 text-slate-400"
-                      >
-                        +
-                      </label>
-                      <input
-                        id="pdf-upload-landing"
-                        type="file"
-                        accept="application/pdf"
-                        onChange={(event) => onFileSelect(event.target.files?.[0] || null)}
-                        className="hidden"
-                      />
-                      <button
-                        type="button"
-                        className="rounded-full border border-slate-200 px-3 py-1 text-xs text-slate-500"
-                        onClick={onToggleTemplatePanel}
-                      >
-                        Template
-                      </button>
-                      <span className="text-xs text-slate-400">
-                        {formatDocLabel(selectedDocType)} · {formatDocLabel(selectedTemplateId)}
-                      </span>
-                      {isTemplatePanelOpen && (
-                        <div className="absolute left-2 top-10 w-80 rounded-2xl border border-slate-200 bg-white p-4 shadow-lg z-50">
-                          <div className="absolute -top-2 left-6 h-3 w-3 rotate-45 border border-slate-200 bg-white" />
-                          <div className="space-y-3">
-                            <div className="flex items-center gap-2 rounded-full border border-slate-200 px-3 py-2 text-xs text-slate-500">
-                              <span>🔎</span>
-                              <input
-                                className="w-full bg-transparent text-sm text-slate-600 focus:outline-none"
-                                placeholder="Search templates..."
-                                value={templateSearch}
-                                onChange={(event) => setTemplateSearch(event.target.value)}
-                              />
-                            </div>
-                            <div className="flex gap-2 overflow-x-auto pb-1">
-                              {[
-                                { id: 'popular', label: 'Popular' },
-                                { id: 'legal', label: 'Legal' },
-                                { id: 'financial', label: 'Financial' },
-                                { id: 'academic', label: 'Academic' },
-                                { id: 'marketing', label: 'Marketing' },
-                                { id: 'operations', label: 'Operations' },
-                              ].map((tab) => (
-                                <button
-                                  type="button"
-                                  key={tab.id}
-                                  onClick={() => setActiveTemplateTab(tab.id as typeof activeTemplateTab)}
-                                  className={`rounded-full px-3 py-1 text-xs ${
-                                    activeTemplateTab === tab.id
-                                      ? 'bg-blue-100 text-blue-700'
-                                      : 'bg-slate-100 text-slate-500'
-                                  }`}
-                                >
-                                  {tab.label}
-                                </button>
-                              ))}
-                            </div>
-                          </div>
-
-                          <div className="mt-4 space-y-2 max-h-64 overflow-y-auto pr-1 relative">
-                            {visibleDocTypes.map((docType) => {
-                              const isExpanded = expandedDocType === docType
-                              const templates =
-                                templateCatalog.find((entry) => entry.docType === docType)?.templates ||
-                                (docType === selectedDocType ? templatesForSelected : ['default'])
-                              return (
-                                <div key={docType} className="rounded-lg border border-slate-200 bg-white">
-                                  <div
-                                    className="flex w-full items-center justify-between px-3 py-2 text-sm text-slate-700"
-                                  >
-                                    <button
-                                      type="button"
-                                      className="flex flex-1 items-center gap-2 text-left"
-                                      onClick={() => onSelectTemplate(docType, 'default')}
-                                    >
-                                      <span>{docTypeIcon(docType)}</span>
-                                      <span>{formatDocLabel(docType)}</span>
-                                    </button>
-                                    <button
-                                      type="button"
-                                      className="text-slate-400 px-2"
-                                      onClick={() => setExpandedDocType(isExpanded ? null : docType)}
-                                    >
-                                      {isExpanded ? '▾' : '▸'}
-                                    </button>
-                                  </div>
-                                  {isExpanded && (
-                                    <div className="border-t border-slate-200 px-3 py-2 space-y-2">
-                                      {(templates || ['default']).map((templateId) => (
-                                        <button
-                                          type="button"
-                                          key={`${docType}-${templateId}`}
-                                          onClick={() => onSelectTemplate(docType, templateId)}
-                                          className={`flex w-full items-center justify-between rounded-md px-2 py-1 text-sm ${
-                                            selectedDocType === docType && selectedTemplateId === templateId
-                                              ? 'bg-blue-50 text-blue-700'
-                                              : 'text-slate-600'
-                                          }`}
-                                          onMouseMove={(event) =>
-                                            setHoveredTemplate({
-                                              docType,
-                                              templateId,
-                                              x: event.clientX,
-                                              y: event.clientY,
-                                            })
-                                          }
-                                          onMouseLeave={() => setHoveredTemplate(null)}
-                                        >
-                                          <span>{formatDocLabel(templateId)}</span>
-                                          <span className="text-xs text-slate-400">Select</span>
-                                        </button>
-                                      ))}
-                                    </div>
-                                  )}
-                                </div>
-                              )
-                            })}
-                            {!visibleDocTypes.length && (
-                              <div className="text-sm text-slate-400">No templates found.</div>
-                            )}
-                            {hoveredTemplate && (
-                              <div
-                                className="fixed z-50 w-36 rounded-lg border border-slate-200 bg-white shadow-lg p-2"
-                                style={{ left: hoveredTemplate.x + 12, top: hoveredTemplate.y + 12 }}
-                              >
-                                <div className="text-[10px] uppercase tracking-wide text-slate-400 mb-2">
-                                  Preview
-                                </div>
-                                <div className="w-full bg-slate-50 rounded-md overflow-hidden" style={{ aspectRatio: '210 / 297' }}>
-                                  <img
-                                    src={templateThumbnailUrl(hoveredTemplate.docType, hoveredTemplate.templateId)}
-                                    alt={`${hoveredTemplate.docType} ${hoveredTemplate.templateId} preview`}
-                                    className="h-full w-full object-contain"
-                                  />
-                                </div>
-                              </div>
-                            )}
-                          </div>
-                        </div>
-                      )}
-                    </div>
-                    <div className="flex items-center gap-2">
-                      <button
-                        type="button"
-                        className="flex h-8 w-8 items-center justify-center rounded-full border border-slate-200 text-slate-500"
-                        onClick={onToggleRecording}
-                        aria-label="Voice input"
-                      >
-                        🎤
-                      </button>
-                      <button
-                        type="submit"
-                        disabled={isImporting || (!prompt.trim() && !uploadedPdfFile)}
-                        className="flex h-8 w-8 items-center justify-center rounded-full bg-slate-900 text-white disabled:opacity-40"
-                        aria-label="Generate"
-                      >
-                        ➜
-                      </button>
-                    </div>
-                  </div>
-                </>
-              )}
-            </div>
-          </form>
-
-        </div>
-      </main>
-    </div>
-  )
-}
@@ -1,75 +0,0 @@
-interface ImportLayoutModalProps {
-  isOpen: boolean
-  docType: string
-  onDocTypeChange: (value: string) => void
-  onClose: () => void
-  onFileSelected: (file: File) => void
-  isImporting: boolean
-  status: string | null
-}
-
-export function ImportLayoutModal({
-  isOpen,
-  docType,
-  onDocTypeChange,
-  onClose,
-  onFileSelected,
-  isImporting,
-  status,
-}: ImportLayoutModalProps) {
-  if (!isOpen) return null
-
-  return (
-    <div className="fixed inset-0 bg-slate-900/70 backdrop-blur-sm z-50 flex items-center justify-center p-4">
-      <div className="bg-slate-900 border border-slate-700 rounded-xl shadow-2xl w-full max-w-md p-5 space-y-4">
-        <div className="flex items-center justify-between">
-          <div>
-            <div className="text-sm text-slate-300">Import layout from PDF</div>
-            <div className="text-xs text-slate-500">First 2 pages only, uses vision model</div>
-          </div>
-          <button onClick={onClose} className="text-slate-400 hover:text-white text-sm">
-            ✕
-          </button>
-        </div>
-
-        <div className="space-y-2">
-          <label className="text-xs text-slate-400">Document type</label>
-          <input
-            type="text"
-            value={docType}
-            onChange={(e) => onDocTypeChange(e.target.value)}
-            className="w-full bg-slate-800 border border-slate-700 rounded-lg px-3 py-2 text-slate-100 text-sm"
-            placeholder="invoice, resume, report..."
-          />
-        </div>
-
-        <div className="space-y-2">
-          <label className="text-xs text-slate-400">PDF file</label>
-          <input
-            type="file"
-            accept="application/pdf"
-            onChange={(e) => {
-              const file = e.target.files?.[0]
-              if (file) onFileSelected(file)
-            }}
-            className="w-full text-sm text-slate-300"
-            disabled={isImporting}
-          />
-        </div>
-
-        {status && (
-          <div className="text-xs text-slate-300 bg-slate-800 border border-slate-700 rounded-lg px-3 py-2">
-            {status}
-          </div>
-        )}
-
-        <div className="flex items-center justify-end gap-3 text-xs text-slate-400">
-          <button onClick={onClose} className="px-3 py-1 rounded-lg border border-slate-700 hover:bg-slate-800">
-            Close
-          </button>
-          {isImporting && <span>Processing...</span>}
-        </div>
-      </div>
-    </div>
-  )
-}
@@ -1,223 +0,0 @@
-import { useCallback, useEffect, useMemo, useState } from 'react'
-import { PDFDocument, rgb, StandardFonts } from 'pdf-lib'
-import { GlobalWorkerOptions, getDocument } from 'pdfjs-dist'
-
-GlobalWorkerOptions.workerSrc = new URL('pdfjs-dist/build/pdf.worker.min.mjs', import.meta.url).toString()
-
-type PageTextItem = {
-  id: string
-  str: string
-  x: number
-  y: number
-  width: number
-  fontSize: number
-}
-
-type PageData = {
-  width: number
-  height: number
-  image: string
-  items: PageTextItem[]
-}
-
-interface PdfTextEditorLiteProps {
-  pdfUrl: string
-  onClose: () => void
-}
-
-export function PdfTextEditorLite({ pdfUrl, onClose }: PdfTextEditorLiteProps) {
-  const [pages, setPages] = useState<PageData[]>([])
-  const [loading, setLoading] = useState(false)
-  const [saving, setSaving] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [editedItems, setEditedItems] = useState<Record<string, string>>({})
-
-  const loadPdf = useCallback(async () => {
-    setLoading(true)
-    setError(null)
-    try {
-      const resp = await fetch(pdfUrl)
-      const buffer = await resp.arrayBuffer()
-      const pdf = await getDocument({ data: buffer }).promise
-      const loaded: PageData[] = []
-
-      for (let i = 1; i <= pdf.numPages; i += 1) {
-        const page = await pdf.getPage(i)
-        const viewport = page.getViewport({ scale: 1.2 })
-
-        // Render page to image
-        const canvas = document.createElement('canvas')
-        const ctx = canvas.getContext('2d')
-        if (!ctx) continue
-        canvas.width = viewport.width
-        canvas.height = viewport.height
-        await page.render({ canvasContext: ctx, viewport }).promise
-        const image = canvas.toDataURL('image/png')
-
-        // Extract text items
-        const textContent = await page.getTextContent()
-        const items: PageTextItem[] = textContent.items
-          .map((raw, idx) => {
-            const it = raw as any
-            const transform: number[] = Array.isArray(it?.transform) ? it.transform : [1, 0, 0, 1, 0, 0]
-            const [a, b, , , e, f] = transform
-            const x = typeof e === 'number' ? e : 0
-            const y = typeof f === 'number' ? f : 0
-            const fontSize = Math.hypot(a || 0, b || 0) || it?.height || 12
-            const width = ((it?.width as number | undefined) || fontSize) * viewport.scale
-            const str = typeof it?.str === 'string' ? it.str : ''
-            return { id: `${i}-${idx}`, str, x, y, width, fontSize }
-          })
-          .filter((it) => it.str.length > 0)
-
-        loaded.push({
-          width: viewport.width,
-          height: viewport.height,
-          image,
-          items,
-        })
-      }
-
-      setPages(loaded)
-      const initialEdits: Record<string, string> = {}
-      loaded.forEach((p) =>
-        p.items.forEach((it) => {
-          initialEdits[it.id] = it.str
-        }),
-      )
-      setEditedItems(initialEdits)
-    } catch (e: any) {
-      setError(e?.message || 'Failed to load PDF')
-    } finally {
-      setLoading(false)
-    }
-  }, [pdfUrl])
-
-  useEffect(() => {
-    loadPdf()
-  }, [loadPdf])
-
-  const handleChange = (id: string, value: string) => {
-    setEditedItems((prev) => ({ ...prev, [id]: value }))
-  }
-
-  const handleDownload = useCallback(async () => {
-    setSaving(true)
-    setError(null)
-    try {
-      const doc = await PDFDocument.create()
-      const font = await doc.embedFont(StandardFonts.Helvetica)
-
-      for (const page of pages) {
-        const pdfPage = doc.addPage([page.width, page.height])
-        const bg = await doc.embedPng(page.image)
-        pdfPage.drawImage(bg, { x: 0, y: 0, width: page.width, height: page.height })
-
-        page.items.forEach((item) => {
-          const text = editedItems[item.id] ?? item.str
-          const yPdf = page.height - item.y // flip coordinate to bottom-left origin
-          pdfPage.drawText(text, {
-            x: item.x,
-            y: yPdf - item.fontSize,
-            size: item.fontSize || 12,
-            font,
-            color: rgb(0, 0, 0),
-          })
-        })
-      }
-
-      const bytes = await doc.save()
-      const arrayBuffer = new ArrayBuffer(bytes.byteLength)
-      new Uint8Array(arrayBuffer).set(bytes)
-      const blob = new Blob([arrayBuffer], { type: 'application/pdf' })
-      const url = URL.createObjectURL(blob)
-      const a = document.createElement('a')
-      a.href = url
-      a.download = 'edited.pdf'
-      a.click()
-      URL.revokeObjectURL(url)
-    } catch (e: any) {
-      setError(e?.message || 'Failed to generate PDF')
-    } finally {
-      setSaving(false)
-    }
-  }, [editedItems, pages])
-
-  const pageCount = useMemo(() => pages.length, [pages])
-
-  return (
-    <div className="w-full h-full flex flex-col bg-slate-950">
-      <div className="flex items-center justify-between px-4 py-3 border-b border-slate-800 bg-slate-900">
-        <div className="flex items-center gap-3">
-          <h3 className="text-slate-100 font-semibold">Text Editor (lite)</h3>
-          <span className="text-xs text-slate-400">Pages: {pageCount || '—'}</span>
-        </div>
-        <div className="flex items-center gap-2">
-          <button
-            onClick={handleDownload}
-            disabled={saving || loading || pages.length === 0}
-            className="px-3 py-1.5 rounded bg-blue-600 text-white text-sm disabled:opacity-50"
-          >
-            {saving ? 'Saving…' : 'Download edited PDF'}
-          </button>
-          <button
-            onClick={onClose}
-            className="px-3 py-1.5 rounded bg-slate-700 text-slate-100 text-sm hover:bg-slate-600"
-          >
-            Back to preview
-          </button>
-        </div>
-      </div>
-
-      {error && <div className="px-4 py-2 text-sm text-amber-200 bg-amber-500/10 border border-amber-600">{error}</div>}
-
-      <div className="flex-1 overflow-y-auto p-4 space-y-8">
-        {loading && <div className="text-slate-300 text-sm">Loading PDF…</div>}
-        {!loading &&
-          pages.map((page, pageIdx) => (
-            <div
-              key={page.image}
-              className="relative bg-slate-900 border border-slate-800 rounded-lg p-2 shadow"
-              style={{ width: page.width, minHeight: page.height }}
-            >
-              <div className="absolute inset-2">
-                <img
-                  src={page.image}
-                  alt={`Page ${pageIdx + 1}`}
-                  className="w-full h-auto rounded border border-slate-800 shadow pointer-events-none select-none"
-                />
-                <div className="absolute inset-0">
-                  {page.items.map((item) => {
-                    const yTop = page.height - item.y
-                    return (
-                      <div
-                        key={item.id}
-                        contentEditable
-                        suppressContentEditableWarning
-                        onInput={(e) => handleChange(item.id, (e.target as HTMLDivElement).innerText)}
-                        className="absolute bg-transparent outline-none focus:ring-1 focus:ring-blue-400 rounded px-0.5"
-                        style={{
-                          left: item.x,
-                          top: yTop - item.fontSize * 0.85,
-                          minWidth: Math.max(item.width, 4),
-                          fontSize: item.fontSize,
-                          lineHeight: '1.05',
-                          color: '#111827',
-                        }}
-                      >
-                        {editedItems[item.id] ?? item.str}
-                      </div>
-                    )
-                  })}
-                </div>
-              </div>
-            </div>
-          ))}
-        {!loading && pages.length === 0 && <div className="text-slate-400 text-sm">No pages loaded.</div>}
-      </div>
-    </div>
-  )
-}
-
-export default PdfTextEditorLite
-
@@ -1,223 +0,0 @@
-import { useEffect, useState } from 'react'
-import { GlobalWorkerOptions, getDocument } from 'pdfjs-dist'
-
-GlobalWorkerOptions.workerSrc = new URL('pdfjs-dist/build/pdf.worker.min.mjs', import.meta.url).toString()
-
-type ThumbnailPage = {
-  id: string
-  dataUrl: string
-  width: number
-  height: number
-}
-
-function PdfPreviewSkeleton() {
-  return (
-    <div className="flex justify-center py-8">
-      <div
-        className="relative rounded-2xl border border-slate-300/60 bg-white shadow-2xl overflow-hidden"
-        style={{
-          width: '860px',
-          maxWidth: '90vw',
-          aspectRatio: '1 / 1.414',
-        }}
-      >
-        <div className="h-12 bg-slate-100 border-b border-slate-200 animate-pulse" />
-        <div className="p-8 space-y-4">
-          {[1, 2, 3, 4].map((line) => (
-            <div
-              key={`line-top-${line}`}
-              className="h-4 rounded-full bg-slate-200 animate-pulse"
-              style={{ width: `${78 - line * 10}%` }}
-            />
-          ))}
-          <div className="h-40 rounded-xl bg-slate-100 border border-slate-200 animate-pulse" />
-          {[5, 6, 7].map((line) => (
-            <div
-              key={`line-bottom-${line}`}
-              className="h-4 rounded-full bg-slate-200 animate-pulse"
-              style={{ width: `${70 - (line - 5) * 8}%` }}
-            />
-          ))}
-        </div>
-      </div>
-    </div>
-  )
-}
-
-interface PdfThumbnailViewerProps {
-  pdfUrl: string
-  isLivePreviewing?: boolean
-}
-
-export function PdfThumbnailViewer({ pdfUrl, isLivePreviewing = false }: PdfThumbnailViewerProps) {
-  const [pages, setPages] = useState<ThumbnailPage[]>([])
-  const [loading, setLoading] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [zoom, setZoom] = useState(1)
-  const [hasRenderedPage, setHasRenderedPage] = useState(false)
-
-  useEffect(() => {
-    if (!pdfUrl) {
-      setPages([])
-      setHasRenderedPage(false)
-      return
-    }
-
-    let cancelled = false
-    const controller = new AbortController()
-
-    const load = async () => {
-      setLoading(true)
-      setError(null)
-      try {
-        const response = await fetch(pdfUrl, { signal: controller.signal })
-        if (!response.ok) {
-          throw new Error('Unable to download PDF preview')
-        }
-        const buffer = await response.arrayBuffer()
-        const pdf = await getDocument({ data: buffer }).promise
-        const next: ThumbnailPage[] = []
-        try {
-          for (let pageNumber = 1; pageNumber <= pdf.numPages; pageNumber += 1) {
-            const page = await pdf.getPage(pageNumber)
-            const viewport = page.getViewport({ scale: 0.85 })
-            const canvas = document.createElement('canvas')
-            const ctx = canvas.getContext('2d')
-            if (ctx) {
-              canvas.width = viewport.width
-              canvas.height = viewport.height
-              await page.render({ canvasContext: ctx, viewport }).promise
-              next.push({
-                id: `page-${pageNumber}`,
-                dataUrl: canvas.toDataURL('image/png'),
-                width: viewport.width,
-                height: viewport.height,
-              })
-              canvas.width = 0
-              canvas.height = 0
-            }
-            page.cleanup?.()
-          }
-        } finally {
-          try {
-            pdf.cleanup?.()
-            await pdf.destroy?.()
-          } catch {
-            // ignore cleanup errors
-          }
-        }
-        if (!cancelled) {
-          setPages(next)
-          if (next.length > 0) {
-            setHasRenderedPage(true)
-          }
-        }
-      } catch (err) {
-        if (!cancelled) {
-          const message = err instanceof Error ? err.message : 'Failed to load PDF preview'
-          const normalized = message.toLowerCase()
-          if (
-            isLivePreviewing &&
-            (normalized.includes('zero bytes') || normalized.includes('file is empty') || normalized.includes('pdf is empty'))
-          ) {
-            setError(null)
-          } else {
-            setError(message)
-          }
-        }
-      } finally {
-        if (!cancelled) {
-          setLoading(false)
-        }
-      }
-    }
-
-    load()
-
-    return () => {
-      cancelled = true
-      controller.abort()
-    }
-  }, [pdfUrl, isLivePreviewing])
-
-  const shouldShowSkeleton = (loading && !hasRenderedPage && pages.length === 0) || (isLivePreviewing && pages.length === 0 && !error && !hasRenderedPage)
-
-  return (
-    <div className="flex h-full flex-col bg-slate-900">
-      {error && (
-        <div className="border-b border-amber-700 bg-amber-500/15 px-4 py-3 text-sm text-amber-200">
-          {error}
-        </div>
-      )}
-
-      <div className="relative flex-1 overflow-y-auto px-6 py-6">
-        <div className="sticky top-0 z-10 mb-4 flex items-center justify-end gap-3 rounded-lg border border-slate-800 bg-slate-850/80 px-3 py-2 backdrop-blur">
-          <span className="text-xs text-slate-300">Zoom</span>
-          <div className="flex items-center gap-2">
-            <button
-              type="button"
-              onClick={() => setZoom((z) => Math.max(0.5, Math.round((z - 0.1) * 100) / 100))}
-              className="h-8 w-8 rounded border border-slate-700 bg-slate-800 text-slate-200 hover:bg-slate-750"
-            >
-              −
-            </button>
-            <input
-              type="range"
-              min={0.5}
-              max={2}
-              step={0.05}
-              value={zoom}
-              onChange={(e) => setZoom(Number(e.target.value))}
-              className="h-2 w-32 accent-blue-500"
-            />
-            <button
-              type="button"
-              onClick={() => setZoom((z) => Math.min(2, Math.round((z + 0.1) * 100) / 100))}
-              className="h-8 w-8 rounded border border-slate-700 bg-slate-800 text-slate-200 hover:bg-slate-750"
-            >
-              +
-            </button>
-            <span className="w-12 text-right text-xs text-slate-300">{Math.round(zoom * 100)}%</span>
-          </div>
-        </div>
-
-        {shouldShowSkeleton && <PdfPreviewSkeleton />}
-
-        {!shouldShowSkeleton && pages.length === 0 && (
-          <div className="flex h-full items-center justify-center text-sm text-slate-400">Preview unavailable.</div>
-        )}
-
-        {!shouldShowSkeleton && pages.length > 0 && (
-          <div className="mx-auto flex max-w-5xl flex-col items-center gap-8">
-            {pages.map((page) => {
-              const baseScale = Math.min(920 / page.width, 1)
-              const displayScale = baseScale * zoom
-              const displayWidth = page.width * displayScale
-              const displayHeight = page.height * displayScale
-              return (
-                <div
-                  key={page.id}
-                  className="overflow-hidden rounded-lg border border-slate-800 bg-white shadow-2xl"
-                  style={{
-                    width: displayWidth,
-                    height: displayHeight,
-                    maxWidth: '100%',
-                  }}
-                >
-                  <img
-                    src={page.dataUrl}
-                    alt={`PDF page ${page.id}`}
-                    className="block h-full w-full select-none object-contain"
-                  />
-                </div>
-              )
-            })}
-          </div>
-        )}
-      </div>
-    </div>
-  )
-}
-
-export default PdfThumbnailViewer
-
@@ -1,59 +0,0 @@
-import React from 'react'
-
-type ZoomControlsProps = {
-  value: number
-  onChange: (next: number) => void
-  min?: number
-  max?: number
-  step?: number
-  disabled?: boolean
-  className?: string
-}
-
-const clamp = (value: number, min: number, max: number) => Math.min(Math.max(value, min), max)
-
-const formatPercent = (value: number) => `${Math.round(value * 100)}%`
-
-const ZoomControls: React.FC<ZoomControlsProps> = ({
-  value,
-  onChange,
-  min = 0.2,
-  max = 3,
-  step = 0.1,
-  disabled = false,
-  className = '',
-}) => {
-  const handleChange = (next: number) => {
-    if (disabled) return
-    const clamped = clamp(next, min, max)
-    onChange(Number(clamped.toFixed(2)))
-  }
-
-  return (
-    <div className={`flex items-center gap-2 ${className}`}>
-      <span className="hidden text-xs text-slate-400 sm:inline">Zoom</span>
-      <button
-        type="button"
-        onClick={() => handleChange(value - step)}
-        disabled={disabled}
-        className="rounded border border-slate-700 bg-slate-800 px-2 py-1 text-sm text-slate-200 hover:bg-slate-700 disabled:cursor-not-allowed disabled:opacity-50"
-      >
-        −
-      </button>
-      <div className="min-w-[56px] rounded border border-slate-700 bg-slate-800 px-2 py-1 text-center text-xs font-medium text-slate-100">
-        {formatPercent(value)}
-      </div>
-      <button
-        type="button"
-        onClick={() => handleChange(value + step)}
-        disabled={disabled}
-        className="rounded border border-slate-700 bg-slate-800 px-2 py-1 text-sm text-slate-200 hover:bg-slate-700 disabled:cursor-not-allowed disabled:opacity-50"
-      >
-        +
-      </button>
-    </div>
-  )
-}
-
-export default ZoomControls
-
@@ -1,421 +0,0 @@
-import { PdfJsonDocument, PdfJsonFont } from './pdfTextEditorTypes';
-
-export type FontStatus = 'perfect' | 'embedded-subset' | 'system-fallback' | 'missing' | 'unknown';
-
-export interface FontAnalysis {
-  fontId: string;
-  baseName: string;
-  status: FontStatus;
-  embedded: boolean;
-  isSubset: boolean;
-  isStandard14: boolean;
-  hasWebFormat: boolean;
-  webFormat?: string;
-  subtype?: string;
-  encoding?: string;
-  warnings: string[];
-  suggestions: string[];
-}
-
-export interface DocumentFontAnalysis {
-  fonts: FontAnalysis[];
-  canReproducePerfectly: boolean;
-  hasWarnings: boolean;
-  summary: {
-    perfect: number;
-    embeddedSubset: number;
-    systemFallback: number;
-    missing: number;
-    unknown: number;
-  };
-}
-
-/**
- * Determines if a font name indicates it's a subset font.
- * Subset fonts typically have a 6-character prefix like "ABCDEE+"
- */
-const isSubsetFont = (baseName: string | null | undefined): boolean => {
-  if (!baseName) return false;
-  // Check for common subset patterns: ABCDEF+FontName
-  return /^[A-Z]{6}\+/.test(baseName);
-};
-
-/**
- * Checks if a font is one of the standard 14 PDF fonts that are guaranteed
- * to be available on all PDF readers
- */
-const isStandard14Font = (font: PdfJsonFont): boolean => {
-  if (font.standard14Name) return true;
-
-  const baseName = (font.baseName || '').toLowerCase().replace(/[-_\s]/g, '');
-
-  const standard14Patterns = [
-    'timesroman', 'timesbold', 'timesitalic', 'timesbolditalic',
-    'helvetica', 'helveticabold', 'helveticaoblique', 'helveticaboldoblique',
-    'courier', 'courierbold', 'courieroblique', 'courierboldoblique',
-    'symbol', 'zapfdingbats'
-  ];
-
-  // Check exact matches or if the base name contains the pattern
-  return standard14Patterns.some(pattern => {
-    // Exact match
-    if (baseName === pattern) return true;
-    // Contains pattern (e.g., "ABCDEF+Helvetica" matches "helvetica")
-    if (baseName.includes(pattern)) return true;
-    return false;
-  });
-};
-
-/**
- * Checks if a font has a fallback available on the backend.
- * These fonts are embedded in the Stirling PDF backend and can be used
- * for PDF export even if not in the original PDF.
- *
- * Based on PdfJsonFallbackFontService.java
- */
-const hasBackendFallbackFont = (font: PdfJsonFont): boolean => {
-  const baseName = (font.baseName || '').toLowerCase().replace(/[-_\s]/g, '');
-
-  // Backend has these font families available (from PdfJsonFallbackFontService)
-  const backendFonts = [
-    // Liberation fonts (metric-compatible with MS core fonts)
-    'arial', 'helvetica', 'arimo',
-    'times', 'timesnewroman', 'tinos',
-    'courier', 'couriernew', 'cousine',
-    'liberation', 'liberationsans', 'liberationserif', 'liberationmono',
-    // DejaVu fonts
-    'dejavu', 'dejavusans', 'dejavuserif', 'dejavumono', 'dejavusansmono',
-    // Noto fonts
-    'noto', 'notosans'
-  ];
-
-  return backendFonts.some(pattern => {
-    if (baseName === pattern) return true;
-    if (baseName.includes(pattern)) return true;
-    return false;
-  });
-};
-
-/**
- * Extracts the base font name from a subset font name
- * e.g., "ABCDEF+Arial" -> "Arial"
- */
-const extractBaseFontName = (baseName: string | null | undefined): string | null => {
-  if (!baseName) return null;
-  const match = baseName.match(/^[A-Z]{6}\+(.+)$/);
-  return match ? match[1] : baseName;
-};
-
-/**
- * Analyzes a single font to determine if it can be reproduced perfectly
- * Takes allFonts to check if full versions of subset fonts are available
- */
-export const analyzeFontReproduction = (font: PdfJsonFont, allFonts?: PdfJsonFont[]): FontAnalysis => {
-  const fontId = font.id || font.uid || 'unknown';
-  const baseName = font.baseName || 'Unknown Font';
-  const isSubset = isSubsetFont(font.baseName);
-  const isStandard14 = isStandard14Font(font);
-  const hasBackendFallback = hasBackendFallbackFont(font);
-  const embedded = font.embedded ?? false;
-
-  // Check available web formats (ordered by preference)
-  const webFormats = [
-    { key: 'webProgram', format: font.webProgramFormat },
-    { key: 'pdfProgram', format: font.pdfProgramFormat },
-    { key: 'program', format: font.programFormat },
-  ];
-
-  const availableWebFormat = webFormats.find(f => f.format);
-  const hasWebFormat = !!availableWebFormat;
-  const webFormat = availableWebFormat?.format || undefined;
-
-  const warnings: string[] = [];
-  const suggestions: string[] = [];
-  let status: FontStatus = 'unknown';
-
-  // Check if we have the full font when this is a subset
-  let hasFullFontVersion = false;
-  if (isSubset && allFonts) {
-    const baseFont = extractBaseFontName(font.baseName);
-    if (baseFont) {
-      // Look for a non-subset version of this font with a web format
-      hasFullFontVersion = allFonts.some(f => {
-        const otherBaseName = extractBaseFontName(f.baseName);
-        const isNotSubset = !isSubsetFont(f.baseName);
-        const hasFormat = !!(f.webProgramFormat || f.pdfProgramFormat || f.programFormat);
-        const sameBase = otherBaseName?.toLowerCase() === baseFont.toLowerCase();
-        return sameBase && isNotSubset && hasFormat && (f.embedded ?? false);
-      });
-    }
-  }
-
-  // Analyze font status - focusing on PDF export quality
-  if (isStandard14) {
-    // Standard 14 fonts are always available in PDF readers - perfect for export!
-    status = 'perfect';
-    suggestions.push('Standard PDF font (Times, Helvetica, or Courier). Always available in PDF readers.');
-    suggestions.push('Exported PDFs will render consistently across all PDF readers.');
-  } else if (embedded && !isSubset) {
-    // Perfect: Fully embedded with complete character set
-    status = 'perfect';
-    suggestions.push('Font is fully embedded. Exported PDFs will reproduce text perfectly, even with edits.');
-  } else if (embedded && isSubset && (hasFullFontVersion || hasBackendFallback)) {
-    // Subset but we have the full font or backend fallback - perfect!
-    status = 'perfect';
-    if (hasFullFontVersion) {
-      suggestions.push('Full font version is also available in the document. Exported PDFs can reproduce all characters.');
-    } else if (hasBackendFallback) {
-      suggestions.push('Backend has the full font available. Exported PDFs can reproduce all characters, including new text.');
-    }
-  } else if (embedded && isSubset) {
-    // Good, but subset: May have missing characters if user adds new text
-    status = 'embedded-subset';
-    warnings.push('This is a subset font - only specific characters are embedded in the PDF.');
-    warnings.push('Exported PDFs may have missing characters if you add new text with this font.');
-    suggestions.push('Existing text will export correctly. New characters may render as boxes (☐) or fallback glyphs.');
-  } else if (!embedded && hasBackendFallback) {
-    // Not embedded, but backend has it - perfect for export!
-    status = 'perfect';
-    suggestions.push('Backend has this font available. Exported PDFs will use the backend fallback font.');
-    suggestions.push('Text will export correctly with consistent appearance.');
-  } else if (!embedded) {
-    // Not embedded - must rely on system fonts (risky for export)
-    status = 'missing';
-    warnings.push('Font is not embedded in the PDF.');
-    warnings.push('Exported PDFs will substitute with a fallback font, which may look very different.');
-    suggestions.push('Consider re-embedding fonts or accepting that the exported PDF will use fallback fonts.');
-  } else if (embedded && !hasWebFormat) {
-    // Embedded but no web format available (still okay for export)
-    status = 'perfect';
-    suggestions.push('Font is embedded in the PDF. Exported PDFs will reproduce correctly.');
-    suggestions.push('Web preview may use a fallback font, but the final PDF export will be accurate.');
-  }
-
-  // Additional warnings based on font properties
-  if (font.subtype === 'Type0' && font.cidSystemInfo) {
-    const registry = font.cidSystemInfo.registry || '';
-    const ordering = font.cidSystemInfo.ordering || '';
-    if (registry.includes('Adobe') && (ordering.includes('Identity') || ordering.includes('UCS'))) {
-      // CID fonts with Identity encoding are common for Asian languages
-      if (!embedded || !hasWebFormat) {
-        warnings.push('This CID font may contain Asian or Unicode characters.');
-      }
-    }
-  }
-
-  if (font.encoding && !font.encoding.includes('WinAnsiEncoding') && !font.encoding.includes('MacRomanEncoding')) {
-    // Custom encodings may cause issues
-    if (font.encoding !== 'Identity-H' && font.encoding !== 'Identity-V') {
-      warnings.push(`Custom encoding detected: ${font.encoding}`);
-    }
-  }
-
-  return {
-    fontId,
-    baseName,
-    status,
-    embedded,
-    isSubset,
-    isStandard14,
-    hasWebFormat,
-    webFormat,
-    subtype: font.subtype || undefined,
-    encoding: font.encoding || undefined,
-    warnings,
-    suggestions,
-  };
-};
-
-/**
- * Gets fonts used on a specific page
- */
-export const getFontsForPage = (
-  document: PdfJsonDocument | null,
-  pageIndex: number
-): PdfJsonFont[] => {
-  if (!document?.fonts || !document?.pages || pageIndex < 0 || pageIndex >= document.pages.length) {
-    return [];
-  }
-
-  const page = document.pages[pageIndex];
-  if (!page?.textElements) {
-    return [];
-  }
-
-  // Get unique font IDs used on this page
-  const fontIdsOnPage = new Set<string>();
-  page.textElements.forEach(element => {
-    if (element?.fontId) {
-      fontIdsOnPage.add(element.fontId);
-    }
-  });
-
-  // Filter fonts to only those used on this page
-  const allFonts = document.fonts.filter((font): font is PdfJsonFont => font !== null && font !== undefined);
-
-  const fontsOnPage = allFonts.filter(font => {
-    // Match by ID
-    if (font.id && fontIdsOnPage.has(font.id)) {
-      return true;
-    }
-    // Match by UID
-    if (font.uid && fontIdsOnPage.has(font.uid)) {
-      return true;
-    }
-    // Match by page-specific ID (pageNumber:id format)
-    if (font.pageNumber === pageIndex + 1 && font.id) {
-      const pageSpecificId = `${font.pageNumber}:${font.id}`;
-      if (fontIdsOnPage.has(pageSpecificId) || fontIdsOnPage.has(font.id)) {
-        return true;
-      }
-    }
-    return false;
-  });
-
-  // Deduplicate by base font name to avoid showing the same font multiple times
-  const uniqueFonts = new Map<string, PdfJsonFont>();
-  fontsOnPage.forEach(font => {
-    const baseName = extractBaseFontName(font.baseName) || font.baseName || font.id || 'unknown';
-    const key = baseName.toLowerCase();
-
-    // Keep the first occurrence, or prefer non-subset over subset
-    const existing = uniqueFonts.get(key);
-    if (!existing) {
-      uniqueFonts.set(key, font);
-    } else {
-      // Prefer non-subset fonts over subset fonts
-      const existingIsSubset = isSubsetFont(existing.baseName);
-      const currentIsSubset = isSubsetFont(font.baseName);
-      if (existingIsSubset && !currentIsSubset) {
-        uniqueFonts.set(key, font);
-      }
-    }
-  });
-
-  return Array.from(uniqueFonts.values());
-};
-
-/**
- * Analyzes all fonts in a PDF document (or just fonts for a specific page)
- */
-export const analyzeDocumentFonts = (
-  document: PdfJsonDocument | null,
-  pageIndex?: number
-): DocumentFontAnalysis => {
-  if (!document?.fonts || document.fonts.length === 0) {
-    return {
-      fonts: [],
-      canReproducePerfectly: true,
-      hasWarnings: false,
-      summary: {
-        perfect: 0,
-        embeddedSubset: 0,
-        systemFallback: 0,
-        missing: 0,
-        unknown: 0,
-      },
-    };
-  }
-
-  const allFonts = document.fonts.filter((font): font is PdfJsonFont => font !== null && font !== undefined);
-
-  // Filter to page-specific fonts if pageIndex is provided
-  const fontsToAnalyze = pageIndex !== undefined
-    ? getFontsForPage(document, pageIndex)
-    : allFonts;
-
-  if (fontsToAnalyze.length === 0) {
-    return {
-      fonts: [],
-      canReproducePerfectly: true,
-      hasWarnings: false,
-      summary: {
-        perfect: 0,
-        embeddedSubset: 0,
-        systemFallback: 0,
-        missing: 0,
-        unknown: 0,
-      },
-    };
-  }
-
-  const fontAnalyses = fontsToAnalyze.map(font => analyzeFontReproduction(font, allFonts));
-
-  // Calculate summary
-  const summary = {
-    perfect: fontAnalyses.filter(f => f.status === 'perfect').length,
-    embeddedSubset: fontAnalyses.filter(f => f.status === 'embedded-subset').length,
-    systemFallback: fontAnalyses.filter(f => f.status === 'system-fallback').length,
-    missing: fontAnalyses.filter(f => f.status === 'missing').length,
-    unknown: fontAnalyses.filter(f => f.status === 'unknown').length,
-  };
-
-  // Can reproduce perfectly ONLY if all fonts are truly perfect (not subsets)
-  const canReproducePerfectly = fontAnalyses.every(f => f.status === 'perfect');
-
-  // Has warnings if any font has issues (including subsets)
-  const hasWarnings = fontAnalyses.some(
-    f => f.warnings.length > 0 || f.status === 'missing' || f.status === 'system-fallback' || f.status === 'embedded-subset'
-  );
-
-  return {
-    fonts: fontAnalyses,
-    canReproducePerfectly,
-    hasWarnings,
-    summary,
-  };
-};
-
-/**
- * Gets a human-readable description of the font status
- */
-export const getFontStatusDescription = (status: FontStatus): string => {
-  switch (status) {
-    case 'perfect':
-      return 'Fully embedded - perfect reproduction';
-    case 'embedded-subset':
-      return 'Embedded (subset) - existing text will render correctly';
-    case 'system-fallback':
-      return 'Using system font - appearance may differ';
-    case 'missing':
-      return 'Not embedded - will use fallback font';
-    case 'unknown':
-      return 'Unknown status';
-  }
-};
-
-/**
- * Gets a color indicator for the font status
- */
-export const getFontStatusColor = (status: FontStatus): string => {
-  switch (status) {
-    case 'perfect':
-      return 'green';
-    case 'embedded-subset':
-      return 'blue';
-    case 'system-fallback':
-      return 'yellow';
-    case 'missing':
-      return 'red';
-    case 'unknown':
-      return 'gray';
-  }
-};
-
-/**
- * Gets an icon indicator for the font status
- */
-export const getFontStatusIcon = (status: FontStatus): string => {
-  switch (status) {
-    case 'perfect':
-      return '✓';
-    case 'embedded-subset':
-      return '⚠';
-    case 'system-fallback':
-      return '⚠';
-    case 'missing':
-      return '✗';
-    case 'unknown':
-      return '?';
-  }
-};
@@ -1,232 +0,0 @@
-export interface PdfJsonFontCidSystemInfo {
-  registry?: string | null;
-  ordering?: string | null;
-  supplement?: number | null;
-}
-
-export interface PdfJsonTextColor {
-  colorSpace?: string | null;
-  components?: number[] | null;
-}
-
-export interface PdfJsonCosValue {
-  type?: string | null;
-  value?: unknown;
-  items?: PdfJsonCosValue[] | null;
-  entries?: Record<string, PdfJsonCosValue | null> | null;
-  stream?: PdfJsonStream | null;
-}
-
-export interface PdfJsonFont {
-  id?: string;
-  pageNumber?: number | null;
-  uid?: string | null;
-  baseName?: string | null;
-  color?: string | null;
-  subtype?: string | null;
-  encoding?: string | null;
-  cidSystemInfo?: PdfJsonFontCidSystemInfo | null;
-  embedded?: boolean | null;
-  program?: string | null;
-  programFormat?: string | null;
-  webProgram?: string | null;
-  webProgramFormat?: string | null;
-  pdfProgram?: string | null;
-  pdfProgramFormat?: string | null;
-  toUnicode?: string | null;
-  standard14Name?: string | null;
-  fontDescriptorFlags?: number | null;
-  ascent?: number | null;
-  descent?: number | null;
-  capHeight?: number | null;
-  xHeight?: number | null;
-  italicAngle?: number | null;
-  unitsPerEm?: number | null;
-  cosDictionary?: PdfJsonCosValue | null;
-}
-
-export interface PdfJsonTextElement {
-  text?: string | null;
-  fontId?: string | null;
-  fontSize?: number | null;
-  fontMatrixSize?: number | null;
-  fontSizeInPt?: number | null;
-  characterSpacing?: number | null;
-  wordSpacing?: number | null;
-  spaceWidth?: number | null;
-  zOrder?: number | null;
-  horizontalScaling?: number | null;
-  leading?: number | null;
-  rise?: number | null;
-  renderingMode?: number | null;
-  x?: number | null;
-  y?: number | null;
-  width?: number | null;
-  height?: number | null;
-  textMatrix?: number[] | null;
-  fillColor?: PdfJsonTextColor | null;
-  strokeColor?: PdfJsonTextColor | null;
-  charCodes?: number[] | null;
-  fallbackUsed?: boolean | null;
-}
-
-export interface PdfJsonImageElement {
-  id?: string | null;
-  objectName?: string | null;
-  inlineImage?: boolean | null;
-  nativeWidth?: number | null;
-  nativeHeight?: number | null;
-  x?: number | null;
-  y?: number | null;
-  width?: number | null;
-  height?: number | null;
-  left?: number | null;
-  right?: number | null;
-  top?: number | null;
-  bottom?: number | null;
-  transform?: number[] | null;
-  zOrder?: number | null;
-  imageData?: string | null;
-  imageFormat?: string | null;
-}
-
-export interface PdfJsonStream {
-  dictionary?: Record<string, unknown> | null;
-  rawData?: string | null;
-}
-
-export interface PdfJsonPage {
-  pageNumber?: number | null;
-  width?: number | null;
-  height?: number | null;
-  rotation?: number | null;
-  mediaBox?: number[] | null;
-  cropBox?: number[] | null;
-  textElements?: PdfJsonTextElement[] | null;
-  imageElements?: PdfJsonImageElement[] | null;
-  resources?: unknown;
-  contentStreams?: PdfJsonStream[] | null;
-}
-
-export interface PdfJsonMetadata {
-  title?: string | null;
-  author?: string | null;
-  subject?: string | null;
-  keywords?: string | null;
-  creator?: string | null;
-  producer?: string | null;
-  creationDate?: string | null;
-  modificationDate?: string | null;
-  trapped?: string | null;
-  numberOfPages?: number | null;
-}
-
-export interface PdfJsonDocument {
-  metadata?: PdfJsonMetadata | null;
-  xmpMetadata?: string | null;
-  fonts?: PdfJsonFont[] | null;
-  pages?: PdfJsonPage[] | null;
-  lazyImages?: boolean | null;
-}
-
-export interface PdfJsonPageDimension {
-  pageNumber?: number | null;
-  width?: number | null;
-  height?: number | null;
-  rotation?: number | null;
-}
-
-export interface PdfJsonDocumentMetadata {
-  metadata?: PdfJsonMetadata | null;
-  xmpMetadata?: string | null;
-  fonts?: PdfJsonFont[] | null;
-  pageDimensions?: PdfJsonPageDimension[] | null;
-  formFields?: unknown[] | null;
-  lazyImages?: boolean | null;
-}
-
-export interface BoundingBox {
-  left: number;
-  right: number;
-  top: number;
-  bottom: number;
-}
-
-export interface TextGroup {
-  id: string;
-  pageIndex: number;
-  fontId?: string | null;
-  fontSize?: number | null;
-  fontMatrixSize?: number | null;
-  lineSpacing?: number | null;
-  lineElementCounts?: number[] | null;
-  color?: string | null;
-  fontWeight?: number | 'normal' | 'bold' | null;
-  rotation?: number | null;
-  anchor?: { x: number; y: number } | null;
-  baselineLength?: number | null;
-  baseline?: number | null;
-  elements: PdfJsonTextElement[];
-  originalElements: PdfJsonTextElement[];
-  text: string;
-  originalText: string;
-  bounds: BoundingBox;
-  childLineGroups?: TextGroup[] | null;
-}
-
-export const DEFAULT_PAGE_WIDTH = 612;
-export const DEFAULT_PAGE_HEIGHT = 792;
-
-export interface ConversionProgress {
-  percent: number;
-  stage: string;
-  message: string;
-  current?: number;
-  total?: number;
-}
-
-export interface PdfTextEditorViewData {
-  document: PdfJsonDocument | null;
-  groupsByPage: TextGroup[][];
-  imagesByPage: PdfJsonImageElement[][];
-  pagePreviews: Map<number, string>;
-  selectedPage: number;
-  dirtyPages: boolean[];
-  hasDocument: boolean;
-  hasVectorPreview: boolean;
-  fileName: string;
-  errorMessage: string | null;
-  isGeneratingPdf: boolean;
-  isConverting: boolean;
-  conversionProgress: ConversionProgress | null;
-  hasChanges: boolean;
-  forceSingleTextElement: boolean;
-  groupingMode: 'auto' | 'paragraph' | 'singleLine';
-  requestPagePreview: (pageIndex: number, scale: number) => void;
-  onSelectPage: (pageIndex: number) => void;
-  onGroupEdit: (pageIndex: number, groupId: string, value: string) => void;
-  onGroupDelete: (pageIndex: number, groupId: string) => void;
-  onImageTransform: (
-    pageIndex: number,
-    imageId: string,
-    next: {
-      left: number;
-      bottom: number;
-      width: number;
-      height: number;
-      transform: number[];
-    },
-  ) => void;
-  onImageReset: (pageIndex: number, imageId: string) => void;
-  onReset: () => void;
-  onDownloadJson: () => void;
-  onGeneratePdf: () => void;
-  onGeneratePdfForNavigation: () => Promise<void>;
-  onSaveToWorkbench: () => Promise<void>;
-  isSavingToWorkbench: boolean;
-  onForceSingleTextElementChange: (value: boolean) => void;
-  onGroupingModeChange: (value: 'auto' | 'paragraph' | 'singleLine') => void;
-  onMergeGroups: (pageIndex: number, groupIds: string[]) => boolean;
-  onUngroupGroup: (pageIndex: number, groupId: string) => boolean;
-  onLoadFile: (file: File) => void;
-}
@@ -1,98 +0,0 @@
-import { useRef, useEffect, useState } from 'react'
-
-interface AudioWaveformProps {
-  waveformHistory: number[][]
-  isActive: boolean
-}
-
-export function AudioWaveform({ waveformHistory, isActive }: AudioWaveformProps) {
-  const containerRef = useRef<HTMLDivElement>(null)
-  const [maxColumns, setMaxColumns] = useState(150)
-  
-  // Measure container and calculate how many columns fit
-  useEffect(() => {
-    if (!containerRef.current) return
-    
-    const updateMaxColumns = () => {
-      if (!containerRef.current) return
-      const width = containerRef.current.offsetWidth
-      // Each column is 2px + 2px gap = 4px effective width
-      const cols = Math.floor(width / 4)
-      setMaxColumns(Math.max(cols, 50)) // minimum 50 columns
-    }
-    
-    updateMaxColumns()
-    
-    const resizeObserver = new ResizeObserver(updateMaxColumns)
-    resizeObserver.observe(containerRef.current)
-    
-    return () => resizeObserver.disconnect()
-  }, [])
-  
-  if (!isActive) return null
-
-  // Use history if available, otherwise show placeholder
-  const columns = waveformHistory || []
-  
-  // Only take exactly what fits
-  const visibleColumns = columns.slice(-maxColumns)
-  
-  // Pad with empty columns at the start if we don't have enough history
-  const paddingCount = Math.max(0, maxColumns - visibleColumns.length)
-
-  return (
-    <div ref={containerRef} className="flex items-center h-6 w-full">
-      <div className="flex items-center gap-0.5 w-full">
-        {/* Padding columns (empty/minimal) */}
-        {Array(paddingCount).fill(0).map((_, i) => (
-          <div
-            key={`pad-${i}`}
-            className="flex flex-col items-center justify-center gap-0.5 flex-shrink-0"
-            style={{ width: '2px', minWidth: '2px' }}
-          >
-            {Array(10).fill(0).map((_, bandIndex) => (
-              <div
-                key={bandIndex}
-                className="w-full bg-blue-400/20 rounded-full"
-                style={{ height: '1px', minHeight: '1px' }}
-              />
-            ))}
-          </div>
-        ))}
-        
-        {/* Actual waveform columns */}
-        {visibleColumns.map((column, colIndex) => {
-          const numBands = 10
-          const step = Math.floor(column.length / numBands)
-          const bands = []
-          for (let i = 0; i < numBands; i++) {
-            const index = Math.min(i * step, column.length - 1)
-            bands.push(column[index])
-          }
-          
-          return (
-            <div
-              key={`col-${colIndex}`}
-              className="flex flex-col items-center justify-center gap-0.5 flex-shrink-0"
-              style={{ width: '2px', minWidth: '2px' }}
-            >
-              {bands.map((level, bandIndex) => {
-                const height = Math.max(1, level * 20)
-                return (
-                  <div
-                    key={bandIndex}
-                    className="w-full bg-blue-400 rounded-full"
-                    style={{
-                      height: `${height}px`,
-                      minHeight: '1px',
-                    }}
-                  />
-                )
-              })}
-            </div>
-          )
-        })}
-      </div>
-    </div>
-  )
-}
@@ -1,32 +0,0 @@
-import { ButtonHTMLAttributes } from 'react'
-
-type ButtonVariant = 'primary' | 'secondary' | 'ghost' | 'danger' | 'accent'
-type ButtonSize = 'sm' | 'md' | 'lg' | 'icon'
-
-interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
-  variant?: ButtonVariant
-  size?: ButtonSize
-}
-
-const base =
-  'inline-flex items-center justify-center rounded-lg font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:ring-blue-500 focus-visible:ring-offset-slate-950 disabled:opacity-50 disabled:cursor-not-allowed'
-
-const variantStyles: Record<ButtonVariant, string> = {
-  primary: 'bg-blue-600 hover:bg-blue-500 text-white',
-  secondary: 'bg-slate-800 hover:bg-slate-700 text-slate-100 border border-slate-700',
-  ghost: 'bg-transparent hover:bg-slate-900 text-slate-300 border border-transparent',
-  danger: 'bg-rose-600 hover:bg-rose-500 text-white',
-  accent: 'bg-emerald-600 hover:bg-emerald-500 text-white',
-}
-
-const sizeStyles: Record<ButtonSize, string> = {
-  sm: 'text-xs px-3 py-1.5',
-  md: 'text-sm px-4 py-2',
-  lg: 'text-base px-5 py-3',
-  icon: 'p-2',
-}
-
-export function Button({ variant = 'primary', size = 'md', className = '', ...props }: ButtonProps) {
-  const classes = [base, variantStyles[variant], sizeStyles[size], className].filter(Boolean).join(' ')
-  return <button className={classes} {...props} />
-}
@@ -1,11 +0,0 @@
-import { PropsWithChildren } from 'react'
-
-interface ButtonGroupProps extends PropsWithChildren {
-  align?: 'start' | 'center' | 'end'
-}
-
-export function ButtonGroup({ children, align = 'start' }: ButtonGroupProps) {
-  const alignment =
-    align === 'center' ? 'justify-center' : align === 'end' ? 'justify-end' : 'justify-start'
-  return <div className={`flex flex-wrap gap-2 ${alignment}`}>{children}</div>
-}
--- a/Show More
+++ b/Show More