revert

.claude/settings.local.json

@@ -0,0 +1,12 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(chmod:*)",
+      "Bash(mkdir:*)",
+      "Bash(./gradlew:*)",
+      "Bash(grep:*)",
+      "Bash(cat:*)"
+    ],
+    "deny": []
+  }
+}

.claude/skills/feature-walkthrough/SKILL.md

@@ -1,97 +0,0 @@
----
-name: feature-walkthrough
-description: >-
-  Explain the full logic and process of the current branch end-to-end so someone
-  with no prior knowledge of the task can understand, review, and reproduce it.
-  Scopes the change from the branch diff, traces the flow across every layer it
-  touches (frontend tool/hook/component, Java controller/service/endpoint, Python
-  engine, config, i18n, tests), and produces a self-contained walkthrough document
-  with Mermaid diagrams (sequence/flow/architecture), annotated file map with
-  clickable references, before/after behavior, screenshots where a UI is involved,
-  a "try it locally" section, and edge cases/risks. Use when asked for a feature or
-  branch walkthrough, "explain what this branch does", a design/logic writeup, PR
-  reviewer onboarding, or a hand-off doc. Pass --html to also emit a rendered HTML
-  version; --no-screens to skip screenshots.
-argument-hint: "[branch-or-area] [--html] [--no-screens]"
-allowed-tools: Read, Write, Edit, Glob, Grep, Bash
----
-
-# Feature / Branch Walkthrough
-
-Turn the current branch into a walkthrough a newcomer can follow. Audience:
-**someone who has never seen this task**. Explain the *why*, the *flow*, and *how to
-try it* - not just a diff summary.
-
-`$ARGUMENTS` may name a branch or area to focus on; default is the current branch
-vs `main`. Flags: `--html` (also emit a rendered HTML twin), `--no-screens`.
-
-## Process
-
-### 1. Scope the change
-- `git log --oneline main..HEAD` and `git diff --stat main...HEAD` for the shape.
-- Read the PR description / commit messages for stated intent. Do **not** invent
-  history or motivation that isn't evidenced (state current behavior in present tense).
-- Classify touched files by layer:
-  - **Frontend**: tools (`frontend/editor/src/core/components/tools/*` or `.../core/tools/*`),
-    hooks (`core/hooks/tools/*`, `useToolOperation`), contexts, routes, i18n
-    (`public/locales/en-US`).
-  - **Java backend**: controllers (`.../controller/api/...`), services, models, config.
-  - **Engine**: `engine/src/stirling/{agents,contracts,api,services}`.
-  - **Config / build / docker / tests.**
-
-### 2. Trace the flow end-to-end
-Follow one real path from user action to result. For a typical PDF tool that's:
-UI control → `useToolOperation` hook → `POST /api/v1/...` → Spring controller →
-service (PDFBox / LibreOffice / engine call) → response → review panel → download.
-Read the actual files so the narrative is true to the code, and collect the exact
-file:line anchors you'll cite.
-
-### 3. Draw the diagrams (Mermaid)
-Pick what fits; usually 2-3 of:
-- **Sequence diagram** - request/response across frontend → backend → engine.
-- **Flowchart** - the core decision/branching logic of the feature.
-- **Architecture/component** - new pieces and how they wire to existing ones.
-- **State** - if the feature has modes/steps.
-Keep nodes labeled in plain language. Validate the Mermaid parses before shipping.
-
-### 4. Screenshots (unless --no-screens)
-If a UI is involved, capture key states with the stubbed Playwright harness
-(see the **ui-walkthrough** skill and `files-page-screenshots.spec.ts` for the
-pattern) or, for before/after, capture `main` then the branch. Drop PNGs in
-`walkthrough/<feature>/` and reference them from the doc. For backend-only
-changes, show request/response examples (curl + JSON) instead.
-
-### 5. Write the walkthrough
-Create `walkthrough/<feature>/FEATURE-WALKTHROUGH.md` with:
-1. **TL;DR** - what the branch does and who it's for, in 3-4 sentences.
-2. **Problem & approach** - what wasn't possible before; the chosen solution.
-3. **Architecture diagram** + 1-paragraph orientation.
-4. **End-to-end flow** - the sequence diagram + a numbered walk of each step,
-   each citing the real file (clickable `path:line`).
-5. **Key files** - annotated map (path → one line on its role).
-6. **Logic deep-dive** - the flowchart + prose for the non-obvious decisions.
-7. **Behavior** - before vs after; screenshots or request/response examples.
-8. **Try it locally** - exact steps (`task dev` / `task dev:all`, the route to
-   open or the curl to run, any env like `DOCKER_ENABLE_SECURITY` or a test
-   license key). Make it copy-pasteable.
-9. **Edge cases, risks, follow-ups** - what's untested, known limits, gotchas.
-
-Markdown is the primary deliverable - it renders with diagrams in GitHub PRs and
-IDEs, no build step, ideal for review.
-
-### 6. If `--html`
-Also emit `walkthrough/<feature>/walkthrough.html`: the same content with Mermaid
-rendered via `mermaid.initialize({startOnLoad:true})` (script from CDN; note in
-the file that rendering diagrams needs network, the `.md` is the offline copy) and
-screenshots inline. Keep it self-contained otherwise.
-
-### 7. Deliver
-Give the doc path and a short chat summary. Offer to `SendUserFile` it.
-
-## Principles
-- **True to the code.** Every claim traces to a file you read; cite `path:line`.
-  No fabricated migration/version history.
-- **Newcomer-first.** Define repo-specific terms (FileContext, `useToolOperation`,
-  the `@app/*` layer cascade, stubbed vs live tests) on first use.
-- **Show, don't assert.** Prefer a diagram + a real example over adjectives.
-- Don't commit the `walkthrough/` output unless asked.

.claude/skills/ui-before-after/SKILL.md

@@ -1,122 +0,0 @@
----
-name: ui-before-after
-description: >-
-  Analyse a branch or PR and automatically capture before/after screenshots of
-  every UI surface its changes touch, then pixel-diff the pairs to surface what
-  actually changed and assemble PR-ready before/after montage images. Generic and
-  diff-driven: it derives the capture targets from the diff (changed tools/routes →
-  URLs) instead of hand-listing screens, captures "before" from the base branch and
-  "after" from the head, then keeps only the views that visually differ. Each
-  comparison is auto-cropped to the region that actually changed (the bounding box of
-  differing pixels), falling back to the full page only when the change spans most of
-  it. Use for before/after shots, a visual diff of a branch/PR, "screenshots for the
-  PR description", "show what changed in the UI", or a side-by-side of UI changes.
-  Takes a PR number/URL (resolved via gh) or a branch; defaults to the current branch
-  vs its base. Flags: --scope <selector>, --base <ref|merge-base>, --theme
-  light|dark|both, --all (capture every route, not just changed), --no-autocrop,
-  --pagewide <n>, --threshold <n>.
-argument-hint: "[PR# | PR-url | branch] [--scope <sel>] [--base <ref>] [--theme both] [--all] [--no-autocrop]"
-allowed-tools: Read, Write, Edit, Glob, Grep, Bash
----
-
-# UI Before / After (generic visual diff)
-
-Point it at a branch or PR; it figures out which UI changed, screenshots every
-affected surface **before** (base) and **after** (head), pixel-diffs the pairs, and
-montages the ones that actually changed into images for the PR description.
-
-`$ARGUMENTS`: a PR number/URL, a branch, or nothing (current branch vs base).
-By default it captures the full viewport and auto-crops each comparison to the region
-that changed. Flags: `--scope <css>` (narrow the *capture* to a container, e.g.
-`[data-sidebar="tool-panel"]`, when you already know where the change is),
-`--no-autocrop` (keep full frames), `--pagewide <fraction>` (above this share of the
-page, skip cropping; default 0.6), `--base <ref|merge-base>`,
-`--theme light|dark|both`, `--all` (walk every route, not just changed),
-`--threshold <fraction>` (diff sensitivity, default 0.001).
-
-Shares the capture harness with **ui-walkthrough** - read its SKILL.md for the
-stubbed-Playwright setup, worktree node_modules + `generate-icons`, the
-stale-`:5173` gotcha, and the dark-mode init-script. Bundled helpers:
-[capture-spec.template.ts](capture-spec.template.ts), [diff-shots.mjs](diff-shots.mjs),
-[montage-template.html](montage-template.html), [shoot-sections.mjs](shoot-sections.mjs).
-
-## Process
-
-### 1. Resolve target + base
-```
-gh pr view <pr> --json number,title,headRefName,baseRefName,url,files   # PR
-# or branch: base = merge-base(main, HEAD); head = HEAD
-gh pr diff <pr> --name-only        # or: git diff --name-only <base>...HEAD
-```
-
-### 2. Derive capture targets from the diff (the "analyse" step - no hand-listing)
-Map changed frontend files to URLs generically:
-- **Tools**: a changed `components/tools/<toolDir>/…` or `hooks/tools/<tool>/…` →
-  toolId → URL via the repo's own rule `getToolUrlPath` in
-  [toolsTaxonomy.ts:200](frontend/editor/src/core/data/toolsTaxonomy.ts): `/` + the
-  id kebab-cased (`addPageNumbers` → `/add-page-numbers`).
-- **Pages/routes**: changed `filesPage/*` → `/files`, etc.
-- `--all`: enumerate every tool in the registry instead of just changed ones.
-Write `frontend/editor/screenshots/ui-diff/targets.json` =
-`[{ "id":"compress", "url":"/compress", "name":"Compress" }]`. This is what makes
-it generic - the spec never names a tool.
-
-### 3. Capture AFTER (head) then BEFORE (base)
-Copy [capture-spec.template.ts](capture-spec.template.ts) →
-`src/core/tests/stubbed/ui-before-after.spec.ts` (it loops `targets.json`, seeds a
-sample PDF so file-dependent panels render, navigates to each URL, and screenshots
-the full viewport - or the `--scope` container if given). Ensure the harness is ready
-(node_modules + icons).
-```
-# after = current head
-cd frontend/editor && PR_SHOT_SIDE=after PR_SHOT_THEME=light \
-  npx playwright test --project=stubbed ui-before-after.spec.ts
-# before = base, in an isolated worktree (copy the spec + targets.json in)
-git worktree add ../ba-base origin/<baseRefName>        # or the merge-base
-#   set up its frontend, copy spec + screenshots/ui-diff/targets.json across, then:
-cd ../ba-base/frontend/editor && PR_SHOT_SIDE=before PR_SHOT_THEME=light \
-  npx playwright test --project=stubbed ui-before-after.spec.ts
-#   copy its screenshots/ui-diff/before/ back next to after/. Repeat with
-#   PR_SHOT_THEME=dark if --theme includes dark. Remove worktree when done.
-```
-
-### 4. Auto-diff (surface what changed)
-```
-cd frontend/editor && node <skill>/diff-shots.mjs \
-  screenshots/ui-diff/before screenshots/ui-diff/after screenshots/ui-diff
-```
-Produces `diff-report.json` classifying each view `unchanged | changed | added |
-removed`. For each changed view it computes the bounding box of differing pixels and
-writes cropped `__before_crop.png` / `__after_crop.png` / `__diff.png` to that region
-(+ padding) - **unless** the change covers more than `--pagewide` of the frame, where
-it keeps the full frame (`pageWide:true`). Drop `unchanged` - that's the noise the
-user doesn't want.
-
-### 5. Montage the changes
-Build the manifest from the non-unchanged entries (group by tab/tool; each becomes a
-state row with before/after). For changed views use the cropped `cropBefore` /
-`cropAfter` from `diff-report.json` (tight on the affected region; full frame when
-`pageWide`); `added`/`removed` render the "not present" placeholder. Fill
-[montage-template.html](montage-template.html) (replace the `window.__BA__` data
-block; base64-inline the PNGs for portability), then render one PNG per section with
-[shoot-sections.mjs](shoot-sections.mjs). Optionally include the `__diff.png` overlay
-as a third column.
-
-### 6. Deliver
-Output the `montage_<tab>.png` files + a short summary (N changed / added / removed,
-M unchanged skipped) and a paste-ready Markdown block. GitHub has no PR-body image
-API, so tell the user to drag the PNGs into the description. Do **not** post to the
-PR.
-
-## Gotchas
-- Two installs (base worktree + head); junction main's node_modules only if its deps
-  match that ref, else `npm ci` (see ui-walkthrough's stale-dep note).
-- A view that errors on one side (refactored/removed) → that side is missing; the
-  diff marks it added/removed rather than failing the run.
-- Pixel diff needs equal dimensions, so capture at a fixed viewport (the template
-  does); a view whose size changed is reported as "changed (dimensions differ)",
-  uncropped.
-- Auto-crop uses a single bounding box, so two far-apart changes give one large crop
-  (or trip `--pagewide`); narrow with `--scope` if that happens.
-- `getToolUrlPath` is the source of truth for tool URLs - use it, don't guess slugs.
-- Don't commit `screenshots/`, the throwaway spec, or the base worktree.

.claude/skills/ui-before-after/capture-spec.template.ts

@@ -1,67 +0,0 @@
-// Generic before/after capturer. NOT app-specific: it walks a targets.json that
-// the ui-before-after skill generates from the branch/PR diff, so nothing here is
-// hand-listed. Copy to src/core/tests/stubbed/ui-before-after.spec.ts, then run
-// once per (side, theme):
-//   PR_SHOT_SIDE=after  PR_SHOT_THEME=light \
-//     npx playwright test --project=stubbed ui-before-after.spec.ts
-//
-// targets.json shape: [{ "id":"compress", "url":"/compress", "name":"Compress",
-//                        "needsFile": true }]
-import { test } from "@app/tests/helpers/stub-test-base";
-import type { Page } from "@playwright/test";
-import fs from "node:fs";
-import path from "node:path";
-
-const SIDE = process.env.PR_SHOT_SIDE ?? "after";
-const THEME = process.env.PR_SHOT_THEME ?? "light";
-// Capture the full viewport by default so the affected region is in frame
-// wherever it is; diff-shots.mjs crops each comparison to what actually changed.
-// Set PR_SHOT_SCOPE to a selector to narrow the capture to one container.
-const SCOPE = process.env.PR_SHOT_SCOPE ?? "";
-const ROOT = path.resolve(process.cwd(), "screenshots", "ui-diff");
-const OUT = path.join(ROOT, SIDE);
-// A tiny sample PDF so file-dependent tool panels render. Point at a real fixture.
-const SAMPLE_PDF = process.env.PR_SHOT_SAMPLE ?? "src/core/tests/test-fixtures/sample.pdf";
-
-type Target = { id: string; url: string; name?: string; needsFile?: boolean };
-const targets: Target[] = JSON.parse(fs.readFileSync(path.join(ROOT, "targets.json"), "utf-8"));
-
-test.use({ autoGoto: false, viewport: { width: 1600, height: 900 }, seedJwt: true });
-
-async function applyTheme(page: Page): Promise<void> {
-  if (THEME !== "dark") return;
-  await page.addInitScript(() => {
-    localStorage.setItem("mantine-color-scheme", "dark");
-    localStorage.setItem("mantine-color-scheme-value", "dark");
-  });
-  await page.emulateMedia({ colorScheme: "dark" });
-}
-
-async function seedFile(page: Page): Promise<void> {
-  if (!fs.existsSync(SAMPLE_PDF)) return;
-  await page.goto("/", { waitUntil: "domcontentloaded" });
-  await page.getByTestId("files-button").click().catch(() => {});
-  await page.locator('[data-testid="file-input"]').setInputFiles(SAMPLE_PDF).catch(() => {});
-  await page.locator(".file-sidebar-file-item").first().isVisible({ timeout: 8_000 }).catch(() => {});
-}
-
-for (const t of targets) {
-  // One test per target so a single failure doesn't drop the rest.
-  test(`${SIDE}/${THEME} ${t.id}`, async ({ page }) => {
-    fs.mkdirSync(OUT, { recursive: true });
-    await applyTheme(page);
-    if (t.needsFile !== false) await seedFile(page);
-    await page.goto(t.url, { waitUntil: "domcontentloaded" });
-    await page.waitForTimeout(400); // settle Mantine portals/transitions
-    const shot = path.join(OUT, `${t.id}__${THEME}.png`);
-    if (SCOPE) {
-      const scope = page.locator(SCOPE).first();
-      if (await scope.isVisible({ timeout: 8_000 }).catch(() => false)) {
-        await scope.screenshot({ path: shot });
-        return;
-      }
-    }
-    // Full viewport (fixed size → stable dimensions for pixel diffing).
-    await page.screenshot({ path: shot });
-  });
-}

.claude/skills/ui-before-after/diff-shots.mjs

@@ -1,106 +0,0 @@
-// Auto-diff before/ vs after/ screenshots, classify each as
-// unchanged | changed | added | removed, and CROP each changed pair to the
-// affected region (bounding box of differing pixels + padding) - unless the
-// change spans most of the page, in which case the full frame is kept.
-// Run from frontend/editor (so deps resolve):
-//   node <skill>/diff-shots.mjs <beforeDir> <afterDir> [outDir]
-// Env:
-//   DIFF_THRESHOLD  min fraction of differing pixels to count as changed (default 0.001)
-//   DIFF_PAD        padding px around the affected region (default 24)
-//   DIFF_PAGEWIDE   if affected bbox area / image area exceeds this, keep full frame (default 0.6)
-import fs from "node:fs";
-import path from "node:path";
-import { createRequire } from "node:module";
-
-const require = createRequire(path.join(process.cwd(), "noop.js"));
-const pm = require("pixelmatch");
-const pixelmatch = pm.default || pm;
-const { PNG } = require("pngjs");
-
-const beforeDir = path.resolve(process.argv[2]);
-const afterDir = path.resolve(process.argv[3]);
-const outDir = path.resolve(process.argv[4] || afterDir);
-const THRESHOLD = Number(process.env.DIFF_THRESHOLD ?? "0.001");
-const PAD = Number(process.env.DIFF_PAD ?? "24");
-const PAGEWIDE = Number(process.env.DIFF_PAGEWIDE ?? "0.6");
-
-const read = (p) => PNG.sync.read(fs.readFileSync(p));
-const isShot = (f) => f.endsWith(".png") && !/__(diff|before_crop|after_crop)\.png$/.test(f);
-const list = (d) => (fs.existsSync(d) ? fs.readdirSync(d).filter(isShot) : []);
-const names = [...new Set([...list(beforeDir), ...list(afterDir)])].sort();
-fs.mkdirSync(outDir, { recursive: true });
-
-function cropPNG(src, x, y, w, h) {
-  const out = new PNG({ width: w, height: h });
-  PNG.bitblt(src, out, x, y, w, h, 0, 0);
-  return out;
-}
-const writePNG = (p, png) => fs.writeFileSync(p, PNG.sync.write(png));
-
-// Bounding box of differing pixels using a diff mask (alpha>0 where changed).
-function changedBBox(before, after, w, h) {
-  const mask = new PNG({ width: w, height: h });
-  pixelmatch(before.data, after.data, mask.data, w, h, { threshold: 0.1, diffMask: true });
-  let minX = w, minY = h, maxX = -1, maxY = -1, count = 0;
-  for (let y = 0; y < h; y++) {
-    for (let x = 0; x < w; x++) {
-      if (mask.data[(y * w + x) * 4 + 3] > 0) {
-        count++;
-        if (x < minX) minX = x; if (x > maxX) maxX = x;
-        if (y < minY) minY = y; if (y > maxY) maxY = y;
-      }
-    }
-  }
-  return maxX < 0 ? null : { minX, minY, maxX, maxY, count };
-}
-
-const report = [];
-for (const name of names) {
-  const id = name.replace(/\.png$/, "");
-  const bp = path.join(beforeDir, name), ap = path.join(afterDir, name);
-  const hasB = fs.existsSync(bp), hasA = fs.existsSync(ap);
-  if (hasB && !hasA) { report.push({ id, status: "removed", before: bp }); continue; }
-  if (!hasB && hasA) { report.push({ id, status: "added", after: ap }); continue; }
-
-  const before = read(bp), after = read(ap);
-  if (before.width !== after.width || before.height !== after.height) {
-    report.push({ id, status: "changed", note: "dimensions differ", before: bp, after: ap });
-    continue;
-  }
-  const w = after.width, h = after.height;
-  const overlay = new PNG({ width: w, height: h });
-  const px = pixelmatch(before.data, after.data, overlay.data, w, h, { threshold: 0.1 });
-  const ratio = px / (w * h);
-  if (ratio <= THRESHOLD) { report.push({ id, status: "unchanged", ratio: Number(ratio.toFixed(5)), before: bp, after: ap }); continue; }
-
-  const box = changedBBox(before, after, w, h);
-  // Pad + clamp the affected region.
-  const x = Math.max(0, box.minX - PAD), y = Math.max(0, box.minY - PAD);
-  const x2 = Math.min(w, box.maxX + 1 + PAD), y2 = Math.min(h, box.maxY + 1 + PAD);
-  const bw = x2 - x, bh = y2 - y;
-  const pageWide = (bw * bh) / (w * h) > PAGEWIDE;
-
-  const entry = { id, status: "changed", ratio: Number(ratio.toFixed(5)), before: bp, after: ap, pageWide };
-  if (pageWide) {
-    // Change spans most of the page - keep the full frame, full overlay.
-    const dp = path.join(outDir, `${id}__diff.png`); writePNG(dp, overlay);
-    entry.diff = dp;
-  } else {
-    entry.bbox = { x, y, w: bw, h: bh };
-    const cb = path.join(outDir, `${id}__before_crop.png`); writePNG(cb, cropPNG(before, x, y, bw, bh));
-    const ca = path.join(outDir, `${id}__after_crop.png`); writePNG(ca, cropPNG(after, x, y, bw, bh));
-    const dp = path.join(outDir, `${id}__diff.png`); writePNG(dp, cropPNG(overlay, x, y, bw, bh));
-    entry.cropBefore = cb; entry.cropAfter = ca; entry.diff = dp;
-  }
-  report.push(entry);
-}
-
-fs.writeFileSync(path.join(outDir, "diff-report.json"), JSON.stringify(report, null, 2));
-const changed = report.filter((r) => r.status !== "unchanged");
-console.log(`diffed ${report.length} view(s): ${changed.length} changed/added/removed, ${report.length - changed.length} unchanged`);
-for (const r of changed) {
-  const tail = r.status !== "changed" ? ""
-    : r.pageWide ? " (page-wide → full frame)"
-    : ` (${(r.ratio * 100).toFixed(2)}%, cropped to ${r.bbox.w}×${r.bbox.h})`;
-  console.log(`  ${r.status.padEnd(9)} ${r.id}${tail}${r.note ? " - " + r.note : ""}`);
-}

.claude/skills/ui-before-after/make_example.py

@@ -1,48 +0,0 @@
-"""Build EXAMPLE.html from montage-template.html using REAL files-page shots as
-stand-in before/after pairs (layout demo, not an actual PR diff). Inlines PNGs as
-data URIs so the HTML is portable. Run: python make_example.py"""
-import base64
-import json
-import pathlib
-import re
-
-HERE = pathlib.Path(__file__).parent
-SHOTS = pathlib.Path(
-    r"C:\Users\systo\git\Stirling-PDFNew\.claude\worktrees\kind-faraday-522a30"
-    r"\frontend\editor\screenshots\files-page"
-)
-
-
-def uri(fname):
-    p = SHOTS / fname
-    return "data:image/png;base64," + base64.b64encode(p.read_bytes()).decode() if p.exists() else None
-
-
-data = {
-    "pr": "DEMO",
-    "title": "EXAMPLE — before/after montage (layout demo, real Files-page shots; not a real PR diff)",
-    "base": "main", "head": "demo-branch",
-    "cropSelector": "[data-sidebar=\"tool-panel\"]  (real runs crop to the side; these demo shots are full-page)",
-    "tabs": [
-        {"id": "files", "title": "Files page", "ctx": "Each row = one flow state; left = base branch, right = this PR.",
-         "states": [
-             {"name": "Empty folder", "before": uri("01_empty_state_ctas.png"), "after": uri("02_empty_state_storage_off.png")},
-             {"name": "Files + details panel", "before": uri("03_subtoolbar_with_files.png"), "after": uri("06_details_panel_save_to_server.png")},
-             {"name": "Delete folder confirm", "before": None, "after": uri("19_delete_folder_dialog.png"), "note": "New in this PR"},
-         ]},
-        {"id": "move", "title": "Move-to-folder dialog",
-         "states": [
-             {"name": "Dialog opened", "before": uri("07_move_dialog_collapsed.png"), "after": uri("08_move_dialog_create_folder_expanded.png")},
-             {"name": "After folder created", "before": None, "after": uri("08b_move_dialog_after_create_folder.png"), "note": "New flow"},
-         ]},
-    ],
-}
-
-tpl = (HERE / "montage-template.html").read_text(encoding="utf-8")
-out = re.sub(
-    r"/\*__DATA__\*/.*?/\*__END__\*/",
-    lambda _m: "/*__DATA__*/" + json.dumps(data) + "/*__END__*/",
-    tpl, count=1, flags=re.S,
-)
-(HERE / "EXAMPLE.html").write_text(out, encoding="utf-8")
-print("wrote", HERE / "EXAMPLE.html", "(", (HERE / "EXAMPLE.html").stat().st_size // 1024, "KB )")

.claude/skills/ui-before-after/montage-template.html

@@ -1,106 +0,0 @@
-<!doctype html>
-<!--
-  Before/After montage for a PR description. The ui-before-after skill replaces
-  the JSON in the window.__BA__ data block below with the captured manifest, then
-  screenshots each .tab-section (id="section-<tabId>") into a PNG to drag into the
-  PR description. Self-contained; images may be relative paths or data URIs.
-
-  Data shape:
-  {
-    "pr":"6552","title":"...","base":"main","head":"feat/x",
-    "cropSelector":"[data-sidebar=\"tool-panel\"]",
-    "tabs":[
-      { "id":"sign","title":"Sign tool","states":[
-        {"name":"Initial","before":"before/sign__initial.png","after":"after/sign__initial.png"},
-        {"name":"Cert selected","before":null,"after":"after/sign__cert.png","note":"New in this PR"}
-      ]}
-    ]
-  }
--->
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<title>Before / After</title>
-<style>
-  :root { --bg:#ffffff; --ink:#0b0c0e; --muted:#6b7280; --line:#e5e7eb;
-          --before:#6b7280; --after:#1f883d; --frame:#f3f4f6; --note:#b45309; }
-  * { box-sizing: border-box; }
-  body { margin:0; background:var(--bg); color:var(--ink);
-         font:14px/1.5 -apple-system,"Segoe UI",Roboto,system-ui,sans-serif; }
-  .wrap { max-width:1100px; margin:0 auto; padding:24px; }
-  .doc-head { margin-bottom:8px; }
-  .doc-head h1 { font-size:18px; margin:0 0 2px; }
-  .doc-head .sub { color:var(--muted); font-size:12.5px; }
-  .legend { display:flex; gap:14px; align-items:center; margin:10px 0 4px; font-size:12px; color:var(--muted); }
-  .chip { font-size:10px; font-weight:700; letter-spacing:.04em; text-transform:uppercase;
-          padding:2px 8px; border-radius:999px; color:#fff; }
-  .chip.before { background:var(--before); } .chip.after { background:var(--after); }
-
-  .tab-section { border:1px solid var(--line); border-radius:14px; padding:18px 18px 8px;
-                 margin:18px 0; background:var(--bg); }
-  .tab-section > h2 { font-size:16px; margin:0 0 2px; }
-  .tab-section > .ctx { color:var(--muted); font-size:12px; margin-bottom:14px; }
-  .state { margin-bottom:18px; }
-  .state .name { font-weight:600; font-size:13.5px; margin-bottom:8px; display:flex; gap:8px; align-items:center; }
-  .state .name .note { font-weight:500; color:var(--note); font-size:12px; }
-  .pair { display:grid; grid-template-columns:1fr 1fr; gap:14px; align-items:start; }
-  .cell { border:1px solid var(--line); border-radius:10px; overflow:hidden; background:var(--frame); }
-  .cell .cap { display:flex; align-items:center; gap:8px; padding:7px 10px; border-bottom:1px solid var(--line);
-               background:var(--bg); }
-  .cell .cap .meta { color:var(--muted); font-size:11px; }
-  .cell img { display:block; width:100%; height:auto; background:#fff; }
-  .cell.empty .ph { display:flex; align-items:center; justify-content:center; height:160px; color:var(--muted);
-                    font-size:12.5px; text-align:center; padding:0 16px; }
-  .single .pair { grid-template-columns:1fr; }
-  .empty-doc { color:var(--muted); padding:40px; text-align:center; }
-  @media (max-width:760px){ .pair{ grid-template-columns:1fr; } }
-</style>
-</head>
-<body>
-<div class="wrap" id="root"></div>
-
-<script id="data">
-window.__BA__ = /*__DATA__*/{"pr":"","title":"No data","base":"","head":"","cropSelector":"","tabs":[]}/*__END__*/;
-</script>
-<script>
-(function(){
-  var D = window.__BA__ || { tabs: [] };
-  var root = document.getElementById("root");
-  function el(html){ var t=document.createElement("template"); t.innerHTML=html.trim(); return t.content.firstChild; }
-  function esc(s){ return (s==null?"":String(s)).replace(/[&<>]/g, function(c){return {"&":"&amp;","<":"&lt;",">":"&gt;"}[c];}); }
-
-  function cell(kind, src){
-    if (src) {
-      return '<div class="cell"><div class="cap"><span class="chip '+kind+'">'+kind+'</span></div>'+
-             '<img src="'+esc(src)+'" alt="'+kind+'"/></div>';
-    }
-    return '<div class="cell empty"><div class="cap"><span class="chip '+kind+'">'+kind+'</span>'+
-           '<span class="meta">not present</span></div><div class="ph">No '+kind+' screenshot for this state</div></div>';
-  }
-
-  var head = '<div class="doc-head"><h1>'+esc(D.title || ("PR #"+D.pr))+'</h1>'+
-    '<div class="sub">Before / after &nbsp;·&nbsp; base <code>'+esc(D.base)+'</code> → head <code>'+esc(D.head)+'</code>'+
-    (D.cropSelector ? ' &nbsp;·&nbsp; cropped to <code>'+esc(D.cropSelector)+'</code>' : '')+'</div></div>'+
-    '<div class="legend"><span class="chip before">Before</span> base branch'+
-    '<span class="chip after">After</span> this PR</div>';
-  root.appendChild(el('<div>'+head+'</div>'));
-
-  if (!D.tabs || !D.tabs.length){ root.appendChild(el('<div class="empty-doc">No tabs captured yet.</div>')); return; }
-
-  D.tabs.forEach(function(tab){
-    var states = (tab.states||[]).map(function(s){
-      var onlyOne = (!s.before || !s.after);
-      return '<div class="state'+(onlyOne?' ':'')+'">'+
-        '<div class="name">'+esc(s.name)+(s.note?'<span class="note">'+esc(s.note)+'</span>':'')+'</div>'+
-        '<div class="pair">'+cell("before", s.before)+cell("after", s.after)+'</div></div>';
-    }).join("");
-    var sec = '<section class="tab-section" id="section-'+esc(tab.id)+'">'+
-      '<h2>'+esc(tab.title)+'</h2>'+
-      (tab.ctx?'<div class="ctx">'+esc(tab.ctx)+'</div>':'')+
-      states+'</section>';
-    root.appendChild(el(sec));
-  });
-})();
-</script>
-</body>
-</html>

.claude/skills/ui-before-after/shoot-sections.mjs

@@ -1,25 +0,0 @@
-// Render each .tab-section of a montage HTML into its own PNG (the PR-ready image).
-// Run from frontend/editor (so @playwright/test resolves):
-//   node <skill>/shoot-sections.mjs <montage.html> <outDir>
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-import { createRequire } from "node:module";
-
-const require = createRequire(path.join(process.cwd(), "noop.js"));
-const { chromium } = require("@playwright/test");
-
-const htmlPath = path.resolve(process.argv[2]);
-const outDir = path.resolve(process.argv[3] || path.dirname(htmlPath));
-
-const browser = await chromium.launch();
-const page = await browser.newPage({ viewport: { width: 1200, height: 1200 }, deviceScaleFactor: 2 });
-await page.goto(pathToFileURL(htmlPath).href, { waitUntil: "load" });
-await page.waitForTimeout(250); // let images/fonts paint
-const ids = await page.$$eval(".tab-section", (els) => els.map((e) => e.id));
-if (!ids.length) { console.error("no .tab-section found"); process.exit(1); }
-for (const id of ids) {
-  const name = id.replace(/^section-/, "");
-  await page.locator("#" + id).screenshot({ path: path.join(outDir, `montage_${name}.png`) });
-  console.log("wrote montage_" + name + ".png");
-}
-await browser.close();

.claude/skills/ui-walkthrough/SKILL.md

@@ -1,120 +0,0 @@
----
-name: ui-walkthrough
-description: >-
-  Full UI investigation of the current branch's feature. Enumerates every view
-  and state (empty, populated, loading, error, each dialog/menu/panel, responsive
-  breakpoints, light + dark + RTL), captures them with the stubbed Playwright
-  harness, assembles a single-image HTML walkthrough with a global light/dark
-  toggle slider, then runs two review passes: visual/consistency (alignment,
-  spacing, professionalism, dark/light parity, contrast, truncation) and
-  UX/ease-of-use (flow, discoverability, affordances, empty/error states,
-  expectations). Use when asked for a UI walkthrough, screenshot review, design
-  or QA pass, "find anywhere to make it easier/better for users", or before
-  merging frontend work. Pass --fix to auto-apply safe frontend fixes and
-  re-capture; --theme to limit themes; --no-rtl to skip RTL.
-argument-hint: "[feature/area] [--fix] [--theme light|dark|both] [--no-rtl] [--breakpoints]"
-allowed-tools: Read, Write, Edit, Glob, Grep, Bash
----
-
-# UI Walkthrough
-
-Produce a reviewable HTML walkthrough of a feature's UI in every state and theme,
-then critique it. Optionally auto-fix and re-capture.
-
-`$ARGUMENTS` may name the feature/area to focus on. If empty, scope from the
-current branch diff. Flags: `--fix`, `--theme light|dark|both` (default both),
-`--no-rtl`, `--breakpoints` (also capture phone/narrow widths).
-
-## What this repo gives you (use it, don't reinvent)
-
-- **Stubbed Playwright project** = backend-free screenshots via `page.route()` mocks.
-  Reference implementation: `frontend/editor/src/core/tests/stubbed/files-page-screenshots.spec.ts`.
-  It already shows the light / **dark** / **RTL** passes, JWT seeding, IndexedDB
-  seeding, and dumping PNGs to a `screenshots/<area>/` folder. Copy its shape.
-- Helpers: `frontend/editor/src/core/tests/helpers/ui-helpers.ts`
-  (`uploadFiles`, `openSettings`, `waitForModalOpen`, `dismissTourTooltip`, …)
-  and the `stub-test-base` fixtures (`autoGoto`, `seedJwt`, `viewport`).
-- Config: `frontend/editor/playwright.config.ts` (run from `frontend/editor/`).
-- Report template: [report-template.html](report-template.html) - self-contained,
-  one big image at a time, a global light/dark slider that flips every shot,
-  thumbnail rail, prev/next + arrow keys, and a Findings tab.
-
-## Process
-
-### 1. Scope the feature
-- If `$ARGUMENTS` is empty: `git diff --name-only main...HEAD` and read the PR/commits.
-  Identify changed pages, tools (`core/components/tools/<tool>` or `core/tools/<tool>`),
-  dialogs, panels, and routes.
-- Enumerate **every view and state** to capture, e.g.:
-  empty / populated / loading / error / disabled; each dialog, menu, popover, tooltip;
-  each tab or step; selection + multi-select; success/result panel; and (if relevant)
-  permission/role variants. Write the list down before capturing - it's the report's spine.
-
-### 2. Prepare the harness (worktree-safe)
-Worktrees have no `node_modules` and no generated icons. From repo root:
-```
-cd frontend && npm ci                       # or junction main's node_modules (see memory)
-cd frontend/editor && node scripts/generate-icons.js
-```
-Kill any stale dev server first (it serves old modules):
-`Get-NetTCPConnection -LocalPort 5173 -State Listen | %{ Stop-Process -Id $_.OwningProcess -Force }`
-
-### 3. Write the capture spec
-Create `frontend/editor/src/core/tests/stubbed/<feature>-walkthrough.spec.ts`,
-modeled on `files-page-screenshots.spec.ts`. For each enumerated view:
-- stub the APIs it needs, drive the UI to that state, wait on a real locator
-  (not a fixed sleep), `await settle(page)` for Mantine portals, then
-  `page.screenshot({ path: shotPath("NN_name_<theme>") })`.
-- Capture each view in **light and dark** (and RTL unless `--no-rtl`). Reuse the
-  `enableDarkMode` / `enableRtl` init-script pattern from the reference spec
-  (`localStorage["mantine-color-scheme"]="dark"` + `emulateMedia({colorScheme:"dark"})`).
-- Name shots `NN_<view>_<theme>.png` so light/dark pair up by suffix.
-- Prefer **stable test-ids** over translated accessible names (RTL/i18n breaks text locators).
-
-Run it: `cd frontend/editor && npx playwright test --project=stubbed <feature>-walkthrough.spec.ts`.
-Add `--project=stubbed-firefox`/`-webkit` only if cross-browser layout matters.
-
-### 4. Build the report
-- Copy `report-template.html` to `screenshots/<feature>/walkthrough.html` (so the
-  relative `screenshots/...` image paths resolve, or rewrite paths to sit beside it).
-- Build the manifest and inject it: replace the JSON between the
-  `/*__DATA__*/` … `/*__END__*/` markers with one `views[]` entry per view
-  (`{id,title,light,dark,viewport,notes}`) and an empty `findings` object you'll
-  fill in step 5. Keep `light`/`dark` as relative paths.
-- The toggle slider answers the "one big image + flip light/dark for all" request:
-  it shows a single large screenshot, and switching the slider re-themes every view.
-
-### 5. Review pass 1 - visual & consistency
-Open each screenshot (Read the PNG) and judge against the others:
-alignment & spacing rhythm, control placement, button hierarchy, typography,
-**light/dark parity** (contrast, invisible borders, washed-out text, wrong tokens),
-truncation/overflow, RTL mirroring, focus states, icon consistency, professional polish.
-Record each issue as a finding `{severity:high|med|low, view, title, detail, fix}`.
-
-### 6. Review pass 2 - UX & ease of use
-Walk the flow as a first-time user: discoverability, number of steps, affordance
-clarity, empty-state guidance, error recovery, destructive-action confirmation,
-defaults, loading feedback, mobile reachability, accessible names, and whether the
-UI matches user expectations for this kind of tool. Record findings the same way.
-
-Write both finding lists into the report's `findings.visual` / `findings.ux`,
-and add short per-view `notes`. Re-inject the manifest.
-
-### 7. If `--fix`
-Only safe, self-contained frontend fixes (spacing, alignment, tokens, missing
-dark-mode colors, labels, aria, obvious copy). For each: edit the component/CSS,
-mark the finding `fixed:true` with what changed, then **re-run the spec** to
-re-capture the affected shots and regenerate the report. Run `task frontend:check`.
-Leave anything risky or ambiguous as a finding, not a change.
-
-### 8. Deliver
-Tell the user the report path and give a tight chat summary: N views ×
-themes captured, top findings by severity, and (if `--fix`) what changed.
-Optionally `SendUserFile` the `walkthrough.html`.
-
-## Gotchas
-- Stale `:5173` server serves old bundles - kill it before capturing (see step 2).
-- Missing `material-symbols-icons.json` → blank app → every shot times out. Run
-  `generate-icons.js` first.
-- `await settle(page)` before shots or portals/transitions tear mid-capture.
-- Don't commit the generated `screenshots/` or the throwaway spec unless asked.

.claude/skills/ui-walkthrough/make_example.py

@@ -1,116 +0,0 @@
-"""Build a self-contained EXAMPLE.html from report-template.html with mock
-light/dark screenshots, so the viewer + global theme slider can be demoed
-without a real capture run. Run: python make_example.py"""
-import base64
-import json
-import pathlib
-import re
-
-HERE = pathlib.Path(__file__).parent
-
-
-def svg(bg, fg, panel, accent, muted, label, kind):
-    """A simple fake 'screen' SVG: title bar, sidebar, content varies by kind."""
-    parts = [
-        f'<svg xmlns="http://www.w3.org/2000/svg" width="1600" height="900" viewBox="0 0 1600 900">',
-        f'<rect width="1600" height="900" fill="{bg}"/>',
-        # top bar
-        f'<rect width="1600" height="64" fill="{panel}"/>',
-        f'<circle cx="40" cy="32" r="12" fill="{accent}"/>',
-        f'<rect x="64" y="24" width="160" height="16" rx="6" fill="{muted}"/>',
-        f'<rect x="1430" y="20" width="130" height="24" rx="12" fill="{accent}"/>',
-        # left sidebar
-        f'<rect x="0" y="64" width="220" height="836" fill="{panel}"/>',
-    ]
-    for i in range(6):
-        y = 100 + i * 56
-        parts.append(f'<rect x="24" y="{y}" width="172" height="32" rx="8" fill="{bg}"/>')
-    if kind == "empty":
-        parts += [
-            f'<rect x="700" y="360" width="200" height="120" rx="16" fill="none" stroke="{muted}" stroke-width="3" stroke-dasharray="10 8"/>',
-            f'<rect x="690" y="510" width="220" height="44" rx="10" fill="{accent}"/>',
-            f'<text x="800" y="600" fill="{muted}" font-family="sans-serif" font-size="26" text-anchor="middle">{label}</text>',
-        ]
-    elif kind == "form":
-        for i in range(4):
-            y = 140 + i * 90
-            parts.append(f'<rect x="280" y="{y}" width="160" height="16" rx="6" fill="{muted}"/>')
-            parts.append(f'<rect x="280" y="{y+26}" width="900" height="44" rx="8" fill="{panel}" stroke="{muted}" stroke-width="1"/>')
-        parts.append(f'<rect x="280" y="560" width="200" height="50" rx="10" fill="{accent}"/>')
-        parts.append(f'<text x="800" y="850" fill="{muted}" font-family="sans-serif" font-size="24" text-anchor="middle">{label}</text>')
-    else:  # dialog
-        parts += [
-            f'<rect width="1600" height="900" fill="{fg}" opacity="0.45"/>',
-            f'<rect x="520" y="280" width="560" height="360" rx="18" fill="{panel}"/>',
-            f'<rect x="556" y="320" width="280" height="22" rx="8" fill="{fg}"/>',
-            f'<rect x="556" y="372" width="488" height="14" rx="6" fill="{muted}"/>',
-            f'<rect x="556" y="398" width="420" height="14" rx="6" fill="{muted}"/>',
-            f'<rect x="820" y="560" width="110" height="44" rx="9" fill="{bg}" stroke="{muted}"/>',
-            f'<rect x="946" y="560" width="98" height="44" rx="9" fill="{accent}"/>',
-            f'<text x="800" y="700" fill="#fff" font-family="sans-serif" font-size="24" text-anchor="middle">{label}</text>',
-        ]
-    parts.append("</svg>")
-    return "".join(parts)
-
-
-def data_uri(s):
-    return "data:image/svg+xml;base64," + base64.b64encode(s.encode()).decode()
-
-
-LIGHT = dict(bg="#ffffff", fg="#111418", panel="#f1f3f6", accent="#2f6fed", muted="#c2c8d0")
-DARK = dict(bg="#16181c", fg="#000000", panel="#1f232a", accent="#5b8cff", muted="#3a414b")
-
-
-def pair(kind, label):
-    return (
-        data_uri(svg(LIGHT["bg"], LIGHT["fg"], LIGHT["panel"], LIGHT["accent"], LIGHT["muted"], label, kind)),
-        data_uri(svg(DARK["bg"], DARK["fg"], DARK["panel"], DARK["accent"], DARK["muted"], label, kind)),
-    )
-
-
-views = []
-for idx, (kind, title, label) in enumerate([
-    ("empty", "Empty state", "Drop a PDF to start"),
-    ("form", "Tool options panel", "Compress options"),
-    ("dialog", "Confirm dialog", "Replace original file?"),
-], start=1):
-    light, dark = pair(kind, label)
-    views.append({
-        "id": f"{idx:02d}_{kind}",
-        "title": title,
-        "light": light,
-        "dark": dark,
-        "viewport": "1600x900",
-        "notes": ["This is mock data to demo the viewer."],
-    })
-
-data = {
-    "feature": "EXAMPLE - Compress PDF (mock data)",
-    "branch": "demo",
-    "generated": "example",
-    "views": views,
-    "findings": {
-        "visual": [
-            {"severity": "high", "view": "03_dialog", "title": "Dialog buttons too close",
-             "detail": "Cancel/Confirm have only 8px gap; easy to misclick.",
-             "fix": "Increase gap to var(--mantine-spacing-md)."},
-            {"severity": "low", "view": "02_form", "title": "Field labels low contrast in dark mode",
-             "detail": "Muted token fails WCAG AA on the dark panel.",
-             "fix": "Use --mantine-color-dimmed instead of a hard-coded grey."},
-        ],
-        "ux": [
-            {"severity": "med", "view": "01_empty", "title": "Primary CTA below the dropzone",
-             "detail": "Users expect the action button adjacent to the dropzone.",
-             "fix": "Move the button directly under the dashed zone."},
-        ],
-    },
-}
-
-tpl = (HERE / "report-template.html").read_text(encoding="utf-8")
-out = re.sub(
-    r"/\*__DATA__\*/.*?/\*__END__\*/",
-    lambda _m: "/*__DATA__*/" + json.dumps(data) + "/*__END__*/",
-    tpl, count=1, flags=re.S,
-)
-(HERE / "EXAMPLE.html").write_text(out, encoding="utf-8")
-print("wrote", (HERE / "EXAMPLE.html"))

.claude/skills/ui-walkthrough/report-template.html

@@ -1,298 +0,0 @@
-<!doctype html>
-<!--
-  UI Walkthrough report template (self-contained, works from file://).
-  The ui-walkthrough skill replaces the JSON in the window.__WALKTHROUGH__ data
-  block below with the captured manifest. Do not add external CDN deps - it must open offline.
-
-  Data shape:
-  {
-    "feature": "Compress PDF tool",
-    "branch": "claude/...",
-    "generated": "2026-06-21",
-    "views": [
-      { "id": "01_empty", "title": "Empty state",
-        "light": "screenshots/compress/01_empty_light.png",
-        "dark":  "screenshots/compress/01_empty_dark.png",
-        "viewport": "1600x900",
-        "notes": ["Heading is centered", "Primary CTA below the fold on mobile"] }
-    ],
-    "findings": {
-      "visual": [ { "severity":"high", "view":"01_empty", "title":"...", "detail":"...", "fix":"..." } ],
-      "ux":     [ { "severity":"med",  "view":"03_dialog", "title":"...", "detail":"...", "fix":"..." } ]
-    }
-  }
--->
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>UI Walkthrough</title>
-<style>
-  :root {
-    --bg: #f6f7f9; --panel: #ffffff; --panel-2: #f0f2f5; --text: #1a1b1e;
-    --muted: #6b7280; --border: #e2e5ea; --accent: #2f6fed; --accent-weak: #e8f0fe;
-    --shadow: 0 1px 3px rgba(0,0,0,.08), 0 8px 24px rgba(0,0,0,.06);
-    --hi: #d92d20; --med: #d98e00; --low: #2f6fed; --stage: #0b0c0e;
-  }
-  html[data-theme="dark"] {
-    --bg: #0d0e10; --panel: #16181c; --panel-2: #1d2024; --text: #e6e8eb;
-    --muted: #9aa3ad; --border: #2a2e35; --accent: #5b8cff; --accent-weak: #1a2336;
-    --shadow: 0 1px 3px rgba(0,0,0,.5), 0 8px 24px rgba(0,0,0,.4); --stage: #000;
-  }
-  * { box-sizing: border-box; }
-  body { margin: 0; font: 14px/1.5 -apple-system, "Segoe UI", Roboto, system-ui, sans-serif;
-         background: var(--bg); color: var(--text); }
-  header { display: flex; align-items: center; gap: 16px; padding: 12px 20px;
-           background: var(--panel); border-bottom: 1px solid var(--border); position: sticky; top: 0; z-index: 5; }
-  header h1 { font-size: 15px; margin: 0; font-weight: 650; }
-  header .sub { color: var(--muted); font-size: 12px; }
-  .spacer { flex: 1; }
-  .counter { color: var(--muted); font-variant-numeric: tabular-nums; font-size: 13px; }
-  .tabs { display: flex; gap: 4px; }
-  .tab { border: 1px solid var(--border); background: var(--panel-2); color: var(--text);
-         padding: 6px 12px; border-radius: 8px; cursor: pointer; font-size: 13px; }
-  .tab.active { background: var(--accent); color: #fff; border-color: var(--accent); }
-
-  /* Light/Dark slider */
-  .theme-toggle { display: flex; align-items: center; gap: 9px; user-select: none; }
-  .theme-toggle .lbl { font-size: 12px; color: var(--muted); }
-  .theme-toggle .lbl.on { color: var(--text); font-weight: 600; }
-  .switch { position: relative; width: 52px; height: 28px; }
-  .switch input { opacity: 0; width: 0; height: 0; }
-  .slider { position: absolute; inset: 0; cursor: pointer; background: var(--panel-2);
-            border: 1px solid var(--border); border-radius: 999px; transition: .2s; }
-  .slider:before { content: ""; position: absolute; height: 20px; width: 20px; left: 3px; top: 3px;
-                   background: #fbbf24; border-radius: 50%; transition: .2s; box-shadow: 0 1px 2px rgba(0,0,0,.3); }
-  .switch input:checked + .slider { background: var(--accent); }
-  .switch input:checked + .slider:before { transform: translateX(24px); background: #c7d2fe; }
-
-  main { display: grid; grid-template-columns: 240px 1fr; height: calc(100vh - 53px); }
-  .rail { border-right: 1px solid var(--border); overflow-y: auto; background: var(--panel); padding: 8px; }
-  .rail .group-label { font-size: 11px; text-transform: uppercase; letter-spacing: .05em;
-                       color: var(--muted); padding: 10px 8px 4px; }
-  .thumb { display: flex; gap: 9px; align-items: center; padding: 7px; border-radius: 8px;
-           cursor: pointer; border: 1px solid transparent; }
-  .thumb:hover { background: var(--panel-2); }
-  .thumb.active { background: var(--accent-weak); border-color: var(--accent); }
-  .thumb img { width: 64px; height: 40px; object-fit: cover; border-radius: 4px; border: 1px solid var(--border); background: var(--stage); }
-  .thumb .t { font-size: 12.5px; line-height: 1.3; }
-  .thumb .badge { font-size: 10px; color: var(--muted); }
-  .thumb .dot { width: 7px; height: 7px; border-radius: 50%; margin-left: auto; flex: none; }
-
-  .stagewrap { display: flex; flex-direction: column; min-width: 0; }
-  .stage { flex: 1; display: flex; align-items: center; justify-content: center; padding: 22px;
-           background: var(--stage); position: relative; min-height: 0; }
-  .stage img { max-width: 100%; max-height: 100%; object-fit: contain; border-radius: 8px;
-               box-shadow: 0 4px 30px rgba(0,0,0,.4); background: #fff; }
-  html[data-theme="dark"] .stage img { background: #16181c; }
-  .nav-btn { position: absolute; top: 50%; transform: translateY(-50%); width: 42px; height: 42px;
-             border-radius: 50%; border: 1px solid var(--border); background: var(--panel);
-             color: var(--text); cursor: pointer; font-size: 18px; opacity: .85; }
-  .nav-btn:hover { opacity: 1; } .nav-btn.prev { left: 16px; } .nav-btn.next { right: 16px; }
-  .nav-btn:disabled { opacity: .25; cursor: default; }
-  .missing { color: var(--muted); font-size: 13px; text-align: center; }
-
-  .detail { border-top: 1px solid var(--border); background: var(--panel); padding: 14px 20px;
-            max-height: 38vh; overflow-y: auto; }
-  .detail h2 { margin: 0 0 4px; font-size: 15px; }
-  .detail .meta { color: var(--muted); font-size: 12px; margin-bottom: 10px; }
-  .notes { list-style: none; padding: 0; margin: 0; display: grid; gap: 6px; }
-  .notes li { display: flex; gap: 8px; align-items: flex-start; }
-  .sev { font-size: 10px; font-weight: 700; text-transform: uppercase; padding: 2px 7px; border-radius: 999px;
-         color: #fff; flex: none; margin-top: 1px; }
-  .sev.high { background: var(--hi); } .sev.med { background: var(--med); } .sev.low { background: var(--low); }
-  .finding .fix { color: var(--muted); font-size: 12.5px; }
-  .finding .fix b { color: var(--text); font-weight: 600; }
-
-  /* Summary tab */
-  .summary { padding: 20px 28px; overflow-y: auto; }
-  .summary h2 { font-size: 16px; margin: 22px 0 8px; }
-  .summary .empty { color: var(--muted); }
-  .card { background: var(--panel); border: 1px solid var(--border); border-radius: 10px;
-          padding: 12px 14px; margin-bottom: 8px; box-shadow: var(--shadow); }
-  .card .head { display: flex; gap: 8px; align-items: center; }
-  .card a { color: var(--accent); text-decoration: none; cursor: pointer; }
-  .hide { display: none !important; }
-  kbd { font: 11px ui-monospace, monospace; background: var(--panel-2); border: 1px solid var(--border);
-        border-radius: 4px; padding: 1px 5px; }
-</style>
-</head>
-<body>
-<header>
-  <div>
-    <h1 id="feature-title">UI Walkthrough</h1>
-    <div class="sub" id="feature-sub"></div>
-  </div>
-  <div class="spacer"></div>
-  <div class="tabs">
-    <button class="tab active" data-tab="viewer">Walkthrough</button>
-    <button class="tab" data-tab="summary">Findings</button>
-  </div>
-  <div class="counter" id="counter"></div>
-  <label class="theme-toggle" title="Toggle light / dark for every screenshot">
-    <span class="lbl" id="lbl-light">Light</span>
-    <span class="switch"><input type="checkbox" id="theme-switch" /><span class="slider"></span></span>
-    <span class="lbl" id="lbl-dark">Dark</span>
-  </label>
-</header>
-
-<main id="viewer-pane">
-  <aside class="rail" id="rail"></aside>
-  <section class="stagewrap">
-    <div class="stage">
-      <button class="nav-btn prev" id="prev" aria-label="Previous">&#8249;</button>
-      <img id="stage-img" alt="" />
-      <div class="missing hide" id="missing"></div>
-      <button class="nav-btn next" id="next" aria-label="Next">&#8250;</button>
-    </div>
-    <div class="detail">
-      <h2 id="view-title"></h2>
-      <div class="meta" id="view-meta"></div>
-      <ul class="notes" id="view-notes"></ul>
-    </div>
-  </section>
-</main>
-
-<section class="summary hide" id="summary-pane"></section>
-
-<script id="data">
-window.__WALKTHROUGH__ = /*__DATA__*/{"feature":"No data","branch":"","generated":"","views":[],"findings":{"visual":[],"ux":[]}}/*__END__*/;
-</script>
-<script>
-(function () {
-  var D = window.__WALKTHROUGH__ || { views: [], findings: { visual: [], ux: [] } };
-  var views = D.views || [];
-  var state = { i: 0, theme: localStorage.getItem("ui-wt-theme") || "light", tab: "viewer" };
-
-  var $ = function (id) { return document.getElementById(id); };
-  function sevClass(s) { return s === "high" ? "high" : s === "med" || s === "medium" ? "med" : "low"; }
-
-  function applyChrome() {
-    document.documentElement.setAttribute("data-theme", state.theme);
-    $("theme-switch").checked = state.theme === "dark";
-    $("lbl-light").classList.toggle("on", state.theme === "light");
-    $("lbl-dark").classList.toggle("on", state.theme === "dark");
-  }
-
-  function srcFor(v) { return state.theme === "dark" ? (v.dark || v.light) : (v.light || v.dark); }
-
-  function findingsForView(id) {
-    var all = (D.findings && D.findings.visual || []).concat(D.findings && D.findings.ux || []);
-    return all.filter(function (f) { return f.view === id; });
-  }
-
-  function renderRail() {
-    var rail = $("rail");
-    rail.innerHTML = "";
-    if (!views.length) { rail.innerHTML = '<div class="group-label">No views captured</div>'; return; }
-    views.forEach(function (v, idx) {
-      var fs = findingsForView(v.id);
-      var worst = fs.some(function (f){return sevClass(f.severity)==="high";}) ? "var(--hi)"
-                : fs.some(function (f){return sevClass(f.severity)==="med";}) ? "var(--med)"
-                : fs.length ? "var(--low)" : "transparent";
-      var el = document.createElement("div");
-      el.className = "thumb" + (idx === state.i ? " active" : "");
-      el.innerHTML = '<img src="' + srcFor(v) + '" alt="" />' +
-        '<div><div class="t">' + (v.title || v.id) + '</div>' +
-        '<div class="badge">' + (v.viewport || "") + '</div></div>' +
-        '<span class="dot" style="background:' + worst + '"></span>';
-      el.onclick = function () { state.i = idx; render(); };
-      rail.appendChild(el);
-    });
-  }
-
-  function render() {
-    applyChrome();
-    if (!views.length) {
-      $("missing").classList.remove("hide"); $("stage-img").classList.add("hide");
-      $("missing").textContent = "No screenshots in this report yet.";
-      $("counter").textContent = ""; return;
-    }
-    var v = views[state.i];
-    var src = srcFor(v);
-    var img = $("stage-img");
-    if (src) {
-      img.classList.remove("hide"); $("missing").classList.add("hide");
-      img.src = src; img.alt = v.title || v.id;
-    } else {
-      img.classList.add("hide"); $("missing").classList.remove("hide");
-      $("missing").textContent = "No " + state.theme + " screenshot for this view.";
-    }
-    $("counter").textContent = (state.i + 1) + " / " + views.length;
-    $("view-title").textContent = v.title || v.id;
-    $("view-meta").textContent = [v.viewport, state.theme + " mode"].filter(Boolean).join("  ·  ");
-    var notes = $("view-notes"); notes.innerHTML = "";
-    var fs = findingsForView(v.id);
-    (v.notes || []).forEach(function (n) {
-      var li = document.createElement("li"); li.textContent = "· " + n; notes.appendChild(li);
-    });
-    fs.forEach(function (f) {
-      var li = document.createElement("li"); li.className = "finding";
-      li.innerHTML = '<span class="sev ' + sevClass(f.severity) + '">' + (f.severity || "note") + '</span>' +
-        '<span><b>' + (f.title || "") + '</b> — ' + (f.detail || "") +
-        (f.fix ? ' <span class="fix"><b>Fix:</b> ' + f.fix + '</span>' : '') + '</span>';
-      notes.appendChild(li);
-    });
-    $("prev").disabled = state.i === 0;
-    $("next").disabled = state.i === views.length - 1;
-    renderRail();
-  }
-
-  function renderSummary() {
-    var pane = $("summary-pane");
-    function block(title, arr) {
-      var h = '<h2>' + title + ' (' + arr.length + ')</h2>';
-      if (!arr.length) return h + '<div class="empty">None found.</div>';
-      return h + arr.map(function (f) {
-        return '<div class="card"><div class="head">' +
-          '<span class="sev ' + sevClass(f.severity) + '">' + (f.severity || "note") + '</span>' +
-          '<b>' + (f.title || "") + '</b>' +
-          (f.view ? ' <a data-jump="' + f.view + '">' + f.view + '</a>' : '') + '</div>' +
-          '<div style="margin-top:6px">' + (f.detail || "") + '</div>' +
-          (f.fix ? '<div class="finding" style="margin-top:6px"><span class="fix"><b>Fix:</b> ' + f.fix + '</span></div>' : '') +
-          '</div>';
-      }).join("");
-    }
-    pane.innerHTML = block("Visual & consistency", (D.findings && D.findings.visual) || []) +
-                     block("UX & ease of use", (D.findings && D.findings.ux) || []);
-    pane.querySelectorAll("[data-jump]").forEach(function (a) {
-      a.onclick = function () {
-        var id = a.getAttribute("data-jump");
-        var idx = views.findIndex(function (v) { return v.id === id; });
-        if (idx >= 0) { state.i = idx; setTab("viewer"); }
-      };
-    });
-  }
-
-  function setTab(t) {
-    state.tab = t;
-    document.querySelectorAll(".tab").forEach(function (b) { b.classList.toggle("active", b.dataset.tab === t); });
-    $("viewer-pane").classList.toggle("hide", t !== "viewer");
-    $("summary-pane").classList.toggle("hide", t !== "summary");
-    if (t === "viewer") $("viewer-pane").style.display = "grid";
-    if (t === "summary") renderSummary();
-  }
-
-  // wiring
-  $("feature-title").textContent = D.feature || "UI Walkthrough";
-  $("feature-sub").textContent = [D.branch, D.generated].filter(Boolean).join("  ·  ");
-  $("theme-switch").onchange = function () {
-    state.theme = this.checked ? "dark" : "light";
-    localStorage.setItem("ui-wt-theme", state.theme);
-    render();
-  };
-  $("prev").onclick = function () { if (state.i > 0) { state.i--; render(); } };
-  $("next").onclick = function () { if (state.i < views.length - 1) { state.i++; render(); } };
-  document.addEventListener("keydown", function (e) {
-    if (state.tab !== "viewer") return;
-    if (e.key === "ArrowLeft") $("prev").click();
-    if (e.key === "ArrowRight") $("next").click();
-    if (e.key.toLowerCase() === "t") $("theme-switch").click();
-  });
-  document.querySelectorAll(".tab").forEach(function (b) { b.onclick = function () { setTab(b.dataset.tab); }; });
-
-  render();
-})();
-</script>
-</body>
-</html>

.devcontainer/devcontainer.json

@@ -49,7 +49,7 @@
                 "java.configuration.updateBuildConfiguration": "interactive",
                 "java.format.enabled": true,
                 "java.format.settings.profile": "GoogleStyle",
-                "java.format.settings.google.version": "1.28.0",
+                "java.format.settings.google.version": "1.26.0",
                 "java.format.settings.google.extra": "--aosp --skip-sorting-imports --skip-javadoc-formatting",
                 "java.saveActions.cleanup": true,
                 "java.cleanup.actions": [
@@ -79,17 +79,9 @@
                     ".venv*/",
                     ".vscode/",
                     "bin/",
-                    "app/core/bin/",
-                    "app/common/bin/",
-                    "app/proprietary/bin/",
                     "build/",
-                    "app/core/build/",
-                    "app/common/build/",
-                    "app/proprietary/build/",
                     "configs/",
-                    "app/core/configs/",
                     "customFiles/",
-                    "app/core/customFiles/",
                     "docs/",
                     "exampleYmlFiles",
                     "gradle/",
@@ -101,9 +93,6 @@
                     ".git-blame-ignore-revs",
                     ".gitattributes",
                     ".gitignore",
-                    "app/core/.gitignore",
-                    "app/common/.gitignore",
-                    "app/proprietary/.gitignore",
                     ".pre-commit-config.yaml"
                 ],
                 "java.signatureHelp.enabled": true,
@@ -130,9 +119,7 @@
                 "EditorConfig.EditorConfig", // EditorConfig support for maintaining consistent coding styles
                 "ms-azuretools.vscode-docker", // Docker extension for Visual Studio Code
                 "charliermarsh.ruff", // Ruff extension for Ruff language support
-                "github.vscode-github-actions", // GitHub Actions extension for Visual Studio Code
-                "stylelint.vscode-stylelint", // Stylelint extension for CSS and SCSS linting
-                "redhat.vscode-yaml" // YAML extension for Visual Studio Code
+                "github.vscode-github-actions" // GitHub Actions extension for Visual Studio Code
             ]
         }
     },

.devcontainer/init-setup.sh

@@ -20,8 +20,8 @@ set -e
 # - To build the project, use:
 #     ./gradlew build
 #
-# - To run the lint/format/secret checks, use:
-#     task pre-commit
+# - For running pre-commit hooks (if configured), use:
+#     pre-commit run --all-files
 #
 # Make sure you are in the project root directory after this script executes.
 # =============================================================================
@@ -70,6 +70,6 @@ echo ""
 echo "  To build the project: "
 echo -e "\e[34m    gradle build\e[0m"
 echo ""
-echo "  To run the lint/format/secret checks:"
-echo -e "\e[34m    task pre-commit\e[0m"
+echo "  To run pre-commit hooks (if configured):"
+echo -e "\e[34m    pre-commit run --all-files -c .pre-commit-config.yaml\e[0m"
 echo "=================================================================="

.dockerignore

@@ -1,110 +0,0 @@
-# Version control
-.git/
-.gitignore
-.git-blame-ignore-revs
-.gitattributes
-
-# Build outputs
-build/
-*/build/
-**/build/
-out/
-target/
-**/target/
-bin/
-version_builds/
-
-# Gradle caches (local, not what's in the container)
-.gradle/
-**/.gradle/
-.gradle-home/
-
-# Task (go-task) cache
-.task/
-
-# Node / frontend
-node_modules/
-**/node_modules/
-frontend/node_modules/
-frontend/editor/dist/
-frontend/editor/playwright-report/
-.npm/
-.yarn/
-
-# Tauri/desktop builds
-src-tauri/target/
-src-tauri/dist/
-frontend/editor/src-tauri/target/
-frontend/editor/src-tauri/dist/
-
-# IDE and editor
-.idea/
-.vscode/
-.settings/
-.settings.zip
-.classpath
-.project
-.devcontainer/
-*.iml
-*.ipr
-*.iws
-
-# Logs and temp files
-*.log
-*.tmp
-*.pid
-.DS_Store
-Thumbs.db
-logs/
-
-# Docker itself
-Dockerfile*
-.dockerignore
-
-# CI / CD configs (not needed in build context)
-.github/
-.circleci/
-.gitlab-ci.yml
-
-# Test reports
-**/test-results/
-**/jacoco/
-test_*.pdf
-
-# Testing and documentation (not needed in build)
-testing/
-docs/
-devGuide/
-devTools/
-*.md
-README*
-
-# Separate projects not consumed by the Java/frontend build
-commonforms-onnx/
-
-# Runtime mount points used by docker-compose volumes, not build input
-stirling/
-customFiles/
-configs/
-
-# Claude Code workspace
-.claude/
-
-# Python caches
-.pytest_cache/
-.ruff_cache/
-__pycache__/
-**/__pycache__/
-
-# Local env
-.env
-.env.*
-!.env.example
-!engine/.env
-
-# Misc
-*.swp
-*.swo
-*~
-.DS_Store
-.cache/

.editorconfig

@@ -14,8 +14,7 @@ indent_size = 4
 max_line_length = 100
 
 [*.py]
-indent_size = 4
-max_line_length = 120
+indent_size = 2
 
 [*.gradle]
 indent_size = 4
@@ -25,19 +24,25 @@ indent_size = 2
 insert_final_newline = false
 trim_trailing_whitespace = false
 
-[{*.js,*.jsx,*.mjs,*.ts,*.tsx}]
+[*.js]
 indent_size = 2
 
 [*.css]
 # CSS files typically use an indent size of 2 spaces for better readability and alignment with community standards.
 indent_size = 2
 
-[*.{yml,yaml}]
+[*.yaml]
 # YAML files use an indent size of 2 spaces to maintain consistency with common YAML formatting practices.
 indent_size = 2
 insert_final_newline = false
 trim_trailing_whitespace = false
 
+[*.yml]
+# YML files follow the same conventions as YAML files, using an indent size of 2 spaces.
+indent_size = 2
+insert_final_newline = false
+trim_trailing_whitespace = false
+
 [*.json]
 # JSON files use an indent size of 2 spaces, which is the standard for JSON formatting.
 indent_size = 2

.git-blame-ignore-revs

@@ -1,9 +1,5 @@
 # Formatting
 5f771b785130154ed47952635b7acef371ffe0ec
-7fa5e130d99227c2202ebddfdd91348176ec0c7b
-14d4fbb2a36195eedb034785e5a5ff6a47f268c6
-ee8030c1c4148062cde15c49c67d04ef03930c55
-fcd41924f5f261febfa9d9a92994671f3ebc97d6
 
 # Normalize files
 55d4fda01b2f39f5b7d7b4fda5214bd7ff0fd5dd

.gitattributes

@@ -1,10 +1,10 @@
 * text=auto eol=lf
 
 # Ignore all JavaScript files in a directory
-app/core/src/main/resources/static/pdfjs/* linguist-vendored
-app/core/src/main/resources/static/pdfjs/** linguist-vendored
-app/core/src/main/resources/static/pdfjs-legacy/* linguist-vendored
-app/core/src/main/resources/static/pdfjs-legacy/** linguist-vendored
-app/core/src/main/resources/static/css/bootstrap-icons.css linguist-vendored
-app/core/src/main/resources/static/css/bootstrap.min.css linguist-vendored
-app/core/src/main/resources/static/css/fonts/* linguist-vendored
+stirling-pdf/src/main/resources/static/pdfjs/* linguist-vendored
+stirling-pdf/src/main/resources/static/pdfjs/** linguist-vendored
+stirling-pdf/src/main/resources/static/pdfjs-legacy/* linguist-vendored
+stirling-pdf/src/main/resources/static/pdfjs-legacy/** linguist-vendored
+stirling-pdf/src/main/resources/static/css/bootstrap-icons.css linguist-vendored
+stirling-pdf/src/main/resources/static/css/bootstrap.min.css linguist-vendored
+stirling-pdf/src/main/resources/static/css/fonts/* linguist-vendored

.github/CODEOWNERS

@@ -1,18 +1,2 @@
-# All PRs must be approved by Frooodle or Ludy87
-* @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
-
-# Backend
-/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs
-
-#V2 frontend
-/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
-/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
-
-#V2 docker
-/docker/backend/** @Frooodle @Ludy87 @DarioGii
-/docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
-/docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
-
-
-#GHA (All users)
-/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
+# All PRs to V1 must be approved by Frooodle
+* @Frooodle @reecebrowne @Ludy87 @DarioGii @ConnorYoh

.github/actions/setup-bot/action.yml

@@ -22,9 +22,9 @@ runs:
   steps:
     - name: Generate a GitHub App Token
       id: generate-token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
       with:
-        client-id: ${{ inputs.app-id }}
+        app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
     - name: Configure Git
       run: |

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,29 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-desktop
-pkgver=2.14.1
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
-arch=('x86_64')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
-provides=('stirling-pdf')
-conflicts=('stirling-pdf' 'stirling-pdf-git' 'stirling-pdf-bin')
-options=('!strip')
-
-source_x86_64=("${pkgname}-${pkgver}.deb::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-linux-x86_64.deb")
-sha256sums_x86_64=('PLACEHOLDER_DEB_SHA256')
-
-package() {
-    # Extract the .deb archive
-    bsdtar -xf data.tar* -C "${pkgdir}"
-
-    # Fix permissions
-    find "${pkgdir}" -type d -exec chmod 755 {} \;
-
-    # Install license
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<EOF
-Copyright (c) 2025 Stirling PDF Inc
-All rights reserved. See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,77 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-server-bin
-pkgver=2.14.1
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
-arch=('any')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('java-runtime>=25')
-provides=('stirling-pdf-server')
-conflicts=('stirling-pdf-server' 'stirling-pdf-server-git')
-backup=('etc/stirling-pdf-server/settings.yml')
-
-source=("Stirling-PDF-with-login-${pkgver}.jar::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-with-login.jar")
-sha256sums=('PLACEHOLDER_JAR_SHA256')
-
-package() {
-    # JAR
-    install -Dm644 "Stirling-PDF-with-login-${pkgver}.jar" \
-        "${pkgdir}/usr/share/stirling-pdf-server/stirling-pdf-server.jar"
-
-    # Wrapper script
-    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/stirling-pdf-server" << 'EOF'
-#!/bin/sh
-exec java $JAVA_OPTS -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar "$@"
-EOF
-
-    # systemd unit
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/systemd/system/stirling-pdf-server.service" << 'EOF'
-[Unit]
-Description=Stirling-PDF Server
-After=network.target
-
-[Service]
-Type=simple
-User=stirling-pdf
-Group=stirling-pdf
-WorkingDirectory=/var/lib/stirling-pdf-server
-ExecStart=/usr/bin/java -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar
-Restart=on-failure
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=stirling-pdf-server
-Environment=JAVA_OPTS=-Xmx512m
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-    # sysusers
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/sysusers.d/stirling-pdf-server.conf" << 'EOF'
-u stirling-pdf - "Stirling-PDF Server" /var/lib/stirling-pdf-server -
-EOF
-
-    # tmpfiles
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/stirling-pdf-server.conf" << 'EOF'
-d /var/lib/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-d /var/log/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-EOF
-
-    # Default config stub
-    install -dm755 "${pkgdir}/etc/stirling-pdf-server"
-    install -Dm644 /dev/stdin "${pkgdir}/etc/stirling-pdf-server/settings.yml" << 'EOF'
-# Stirling-PDF Server configuration
-# See https://github.com/Stirling-Tools/Stirling-PDF for all options
-server:
-  port: 8080
-EOF
-
-    # License
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" << 'EOF'
-MIT License with proprietary carve-outs (open-core).
-SPDX: MIT AND LicenseRef-Stirling-PDF-Proprietary
-See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}

.github/config/.files.yaml

@@ -1,132 +0,0 @@
-build: &build
-  - build.gradle
-  - app/(common|core|proprietary)/build.gradle
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-
-openapi: &openapi
-  - *build
-  - app/(common|core|proprietary)/src/main/java/**
-
-docker-base: &docker-base
-  - docker/base/Dockerfile
-
-docker: &docker
-  - docker/embedded/Dockerfile
-  - docker/embedded/Dockerfile.fat
-  - docker/embedded/Dockerfile.ultra-lite
-  - ".github/workflows/build.yml"
-  - ".github/workflows/push-docker.yml"
-  - scripts/init.sh
-  - scripts/init-without-ocr.sh
-  - exampleYmlFiles/**
-  - *docker-base
-
-project: &project
-  - app/(common|core|proprietary)/src/(main|test)/java/**
-  - *build
-  - "app/(common|core|proprietary)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
-  - exampleYmlFiles/**
-  - gradle/**
-  - libs/**
-  - "testing/**/!(requirements*.txt|requirements*.in)*"
-  - *docker
-  - *docker-base
-  - gradle.properties
-  - gradlew
-  - gradlew.bat
-  - launch4jConfig.xml
-  - settings.gradle
-  - frontend/**
-  - docker/**
-  - scripts/RestartHelper.java
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-  - .taskfiles/docker.yml
-  - scripts/db-migration/**
-  - .github/workflows/db-migration-test.yml
-
-frontend: &frontend
-  - frontend/**
-  - .github/workflows/testdriver.yml
-  - testing/**
-  - docker/**
-  - scripts/translations/*.py
-  - .taskfiles/desktop.yml
-  - scripts/convert_cff_to_ttf.py
-  - scripts/harvest_type3_fonts.py
-  - scripts/ignore_translation.toml
-  - scripts/index_type3_catalogue.py
-  - scripts/summarize_type3_signatures.py
-  - scripts/type3_to_cff.py
-  - scripts/update_type3_library.py
-  - Taskfile.yml
-  - .taskfiles/frontend.yml
-  - .taskfiles/e2e.yml
-
-# Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
-# job on changes to any of these.
-tauri: &tauri
-  - frontend/editor/src-tauri/**
-  - frontend/editor/src/desktop/**
-  - frontend/editor/tsconfig.desktop.vite.json
-  - frontend/package.json
-  - frontend/package-lock.json
-  - frontend/editor/vite.config.ts
-  - .github/workflows/tauri-build.yml
-  - Taskfile.yml
-  - .taskfiles/desktop.yml
-
-# Files that affect the AI engine (Python tool models, fixers, tests). Gate
-# the engine validation job on changes to engine sources or to the Java
-# tool surfaces it generates models from.
-engine: &engine
-  - engine/**
-  - app/(common|core|proprietary)/src/main/java/**
-  - .github/workflows/ai-engine.yml
-  - Taskfile.yml
-  - .taskfiles/engine.yml
-
-# Files that can make the committed generated API models (frontend tool API
-# types + engine tool models) go stale: the Java tool surfaces they derive from,
-# the generators, the generated files themselves (to catch a hand-edit), and the
-# tasks that drive generation. Deliberately excludes the broad frontend/docker/
-# testing globs, so a CSS-only PR does not boot the backend to rebuild the spec.
-generated-models: &generated-models
-  - *openapi
-  - frontend/editor/scripts/generate-tool-api-types.mts
-  - frontend/editor/src/core/types/toolApiTypes.ts
-  - engine/scripts/generate_tool_models.py
-  - engine/src/stirling/models/tool_models.py
-  - .taskfiles/frontend.yml
-  - .taskfiles/engine.yml
-  - .github/workflows/check-generated-models.yml
-
-licenses-frontend: &licenses-frontend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - "frontend/package.json"
-  - "frontend/package-lock.json"
-  - "frontend/editor/scripts/generate-licenses.js"
-
-licenses-backend: &licenses-backend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - *build
-
-# Files that can affect premium / enterprise behaviour. Gate the enterprise
-# Playwright job on changes to any of these on PRs.
-proprietary: &proprietary
-  - app/proprietary/**
-  - frontend/editor/src/proprietary/**
-  - frontend/editor/src/core/tests/enterprise/**
-  - testing/compose/docker-compose-keycloak-oauth.yml
-  - testing/compose/docker-compose-keycloak-saml.yml
-  - testing/compose/keycloak-realm-oauth.json
-  - testing/compose/keycloak-realm-saml.json
-  - testing/compose/start-oauth-test.sh
-  - testing/compose/start-saml-test.sh
-  - testing/compose/validate-oauth-test.sh
-  - testing/compose/validate-saml-test.sh
-  - configs/settings.yml.template
-  - build.gradle
-  - app/proprietary/build.gradle
-  - .github/workflows/build-enterprise.yml

.github/config/dependency-review-config.yml

@@ -1 +0,0 @@
-allow-ghsas: GHSA-wrw7-89jp-8q8g

.github/config/repo_devs.json

@@ -1,9 +1,4 @@
 {
-  "label_changer": [
-    "Frooodle",
-    "Ludy87",
-    "balazs-szucs"
-  ],
   "repo_devs": [
     "Frooodle",
     "sf298",
@@ -12,9 +7,6 @@
     "sbplat",
     "reecebrowne",
     "DarioGii",
-    "ConnorYoh",
-    "EthanHealy01",
-    "jbrunton96",
-    "balazs-szucs"
+    "ConnorYoh"
   ]
 }

.github/dependabot.yml

@@ -6,159 +6,18 @@
 version: 2
 updates:
   - package-ecosystem: "gradle" # See documentation for possible values
-    directories:
-      - "/" # Location of package manifests
-      - "/app/common"
-      - "/app/core"
-      - "/app/proprietary"
+    directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
+    open-pull-requests-limit: 10
     rebase-strategy: "auto"
 
   - package-ecosystem: "docker"
-    directories:
-      - "/" # Location of Dockerfile
-      - "/docker/backend"
-      - "/docker/embedded"
-      - "/docker/frontend"
-      - "/docker/base"
-      - "/docker/engine"
-      - "/docker/unoserver"
-      - "/engine"
+    directory: "/" # Location of Dockerfile
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
-
-  - package-ecosystem: npm
-    directories:
-      - /devTools
-      - /frontend
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
-    groups:
-      embedpdf:
-        patterns:
-          - "@embedpdf/*"
-      mantine:
-        patterns:
-          - "@mantine/*"
-          - "postcss-preset-mantine"
-      mui:
-        patterns:
-          - "@mui/*"
-      tauri-js:
-        patterns:
-          - "@tauri-apps/*"
-      emotion:
-        patterns:
-          - "@emotion/*"
-      react:
-        patterns:
-          - "react"
-          - "react-dom"
-          - "@types/react"
-          - "@types/react-dom"
-      typescript-eslint:
-        patterns:
-          - "@typescript-eslint/*"
-          - "typescript-eslint"
-      eslint:
-        patterns:
-          - "eslint"
-          - "@eslint/*"
-      vite:
-        patterns:
-          - "vite"
-          - "vite-*"
-          - "@vitejs/*"
-      vitest:
-        patterns:
-          - "vitest"
-          - "@vitest/*"
-      testing-library:
-        patterns:
-          - "@testing-library/*"
-      i18next:
-        patterns:
-          - "i18next"
-          - "i18next-*"
-          - "react-i18next"
-      iconify:
-        patterns:
-          - "@iconify/*"
-          - "@iconify-json/*"
-      stripe:
-        patterns:
-          - "@stripe/*"
-      posthog:
-        patterns:
-          - "@posthog/*"
-          - "posthog-js"
-      supabase:
-        patterns:
-          - "@supabase/*"
-      dnd-kit:
-        patterns:
-          - "@dnd-kit/*"
-      tailwind:
-        patterns:
-          - "tailwindcss"
-          - "@tailwindcss/*"
-      postcss:
-        patterns:
-          - "postcss"
-          - "postcss-*"
-        exclude-patterns:
-          - "postcss-preset-mantine"
-
-  - package-ecosystem: cargo
-    directories:
-      - /frontend/editor/src-tauri
-      - /frontend/editor/src-tauri/thumbnail-handler
-      - /frontend/editor/src-tauri/provisioner
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
-    groups:
-      tauri:
-        patterns:
-          - "tauri"
-          - "tauri-build"
-          - "tauri-plugin-*"
-      serde:
-        patterns:
-          - "serde"
-          - "serde_*"
-      tracing:
-        patterns:
-          - "tracing"
-          - "tracing-*"
-      tokio:
-        patterns:
-          - "tokio"
-          - "tokio-*"
-
-  - package-ecosystem: pip
-    directory: /testing/cucumber
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"

.github/labeler-config-srvaroa.yml

@@ -2,117 +2,88 @@ version: 1
 labels:
 
   - label: "Bugfix"
-    title: '^fix(\([^)]*\))?:|^fix:.*'
+    title: '^fix:.*'
 
   - label: "enhancement"
-    title: '^feat(\([^)]*\))?:|^feat:.*'
+    title: '^feat:.*'
 
   - label: "build"
-    title: '^build(\([^)]*\))?:|^build:.*'
+    title: '^build:.*'
 
   - label: "chore"
-    title: '^chore(\([^)]*\))?:|^chore:.*'
+    title: '^chore:.*'
 
   - label: "ci"
-    title: '^ci(\([^)]*\))?:|^ci:.*'
-
-  - label: "ci"
-    title: '^.*\(ci\):.*'
+    title: '^ci:.*'
 
   - label: "perf"
-    title: '^perf(\([^)]*\))?:|^perf:.*'
+    title: '^perf:.*'
 
   - label: "refactor"
-    title: '^refactor(\([^)]*\))?:|^refactor:.*'
+    title: '^refactor:.*'
 
   - label: "revert"
-    title: '^revert(\([^)]*\))?:|^revert:.*'
+    title: '^revert:.*'
 
   - label: "style"
-    title: '^style(\([^)]*\))?:|^style:.*'
+    title: '^style:.*'
 
   - label: "Documentation"
-    title: '^docs(\([^)]*\))?:|^docs:.*'
-
-  - label: "Documentation"
-    title: '^.*\(docs\):.*'
-
-  - label: "dependencies"
-    title: '^deps(\([^)]*\))?:|^deps:.*'
-
-  - label: "dependencies"
-    title: '^.*\(deps\):.*'
+    title: '^docs:.*'
 
   - label: 'API'
-    title: '.*openapi.*|.*swagger.*|.*api.*'
-
-  - label: 'v3'
-    base-branch: 'V3'
+    title: '.*openapi.*'
 
   - label: 'Translation'
     files:
-      - 'frontend/editor/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'stirling-pdf/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}.properties'
       - 'scripts/ignore_translation.toml'
-      - 'scripts/remove_translation_keys.sh'
-      - 'scripts/replace_translation_line.sh'
-      - 'scripts/translations/.*'
-      - '.github/scripts/check_language_toml.py'
-      - 'scripts/counter_translation_v3.py'
+      - 'stirling-pdf/src/main/resources/templates/fragments/languages.html'
+      - '.github/scripts/check_language_properties.py'
 
   - label: 'Front End'
     files:
-      - 'app/core/src/main/resources/static/.*'
-      - 'app/proprietary/src/main/resources/static/.*'
-      - 'frontend/**'
-      - 'frontend/.*'
-      - 'frontend/**/.*'
-
-  - label: 'Tauri'
-    files:
-      - 'frontend/editor/src-tauri/**'
-      - 'frontend/editor/src-tauri/.*'
-
-  - label: 'engine'
-    files:
-      - 'engine/**'
-      - 'engine/.*'
-      - 'engine/**/.*'
+      - 'stirling-pdf/src/main/resources/templates/.*'
+      - 'proprietary/src/main/resources/templates/.*'
+      - 'stirling-pdf/src/main/resources/static/.*'
+      - 'proprietary/src/main/resources/static/.*'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/.*'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/UI/.*'
+      - 'proprietary/src/main/java/stirling/software/proprietary/security/controller/web/.*'
 
   - label: 'Java'
     files:
-      - 'app/common/src/main/java/.*.java'
-      - 'app/proprietary/src/main/java/.*.java'
-      - 'app/core/src/main/java/.*.java'
+      - 'common/src/main/java/.*.java'
+      - 'proprietary/src/main/java/.*.java'
+      - 'stirling-pdf/src/main/java/.*.java'
 
   - label: 'Back End'
     files:
-      - 'app/core/src/main/java/stirling/software/SPDF/config/.*'
-      - 'app/core/src/main/java/stirling/software/SPDF/controller/.*'
-      - 'app/core/src/main/resources/settings.yml.template'
-      - 'app/core/src/main/resources/application.properties'
-      - 'app/core/src/main/resources/banner.txt'
-      - 'app/core/src/main/resources/static/python/png_to_webp.py'
-      - 'app/core/src/main/resources/static/python/split_photos.py'
-      - 'app/core/src/main/resources/static/pipeline/defaultWebUIConfigs/**'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/config/.*'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/.*'
+      - 'stirling-pdf/src/main/resources/settings.yml.template'
+      - 'stirling-pdf/src/main/resources/application.properties'
+      - 'stirling-pdf/src/main/resources/banner.txt'
+      - 'scripts/png_to_webp.py'
+      - 'split_photos.py'
       - 'application.properties'
 
   - label: 'Security'
     files:
-      - 'app/proprietary/src/main/java/stirling/software/proprietary/security/.*'
+      - 'proprietary/src/main/java/stirling/software/proprietary/security/.*'
       - 'scripts/download-security-jar.sh'
       - '.github/workflows/dependency-review.yml'
       - '.github/workflows/scorecards.yml'
 
   - label: 'API'
     files:
-      - 'app/core/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java'
-      - 'app/core/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java'
-      - 'app/core/src/main/java/stirling/software/SPDF/controller/api/.*'
-      - 'app/core/src/main/java/stirling/software/SPDF/model/api/.*'
-      - 'app/core/src/main/java/stirling/software/SPDF/service/ApiDocService.java'
-      - 'app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/.*'
-      - 'app/core/src/main/resources/static/python/png_to_webp.py'
-      - 'app/core/src/main/resources/static/python/split_photos.py'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/api/.*'
+      - 'stirling-pdf/src/main/java/stirling/software/SPDF/model/api/.*'
+      - 'proprietary/src/main/java/stirling/software/proprietary/security/controller/api/.*'
+      - 'scripts/png_to_webp.py'
+      - 'split_photos.py'
       - '.github/workflows/swagger.yml'
 
   - label: 'Documentation'
@@ -135,7 +106,6 @@ labels:
       - 'scripts/installFonts.sh'
       - 'test.sh'
       - 'test2.sh'
-      - 'docker/**'
 
   - label: 'Devtools'
     files:
@@ -146,13 +116,12 @@ labels:
       - '.pre-commit-config'
       - '.github/workflows/pre_commit.yml'
       - 'devGuide/.*'
-      - 'devTools/.*'
 
   - label: 'Test'
     files:
-      - 'app/common/src/test/.*'
-      - 'app/proprietary/src/test/.*'
-      - 'app/core/src/test/.*'
+      - 'common/src/test/.*'
+      - 'proprietary/src/test/.*'
+      - 'stirling-pdf/src/test/.*'
       - 'testing/.*'
       - '.github/workflows/scorecards.yml'
       - 'exampleYmlFiles/test_cicd.yml'
@@ -168,6 +137,6 @@ labels:
       - 'gradlew.bat'
       - 'settings.gradle'
       - 'build.gradle'
-      - 'app/common/build.gradle'
-      - 'app/proprietary/build.gradle'
-      - 'app/core/build.gradle'
+      - 'common/build.gradle'
+      - 'proprietary/build.gradle'
+      - 'stirling-pdf/build.gradle'

.github/labeler-config.yml

@@ -0,0 +1,86 @@
+Translation:
+  - changed-files:
+    - any-glob-to-any-file: 'stirling-pdf/src/main/resources/messages_*_*.properties'
+    - any-glob-to-any-file: 'scripts/ignore_translation.toml'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/resources/templates/fragments/languages.html'
+
+Front End:
+  - changed-files:
+    - any-glob-to-any-file: 'stirling-pdf/src/main/resources/templates/**/*'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/resources/static/**/*'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/**'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/UI/**/*'
+
+Java:
+  - changed-files:
+    - any-glob-to-any-file: 'common/src/main/java/**/*.java'
+    - any-glob-to-any-file: 'proprietary/src/main/java/**/*.java'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/**/*.java'
+
+Back End:
+  - changed-files:
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/config/**/*'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/**/*'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/resources/settings.yml.template'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/resources/application.properties'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/resources/banner.txt'
+    - any-glob-to-any-file: 'scripts/png_to_webp.py'
+    - any-glob-to-any-file: 'split_photos.py'
+
+Security:
+  - changed-files:
+    - any-glob-to-any-file: 'proprietary/src/main/java/stirling/software/proprietary/security/**/*'
+    - any-glob-to-any-file: 'scripts/download-security-jar.sh'
+    - any-glob-to-any-file: '.github/workflows/dependency-review.yml'
+    - any-glob-to-any-file: '.github/workflows/scorecards.yml'
+
+API:
+  - changed-files:
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/api/**/*'
+    - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/model/api/**/*'
+    - any-glob-to-any-file: 'scripts/png_to_webp.py'
+    - any-glob-to-any-file: 'split_photos.py'
+    - any-glob-to-any-file: '.github/workflows/swagger.yml'
+
+Documentation:
+  - changed-files:
+    - any-glob-to-any-file: '**/*.md'
+    - any-glob-to-any-file: 'scripts/counter_translation.py'
+    - any-glob-to-any-file: 'scripts/ignore_translation.toml'
+
+Docker:
+  - changed-files:
+    - any-glob-to-any-file: '.github/workflows/build.yml'
+    - any-glob-to-any-file: '.github/workflows/push-docker.yml'
+    - any-glob-to-any-file: 'Dockerfile'
+    - any-glob-to-any-file: 'Dockerfile.fat'
+    - any-glob-to-any-file: 'Dockerfile.ultra-lite'
+    - any-glob-to-any-file: 'exampleYmlFiles/*.yml'
+    - any-glob-to-any-file: 'scripts/download-security-jar.sh'
+    - any-glob-to-any-file: 'scripts/init.sh'
+    - any-glob-to-any-file: 'scripts/init-without-ocr.sh'
+    - any-glob-to-any-file: 'scripts/installFonts.sh'
+    - any-glob-to-any-file: 'test.sh'
+    - any-glob-to-any-file: 'test2.sh'
+
+Devtools:
+  - changed-files:
+    - any-glob-to-any-file: '.devcontainer/**/*'
+    - any-glob-to-any-file: 'Dockerfile.dev'
+
+Test:
+  - changed-files:
+    - any-glob-to-any-file: 'cucumber/**/*'
+    - any-glob-to-any-file: 'common/src/test/**/*'
+    - any-glob-to-any-file: 'proprietary/src/test/**/*'
+    - any-glob-to-any-file: 'stirling-pdf/src/test/**/*'
+    - any-glob-to-any-file: 'src/testing/**/*'
+    - any-glob-to-any-file: '.pre-commit-config'
+    - any-glob-to-any-file: '.github/workflows/pre_commit.yml'
+    - any-glob-to-any-file: '.github/workflows/scorecards.yml'
+
+Github:
+  - changed-files:
+    - any-glob-to-any-file: '.github/**/*'

.github/labels.yml

@@ -42,7 +42,6 @@
 - name: "Front End"
   color: "BBD2F1"
   description: "Issues or pull requests related to front-end development"
-  from_name: "frontend"
 - name: "github-actions"
   description: "Pull requests that update GitHub Actions code"
   color: "999999"
@@ -78,15 +77,10 @@
 - name: "Translation"
   color: "9FABF9"
   from_name: "translation"
-  description: "Issues or pull requests related to translation"
 - name: "upstream"
   color: "DEDEDE"
 - name: "v2"
   color: "FFFF00"
-  description: "Issues or pull requests related to the v2 branch"
-- name: "v3"
-  color: "FFA500"
-  description: "Issues or pull requests related to the v3 branch"
 - name: "wontfix"
   description: "This will not be worked on"
   color: "FFFFFF"
@@ -181,23 +175,3 @@
   description: "This PR changes 1000+ lines ignoring generated files."
 - name: "to research"
   color: "FBCA04"
-- name: "pr-deployed"
-  color: "00FF00"
-  description: "Pull request has been deployed to a test environment"
-- name: "codex"
-  color: "ededed"
-  description: "chatgpt AI generated code"
-- name: "break-change"
-  color: "FF0000"
-  description: "This PR introduces a breaking API change."
-- name: "Rust"
-  color: "DEA584"
-  description: "Pull requests that update Rust code"
-  from_name: "rust"
-- name: "Tauri"
-  color: "24C8FF"
-  description: "Pull requests that update Tauri code"
-  from_name: "tauri"
-- name: "license-review-required"
-  color: "EDEDED"
-  description: "This PR requires a license review"

.github/pull_request_template.md

@@ -17,7 +17,7 @@ Closes #(issue_number)
 ### General
 
 - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
-- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable)
+- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable)
 - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable)
 - [ ] I have performed a self-review of my own code
 - [ ] My changes generate no new warnings
@@ -27,15 +27,10 @@ Closes #(issue_number)
 - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed)
 - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only)
 
-### Translations (if applicable)
-
-- [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)
-
 ### UI Changes (if applicable)
 
 - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR)
 
 ### Testing (if applicable)
 
-- [ ] I have run `task check` to verify linters, typechecks, and tests pass
-- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details.
+- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details.

.github/release.yml

@@ -1,34 +1,17 @@
 changelog:
-  exclude:
-    labels:
-      - ignore-for-release
-      # engine: Python AI engine - not currently live / not yet shipped to users.
-      # Remove this entry once the engine is released.
-      - engine
-
   categories:
-    - title: Breaking Changes
-      labels:
-        - break-change
-
     - title: Bug Fixes
       labels:
-        - Bugfix
         - Bug
 
     - title: Enhancements
       labels:
         - enhancement
-        - Java
-        - Front End
-        - Back End
-        - Tauri
 
     - title: Minor Enhancements
       labels:
-        - chore
-        - style
-        - refactor
+        - Java
+        - Front End
 
     - title: Docker Updates
       labels:

.github/scripts/check_language_properties.py

@@ -0,0 +1,401 @@
+"""
+Author: Ludy87
+Description: This script processes .properties files for localization checks. It compares translation files in a branch with
+a reference file to ensure consistency. The script performs two main checks:
+1. Verifies that the number of lines (including comments and empty lines) in the translation files matches the reference file.
+2. Ensures that all keys in the translation files are present in the reference file and vice versa.
+
+The script also provides functionality to update the translation files to match the reference file by adding missing keys and
+adjusting the format.
+
+Usage:
+    python check_language_properties.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+"""
+# Sample for Windows:
+# python .github/scripts/check_language_properties.py --reference-file src\main\resources\messages_en_GB.properties --branch "" --files src\main\resources\messages_de_DE.properties src\main\resources\messages_uk_UA.properties
+
+import copy
+import glob
+import os
+import argparse
+import re
+
+
+def find_duplicate_keys(file_path):
+    """
+    Identifies duplicate keys in a .properties file.
+    :param file_path: Path to the .properties file.
+    :return: List of tuples (key, first_occurrence_line, duplicate_line).
+    """
+    keys = {}
+    duplicates = []
+
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Skip empty lines and comments
+            if not stripped_line or stripped_line.startswith("#"):
+                continue
+
+            # Split the line into key and value
+            if "=" in stripped_line:
+                key, _ = stripped_line.split("=", 1)
+                key = key.strip()
+
+                # Check if the key already exists
+                if key in keys:
+                    duplicates.append((key, keys[key], line_number))
+                else:
+                    keys[key] = line_number
+
+    return duplicates
+
+
+# Maximum size for properties files (e.g., 200 KB)
+MAX_FILE_SIZE = 200 * 1024
+
+
+def parse_properties_file(file_path):
+    """
+    Parses a .properties file and returns a structured list of its contents.
+    :param file_path: Path to the .properties file.
+    :return: List of dictionaries representing each line in the file.
+    """
+    properties_list = []
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Handle empty lines
+            if not stripped_line:
+                properties_list.append(
+                    {"line_number": line_number, "type": "empty", "content": ""}
+                )
+                continue
+
+            # Handle comments
+            if stripped_line.startswith("#"):
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "comment",
+                        "content": stripped_line,
+                    }
+                )
+                continue
+
+            # Handle key-value pairs
+            match = re.match(r"^([^=]+)=(.*)$", line)
+            if match:
+                key, value = match.groups()
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "entry",
+                        "key": key.strip(),
+                        "value": value.strip(),
+                    }
+                )
+
+    return properties_list
+
+
+def write_json_file(file_path, updated_properties):
+    """
+    Writes updated properties back to the file in their original format.
+    :param file_path: Path to the .properties file.
+    :param updated_properties: List of updated properties to write.
+    """
+    updated_lines = {entry["line_number"]: entry for entry in updated_properties}
+
+    # Sort lines by their numbers and retain comments and empty lines
+    all_lines = sorted(set(updated_lines.keys()))
+
+    original_format = []
+    for line in all_lines:
+        if line in updated_lines:
+            entry = updated_lines[line]
+        else:
+            entry = None
+        ref_entry = updated_lines[line]
+        if ref_entry["type"] in ["comment", "empty"]:
+            original_format.append(ref_entry)
+        elif entry is None:
+            # Add missing entries from the reference file
+            original_format.append(ref_entry)
+        elif entry["type"] == "entry":
+            # Replace entries with those from the current JSON
+            original_format.append(entry)
+
+    # Write the updated content back to the file
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        for entry in original_format:
+            if entry["type"] == "comment":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "empty":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "entry":
+                file.write(f"{entry['key']}={entry['value']}\n")
+
+
+def update_missing_keys(reference_file, file_list, branch=""):
+    """
+    Updates missing keys in the translation files based on the reference file.
+    :param reference_file: Path to the reference .properties file.
+    :param file_list: List of translation files to update.
+    :param branch: Branch where the files are located.
+    """
+    reference_properties = parse_properties_file(reference_file)
+    for file_path in file_list:
+        basename_current_file = os.path.basename(os.path.join(branch, file_path))
+        if (
+            basename_current_file == os.path.basename(reference_file)
+            or not file_path.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+
+        current_properties = parse_properties_file(os.path.join(branch, file_path))
+        updated_properties = []
+        for ref_entry in reference_properties:
+            ref_entry_copy = copy.deepcopy(ref_entry)
+            for current_entry in current_properties:
+                if current_entry["type"] == "entry":
+                    if ref_entry_copy["type"] != "entry":
+                        continue
+                    if ref_entry_copy["key"].lower() == current_entry["key"].lower():
+                        ref_entry_copy["value"] = current_entry["value"]
+            updated_properties.append(ref_entry_copy)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
+
+
+def check_for_missing_keys(reference_file, file_list, branch):
+    update_missing_keys(reference_file, file_list, branch)
+
+
+def read_properties(file_path):
+    if os.path.isfile(file_path) and os.path.exists(file_path):
+        with open(file_path, "r", encoding="utf-8") as file:
+            return file.read().splitlines()
+    return [""]
+
+
+def check_for_differences(reference_file, file_list, branch, actor):
+    reference_branch = reference_file.split("/")[0]
+    basename_reference_file = os.path.basename(reference_file)
+
+    report = []
+    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
+    reference_lines = read_properties(reference_file)
+    has_differences = False
+
+    only_reference_file = True
+
+    file_arr = file_list
+
+    if len(file_list) == 1:
+        file_arr = file_list[0].split()
+    base_dir = os.path.abspath(
+        os.path.join(os.getcwd(), "stirling-pdf", "src", "main", "resources")
+    )
+
+    for file_path in file_arr:
+        file_normpath = os.path.normpath(file_path)
+        absolute_path = os.path.abspath(file_normpath)
+        # Verify that file is within the expected directory
+        if not absolute_path.startswith(base_dir):
+            raise ValueError(f"Unsafe file found: {file_normpath}")
+        # Verify file size before processing
+        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
+            raise ValueError(
+                f"The file {file_normpath} is too large and could pose a security risk."
+            )
+
+        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
+        if (
+            basename_current_file == basename_reference_file
+            or (
+                # only local windows command
+                not file_normpath.startswith(
+                    os.path.join(
+                        "", "stirling-pdf", "src", "main", "resources", "messages_"
+                    )
+                )
+                and not file_normpath.startswith(
+                    os.path.join(
+                        os.getcwd(),
+                        "stirling-pdf",
+                        "src",
+                        "main",
+                        "resources",
+                        "messages_",
+                    )
+                )
+            )
+            or not file_normpath.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+        only_reference_file = False
+        report.append(f"#### 📃 **File Check:** `{basename_current_file}`")
+        current_lines = read_properties(os.path.join(branch, file_path))
+        reference_line_count = len(reference_lines)
+        current_line_count = len(current_lines)
+
+        if reference_line_count != current_line_count:
+            report.append("")
+            report.append("1. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            has_differences = True
+            if reference_line_count > current_line_count:
+                report.append(
+                    f"    - **_Mismatched line count_**: {reference_line_count} (reference) vs {current_line_count} (current). Comments, empty lines, or translation strings are missing."
+                )
+            elif reference_line_count < current_line_count:
+                report.append(
+                    f"    - **_Too many lines_**: {reference_line_count} (reference) vs {current_line_count} (current). Please verify if there is an additional line that needs to be removed."
+                )
+        else:
+            report.append("1. **Test Status:** ✅ **_Passed_**")
+
+        # Check for missing or extra keys
+        current_keys = []
+        reference_keys = []
+        for line in current_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                current_keys.append(key)
+        for line in reference_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                reference_keys.append(key)
+
+        current_keys_set = set(current_keys)
+        reference_keys_set = set(reference_keys)
+        missing_keys = current_keys_set.difference(reference_keys_set)
+        extra_keys = reference_keys_set.difference(current_keys_set)
+        missing_keys_list = list(missing_keys)
+        extra_keys_list = list(extra_keys)
+
+        if missing_keys_list or extra_keys_list:
+            has_differences = True
+            missing_keys_str = "`, `".join(missing_keys_list)
+            extra_keys_str = "`, `".join(extra_keys_list)
+            report.append("2. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            if missing_keys_list:
+                spaces_keys_list = []
+                for key in missing_keys_list:
+                    if " " in key:
+                        spaces_keys_list.append(key)
+                if spaces_keys_list:
+                    spaces_keys_str = "`, `".join(spaces_keys_list)
+                    report.append(
+                        f"    - **_Keys containing unnecessary spaces_**: `{spaces_keys_str}`!"
+                    )
+                report.append(
+                    f"    - **_Extra keys in `{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
+                )
+            if extra_keys_list:
+                report.append(
+                    f"    - **_Missing keys in `{basename_reference_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_current_file}`_**."
+                )
+        else:
+            report.append("2. **Test Status:** ✅ **_Passed_**")
+
+        if find_duplicate_keys(os.path.join(branch, file_normpath)):
+            has_differences = True
+            output = "\n".join(
+                [
+                    f"      - `{key}`: first at line {first}, duplicate at `line {duplicate}`"
+                    for key, first, duplicate in find_duplicate_keys(
+                        os.path.join(branch, file_normpath)
+                    )
+                ]
+            )
+            report.append("3. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            report.append("    - duplicate entries were found:")
+            report.append(output)
+        else:
+            report.append("3. **Test Status:** ✅ **_Passed_**")
+
+        report.append("")
+        report.append("---")
+        report.append("")
+    if has_differences:
+        report.append("## ❌ Overall Check Status: **_Failed_**")
+        report.append("")
+        report.append(
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/stirling-pdf/src/main/resources/messages_en_GB.properties)"
+        )
+    else:
+        report.append("## ✅ Overall Check Status: **_Success_**")
+        report.append("")
+        report.append(
+            f"Thanks @{actor} for your help in keeping the translations up to date."
+        )
+
+    if not only_reference_file:
+        print("\n".join(report))
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Find missing keys")
+    parser.add_argument(
+        "--actor",
+        required=False,
+        help="Actor from PR.",
+    )
+    parser.add_argument(
+        "--reference-file",
+        required=True,
+        help="Path to the reference file.",
+    )
+    parser.add_argument(
+        "--branch",
+        type=str,
+        required=True,
+        help="Branch name.",
+    )
+    parser.add_argument(
+        "--check-file",
+        type=str,
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    parser.add_argument(
+        "--files",
+        nargs="+",
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    args = parser.parse_args()
+
+    # Sanitize --actor input to avoid injection attacks
+    if args.actor:
+        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
+
+    # Sanitize --branch input to avoid injection attacks
+    if args.branch:
+        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
+
+    file_list = args.files
+    if file_list is None:
+        if args.check_file:
+            file_list = [args.check_file]
+        else:
+            file_list = glob.glob(
+                os.path.join(
+                    os.getcwd(),
+                    "stirling-pdf",
+                    "src",
+                    "main",
+                    "resources",
+                    "messages_*.properties",
+                )
+            )
+        update_missing_keys(args.reference_file, file_list)
+    else:
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/check_language_toml.py

@@ -1,384 +0,0 @@
-"""
-Author: Ludy87
-Description: This script processes TOML translation files for localization checks. It compares translation files in a branch with
-a reference file to ensure consistency. The script performs two main checks:
-1. Verifies that the number of translation keys in the translation files matches the reference file.
-2. Ensures that all keys in the translation files are present in the reference file and vice versa.
-
-The script also provides functionality to update the translation files to match the reference file by adding missing keys and
-adjusting the format.
-
-Usage:
-    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
-"""
-
-# Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/editor/public/locales/en-US/translation.toml --branch "" --files frontend/editor/public/locales/de-DE/translation.toml frontend/editor/public/locales/fr-FR/translation.toml
-
-import argparse
-import glob
-import os
-import re
-from pathlib import Path
-
-import tomllib  # Python 3.11+ (stdlib)
-import tomli_w  # For writing TOML files
-
-
-def find_duplicate_keys(file_path, keys=None, prefix=""):
-    """
-    Identifies duplicate keys in a TOML file (including nested keys).
-    :param file_path: Path to the TOML file.
-    :param keys: Dictionary to track keys (used for recursion).
-    :param prefix: Prefix for nested keys.
-    :return: List of tuples (key, first_occurrence_path, duplicate_path).
-    """
-    if keys is None:
-        keys = {}
-
-    duplicates = []
-
-    # Load TOML file
-    file_path = Path(file_path)
-    with file_path.open("rb") as file:
-        data = tomllib.load(file)
-
-    def process_dict(obj, current_prefix=""):
-        for key, value in obj.items():
-            full_key = f"{current_prefix}.{key}" if current_prefix else key
-
-            if isinstance(value, dict):
-                process_dict(value, full_key)
-            else:
-                if full_key in keys:
-                    duplicates.append((full_key, keys[full_key], full_key))
-                else:
-                    keys[full_key] = full_key
-
-    process_dict(data, prefix)
-    return duplicates
-
-
-# Maximum size for TOML files (e.g., 1 MB)
-MAX_FILE_SIZE = 1000 * 1024
-
-
-def parse_toml_file(file_path):
-    """
-    Parses a TOML translation file and returns a flat dictionary of all keys.
-    :param file_path: Path to the TOML file.
-    :return: Dictionary with flattened keys.
-    """
-    file_path = Path(file_path)
-    with file_path.open("rb") as file:
-        data = tomllib.load(file)
-
-    def flatten_dict(d, parent_key="", sep="."):
-        items = {}
-        for k, v in d.items():
-            new_key = f"{parent_key}{sep}{k}" if parent_key else k
-            if isinstance(v, dict):
-                items.update(flatten_dict(v, new_key, sep=sep))
-            else:
-                items[new_key] = v
-        return items
-
-    return flatten_dict(data)
-
-
-def unflatten_dict(d, sep="."):
-    """
-    Converts a flat dictionary with dot notation keys back to nested dict.
-    :param d: Flattened dictionary.
-    :param sep: Separator used in keys.
-    :return: Nested dictionary.
-    """
-    result = {}
-    for key, value in d.items():
-        parts = key.split(sep)
-        current = result
-        for part in parts[:-1]:
-            if part not in current:
-                current[part] = {}
-            current = current[part]
-        current[parts[-1]] = value
-    return result
-
-
-def write_toml_file(file_path, updated_properties):
-    """
-    Writes updated properties back to the TOML file.
-    :param file_path: Path to the TOML file.
-    :param updated_properties: Dictionary of updated properties to write.
-    """
-    nested_data = unflatten_dict(updated_properties)
-
-    file_path = Path(file_path)
-    with file_path.open("wb") as file:
-        tomli_w.dump(nested_data, file)
-
-
-def update_missing_keys(reference_file, file_list, branch=""):
-    """
-    Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference TOML file.
-    :param file_list: List of translation files to update.
-    :param branch: Branch where the files are located.
-    """
-    reference_file = Path(reference_file)
-    reference_properties = parse_toml_file(reference_file)
-    branch_path = Path(branch) if branch else Path()
-
-    for file_path in file_list:
-        file_path = Path(file_path)
-        language_dir = file_path.parent.name
-        reference_lang_dir = reference_file.parent.name
-        if (
-            language_dir == reference_lang_dir
-            or file_path.suffix != ".toml"
-            or file_path.parents[1].name != "locales"
-        ):
-            print(f"Skipping file: {file_path}")
-            continue
-
-        current_properties = parse_toml_file(branch_path / file_path)
-        updated_properties = {}
-
-        for ref_key, ref_value in reference_properties.items():
-            if ref_key in current_properties:
-                # Keep the current translation
-                updated_properties[ref_key] = current_properties[ref_key]
-            else:
-                # Add missing key with reference value
-                updated_properties[ref_key] = ref_value
-
-        write_toml_file(branch_path / file_path, updated_properties)
-
-
-def check_for_missing_keys(reference_file, file_list, branch):
-    update_missing_keys(reference_file, file_list, branch)
-
-
-def read_toml_keys(file_path):
-    file_path = Path(file_path)
-    if file_path.is_file():
-        return parse_toml_file(file_path)
-    return {}
-
-
-def check_for_differences(reference_file, file_list, branch, actor):
-    reference_branch = branch
-    reference_file = Path(reference_file)
-    basename_reference_file = reference_file.name
-    branch_path = Path(branch) if branch else Path()
-
-    report = []
-    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_keys = read_toml_keys(reference_file)
-    has_differences = False
-
-    only_reference_file = True
-
-    file_arr = file_list
-
-    if len(file_list) == 1:
-        file_arr = file_list[0].split()
-
-    base_dir = Path.cwd() / "frontend" / "editor" / "public" / "locales"
-
-    for file_path in file_arr:
-        file_path = Path(file_path)
-        file_normpath = file_path
-        absolute_path = file_normpath.resolve()
-
-        basename_current_file = (branch_path / file_normpath).name
-        locale_dir = file_normpath.parent.name
-        report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-
-        # Verify that file is within the expected directory
-        if not absolute_path.is_relative_to(base_dir):
-            has_differences = True
-            report.append(
-                f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n"
-            )
-            continue
-
-        # Verify file size before processing
-        if (branch_path / file_normpath).stat().st_size > MAX_FILE_SIZE:
-            has_differences = True
-            report.append(
-                f"\n⚠️ The file `{locale_dir}/{basename_current_file}` is too large and could pose a security risk.\n\n---\n"
-            )
-            continue
-
-        if basename_current_file == basename_reference_file and locale_dir == "en-US":
-            continue
-
-        if (
-            file_normpath.suffix != ".toml"
-            or basename_current_file != "translation.toml"
-        ):
-            continue
-
-        only_reference_file = False
-        current_keys = read_toml_keys(branch_path / file_path)
-        reference_key_count = len(reference_keys)
-        current_key_count = len(current_keys)
-
-        if reference_key_count != current_key_count:
-            report.append("")
-            report.append("1. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            has_differences = True
-            if reference_key_count > current_key_count:
-                report.append(
-                    f"    - **_Mismatched key count_**: {reference_key_count} (reference) vs {current_key_count} (current). Translation keys are missing."
-                )
-            elif reference_key_count < current_key_count:
-                report.append(
-                    f"    - **_Too many keys_**: {reference_key_count} (reference) vs {current_key_count} (current). Please verify if there are additional keys that need to be removed."
-                )
-        else:
-            report.append("1. **Test Status:** ✅ **_Passed_**")
-
-        # Check for missing or extra keys
-        current_keys_set = set(current_keys.keys())
-        reference_keys_set = set(reference_keys.keys())
-        missing_keys = current_keys_set.difference(reference_keys_set)
-        extra_keys = reference_keys_set.difference(current_keys_set)
-        missing_keys_list = list(missing_keys)
-        extra_keys_list = list(extra_keys)
-
-        if missing_keys_list or extra_keys_list:
-            has_differences = True
-            missing_keys_str = "`, `".join(missing_keys_list)
-            extra_keys_str = "`, `".join(extra_keys_list)
-            report.append("2. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            if missing_keys_list:
-                report.append(
-                    f"    - **_Extra keys in `{locale_dir}/{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
-                )
-                report.append("")
-                report.append("    Use the following command to remove them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
-                )
-                report.append("")
-            if extra_keys_list:
-                report.append(
-                    f"    - **_Missing keys in `{locale_dir}/{basename_current_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_reference_file}`_**."
-                )
-                report.append("")
-                report.append("    Use the following command to add them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
-                )
-                report.append("")
-
-            if missing_keys_list or extra_keys_list:
-                report.append(
-                    "    See: https://github.com/Stirling-Tools/Stirling-PDF/tree/main/scripts/translations#2-translation_mergerpy"
-                )
-        else:
-            report.append("2. **Test Status:** ✅ **_Passed_**")
-
-        if find_duplicate_keys(branch_path / file_normpath):
-            has_differences = True
-            output = "\n".join(
-                [
-                    f"      - `{key}`: first at {first}, duplicate at `{duplicate}`"
-                    for key, first, duplicate in find_duplicate_keys(
-                        branch_path / file_normpath
-                    )
-                ]
-            )
-            report.append("3. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            report.append("    - duplicate entries were found:")
-            report.append(output)
-        else:
-            report.append("3. **Test Status:** ✅ **_Passed_**")
-
-        report.append("")
-        report.append("---")
-        report.append("")
-
-    if has_differences:
-        report.append("## ❌ Overall Check Status: **_Failed_**")
-        report.append("")
-        report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/editor/public/locales/en-US/translation.toml)"
-        )
-    else:
-        report.append("## ✅ Overall Check Status: **_Success_**")
-        report.append("")
-        report.append(
-            f"Thanks @{actor} for your help in keeping the translations up to date."
-        )
-
-    if not only_reference_file:
-        print("\n".join(report))
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(
-        description="Find missing keys in TOML translation files"
-    )
-    parser.add_argument(
-        "--actor",
-        required=False,
-        help="Actor from PR.",
-    )
-    parser.add_argument(
-        "--reference-file",
-        required=True,
-        help="Path to the reference file.",
-    )
-    parser.add_argument(
-        "--branch",
-        type=str,
-        required=True,
-        help="Branch name.",
-    )
-    parser.add_argument(
-        "--check-file",
-        type=str,
-        required=False,
-        help="List of changed files, separated by spaces.",
-    )
-    parser.add_argument(
-        "--files",
-        nargs="+",
-        required=False,
-        help="List of changed files, separated by spaces.",
-    )
-    args = parser.parse_args()
-
-    # Sanitize --actor input to avoid injection attacks
-    if args.actor:
-        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
-
-    # Sanitize --branch input to avoid injection attacks
-    if args.branch:
-        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
-
-    file_list = args.files
-    if file_list is None:
-        if args.check_file:
-            file_list = [args.check_file]
-        else:
-            file_list = glob.glob(
-                os.path.join(
-                    os.getcwd(),
-                    "frontend",
-                    "editor",
-                    "public",
-                    "locales",
-                    "*",
-                    "translation.toml",
-                )
-            )
-        update_missing_keys(args.reference_file, file_list)
-    else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/requirements_dev.in

@@ -1,9 +0,0 @@
-pip
-setuptools
-WeasyPrint
-pdf2image
-pillow
-unoserver
-opencv-python-headless
-pre-commit
-brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29

.github/scripts/requirements_dev.txt

@@ -1,515 +0,0 @@
-#
-# This file is autogenerated by pip-compile with Python 3.12
-# by the following command:
-#
-#    pip-compile --allow-unsafe --generate-hashes --output-file='.github\scripts\requirements_dev.txt' --strip-extras '.github\scripts\requirements_dev.in'
-#
-# WARNING: pip install will require the following package to be hashed.
-# Consider using a hashable URL like https://github.com/jazzband/pip-tools/archive/SOMECOMMIT.zip
-# CVE-2025-6176 mitigation: pin brotli to a specific commit
-brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
-    # via
-    #   -r .github/scripts/requirements_dev.in
-    #   fonttools
-cffi==2.0.0 \
-    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
-    --hash=sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b \
-    --hash=sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f \
-    --hash=sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9 \
-    --hash=sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44 \
-    --hash=sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2 \
-    --hash=sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c \
-    --hash=sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75 \
-    --hash=sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65 \
-    --hash=sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e \
-    --hash=sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a \
-    --hash=sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e \
-    --hash=sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25 \
-    --hash=sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a \
-    --hash=sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe \
-    --hash=sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b \
-    --hash=sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91 \
-    --hash=sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592 \
-    --hash=sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187 \
-    --hash=sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c \
-    --hash=sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1 \
-    --hash=sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94 \
-    --hash=sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba \
-    --hash=sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb \
-    --hash=sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165 \
-    --hash=sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529 \
-    --hash=sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca \
-    --hash=sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c \
-    --hash=sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6 \
-    --hash=sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c \
-    --hash=sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0 \
-    --hash=sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743 \
-    --hash=sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63 \
-    --hash=sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5 \
-    --hash=sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5 \
-    --hash=sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4 \
-    --hash=sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d \
-    --hash=sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b \
-    --hash=sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93 \
-    --hash=sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205 \
-    --hash=sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27 \
-    --hash=sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512 \
-    --hash=sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d \
-    --hash=sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c \
-    --hash=sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037 \
-    --hash=sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26 \
-    --hash=sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322 \
-    --hash=sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb \
-    --hash=sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c \
-    --hash=sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8 \
-    --hash=sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4 \
-    --hash=sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414 \
-    --hash=sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9 \
-    --hash=sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664 \
-    --hash=sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9 \
-    --hash=sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775 \
-    --hash=sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739 \
-    --hash=sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc \
-    --hash=sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062 \
-    --hash=sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe \
-    --hash=sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9 \
-    --hash=sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92 \
-    --hash=sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5 \
-    --hash=sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13 \
-    --hash=sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d \
-    --hash=sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26 \
-    --hash=sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f \
-    --hash=sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495 \
-    --hash=sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b \
-    --hash=sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6 \
-    --hash=sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c \
-    --hash=sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef \
-    --hash=sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5 \
-    --hash=sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18 \
-    --hash=sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad \
-    --hash=sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3 \
-    --hash=sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7 \
-    --hash=sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5 \
-    --hash=sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534 \
-    --hash=sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49 \
-    --hash=sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2 \
-    --hash=sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5 \
-    --hash=sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453 \
-    --hash=sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf
-    # via weasyprint
-cfgv==3.5.0 \
-    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
-    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
-    # via pre-commit
-cssselect2==0.9.0 \
-    --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
-    --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
-    # via weasyprint
-distlib==0.4.0 \
-    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
-    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
-    # via virtualenv
-filelock==3.29.0 \
-    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
-    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
-    # via
-    #   python-discovery
-    #   virtualenv
-fonttools==4.62.1 \
-    --hash=sha256:0aa72c43a601cfa9273bb1ae0518f1acadc01ee181a6fc60cd758d7fdadffc04 \
-    --hash=sha256:0b3ae47e8636156a9accff64c02c0924cbebad62854c4a6dbdc110cd5b4b341a \
-    --hash=sha256:12859ff0b47dd20f110804c3e0d0970f7b832f561630cd879969011541a464a9 \
-    --hash=sha256:149f7d84afca659d1a97e39a4778794a2f83bf344c5ee5134e09995086cc2392 \
-    --hash=sha256:1596aeaddf7f78e21e68293c011316a25267b3effdaccaf4d59bc9159d681b82 \
-    --hash=sha256:19177c8d96c7c36359266e571c5173bcee9157b59cfc8cb0153c5673dc5a3a7d \
-    --hash=sha256:1c5c25671ce8805e0d080e2ffdeca7f1e86778c5cbfbeae86d7f866d8830517b \
-    --hash=sha256:1eecc128c86c552fb963fe846ca4e011b1be053728f798185a1687502f6d398e \
-    --hash=sha256:268abb1cb221e66c014acc234e872b7870d8b5d4657a83a8f4205094c32d2416 \
-    --hash=sha256:2d850f66830a27b0d498ee05adb13a3781637b1826982cd7e2b3789ef0cc71ae \
-    --hash=sha256:2e7abd2b1e11736f58c1de27819e1955a53267c21732e78243fa2fa2e5c1e069 \
-    --hash=sha256:403d28ce06ebfc547fbcb0cb8b7f7cc2f7a2d3e1a67ba9a34b14632df9e080f9 \
-    --hash=sha256:40975849bac44fb0b9253d77420c6d8b523ac4dcdcefeff6e4d706838a5b80f7 \
-    --hash=sha256:486f32c8047ccd05652aba17e4a8819a3a9d78570eb8a0e3b4503142947880ed \
-    --hash=sha256:49a445d2f544ce4a69338694cad575ba97b9a75fff02720da0882d1a73f12800 \
-    --hash=sha256:59b372b4f0e113d3746b88985f1c796e7bf830dd54b28374cd85c2b8acd7583e \
-    --hash=sha256:5a648bde915fba9da05ae98856987ca91ba832949a9e2888b48c47ef8b96c5a9 \
-    --hash=sha256:5f37df1cac61d906e7b836abe356bc2f34c99d4477467755c216b72aa3dc748b \
-    --hash=sha256:6706d1cb1d5e6251a97ad3c1b9347505c5615c112e66047abbef0f8545fa30d1 \
-    --hash=sha256:68959f5fc58ed4599b44aad161c2837477d7f35f5f79402d97439974faebfebe \
-    --hash=sha256:6acb4109f8bee00fec985c8c7afb02299e35e9c94b57287f3ea542f28bd0b0a7 \
-    --hash=sha256:7487782e2113861f4ddcc07c3436450659e3caa5e470b27dc2177cade2d8e7fd \
-    --hash=sha256:7aa21ff53e28a9c2157acbc44e5b401149d3c9178107130e82d74ceb500e5056 \
-    --hash=sha256:7bca7a1c1faf235ffe25d4f2e555246b4750220b38de8261d94ebc5ce8a23c23 \
-    --hash=sha256:8d337fdd49a79b0d51c4da87bc38169d21c3abbf0c1aa9367eff5c6656fb6dae \
-    --hash=sha256:8f8fca95d3bb3208f59626a4b0ea6e526ee51f5a8ad5d91821c165903e8d9260 \
-    --hash=sha256:90365821debbd7db678809c7491ca4acd1e0779b9624cdc6ddaf1f31992bf974 \
-    --hash=sha256:92bb00a947e666169c99b43753c4305fc95a890a60ef3aeb2a6963e07902cc87 \
-    --hash=sha256:93c316e0f5301b2adbe6a5f658634307c096fd5aae60a5b3412e4f3e1728ab24 \
-    --hash=sha256:942b03094d7edbb99bdf1ae7e9090898cad7bf9030b3d21f33d7072dbcb51a53 \
-    --hash=sha256:9c125ffa00c3d9003cdaaf7f2c79e6e535628093e14b5de1dccb08859b680936 \
-    --hash=sha256:9dde91633f77fa576879a0c76b1d89de373cae751a98ddf0109d54e173b40f14 \
-    --hash=sha256:9e7863e10b3de72376280b515d35b14f5eeed639d1aa7824f4cf06779ec65e42 \
-    --hash=sha256:a24decd24d60744ee8b4679d38e88b8303d86772053afc29b19d23bb8207803c \
-    --hash=sha256:a5d8825e1140f04e6c99bb7d37a9e31c172f3bc208afbe02175339e699c710e1 \
-    --hash=sha256:aa69d10ed420d8121118e628ad47d86e4caa79ba37f968597b958f6cceab7eca \
-    --hash=sha256:ad5cca75776cd453b1b035b530e943334957ae152a36a88a320e779d61fc980c \
-    --hash=sha256:b4e0fcf265ad26e487c56cb12a42dffe7162de708762db951e1b3f755319507d \
-    --hash=sha256:b820fcb92d4655513d8402d5b219f94481c4443d825b4372c75a2072aa4b357a \
-    --hash=sha256:bd13b7999d59c5eb1c2b442eb2d0c427cb517a0b7a1f5798fc5c9e003f5ff782 \
-    --hash=sha256:bdfe592802ef939a0e33106ea4a318eeb17822c7ee168c290273cbd5fabd746c \
-    --hash=sha256:c05557a78f8fa514da0f869556eeda40887a8abc77c76ee3f74cf241778afd5a \
-    --hash=sha256:c22b1014017111c401469e3acc5433e6acf6ebcc6aa9efb538a533c800971c79 \
-    --hash=sha256:c9b9e288b4da2f64fd6180644221749de651703e8d0c16bd4b719533a3a7d6e3 \
-    --hash=sha256:d241cdc4a67b5431c6d7f115fdf63335222414995e3a1df1a41e1182acd4bcc7 \
-    --hash=sha256:e54c75fd6041f1122476776880f7c3c3295ffa31962dc6ebe2543c00dca58b5d \
-    --hash=sha256:e8514f4924375f77084e81467e63238b095abda5107620f49421c368a6017ed2 \
-    --hash=sha256:ee91628c08e76f77b533d65feb3fbe6d9dad699f95be51cf0d022db94089cdc4 \
-    --hash=sha256:ef46db46c9447103b8f3ff91e8ba009d5fe181b1920a83757a5762551e32bb68 \
-    --hash=sha256:fa1d16210b6b10a826d71bed68dd9ec24a9e218d5a5e2797f37c573e7ec215ca
-    # via weasyprint
-identify==2.6.19 \
-    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
-    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
-    # via pre-commit
-nodeenv==1.10.0 \
-    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
-    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
-    # via pre-commit
-numpy==2.4.4 \
-    --hash=sha256:07077278157d02f65c43b1b26a3886bce886f95d20aabd11f87932750dfb14ed \
-    --hash=sha256:08f2e31ed5e6f04b118e49821397f12767934cfdd12a1ce86a058f91e004ee50 \
-    --hash=sha256:0aec54fd785890ecca25a6003fd9a5aed47ad607bbac5cd64f836ad8666f4959 \
-    --hash=sha256:0d35aea54ad1d420c812bfa0385c71cd7cc5bcf7c65fed95fc2cd02fe8c79827 \
-    --hash=sha256:0d4e437e295f18ec29bc79daf55e8a47a9113df44d66f702f02a293d93a2d6dd \
-    --hash=sha256:0dfd3f9d3adbe2920b68b5cd3d51444e13a10792ec7154cd0a2f6e74d4ab3233 \
-    --hash=sha256:1378871da56ca8943c2ba674530924bb8ca40cd228358a3b5f302ad60cf875fc \
-    --hash=sha256:15716cfef24d3a9762e3acdf87e27f58dc823d1348f765bbea6bef8c639bfa1b \
-    --hash=sha256:19710a9ca9992d7174e9c52f643d4272dcd1558c5f7af7f6f8190f633bd651a7 \
-    --hash=sha256:23cbfd4c17357c81021f21540da84ee282b9c8fba38a03b7b9d09ba6b951421e \
-    --hash=sha256:2483e4584a1cb3092da4470b38866634bafb223cbcd551ee047633fd2584599a \
-    --hash=sha256:27a8d92cd10f1382a67d7cf4db7ce18341b66438bdd9f691d7b0e48d104c2a9d \
-    --hash=sha256:28a650663f7314afc3e6ec620f44f333c386aad9f6fc472030865dc0ebb26ee3 \
-    --hash=sha256:2aa0613a5177c264ff5921051a5719d20095ea586ca88cc802c5c218d1c67d3e \
-    --hash=sha256:2c194dd721e54ecad9ad387c1d35e63dce5c4450c6dc7dd5611283dda239aabb \
-    --hash=sha256:2d19e6e2095506d1736b7d80595e0f252d76b89f5e715c35e06e937679ea7d7a \
-    --hash=sha256:2d390634c5182175533585cc89f3608a4682ccb173cc9bb940b2881c8d6f8fa0 \
-    --hash=sha256:30caa73029a225b2d40d9fae193e008e24b2026b7ee1a867b7ee8d96ca1a448e \
-    --hash=sha256:42c16925aa5a02362f986765f9ebabf20de75cdefdca827d14315c568dcab113 \
-    --hash=sha256:45dbed2ab436a9e826e302fcdcbe9133f9b0006e5af7168afb8963a6520da103 \
-    --hash=sha256:4636de7fd195197b7535f231b5de9e4b36d2c440b6e566d2e4e4746e6af0ca93 \
-    --hash=sha256:4a19d9dba1a76618dd86b164d608566f393f8ec6ac7c44f0cc879011c45e65af \
-    --hash=sha256:4bbc7f303d125971f60ec0aaad5e12c62d0d2c925f0ab1273debd0e4ba37aba5 \
-    --hash=sha256:4d6d57903571f86180eb98f8f0c839fa9ebbfb031356d87f1361be91e433f5b7 \
-    --hash=sha256:4e874c976154687c1f71715b034739b45c7711bec81db01914770373d125e392 \
-    --hash=sha256:51fc224f7ca4d92656d5a5eb315f12eb5fe2c97a66249aa7b5f562528a3be38c \
-    --hash=sha256:58c8b5929fcb8287cbd6f0a3fae19c6e03a5c48402ae792962ac465224a629a4 \
-    --hash=sha256:5a285b3b96f951841799528cd1f4f01cd70e7e0204b4abebac9463eecfcf2a40 \
-    --hash=sha256:5c70f1cc1c4efbe316a572e2d8b9b9cc44e89b95f79ca3331553fbb63716e2bf \
-    --hash=sha256:62d6b0f03b694173f9fcb1fb317f7222fd0b0b103e784c6549f5e53a27718c44 \
-    --hash=sha256:6a246d5914aa1c820c9443ddcee9c02bec3e203b0c080349533fae17727dfd1b \
-    --hash=sha256:6aa3236c78803afbcb255045fbef97a9e25a1f6c9888357d205ddc42f4d6eba5 \
-    --hash=sha256:6bbe4eb67390b0a0265a2c25458f6b90a409d5d069f1041e6aff1e27e3d9a79e \
-    --hash=sha256:715d1c092715954784bc79e1174fc2a90093dc4dc84ea15eb14dad8abdcdeb74 \
-    --hash=sha256:72944b19f2324114e9dc86a159787333b77874143efcf89a5167ef83cfee8af0 \
-    --hash=sha256:81f4a14bee47aec54f883e0cad2d73986640c1590eb9bfaaba7ad17394481e6e \
-    --hash=sha256:846300f379b5b12cc769334464656bc882e0735d27d9726568bc932fdc49d5ec \
-    --hash=sha256:86b6f55f5a352b48d7fbfd2dbc3d5b780b2d79f4d3c121f33eb6efb22e9a2015 \
-    --hash=sha256:874f200b2a981c647340f841730fc3a2b54c9d940566a3c4149099591e2c4c3d \
-    --hash=sha256:8a87ec22c87be071b6bdbd27920b129b94f2fc964358ce38f3822635a3e2e03d \
-    --hash=sha256:8b3b60bb7cba2c8c81837661c488637eee696f59a877788a396d33150c35d842 \
-    --hash=sha256:8e3ed142f2728df44263aaf5fb1f5b0b99f4070c553a0d7f033be65338329150 \
-    --hash=sha256:93e15038125dc1e5345d9b5b68aa7f996ec33b98118d18c6ca0d0b7d6198b7e8 \
-    --hash=sha256:989824e9faf85f96ec9c7761cd8d29c531ad857bfa1daa930cba85baaecf1a9a \
-    --hash=sha256:99d838547ace2c4aace6c4f76e879ddfe02bb58a80c1549928477862b7a6d6ed \
-    --hash=sha256:9b2aec6af35c113b05695ebb5749a787acd63cafc83086a05771d1e1cd1e555f \
-    --hash=sha256:9c585a1790d5436a5374bac930dad6ed244c046ed91b2b2a3634eb2971d21008 \
-    --hash=sha256:a7164afb23be6e37ad90b2f10426149fd75aee07ca55653d2aa41e66c4ef697e \
-    --hash=sha256:ac6b31e35612a26483e20750126d30d0941f949426974cace8e6b5c58a3657b0 \
-    --hash=sha256:ad2e2ef14e0b04e544ea2fa0a36463f847f113d314aa02e5b402fdf910ef309e \
-    --hash=sha256:b268594bccac7d7cf5844c7732e3f20c50921d94e36d7ec9b79e9857694b1b2f \
-    --hash=sha256:b5f0362dc928a6ecd9db58868fca5e48485205e3855957bdedea308f8672ea4a \
-    --hash=sha256:ba1f4fc670ed79f876f70082eff4f9583c15fb9a4b89d6188412de4d18ae2f40 \
-    --hash=sha256:ba203255017337d39f89bdd58417f03c4426f12beed0440cfd933cb15f8669c7 \
-    --hash=sha256:c901b15172510173f5cb310eae652908340f8dede90fff9e3bf6c0d8dfd92f83 \
-    --hash=sha256:c9b39d38a9bd2ae1becd7eac1303d031c5c110ad31f2b319c6e7d98b135c934d \
-    --hash=sha256:d2a8490669bfe99a233298348acc2d824d496dee0e66e31b66a6022c2ad74a5c \
-    --hash=sha256:dddbbd259598d7240b18c9d87c56a9d2fb3b02fe266f49a7c101532e78c1d871 \
-    --hash=sha256:df3775294accfdd75f32c74ae39fcba920c9a378a2fc18a12b6820aa8c1fb502 \
-    --hash=sha256:e44319a2953c738205bf3354537979eaa3998ed673395b964c1176083dd46252 \
-    --hash=sha256:e4a010c27ff6f210ff4c6ef34394cd61470d01014439b192ec22552ee867f2a8 \
-    --hash=sha256:e823b8b6edc81e747526f70f71a9c0a07ac4e7ad13020aa736bb7c9d67196115 \
-    --hash=sha256:e892aff75639bbef0d2a2cfd55535510df26ff92f63c92cd84ef8d4ba5a5557f \
-    --hash=sha256:eea7ac5d2dce4189771cedb559c738a71512768210dc4e4753b107a2048b3d0e \
-    --hash=sha256:ef4059d6e5152fa1a39f888e344c73fdc926e1b2dd58c771d67b0acfbf2aa67d \
-    --hash=sha256:f169b9a863d34f5d11b8698ead99febeaa17a13ca044961aa8e2662a6c7766a0 \
-    --hash=sha256:f2cf083b324a467e1ab358c105f6cad5ea950f50524668a80c486ff1db24e119 \
-    --hash=sha256:f8474c4241bc18b750be2abea9d7a9ec84f46ef861dbacf86a4f6e043401f79e \
-    --hash=sha256:f983334aea213c99992053ede6168500e5f086ce74fbc4acc3f2b00f5762e9db \
-    --hash=sha256:f9e75681b59ddaa5e659898085ae0eaea229d054f2ac0c7e563a62205a700121 \
-    --hash=sha256:fbc356aae7adf9e6336d336b9c8111d390a05df88f1805573ebb0807bd06fd1d \
-    --hash=sha256:fcfe2045fd2e8f3cb0ce9d4ba6dba6333b8fa05bb8a4939c908cd43322d14c7e
-    # via opencv-python-headless
-opencv-python-headless==4.13.0.92 \
-    --hash=sha256:0525a3d2c0b46c611e2130b5fdebc94cf404845d8fa64d2f3a3b679572a5bd22 \
-    --hash=sha256:0bd48544f77c68b2941392fcdf9bcd2b9cdf00e98cb8c29b2455d194763cf99e \
-    --hash=sha256:1a7d040ac656c11b8c38677cc8cccdc149f98535089dbe5b081e80a4e5903209 \
-    --hash=sha256:3e0a6f0a37994ec6ce5f59e936be21d5d6384a4556f2d2da9c2f9c5dc948394c \
-    --hash=sha256:5c8cfc8e87ed452b5cecb9419473ee5560a989859fe1d10d1ce11ae87b09a2cb \
-    --hash=sha256:77a82fe35ddcec0f62c15f2ba8a12ecc2ed4207c17b0902c7a3151ae29f37fb6 \
-    --hash=sha256:a7cf08e5b191f4ebb530791acc0825a7986e0d0dee2a3c491184bd8599848a4b \
-    --hash=sha256:eb60e36b237b1ebd40a912da5384b348df8ed534f6f644d8e0b4f103e272ba7d
-    # via -r .github/scripts/requirements_dev.in
-pdf2image==1.17.0 \
-    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
-    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r .github/scripts/requirements_dev.in
-pillow==12.2.0 \
-    --hash=sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9 \
-    --hash=sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5 \
-    --hash=sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987 \
-    --hash=sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9 \
-    --hash=sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b \
-    --hash=sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f \
-    --hash=sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd \
-    --hash=sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e \
-    --hash=sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e \
-    --hash=sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe \
-    --hash=sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795 \
-    --hash=sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601 \
-    --hash=sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1 \
-    --hash=sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed \
-    --hash=sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea \
-    --hash=sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5 \
-    --hash=sha256:2e589959f10d9824d39b350472b92f0ce3b443c0a3442ebf41c40cb8361c5b97 \
-    --hash=sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453 \
-    --hash=sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98 \
-    --hash=sha256:34c0d99ecccea270c04882cb3b86e7b57296079c9a4aff88cb3b33563d95afaa \
-    --hash=sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b \
-    --hash=sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d \
-    --hash=sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705 \
-    --hash=sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8 \
-    --hash=sha256:3e080565d8d7c671db5802eedfb438e5565ffa40115216eabb8cd52d0ecce024 \
-    --hash=sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0 \
-    --hash=sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286 \
-    --hash=sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150 \
-    --hash=sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2 \
-    --hash=sha256:51c4167c34b0d8ba05b547a3bb23578d0ba17b80a5593f93bd8ecb123dd336a3 \
-    --hash=sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b \
-    --hash=sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f \
-    --hash=sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463 \
-    --hash=sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940 \
-    --hash=sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166 \
-    --hash=sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed \
-    --hash=sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f \
-    --hash=sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795 \
-    --hash=sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780 \
-    --hash=sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7 \
-    --hash=sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1 \
-    --hash=sha256:673aa32138f3e7531ccdbca7b3901dba9b70940a19ccecc6a37c77d5fdeb05b5 \
-    --hash=sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295 \
-    --hash=sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b \
-    --hash=sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354 \
-    --hash=sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60 \
-    --hash=sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65 \
-    --hash=sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005 \
-    --hash=sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c \
-    --hash=sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be \
-    --hash=sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5 \
-    --hash=sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06 \
-    --hash=sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae \
-    --hash=sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c \
-    --hash=sha256:88d387ff40b3ff7c274947ed3125dedf5262ec6919d83946753b5f3d7c67ea4c \
-    --hash=sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612 \
-    --hash=sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e \
-    --hash=sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab \
-    --hash=sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808 \
-    --hash=sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f \
-    --hash=sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e \
-    --hash=sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909 \
-    --hash=sha256:975385f4776fafde056abb318f612ef6285b10a1f12b8570f3647ad0d74b48ec \
-    --hash=sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe \
-    --hash=sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50 \
-    --hash=sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4 \
-    --hash=sha256:a4e8f36e677d3336f35089648c8955c51c6d386a13cf6ee9c189c5f5bd713a9f \
-    --hash=sha256:a52edc8bfff4429aaabdf4d9ee0daadbbf8562364f940937b941f87a4290f5ff \
-    --hash=sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5 \
-    --hash=sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb \
-    --hash=sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414 \
-    --hash=sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1 \
-    --hash=sha256:b85f66ae9eb53e860a873b858b789217ba505e5e405a24b85c0464822fe88032 \
-    --hash=sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76 \
-    --hash=sha256:bd9c0c7a0c681a347b3194c500cb1e6ca9cab053ea4d82a5cf45b6b754560136 \
-    --hash=sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e \
-    --hash=sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c \
-    --hash=sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3 \
-    --hash=sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea \
-    --hash=sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f \
-    --hash=sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104 \
-    --hash=sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176 \
-    --hash=sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24 \
-    --hash=sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3 \
-    --hash=sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4 \
-    --hash=sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed \
-    --hash=sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43 \
-    --hash=sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421 \
-    --hash=sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7 \
-    --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
-    --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
-    # via
-    #   -r .github/scripts/requirements_dev.in
-    #   pdf2image
-    #   weasyprint
-platformdirs==4.9.6 \
-    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
-    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
-    # via
-    #   python-discovery
-    #   virtualenv
-pre-commit==4.6.0 \
-    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
-    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
-    # via -r .github/scripts/requirements_dev.in
-pycparser==3.0 \
-    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
-    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
-    # via cffi
-pydyf==0.12.1 \
-    --hash=sha256:ea25b4e1fe7911195cb57067560daaa266639184e8335365cc3ee5214e7eaadc \
-    --hash=sha256:fbd7e759541ac725c29c506612003de393249b94310ea78ae44cb1d04b220095
-    # via weasyprint
-pyphen==0.17.2 \
-    --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
-    --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
-    # via weasyprint
-python-discovery==1.2.2 \
-    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
-    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
-    # via virtualenv
-pyyaml==6.0.3 \
-    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
-    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
-    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
-    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
-    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
-    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
-    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
-    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
-    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
-    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
-    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
-    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
-    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
-    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
-    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
-    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
-    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
-    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
-    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
-    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
-    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
-    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
-    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
-    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
-    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
-    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
-    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
-    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
-    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
-    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
-    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
-    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
-    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
-    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
-    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
-    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
-    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
-    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
-    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
-    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
-    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
-    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
-    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
-    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
-    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
-    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
-    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
-    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
-    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
-    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
-    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
-    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
-    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
-    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
-    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
-    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
-    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
-    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
-    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
-    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
-    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
-    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
-    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
-    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
-    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
-    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
-    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
-    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
-    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
-    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
-    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
-    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
-    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
-    # via pre-commit
-tinycss2==1.5.1 \
-    --hash=sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661 \
-    --hash=sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957
-    # via
-    #   cssselect2
-    #   weasyprint
-tinyhtml5==2.1.0 \
-    --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
-    --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
-    # via weasyprint
-unoserver==3.6 \
-    --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
-    --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r .github/scripts/requirements_dev.in
-virtualenv==21.2.4 \
-    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
-    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
-    # via pre-commit
-weasyprint==68.1 \
-    --hash=sha256:4dc3ba63c68bbbce3e9617cb2226251c372f5ee90a8a484503b1c099da9cf5be \
-    --hash=sha256:d3b752049b453a5c95edb27ce78d69e9319af5a34f257fa0f4c738c701b4184e
-    # via -r .github/scripts/requirements_dev.in
-webencodings==0.5.1 \
-    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
-    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
-    # via
-    #   cssselect2
-    #   tinycss2
-    #   tinyhtml5
-zopfli==0.4.1 \
-    --hash=sha256:02086247dd12fda929f9bfe8b3962b6bcdbfc8c82e99255aebcf367867cf0760 \
-    --hash=sha256:07a5cdc5d1aaa6c288c5d9f5a5383042ba743641abf8e2fd898dcad622d8a38e \
-    --hash=sha256:27823dc1161a4031d1c25925fd45d9868ec0cbc7692341830a7dcfa25063662c \
-    --hash=sha256:2f992ac7d83cbddd889e1813ace576cbc91a05d5d7a0a21b366e2e5f492e7707 \
-    --hash=sha256:4238d4d746d1095e29c9125490985e0c12ffd3654f54a24af551e2391e936d54 \
-    --hash=sha256:5a4c22b6161f47f5bd34637dbaee6735abd287cd64e0d1ce28ef1871bf625f4b \
-    --hash=sha256:84a31ba9edc921b1d3a4449929394a993888f32d70de3a3617800c428a947b9b \
-    --hash=sha256:a899eca405662a23ae75054affa3517a060362eae1185d3d791c86a50153c4dd \
-    --hash=sha256:a93c2ecafff372de6c0aa2212eff18a75f6c71a100372fee7b4b129cc0b6f9a7 \
-    --hash=sha256:cb136a74d14a4ecfae29cb0fdecece58a6c115abc9a74c12bc6ac62e80f229d7 \
-    --hash=sha256:d7bcee1b189d64ec33d1e05cfa1b6a1268c29329c382f6ca1bd6245b04925c57 \
-    --hash=sha256:fdfb7ce9f5de37a5b2f75dd2642fd7717956ef2a72e0387302a36d382440db07
-    # via fonttools
-
-# The following packages are considered to be unsafe in a requirements file:
-pip==26.0.1 \
-    --hash=sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b \
-    --hash=sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8
-    # via -r .github/scripts/requirements_dev.in
-setuptools==82.0.1 \
-    --hash=sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9 \
-    --hash=sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb
-    # via -r .github/scripts/requirements_dev.in

.github/scripts/requirements_pre_commit.in

@@ -0,0 +1 @@
+pre-commit

.github/scripts/requirements_pre_commit.txt

@@ -0,0 +1,93 @@
+#
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
+#
+cfgv==3.4.0 \
+    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
+    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
+    # via pre-commit
+distlib==0.3.9 \
+    --hash=sha256:47f8c22fd27c27e25a65601af709b38e4f0a45ea4fc2e710f65755fa8caaaf87 \
+    --hash=sha256:a60f20dea646b8a33f3e7772f74dc0b2d0772d2837ee1342a00645c81edf9403
+    # via virtualenv
+filelock==3.18.0 \
+    --hash=sha256:adbc88eabb99d2fec8c9c1b229b171f18afa655400173ddc653d5d01501fb9f2 \
+    --hash=sha256:c401f4f8377c4464e6db25fff06205fd89bdd83b65eb0488ed1b160f780e21de
+    # via virtualenv
+identify==2.6.12 \
+    --hash=sha256:ad9672d5a72e0d2ff7c5c8809b62dfa60458626352fb0eb7b55e69bdc45334a2 \
+    --hash=sha256:d8de45749f1efb108badef65ee8386f0f7bb19a7f26185f74de6367bffbaf0e6
+    # via pre-commit
+nodeenv==1.9.1 \
+    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
+    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
+    # via pre-commit
+platformdirs==4.3.8 \
+    --hash=sha256:3d512d96e16bcb959a814c9f348431070822a6496326a4be0911c40b5a74c2bc \
+    --hash=sha256:ff7059bb7eb1179e2685604f4aaf157cfd9535242bd23742eadc3c13542139b4
+    # via virtualenv
+pre-commit==4.2.0 \
+    --hash=sha256:601283b9757afd87d40c4c4a9b2b5de9637a8ea02eaff7adc2d0fb4e04841146 \
+    --hash=sha256:a009ca7205f1eb497d10b845e52c838a98b6cdd2102a6c8e4540e94ee75c58bd
+    # via -r .github\scripts\requirements_pre_commit.in
+pyyaml==6.0.2 \
+    --hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
+    --hash=sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48 \
+    --hash=sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086 \
+    --hash=sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e \
+    --hash=sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133 \
+    --hash=sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5 \
+    --hash=sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484 \
+    --hash=sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee \
+    --hash=sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5 \
+    --hash=sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68 \
+    --hash=sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a \
+    --hash=sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf \
+    --hash=sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99 \
+    --hash=sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8 \
+    --hash=sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85 \
+    --hash=sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19 \
+    --hash=sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc \
+    --hash=sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a \
+    --hash=sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1 \
+    --hash=sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317 \
+    --hash=sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c \
+    --hash=sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631 \
+    --hash=sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d \
+    --hash=sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652 \
+    --hash=sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5 \
+    --hash=sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e \
+    --hash=sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b \
+    --hash=sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8 \
+    --hash=sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476 \
+    --hash=sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706 \
+    --hash=sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563 \
+    --hash=sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237 \
+    --hash=sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b \
+    --hash=sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083 \
+    --hash=sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180 \
+    --hash=sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425 \
+    --hash=sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e \
+    --hash=sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f \
+    --hash=sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725 \
+    --hash=sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183 \
+    --hash=sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab \
+    --hash=sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774 \
+    --hash=sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725 \
+    --hash=sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e \
+    --hash=sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5 \
+    --hash=sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d \
+    --hash=sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290 \
+    --hash=sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44 \
+    --hash=sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed \
+    --hash=sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4 \
+    --hash=sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba \
+    --hash=sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12 \
+    --hash=sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4
+    # via pre-commit
+virtualenv==20.31.2 \
+    --hash=sha256:36efd0d9650ee985f0cad72065001e66d49a6f24eb44d98980f630686243cf11 \
+    --hash=sha256:e10c0a9d02835e592521be48b332b6caee6887f332c111aa79a09b9e79efc2af
+    # via pre-commit

.github/scripts/requirements_sync_readme.in

@@ -1,2 +1 @@
 tomlkit
-tomli-w

.github/scripts/requirements_sync_readme.txt

@@ -1,14 +1,10 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
 #
-tomli-w==1.2.0 \
-    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
-    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
-    # via -r .github/scripts/requirements_sync_readme.in
-tomlkit==0.14.0 \
-    --hash=sha256:592064ed85b40fa213469f81ac584f67a4f2992509a7c3ea2d632208623a3680 \
-    --hash=sha256:cf00efca415dbd57575befb1f6634c4f42d2d87dbba376128adb42c121b87064
-    # via -r .github/scripts/requirements_sync_readme.in
+tomlkit==0.13.3 \
+    --hash=sha256:430cf247ee57df2b94ee3fbe588e71d362a941ebb545dec29b53961d61add2a1 \
+    --hash=sha256:c89c649d79ee40629a9fda55f8ace8c6a1b42deb912b2a8fd8d942ddadb606b0
+    # via -r .github\scripts\requirements_sync_readme.in

.github/scripts/verify-updater-signatures.py

@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-"""Verify Tauri updater .sig files against plugins.updater.pubkey in tauri.conf.json.
-
-Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
-"""
-
-import binascii
-import sys
-import json
-import base64
-import hashlib
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-from cryptography.exceptions import InvalidSignature
-
-ART_ROOT = Path(sys.argv[1])
-CONF = Path(
-    sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json"
-)
-
-
-def load_pubkey():
-    # tauri pubkey = base64 of a minisign .pub file; last line is base64 of
-    # [2 algo][8 key-id][32 ed25519 public key].
-    raw = json.loads(CONF.read_text())["plugins"]["updater"]["pubkey"]
-    blob = base64.b64decode(base64.b64decode(raw).decode().splitlines()[-1])
-    return blob[2:10], Ed25519PublicKey.from_public_bytes(blob[10:])
-
-
-def hash_file(path: Path) -> bytes:
-    h = hashlib.blake2b(digest_size=64)
-    with path.open("rb") as f:
-        for chunk in iter(lambda: f.read(1 << 16), b""):
-            h.update(chunk)
-    return h.digest()
-
-
-def verify(artifact: Path, sig_file: Path, keyid_pub, pub) -> str:
-    # tauri .sig = base64 of a minisign signature file (4 lines).
-    try:
-        lines = base64.b64decode(sig_file.read_text()).decode().splitlines()
-        sig_blob = base64.b64decode(lines[1])
-    except (binascii.Error, IndexError, UnicodeDecodeError) as e:
-        return f"FAIL malformed sig ({type(e).__name__})"
-    algo, keyid, sig = sig_blob[:2], sig_blob[2:10], sig_blob[10:74]
-    if keyid != keyid_pub:
-        return f"FAIL key-id mismatch (sig {keyid.hex()} vs pub {keyid_pub.hex()})"
-    # 'ED' = prehashed (BLAKE2b-512), 'Ed' = legacy (raw message).
-    msg = hash_file(artifact) if algo == b"ED" else artifact.read_bytes()
-    try:
-        pub.verify(sig, msg)
-    except InvalidSignature:
-        return f"FAIL signature invalid (algo={algo.decode()})"
-    # Global signature covers sig + trusted_comment.
-    gc = "global-sig FAIL"
-    try:
-        tc = lines[2].split("trusted comment: ", 1)[1]
-        pub.verify(base64.b64decode(lines[3]), sig + tc.encode())
-        gc = "global-sig OK"
-    except (InvalidSignature, IndexError, binascii.Error):
-        pass
-    return f"VALID (algo={algo.decode()}, keyid={keyid.hex()}, {gc})"
-
-
-keyid_pub, pub = load_pubkey()
-print(f"updater pubkey keyid={keyid_pub.hex()}\n")
-sigs = sorted(ART_ROOT.rglob("*.sig"))
-if not sigs:
-    print(f"WARN: no .sig files under {ART_ROOT} - nothing to verify")
-    sys.exit(0)
-bad = 0
-for sig_file in sigs:
-    artifact = sig_file.with_suffix("")
-    if not artifact.exists():
-        print(f"  ? {sig_file.name}: artifact missing")
-        bad += 1
-        continue
-    res = verify(artifact, sig_file, keyid_pub, pub)
-    print(f"  {artifact.name}: {res}")
-    if not res.startswith("VALID") or "global-sig FAIL" in res:
-        bad += 1
-print(f"\n{'ALL SIGNATURES VALID' if bad == 0 else f'{bad} SIGNATURE(S) FAILED'}")
-sys.exit(1 if bad else 0)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -1,577 +0,0 @@
-name: Auto PR V2 Deployment
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, closed]
-  workflow_dispatch:
-    inputs:
-      pr:
-        description: "PR number to deploy"
-        required: true
-      allow_fork:
-        description: "Allow deploying fork PR?"
-        required: false
-        type: choice
-        options:
-          - "true"
-          - "false"
-        default: "false"
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  check-pr:
-    if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    outputs:
-      should_deploy: ${{ steps.decide.outputs.should_deploy }}
-      is_fork: ${{ steps.resolve.outputs.is_fork }}
-      allow_fork: ${{ steps.decide.outputs.allow_fork }}
-      pr_number: ${{ steps.resolve.outputs.pr_number }}
-      pr_repository: ${{ steps.resolve.outputs.repository }}
-      pr_ref: ${{ steps.resolve.outputs.ref }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Resolve PR info
-        id: resolve
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            let prNumber = context.eventName === 'workflow_dispatch'
-              ? parseInt(context.payload.inputs.pr, 10)
-              : context.payload.number;
-
-            if (!Number.isInteger(prNumber)) { core.setFailed('Invalid PR number'); return; }
-
-            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
-            core.setOutput('pr_number', String(prNumber));
-            core.setOutput('repository', pr.head.repo.full_name);
-            core.setOutput('ref', pr.head.ref);
-            core.setOutput('is_fork', String(pr.head.repo.fork));
-            core.setOutput('author', pr.user.login);
-            core.setOutput('state', pr.state);
-
-      - name: Decide deploy
-        id: decide
-        shell: bash
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          STATE: ${{ steps.resolve.outputs.state }}
-          IS_FORK: ${{ steps.resolve.outputs.is_fork }}
-          # nur bei workflow_dispatch gesetzt:
-          ALLOW_FORK_INPUT: ${{ inputs.allow_fork }}
-          PR_AUTHOR: ${{ steps.resolve.outputs.author }}
-        run: |
-          set -e
-          # Standard: nichts deployen
-          should=false
-          allow_fork="$(echo "${ALLOW_FORK_INPUT:-false}" | tr '[:upper:]' '[:lower:]')"
-
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            if [ "$STATE" != "open" ]; then
-              echo "PR not open -> skip"
-            else
-              if [ "$IS_FORK" = "true" ] && [ "$allow_fork" != "true" ]; then
-                echo "Fork PR and allow_fork=false -> skip"
-              else
-                should=true
-              fi
-            fi
-          else
-            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
-            is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
-            if [ "$is_auth" = true ]; then
-              should=true
-            fi
-          fi
-
-          echo "should_deploy=$should" >> $GITHUB_OUTPUT
-          echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT
-
-  deploy-v2-pr:
-    needs: [pick, check-pr]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
-    # Concurrency control - only one deployment per PR at a time
-    concurrency:
-      group: v2-deploy-pr-${{ needs.check-pr.outputs.pr_number }}
-      cancel-in-progress: true
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-      # Single source of truth for whether this preview embeds the admin portal:
-      # drives the image build-arg and the deployment comment.
-      BUILD_PORTAL: "true"
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout main repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: main
-
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Add deployment started comment
-        id: deployment-started
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
-
-            // Delete previous V2 deployment comments to avoid clutter
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            const v2Comments = comments.filter(comment => 
-              comment.body.includes('🚀 **Auto-deploying V2 version**') ||
-              comment.body.includes('## 🚀 V2 Auto-Deployment Complete!') ||
-              comment.body.includes('❌ **V2 Auto-deployment failed**')
-            );
-
-            for (const comment of v2Comments) {
-              console.log(`Deleting old V2 comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-            // Create new deployment started comment
-            const { data: newComment } = await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment for approved V2 contributors._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
-            });
-            return newComment.id;
-
-      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: ${{ needs.check-pr.outputs.pr_repository }}
-          ref: ${{ needs.check-pr.outputs.pr_ref }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0 # Fetch full history for commit hash detection
-
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
-      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Get version number
-        id: versionNumber
-        run: |
-          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
-          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Get commit hash for app
-        id: commit-hash
-        run: |
-          # Get last commit that touched the application code
-          APP_HASH=$(git log -1 --format="%H" -- . 2>/dev/null || echo "")
-          if [ -z "$APP_HASH" ]; then
-            APP_HASH="no-changes"
-          fi
-
-          echo "App hash: $APP_HASH"
-          echo "app_hash=$APP_HASH" >> $GITHUB_OUTPUT
-
-          # Short hash for tags
-          if [ "$APP_HASH" = "no-changes" ]; then
-            echo "app_short=no-changes" >> $GITHUB_OUTPUT
-          else
-            echo "app_short=${APP_HASH:0:8}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check if image exists
-        id: check-image
-        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Image already exists, skipping build"
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Image needs to be built"
-          fi
-
-      - name: Build and push V2 image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: |
-            VERSION_TAG=v2-alpha
-            BUILD_PORTAL=${{ env.BUILD_PORTAL }}
-          platforms: linux/amd64
-
-      - name: Build and push V2 image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-image.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: |
-            VERSION_TAG=v2-alpha
-            BUILD_PORTAL=${{ env.BUILD_PORTAL }}
-          platforms: linux/amd64
-
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
-          sudo chmod 600 ../private.key
-
-      - name: Deploy V2 to VPS
-        id: deploy
-        run: |
-          # Use same port strategy as regular PRs - just the PR number
-          V2_PORT=${{ needs.check-pr.outputs.pr_number }}
-
-          # Create docker-compose for V2 with unified embedded image
-          cat > docker-compose.yml << EOF
-          version: '3.3'
-          services:
-            stirling-pdf-v2:
-              container_name: stirling-pdf-v2-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-              ports:
-                - "${V2_PORT}:8080"
-              volumes:
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
-              environment:
-                DISABLE_ADDITIONAL_FEATURES: "false"
-                POLICIES_ENABLED: "true"
-                STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
-                SECURITY_ENABLELOGIN: "true"
-                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
-                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
-                SYSTEM_DEFAULTLOCALE: en-US
-                UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
-                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
-                UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
-                SYSTEM_MAXFILESIZE: "100"
-                METRICS_ENABLED: "true"
-                SYSTEM_GOOGLEVISIBILITY: "false"
-                SWAGGER_SERVER_URL: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
-                baseUrl: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
-              restart: on-failure:5
-          EOF
-
-          # Deploy to VPS
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose-v2.yml
-
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
-            # Create V2 PR-specific directories
-            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
-
-            # Move docker-compose file to correct location
-            mv /tmp/docker-compose-v2.yml /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/docker-compose.yml
-
-            # Stop any existing container and clean up
-            cd /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}
-            docker-compose down --remove-orphans 2>/dev/null || true
-
-            # Start the new container
-            docker-compose pull
-            docker-compose up -d
-
-            # Clean up unused Docker resources to save space
-            docker system prune -af --volumes || true
-
-            # Clean up old images (older than 2 weeks)
-            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
-          ENDSSH
-
-          # Set port for output
-          echo "v2_port=${V2_PORT}" >> $GITHUB_OUTPUT
-
-      # ---- Storybook preview (only when this PR touches stories/.storybook) ----
-      # Runs inside the same approved-contributor-gated deploy job, so it deploys
-      # under the exact same access rules as the app preview.
-      - name: Detect Storybook changes
-        id: sb-changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        with:
-          list-files: json
-          filters: |
-            storybook:
-              - 'frontend/**/*.stories.@(ts|tsx|mdx)'
-              - 'frontend/**/*.mdx'
-              - 'frontend/.storybook/**'
-
-      - name: Set up Node.js for Storybook
-        if: steps.sb-changes.outputs.storybook == 'true'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task for Storybook
-        if: steps.sb-changes.outputs.storybook == 'true'
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Build and deploy Storybook
-        id: storybook
-        if: steps.sb-changes.outputs.storybook == 'true'
-        env:
-          VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
-          VPS_USER: ${{ secrets.NEW_VPS_USERNAME }}
-        run: |
-          set -euo pipefail
-          # `prepare` generates the icon set stories import (not committed).
-          task frontend:prepare
-          task frontend:storybook:build
-          PR=${{ needs.check-pr.outputs.pr_number }}
-          # Served at the ROOT of its own port so Storybook's global MSW worker
-          # (/mockServiceWorker.js) resolves. Port = PR + 20000 (bijective, offset
-          # from the app preview's bare-PR-number port).
-          SB_PORT=$((PR + 20000))
-          DIR=/stirling/SB-PR-$PR
-          tar czf storybook.tgz -C frontend/storybook-static .
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
-            storybook.tgz "$VPS_USER@$VPS_HOST:/tmp/storybook-$PR.tgz"
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T \
-            "$VPS_USER@$VPS_HOST" << ENDSSH
-            set -e
-            rm -rf "$DIR" && mkdir -p "$DIR"
-            tar xzf /tmp/storybook-$PR.tgz -C "$DIR"
-            rm -f /tmp/storybook-$PR.tgz
-            docker rm -f storybook-pr-$PR 2>/dev/null || true
-            docker run -d --name storybook-pr-$PR --restart unless-stopped \
-              -p $SB_PORT:80 -v "$DIR":/usr/share/nginx/html:ro nginx:alpine
-          ENDSSH
-          echo "url=http://$VPS_HOST:$SB_PORT/" >> "$GITHUB_OUTPUT"
-
-      - name: Post V2 deployment URL to PR
-        if: success()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          SB_URL: ${{ steps.storybook.outputs.url }}
-          SB_FILES: ${{ steps.sb-changes.outputs.storybook_files }}
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
-            const v2Port = ${{ steps.deploy.outputs.v2_port }};
-
-            // Delete the "deploying..." comment since we're posting the final result
-            const deploymentStartedId = ${{ steps.deployment-started.outputs.result }};
-            if (deploymentStartedId) {
-              console.log(`Deleting deployment started comment: ${deploymentStartedId}`);
-              try {
-                await github.rest.issues.deleteComment({
-                  owner,
-                  repo,
-                  comment_id: deploymentStartedId
-                });
-              } catch (error) {
-                console.log(`Could not delete deployment started comment: ${error.message}`);
-              }
-            }
-
-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;
-
-            // Only mention the portal when this image actually embeds it.
-            // Use the direct IP URL - the SSL hostname isn't supported yet.
-            const withPortal = "${{ env.BUILD_PORTAL }}" === "true";
-            const portalNote = withPortal
-              ? `🧩 **Admin portal** included - try it at [${deploymentUrl}/portal](${deploymentUrl}/portal).\n\n`
-              : ``;
-
-            // Storybook preview: only present when this PR changed stories/config.
-            const sbUrl = process.env.SB_URL;
-            let storybookNote = "";
-            if (sbUrl) {
-              const files = JSON.parse(process.env.SB_FILES || "[]");
-              const stories = files.filter((f) => /\.stories\.(ts|tsx|mdx)$/.test(f));
-              const config = files.filter((f) => f.startsWith("frontend/.storybook/"));
-              const shorten = (f) =>
-                f.replace(/^frontend\/editor\/src\//, "").replace(/^frontend\//, "");
-              const storyList = stories.map((f) => `- \`${shorten(f)}\``).join("\n");
-              const configList = config.map((f) => `- \`${shorten(f)}\``).join("\n");
-              const summary =
-                `${stories.length} stor${stories.length === 1 ? "y" : "ies"} changed` +
-                (config.length ? ` (+${config.length} config file${config.length === 1 ? "" : "s"})` : "");
-              storybookNote =
-                `📚 **Storybook:** [${sbUrl}](${sbUrl})\n\n` +
-                `<details>\n<summary>${summary}</summary>\n\n` +
-                (storyList ? `**Stories**\n${storyList}\n\n` : "") +
-                (configList ? `**Config**\n${configList}\n` : "") +
-                `</details>\n\n`;
-            }
-
-            const commentBody = `## 🚀 V2 Auto-Deployment Complete!\n\n` +
-                              `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
-                              portalNote +
-                              storybookNote +
-                              `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
-                              `🔄 **Auto-deployed** for approved V2 contributors.`;
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: commentBody
-            });
-
-  cleanup-v2-deployment:
-    if: github.event.action == 'closed'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Clean up V2 deployment comments
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = ${{ github.event.pull_request.number }};
-
-            // Find and delete V2 deployment comments
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber
-            });
-
-            const v2Comments = comments.filter(c =>
-              c.body?.includes("## 🚀 V2 Auto-Deployment Complete!") &&
-              c.user?.type === "Bot"
-            );
-
-            for (const comment of v2Comments) {
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-              console.log(`Deleted V2 deployment comment (ID: ${comment.id})`);
-            }
-
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
-          sudo chmod 600 ../private.key
-
-      - name: Cleanup V2 deployment
-        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
-            if [ -d "/stirling/V2-PR-${{ github.event.pull_request.number }}" ]; then
-              echo "Found V2 PR directory, proceeding with cleanup..."
-
-              # Stop and remove V2 containers
-              cd /stirling/V2-PR-${{ github.event.pull_request.number }}
-              docker-compose down || true
-
-              # Go back to root before removal
-              cd /
-
-              # Remove V2 PR-specific directories
-              rm -rf /stirling/V2-PR-${{ github.event.pull_request.number }}
-
-              # Clean up V2 container by name (in case compose cleanup missed it)
-              docker rm -f stirling-pdf-v2-pr-${{ github.event.pull_request.number }} || true
-
-              echo "V2 cleanup completed"
-            else
-              echo "V2 PR directory not found, nothing to clean up"
-            fi
-
-            # Remove this PR's Storybook preview (container + files), if any.
-            docker rm -f storybook-pr-${{ github.event.pull_request.number }} 2>/dev/null || true
-            rm -rf /stirling/SB-PR-${{ github.event.pull_request.number }}
-
-            # Clean up old unused images (older than 2 weeks) but keep recent ones for reuse
-            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
-
-            # Note: We don't remove the commit-based images since they can be reused across PRs
-            # Only remove PR-specific containers and directories
-          ENDSSH
-
-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          rm -f ../private.key
-        continue-on-error: true

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -3,116 +3,100 @@ name: PR Deployment via Comment
 on:
   issue_comment:
     types: [created]
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: "PR number to deploy"
-        required: true
-      enable_prototypes:
-        description: "Build with prototypes frontend"
-        required: false
-        type: boolean
-        default: false
-      enable_pro:
-        description: "Enable pro features"
-        required: false
-        type: boolean
-        default: false
-      enable_enterprise:
-        description: "Enable enterprise features"
-        required: false
-        type: boolean
-        default: false
-      disable_security:
-        description: "Disable security/login"
-        required: false
-        type: boolean
-        default: true
 
 permissions:
   contents: read
-  pull-requests: read
+  issues: write      # Required for adding reactions to comments
+  pull-requests: read # Required for reading PR information
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   check-comment:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
     permissions:
       issues: write
+      pull-requests: read
     if: |
-      vars.CI_PROFILE != 'lite' && (
-        github.event_name == 'workflow_dispatch' ||
-        (
-          github.event.issue.pull_request &&
-          (
-            contains(github.event.comment.body, 'prdeploy') ||
-            contains(github.event.comment.body, 'deploypr')
-          )
-          &&
-          (
-            github.event.comment.user.login == 'frooodle' ||
-            github.event.comment.user.login == 'sf298' ||
-            github.event.comment.user.login == 'Ludy87' ||
-            github.event.comment.user.login == 'balazs-szucs' ||
-            github.event.comment.user.login == 'reecebrowne' ||
-            github.event.comment.user.login == 'DarioGii' ||
-            github.event.comment.user.login == 'EthanHealy01' ||
-            github.event.comment.user.login == 'jbrunton96' ||
-            github.event.comment.user.login == 'ConnorYoh'
-          )
-        )
+      github.event.issue.pull_request &&
+      (
+      contains(github.event.comment.body, 'prdeploy') ||
+      contains(github.event.comment.body, 'deploypr')
+      )
+      &&
+      (
+        github.event.comment.user.login == 'frooodle' ||
+        github.event.comment.user.login == 'sf298' ||
+        github.event.comment.user.login == 'Ludy87' ||
+        github.event.comment.user.login == 'LaserKaspar' ||
+        github.event.comment.user.login == 'sbplat' ||
+        github.event.comment.user.login == 'reecebrowne' ||
+        github.event.comment.user.login == 'DarioGii' ||
+        github.event.comment.user.login == 'EthanHealy01' ||
+        github.event.comment.user.login == 'ConnorYoh'
       )
     outputs:
       pr_number: ${{ steps.get-pr.outputs.pr_number }}
+      pr_repository: ${{ steps.get-pr-info.outputs.repository }}
+      pr_ref: ${{ steps.get-pr-info.outputs.ref }}
       comment_id: ${{ github.event.comment.id }}
       disable_security: ${{ steps.check-security-flag.outputs.disable_security }}
       enable_pro: ${{ steps.check-pro-flag.outputs.enable_pro }}
       enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }}
-      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
+      # Generate GitHub App token
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Get PR data
         id: get-pr
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
-            const prNumber = context.eventName === 'workflow_dispatch'
-              ? context.payload.inputs.pr_number
-              : context.payload.issue.number;
+            const prNumber = context.payload.issue.number;
             console.log(`PR Number: ${prNumber}`);
             core.setOutput('pr_number', prNumber);
 
+      - name: Get PR repository and ref
+        id: get-pr-info
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.issue.number;
+
+            const { data: pr } = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: prNumber,
+            });
+
+            // For forks, use the full repository name, for internal PRs use the current repo
+            const repository = pr.head.repo.fork ? pr.head.repo.full_name : `${owner}/${repo}`;
+
+            console.log(`PR Repository: ${repository}`);
+            console.log(`PR Branch: ${pr.head.ref}`);
+
+            core.setOutput('repository', repository);
+            core.setOutput('ref', pr.head.ref);
+
       - name: Check for security/login flag
         id: check-security-flag
         env:
           COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_DISABLE_SECURITY: ${{ inputs.disable_security }}
         run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "disable_security=$DISPATCH_DISABLE_SECURITY" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+          if [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+            echo "Security flags detected in comment"
             echo "disable_security=false" >> $GITHUB_OUTPUT
           else
+            echo "No security flags detected in comment"
             echo "disable_security=true" >> $GITHUB_OUTPUT
           fi
 
@@ -120,47 +104,26 @@ jobs:
         id: check-pro-flag
         env:
           COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PRO: ${{ inputs.enable_pro }}
-          DISPATCH_ENTERPRISE: ${{ inputs.enable_enterprise }}
         run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_pro=$DISPATCH_PRO" >> $GITHUB_OUTPUT
-            echo "enable_enterprise=$DISPATCH_ENTERPRISE" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+          if [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+            echo "pro flags detected in comment"
             echo "enable_pro=true" >> $GITHUB_OUTPUT
             echo "enable_enterprise=false" >> $GITHUB_OUTPUT
           elif [[ "$COMMENT_BODY" == *"enterprise"* ]]; then
+            echo "enterprise flags detected in comment"
             echo "enable_enterprise=true" >> $GITHUB_OUTPUT
             echo "enable_pro=true" >> $GITHUB_OUTPUT
           else
+            echo "No pro or enterprise flags detected in comment"
             echo "enable_pro=false" >> $GITHUB_OUTPUT
             echo "enable_enterprise=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Check for prototypes flag
-        id: check-prototypes-flag
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PROTOTYPES: ${{ inputs.enable_prototypes }}
-        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_prototypes=$DISPATCH_PROTOTYPES" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"prototypes"* ]]; then
-            echo "Prototypes flag detected in comment"
-            echo "enable_prototypes=true" >> $GITHUB_OUTPUT
-          else
-            echo "No prototypes flag detected in comment"
-            echo "enable_prototypes=false" >> $GITHUB_OUTPUT
-          fi
-
       - name: Add 'in_progress' reaction to comment
-        if: github.event_name == 'issue_comment'
         id: add-eyes-reaction
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             console.log(`Adding eyes reaction to comment ID: ${context.payload.comment.id}`);
             try {
@@ -179,53 +142,38 @@ jobs:
             }
 
   deploy-pr:
-    needs: [pick, check-comment]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: check-comment
+    runs-on: ubuntu-latest
     permissions:
+      contents: read
       issues: write
-      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
-          token: ${{ steps.setup-bot.outputs.token }}
+          repository: ${{ needs.check-comment.outputs.pr_repository }}
+          ref: ${{ needs.check-comment.outputs.pr_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "25"
+          java-version: "17"
           distribution: "temurin"
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Run Gradle Command
         run: |
           if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -233,83 +181,39 @@ jobs:
           else
             export DISABLE_ADDITIONAL_FEATURES=false
           fi
-          task backend:build
+          ./gradlew clean build
         env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Get version number
+        id: versionNumber
+        run: |
+          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
+          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
-      - name: Build and push PR-specific image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push PR-specific image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      - name: Build and push PR-specific image
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image (Depot)
-        if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-engine
-          cache-to: type=gha,mode=max,scope=stirling-pdf-engine
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          build-args: VERSION_TAG=alpha
           platforms: linux/amd64
 
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Deploy to VPS
@@ -341,78 +245,47 @@ jobs:
             PREMIUM_PROFEATURES_AUDIT_ENABLED="false"
           fi
 
-          ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
-          PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
-          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"
-
-          # Build engine env vars for backend (only set when prototypes enabled)
-          if [ "$ENABLE_PROTOTYPES" == "true" ]; then
-            AI_ENGINE_VARS="
-                SYSTEM_AIENGINE_ENABLED: \"true\"
-                SYSTEM_AIENGINE_URL: \"http://stirling-pdf-engine-pr-${PR_NUMBER}:5001\""
-            ENGINE_SERVICE="
-            stirling-pdf-engine:
-              container_name: stirling-pdf-engine-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
-              environment:
-                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
-              networks:
-                - pr-network
-              restart: on-failure:5"
-            NETWORK_SECTION="
-          networks:
-            pr-network:"
-            BACKEND_NETWORK="
-              networks:
-                - pr-network"
-          else
-            AI_ENGINE_VARS=""
-            ENGINE_SERVICE=""
-            NETWORK_SECTION=""
-            BACKEND_NETWORK=""
-          fi
-
           # First create the docker-compose content locally
           cat > docker-compose.yml << EOF
           version: '3.3'
           services:
             stirling-pdf:
-              container_name: stirling-pdf-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
+              container_name: stirling-pdf-pr-${{ needs.check-comment.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
               ports:
-                - "${PR_NUMBER}:8080"
+                - "${{ needs.check-comment.outputs.pr_number }}:8080"
               volumes:
-                - /stirling/PR-${PR_NUMBER}/data:/usr/share/tessdata:rw
-                - /stirling/PR-${PR_NUMBER}/config:/configs:rw
-                - /stirling/PR-${PR_NUMBER}/logs:/logs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/data:/usr/share/tessdata:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/config:/configs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/logs:/logs:rw
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                 SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
-                SYSTEM_DEFAULTLOCALE: en-US
-                UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
-                UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
-                UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"
+                SYSTEM_DEFAULTLOCALE: en-GB
+                UI_APPNAME: "Stirling-PDF PR#${{ needs.check-comment.outputs.pr_number }}"
+                UI_HOMEDESCRIPTION: "PR#${{ needs.check-comment.outputs.pr_number }} for Stirling-PDF Latest"
+                UI_APPNAMENAVBAR: "PR#${{ needs.check-comment.outputs.pr_number }}"
                 SYSTEM_MAXFILESIZE: "100"
                 METRICS_ENABLED: "true"
                 SYSTEM_GOOGLEVISIBILITY: "false"
                 PREMIUM_KEY:                         "${PREMIUM_KEY}"
                 PREMIUM_ENABLED:                     "${PREMIUM_ENABLED}"
-                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"${AI_ENGINE_VARS}
-              restart: on-failure:5${BACKEND_NETWORK}${ENGINE_SERVICE}${NETWORK_SECTION}
+                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"
+              restart: on-failure:5
           EOF
 
           # Then copy the file and execute commands
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
             # Create PR-specific directories
-            mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}
+            mkdir -p /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/{data,config,logs}
 
             # Move docker-compose file to correct location
-            mv /tmp/docker-compose.yml /stirling/PR-${PR_NUMBER}/docker-compose.yml
+            mv /tmp/docker-compose.yml /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/docker-compose.yml
 
             # Start or restart the container
-            cd /stirling/PR-${PR_NUMBER}
+            cd /stirling/PR-${{ needs.check-comment.outputs.pr_number }}
             docker-compose pull
             docker-compose up -d
           ENDSSH
@@ -421,10 +294,10 @@ jobs:
           echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV
 
       - name: Add success reaction to comment
-        if: success() && github.event_name == 'issue_comment'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        if: success()
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             console.log(`Adding rocket reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
             try {
@@ -440,26 +313,11 @@ jobs:
               console.error(error);
             }
 
-            // add label to PR
-            const prNumber = ${{ needs.check-comment.outputs.pr_number }};
-            try {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                labels: ['pr-deployed']
-              });
-              console.log(`Added 'pr-deployed' label to PR #${prNumber}`);
-            } catch (error) {
-              console.error(`Failed to add label to PR: ${error.message}`);
-              console.error(error);
-            }
-
       - name: Add failure reaction to comment
-        if: failure() && github.event_name == 'issue_comment'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        if: failure()
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             console.log(`Adding -1 reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
             try {
@@ -477,16 +335,16 @@ jobs:
 
       - name: Post deployment URL to PR
         if: success()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             const { GITHUB_REPOSITORY } = process.env;
             const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
             const prNumber = ${{ needs.check-comment.outputs.pr_number }};
             const securityStatus = process.env.security_status || "Security Disabled";
 
-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${prNumber}`;
+            const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${prNumber}`;
             const commentBody = `## 🚀 PR Test Deployment\n\n` +
                               `Your PR has been deployed for testing!\n\n` +
                               `🔗 **Test URL:** [${deploymentUrl}](${deploymentUrl})\n` +
@@ -499,158 +357,3 @@ jobs:
               issue_number: prNumber,
               body: commentBody
             });
-
-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          echo "Cleaning up temporary files..."
-          rm -f ../private.key docker-compose.yml
-          echo "Cleanup complete."
-        continue-on-error: true
-
-  handle-label-commands:
-    if: ${{ github.event.issue.pull_request != null }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Apply label commands
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-
-            const { comment, issue } = context.payload;
-            const commentBody = comment?.body ?? '';
-            if (!commentBody.includes('::label::')) {
-              core.info('No label commands detected in comment.');
-              return;
-            }
-
-            const configPath = path.join(process.env.GITHUB_WORKSPACE, '.github', 'config', 'repo_devs.json');
-            const repoDevsConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-            const label_changer = (repoDevsConfig.label_changer || []).map((login) => login.toLowerCase());
-
-            const commenter = (comment?.user?.login || '').toLowerCase();
-            if (!label_changer.includes(commenter)) {
-              core.info(`User ${commenter} is not authorized to manage labels.`);
-              return;
-            }
-
-            const labelsConfigPath = path.join(process.env.GITHUB_WORKSPACE, '.github', 'labels.yml');
-            const labelsFile = fs.readFileSync(labelsConfigPath, 'utf8');
-
-            const labelNameMap = new Map();
-            for (const match of labelsFile.matchAll(/-\s+name:\s*(?:"([^"]+)"|'([^']+)'|([^\n]+))/g)) {
-              const labelName = (match[1] ?? match[2] ?? match[3] ?? '').trim();
-
-              if (!labelName) {
-                continue;
-              }
-              const normalized = labelName.toLowerCase();
-              if (!labelNameMap.has(normalized)) {
-                labelNameMap.set(normalized, labelName);
-              }
-            }
-
-            if (!labelNameMap.size) {
-              core.warning('No labels could be read from .github/labels.yml; aborting label commands.');
-              return;
-            }
-
-            let allowedLabelNames = new Set(labelNameMap.values());
-
-            const labelsToAdd = new Set();
-            const labelsToRemove = new Set();
-            const commandRegex = /^(\w+)::(label)::"([^"]+)"/gim;
-            let match;
-            while ((match = commandRegex.exec(commentBody)) !== null) {
-              core.info(`Found label command: ${match[0]} (action: ${match[1]}, label: ${match[2]}, labelName: ${match[3]})`);
-              const action = match[1].toLowerCase();
-              const labelName = match[3].trim();
-
-              if (!labelName) {
-                continue;
-              }
-
-              const normalized = labelName.toLowerCase();
-              const resolvedLabelName = labelNameMap.get(normalized);
-              if (action === 'add') {
-                if (!resolvedLabelName) {
-                  core.warning(`Label "${labelName}" is not defined in .github/labels.yml and cannot be added.`);
-                  continue;
-                }
-                if (!allowedLabelNames.has(resolvedLabelName)) {
-                  core.warning(`Label "${resolvedLabelName}" is not allowed for add commands and will be skipped.`);
-                  continue;
-                }
-                labelsToAdd.add(resolvedLabelName);
-              } else if (action === 'rm') {
-                const labelToRemove = resolvedLabelName ?? labelName;
-                if (!resolvedLabelName) {
-                  core.warning(`Label "${labelName}" is not defined in .github/labels.yml; attempting to remove as provided.`);
-                }
-                labelsToRemove.add(labelToRemove);
-              }
-            }
-
-            const addLabels = Array.from(labelsToAdd);
-            const removeLabels = Array.from(labelsToRemove);
-
-            if (!addLabels.length && !removeLabels.length) {
-              core.info('No valid label commands found after parsing.');
-              return;
-            }
-
-            const issueParams = {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issue.number,
-            };
-
-            if (addLabels.length) {
-              core.info(`Adding labels: ${addLabels.join(', ')}`);
-              await github.rest.issues.addLabels({
-                ...issueParams,
-                labels: addLabels,
-              });
-            }
-
-            for (const labelName of removeLabels) {
-              core.info(`Removing label: ${labelName}`);
-              try {
-                await github.rest.issues.removeLabel({
-                  ...issueParams,
-                  name: labelName,
-                });
-              } catch (error) {
-                if (error.status === 404) {
-                  core.warning(`Label "${labelName}" was not present on the pull request.`);
-                } else {
-                  throw error;
-                }
-              }
-            }
-
-            await github.rest.issues.deleteComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: comment.id,
-            });
-            core.info('Processed label commands and deleted the comment.');

.github/workflows/PR-Demo-cleanup.yml

@@ -1,113 +1,40 @@
 name: PR Deployment cleanup
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened, closed]
 
 permissions:
   contents: read
 
 env:
-  SERVER_IP: ${{ secrets.NEW_VPS_IP }} # Add this to your GitHub secrets
+  SERVER_IP: ${{ secrets.VPS_IP }} # Add this to your GitHub secrets
   CLEANUP_PERFORMED: "false" # Add flag to track if cleanup occurred
 
 jobs:
   cleanup:
-    if: github.event.action == 'closed'
     runs-on: ubuntu-latest
     permissions:
+      contents: write
       pull-requests: write
-      issues: write
+    if: github.event.action == 'closed'
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Remove 'pr-deployed' label if present
-        id: remove-label-comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const prNumber = ${{ github.event.pull_request.number }};
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-
-            // Get all labels on the PR
-            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
-              owner,
-              repo,
-              issue_number: prNumber
-            });
-
-            const hasLabel = labels.some(label => label.name === 'pr-deployed');
-
-            if (hasLabel) {
-              console.log("Label 'pr-deployed' found. Removing...");
-              await github.rest.issues.removeLabel({
-                owner,
-                repo,
-                issue_number: prNumber,
-                name: 'pr-deployed'
-              });
-            } else {
-              console.log("Label 'pr-deployed' not found. Nothing to do.");
-            }
-
-            // Find existing bot comments about the deployment
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber
-            });
-            const deploymentComments = comments.filter(c =>
-              c.body?.includes("## 🚀 PR Test Deployment") &&
-              c.user?.type === "Bot"
-            );
-
-            if (deploymentComments.length > 0) {
-              for (const comment of deploymentComments) {
-                await github.rest.issues.deleteComment({
-                  owner,
-                  repo,
-                  comment_id: comment.id
-                });
-                console.log(`Deleted deployment comment (ID: ${comment.id})`);
-              }
-            } else {
-              console.log("No matching deployment comments found.");
-            }
-
-            // Set flag if either label or comment was present
-            const hasDeploymentComment = deploymentComments.length > 0;
-            core.setOutput('present', (hasLabel || hasDeploymentComment) ? 'true' : 'false');
-
       - name: Set up SSH
-        if: steps.remove-label-comment.outputs.present == 'true'
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Cleanup PR deployment
-        if: steps.remove-label-comment.outputs.present == 'true'
         id: cleanup
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << 'ENDSSH'
             if [ -d "/stirling/PR-${{ github.event.pull_request.number }}" ]; then
               echo "Found PR directory, proceeding with cleanup..."
 
@@ -121,9 +48,8 @@ jobs:
               # Remove PR-specific directories
               rm -rf /stirling/PR-${{ github.event.pull_request.number }}
 
-              # Remove the Docker images
+              # Remove the Docker image
               docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
-              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true
 
               echo "PERFORMED_CLEANUP"
             else
@@ -131,11 +57,3 @@ jobs:
               echo "NO_CLEANUP_NEEDED"
             fi
           ENDSSH
-
-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          echo "Cleaning up temporary files..."
-          rm -f ../private.key
-          echo "Cleanup complete."
-        continue-on-error: true

.github/workflows/_runner-pick.yml

@@ -1,70 +0,0 @@
-name: _runner-pick
-
-# Tiny reusable workflow that classifies the trigger as either a "fork PR
-# from an untrusted contributor" or a "trusted commit" so downstream jobs
-# can pick a runner class without each one duplicating the 200-char gate
-# expression in their own `runs-on:`.
-#
-# Caller pattern:
-#
-#   jobs:
-#     pick:
-#       uses: ./.github/workflows/_runner-pick.yml
-#
-#     real-work:
-#       needs: pick
-#       runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-#       steps: [...]
-#
-# Output:
-#   is_fork: "true" when the trigger is a pull_request from a fork or an
-#            untrusted author_association, "false" otherwise.
-
-on:
-  workflow_call:
-    outputs:
-      is_fork:
-        description: '"true" if the trigger is an untrusted fork PR.'
-        value: ${{ jobs.pick.outputs.is_fork }}
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    runs-on: ubuntu-latest
-    timeout-minutes: 1
-    outputs:
-      is_fork: ${{ steps.decide.outputs.is_fork }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Classify the trigger
-        id: decide
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_REPO_FORK: ${{ github.event.pull_request.head.repo.fork }}
-          AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
-        run: |
-          set -eu
-          if [ -z "${PR_NUMBER:-}" ]; then
-            # Not a pull_request event at all (push, schedule, workflow_dispatch,
-            # workflow_call from a non-PR trigger) -> trusted by default.
-            echo "is_fork=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          if [ "${HEAD_REPO_FORK}" = "true" ]; then
-            echo "is_fork=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          case "${AUTHOR_ASSOC}" in
-            OWNER|MEMBER|COLLABORATOR)
-              echo "is_fork=false" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "is_fork=true" >> "$GITHUB_OUTPUT"
-              ;;
-          esac

.github/workflows/ai-engine.yml

@@ -1,119 +0,0 @@
-name: AI Engine CI
-
-# Runs the engine quality gate (lint, type-check, format-check, tests). Called
-# from build.yml on PRs and merge_group; also runs directly on push to main as
-# a post-merge safety net. Freshness of the generated tool_models.py is checked
-# by the shared check-generated-models workflow.
-on:
-  workflow_call:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  engine:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: true
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Quality-check engine
-        id: engine-check
-        run: task engine:check
-        continue-on-error: true
-
-      - name: Comment on engine check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.engine-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const body = [
-              marker,
-              '### Engine Check Failed',
-              '',
-              'There are issues with your Python code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task engine:fix` to auto-fix what can be fixed automatically, then run `task engine:check` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if engine check failed
-        if: steps.engine-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Engine Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your Python code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task engine:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task engine:check'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
-
-      - name: Remove engine check comment on success
-        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }

.github/workflows/ai_pr_title_review.yml

@@ -5,7 +5,7 @@ on:
     types: [opened, edited]
     branches: [main]
 
-permissions: # required for secure-repo hardening
+permissions:  # required for secure-repo hardening
   contents: read
 
 jobs:
@@ -19,11 +19,11 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -87,7 +87,7 @@ jobs:
       - name: AI PR Title Analysis
         if: steps.actor.outputs.is_repo_dev == 'true'
         id: ai-title-analysis
-        uses: actions/ai-inference@17ff458cb182449bbb2e43701fcd98f6af8f6570 # v2.1.0
+        uses: actions/ai-inference@d645f067d89ee1d5d736a5990e327e504d1c5a4a # v1.1.0
         with:
           model: openai/gpt-4o
           system-prompt-file: ".github/config/system-prompt.txt"
@@ -158,7 +158,7 @@ jobs:
 
       - name: Post comment on PR if needed
         if: steps.actor.outputs.is_repo_dev == 'true'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         continue-on-error: true
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}

.github/workflows/aur-publish.yml

@@ -1,128 +0,0 @@
-name: Publish to AUR
-
-on:
-  release:
-    types: [released]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the AUR push (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
-
-  publish-aur:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Update stirling-pdf-desktop PKGBUILD
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          DEB_SHA: ${{ needs.get-release-info.outputs.deb_sha256 }}
-        run: |
-          PKGBUILD=".github/aur/stirling-pdf-desktop/PKGBUILD"
-          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-          sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-          sed -i "s/'PLACEHOLDER_DEB_SHA256'/'${DEB_SHA}'/" "$PKGBUILD"
-
-      # Disabled until we sort out the server packaging story.
-      # The third-party stirling-pdf-bin on AUR currently covers a similar use case.
-      # - name: Update stirling-pdf-server-bin PKGBUILD
-      #   env:
-      #     VERSION: ${{ needs.get-release-info.outputs.version }}
-      #     JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-      #   run: |
-      #     PKGBUILD=".github/aur/stirling-pdf-server-bin/PKGBUILD"
-      #     sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-      #     sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-      #     sed -i "s/'PLACEHOLDER_JAR_SHA256'/'${JAR_SHA}'/" "$PKGBUILD"
-
-      - name: Show updated PKGBUILD (for dry-run visibility)
-        run: |
-          echo "--- stirling-pdf-desktop PKGBUILD ---"
-          cat .github/aur/stirling-pdf-desktop/PKGBUILD
-
-      - name: Publish stirling-pdf-desktop to AUR
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
-        with:
-          pkgname: stirling-pdf-desktop
-          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
-          commit_username: Stirling PDF Inc
-          commit_email: contact@stirlingpdf.com
-          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-          commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
-
-      # Disabled until we sort out the server packaging story.
-      # - name: Publish stirling-pdf-server-bin to AUR
-      #   if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-      #   uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
-      #   with:
-      #     pkgname: stirling-pdf-server-bin
-      #     pkgbuild: .github/aur/stirling-pdf-server-bin/PKGBUILD
-      #     commit_username: Stirling PDF Inc
-      #     commit_email: contact@stirlingpdf.com
-      #     ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-      #     commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"

.github/workflows/auto-labeler.yml

@@ -0,0 +1,27 @@
+name: "Pull Request Labeler"
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  labeler:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Apply Labels
+        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          configuration-path: .github/labeler-config.yml
+          sync-labels: true

.github/workflows/auto-labelerV2.yml

@@ -2,9 +2,6 @@ name: "Auto Pull Request Labeler V2"
 on:
   pull_request_target:
     types: [opened, synchronize]
-    branches:
-      - main
-      - V3
 
 permissions:
   contents: read
@@ -16,11 +13,11 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup GitHub App Bot
         id: setup-bot
@@ -29,7 +26,7 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - uses: srvaroa/labeler@bf262763a8a8e191f5847873aecc0f29df84f957 # v1.14.0
+      - uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # v1.13.0
         with:
           config_path: .github/labeler-config-srvaroa.yml
           use_local_config: false

.github/workflows/backend-build.yml

@@ -1,257 +0,0 @@
-name: Backend build, format check, and coverage
-
-# Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × every flavor), Spotless formatting check, JUnit, and
-# posts Jacoco coverage to PRs.
-#
-# Flavor axis (maps to STIRLING_FLAVOR in settings.gradle):
-#   core         - DISABLE_ADDITIONAL_FEATURES=true, no proprietary, no saas
-#   proprietary  - default build, no saas
-#   saas         - proprietary + the saas subproject (build + JUnit only,
-#                  never any runtime/integration testing)
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  actions: read
-  security-events: write
-  pull-requests: write
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  build:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    strategy:
-      fail-fast: false
-      matrix:
-        jdk-version: [25]
-        flavor: [core, proprietary, saas]
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: ${{ matrix.jdk-version }}
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Check Java formatting (Spotless)
-        # Runs once per matrix combination - pick the cheapest leg
-        # (core - no proprietary, no saas) so we don't wait for the
-        # heavier flavors just to fail formatting.
-        if: matrix.jdk-version == 25 && matrix.flavor == 'core'
-        id: spotless-check
-        run: task backend:format:check
-        continue-on-error: true
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Comment on backend format check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const body = [
-              marker,
-              '### Backend Format Check Failed',
-              '',
-              'There are formatting issues in your Java code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task backend:format` to auto-fix, then commit and push the changes.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if backend format check failed
-        if: steps.spotless-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Backend Format Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are formatting issues in your Java code"
-          echo "that will need to be fixed before they can be"
-          echo "merged in."
-          echo ""
-          echo "Run 'task backend:format' to auto-fix, then"
-          echo "commit and push the changes."
-          echo "============================================"
-          exit 1
-
-      - name: Remove backend format check comment on success
-        if: steps.spotless-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-
-      - name: Build with Gradle (flavor=${{ matrix.flavor }})
-        # STIRLING_FLAVOR is read by settings.gradle and expands into the
-        # right combination of DISABLE_ADDITIONAL_FEATURES + ENABLE_SAAS
-        # so we don't have to set them by hand. The saas flavor pulls in
-        # the app/saas subproject (unit tests only - no runtime tests).
-        run: task backend:build:ci
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          STIRLING_FLAVOR: ${{ matrix.flavor }}
-
-      - name: Check Test Reports Exist
-        if: always()
-        run: |
-          # Common + core + proprietary always build (proprietary is
-          # excluded only at runtime, not from the gradle subproject
-          # graph). Saas builds add a fourth report dir.
-          declare -a dirs=(
-            "app/core/build/reports/tests/"
-            "app/core/build/test-results/"
-            "app/common/build/reports/tests/"
-            "app/common/build/test-results/"
-            "app/proprietary/build/reports/tests/"
-            "app/proprietary/build/test-results/"
-          )
-          if [ "${{ matrix.flavor }}" = "saas" ]; then
-            dirs+=("app/saas/build/reports/tests/" "app/saas/build/test-results/")
-          fi
-          for dir in "${dirs[@]}"; do
-            if [ ! -d "$dir" ]; then
-              echo "Missing $dir"
-              exit 1
-            fi
-          done
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-flavor-${{ matrix.flavor }}
-          path: |
-            app/**/build/reports/jacoco/test
-            app/**/build/reports/tests/
-            app/**/build/test-results/
-            app/**/build/reports/problems/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml to
-        # silence security scanners that pattern-match on the stdlib
-        # xml.etree.ElementTree.parse call.
-        if: always() && matrix.flavor == 'saas'
-        run: python -m pip install --quiet defusedxml
-
-      - name: JaCoCo coverage step summary
-        # Only the saas leg posts the JUnit summary - it's a strict
-        # superset of the core + proprietary legs (same .exec files plus
-        # the saas subproject). Posting from all three would mean three
-        # near-identical tables crowding out the aggregate report.
-        if: always() && matrix.flavor == 'saas'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
-            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "proprietary=app/proprietary/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "saas=app/saas/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload raw JUnit .exec for aggregate merge
-        # Same dedup rationale as the summary step: upload from the saas
-        # leg only (the most complete set, includes app/saas/.../test.exec)
-        # so the aggregate workflow merges the union rather than three
-        # overlapping subsets.
-        #
-        # Separate artifact from the HTML reports so the aggregate
-        # workflow can grab just the .exec files with a name pattern
-        # (`jacoco-exec-*`) instead of unpacking the whole test-reports
-        # tarball.
-        if: always() && matrix.flavor == 'saas'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-junit-jdk-${{ matrix.jdk-version }}
-          path: app/*/build/jacoco/*.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Add coverage to PR (flavor=${{ matrix.flavor }}, JDK=${{ matrix.jdk-version }})
-        # The action only supports the pull_request event (it posts a PR comment),
-        # so skip it for merge_group runs and workflow_dispatch.
-        if: github.event_name == 'pull_request'
-        id: jacoco
-        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
-        with:
-          paths: |
-            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
-          token: ${{ secrets.GITHUB_TOKEN }}
-          min-coverage-overall: 10
-          min-coverage-changed-files: 0
-          comment-type: summary

.github/workflows/build-enterprise.yml

@@ -1,310 +0,0 @@
-name: Enterprise E2E (Playwright)
-
-# Enterprise Playwright suite — exercises premium-key gated features (audit,
-# teams, analytics) plus full OAuth + SAML logins via the Keycloak compose
-# stacks under testing/compose. Slow and secret-gated, so it runs in four
-# situations:
-#
-#   - PRs that touch proprietary / premium / SSO compose / enterprise tests
-#     (driven by build.yml via workflow_call, path-filtered against
-#     .github/config/.files.yaml `proprietary`),
-#   - every push to main (post-merge safety net),
-#   - on a nightly cron schedule (catches Keycloak image drift, license
-#     expiry, upstream proprietary changes),
-#   - manual workflow_dispatch.
-
-on:
-  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
-  push:
-    branches: ["main"]
-  schedule:
-    - cron: "0 4 * * *"
-  workflow_dispatch:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
-
-# No `concurrency:` block here on purpose. When this workflow is called via
-# workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
-# resolve to the *caller's* values, producing the same group key as build.yml
-# and causing the workflow_call instantiation to self-cancel — the job
-# silently fails to spawn while `${{ needs.X.result }}` still reports
-# `failure`. Standalone runs (push-to-main, nightly cron, dispatch) don't
-# overlap often enough to need explicit concurrency control.
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  playwright-e2e-enterprise:
-    needs: pick
-    # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE
-    # (nor DEPOT_TOKEN), so the suite can't boot premium and would fail. See the
-    # header comment. GitHub reports the skipped reusable workflow as success.
-    if: needs.pick.outputs.is_fork != 'true'
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    timeout-minutes: 45
-    env:
-      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
-      PREMIUM_ENABLED: "true"
-      SYSTEM_ENABLEANALYTICS: "false"
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (needed for playwright's vite preview webServer)
-        # Enterprise tests target :8080 (Spring Boot's bundled frontend), but
-        # playwright's webServer config still launches `vite preview --port 5173`
-        # before any test run, which needs dist/ to exist. VITE_BUILD_FOR_PREVIEW
-        # forces absolute asset paths so vite preview can serve deep SPA routes.
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-
-      - name: Resolve kubernetes.docker.internal to localhost
-        # The compose stacks set KC_HOSTNAME=kubernetes.docker.internal so
-        # Keycloak issues redirect URIs against that host. Docker Desktop
-        # auto-resolves it; GHA runners don't. Map it to 127.0.0.1 so the
-        # browser-driven OAuth flow lands back on Stirling-PDF correctly.
-        run: |
-          echo "127.0.0.1 kubernetes.docker.internal" | sudo tee -a /etc/hosts
-
-      # Helper function used by all phases — boots `:stirling-pdf:bootRun`
-      # with the React frontend baked in (-PbuildWithFrontend=true) so the
-      # SPA serves on :8080 and OAuth/SAML callbacks land on the same host
-      # that the browser is interacting with.
-      - name: Define helpers
-        run: |
-          {
-            echo 'wait_for_backend() {'
-            echo '  start=$SECONDS'
-            echo '  for i in $(seq 1 300); do'
-            echo '    if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then'
-            echo '      echo "Backend up after $((SECONDS - start))s"; return 0'
-            echo '    fi; sleep 2'
-            echo '  done'
-            echo '  tail -200 /tmp/backend.log || true; return 1'
-            echo '}'
-            echo 'stop_backend() {'
-            echo '  if [ -f /tmp/backend.pid ]; then'
-            echo '    kill "$(cat /tmp/backend.pid)" 2>/dev/null || true'
-            echo '    rm -f /tmp/backend.pid'
-            echo '  fi'
-            echo '  pkill -f "gradlew :stirling-pdf:bootRun" 2>/dev/null || true'
-            echo '  for i in $(seq 1 30); do'
-            echo '    curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1 || return 0'
-            echo '    sleep 1'
-            echo '  done'
-            echo '}'
-          } > /tmp/helpers.sh
-          chmod +x /tmp/helpers.sh
-
-      # ───────── OAuth round-trip ─────────
-      - name: Bring up Keycloak (OAuth realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-oauth.yml up -d --no-deps keycloak-oauth-db keycloak-oauth
-      - name: Wait for Keycloak (OAuth) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            bash validate-oauth-test.sh 2>/dev/null && exit 0 || true
-            # validate script also pings stirling on :8080 — accept just the
-            # keycloak realm as our gate here, stirling boots in the next step
-            curl -fsS http://localhost:9080/realms/stirling-oauth >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-oauth.yml logs --tail=200 keycloak-oauth
-          exit 1
-      - name: Boot Stirling-PDF (frontend baked in, OAuth env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_OAUTH2_ENABLED: "true"
-          SECURITY_OAUTH2_AUTOCREATEUSER: "true"
-          # Keycloak issues redirect URIs against KC_HOSTNAME, which the
-          # compose default sets to kubernetes.docker.internal. Match here
-          # (resolves to localhost via /etc/hosts mapping above).
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_ISSUER: "http://kubernetes.docker.internal:9080/realms/stirling-oauth"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTID: "stirling-pdf-client"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTSECRET: "test-client-secret-change-in-production"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_USEASUSERNAME: "email"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_SCOPES: "openid,profile,email"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise OAuth Playwright tests
-        id: oauth-tests
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-oauth.json
-        run: task e2e:enterprise -- --grep "OAuth"
-      - name: Stop backend + tear down OAuth Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-oauth.yml down -v)
-
-      # ───────── SAML round-trip ─────────
-      - name: Bring up Keycloak (SAML realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-saml.yml up -d --no-deps keycloak-saml-db keycloak-saml
-      - name: Wait for Keycloak (SAML) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            curl -fsS http://localhost:9080/realms/stirling-saml >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-saml.yml logs --tail=200 keycloak-saml
-          exit 1
-      - name: Generate SAML SP certs + fetch Keycloak IdP cert
-        # The .pem/.crt/.key files are gitignored (test-only certs); the
-        # docker-based start-saml-test.sh generates them at runtime, so do
-        # the same in CI before bootRun reads them.
-        working-directory: testing/compose
-        run: |
-          openssl req -x509 -newkey rsa:2048 \
-            -keyout saml-private-key.key \
-            -out saml-public-cert.crt \
-            -days 3650 -nodes \
-            -subj "/CN=stirling-pdf-saml-sp" >/dev/null 2>&1
-          # Fetch Keycloak's SAML signing cert from the realm descriptor
-          CERT_BODY=$(curl -sf http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor \
-            | awk 'BEGIN{RS="<[^>]*X509Certificate>|</[^>]*X509Certificate>"} NR==2{gsub(/[[:space:]]+/,""); print; exit}')
-          {
-            echo "-----BEGIN CERTIFICATE-----"
-            echo "$CERT_BODY"
-            echo "-----END CERTIFICATE-----"
-          } > keycloak-saml-cert.pem
-          test -s saml-private-key.key
-          test -s saml-public-cert.crt
-          test -s keycloak-saml-cert.pem
-          echo "✓ SAML certs prepared"
-      - name: Boot Stirling-PDF (frontend baked in, SAML env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_SAML2_ENABLED: "true"
-          SECURITY_SAML2_AUTOCREATEUSER: "true"
-          SECURITY_SAML2_PROVIDER: "keycloak"
-          SECURITY_SAML2_REGISTRATIONID: "keycloak"
-          SECURITY_SAML2_IDP_ISSUER: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_ENTITYID: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_METADATAURI: "http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor"
-          SECURITY_SAML2_IDPSINGLELOGINURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDPSINGLELOGOUTURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDP_CERT: "${{ github.workspace }}/testing/compose/keycloak-saml-cert.pem"
-          SECURITY_SAML2_PRIVATEKEY: "${{ github.workspace }}/testing/compose/saml-private-key.key"
-          SECURITY_SAML2_SP_CERT: "${{ github.workspace }}/testing/compose/saml-public-cert.crt"
-          # Realm registers the SP entity as the metadata URL — see
-          # keycloak-realm-saml.json `clientId`. Match it here so Keycloak
-          # accepts the AuthnRequest issuer.
-          SECURITY_SAML2_SP_ENTITYID: "http://localhost:8080/saml2/service-provider-metadata/keycloak"
-          SECURITY_SAML2_SP_ACS: "http://localhost:8080/login/saml2/sso/keycloak"
-          SECURITY_SAML2_SP_SLS: "http://localhost:8080/logout/saml2/slo"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise SAML Playwright tests
-        id: saml-tests
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-saml.json
-        run: task e2e:enterprise -- --grep "SAML"
-      - name: Stop backend + tear down SAML Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-saml.yml down -v)
-
-      # ───────── License-gated feature tests (no IdP needed) ─────────
-      - name: Wipe DB so InitialSecuritySetup re-runs with admin/adminadmin
-        # Earlier phases (OAuth, SAML) create the default admin/stirling user.
-        # InitialSecuritySetup only honours SECURITY_INITIALLOGIN_* when the
-        # admin user doesn't already exist, so the persisted DB has to be
-        # cleared between phases for the feature env vars to take effect.
-        run: |
-          rm -f app/core/configs/stirling-pdf-DB*.mv.db
-          rm -rf app/core/configs/backup
-      - name: Boot Stirling-PDF (frontend baked in, premium only)
-        env:
-          SECURITY_INITIALLOGIN_USERNAME: admin
-          SECURITY_INITIALLOGIN_PASSWORD: adminadmin
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise feature Playwright tests
-        id: feature-tests
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-feature.json
-        run: task e2e:enterprise -- --grep "Enterprise license"
-      - name: Print backend log on failure
-        if: failure()
-        run: |
-          echo "::group::Enterprise backend log"
-          tail -500 /tmp/backend.log || true
-          echo "::endgroup::"
-      - name: Stop backend (final)
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-      - name: Flag flaky tests
-        # Runs regardless of the test outcomes: a flaky test (passed on retry)
-        # leaves its step green, so this is the only place it surfaces. Merges
-        # all three phase reports (some may be absent if an earlier phase hard-
-        # failed and skipped the rest). Emits ::warning:: annotations + a job
-        # summary; never fails the job.
-        if: always()
-        working-directory: frontend
-        run: >
-          npx tsx editor/scripts/report-flaky-tests.mts
-          "${{ github.workspace }}/frontend/playwright-report/results-oauth.json"
-          "${{ github.workspace }}/frontend/playwright-report/results-saml.json"
-          "${{ github.workspace }}/frontend/playwright-report/results-feature.json"
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7

.github/workflows/build.yml

@@ -1,290 +1,174 @@
-name: Build and Test Workflow
-
-# Top-level PR / merge-queue gate. Detects which paths changed and dispatches
-# to the dedicated reusable workflows under .github/workflows/. Each child
-# workflow keeps its own setup/teardown so this file stays a routing layer.
-#
-# The final `all-checks-passed` job is the single status check that branch
-# protection should require — it succeeds only if every required upstream
-# job either succeeded or was legitimately skipped by its path filter.
+name: Build repo
 
 on:
+  push:
+    branches: ["main"]
   pull_request:
     branches: ["main"]
-  merge_group:
-    branches: ["main"]
-  workflow_dispatch:
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
-  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
-  files-changed:
-    name: detect what files changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    outputs:
-      build: ${{ steps.changes.outputs.build }}
-      project: ${{ steps.changes.outputs.project }}
-      openapi: ${{ steps.changes.outputs.openapi }}
-      frontend: ${{ steps.changes.outputs.frontend }}
-      docker-base: ${{ steps.changes.outputs.docker-base }}
-      tauri: ${{ steps.changes.outputs.tauri }}
-      engine: ${{ steps.changes.outputs.engine }}
-      generated-models: ${{ steps.changes.outputs.generated-models }}
-      proprietary: ${{ steps.changes.outputs.proprietary }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          filters: .github/config/.files.yaml
-
   build:
-    needs: [files-changed]
+    runs-on: ubuntu-latest
+
     permissions:
       actions: read
-      contents: read
       security-events: write
-      pull-requests: write
-    uses: ./.github/workflows/backend-build.yml
-    secrets: inherit
 
-  db-migration-test:
-    # Boots the current bootJar against H2 fixtures captured from past
-    # releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still
-    # works after Hibernate's ddl-auto=update migrates the schema. Gated on
-    # the `project` filter so doc-only PRs skip this ~5-minute job.
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/db-migration-test.yml
-    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        jdk-version: [17, 21]
+        spring-security: [true, false]
 
-  check-generateOpenApiDocs:
-    if: needs.files-changed.outputs.openapi == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-openapi.yml
-    secrets: inherit
-
-  frontend-validation:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/frontend-validation.yml
-    secrets: inherit
-
-  playwright-e2e:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-stubbed.yml
-    secrets: inherit
-
-  playwright-e2e-live:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-live.yml
-    secrets: inherit
-
-  playwright-e2e-enterprise:
-    if: needs.files-changed.outputs.proprietary == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/build-enterprise.yml
-    secrets: inherit
-
-  check-licence:
-    if: needs.files-changed.outputs.build == 'true'
-    needs: [files-changed, build]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-licence.yml
-    secrets: inherit
-
-  docker-compose-tests:
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
-    permissions:
-      actions: write
-      contents: read
-      checks: write
-    uses: ./.github/workflows/docker-compose-tests.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
-
-  test-build-docker-images:
-    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
-    needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
-    permissions:
-      contents: read
-      packages: read
-      id-token: write
-    uses: ./.github/workflows/test-build-docker.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
-
-  tauri-build:
-    if: needs.files-changed.outputs.tauri == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/tauri-build.yml
-    secrets: inherit
-
-  ai-engine:
-    if: needs.files-changed.outputs.engine == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/ai-engine.yml
-    secrets: inherit
-
-  # The generated frontend types and engine tool models are both derived from
-  # the Java OpenAPI spec. This job regenerates and diffs them; it boots the
-  # backend, so it is gated on the narrow generated-models filter (spec source,
-  # generators, generated files, generation tasks) rather than the broad
-  # frontend filter, so a CSS-only PR does not pay for a backend build.
-  generated-models:
-    if: needs.files-changed.outputs.generated-models == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/check-generated-models.yml
-    secrets: inherit
-
-  pre-commit:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/pre_commit.yml
-    secrets: inherit
-
-  dependency-review:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/dependency-review.yml
-    secrets: inherit
-
-  # Coverage aggregate: merges the JUnit + e2e:live + cucumber .exec
-  # artifacts produced by the jobs above into one report, plus pulls
-  # in vitest + Playwright frontend coverage for the per-area matrix.
-  # `if: always()` so a producer failing partway still gets credit
-  # for whatever did record. Advisory only - intentionally NOT in
-  # all-checks-passed, so a flaky aggregate run never blocks merging.
-  coverage-aggregate:
-    if: always()
-    needs:
-      - build
-      - playwright-e2e-live
-      - docker-compose-tests
-      - frontend-validation
-    permissions:
-      contents: read
-    uses: ./.github/workflows/coverage-aggregate.yml
-    secrets: inherit
-    with:
-      frontend-validation-result: ${{ needs.frontend-validation.result }}
-      playwright-e2e-live-result: ${{ needs.playwright-e2e-live.result }}
-
-  # Single status check that branch protection should mark as required.
-  # Succeeds when every upstream job is either `success` or `skipped` (path-
-  # gated jobs that didn't apply this run). Any `failure` or `cancelled`
-  # result fails the gate. `if: always()` ensures the gate evaluates even
-  # when an upstream job fails.
-  all-checks-passed:
-    name: All checks passed
-    if: always()
-    needs:
-      - files-changed
-      - build
-      - db-migration-test
-      - check-generateOpenApiDocs
-      - frontend-validation
-      - playwright-e2e
-      - playwright-e2e-live
-      - playwright-e2e-enterprise
-      - check-licence
-      - docker-compose-tests
-      - test-build-docker-images
-      - tauri-build
-      - ai-engine
-      - generated-models
-      - pre-commit
-      - dependency-review
-    runs-on: ubuntu-latest
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - name: Verify every required job passed (or was legitimately skipped)
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up JDK ${{ matrix.jdk-version }}
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: ${{ matrix.jdk-version }}
+          distribution: "temurin"
+
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
+        run: ./gradlew clean build
         env:
-          RESULTS: |
-            files-changed=${{ needs.files-changed.result }}
-            build=${{ needs.build.result }}
-            db-migration-test=${{ needs.db-migration-test.result }}
-            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
-            frontend-validation=${{ needs.frontend-validation.result }}
-            playwright-e2e=${{ needs.playwright-e2e.result }}
-            playwright-e2e-live=${{ needs.playwright-e2e-live.result }}
-            playwright-e2e-enterprise=${{ needs.playwright-e2e-enterprise.result }}
-            check-licence=${{ needs.check-licence.result }}
-            docker-compose-tests=${{ needs.docker-compose-tests.result }}
-            test-build-docker-images=${{ needs.test-build-docker-images.result }}
-            tauri-build=${{ needs.tauri-build.result }}
-            ai-engine=${{ needs.ai-engine.result }}
-            generated-models=${{ needs.generated-models.result }}
-            pre-commit=${{ needs.pre-commit.result }}
-            dependency-review=${{ needs.dependency-review.result }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
+
+      - name: Check Test Reports Exist
+        id: check-reports
+        if: always()
         run: |
-          ok=true
-          while IFS='=' read -r name result; do
-            [ -z "$name" ] && continue
-            case "$result" in
-              success|skipped) printf '  %-30s %s\n' "$name" "$result" ;;
-              *)               printf '✗ %-30s %s\n' "$name" "$result"; ok=false ;;
-            esac
-          done <<< "$RESULTS"
-          if [ "$ok" != "true" ]; then
-            echo ""
-            echo "One or more required checks failed or were cancelled."
+          declare -a dirs=(
+            "stirling-pdf/build/reports/tests/"
+            "stirling-pdf/build/test-results/"
+            "common/build/reports/tests/"
+            "common/build/test-results/"
+            "proprietary/build/reports/tests/"
+            "proprietary/build/test-results/"
+          )
+          missing_reports=()
+          for dir in "${dirs[@]}"; do
+            if [ ! -d "$dir" ]; then
+              missing_reports+=("$dir")
+            fi
+          done
+          if [ ${#missing_reports[@]} -gt 0 ]; then
+            echo "ERROR: The following required test report directories are missing:"
+            printf '%s\n' "${missing_reports[@]}"
             exit 1
           fi
-          echo ""
-          echo "All required checks passed."
+          echo "All required test report directories are present"
+
+      - name: Upload Test Reports
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
+          path: |
+            stirling-pdf/build/reports/tests/
+            stirling-pdf/build/test-results/
+            stirling-pdf/build/reports/problems/
+            common/build/reports/tests/
+            common/build/test-results/
+            common/build/reports/problems/
+            proprietary/build/reports/tests/
+            proprietary/build/test-results/
+            proprietary/build/reports/problems/
+            build/reports/problems/
+          retention-days: 3
+          if-no-files-found: warn
+
+  check-licence:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "17"
+          distribution: "adopt"
+
+      - name: check the licenses for compatibility
+        run: ./gradlew clean checkLicense
+
+      - name: FAILED - check the licenses for compatibility
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: dependencies-without-allowed-license.json
+          path: |
+            build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3
+
+  docker-compose-tests:
+    # if: github.event_name == 'push' && github.ref == 'refs/heads/main' ||
+    #     (github.event_name == 'pull_request' &&
+    #     contains(github.event.pull_request.labels.*.name, 'licenses') == false &&
+    #     (
+    #       contains(github.event.pull_request.labels.*.name, 'Front End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Java') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Back End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Security') ||
+    #       contains(github.event.pull_request.labels.*.name, 'API') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Docker') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Test')
+    #     )
+    #     )
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Java 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "17"
+          distribution: "adopt"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Install Docker Compose
+        run: |
+          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.37.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo chmod +x /usr/local/bin/docker-compose
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+          cache: 'pip' # caching pip dependencies
+
+      - name: Pip requirements
+        run: |
+          pip install --require-hashes -r ./testing/cucumber/requirements.txt
+
+      - name: Run Docker Compose Tests
+        run: |
+          chmod +x ./testing/test_webpages.sh
+          chmod +x ./testing/test.sh
+          chmod +x ./testing/test_disabledEndpoints.sh
+          ./testing/test.sh

.github/workflows/check-generated-models.yml

@@ -1,148 +0,0 @@
-name: Check generated models
-
-# Verifies the committed generated API models are still in sync with the Java
-# OpenAPI spec: the frontend tool API types
-# (frontend/editor/src/core/types/toolApiTypes.ts) and the engine tool
-# models (engine/src/stirling/models/tool_models.py). Regenerates both with the
-# single top-level `task tool-models` and fails if either committed file is
-# out of date. Called from build.yml when the backend Java, frontend, or engine
-# changes; also runs on push to main as a post-merge safety net.
-on:
-  workflow_call:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  generated-models:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: true
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      # Rebuilds the OpenAPI spec from the current Java and regenerates both the
-      # frontend types and the engine tool models from it.
-      - name: Regenerate generated models
-        run: task tool-models
-
-      - name: Verify generated models are up to date
-        id: models-check
-        continue-on-error: true
-        run: |
-          git diff --exit-code \
-            frontend/editor/src/core/types/toolApiTypes.ts \
-            engine/src/stirling/models/tool_models.py
-
-      - name: Comment on generated models check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.models-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- generated-models-check -->';
-            const body = [
-              marker,
-              '### Generated Models Check Failed',
-              '',
-              'The generated `frontend/editor/src/core/types/toolApiTypes.ts` and/or `engine/src/stirling/models/tool_models.py` are out of date with the Java OpenAPI spec and will need to be regenerated before they can be merged in.',
-              '',
-              'Run `task tool-models` to regenerate both, then commit the updated files.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if generated models check failed
-        if: steps.models-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Generated Models Check Failed"
-          echo "============================================"
-          echo ""
-          echo "The generated frontend API types and/or engine tool"
-          echo "models are out of date with the Java OpenAPI spec and"
-          echo "will need to be regenerated before they can be merged in."
-          echo ""
-          echo "Run 'task tool-models' to regenerate both, then"
-          echo "commit the updated files."
-          echo "============================================"
-          exit 1
-
-      - name: Remove generated models check comment on success
-        if: steps.models-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- generated-models-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }

.github/workflows/check-licence.yml

@@ -1,61 +0,0 @@
-name: License compatibility check
-
-# Reusable workflow called from build.yml when build.gradle / module gradle
-# files change. Verifies all transitive dependencies use a permitted license.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  check-licence:
-    runs-on: ubuntu-latest
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Check licenses for compatibility
-        run: task backend:licenses:check
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: FAILED - check the licenses for compatibility
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-          retention-days: 3

.github/workflows/check-openapi.yml

@@ -1,65 +0,0 @@
-name: Generate OpenAPI documentation
-
-# Reusable workflow called from build.yml when backend Java sources change.
-# Generates SwaggerDoc.json so we know the doc still builds against the
-# current code.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  check-generate-openapi-docs:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Generate OpenAPI documentation
-        run: task backend:swagger
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: openapi-docs
-          path: ./SwaggerDoc.json

.github/workflows/check_properties.yml

@@ -0,0 +1,280 @@
+name: Check Properties Files on PR
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    paths:
+      - "stirling-pdf/src/main/resources/messages_*.properties"
+
+permissions:
+  contents: read # Allow read access to repository content
+
+jobs:
+  check-files:
+    if: github.event_name == 'pull_request_target'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write # Allow posting comments on issues/PRs
+      pull-requests: write # Allow writing to pull requests
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout main branch first
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Get PR data
+        id: get-pr-data
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const repoOwner = context.payload.repository.owner.login;
+            const repoName = context.payload.repository.name;
+            const branch = context.payload.pull_request.head.ref;
+
+            console.log(`PR Number: ${prNumber}`);
+            console.log(`Repo Owner: ${repoOwner}`);
+            console.log(`Repo Name: ${repoName}`);
+            console.log(`Branch: ${branch}`);
+
+            core.setOutput("pr_number", prNumber);
+            core.setOutput("repo_owner", repoOwner);
+            core.setOutput("repo_name", repoName);
+            core.setOutput("branch", branch);
+        continue-on-error: true
+
+      - name: Fetch PR changed files
+        id: fetch-pr-changes
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+        run: |
+          echo "Fetching PR changed files..."
+          echo "Getting list of changed files from PR..."
+                   # Check if PR number exists
+            if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+              echo "Error: PR number is empty"
+              exit 1
+            fi
+            # Get changed files and filter for properties files, handle case where no matches are found
+            gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^stirling-pdf/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR"
+            # Check if any files were found
+            if [ ! -s changed_files.txt ]; then
+              echo "No properties files changed in this PR"
+              echo "Workflow will exit early as no relevant files to check"
+              exit 0
+            fi
+            echo "Found $(wc -l < changed_files.txt) matching properties files"
+
+      - name: Determine reference file test
+        id: determine-file
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const fs = require("fs");
+            const path = require("path");
+
+            const prNumber = ${{ steps.get-pr-data.outputs.pr_number }};
+            const repoOwner = "${{ steps.get-pr-data.outputs.repo_owner }}";
+            const repoName = "${{ steps.get-pr-data.outputs.repo_name }}";
+
+            const prRepoOwner = "${{ github.event.pull_request.head.repo.owner.login }}";
+            const prRepoName = "${{ github.event.pull_request.head.repo.name }}";
+            const branch = "${{ steps.get-pr-data.outputs.branch }}";
+
+            console.log(`Determining reference file for PR #${prNumber}`);
+
+            // Validate inputs
+            const validateInput = (input, regex, name) => {
+              if (!regex.test(input)) {
+                throw new Error(`Invalid ${name}: ${input}`);
+              }
+            };
+
+            validateInput(repoOwner, /^[a-zA-Z0-9_-]+$/, "repository owner");
+            validateInput(repoName, /^[a-zA-Z0-9._-]+$/, "repository name");
+            validateInput(branch, /^[a-zA-Z0-9._/-]+$/, "branch name");
+
+            // Get the list of changed files in the PR
+            const { data: files } = await github.rest.pulls.listFiles({
+              owner: repoOwner,
+              repo: repoName,
+              pull_number: prNumber,
+            });
+
+            // Filter for relevant files based on the PR changes
+            const changedFiles = files
+              .filter(file => 
+                file.status !== "removed" &&
+                /^stirling-pdf\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename)
+              )
+              .map(file => file.filename);
+
+            console.log("Changed files:", changedFiles);
+
+            // Create a temporary directory for PR files
+            const tempDir = "pr-branch";
+            if (!fs.existsSync(tempDir)) {
+              fs.mkdirSync(tempDir, { recursive: true });
+            }
+
+            // Download and save each changed file
+            for (const file of changedFiles) {
+              const { data: fileContent } = await github.rest.repos.getContent({
+                owner: prRepoOwner,
+                repo: prRepoName,
+                path: file,
+                ref: branch,
+              });
+
+              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
+              const filePath = path.join(tempDir, file);
+              const dirPath = path.dirname(filePath);
+
+              if (!fs.existsSync(dirPath)) {
+                fs.mkdirSync(dirPath, { recursive: true });
+              }
+
+              fs.writeFileSync(filePath, content);
+              console.log(`Saved file: ${filePath}`);
+            }
+
+            // Output the list of changed files for further processing
+            const fileList = changedFiles.join(" ");
+            core.exportVariable("FILES_LIST", fileList);
+            console.log("Files saved and listed in FILES_LIST.");
+
+            // Determine reference file
+            let referenceFilePath;
+            if (changedFiles.includes("stirling-pdf/src/main/resources/messages_en_GB.properties")) {
+              console.log("Using PR branch reference file.");
+              const { data: fileContent } = await github.rest.repos.getContent({
+                owner: prRepoOwner,
+                repo: prRepoName,
+                path: "stirling-pdf/src/main/resources/messages_en_GB.properties",
+                ref: branch,
+              });
+
+              referenceFilePath = "pr-branch-messages_en_GB.properties";
+              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
+              fs.writeFileSync(referenceFilePath, content);
+            } else {
+              console.log("Using main branch reference file.");
+              const { data: fileContent } = await github.rest.repos.getContent({
+                owner: repoOwner,
+                repo: repoName,
+                path: "stirling-pdf/src/main/resources/messages_en_GB.properties",
+                ref: "main",
+              });
+
+              referenceFilePath = "main-branch-messages_en_GB.properties";
+              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
+              fs.writeFileSync(referenceFilePath, content);
+            }
+
+            console.log(`Reference file path: ${referenceFilePath}`);
+            core.exportVariable("REFERENCE_FILE", referenceFilePath);
+
+      - name: Run Python script to check files
+        id: run-check
+        run: |
+          echo "Running Python script to check files..."
+          python .github/scripts/check_language_properties.py \
+            --actor ${{ github.event.pull_request.user.login }} \
+            --reference-file "${REFERENCE_FILE}" \
+            --branch "pr-branch" \
+            --files "${FILES_LIST[@]}" > result.txt
+        continue-on-error: true # Continue the job even if this step fails
+
+      - name: Capture output
+        id: capture-output
+        run: |
+          if [ -f result.txt ] && [ -s result.txt ]; then
+            echo "Test, capturing output..."
+            SCRIPT_OUTPUT=$(cat result.txt)
+            echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
+            echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
+            echo "EOF" >> $GITHUB_ENV
+            echo "${SCRIPT_OUTPUT}"
+
+            # Determine job failure based on script output
+            if [[ "$SCRIPT_OUTPUT" == *"❌"* ]]; then
+              echo "FAIL_JOB=true" >> $GITHUB_ENV
+            else
+              echo "FAIL_JOB=false" >> $GITHUB_ENV
+            fi
+          else
+            echo "No update found."
+            echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
+            echo "FAIL_JOB=false" >> $GITHUB_ENV
+          fi
+
+      - name: Post comment on PR
+        if: env.SCRIPT_OUTPUT != ''
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { GITHUB_REPOSITORY, SCRIPT_OUTPUT } = process.env;
+            const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
+            const issueNumber = context.issue.number;
+
+            // Find existing comment
+            const comments = await github.rest.issues.listComments({
+              owner: repoOwner,
+              repo: repoName,
+              issue_number: issueNumber
+            });
+
+            const comment = comments.data.find(c => c.body.includes("## 🚀 Translation Verification Summary"));
+
+            // Only update or create comments by the action user
+            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
+
+            if (comment && comment.user.login === expectedActor) {
+              // Update existing comment
+              await github.rest.issues.updateComment({
+                owner: repoOwner,
+                repo: repoName,
+                comment_id: comment.id,
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+              });
+              console.log("Updated existing comment.");
+            } else if (!comment) {
+              // Create new comment if no existing comment is found
+              await github.rest.issues.createComment({
+                owner: repoOwner,
+                repo: repoName,
+                issue_number: issueNumber,
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+              });
+              console.log("Created new comment.");
+            } else {
+              console.log("Comment update attempt denied. Actor does not match.");
+            }
+
+      - name: Fail job if errors found
+        if: env.FAIL_JOB == 'true'
+        run: |
+          echo "Failing the job because errors were detected."
+          exit 1
+
+      - name: Cleanup temporary files
+        if: always()
+        run: |
+          echo "Cleaning up temporary files..."
+          rm -rf pr-branch
+          rm -f pr-branch-messages_en_GB.properties main-branch-messages_en_GB.properties changed_files.txt result.txt
+          echo "Cleanup complete."
+        continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/check_toml.yml

@@ -1,298 +0,0 @@
-name: Check TOML Translation Files on PR
-
-# This workflow validates TOML translation files
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-    paths:
-      - "frontend/editor/public/locales/*/translation.toml"
-      - ".github/scripts/check_language_toml.py"
-      - ".github/workflows/check_toml.yml"
-
-# cancel in-progress jobs if a new job is triggered
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read # Allow read access to repository content
-
-jobs:
-  check-files:
-    if: github.event_name == 'pull_request_target'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write # Allow posting comments on issues/PRs
-      pull-requests: write # Allow writing to pull requests
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout main branch first
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Get PR data
-        id: get-pr-data
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const prNumber = context.payload.pull_request.number;
-            const repoOwner = context.payload.repository.owner.login;
-            const repoName = context.payload.repository.name;
-            const branch = context.payload.pull_request.head.ref;
-
-            console.log(`PR Number: ${prNumber}`);
-            console.log(`Repo Owner: ${repoOwner}`);
-            console.log(`Repo Name: ${repoName}`);
-            console.log(`Branch: ${branch}`);
-
-            core.setOutput("pr_number", prNumber);
-            core.setOutput("repo_owner", repoOwner);
-            core.setOutput("repo_name", repoName);
-            core.setOutput("branch", branch);
-        continue-on-error: true
-
-      - name: Fetch PR changed files
-        id: fetch-pr-changes
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-        run: |
-          echo "Fetching PR changed files..."
-          echo "Getting list of changed files from PR..."
-          # Check if PR number exists
-          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
-            echo "Error: PR number is empty"
-            exit 1
-          fi
-          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
-          # Check if any files were found
-          if [ ! -s changed_files.txt ]; then
-            echo "No TOML translation files changed in this PR"
-            echo "Workflow will exit early as no relevant files to check"
-            exit 0
-          fi
-          echo "Found $(wc -l < changed_files.txt) matching TOML files"
-
-      - name: Determine reference file
-        id: determine-file
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const fs = require("fs");
-            const path = require("path");
-
-            const prNumber = ${{ steps.get-pr-data.outputs.pr_number }};
-            const repoOwner = "${{ steps.get-pr-data.outputs.repo_owner }}";
-            const repoName = "${{ steps.get-pr-data.outputs.repo_name }}";
-
-            const prRepoOwner = "${{ github.event.pull_request.head.repo.owner.login }}";
-            const prRepoName = "${{ github.event.pull_request.head.repo.name }}";
-            const branch = "${{ steps.get-pr-data.outputs.branch }}";
-
-            console.log(`Determining reference file for PR #${prNumber}`);
-
-            // Validate inputs
-            const validateInput = (input, regex, name) => {
-              if (!regex.test(input)) {
-                throw new Error(`Invalid ${name}: ${input}`);
-              }
-            };
-
-            validateInput(repoOwner, /^[a-zA-Z0-9_-]+$/, "repository owner");
-            validateInput(repoName, /^[a-zA-Z0-9._-]+$/, "repository name");
-            validateInput(branch, /^[a-zA-Z0-9._/-]+$/, "branch name");
-
-            // Get the list of changed files in the PR
-            const { data: files } = await github.rest.pulls.listFiles({
-              owner: repoOwner,
-              repo: repoName,
-              pull_number: prNumber,
-            });
-
-            // Filter for relevant TOML files based on the PR changes
-            const changedFiles = files
-              .filter(file =>
-                file.status !== "removed" &&
-                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
-              )
-              .map(file => file.filename);
-
-            console.log("Changed files:", changedFiles);
-
-            // Create a temporary directory for PR files
-            const tempDir = "pr-branch";
-            if (!fs.existsSync(tempDir)) {
-              fs.mkdirSync(tempDir, { recursive: true });
-            }
-
-            // Download and save each changed file
-            for (const file of changedFiles) {
-              const { data: fileContent } = await github.rest.repos.getContent({
-                owner: prRepoOwner,
-                repo: prRepoName,
-                path: file,
-                ref: branch,
-              });
-
-              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
-              const filePath = path.join(tempDir, file);
-              const dirPath = path.dirname(filePath);
-
-              if (!fs.existsSync(dirPath)) {
-                fs.mkdirSync(dirPath, { recursive: true });
-              }
-
-              fs.writeFileSync(filePath, content);
-              console.log(`Saved file: ${filePath}`);
-            }
-
-            // Output the list of changed files for further processing
-            const fileList = changedFiles.join(" ");
-            core.exportVariable("FILES_LIST", fileList);
-            console.log("Files saved and listed in FILES_LIST.");
-
-            // Determine reference file
-            let referenceFilePath;
-            if (changedFiles.includes("frontend/editor/public/locales/en-US/translation.toml")) {
-              console.log("Using PR branch reference file.");
-              const { data: fileContent } = await github.rest.repos.getContent({
-                owner: prRepoOwner,
-                repo: prRepoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
-                ref: branch,
-              });
-
-              referenceFilePath = "pr-branch-translation-en-US.toml";
-              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
-              fs.writeFileSync(referenceFilePath, content);
-            } else {
-              console.log("Using main branch reference file.");
-              const { data: fileContent } = await github.rest.repos.getContent({
-                owner: repoOwner,
-                repo: repoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
-                ref: "main",
-              });
-
-              referenceFilePath = "main-branch-translation-en-US.toml";
-              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
-              fs.writeFileSync(referenceFilePath, content);
-            }
-
-            console.log(`Reference file path: ${referenceFilePath}`);
-            core.exportVariable("REFERENCE_FILE", referenceFilePath);
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install Python dependencies
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Run Python script to check files
-        id: run-check
-        run: |
-          echo "Running Python script to check TOML files..."
-          python .github/scripts/check_language_toml.py \
-            --actor ${{ github.event.pull_request.user.login }} \
-            --reference-file "${REFERENCE_FILE}" \
-            --branch "pr-branch" \
-            --files "${FILES_LIST[@]}" > result.txt
-        continue-on-error: true # Continue the job even if this step fails
-
-      - name: Capture output
-        id: capture-output
-        run: |
-          if [ -f result.txt ] && [ -s result.txt ]; then
-            echo "Capturing output..."
-            SCRIPT_OUTPUT=$(cat result.txt)
-            echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
-            echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
-            echo "EOF" >> $GITHUB_ENV
-            echo "${SCRIPT_OUTPUT}"
-
-            # Determine job failure based on script output
-            if [[ "$SCRIPT_OUTPUT" == *"❌"* ]]; then
-              echo "FAIL_JOB=true" >> $GITHUB_ENV
-            else
-              echo "FAIL_JOB=false" >> $GITHUB_ENV
-            fi
-          else
-            echo "No output found."
-            echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
-            echo "FAIL_JOB=false" >> $GITHUB_ENV
-          fi
-
-      - name: Post comment on PR
-        if: env.SCRIPT_OUTPUT != ''
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { GITHUB_REPOSITORY, SCRIPT_OUTPUT } = process.env;
-            const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
-            const issueNumber = context.issue.number;
-
-            // Find existing comment
-            const comments = await github.rest.issues.listComments({
-              owner: repoOwner,
-              repo: repoName,
-              issue_number: issueNumber
-            });
-
-            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
-
-            // Only update or create comments by the action user
-            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
-
-            if (comment && comment.user.login === expectedActor) {
-              // Update existing comment
-              await github.rest.issues.updateComment({
-                owner: repoOwner,
-                repo: repoName,
-                comment_id: comment.id,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
-              });
-              console.log("Updated existing comment.");
-            } else if (!comment) {
-              // Create new comment if no existing comment is found
-              await github.rest.issues.createComment({
-                owner: repoOwner,
-                repo: repoName,
-                issue_number: issueNumber,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
-              });
-              console.log("Created new comment.");
-            } else {
-              console.log("Comment update attempt denied. Actor does not match.");
-            }
-
-      - name: Fail job if errors found
-        if: env.FAIL_JOB == 'true'
-        run: |
-          echo "Failing the job because errors were detected."
-          exit 1
-
-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          echo "Cleaning up temporary files..."
-          rm -rf pr-branch
-          rm -f pr-branch-translation-en-US.toml main-branch-translation-en-US.toml changed_files.txt result.txt
-          echo "Cleanup complete."
-        continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/codeql.yml-disabled

@@ -0,0 +1,79 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+#disable for now
+#on:
+#  push:
+#    branches: ["main"]
+#  pull_request:
+    # The branches below must be a subset of the branches above
+#    branches: ["main"]
+#  schedule:
+#    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["java"]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/coverage-aggregate.yml

@@ -1,241 +0,0 @@
-name: Aggregate backend coverage
-
-# Reusable workflow called from build.yml after every backend coverage
-# producer (JUnit, e2e:live, cucumber) has run. Downloads each job's raw
-# .exec, merges them into one JaCoCo report, and posts a combined step
-# summary alongside the per-source ones.
-#
-# Kept separate from the per-source jobs so:
-#   - the per-source jobs stay fast and independent (no cross-job waits)
-#   - this job can `if: always()` and still produce something useful when
-#     one of the producers fails partway through
-#   - frontend producers can be added later without touching the
-#     producers themselves
-on:
-  workflow_call:
-    inputs:
-      frontend-validation-result:
-        description: Result of the frontend-validation producer job
-        required: false
-        type: string
-        default: skipped
-      playwright-e2e-live-result:
-        description: Result of the playwright-e2e-live producer job
-        required: false
-        type: string
-        default: skipped
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  aggregate:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    timeout-minutes: 15
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for coverage scripts
-        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
-        # XML through defusedxml - see the script headers for context.
-        run: python -m pip install --quiet defusedxml
-
-      # Pattern matches every artifact this PR's producers might upload:
-      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
-      #                                         leg of backend-build, which
-      #                                         is a strict superset of the
-      #                                         core + proprietary legs)
-      #   jacoco-exec-e2e-live
-      #   jacoco-exec-cucumber
-      # Each lands as a sibling dir under coverage-execs/, with the .exec
-      # files preserving their original relative paths.
-      - name: Download all .exec artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          pattern: jacoco-exec-*
-          path: coverage-execs/
-          merge-multiple: false
-        continue-on-error: true
-
-      - name: Inventory .exec files
-        id: inventory
-        # Splits the downloaded artifacts into two buckets:
-        #   * e2e-only  = cucumber + Playwright live (user-flow coverage)
-        #   * all       = the above plus JUnit (everything we test)
-        #
-        # Bucketing is by artifact-name prefix: download-artifact preserves
-        # the artifact name as the top-level dir, so JUnit's `.exec`s live
-        # under coverage-execs/jacoco-exec-junit-*/... while the others
-        # are under coverage-execs/jacoco-exec-{e2e-live,cucumber}/...
-        #
-        # If nothing was uploaded (e.g. all producers crashed before
-        # writing) we exit gracefully so this advisory job never fails CI.
-        run: |
-          mapfile -t all_execs < <(find coverage-execs -name '*.exec' -type f | sort)
-          mapfile -t e2e_execs < <(find coverage-execs -name '*.exec' -type f -not -path '*/jacoco-exec-junit-*' | sort)
-          if [ "${#all_execs[@]}" -eq 0 ]; then
-            echo "::warning::No .exec artifacts found - skipping aggregate report"
-            echo "found_all=false" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          printf 'All %d .exec files:\n' "${#all_execs[@]}"
-          printf '  %s\n' "${all_execs[@]}"
-          IFS=','; all_joined="${all_execs[*]}"
-          echo "files_all=$all_joined" >> "$GITHUB_OUTPUT"
-          echo "found_all=true" >> "$GITHUB_OUTPUT"
-          if [ "${#e2e_execs[@]}" -eq 0 ]; then
-            echo "::notice::No e2e/cucumber .exec files - e2e-only report will be skipped"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-          else
-            printf 'E2E-only %d .exec files:\n' "${#e2e_execs[@]}"
-            printf '  %s\n' "${e2e_execs[@]}"
-            unset IFS
-            IFS=','; e2e_joined="${e2e_execs[*]}"
-            echo "files_e2e=$e2e_joined" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Compile classes for JaCoCo class lookup
-        # jacocoReportFromExec only needs the compiled .class files
-        # under each subproject's build/classes/java/main/. `classes`
-        # (compileJava + processResources) is enough; we skipped the
-        # heavier `assemble` to avoid building bootJar / fat jars that
-        # add 60+ seconds per run for no gain to the report.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: ./gradlew classes -PnoSpotless
-
-      - name: Generate e2e-only JaCoCo report
-        # "Real user-flow" coverage: only counts code reached by an actual
-        # HTTP request from cucumber or live Playwright. Useful for
-        # questions like "how much of our backend does a user actually
-        # hit?". Skipped when neither producer uploaded a .exec.
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_e2e }}" \
-            -PreportDir=build/reports/jacoco/aggregate-e2e \
-            -PnoSpotless
-
-      - name: Generate combined JaCoCo report (everything)
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_all }}" \
-            -PreportDir=build/reports/jacoco/aggregate-all \
-            -PnoSpotless
-
-      - name: E2E-only step summary
-        # Rendered first so it gets prime real estate in the Summary
-        # tab - this is the number most readers actually want
-        # ("how much of the backend do real user flows cover?").
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: ALL-sources step summary
-        # Separate call (not a multi-input one) because the helper's
-        # rightmost "Aggregate" column would sum the two reports - which
-        # is meaningless when one is a strict superset of the other.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload combined aggregate report
-        if: steps.inventory.outputs.found_all == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-all-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-all/
-          retention-days: 14
-
-      - name: Upload e2e-only aggregate report
-        if: steps.inventory.outputs.found_e2e == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-e2e-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-e2e/
-          retention-days: 14
-
-      # --------------------------------------------------------------
-      # Per-area matrix: rolls backend + frontend coverage into one
-      # table indexed by core/proprietary/saas/desktop. Pulls the
-      # frontend artifacts now (after the JaCoCo step has done its
-      # work) so the per-source backend summaries still render first
-      # even if the matrix step fails.
-      # --------------------------------------------------------------
-      - name: Download vitest coverage artifact
-        # frontend-validation uploads as `frontend-coverage`. Tolerate
-        # absence on backend-only runs by skipping the download entirely
-        # when the producer job was not part of this workflow run.
-        if: inputs.frontend-validation-result == 'success'
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: frontend-coverage
-          path: matrix-inputs/vitest/
-        continue-on-error: true
-
-      - name: Download Playwright frontend coverage artifact
-        # e2e-live uploads the artifact with a stable name. Skip the
-        # download entirely when the producer job did not run.
-        if: inputs.playwright-e2e-live-result == 'success'
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: playwright-frontend-coverage
-          path: matrix-inputs/playwright/
-        continue-on-error: true
-
-      - name: Coverage matrix step summary
-        if: always()
-        # Matrix references the two aggregate JaCoCo XMLs (already
-        # generated above) plus whichever frontend artifacts landed.
-        # Every input is optional; missing ones render as "-".
-        run: |
-          python scripts/coverage-matrix.py \
-            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
-            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
-            --vitest matrix-inputs/vitest/coverage-summary.json \
-            --playwright-frontend matrix-inputs/playwright/coverage-pw-summary/coverage-summary.json \
-            --title "Coverage matrix (per-area, e2e vs all)" \
-            --github-step-summary

.github/workflows/db-migration-test.yml

@@ -1,93 +0,0 @@
-name: DB migration smoke test
-
-# Boots the current Stirling-PDF JAR against H2 fixtures captured from past
-# releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still works.
-# Catches schema changes that would break existing user databases under
-# Hibernate's `ddl-auto=update` upgrade path.
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  migration-test:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    timeout-minutes: 30
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: 25
-          distribution: temurin
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      # No `-PnoSpotless` here yet because the upstream cache layer matches the
-      # backend build's; reuse keeps cold-cache cost identical.
-      - name: Build Stirling-PDF JAR
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:bootJar -PnoSpotless --no-daemon
-
-      - name: Locate built JAR
-        id: jar
-        run: |
-          jar=$(find app/core/build/libs -maxdepth 1 -name 'Stirling-PDF*.jar' -o -name 'stirling-pdf*.jar' 2>/dev/null \
-              | grep -vE '(-plain|-sources)\.jar$' | head -n 1)
-          if [[ -z "$jar" ]]; then
-            echo "::error::No JAR under app/core/build/libs"
-            ls -lah app/core/build/libs || true
-            exit 1
-          fi
-          # Absolute path - the migration script pushd's into a temp workdir
-          # before invoking java, which would dangle a relative path.
-          jar=$(realpath "$jar")
-          echo "path=$jar" >> "$GITHUB_OUTPUT"
-          echo "Built JAR: $jar"
-
-      - name: Run migration smoke test
-        env:
-          STIRLING_JAR: ${{ steps.jar.outputs.path }}
-        run: bash scripts/db-migration/run-migration-test.sh
-
-      - name: Upload app logs on failure
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: db-migration-app-logs
-          # Path matches the preserved workdir in run-migration-test.sh -
-          # only failing fixtures leave a directory behind.
-          path: /tmp/stirling-migration-failed-*/app.log
-          retention-days: 7
-          if-no-files-found: warn

.github/workflows/dependency-review.yml

@@ -1,10 +1,13 @@
-name: Dependency Review
-
-# Reusable workflow called from build.yml. Scans dependency manifest files
-# changing in a PR for known-vulnerable packages, using the rules in
-# .github/config/dependency-review-config.yml.
-on:
-  workflow_call:
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: "Dependency Review"
+on: [pull_request]
 
 permissions:
   contents: read
@@ -14,13 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: "Checkout Repository"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          config-file: "./.github/config/dependency-review-config.yml"
+        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

.github/workflows/deploy-on-v2-commit.yml

@@ -1,232 +0,0 @@
-name: Auto V2 Deploy on Push
-
-on:
-  push:
-    branches:
-      - V2
-      - deploy-on-v2-commit
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  deploy-v2-on-push:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    concurrency:
-      group: deploy-v2-push-V2
-      cancel-in-progress: true
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
-      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Get commit hashes for frontend and backend
-        id: commit-hashes
-        run: |
-          # Get last commit that touched the frontend folder, docker/frontend, or docker/compose
-          FRONTEND_HASH=$(git log -1 --format="%H" -- frontend/ docker/frontend/ docker/compose/ 2>/dev/null || echo "")
-          if [ -z "$FRONTEND_HASH" ]; then
-            FRONTEND_HASH="no-frontend-changes"
-          fi
-
-          # Get last commit that touched backend code, docker/backend, or docker/compose
-          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
-          if [ -z "$BACKEND_HASH" ]; then
-            BACKEND_HASH="no-backend-changes"
-          fi
-
-          echo "Frontend hash: $FRONTEND_HASH"
-          echo "Backend hash: $BACKEND_HASH"
-
-          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
-          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-
-          # Short hashes for tags
-          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
-            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
-          else
-            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
-          fi
-
-          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
-            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
-          else
-            echo "backend_short=${BACKEND_HASH:0:8}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check if frontend image exists
-        id: check-frontend
-        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }} >/dev/null 2>&1; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Frontend image already exists, skipping build"
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Frontend image needs to be built"
-          fi
-
-      - name: Check if backend image exists
-        id: check-backend
-        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }} >/dev/null 2>&1; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Backend image already exists, skipping build"
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Backend image needs to be built"
-          fi
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Build and push frontend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push frontend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-v2-frontend
-          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push backend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push backend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-v2-backend
-          cache-to: type=gha,mode=max,scope=stirling-v2-backend
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
-          chmod 600 ../private.key
-
-      - name: Deploy to VPS on port 3000
-        run: |
-          export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
-
-          cat > $UNIQUE_NAME << EOF
-          version: '3.3'
-          services:
-            backend:
-              container_name: stirling-v2-backend
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-              ports:
-                - "13000:8080"
-              volumes:
-                - /stirling/V2/data:/usr/share/tessdata:rw
-                - /stirling/V2/config:/configs:rw
-                - /stirling/V2/logs:/logs:rw
-              environment:
-                DISABLE_ADDITIONAL_FEATURES: "true"
-                SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
-                UI_APPNAME: "Stirling-PDF V2"
-                UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
-                UI_APPNAMENAVBAR: "V2 Deployment"
-                SYSTEM_MAXFILESIZE: "100"
-                METRICS_ENABLED: "true"
-                SYSTEM_GOOGLEVISIBILITY: "false"
-                SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
-                baseUrl: "https://demo.stirlingpdf.cloud"
-              restart: on-failure:5
-
-            frontend:
-              container_name: stirling-v2-frontend
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-              ports:
-                - "3000:80"
-              environment:
-                VITE_API_BASE_URL: "http://${{ secrets.NEW_VPS_HOST }}:13000"
-              depends_on:
-                - backend
-              restart: on-failure:5
-          EOF
-
-          # Copy to remote with unique name
-          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/$UNIQUE_NAME
-
-          # SSH and rename/move atomically to avoid interference
-          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
-            mkdir -p /stirling/V2/{data,config,logs}
-            mv /tmp/$UNIQUE_NAME /stirling/V2/docker-compose.yml
-            cd /stirling/V2
-            docker-compose down || true
-            docker-compose pull
-            docker-compose up -d
-            docker system prune -af --volumes || true
-            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
-          ENDSSH
-
-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          rm -f ../private.key

.github/workflows/docker-compose-tests.yml

@@ -1,197 +0,0 @@
-name: Docker Compose Cucumber tests
-
-# Reusable workflow called from build.yml when project / docker / testing
-# sources change. Boots the docker-compose stack and runs the cucumber
-# scenarios in testing/cucumber.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 4 because bench showed 16 was within noise of 4."
-        required: false
-        type: string
-        default: "4"
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  docker-compose-tests:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') }}
-    permissions:
-      actions: write
-      contents: read
-      checks: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      # When the PR changes the base image, test.sh builds it locally
-      # (stirling-pdf-base:local) into the daemon image store. A buildx
-      # container builder can't see that store, so skip it here and let
-      # `docker buildx build` fall back to the default docker driver, which
-      # resolves the local base. The gha cache backend is also skipped (its
-      # runtime token isn't exposed) since the docker driver can't use it.
-      - name: Set up Docker Buildx
-        if: inputs.docker-base-changed != 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
-      - name: Expose GitHub runtime for Buildx cache
-        if: inputs.docker-base-changed != 'true'
-        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
-
-      - name: Install Docker Compose
-        run: |
-          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-          sudo chmod +x /usr/local/bin/docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
-          cache-dependency-path: ./testing/cucumber/requirements.txt
-
-      - name: Pip requirements
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
-
-      - name: Extract JaCoCo agent for cucumber coverage
-        # Stages build/jacoco/jacocoagent.jar where the coverage override
-        # file bind-mounts it into the cucumber container. The agent jar
-        # never goes into the published image - this is host-only.
-        run: ./gradlew copyJacocoAgent -PnoSpotless
-
-      - name: Run Docker Compose Tests
-        run: |
-          chmod +x ./testing/test_webpages.sh
-          chmod +x ./testing/test.sh
-          chmod +x ./testing/test_disabledEndpoints.sh
-          ./testing/test.sh
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-          # Tells test.sh to layer testing/compose/docker-compose-coverage.override.yml
-          # over the cucumber compose so the container starts with the
-          # JaCoCo agent attached via JAVA_CUSTOM_OPTS.
-          STIRLING_PDF_TEST_COVERAGE: "1"
-
-      - name: Generate cucumber JaCoCo report
-        # `if: always()` so a behave failure still produces partial
-        # coverage from whatever endpoints did run. The exec file only
-        # exists when the container shut down cleanly - guard so the step
-        # is silent on the (rare) crash path.
-        if: always()
-        id: cucumber-coverage
-        run: |
-          if [ -s testing/cucumber-coverage/cucumber.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=testing/cucumber-coverage/cucumber.exec \
-              -PreportDir=build/reports/jacoco/cucumber \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No cucumber .exec at testing/cucumber-coverage/cucumber.exec (container may have crashed before flushing)"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml -
-        # see the script header for context.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-
-      - name: Cucumber coverage step summary
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Cucumber (docker) JaCoCo coverage" \
-            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload cucumber JaCoCo report
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-cucumber-${{ github.run_id }}
-          path: build/reports/jacoco/cucumber/
-          retention-days: 7
-
-      - name: Upload raw cucumber .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-cucumber
-          path: testing/cucumber-coverage/cucumber.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload Cucumber Report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: cucumber-report
-          path: testing/cucumber/report.html
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docker-compose-test-reports
-          path: testing/reports/
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Cucumber Test Report
-        if: always()
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        with:
-          name: Cucumber Tests
-          path: testing/cucumber/junit/*.xml
-          reporter: java-junit
-          fail-on-error: false

.github/workflows/e2e-live.yml

@@ -1,227 +0,0 @@
-name: Playwright E2E (live backend)
-
-# Reusable workflow called from build.yml. Live-backend Playwright suite —
-# boots Spring Boot and runs auth + real tool round-trips against the live
-# server.
-on:
-  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  playwright-e2e-live:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    timeout-minutes: 30
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-      - name: Run live E2E tests (chromium) with coverage
-        id: live-tests
-        env:
-          # Attaches the JaCoCo agent to the bootRun JVM (see
-          # .taskfiles/e2e.yml live:backend). The .exec gets flushed on
-          # graceful shutdown when the runner traps EXIT/INT/TERM, so the
-          # report step below sees a populated file.
-          COVERAGE: "1"
-          # Tells the Playwright fixture (test-base.ts) to capture per-test
-          # V8 JS coverage. Raw dumps land under
-          # .test-state/playwright/coverage-pw/ for the post-process step
-          # to aggregate. Chromium-only - other engines silently skip.
-          PW_COVERAGE: "1"
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-        run: task e2e:live
-      - name: Flag flaky tests
-        # Runs regardless of the test outcome: a flaky test (passed on retry)
-        # leaves the step green, so this is the only place it surfaces. Emits
-        # ::warning:: annotations + a job summary; never fails the job.
-        if: always()
-        working-directory: frontend
-        run: npx tsx editor/scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-      - name: Generate JaCoCo report from e2e:live .exec
-        if: always()
-        id: live-coverage
-        # `if: always()` so even a failed test run still produces a
-        # report from whatever flows did exercise the backend before
-        # the failure. The task itself tolerates a missing .exec
-        # (jacoco emits an empty report rather than crashing) but we
-        # guard with `test -s` to keep the job log clean.
-        run: |
-          if [ -s .test-state/playwright/jacoco.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=.test-state/playwright/jacoco.exec \
-              -PreportDir=build/reports/jacoco/e2e-live \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Set up Python for coverage summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
-        # to dodge XXE / billion-laughs scanner findings.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-      - name: e2e:live coverage step summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live backend) JaCoCo coverage" \
-            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
-            --github-step-summary
-      - name: Upload e2e:live JaCoCo report
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-e2e-live-${{ github.run_id }}
-          path: build/reports/jacoco/e2e-live/
-          retention-days: 7
-
-      - name: Upload raw e2e:live .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-e2e-live
-          path: .test-state/playwright/jacoco.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Set up Python for frontend coverage summary
-        # Separate from the backend-coverage python step because the
-        # frontend path doesn't depend on a JaCoCo report - it produces
-        # a summary even on backend failure, as long as some Playwright
-        # tests ran far enough to dump V8 coverage.
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for frontend coverage summary
-        # Idempotent re-install: the backend-coverage step may have
-        # installed it already, but this leg can run on its own when the
-        # backend report step skips (e.g. .exec missing).
-        if: always()
-        run: python -m pip install --quiet defusedxml
-
-      - name: Aggregate Playwright frontend (V8) coverage
-        # Rolls per-test V8 dumps from the test-base fixture into one
-        # vitest-shaped coverage-summary.json. Tolerates a missing dump
-        # dir (firefox/webkit runs, or a failure before any test got
-        # far enough to dump).
-        if: always()
-        id: pw-frontend-coverage
-        run: |
-          if [ -d .test-state/playwright/coverage-pw ] && \
-             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            python scripts/playwright-coverage-summary.py \
-              .test-state/playwright/coverage-pw \
-              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
-            echo "summary=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::No Playwright frontend coverage dumps found (chromium-only feature)"
-            echo "summary=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Playwright frontend coverage step summary
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live) frontend coverage" \
-            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-            --github-step-summary
-
-      - name: Upload Playwright frontend coverage
-        # Bundle both the aggregated summary and the raw V8 dumps so
-        # someone debugging "why is this function showing as covered"
-        # can trace it back to the source dump.
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-frontend-coverage
-          path: |
-            .test-state/playwright/coverage-pw-summary/
-            .test-state/playwright/coverage-pw/
-          retention-days: 7
-
-      - name: Print backend log on failure
-        if: failure() && steps.live-tests.conclusion == 'failure'
-        run: |
-          echo "::group::Spring Boot backend log (last 500 lines)"
-          tail -500 .test-state/playwright/backend.log || echo "no backend log found"
-          echo "::endgroup::"
-      - name: Upload backend log
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: backend-log-live-${{ github.run_id }}
-          path: .test-state/playwright/backend.log
-          retention-days: 7
-      - name: List Playwright output locations (debug)
-        if: always()
-        run: |
-          echo "::group::Playwright output dirs"
-          # Playwright anchors its default outputDir + HTML report to the
-          # nearest package.json, which is frontend/ (frontend/editor has
-          # none), so artifacts land under frontend/, not frontend/editor/.
-          ls -la frontend/playwright-report 2>/dev/null \
-            || echo "no playwright-report at frontend/"
-          ls -la frontend/test-results 2>/dev/null \
-            || echo "no test-results at frontend/"
-          find . -name node_modules -prune -o -name 'trace.zip' -print 2>/dev/null || true
-          echo "::endgroup::"
-      - name: Upload Playwright report + traces
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-live-${{ github.run_id }}
-          # test-results/ holds the per-test trace.zip (with browser console
-          # logs) + screenshots/video; playwright-report/ is the HTML report.
-          # Both live under frontend/ (Playwright anchors them to the nearest
-          # package.json, which is frontend/; frontend/editor has none).
-          path: |
-            frontend/playwright-report/
-            frontend/test-results/
-          retention-days: 7
-          if-no-files-found: warn

.github/workflows/e2e-stubbed.yml

@@ -1,65 +0,0 @@
-name: Playwright E2E (stubbed)
-
-# Reusable workflow called from build.yml. Backend-free Playwright suite —
-# fast, no Spring Boot required. Runs against the `stubbed` project which
-# mocks API responses in the browser.
-on:
-  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 8 to match the other playwright workflows; bench showed flat scaling above 8."
-        required: false
-        type: string
-        default: "8"
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  playwright-e2e:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-      - name: Run stubbed E2E tests (chromium)
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-        run: task e2e:stubbed -- --workers=3
-      - name: Flag flaky tests
-        # Runs regardless of the test outcome: a flaky test (passed on retry)
-        # leaves the step green, so this is the only place it surfaces. Emits
-        # ::warning:: annotations + a job summary; never fails the job.
-        if: always()
-        working-directory: frontend
-        run: npx tsx editor/scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7

.github/workflows/frontend-backend-licenses-update.yml

@@ -1,537 +0,0 @@
-name: License Report Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  merge_group:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  files-changed:
-    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    timeout-minutes: 3
-    outputs:
-      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
-      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          filters: .github/config/.files.yaml
-
-  generate-frontend-license-report:
-    if: needs.files-changed.outputs.licenses-frontend == 'true'
-    name: Generate Frontend License Report
-    needs: [pick, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout PR head (default)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Checkout BASE branch (safe script)
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: base
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install frontend dependencies
-        working-directory: frontend
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        run: npm ci --ignore-scripts --audit=false --fund=false
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Generate frontend license report (Push only)
-        if: github.event_name == 'push'
-        env:
-          PR_IS_FORK: "false"
-        run: task frontend:licenses:generate
-
-      - name: Generate frontend license report (internal PR)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        env:
-          PR_IS_FORK: "false"
-        run: task frontend:licenses:generate
-
-      - name: Generate frontend license report (fork PRs, pinned)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        working-directory: frontend
-        run: |
-          mkdir -p editor/src/assets
-          npx --yes license-report --only=prod --output=json > editor/src/assets/3rdPartyLicenses.json
-
-      - name: Postprocess with project script (BASE version)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          PR_IS_FORK: "true"
-        run: |
-          node base/frontend/editor/scripts/generate-licenses.js \
-            --input frontend/editor/src/assets/3rdPartyLicenses.json
-
-      - name: Copy postprocessed artifacts back (fork PRs)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        run: |
-          mkdir -p frontend/editor/src/assets
-          if [ -f "base/frontend/editor/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/editor/src/assets/3rdPartyLicenses.json frontend/editor/src/assets/3rdPartyLicenses.json
-          fi
-          if [ -f "base/frontend/editor/src/assets/license-warnings.json" ]; then
-            cp base/frontend/editor/src/assets/license-warnings.json frontend/editor/src/assets/license-warnings.json
-          fi
-
-      - name: Check for license warnings
-        run: |
-          if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-
-      # PR Event: Check licenses and comment on PR
-      - name: Delete previous license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            // Get all comments on the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            // Filter for license check comments
-            const licenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Frontend License Check Passed') ||
-              comment.body.includes('## ❌ Frontend License Check Failed')
-            );
-
-            // Delete old license check comments
-            for (const comment of licenseComments) {
-              console.log(`Deleting old license check comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Summarize results (fork PRs)
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) || github.actor == 'dependabot[bot]'
-        run: |
-          {
-            echo "## Frontend License Check"
-            echo ""
-            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
-              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
-                echo ""
-                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/editor/src/assets/license-warnings.json || true
-              fi
-            else
-              echo "✅ **Passed** – no license warnings detected."
-            fi
-            echo ""
-            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Comment on PR - License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-
-            let commentBody;
-
-            if (hasWarnings) {
-              // Read warnings file to get specific issues
-              const fs = require('fs');
-              let warningDetails = '';
-              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/editor/src/assets/license-warnings.json', 'utf8'));
-                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
-              } catch (e) {
-                warningDetails = 'Unable to read warning details';
-              }
-
-              commentBody = `## ❌ Frontend License Check Failed
-
-              The frontend license check has detected compatibility warnings that require review:
-
-              ${warningDetails}
-
-              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Frontend License Check Passed
-
-              All frontend licenses have been validated and no compatibility warnings were detected.
-
-              The frontend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ License warnings detected. Failing the workflow."
-          exit 1
-
-      # Push Event: Commit license files and create PR
-      - name: Commit changes (Push only)
-        if: github.event_name == 'push'
-        run: |
-          git add frontend/editor/src/assets/3rdPartyLicenses.json
-          # Note: Do NOT commit license-warnings.json - it's only for PR review
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (Push only)
-        if: github.event_name == 'push'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the frontend license report based on changes to package.json dependencies."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          The following licenses may require review for corporate compatibility:
-
-          $(cat frontend/editor/src/assets/license-warnings.json | jq -r '.warnings[].message')
-
-          Please review these licenses to ensure they are acceptable for your use case."
-          fi
-
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (Push only)
-        id: cpr
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Frontend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-frontend-3rd-party-licenses
-          base: main
-          title: "Update Frontend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,frontend
-          draft: false
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-  generate-backend-license-report:
-    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: [pick, files-changed]
-    name: Generate Backend License Report
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Check licenses and generate report
-        id: license-check
-        run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: false
-          STIRLING_PDF_DESKTOP_UI: true
-
-      - name: Check for license compatibility issues
-        run: |
-          if [ -f build/reports/dependency-license/dependencies-without-allowed-license.json ] && \
-             jq '.dependenciesWithoutAllowedLicenses | length > 0' build/reports/dependency-license/dependencies-without-allowed-license.json | grep -q true; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-        if: always()
-
-      - name: Upload artifact on license issues
-        if: env.LICENSE_WARNINGS_EXIST == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: backend-dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-
-      - name: Move license file
-        if: env.LICENSE_CHECK_FAILED != 'true' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          mkdir -p app/core/src/main/resources/static
-          cp build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
-
-      - name: Delete previous backend license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            const backendLicenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Backend License Check Passed') ||
-              comment.body.includes('## ❌ Backend License Check Failed')
-            );
-
-            for (const comment of backendLicenseComments) {
-              console.log(`Deleting old backend license comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Comment on PR - Backend License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-            const fs = require('fs');
-            let warningDetails = '';
-
-            if (hasWarnings) {
-              try {
-                const warningsFile = 'build/reports/dependency-license/dependencies-without-allowed-license.json';
-                if (fs.existsSync(warningsFile)) {
-                  const data = JSON.parse(fs.readFileSync(warningsFile, 'utf8'));
-                  if (data.length > 0) {
-                    warningDetails = data.map(dep => `- **${dep.moduleName}@${dep.moduleVersion}** – ${dep.moduleLicenses.map(l => l.licenseName).join(', ')}`).join('\n');
-                  }
-                }
-              } catch (e) {
-                warningDetails = 'Unable to parse warning details.';
-              }
-            }
-
-            let commentBody;
-            if (hasWarnings) {
-              commentBody = `## ❌ Backend License Check Failed
-
-              The backend license check has detected dependencies with incompatible or unallowed licenses:
-
-              ${warningDetails || 'See uploaded artifact for details.'}
-
-              **Action Required:** Please review these licenses and resolve before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Backend License Check Passed
-
-              All backend dependencies have valid and allowed licenses.
-
-              The backend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ Backend license warnings detected. Failing the workflow."
-          exit 1
-
-      - name: Commit changes (push only)
-        if: github.event_name == 'push' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          git config user.name "${{ steps.setup-bot.outputs.committer }}"
-          git config user.email "${{ steps.setup-bot.outputs.committer-email || 'bot@github.com' }}"
-          git add app/core/src/main/resources/static/3rdPartyLicenses.json
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the backend license report based on dependency changes."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          Incompatible licenses detected – manual review required before merge."
-          fi
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        id: cpr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Backend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-backend-3rd-party-licenses
-          base: main
-          title: "Update Backend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,backend
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (push only, no warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (push only, with warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/frontend-validation.yml

@@ -1,152 +0,0 @@
-name: Frontend lint, type-check, and build
-
-# Reusable workflow called from build.yml when frontend / testing sources
-# change. Runs the consolidated `task frontend:check:all` (lint, types,
-# unit tests, build) and uploads the dist artifact for downstream jobs.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  frontend-validation:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Quality-check frontend
-        id: frontend-check
-        run: task frontend:check:all
-        continue-on-error: true
-      - name: Comment on frontend check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.frontend-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const body = [
-              marker,
-              '### Frontend Check Failed',
-              '',
-              'There are issues with your frontend code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-      - name: Fail if frontend check failed
-        if: steps.frontend-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Frontend Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your frontend code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task frontend:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task frontend:check:all'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
-      - name: Remove frontend check comment on success
-        if: steps.frontend-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-      - name: Vitest coverage
-        # Separate from `frontend:check:all` so the quality-gate run stays
-        # uninstrumented (faster signal) and coverage stays an informational
-        # follow-up. Continue-on-error keeps the workflow green even when
-        # a handful of test files refuse to import (e.g. missing icon
-        # specifiers) - the summary still gets posted with whatever
-        # vitest managed to instrument.
-        id: frontend-coverage
-        continue-on-error: true
-        run: task frontend:test:coverage
-      - name: Set up Python for coverage summary
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # See coverage-summary.py header - it parses XML through defusedxml
-        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
-        if: always()
-        run: python -m pip install --quiet defusedxml
-      - name: Vitest coverage step summary
-        if: always()
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Frontend Vitest coverage" \
-            --vitest frontend/editor/coverage/coverage-summary.json \
-            --github-step-summary
-      - name: Upload vitest coverage report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-coverage
-          path: frontend/editor/coverage/
-          retention-days: 7
-          if-no-files-found: warn
-      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-build
-          path: frontend/editor/dist/
-          retention-days: 3

.github/workflows/licenses-update.yml

@@ -0,0 +1,90 @@
+name: License Report Workflow
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+
+permissions:
+  contents: read
+
+jobs:
+  generate-license-report:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "17"
+          distribution: "adopt"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
+
+      - name: Check licenses for compatibility
+        run: ./gradlew clean checkLicense
+
+      - name: Upload artifact on failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3
+
+      - name: Move and rename license file
+        run: |
+          mv build/reports/dependency-license/index.json stirling-pdf/src/main/resources/static/3rdPartyLicenses.json
+
+      - name: Commit changes
+        run: |
+          git add stirling-pdf/src/main/resources/static/3rdPartyLicenses.json
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        id: cpr
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-3rd-party-licenses
+          title: "Update 3rd Party Licenses"
+          body: |
+            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+          labels: Licenses,github-actions
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge
+        if: steps.cpr.outputs.pull-request-operation == 'created'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/manage-label.yml

@@ -15,15 +15,15 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
+        uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           yaml-file: .github/labels.yml

.github/workflows/nightly.yml

@@ -1,71 +0,0 @@
-name: Nightly E2E Tests
-
-on:
-  schedule:
-    - cron: "0 2 * * *" # 2 AM UTC every night
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  playwright-all-browsers:
-    name: Playwright (chromium + firefox + webkit)
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install all Playwright browsers
-        run: task e2e:install
-
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-
-      - name: Run E2E tests (all browsers)
-        run: task e2e:cross-browser
-
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-nightly-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 14
-
-  # Builds all desktop platforms on a schedule so the Rust dependency cache is
-  # written on main, where PR and merge-queue tauri builds can restore it.
-  warm-tauri-cache:
-    name: Warm Tauri Rust cache
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/tauri-build.yml
-    with:
-      platform: all
-      sign: false
-    secrets: inherit

.github/workflows/package-managers.yml

@@ -1,155 +0,0 @@
-name: Update Package Manager Manifests
-
-on:
-  release:
-    types: [released]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to test (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the git push at the end (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      dmg_sha256: ${{ steps.hashes.outputs.dmg_sha256 }}
-      msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DMG_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-universal.dmg")
-          MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "dmg_sha256=$DMG_SHA" >> "$GITHUB_OUTPUT"
-          echo "msi_sha256=$MSI_SHA" >> "$GITHUB_OUTPUT"
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
-
-  update-homebrew-and-scoop:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: Stirling-Tools/homebrew-stirling-pdf
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          path: tap
-
-      # Stirling-PDF now ships a single universal DMG, so the Cask should
-      # have one sha256 line rather than separate on_arm/on_intel blocks.
-      # We rewrite every `sha256 "..."` in the Cask to the same value so
-      # the workflow keeps working through the Cask migration: pre-migration
-      # both arch blocks get the universal SHA (still correct, since both
-      # would resolve to the same DMG), post-migration the lone sha256 line
-      # is updated.
-      - name: Update Homebrew cask (Casks/stirling-pdf.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          DMG_SHA: ${{ needs.get-release-info.outputs.dmg_sha256 }}
-        run: |
-          CASK="tap/Casks/stirling-pdf.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$CASK"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${DMG_SHA}\"/g" "$CASK"
-
-      - name: Update Homebrew formula (Formula/stirling-pdf-server.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          FORMULA="tap/Formula/stirling-pdf-server.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$FORMULA"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
-
-      - name: Update Scoop stirling-pdf.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          MSI_SHA: ${{ needs.get-release-info.outputs.msi_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf.json"
-          jq --arg v "$VERSION" --arg h "$MSI_SHA" \
-            '.version = $v | .architecture["64bit"].url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-windows-x86_64.msi" | .architecture["64bit"].hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Update Scoop stirling-pdf-server.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf-server.json"
-          jq --arg v "$VERSION" --arg h "$JAR_SHA" \
-            '.version = $v | .url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-with-login.jar" | .hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Show tap diff (for dry-run visibility)
-        working-directory: tap
-        run: |
-          echo "--- diff --stat ---"
-          git diff --stat
-          echo "--- full diff ---"
-          git diff
-
-      - name: Commit and push all tap updates
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        working-directory: tap
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Casks/stirling-pdf.rb Formula/stirling-pdf-server.rb scoop/stirling-pdf.json scoop/stirling-pdf-server.json
-          git diff --cached --quiet && echo "No changes" && exit 0
-          git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
-          git push

.github/workflows/pre_commit.yml

@@ -1,10 +1,9 @@
 name: Pre-commit
 
-# Runs the repo-wide lint/format/secret checks via `task pre-commit`.
-# Called from build.yml on PRs and merge_group; also runnable on demand via workflow_dispatch.
 on:
-  workflow_call:
   workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * 1"
 
 permissions:
   contents: read
@@ -12,25 +11,61 @@ permissions:
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
-          persist-credentials: false
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
         with:
-          enable-cache: true
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: 3.12
+          cache: 'pip' # caching pip dependencies
 
-      - name: Run pre-commit checks
-        run: task pre-commit
+      - name: Run Pre-Commit Hooks
+        run: |
+          pip install --require-hashes -r ./.github/scripts/requirements_pre_commit.txt
+
+      - run: pre-commit run --all-files -c .pre-commit-config.yaml
+        continue-on-error: true
+
+      - name: git add
+        run: |
+          git add .
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: ":file_folder: pre-commit"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: pre-commit
+          title: "🤖 format everything with pre-commit by ${{ steps.setup-bot.outputs.app-slug }}"
+          body: |
+            Auto-generated by [create-pull-request][1] with **${{ steps.setup-bot.outputs.app-slug }}**
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true

.github/workflows/push-docker-base.yml

@@ -1,122 +0,0 @@
-name: Push Docker Base Image
-
-on:
-  push:
-    branches:
-      - baseDockerImage
-      - accessIssueFix
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Base image version (e.g., 1.0.0, 1.0.1)'
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  push-base:
-    if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Verify authorized user
-        run: |
-          if [ "${{ github.actor }}" != "Frooodle" ]; then
-            echo "Error: Only Frooodle is authorized to run this workflow"
-            exit 1
-          fi
-
-      - name: Set version
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${{ github.event.inputs.version }}"
-          elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
-            VERSION="1.0.3"
-          else
-            VERSION="1.0.0"
-          fi
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for base image
-        id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-base
-          tags: |
-            type=raw,value=${{ steps.version.outputs.version }}
-
-      - name: Build and push base image
-        id: build-push-base
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: docker/base
-          file: ./docker/base/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-base
-          cache-to: type=gha,mode=max,scope=stirling-pdf-base
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Sign base images
-        env:
-          DIGEST: ${{ steps.build-push-base.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --yes \
-                --key env://COSIGN_PRIVATE_KEY \
-                "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping image signing"
-          fi

.github/workflows/push-docker.yml

@@ -2,134 +2,82 @@ name: Push Docker Image with VersionNumber
 
 on:
   workflow_dispatch:
-    inputs:
-      build_main_app:
-        description: "Build & push the main Stirling-PDF image (latest, fat, ultra-lite)."
-        required: false
-        type: boolean
-        default: true
-      build_unoserver:
-        description: "Build & push the standalone stirling-unoserver image."
-        required: false
-        type: boolean
-        default: true
-      force_unoserver_rebuild:
-        description: "Rebuild stirling-unoserver even if its source hash is unchanged."
-        required: false
-        type: boolean
-        default: false
   push:
     branches:
       - master
       - main
-      - V2-master
-      - testMain
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
+    runs-on: ubuntu-latest
     permissions:
       packages: write
       id-token: write
-    # On push events these stay 'true'; on workflow_dispatch they follow the inputs.
-    env:
-      RUN_MAIN_APP: ${{ github.event_name != 'workflow_dispatch' || inputs.build_main_app }}
-      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "25"
+          java-version: "17"
           distribution: "temurin"
 
-      - name: Cache Gradle dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
         with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
+          gradle-version: 8.14
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+      - name: Run Gradle Command
+        run: ./gradlew clean build
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/master'
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
         with:
-          gradle-version: 9.6.0
+          cosign-release: "v2.4.1"
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        with:
-          cosign-release: "v2.4.1"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Convert repository owner to lowercase
         id: repoowner
         run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
 
-      - name: Generate tags for latest
+      - name: Generate tags
         id: meta
-        if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        if: github.ref != 'refs/heads/main'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -137,35 +85,31 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testMain' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
 
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        # Empty-tag guard: build-push-action errors when asked to push with no tags.
-        if: env.RUN_MAIN_APP == 'true' && steps.meta.outputs.tags != ''
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      - name: Build and push main Dockerfile
+        id: build-push-regular
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          # No BASE_VERSION pin: inherit the Dockerfile ARG default (single source of truth).
-          build-args: |
-            VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true
 
       - name: Sign regular images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
+        if: github.ref == 'refs/heads/master'
         env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          DIGEST: ${{ steps.build-push-regular.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
           COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -176,10 +120,10 @@ jobs:
               "${tag}@${DIGEST}"
           done
 
-      - name: Generate tags for latest-fat
-        id: meta-fat
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+      - name: Generate tags ultra-lite
+        id: meta2
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        if: github.ref != 'refs/heads/main'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -187,212 +131,65 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
 
-      - name: Build and push Unified Dockerfile (fat variant)
+      - name: Build and push Dockerfile-ultra-lite
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
+        with:
+          context: .
+          file: ./Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta2.outputs.tags }}
+          labels: ${{ steps.meta2.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Generate tags fat
+        id: meta3
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push main Dockerfile fat
         id: build-push-fat
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-fat.outputs.tags != ''
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.fat
+          file: ./Dockerfile.fat
           push: true
-          cache-from: type=gha,scope=stirling-pdf-fat
-          cache-to: type=gha,mode=max,scope=stirling-pdf-fat
-          tags: ${{ steps.meta-fat.outputs.tags }}
-          labels: ${{ steps.meta-fat.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta3.outputs.tags }}
+          labels: ${{ steps.meta3.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true
 
       - name: Sign fat images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
+        if: github.ref == 'refs/heads/master'
         env:
           DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          TAGS: ${{ steps.meta3.outputs.tags }}
           COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
         run: |
           echo "$TAGS" | tr ',' '\n' | while read -r tag; do
             cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
           done
-
-      - name: Generate tags for ultra-lite
-        id: meta-lite
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-lite.outputs.tags != ''
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-ultra-lite
-          cache-to: type=gha,mode=max,scope=stirling-pdf-ultra-lite
-          tags: ${{ steps.meta-lite.outputs.tags }}
-          labels: ${{ steps.meta-lite.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      # Standalone unoserver image — versioned independently via
-      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
-      # only when the version is new. main/testMain: republish :alpha only
-      # when the source hash differs from the published image's annotation.
-      - name: Read unoserver image version
-        id: unoserverVersion
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          version=$(tr -d '[:space:]' < docker/unoserver/VERSION)
-          if [ -z "$version" ]; then
-            echo "docker/unoserver/VERSION is empty"; exit 1
-          fi
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver image version (from file): ${version}"
-
-      - name: Compute unoserver image source hash
-        id: unoserverHash
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          set -eu
-          hash=$(cat \
-            docker/unoserver/Dockerfile \
-            docker/unoserver/entrypoint.sh \
-            docker/unoserver/healthcheck.sh \
-            docker/unoserver/VERSION \
-            | sha256sum | cut -d' ' -f1)
-          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver source hash: ${hash}"
-
-      - name: Decide whether to publish unoserver image
-        id: unoserverDecision
-        if: env.RUN_UNOSERVER == 'true'
-        env:
-          UNOSERVER_VERSION: ${{ steps.unoserverVersion.outputs.version }}
-          UNOSERVER_HASH: ${{ steps.unoserverHash.outputs.hash }}
-          UNOSERVER_IMAGE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-unoserver
-          UNOSERVER_HASH_ANNOTATION: org.stirlingpdf.unoserver-source-hash
-          FORCE_REBUILD: ${{ inputs.force_unoserver_rebuild }}
-          GH_REF: ${{ github.ref }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -eu
-          mode="skip"
-          tags=""
-
-          read_published_hash() {
-            local ref="$1"
-            docker buildx imagetools inspect "$ref" --raw 2>/dev/null \
-              | jq -r --arg key "$UNOSERVER_HASH_ANNOTATION" \
-                  '.annotations[$key] // empty' \
-              2>/dev/null || true
-          }
-
-          # Manual dispatch from any branch routes to the :alpha publish path.
-          EFFECTIVE_REF="$GH_REF"
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            EFFECTIVE_REF="refs/heads/testMain"
-          fi
-
-          case "$EFFECTIVE_REF" in
-            refs/heads/master|refs/heads/V2-master)
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — building stable regardless"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              elif docker manifest inspect "${UNOSERVER_IMAGE}:${UNOSERVER_VERSION}" >/dev/null 2>&1; then
-                echo "stirling-unoserver:${UNOSERVER_VERSION} already on GHCR — skipping"
-              else
-                echo "stirling-unoserver:${UNOSERVER_VERSION} is new — will publish"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              fi
-              ;;
-            refs/heads/main|refs/heads/testMain)
-              published_hash=$(read_published_hash "${UNOSERVER_IMAGE}:alpha")
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — rebuilding :alpha regardless"
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              elif [ -n "$published_hash" ] && [ "$published_hash" = "$UNOSERVER_HASH" ]; then
-                echo "Published :alpha source hash matches (${published_hash}) — skipping"
-              else
-                if [ -z "$published_hash" ]; then
-                  echo ":alpha has no source-hash annotation (first publish or pre-tracking image) — will publish"
-                else
-                  echo "Source hash changed (was ${published_hash}, now ${UNOSERVER_HASH}) — will publish"
-                fi
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              fi
-              ;;
-            *)
-              echo "Branch ${GH_REF} does not publish unoserver image"
-              ;;
-          esac
-          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
-          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push unoserver image
-        id: build-push-unoserver
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode != 'skip'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          tags: ${{ steps.unoserverDecision.outputs.tags }}
-          # Manifest annotation read by the decision step above to detect drift.
-          annotations: |
-            index:org.stirlingpdf.unoserver-source-hash=${{ steps.unoserverHash.outputs.hash }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign unoserver image
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode == 'stable'
-        env:
-          DIGEST: ${{ steps.build-push-unoserver.outputs.digest }}
-          TAGS: ${{ steps.unoserverDecision.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping unoserver image signing"
-          fi

.github/workflows/releaseArtifacts.yml

@@ -0,0 +1,180 @@
+name: Release Artifacts
+
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
+    outputs:
+      version: ${{ steps.versionNumber.outputs.versionNumber }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
+        with:
+          gradle-version: 8.14
+
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
+        env:
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Get version number
+        id: versionNumber
+        run: |
+          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
+          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Rename binaries
+        run: |
+          mv ./build/launch4j/Stirling-PDF.exe ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+          mv ./build/libs/Stirling-PDF-${{ steps.versionNumber.outputs.versionNumber }}.jar ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+      - name: Debug build artifacts
+        run: |
+          echo "Current Directory: $(pwd)"
+          ls -R ./build/libs
+          ls -R ./build/launch4j
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: binaries${{ matrix.file_suffix }}
+          path: |
+            ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+            ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.*
+
+  sign_verify:
+    needs: build
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: binaries${{ matrix.file_suffix }}
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
+
+      - name: Generate key pair
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        run: |
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.intoto.jsonl \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.intoto.jsonl \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: signed${{ matrix.file_suffix }}
+          path: |
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.*
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+
+  release:
+    needs: [build, sign_verify]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - name: Download signed artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: signed${{ matrix.file_suffix }}
+
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        with:
+          tag_name: v${{ needs.build.outputs.version }}
+          generate_release_notes: true
+          files: |
+            ./libs/Stirling-PDF*
+            ./launch4j/Stirling-PDF-Server*

.github/workflows/rollback-latest.yml

@@ -1,93 +0,0 @@
-name: Rollback Latest Tags to Version
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to rollback to (e.g. 2.8.0)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  rollback:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Install crane
-        uses: imjasonh/setup-crane@31b88afe9de28ae0ffa220711af4b60be9435f6e # v0.4
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Rollback all latest tags to v${{ inputs.version }}
-        env:
-          VERSION: ${{ inputs.version }}
-          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
-          DOCKER_HUB_ORG_USERNAME: ${{ secrets.DOCKER_HUB_ORG_USERNAME }}
-          REPO_OWNER: ${{ steps.repoowner.outputs.lowercase }}
-        run: |
-          set -euo pipefail
-
-          IMAGES=(
-            "${DOCKER_HUB_USERNAME}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/stirling-pdf"
-            "${DOCKER_HUB_ORG_USERNAME}/stirling-pdf"
-          )
-
-          VARIANTS=(
-            "${VERSION}:latest"
-            "${VERSION}-fat:latest-fat"
-            "${VERSION}-ultra-lite:latest-ultra-lite"
-          )
-
-          FAILED=0
-
-          for image in "${IMAGES[@]}"; do
-            for variant in "${VARIANTS[@]}"; do
-              SOURCE_TAG="${variant%%:*}"
-              TARGET_TAG="${variant##*:}"
-
-              echo "::group::${image} — ${SOURCE_TAG} → ${TARGET_TAG}"
-
-              if crane manifest "${image}:${SOURCE_TAG}" > /dev/null 2>&1; then
-                crane cp "${image}:${SOURCE_TAG}" "${image}:${TARGET_TAG}"
-                echo "✅ ${image}:${TARGET_TAG} now points to ${SOURCE_TAG}"
-              else
-                echo "::warning::⚠️ ${image}:${SOURCE_TAG} not found, skipping"
-                FAILED=1
-              fi
-
-              echo "::endgroup::"
-            done
-          done
-
-          if [ "$FAILED" -ne 0 ]; then
-            echo "::warning::Some source tags were not found. This is expected if not all variants exist for this version."
-          fi
-
-          echo ""
-          echo "🎉 Rollback to ${VERSION} complete!"

.github/workflows/scorecards.yml

@@ -17,7 +17,6 @@ permissions: read-all
 
 jobs:
   analysis:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
@@ -35,17 +34,17 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -67,7 +66,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
@@ -75,6 +74,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.29.5
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: results.sarif

.github/workflows/sonarqube.yml

@@ -0,0 +1,63 @@
+name: Run Sonarqube
+
+on:
+  push:
+    branches:
+      - master
+  pull_request_target:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  pull-requests: read
+  actions: read
+
+jobs:
+  sonarqube:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
+
+      - name: Build and analyze with Gradle
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          DISABLE_ADDITIONAL_FEATURES: false
+          STIRLING_PDF_DESKTOP_UI: true
+        run: |
+          ./gradlew clean build sonar \
+            -Dsonar.projectKey=Stirling-Tools_Stirling-PDF \
+            -Dsonar.organization=stirling-tools \
+            -Dsonar.host.url=https://sonarcloud.io \
+            -Dsonar.login=${SONAR_TOKEN} \
+            -Dsonar.log.level=DEBUG \
+            --info
+
+      - name: Upload Problems Report on Failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: gradle-problems-report
+          path: build/reports/problems/problems-report.html
+          retention-days: 7
+
+      - name: Upload Sonar Logs on Failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: sonar-logs
+          path: |
+            .scannerwork/report-task.txt
+            build/sonar/
+          retention-days: 7

.github/workflows/stale.yml

@@ -10,19 +10,18 @@ permissions:
 
 jobs:
   stale:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: 30 days stale issues
-        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/swagger.yml

@@ -6,71 +6,40 @@ on:
     branches:
       - master
 
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "25"
+          java-version: "17"
           distribution: "temurin"
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
+      - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
 
       - name: Generate Swagger documentation
-        run: ./gradlew :stirling-pdf:generateOpenApiDocs
+        run: ./gradlew generateOpenApiDocs
 
       - name: Upload Swagger Documentation to SwaggerHub
         run: ./gradlew swaggerhubUpload
         env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }}
           SWAGGERHUB_USER: "Frooodle"
 
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
       - name: Set API version as published and default on SwaggerHub
         run: |

.github/workflows/sync_files.yml

@@ -0,0 +1,104 @@
+name: Sync Files
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+      - "README.md"
+      - "stirling-pdf/src/main/resources/messages_*.properties"
+      - "stirling-pdf/src/main/resources/static/3rdPartyLicenses.json"
+      - "scripts/ignore_translation.toml"
+
+permissions:
+  contents: read
+
+jobs:
+  sync-files:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+
+      - name: Sync translation property files
+        run: |
+          python .github/scripts/check_language_properties.py --reference-file "stirling-pdf/src/main/resources/messages_en_GB.properties" --branch main
+
+      - name: Commit translation files
+        run: |
+          git add stirling-pdf/src/main/resources/messages_*.properties
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+
+      - name: Install dependencies
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
+
+      - name: Sync README.md
+        run: |
+          python scripts/counter_translation.py
+
+      - name: Run git add
+        run: |
+          git add README.md scripts/ignore_translation.toml
+          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
+
+      - name: Create Pull Request
+        if: always()
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: Update files
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: sync_readme
+          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          body: |
+            ### Description of Changes
+
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+
+            #### **1. Synchronization of Translation Files**
+            - Updated translation files (`messages_*.properties`) to reflect changes in the reference file `messages_en_GB.properties`.
+            - Ensured consistency and synchronization across all supported language files.
+            - Highlighted any missing or incomplete translations.
+
+            #### **2. Update README.md**
+            - Generated the translation progress table in `README.md`.
+            - Added a summary of the current translation status for all supported languages.
+            - Included up-to-date statistics on translation coverage.
+
+            #### **Why these changes are necessary**
+            - Keeps translation files aligned with the latest reference updates.
+            - Ensures the documentation reflects the current translation progress.
+
+            ---
+
+            Auto-generated by [create-pull-request][1].
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true
+          add-paths: |
+            README.md
+              stirling-pdf/src/main/resources/messages_*.properties

.github/workflows/sync_files_v2.yml

@@ -1,137 +0,0 @@
-name: Sync Files (TOML)
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - "build.gradle"
-      - "app/common/build.gradle"
-      - "app/core/build.gradle"
-      - "app/proprietary/build.gradle"
-      - "README.md"
-      - "frontend/editor/public/locales/*/translation.toml"
-      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
-      - "scripts/ignore_translation.toml"
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  sync-files:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
-
-      - name: Install Python dependencies
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-
-      - name: Sync translation TOML files
-        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
-
-      - name: Sort translation TOML files
-        run: |
-          task pre-commit:toml-sort FIX=1
-
-      - name: Commit translation files
-        run: |
-          git add frontend/editor/public/locales/*/translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
-
-      - name: Sync README.md
-        run: |
-          python scripts/counter_translation_v3.py
-
-      - name: Run git add
-        run: |
-          git add README.md scripts/ignore_translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
-
-      - name: Create Pull Request
-        if: always()
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: Update files
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: sync_readme_v3
-          base: main
-          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
-          body: |
-            ### Description of Changes
-
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
-
-            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
-            - Ensured consistency and synchronization across all supported language files.
-            - Highlighted any missing or incomplete translations.
-            - **Format**: TOML
-
-            #### **2. Update README.md**
-            - Generated the translation progress table in `README.md` using `counter_translation_v3.py`.
-            - Added a summary of the current translation status for all supported languages.
-            - Included up-to-date statistics on translation coverage.
-
-            #### **Why these changes are necessary**
-            - Keeps translation files aligned with the latest reference updates.
-            - Ensures the documentation reflects the current translation progress.
-
-            ---
-
-            Auto-generated by [create-pull-request][1].
-
-            [1]: https://github.com/peter-evans/create-pull-request
-          draft: false
-          delete-branch: true
-          labels: github-actions
-          sign-commits: true
-          add-paths: |
-            README.md
-            frontend/editor/public/locales/*/translation.toml
-            scripts/ignore_translation.toml

.github/workflows/tauri-build.yml

@@ -1,715 +0,0 @@
-name: Build Tauri Applications
-
-# Multi-OS Tauri desktop bundle build matrix (Windows / macOS universal /
-# Linux). Called from build.yml on PRs that touch desktop sources (gated
-# via the `tauri` filter in .github/config/.files.yaml). Also runnable
-# on demand via workflow_dispatch with a per-platform selector.
-#
-# Note: editing this file is itself enough to make the `tauri` path filter
-# match, which is how non-desktop PRs (e.g. backend-only fixes) opt into a
-# desktop smoke build.
-on:
-  workflow_call:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)."
-        required: false
-        type: string
-        default: "all"
-      sign:
-        description: "Sign and notarize the bundles."
-        required: false
-        type: boolean
-        default: true
-  workflow_dispatch:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-      sign:
-        description: "Sign and notarize the bundles."
-        required: false
-        default: true
-        type: boolean
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Determine build matrix
-        id: set-matrix
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          PLATFORM: ${{ inputs.platform }}
-        run: |
-          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}'
-          MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}'
-          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}'
-
-          case "$PLATFORM" in
-            windows) ENTRIES=("$WINDOWS") ;;
-            macos)   ENTRIES=("$MACOS") ;;
-            linux)   ENTRIES=("$LINUX") ;;
-            *)       ENTRIES=("$WINDOWS" "$MACOS" "$LINUX") ;;
-          esac
-
-          # Drop macOS entries when Apple certificate secret is unavailable
-          if [ -z "$APPLE_CERTIFICATE" ]; then
-            echo "⚠️ APPLE_CERTIFICATE secret not available - skipping macOS builds"
-            FILTERED=()
-            for entry in "${ENTRIES[@]}"; do
-              [[ "$entry" != *'"macos'* ]] && FILTERED+=("$entry")
-            done
-            ENTRIES=("${FILTERED[@]}")
-          fi
-
-          JOINED=$(IFS=','; echo "${ENTRIES[*]}")
-          echo "matrix={\"include\":[$JOINED]}" >> $GITHUB_OUTPUT
-
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
-        with:
-          toolchain: stable
-          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      # Cache the Cargo registry and compiled dependency crates so the build
-      # only recompiles the app crate. Written on main; PRs and the merge queue
-      # restore from it.
-      - name: Cache Rust build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: frontend/editor/src-tauri
-          # Stable key shared across workflows so the nightly warmer.
-          # rust-cache still appends OS + rustc + Cargo.lock.
-          shared-key: tauri-${{ matrix.name }}
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-          # Save the dependency cache even if a later step fails
-          cache-on-failure: true
-
-      - name: Set up x86_64 JDK 25 (macOS universal JRE)
-        if: matrix.platform == 'macos-15'
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-          architecture: "x64"
-
-      - name: Capture x86_64 JAVA_HOME
-        if: matrix.platform == 'macos-15'
-        run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-
-      - name: Setup Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Build universal macOS JRE
-        if: matrix.platform == 'macos-15'
-        env:
-          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:jlink:universal-mac
-
-      - name: Prepare desktop build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:prepare
-
-      - name: Run Tauri/Cargo tests
-        run: task desktop:test
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: inputs.sign && matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: inputs.sign && matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Check DMG creation dependencies (macOS only)
-        if: matrix.platform == 'macos-15'
-        run: |
-          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
-          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
-          echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
-          echo "Available disk space: $(df -h /tmp | tail -1)"
-          echo "macOS version: $(sw_vers -productVersion)"
-          echo "Available tools:"
-          ls -la /usr/bin/hd* || echo "No hd* tools found"
-
-      - name: Preflight smctl
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          & smctl healthcheck
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl healthcheck failed"; exit 1 }
-          & smctl keypair ls
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl keypair ls failed"; exit 1 }
-          & smctl windows certsync --keypair-alias "$env:KEYPAIR_ALIAS"
-          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
-
-      - name: Configure Windows code signing
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: bash
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
-          {
-            "bundle": {
-              "windows": {
-                "signCommand": {
-                  "cmd": "smctl",
-                  "args": ["sign", "--keypair-alias", "${KEYPAIR_ALIAS}", "--input", "%1", "--verbose"]
-                }
-              }
-            }
-          }
-          EOF
-
-      - name: Import release GPG signing key (Linux)
-        if: inputs.sign && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
-        run: |
-          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
-          gpg --list-secret-keys --keyid-format=long
-
-      - name: Make libjvm discoverable for linuxdeploy (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
-          if [ -f "$JAVA_LIBJVM" ]; then
-            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
-            echo "Linked libjvm from $JAVA_LIBJVM -> /usr/lib/libjvm.so"
-          else
-            echo "libjvm not found at $JAVA_LIBJVM"
-            exit 1
-          fi
-
-      - name: Build Tauri app (signed)
-        if: inputs.sign
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          # AppImage signing — three env vars work together:
-          #   SIGN=1                        tells linuxdeploy-plugin-appimage to forward --sign to appimagetool
-          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
-          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
-          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign when secret is present AND ref is main (skips PRs from forks/Dependabot).
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
-          CI: true
-        with:
-          projectPath: ./frontend/editor
-          tauriScript: npx tauri
-          # Linux: build deb+rpm only here. AppImage runs in its own
-          # continue-on-error step below so its persistent linuxdeploy
-          # failure (#6127 onwards) does not tank deb/rpm uploads.
-          args: ${{ matrix.platform == 'ubuntu-22.04' && '--bundles deb,rpm' || matrix.args }}
-
-      - name: Build Tauri app (unsigned)
-        if: ${{ !inputs.sign }}
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SIGN: "0"
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          CI: true
-        with:
-          projectPath: ./frontend/editor
-          tauriScript: npx tauri
-          # Linux: build deb+rpm only here. AppImage runs in its own
-          # continue-on-error step below so its persistent linuxdeploy
-          # failure (#6127 onwards) does not tank deb/rpm uploads.
-          args: ${{ matrix.platform == 'ubuntu-22.04' && '--bundles deb,rpm' || matrix.args }}
-
-      # AppImage is decoupled so its linuxdeploy run gets a fresh process
-      # (rpm scratch state torn down) and its failure can't tank deb/rpm.
-      - name: Build Tauri app (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        continue-on-error: true
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SIGN: ${{ (inputs.sign && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }} # gitleaks:allow
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          CI: true
-        with:
-          projectPath: ./frontend/editor
-          tauriScript: npx tauri
-          args: --bundles appimage
-
-      - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && inputs.sign && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
-        env:
-          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-        run: |
-          if [ -n "$RELEASE_GPG_FINGERPRINT" ]; then
-            gpg --batch --yes --delete-secret-keys "$RELEASE_GPG_FINGERPRINT" || true
-            gpg --batch --yes --delete-keys "$RELEASE_GPG_FINGERPRINT" || true
-          fi
-
-      - name: Verify notarization (macOS only)
-        if: inputs.sign && matrix.platform == 'macos-15'
-        run: |
-          echo "🔍 Verifying notarization status..."
-          cd ./frontend/editor/src-tauri/target
-          DMG_FILE=$(find . -name "*.dmg" | head -1)
-          if [ -n "$DMG_FILE" ]; then
-            echo "Found DMG: $DMG_FILE"
-            echo "Checking notarization ticket..."
-            spctl -a -vvv -t install "$DMG_FILE" || echo "⚠️ Notarization check failed or not yet complete"
-            stapler validate "$DMG_FILE" || echo "⚠️ No notarization ticket attached"
-          else
-            echo "⚠️ No DMG file found to verify"
-          fi
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
-          cd ./frontend/editor/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            # Only ship the MSI installer. The loose exe and WiX toolset exes
-            # are not the user-facing installer - the MSI contains the signed inner exe.
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
-          else
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
-
-      # Verify the MSI AND the inner exe extracted from it are signed.
-      # The inner exe is what gets installed on users' machines and what AV scans.
-      - name: Verify Windows Code Signature
-        if: inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
-        shell: pwsh
-        run: |
-          $allSigned = $true
-          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
-
-          # Check MSI (outer wrapper)
-          if (Test-Path $msiPath) {
-            $sig = Get-AuthenticodeSignature -FilePath $msiPath
-            Write-Host "MSI: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-            if ($sig.Status -ne "Valid") {
-              Write-Host "[ERROR] MSI is not signed"
-              $allSigned = $false
-            }
-
-            # Extract MSI and verify inner exe
-            $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
-            if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
-            $proc = Start-Process msiexec.exe -ArgumentList '/a', $msiPath, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
-            if ($proc.ExitCode -eq 0) {
-              $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
-              if ($innerExe) {
-                $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
-                Write-Host "Inner EXE: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-                if ($sig.Status -ne "Valid") {
-                  Write-Host "[ERROR] Inner exe is NOT signed - AV will flag this at runtime"
-                  $allSigned = $false
-                }
-              } else {
-                Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
-                $allSigned = $false
-              }
-            } else {
-              Write-Host "[ERROR] MSI extraction failed (exit code: $($proc.ExitCode))"
-              $allSigned = $false
-            }
-          } else {
-            Write-Host "[ERROR] MSI not found at $msiPath"
-            $allSigned = $false
-          }
-
-          if (-not $allSigned) {
-            Write-Host "[ERROR] Signature verification failed"
-            exit 1
-          }
-          Write-Host "[SUCCESS] MSI and inner exe are properly signed"
-
-      - name: Dump smctl logs on failure
-        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
-        shell: pwsh
-        run: |
-          $logDir = "$env:USERPROFILE\.signingmanager\logs"
-          if (Test-Path $logDir) {
-            Get-ChildItem $logDir | ForEach-Object {
-              Write-Host "=== $($_.FullName) ==="
-              Get-Content $_.FullName -Tail 200
-              Write-Host ""
-            }
-          } else {
-            Write-Host "smctl log directory not found at $logDir"
-          }
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
-          retention-days: 7
-
-      - name: Verify build artifacts
-        shell: bash
-        run: |
-          cd ./frontend/editor/src-tauri/target
-
-          # Check for expected artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            echo "Checking for Windows artifacts..."
-            find . -name "*.exe" -o -name "*.msi" | head -5
-            if [ $(find . -name "*.exe" | wc -l) -eq 0 ]; then
-              echo "❌ No Windows executable found"
-              exit 1
-            fi
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            echo "Checking for macOS artifacts..."
-            find . -name "*.dmg" | head -5
-            if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
-              echo "❌ No macOS artifacts found"
-              exit 1
-            fi
-          else
-            echo "Checking for Linux artifacts..."
-            find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | head -5
-            if [ $(find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
-              echo "❌ No Linux artifacts found"
-              exit 1
-            fi
-          fi
-
-          echo "✅ Build artifacts found for ${{ matrix.name }}"
-
-      - name: Test artifact sizes
-        shell: bash
-        run: |
-          cd ./frontend/editor/src-tauri/target
-          echo "Artifact sizes for ${{ matrix.name }}:"
-          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
-            if [ -f "$file" ]; then
-              size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
-              echo "$file: $size bytes"
-              # Check if file is suspiciously small (less than 1MB)
-              if [ "$size" != "unknown" ] && [ "$size" -lt 1048576 ]; then
-                echo "⚠️  Warning: $file is smaller than 1MB"
-              fi
-            fi
-          done
-
-  pr-comment:
-    needs: build
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && needs.build.result == 'success'
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Post/Update PR Comment with Download Links
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const prNumber = context.issue.number;
-            const runId = context.runId;
-
-            // Fetch artifacts for this workflow run
-            const { data: artifactsList } = await github.rest.actions.listWorkflowRunArtifacts({
-              owner,
-              repo,
-              run_id: runId
-            });
-
-            // Map of expected artifact names to display info
-            const artifactMap = {
-              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
-              'Stirling-PDF-macos-universal': { icon: '🍎', platform: 'macOS Universal', files: '.dmg' },
-              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
-            };
-
-            let commentBody = `## 📦 Tauri Desktop Builds Ready!\n\n`;
-            commentBody += `The desktop applications have been built and are ready for testing.\n\n`;
-            commentBody += `### Download Artifacts:\n\n`;
-
-            // Add links for each found artifact
-            let foundArtifacts = 0;
-            for (const artifact of artifactsList.artifacts) {
-              const info = artifactMap[artifact.name];
-              if (info) {
-                foundArtifacts++;
-                // GitHub doesn't provide direct download URLs via API, but we can link to the artifact on the Actions page
-                const artifactUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}/artifacts/${artifact.id}`;
-                commentBody += `${info.icon} **${info.platform}**: [Download ${artifact.name}](${artifactUrl}) `;
-                commentBody += `(${info.files}) - ${(artifact.size_in_bytes / 1024 / 1024).toFixed(1)} MB\n`;
-              }
-            }
-
-            if (foundArtifacts === 0) {
-              commentBody += `⚠️ **Warning**: No artifacts found in workflow run.\n`;
-              commentBody += `[View workflow run](https://github.com/${owner}/${repo}/actions/runs/${runId})\n`;
-            }
-
-            commentBody += `\n---\n`;
-            commentBody += `_Built from commit ${context.sha.substring(0, 7)}_\n`;
-            commentBody += `_Artifacts expire in 7 days_`;
-
-            // Find existing comment
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber
-            });
-
-            const botComment = comments.find(comment =>
-              comment.user.type === 'Bot' &&
-              comment.body.includes('📦 Tauri Desktop Builds Ready!')
-            );
-
-            if (botComment) {
-              // Update existing comment
-              await github.rest.issues.updateComment({
-                owner,
-                repo,
-                comment_id: botComment.id,
-                body: commentBody
-              });
-              console.log('Updated existing comment');
-            } else {
-              // Create new comment
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number: prNumber,
-                body: commentBody
-              });
-              console.log('Created new comment');
-            }
-
-  report:
-    needs: build
-    runs-on: ubuntu-latest
-    if: always()
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Report build results
-        run: |
-          if [ "${{ needs.build.result }}" = "success" ]; then
-            echo "✅ All Tauri builds completed successfully!"
-            echo "Artifacts are ready for distribution."
-          elif [ "${{ needs.build.result }}" = "skipped" ]; then
-            echo "⏭️  Tauri builds skipped (CI lite mode enabled)"
-          else
-            echo "❌ Some Tauri builds failed."
-            echo "Please check the logs and fix any issues."
-            exit 1
-          fi

.github/workflows/test-build-docker.yml

@@ -1,296 +0,0 @@
-name: Build Docker images (PR test)
-
-# Reusable workflow called from build.yml on PRs to verify the three
-# embedded Dockerfiles (default, ultra-lite, fat) still build cleanly,
-# optionally against a freshly-built base image when the PR touches the
-# base Dockerfile.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  # TODO: extract a pre-matrix `prepare` job that runs once and produces
-  # shared artifacts for the three matrix entries below to consume:
-  #   1. `task backend:build` — currently runs 3× in parallel with
-  #      identical env (DISABLE_ADDITIONAL_FEATURES=true,
-  #      STIRLING_PDF_DESKTOP_UI=false). Build once, upload the JAR as an
-  #      artifact, matrix entries download.
-  #   2. The base-image `docker build` (gated on docker-base-changed) —
-  #      currently runs 3× in parallel against the same Dockerfile and
-  #      context. Build once, `docker save` to an artifact, matrix entries
-  #      `docker load` before the embedded build.
-  # Saves ~2 full backend builds + 2 base-image builds per PR that touches
-  # docker. May also be reusable from backend-build.yml's jdk-25 +
-  # spring-security=true matrix entry if `task backend:build` and
-  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
-  test-build-docker-images:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-            cache-scope: stirling-pdf-latest
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-            cache-scope: stirling-pdf-ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
-            cache-scope: stirling-pdf-fat
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Build application
-        run: task backend:build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
-      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Build base image locally (PR base change only)
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: |
-          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
-
-      - name: Set base image and platform for this build
-        id: build-params
-        # Pass workflow inputs through env vars rather than expanding `${{ }}`
-        # directly into the shell — defense-in-depth against template injection
-        # if any upstream provider of these values ever becomes less trusted.
-        # GITHUB_EVENT_NAME is already provided by the runner.
-        env:
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-        run: |
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$DOCKER_BASE_CHANGED" = "true" ]; then
-            echo "base_image=stirling-pdf-base:pr-test" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
-          else
-            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
-          fi
-
-      # Base-changed PRs build the embedded image with the local docker driver
-      # so the locally-built stirling-pdf-base:pr-test (in the daemon image
-      # store) resolves. A buildx container builder cannot see it and would try
-      # to pull it from a registry, which fails. Single-platform, no gha cache.
-      - name: Build ${{ matrix.docker-rev }} against local base (PR base change)
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: |
-          DOCKER_BUILDKIT=1 docker build \
-            --build-arg BASE_IMAGE=${{ steps.build-params.outputs.base_image }} \
-            --file ./${{ matrix.docker-rev }} \
-            --tag stirling-pdf-embedded:pr-test \
-            .
-
-      - name: Build ${{ matrix.docker-rev }} (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      # Fork PRs that did NOT change the base use the buildx container builder
-      # (multi-platform + gha cache) against the published base image.
-      - name: Build ${{ matrix.docker-rev }} (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && inputs.docker-base-changed != 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          cache-from: type=gha,scope=${{ matrix.cache-scope }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      - name: Upload Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
-          path: |
-            build/reports/tests/
-            build/test-results/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
-
-  test-build-unoserver-image:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
-      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Build docker/unoserver/Dockerfile (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Build docker/unoserver/Dockerfile (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Smoke test the built image
-        run: |
-          set -eu
-          docker run -d --name unoserver-smoke \
-            -e UNOSERVER_RECYCLE_INTERVAL_SECONDS=0 \
-            stirling-unoserver:pr-test
-          deadline=$((SECONDS + 60))
-          while [ $SECONDS -lt $deadline ]; do
-            status=$(docker inspect -f '{{.State.Health.Status}}' unoserver-smoke 2>/dev/null || echo "starting")
-            if [ "$status" = "healthy" ]; then
-              echo "unoserver became healthy"
-              docker logs unoserver-smoke | tail -30
-              docker rm -f unoserver-smoke
-              exit 0
-            fi
-            sleep 3
-          done
-          echo "unoserver did not become healthy in time"
-          docker logs unoserver-smoke || true
-          docker rm -f unoserver-smoke || true
-          exit 1

.github/workflows/testdriver.yml

@@ -4,70 +4,34 @@ on:
   push:
     branches: ["master", "UITest", "testdriver"]
 
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   deploy:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
+          java-version: '17'
+          distribution: 'temurin'
 
       - name: Build with Gradle
-        run: ./gradlew build
+        run: ./gradlew clean build
         env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DISABLE_ADDITIONAL_FEATURES: true
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Get version number
         id: versionNumber
@@ -76,32 +40,17 @@ jobs:
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
-      - name: Build and push test image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64
-
-      - name: Build and push test image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      - name: Build and push test image
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64
@@ -109,7 +58,7 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Deploy to VPS
@@ -129,7 +78,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "true"
                 SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF Test"
                 UI_HOMEDESCRIPTION: "Test Deployment"
                 UI_APPNAMENAVBAR: "Test"
@@ -140,9 +89,9 @@ jobs:
               restart: on-failure:5
           EOF
 
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
             mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
             mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
             cd /stirling/test-${{ github.sha }}
@@ -150,56 +99,27 @@ jobs:
             docker-compose up -d
           EOF
 
-  files-changed:
-    if: always()
-    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    timeout-minutes: 3
-    outputs:
-      frontend: ${{ steps.changes.outputs.frontend }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          filters: ".github/config/.files.yaml"
-
   test:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [pick, deploy, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: deploy
+    runs-on: ubuntu-latest
+
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Run TestDriver.ai
         uses: testdriverai/action@f0d0f45fdd684db628baa843fe9313f3ca3a8aa8 #1.1.3
         with:
           key: ${{secrets.TESTDRIVER_API_KEY}}
           prerun: |
-            choco install go-task -y
-            task frontend:build
-            cd frontend
+            npm install
+            npm run build
             npm install dashcam-chrome --save
-            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
+            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.VPS_HOST }}:1337"
             Start-Sleep -Seconds 20
           prompt: |
             1. /run testing/testdriver/test.yml
@@ -208,29 +128,27 @@ jobs:
           FORCE_COLOR: "3"
 
   cleanup:
-    needs: [pick, deploy, test]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [deploy, test]
+    runs-on: ubuntu-latest
     if: always()
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Cleanup deployment
-        if: always()
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
             cd /stirling/test-${{ github.sha }}
             docker-compose down
             cd /stirling
             rm -rf test-${{ github.sha }}
           EOF
-        continue-on-error: true # Ensure cleanup runs even if previous steps fail

.gitignore

@@ -17,61 +17,21 @@ local.properties
 version.properties
 
 #### Stirling-PDF Files ###
-pipeline/
-!pipeline/.gitkeep
+pipeline/watchedFolders/
+pipeline/finishedFolders/
 customFiles/
 configs/
 watchedFolders/
 clientWebUI/
-# Scratch dir used by local fixture-regeneration runs (see
-# app/proprietary/src/test/resources/db-migration-fixtures/README.md).
-# Holds downloaded JARs and disposable workdirs. Never committed.
-.alpha-local/
 !cucumber/
 !cucumber/exampleFiles/
 !cucumber/exampleFiles/example_html.zip
 exampleYmlFiles/stirling/
-/stirling/
 /testing/file_snapshots
-/testing/cucumber/junit/
-/testing/cucumber/report.html
-/testing/.failed_tests
-/.test-state/
 SwaggerDoc.json
 
-# Runtime storage for uploaded files and user data (not Java source code)
-app/core/storage/
-
-# Frontend build artifacts copied to backend static resources
-# These are generated by npm build and should not be committed
-app/core/src/main/resources/static/assets/
-app/core/src/main/resources/static/index.html
-# Prerendered per-route SPA pages (OG/social-preview), e.g. compress.html. api-landing.html is source.
-app/core/src/main/resources/static/*.html
-!app/core/src/main/resources/static/api-landing.html
-!app/core/src/main/resources/static/mobile-upload.html
-# Prerendered nested-route pages (e.g. settings/people.html)
-app/core/src/main/resources/static/settings/
-app/core/src/main/resources/static/locales/
-app/core/src/main/resources/static/Login/
-app/core/src/main/resources/static/classic-logo/
-app/core/src/main/resources/static/modern-logo/
-app/core/src/main/resources/static/og_images/
-app/core/src/main/resources/static/samples/
-app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/og-metadata.json
-app/core/src/main/resources/static/sw-folder-retry.js
-app/core/src/main/resources/static/robots.txt
-app/core/src/main/resources/static/pdfium/
-app/core/src/main/resources/static/pdfjs/
-app/core/src/main/resources/static/vendor/
-app/core/src/main/resources/static/**/*.gz
-app/core/src/main/resources/static/**/*.br
-# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
-
 # Gradle
 .gradle
-.gradle-home
 .lock
 
 # External tool builders
@@ -164,14 +124,10 @@ app/core/src/main/resources/static/**/*.br
 *.tar.gz
 *.rar
 *.db
-build
-app/core/build
-app/common/build
-app/proprietary/build
-common/build
-proprietary/build
-stirling-pdf/build
-frontend/editor/src-tauri/provisioner/target
+/build
+/stirling-pdf/build
+/common/build
+/proprietary/build
 
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -179,6 +135,7 @@ __pycache__/
 *.pyo
 
 # Virtual environments
+.env*
 .venv*
 env*/
 venv*/
@@ -186,9 +143,6 @@ ENV/
 env.bak/
 venv.bak/
 
-# Env files (secrets / local overrides). Subproject .gitignore files whitelist any committed defaults.
-.env*
-
 # VS Code
 /.vscode/**/*
 !/.vscode/settings.json
@@ -198,7 +152,6 @@ venv.bak/
 .idea/
 *.iml
 out/
-.junie/
 
 # Ignore Mac DS_Store files
 .DS_Store
@@ -221,9 +174,6 @@ out/
 *.jks
 *.asc
 
-# Allow test fixture certificates (synthetic, no real credentials)
-!frontend/editor/src/core/tests/test-fixtures/certs/**
-
 # SSH Keys
 *.pub
 *.priv
@@ -234,59 +184,16 @@ id_ecdsa.pub
 id_ed25519
 id_ed25519.pub
 .ssh/
-
-# Allow the published GPG release signing public key (safe to share)
-!docs/security/signing-key.pub
 *ssh
 
-# Taskfile checksum cache
-.task/
-
 # cache
 .cache
 .ruff_cache
 .mypy_cache
 .pytest_cache
 .ipynb_checkpoints
-.build-cache
-
 
 **/jcef-bundle/
 
 # node_modules
 node_modules/
-
-# weasyPrint
-**/LOCAL_APPDATA_FONTCONFIG_CACHE/**
-
-# Translation temp files
-*_compact.json
-*compact*.json
-test_batch.json
-*.backup.*.json
-frontend/editor/public/locales/*/translation.backup*.json
-
-# Development/build artifacts
-.gradle-cache/
-scripts/pdf-collection/
-**/tmp/
-*.backup
-
-# Type3 development data
-docs/type3/signatures/
-
-
-# Type3 sample PDFs (development only)
-**/type3/samples/
-
-**/application-dev-local.properties
-
-# Claude
-.claude/
-
-# Playwright MCP screenshots / traces
-.playwright-mcp/
-*.playwright-mcp.png
-
-# Local screenshot artifacts from *-screenshots.spec.ts
-frontend/editor/screenshots/

.gitleaksignore

@@ -1,29 +0,0 @@
-# PostHog project-level key - phc_ prefix keys are public/client-side by design
-# (PostHog client-side tracking embeds them in the browser bundle). Committed
-# intentionally in #6150 so engine/.env has a working default, with real
-# credentials overridden via engine/.env.local.
-engine/.env:generic-api-key:41
-
-# MCP test fixtures / harness - no real secrets:
-# - test-only API key constant in an integration test
-# - JDBC URL + throwaway Keycloak creds in the local test compose
-# - placeholder / shell-variable Bearer headers in curl-based validation scripts
-app/proprietary/src/test/java/stirling/software/proprietary/mcp/security/McpApiKeyIntegrationTest.java:generic-api-key:40
-testing/compose/docker-compose-keycloak-mcp.yml:generic-api-key:25
-testing/compose/validate-mcp-apikey.sh:curl-auth-header:73
-testing/compose/validate-mcp-test.sh:curl-auth-header:92
-testing/compose/validate-mcp-test.sh:curl-auth-header:116
-
-# Storybook example showing curl with a fake Bearer token placeholder (sk_live_a3f8...).
-frontend/editor/src/proprietary/ui/CodeBlock.stories.tsx:curl-auth-header:5
-
-# Truncated placeholder API key in portal docs example (sk_live_8f2c...e10) - not a real secret.
-frontend/editor/src/portal/components/docs/GettingStartedSection.tsx:generic-api-key:30
-
-# False positive: generic-api-key matches the Java type name "X509Certificate"
-# in a method signature (CreateSignatureBase.resolveSignatureAlgorithm) - not a secret.
-app/core/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java:generic-api-key:224
-
-# Supabase publishable key (public by design, RLS-protected) used as a CI fallback
-# default in the tauri-build workflow when the GitHub secret is unset - not a real secret.
-.github/workflows/tauri-build.yml:generic-api-key:402

.pre-commit-config.yaml

@@ -1,14 +1,36 @@
-# The actual checks live in .taskfiles/pre-commit.yml (with helper scripts under
-# scripts/pre-commit/) and are driven by Task. This hook just delegates to `task
-# pre-commit` so the git pre-commit hook, CI and a manual `task pre-commit` all
-# run the exact same thing. Requires `task` and `uv` on PATH. To auto-fix instead
-# of only checking, run `task pre-commit:fix`.
 repos:
-  - repo: local
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.12.0
     hooks:
-      - id: task-pre-commit
-        name: task pre-commit
-        entry: task pre-commit
-        language: system
-        pass_filenames: false
-        always_run: true
+      - id: ruff
+        args:
+          - --fix
+          - --line-length=127
+        files: ^((\.github/scripts|scripts)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+      - id: ruff-format
+        files: ^((\.github/scripts|scripts)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.1
+    hooks:
+      - id: codespell
+        args:
+          - --ignore-words-list=thirdParty,tabEl,tabEls
+          - --skip="./.*,*.csv,*.json,*.ambr"
+          - --quiet-level=2
+        files: \.(html|css|js|py|md)$
+        exclude: (.vscode|.devcontainer|stirling-pdf/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.27.2
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: end-of-file-fixer
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+      - id: trailing-whitespace
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)

.taskfiles/backend.yml

@@ -1,191 +0,0 @@
-version: '3'
-
-# Gradle invocation strategy:
-#   - Linux/macOS: `./gradlew` runs the POSIX shell wrapper natively.
-#   - Windows:     `cmd /c ".\gradlew.bat ..."` invokes the .bat wrapper through
-#                  cmd.exe so it inherits the user's Windows-side `JAVA_HOME`
-#                  and PATH. Routing through `bash gradlew` on Windows ends up
-#                  under WSL or Git-Bash, neither of which inherits
-#                  Adoptium/Temurin's default Windows-only Java env - gradlew
-#                  then errors with "JAVA_HOME is not set and no 'java' command
-#                  could be found".
-#
-#                  The entire `.\gradlew.bat ...` payload is double-quoted so
-#                  the leading `.\` survives mvdan/sh's POSIX backslash
-#                  stripping; cmd.exe also requires `.\` (not bare `gradlew.bat`)
-#                  because modern Windows excludes cwd from cmd's search path.
-
-tasks:
-  dev:
-    desc: "Start backend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars:
-          PORT: '{{.PORT}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-          SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN}}'
-          POLICIES_ENABLED: '{{.POLICIES_ENABLED}}'
-
-  dev:proprietary:
-    desc: "Start backend dev server in proprietary mode"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`. Local overrides in
-    # .env.proprietary.local win over the committed .env.proprietary defaults.
-    dotenv: ['app/.env.proprietary.local', 'app/.env.proprietary']
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-      SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN | default ""}}'
-      POLICIES_ENABLED: '{{.POLICIES_ENABLED | default ""}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-    cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .POLICIES_ENABLED}}POLICIES_ENABLED={{.POLICIES_ENABLED}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
-        platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .POLICIES_ENABLED}}POLICIES_ENABLED={{.POLICIES_ENABLED}} {{end}}./gradlew :stirling-pdf:bootRun'
-        platforms: [linux, darwin]
-
-  dev:bundled:
-    desc: "Clean + bootRun with frontend bundled into the backend (single :8080 server)"
-    ignore_error: true
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean bootRun -PbuildWithFrontend=true"
-        platforms: [windows]
-      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
-        platforms: [linux, darwin]
-
-  dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`.
-    dotenv: ['app/.env.saas.local', 'app/.env.saas']
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
-      PROFILES: '{{.PROFILES | default "dev"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-      STIRLING_FLAVOR: saas
-      AIENGINE_URL: '{{.AIENGINE_URL}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
-        platforms: [linux, darwin]
-
-  build:
-    desc: "Full backend build"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build"
-        platforms: [windows]
-      - cmd: ./gradlew clean build
-        platforms: [linux, darwin]
-
-  build:fast:
-    desc: "Build without tests"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build -x test"
-        platforms: [windows]
-      - cmd: ./gradlew clean build -x test
-        platforms: [linux, darwin]
-
-  build:ci:
-    desc: "Build for CI (formatting checked separately)"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat build -PnoSpotless"
-        platforms: [windows]
-      - cmd: ./gradlew build -PnoSpotless
-        platforms: [linux, darwin]
-
-  test:
-    desc: "Run backend tests"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat test"
-        platforms: [windows]
-      - cmd: ./gradlew test
-        platforms: [linux, darwin]
-
-  format:
-    desc: "Auto-fix code formatting"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessApply"
-        platforms: [windows]
-      - cmd: ./gradlew spotlessApply
-        platforms: [linux, darwin]
-
-  format:check:
-    desc: "Check code formatting"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessCheck"
-        platforms: [windows]
-      - cmd: ./gradlew spotlessCheck
-        platforms: [linux, darwin]
-
-  fix:
-    desc: "Auto-fix backend"
-    cmds:
-      - task: format
-
-  swagger:
-    desc: "Generate OpenAPI docs"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:copySwaggerDoc"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
-        platforms: [linux, darwin]
-    sources:
-      - app/core/src/main/java/**/*.java
-      - app/proprietary/src/main/java/**/*.java
-      - app/common/src/main/java/**/*.java
-    generates:
-      - SwaggerDoc.json
-
-  check:
-    desc: "Backend quality gate"
-    cmds:
-      - task: format:check
-      - task: test
-
-  version:
-    desc: "Print project version"
-    silent: true
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat printVersion --quiet" | tail -1
-        platforms: [windows]
-      - cmd: ./gradlew printVersion --quiet | tail -1
-        platforms: [linux, darwin]
-
-  licenses:check:
-    desc: "Check dependency licenses"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense --no-parallel"
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense --no-parallel
-        platforms: [linux, darwin]
-
-  licenses:generate:
-    desc: "Check and generate dependency license report"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense generateLicenseReport --no-parallel"
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
-        platforms: [linux, darwin]
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean"
-        platforms: [windows]
-      - cmd: ./gradlew clean
-        platforms: [linux, darwin]

.taskfiles/desktop.yml

@@ -1,222 +0,0 @@
-version: '3'
-
-vars:
-  # jdk.dynalink is required by VeraPDF (PDF/A validation); without it the bundled JRE throws
-  # NoClassDefFoundError: jdk/dynalink/Namespace at runtime in get-info-on-pdf and verify-pdf
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.dynalink"
-
-  # Minimum Java major the bundled JRE must be. Keep in sync with build.gradle
-  # `modernJavaVersion` - the app JAR is compiled for this, so an older runtime
-  # fails at launch with UnsupportedClassVersionError. Enforced by jlink:verify.
-  REQUIRED_JAVA: "25"
-
-  # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
-  JPDFIUM_PLATFORMS:
-    sh: |
-      if [ -n "${JPDFIUM_PLATFORMS:-}" ]; then
-          echo "$JPDFIUM_PLATFORMS"
-      else
-          case "{{OS}}-{{ARCH}}" in
-              darwin-arm64)  echo "darwin-arm64";;
-              darwin-amd64)  echo "darwin-x64";;
-              linux-amd64)   echo "linux-x64";;
-              linux-arm64)   echo "linux-arm64";;
-              windows-amd64) echo "windows-x64";;
-              *)             echo "all";;
-          esac
-      fi
-
-tasks:
-  prepare:
-    desc: "Prepare desktop build dependencies"
-    deps:
-      - jlink
-      - task: ":frontend:prepare"
-        vars: { MODE: desktop }
-      - provisioner
-
-  provisioner:
-    desc: "Build installer provisioner"
-    platforms: [windows]
-    dir: editor
-    cmds:
-      - node scripts/build-provisioner.mjs
-
-  dev:
-    desc: "Start Tauri desktop dev mode"
-    deps: [prepare]
-    ignore_error: true
-    dir: editor
-    cmds:
-      - npx tauri dev --no-watch
-
-  build:
-    desc: "Build Tauri desktop app (production)"
-    deps: [prepare]
-    dir: editor
-    cmds:
-      - npx tauri build
-
-  build:dev:
-    desc: "Build Tauri desktop app (dev, no bundling)"
-    deps: [prepare]
-    dir: editor
-    cmds:
-      - npx tauri build --no-bundle
-
-  build:dev:mac:
-    desc: "Build Tauri desktop .app bundle (macOS)"
-    deps: [prepare]
-    dir: editor
-    cmds:
-      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  build:dev:windows:
-    desc: "Build Tauri desktop NSIS installer (Windows)"
-    deps: [prepare]
-    dir: editor
-    cmds:
-      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  build:dev:linux:
-    desc: "Build Tauri desktop AppImage (Linux)"
-    deps: [prepare]
-    dir: editor
-    cmds:
-      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  test:
-    desc: "Run Tauri/Cargo tests"
-    deps: [prepare]
-    dir: editor/src-tauri
-    cmds:
-      - cargo test
-
-  clean:
-    desc: "Clean Tauri/Cargo build artifacts"
-    dir: editor
-    cmds:
-      - task: jlink:clean
-      - cd src-tauri && cargo clean
-      - rm -rf dist build
-
-  # ============================================================
-  # JLink — Build bundled Java runtime for Tauri
-  # ============================================================
-
-  jlink:
-    desc: "Build backend JAR and create JLink runtime for Tauri"
-    deps: [jlink:jar, jlink:runtime]
-    # Runs after the runtime is in place. Lives here (not in jlink:runtime's
-    # cmds) so it still fires when jlink:runtime short-circuits on its `status:`
-    # check and reuses an existing runtime/jre - that reuse path is exactly how
-    # a stale, too-old JRE slips through.
-    cmds:
-      - task: jlink:verify
-
-  jlink:verify:
-    desc: "Fail the build if the bundled JRE is older than the app JAR requires"
-    dir: editor
-    env:
-      REQUIRED_JAVA: "{{.REQUIRED_JAVA}}"
-    cmds:
-      - node scripts/verify-bundled-jre.mjs src-tauri/runtime/jre/release
-
-  jlink:jar:
-    desc: "Build backend JAR for Tauri bundling (host-OS natives only by default)"
-    run: once
-    dir: ..
-    env:
-      DISABLE_ADDITIONAL_FEATURES: "true"
-    cmds:
-      - echo "Building bootJar with JPDFium natives for {{.JPDFIUM_PLATFORMS}}"
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
-        platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
-        platforms: [linux, darwin]
-      - mkdir -p frontend/editor/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/editor/src-tauri/libs/
-    status:
-      - test -f frontend/editor/src-tauri/libs/stirling-pdf-*.jar
-
-  jlink:runtime:
-    desc: "Create custom JRE with jlink"
-    deps: [jlink:jar]
-    dir: editor/src-tauri
-    cmds:
-      - rm -rf runtime/jre
-      - mkdir -p runtime
-      # Pin jlink to JAVA_HOME so the bundled JRE matches the JDK the build
-      # uses. Bare `jlink` on PATH can resolve to an older system Java (the
-      # ubuntu runner ships Java 11), producing a runtime jlink:verify rejects.
-      #
-      # jdk.crypto.mscapi (the Windows certificate store / SunMSCAPI provider, used by
-      # hardware-backed cert signing) is a Windows-only module - it only exists in a Windows
-      # JDK's jmods, so it is added on Windows only or jlink fails to resolve it elsewhere.
-      - cmd: |
-          JLINK="${JAVA_HOME:+$JAVA_HOME/bin/}jlink"
-          JLINK_COMPRESS="$("$JLINK" --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-          "$JLINK" \
-            --add-modules {{.JLINK_MODULES}},jdk.crypto.mscapi \
-            --strip-debug \
-            --compress="$JLINK_COMPRESS" \
-            --no-header-files \
-            --no-man-pages \
-            --output runtime/jre
-        platforms: [windows]
-      - cmd: |
-          JLINK="${JAVA_HOME:+$JAVA_HOME/bin/}jlink"
-          JLINK_COMPRESS="$("$JLINK" --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-          "$JLINK" \
-            --add-modules {{.JLINK_MODULES}} \
-            --strip-debug \
-            --compress="$JLINK_COMPRESS" \
-            --no-header-files \
-            --no-man-pages \
-            --output runtime/jre
-        platforms: [linux, darwin]
-      # jlink emits its files mode 444 (read-only). Tauri's build-script
-      # resource copier preserves source permissions when staging
-      # `runtime/jre/**/*` into `target/<profile>/runtime/jre/...`, so the
-      # staged copies are read-only too. On any subsequent incremental
-      # build the copier tries to overwrite them and fails with a bare
-      # `Permission denied (os error 13)` (Rust's io::Error Display drops
-      # the path, so the failure is opaque). Make the source writable here
-      # so the staged destinations are writable and can be overwritten.
-      #
-      # Trade-off: this task runs for both `task desktop:dev` and
-      # `task desktop:build`, so production bundles also ship mode-644
-      # JRE files instead of 444. Functionally harmless on POSIX (the
-      # `other` bit is `r--` either way, and on macOS code signing is the
-      # real integrity check) and on Windows the DOS read-only attribute
-      # isn't load-bearing for the bundled JDK. If we ever need strict
-      # 444 in production, split the chmod into a dev-only step and have
-      # `desktop:build` run `jlink:clean` first to force a fresh build.
-      - cmd: chmod -R u+w runtime/jre
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
-        platforms: [windows]
-    status:
-      - test -f runtime/jre/release
-
-  jlink:clean:
-    desc: "Remove JLink runtime and bundled JARs"
-    dir: editor/src-tauri
-    cmds:
-      - rm -rf libs runtime
-
-  # macOS-only. Replaces jlink:runtime's single-arch JRE with a universal
-  # (arm64 + x86_64) one for the universal Tauri shell. Runs the x86_64
-  # jlink under Rosetta on Apple Silicon, so it is opt-in and not part of
-  # the default desktop:build flow. Requires AARCH64_JAVA_HOME and
-  # X64_JAVA_HOME to point at matching JDK installations with jmods/.
-  jlink:universal-mac:
-    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
-    deps: [jlink:jar]
-    platforms: [darwin]
-    dir: editor
-    env:
-      JLINK_MODULES: "{{.JLINK_MODULES}}"
-      OUTPUT_DIR: src-tauri/runtime/jre
-    cmds:
-      - scripts/build-universal-mac-jre.sh

.taskfiles/docker.yml

@@ -1,68 +0,0 @@
-version: '3'
-
-vars:
-  COMPOSE_DIR: docker/compose
-  EMBEDDED_DIR: docker/embedded
-
-tasks:
-  build:
-    desc: "Build standard Docker image"
-    cmds:
-      - docker build -t stirling-pdf -f {{.EMBEDDED_DIR}}/Dockerfile .
-
-  build:fat:
-    desc: "Build fat Docker image (all features)"
-    cmds:
-      - docker build -t stirling-pdf-fat -f {{.EMBEDDED_DIR}}/Dockerfile.fat .
-
-  build:ultra-lite:
-    desc: "Build ultra-lite Docker image"
-    cmds:
-      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
-
-  build:backend:
-    desc: "Build backend-only Docker image (no embedded frontend)"
-    cmds:
-      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
-
-  build:frontend:
-    desc: "Build frontend-only Docker image"
-    cmds:
-      - docker build -t stirling-pdf-frontend -f docker/frontend/Dockerfile .
-
-  build:engine:
-    desc: "Build engine Docker image"
-    dir: engine
-    cmds:
-      - docker build -t stirling-pdf-engine .
-
-  up:
-    desc: "Start standard docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml up -d
-
-  up:fat:
-    desc: "Start fat docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.fat.yml up -d
-
-  up:ultra-lite:
-    desc: "Start ultra-lite docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.ultra-lite.yml up -d
-
-  down:
-    desc: "Stop all running docker compose stacks"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml down
-
-  logs:
-    desc: "Tail docker compose logs"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
-
-  test:
-    desc: "Run full Docker integration test suite (builds all variants and tests them)"
-    ignore_error: true
-    cmds:
-      - bash testing/test.sh {{.CLI_ARGS}}

.taskfiles/e2e.yml

@@ -1,266 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install Playwright browsers"
-    dir: frontend/editor
-    deps: [ ':frontend:install' ]
-    cmds:
-      - npx playwright install {{.CLI_ARGS}} --with-deps
-
-  stubbed:
-    desc: "Run stubbed E2E tests"
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed {{.CLI_ARGS}}
-
-  live:
-    desc: "Run live E2E tests"
-    summary: |
-      Auto-spawns a Spring Boot backend with isolated state under
-      .test-state/playwright/ (purged on every run) so the suite doesn't
-      touch your local DB, settings.yml, backups or customFiles. The
-      backend is stopped automatically when the runner exits.
-
-      Pass extra Playwright flags via -- :
-        task e2e:live -- --headed --grep merge
-    deps:
-      - live:backend
-      - live:runner
-
-  live:backend:
-    internal: true
-    ignore_error: true
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    # COVERAGE=1 in the calling environment attaches the JaCoCo agent to
-    # the bootRun JVM and writes to BASE_DIR/jacoco.exec on shutdown.
-    # Off by default to keep local dev runs uninstrumented; CI flips it.
-    env:
-      STIRLING_BASE_PATH: '{{.BASE_DIR}}'
-      # Suppress the analytics opt-in modal that fires on first admin login.
-      # It renders a Mantine overlay that intercepts pointer events and blocks
-      # FirstLoginSlide from rendering, so the bootstrap spec times out waiting
-      # for the password-change prompt.
-      SYSTEM_ENABLEANALYTICS: "false"
-      # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
-      # The live-setup project's bootstrap spec performs the real first-login
-      # flow against the backend's default admin/stirling user, exercising the
-      # forced-password-change UI and leaving the DB at admin/adminadmin for
-      # the rest of the live suite. This is both real coverage of the first-
-      # login flow and a stronger seed than env-var-driven user creation.
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) doesn't
-      # support `&` + `$!` + `wait` reliably (gradle was never actually
-      # backgrounded, so `$!` recorded a stale PID and the runner saw an
-      # immediate "backend died"). Real bash backgrounds gradle properly and
-      # gives us a stable PID to clean up.
-      - |
-        bash -c '
-          set -e
-          rm -rf "{{.BASE_DIR}}"
-          mkdir -p "{{.BASE_DIR}}"
-          GRADLE_ARGS=":stirling-pdf:bootRun"
-          if [ -n "${COVERAGE:-}" ]; then
-            # copyJacocoAgent is wired as a dependency of bootRun when
-            # -PjacocoAgent=true, so we do not need to invoke it separately.
-            GRADLE_ARGS="$GRADLE_ARGS -PjacocoAgent=true -PjacocoExec={{.BASE_DIR}}/jacoco.exec"
-            echo "JaCoCo coverage enabled, writing to {{.BASE_DIR}}/jacoco.exec"
-          fi
-          # Background gradle and record its PID so the runner can clean up
-          # the exact process tree (wrapper + forked Spring Boot JVM) without
-          # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
-          # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
-          # synchronised.
-          bash gradlew $GRADLE_ARGS > "{{.BASE_DIR}}/backend.log" 2>&1 &
-          GRADLE_PID=$!
-          echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
-          wait $GRADLE_PID
-        '
-
-  live:runner:
-    internal: true
-    deps: [ ':frontend:prepare' ]
-    dir: frontend/editor
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) only
-      # supports `EXIT`/`ERR` in `trap`, not `INT`/`TERM`. CLI_ARGS are
-      # passed positionally so quoted args like --grep "foo bar" survive.
-      - |
-        bash -c '
-          set +e
-          # bootRun forks a separate Spring Boot JVM as a child of the gradle
-          # wrapper; killing only the wrapper leaves that JVM orphaned holding
-          # :8080. Walk the recorded PID'"'"'s process tree via pgrep so we kill
-          # every descendant, then lsof as a last-resort backstop.
-          kill_tree() {
-            local pid=$1
-            for child in $(pgrep -P "$pid" 2>/dev/null); do
-              kill_tree "$child"
-            done
-            kill "$pid" 2>/dev/null || true
-          }
-          cleanup() {
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              echo "Stopping backend..."
-              kill_tree "$(cat "{{.BASE_DIR}}/backend.pid")"
-              sleep 1
-              lsof -ti:8080 2>/dev/null | xargs kill 2>/dev/null || true
-              echo "Backend stopped"
-            fi
-          }
-          # Trap so cleanup runs on every exit path: tests pass, tests fail,
-          # backend never starts, user Ctrl-Cs. Without this the gradle JVM
-          # is left orphaned holding :8080 whenever the wait loop times out.
-          trap cleanup EXIT INT TERM
-
-          echo "Waiting for backend on :8080 (up to 10min; first compile can be slow)..."
-          WAITED=0
-          while [ $WAITED -lt 600 ]; do
-            if curl -sf http://localhost:8080/api/v1/info/status 2>/dev/null | grep -q UP; then
-              echo "Backend ready, starting Playwright"
-              break
-            fi
-            # Bail early if the backend already died: no point waiting 10min.
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              BACKEND_PID=$(cat "{{.BASE_DIR}}/backend.pid")
-              if ! kill -0 "$BACKEND_PID" 2>/dev/null; then
-                echo "Backend process exited before becoming ready; last 100 log lines:"
-                tail -100 "{{.BASE_DIR}}/backend.log" 2>/dev/null || true
-                exit 1
-              fi
-            fi
-            sleep 2
-            WAITED=$((WAITED + 2))
-          done
-          if [ $WAITED -ge 600 ]; then
-            echo "Backend did not become ready within 10min, aborting"
-            exit 1
-          fi
-
-          npx playwright test --project=live "$@"
-        ' bash {{.CLI_ARGS}}
-
-  enterprise:
-    desc: "Run enterprise E2E tests"
-    summary: |
-      Requires an already-running keycloak compose stack on :8080. Bring one
-      up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=enterprise {{.CLI_ARGS}}
-
-  cross-browser:
-    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
-
-  check:
-    desc: "Run all E2E tests not requiring Docker"
-    cmds:
-      - task: stubbed
-      - task: live
-
-  check:all:
-    desc: "Run all E2E tests"
-    summary: |
-      Includes the enterprise project, which requires a keycloak compose
-      stack on :8080. Bring one up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    cmds:
-      - task: stubbed
-      - task: live
-      - task: enterprise
-
-  oauth:up:
-    desc: "Start the OAuth keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:oauth:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:oauth:up -- --auto --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-oauth-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  oauth:down:
-    desc: "Stop the OAuth keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-oauth.yml down -v
-
-  saml:up:
-    desc: "Start the SAML keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:saml:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:saml:up -- --auto --with-storage --nobuild --language sv-SE
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-saml-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  saml:down:
-    desc: "Stop the SAML keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
-
-  mcp:up:
-    desc: "Start the MCP keycloak test environment (Stirling as OAuth resource server)"
-    summary: |
-      Brings up Keycloak (OAuth authorization server) + Stirling configured as an
-      MCP resource server, then you can exercise /mcp with real Keycloak tokens.
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:mcp:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:mcp:up -- --validate --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:manual:
-    desc: "Start the MCP keycloak test env in manual mode (prints URLs + a live token for your client)"
-    summary: |
-      Brings the stack up and prints copy-paste URLs/commands plus a freshly minted
-      access token so you can drive your own MCP client (Inspector, curl, ...).
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key>
-      Add --nobuild if the images are already built:
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --manual {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:apikey:
-    desc: "Start the MCP test env in API-KEY manual mode (no OAuth/IdP): mints a key + prints client settings"
-    summary: |
-      Brings Stirling up in apikey auth mode and prints copy-paste client settings with a freshly
-      minted X-API-KEY - ideal for clients whose OAuth layer can't reach localhost.
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key>
-      Add --nobuild if images are already built:
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --apikey {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:validate:
-    desc: "Validate the running MCP keycloak test environment end-to-end (oauth mode + real MCP SDK client)"
-    cmds:
-      - bash testing/compose/validate-mcp-test.sh
-
-  mcp:validate-apikey:
-    desc: "Validate the MCP server in API-KEY auth mode (mints a key + real MCP SDK client), then restore oauth"
-    cmds:
-      - bash testing/compose/validate-mcp-apikey.sh
-
-  mcp:down:
-    desc: "Stop the MCP keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-mcp.yml down -v

.taskfiles/engine.yml

@@ -1,132 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install engine dependencies"
-    run: once
-    cmds:
-      - uv python install 3.13.8
-      - uv sync
-    sources:
-      - uv.lock
-      - pyproject.toml
-    status:
-      - test -d .venv
-
-  prepare:
-    desc: "Set up engine .env from template"
-    deps: [install]
-    cmds:
-      - uv run scripts/setup_env.py
-    sources:
-      - scripts/setup_env.py
-    generates:
-      - .env.local
-
-  run:
-    desc: "Run engine server"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
-
-  dev:
-    desc: "Start engine dev server with hot reload"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - uv run ruff check .
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - uv run ruff check . --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format . --diff
-
-  typecheck:
-    desc: "Run type checking"
-    deps: [install]
-    cmds:
-      - uv run pyright . --warnings
-
-  test:
-    desc: "Run tests"
-    deps: [prepare]
-    cmds:
-      - uv run pytest tests
-
-  fix:
-    desc: "Auto-fix lint + format"
-    cmds:
-      - task: format  # Can auto-fix some things that `lint:fix` can't like line length violations
-      - task: lint:fix
-      - task: format  # Ensure that after lint fixing that the code is still formatted correctly
-
-  check:
-    desc: "Full engine quality gate"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  tool-models:
-    desc: "Generate tool_models.py from Java OpenAPI spec (SwaggerDoc.json)"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py
-    sources:
-      - ../SwaggerDoc.json
-      - scripts/generate_tool_models.py
-    generates:
-      - src/stirling/models/tool_models.py
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - task: '{{if eq .OS "Windows_NT"}}clean-windows{{else}}clean-unix{{end}}'
-
-  clean-unix:
-    internal: true
-    desc: "Clean build artifacts"
-    cmds:
-      - rm -rf .venv data logs output
-
-  # On Windows, use PowerShell as bash failed to delete some dependencies
-  clean-windows:
-    internal: true
-    desc: "Clean build artifacts"
-    ignore_error: true
-    cmds:
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue .venv
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue data
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue logs
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue output

.taskfiles/frontend.yml

@@ -1,438 +0,0 @@
-version: '3'
-
-# Tasks operate from the workspace root (frontend/). Editor commands pass
-# `editor` as the vite project root (positional after `build` / before the
-# mode flag) or use `--project editor/...` for tsc — so the editor lives
-# under frontend/editor/ without each task needing a cd.
-
-tasks:
-  install:
-    desc: "Install dependencies"
-    run: once
-    cmds:
-      - '{{ if eq .CI "true" }}npm ci{{ else }}npm install{{ end }}'
-    sources:
-      - package-lock.json
-      - package.json
-    status:
-      - test -d node_modules
-    env:
-      CI: '{{ .CI | default "false" }}'
-
-  prepare:env:
-    internal: true
-    run: when_changed
-    deps: [install]
-    vars:
-      MODE: '{{.MODE | default ""}}'
-    cmds:
-      - npx tsx editor/scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
-    sources:
-      - editor/scripts/setup-env.mts
-    generates:
-      - editor/.env.local
-      - editor/.env{{if .MODE}}.{{.MODE}}{{end}}.local
-
-  prepare:icons:
-    internal: true
-    run: once
-    deps: [install]
-    cmds:
-      - node editor/scripts/generate-icons.js
-
-  prepare:og:
-    internal: true
-    run: when_changed
-    desc: "Regenerate OG/social-preview metadata from the tool registry"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs
-    sources:
-      - editor/src/core/types/toolId.ts
-      - editor/src/core/utils/urlMapping.ts
-      - editor/src/core/data/useTranslatedToolRegistry.tsx
-      - editor/public/og_images/*.png
-    generates:
-      - editor/src/core/data/ogImageMap.json
-      - editor/public/og-metadata.json
-
-  prepare:
-    desc: "Set up dev environment"
-    run: when_changed
-    vars:
-      MODE: '{{.MODE | default ""}}'
-    deps:
-      - task: prepare:env
-        vars: { MODE: '{{.MODE}}' }
-      - prepare:icons
-      - prepare:og
-
-  # ============================================================
-  # Development
-  # ============================================================
-
-  dev:_run:
-    internal: true
-    ignore_error: true
-    vars:
-      MODE: '{{.MODE}}'
-      PORT: '{{.PORT | default "5173"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      OPEN: '{{.OPEN | default ""}}'
-    env:
-      BACKEND_URL: '{{.BACKEND_URL}}'
-      # Dev-only browser-tab label so concurrent worktrees are distinguishable.
-      # Only the worktree folder basename (e.g. "wt1") is exposed — never the
-      # full path, hostname, or user. Consumed at dev-serve time by vite.config
-      # and dropped from production builds.
-      STIRLING_DEV_LABEL:
-        sh: basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-    cmds:
-      - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
-
-  dev:
-    desc: "Start frontend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars: { PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:core:
-    desc: "Start frontend dev server in core mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: core, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:proprietary:
-    desc: "Start frontend dev server in proprietary mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: proprietary, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:saas:
-    desc: "Start frontend dev server in SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - task: dev:_run
-        vars: { MODE: saas, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:desktop:
-    desc: "Start frontend dev server in desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - task: dev:_run
-        vars: { MODE: desktop, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:prototypes:
-    desc: "Start frontend dev server in prototypes mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  # ============================================================
-  # Build
-  # ============================================================
-
-  build:
-    desc: "Production build (default mode)"
-    deps: [prepare]
-    cmds:
-      - npx vite build editor
-
-  build:core:
-    desc: "Build for core mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build editor --mode core
-
-  build:proprietary:
-    desc: "Build for proprietary mode"
-    deps: [prepare]
-    vars:
-      PREVIEW: '{{.PREVIEW | default ""}}'
-    cmds:
-      - '{{if .PREVIEW}}VITE_BUILD_FOR_PREVIEW=1 {{end}}npx vite build editor --mode proprietary'
-
-  build:saas:
-    desc: "Build for SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - npx vite build editor --mode saas
-
-  build:desktop:
-    desc: "Build for desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - npx vite build editor --mode desktop
-
-  build:prototypes:
-    desc: "Build for prototypes mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build editor --mode prototypes
-
-
-  storybook:
-    desc: "Start Storybook dev server"
-    deps: [install]
-    cmds:
-      - npx storybook dev -p 6006 {{.CLI_ARGS}}
-
-  storybook:build:
-    desc: "Build static Storybook"
-    deps: [install]
-    cmds:
-      - npx storybook build {{.CLI_ARGS}}
-
-  # ============================================================
-  # Code quality
-  # ============================================================
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - task: lint:eslint
-      - task: lint:dpdm
-
-  lint:eslint:
-    desc: "Run ESLint linting"
-    deps: [install]
-    cmds:
-      - npx eslint --max-warnings=0
-
-  lint:dpdm:
-    desc: "Run circular import linting"
-    deps: [install]
-    cmds:
-      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
-      # shell-agnostic. Covers the whole editor tree, including the portal layer.
-      - npx dpdm "editor/src/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - npx eslint --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --write .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --check .
-
-  fix:
-    desc: "Auto-fix lint and format"
-    cmds:
-      - task: format
-      - task: lint:fix
-
-  typecheck:
-    desc: "Typecheck default build of the app"
-    cmds:
-      - task: typecheck:proprietary
-
-  typecheck:_run:
-    internal: true
-    env:
-      CI: '{{ .CI | default "false" }}'
-    cmds:
-      - '{{ if eq .CI "true" }}npx tsc{{ else }}npx tsgo{{ end }} --noEmit --project {{.PROJECT}}'
-
-  typecheck:core:
-    desc: "Typecheck core build variant"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/core/tsconfig.json }
-
-  typecheck:proprietary:
-    desc: "Typecheck proprietary build variant"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/proprietary/tsconfig.json }
-
-  typecheck:saas:
-    desc: "Typecheck SaaS build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/saas/tsconfig.json }
-
-  typecheck:desktop:
-    desc: "Typecheck desktop build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/desktop/tsconfig.json }
-
-  typecheck:cloud:
-    desc: "Typecheck cloud shared layer (standalone)"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/cloud/tsconfig.json }
-
-  typecheck:scripts:
-    desc: "Typecheck scripts"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/scripts/tsconfig.json }
-
-  typecheck:prototypes:
-    desc: "Typecheck prototypes build variant"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/prototypes/tsconfig.json }
-
-  typecheck:portal:
-    desc: "Typecheck developer portal build variant"
-    deps: [install]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/portal/tsconfig.json }
-
-  typecheck:all:
-    desc: "Typecheck all build variants"
-    cmds:
-      - task: typecheck:core
-      - task: typecheck:proprietary
-      - task: typecheck:saas
-      - task: typecheck:desktop
-      - task: typecheck:cloud
-      - task: typecheck:scripts
-      - task: typecheck:prototypes
-      - task: typecheck:portal
-
-  # ============================================================
-  # Quality Gate
-  # ============================================================
-
-  check:
-    desc: "Quick quality gate for local development"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  og:check:
-    desc: "Fail if committed OG/social-preview metadata is out of date"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs --check
-
-  check:all:
-    desc: "Full CI quality gate"
-    cmds:
-      # Runs first, before prepare regenerates: guards the committed og-metadata.json /
-      # ogImageMap.json that the Cloudflare Pages (plain `vite build`) deploy relies on.
-      - task: og:check
-      - task: typecheck:all
-      - task: lint
-      - task: format:check
-      - task: build
-      - task: test
-      - task: storybook:build
-
-  # ============================================================
-  # Test
-  # ============================================================
-
-  test:
-    desc: "Run tests"
-    cmds:
-      - task: test:editor
-
-  test:editor:
-    desc: "Run editor tests"
-    deps: [prepare]
-    cmds:
-      - npx vitest run --root editor
-
-  test:watch:
-    desc: "Run tests in watch mode"
-    deps: [prepare]
-    cmds:
-      - npx vitest --watch --root editor
-
-  test:coverage:
-    desc: "Run tests with coverage (one-shot; CI-friendly)."
-    deps: [prepare]
-    cmds:
-      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
-      # mode). Explicit reporter list because v8 + json-summary is what the
-      # coverage-summary.py helper consumes; html/text are kept for humans.
-      #
-      # reportsDirectory is pinned to ./coverage relative to vitest's root
-      # (--root editor), so output lands at frontend/editor/coverage/. The
-      # CI upload step reads from that path. An earlier attempt with
-      # `./editor/coverage` double-nested into frontend/editor/editor/coverage;
-      # pinning future-proofs against vitest changing the default.
-      - >
-        npx vitest run --root editor --coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage
-
-  # ============================================================
-  # Code Generation
-  # ============================================================
-
-  tool-models:
-    desc: "Generate tool API types from the Java OpenAPI spec"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts
-    sources:
-      - editor/scripts/generate-tool-api-types.mts
-      - ../SwaggerDoc.json
-    generates:
-      - editor/src/core/types/toolApiTypes.ts
-
-  tool-models:check:
-    desc: "Fail if committed tool API types are out of date"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --check
-
-  licenses:generate:
-    desc: "Generate frontend license report"
-    deps: [install]
-    cmds:
-      - node editor/scripts/generate-licenses.js
-
-  # ============================================================
-  # Clean
-  # ============================================================
-
-  clean:
-    desc: "Clean build artifacts and caches"
-    cmds:
-      - cmd: powershell rm -Recurse -Force -ErrorAction SilentlyContinue node_modules/.vite, editor/dist, dist
-        platforms: [windows]
-      - cmd: rm -rf node_modules/.vite editor/dist dist
-        platforms: [linux, darwin]

.taskfiles/pre-commit.yml

@@ -1,133 +0,0 @@
-version: '3'
-
-# Repo-wide lint/format/secret checks - the single source of truth that the git
-# pre-commit hook (.pre-commit-config.yaml) and CI (pre_commit.yml) both call.
-
-vars:
-  # File selections as git pathspecs: git does the include/exclude matching, so
-  # there is no grep/xargs and it behaves identically on every platform.
-  PY_FILES: >-
-    'scripts/*.py'
-    '.github/scripts/*.py'
-    'app/core/src/main/resources/static/python/*.py'
-    ':(exclude)*split_photos.py'
-  SPELL_FILES: >-
-    '*.html'
-    '*.css'
-    '*.js'
-    '*.py'
-    '*.md'
-    ':(exclude).vscode/*'
-    ':(exclude).devcontainer/*'
-    ':(exclude)app/core/src/main/resources/*'
-    ':(exclude)app/proprietary/src/main/resources/*'
-    ':(exclude)frontend/editor/public/vendor/*'
-    ':(exclude)*Dockerfile*'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-  WS_FILES: >-
-    '*.js'
-    '*.java'
-    '*.py'
-    '*.yml'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-    ':(exclude).github/workflows/*'
-  LOCALE_TOML: 'frontend/editor/public/locales/*/translation.toml'
-
-  # gitleaks is pinned + checksum-verified by scripts/pre-commit/install_gitleaks.py,
-  # which owns the version and caches the binary here.
-  GITLEAKS_BIN: '.task/bin/gitleaks{{if eq OS "windows"}}.exe{{end}}'
-
-tasks:
-  default:
-    desc: "Check formatting, spelling, and secrets across the repo"
-    cmds:
-      - task: ruff
-      - task: ruff-format
-      - task: codespell
-      - task: gitleaks
-      - task: whitespace
-      - task: toml-sort
-
-  fix:
-    desc: "Auto-fix formatting, spelling, and secrets issues across the repo"
-    cmds:
-      # Auto-fixers first, then the report-only tools (codespell, gitleaks) so a
-      # finding there does not stop the fixers from running.
-      - task: ruff
-        vars: { FIX: '1' }
-      - task: ruff-format
-        vars: { FIX: '1' }
-      - task: whitespace
-        vars: { FIX: '1' }
-      - task: toml-sort
-        vars: { FIX: '1' }
-      - task: codespell
-      - task: gitleaks
-
-  install:
-    desc: "Install the pinned pre-commit Python tools (ruff, codespell, toml-sort)"
-    run: once
-    cmds:
-      - uv sync --project scripts/pre-commit --locked
-    sources:
-      - scripts/pre-commit/uv.lock
-      - scripts/pre-commit/pyproject.toml
-    status:
-      - test -d scripts/pre-commit/.venv
-
-  clean:
-    desc: "Remove the cached gitleaks binary and the tool virtualenv"
-    cmds:
-      - cmd: rm -rf scripts/pre-commit/.venv .task/bin/gitleaks
-        platforms: [linux, darwin]
-      - cmd: cmd /c "rmdir /s /q scripts\pre-commit\.venv & del /q .task\bin\gitleaks.exe"
-        platforms: [windows]
-        ignore_error: true
-
-  # Individual checks (hidden from `task --list`, but callable, e.g.
-  # `task pre-commit:toml-sort FIX=1`). Pass FIX=1 to auto-fix where supported.
-  ruff:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff check --line-length=127 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
-
-  ruff-format:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff format {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
-
-  codespell:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
-
-  toml-sort:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync toml-sort --all --ignore-case {{if .FIX}}--in-place{{else}}--check{{end}} {{.LOCALE_TOML}}
-
-  whitespace:
-    cmds:
-      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}
-
-  gitleaks:
-    deps: [gitleaks-bin]
-    # Scan staged changes only, matching the old hook: the git-mode fingerprints
-    # in .gitleaksignore (file:rule:line) still apply, and with nothing staged
-    # this is a no-op. Secrets are never auto-fixed, so FIX has no effect.
-    cmds:
-      - "{{.GITLEAKS_BIN}} git --pre-commit --redact --staged --verbose"
-
-  gitleaks-bin:
-    internal: true
-    desc: "Ensure the pinned, checksum-verified gitleaks binary is cached in .task/bin"
-    cmds:
-      - uv run --no-project python scripts/pre-commit/install_gitleaks.py

.vscode/extensions.json

@@ -13,12 +13,9 @@
     "vscjava.vscode-spring-boot-dashboard", // Spring Boot dashboard for managing and visualizing Spring Boot applications
     "EditorConfig.EditorConfig", // EditorConfig support for maintaining consistent coding styles
     "ms-azuretools.vscode-docker", // Docker extension for Visual Studio Code
-    "GitHub.copilot-chat", // GitHub Copilot AI pair programmer for Visual Studio Code
+    "GitHub.copilot", // GitHub Copilot AI pair programmer for Visual Studio Code
     "GitHub.vscode-pull-request-github", // GitHub Pull Requests extension for Visual Studio Code
     "charliermarsh.ruff", // Ruff code formatter for Python to follow the Ruff Style Guide
     "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing
-    "stylelint.vscode-stylelint", // Stylelint extension for CSS and SCSS linting
-    "redhat.vscode-yaml", // YAML extension for Visual Studio Code
-    "dbaeumer.vscode-eslint", // ESLint extension for TypeScript linting
   ]
 }

.vscode/settings.json

@@ -2,20 +2,13 @@
   "editor.wordSegmenterLocales": "",
   "editor.guides.bracketPairs": "active",
   "editor.guides.bracketPairsHorizontal": "active",
-  "editor.defaultFormatter": "EditorConfig.EditorConfig",
   "cSpell.enabled": false,
-  "[feature]": {
-    "editor.defaultFormatter": "alexkrechik.cucumberautocomplete"
-  },
   "[java]": {
     "editor.defaultFormatter": "josevseb.google-java-format-for-vs-code"
   },
   "[jsonc]": {
     "editor.defaultFormatter": "vscode.json-language-features"
   },
-  "[css]": {
-    "editor.defaultFormatter": "stylelint.vscode-stylelint"
-  },
   "[json]": {
     "editor.defaultFormatter": "vscode.json-language-features"
   },
@@ -34,14 +27,11 @@
   "[gradle]": {
     "editor.defaultFormatter": "vscjava.vscode-gradle"
   },
-  "[yaml]": {
-    "editor.defaultFormatter": "redhat.vscode-yaml"
-  },
   "java.compile.nullAnalysis.mode": "automatic",
   "java.configuration.updateBuildConfiguration": "interactive",
   "java.format.enabled": true,
   "java.format.settings.profile": "GoogleStyle",
-  "java.format.settings.google.version": "1.28.0",
+  "java.format.settings.google.version": "1.27.0",
   "java.format.settings.google.extra": "--aosp --skip-sorting-imports --skip-javadoc-formatting",
   // (DE) Aktiviert Kommentare im Java-Format.
   // (EN) Enables comments in Java formatting.
@@ -80,17 +70,13 @@
     ".venv*/",
     ".vscode/",
     "bin/",
-    "app/core/bin/",
-    "app/common/bin/",
-    "app/proprietary/bin/",
+    "common/bin/",
+    "proprietary/bin/",
     "build/",
-    "app/core/build/",
-    "app/common/build/",
-    "app/proprietary/build/",
+    "common/build/",
+    "proprietary/build/",
     "configs/",
-    "app/core/configs/",
     "customFiles/",
-    "app/core/customFiles/",
     "docs/",
     "exampleYmlFiles",
     "gradle/",
@@ -102,9 +88,8 @@
     ".git-blame-ignore-revs",
     ".gitattributes",
     ".gitignore",
-    "app/core/.gitignore",
-    "app/common/.gitignore",
-    "app/proprietary/.gitignore",
+    "common/.gitignore",
+    "proprietary/.gitignore",
     ".pre-commit-config.yaml",
   ],
   // Enables signature help in Java.
@@ -134,13 +119,9 @@
   "html.format.indentHandlebars": true,
   "html.format.preserveNewLines": true,
   "html.format.maxPreserveNewLines": 2,
-  "stylelint.configFile": "devTools/.stylelintrc.json",
   "java.project.sourcePaths": [
-    "app/core/src/main/java",
-    "app/common/src/main/java",
-    "app/proprietary/src/main/java"
-  ],
-  "[typescript]": {
-    "editor.defaultFormatter": "vscode.typescript-language-features"
-  }
+    "stirling-pdf/src/main/java",
+    "common/src/main/java",
+    "proprietary/src/main/java"
+  ]
 }

ADDING_TOOLS.md

@@ -1,292 +0,0 @@
-# Adding New React Tools to Stirling PDF
-
-This guide covers how to add new PDF tools to the React frontend.
-
-## Overview
-
-When adding tools, follow this systematic approach using the established patterns and architecture.
-
-## 1. Create Tool Structure
-
-Create these files in the correct directories:
-```
-frontend/editor/src/hooks/tools/[toolName]/
-  ├── use[ToolName]Parameters.ts     # Parameter definitions and validation
-  └── use[ToolName]Operation.ts      # Tool operation logic using useToolOperation
-
-frontend/editor/src/components/tools/[toolName]/
-  └── [ToolName]Settings.tsx         # Settings UI component (if needed)
-
-frontend/editor/src/tools/
-  └── [ToolName].tsx                 # Main tool component
-```
-
-## 2. Implementation Pattern
-
-Use `useBaseTool` for simplified hook management. This is the recommended approach for all new tools:
-
-**Parameters Hook** (`use[ToolName]Parameters.ts`):
-```typescript
-import { BaseParameters } from '../../../types/parameters';
-import { useBaseParameters, BaseParametersHook } from '../shared/useBaseParameters';
-
-export interface [ToolName]Parameters extends BaseParameters {
-  // Define your tool-specific parameters here
-  someOption: boolean;
-}
-
-export const defaultParameters: [ToolName]Parameters = {
-  someOption: false,
-};
-
-export const use[ToolName]Parameters = (): BaseParametersHook<[ToolName]Parameters> => {
-  return useBaseParameters({
-    defaultParameters,
-    endpointName: 'your-endpoint-name',
-    validateFn: (params) => true, // Add validation logic
-  });
-};
-```
-
-**Operation Hook** (`use[ToolName]Operation.ts`):
-```typescript
-import { useTranslation } from 'react-i18next';
-import { ToolType, useToolOperation } from '../shared/useToolOperation';
-import { createStandardErrorHandler } from '../../../utils/toolErrorHandler';
-
-export const build[ToolName]FormData = (parameters: [ToolName]Parameters, file: File): FormData => {
-  const formData = new FormData();
-  formData.append('fileInput', file);
-  // Add parameters to formData
-  return formData;
-};
-
-export const [toolName]OperationConfig = {
-  toolType: ToolType.singleFile, // or ToolType.multiFile (buildFormData's file parameter will need to be updated)
-  buildFormData: build[ToolName]FormData,
-  operationType: '[toolName]',
-  endpoint: '/api/v1/category/endpoint-name',
-  filePrefix: 'processed_', // Will be overridden with translation
-  defaultParameters,
-} as const;
-
-export const use[ToolName]Operation = () => {
-  const { t } = useTranslation();
-  return useToolOperation({
-    ...[toolName]OperationConfig,
-    filePrefix: t('[toolName].filenamePrefix', 'processed') + '_',
-    getErrorMessage: createStandardErrorHandler(t('[toolName].error.failed', 'Operation failed'))
-  });
-};
-```
-
-**Main Component** (`[ToolName].tsx`):
-```typescript
-import { useTranslation } from "react-i18next";
-import { createToolFlow } from "../components/tools/shared/createToolFlow";
-import { use[ToolName]Parameters } from "../hooks/tools/[toolName]/use[ToolName]Parameters";
-import { use[ToolName]Operation } from "../hooks/tools/[toolName]/use[ToolName]Operation";
-import { useBaseTool } from "../hooks/tools/shared/useBaseTool";
-import { BaseToolProps, ToolComponent } from "../types/tool";
-
-const [ToolName] = (props: BaseToolProps) => {
-  const { t } = useTranslation();
-  const base = useBaseTool('[toolName]', use[ToolName]Parameters, use[ToolName]Operation, props);
-
-  return createToolFlow({
-    files: {
-      selectedFiles: base.selectedFiles,
-      isCollapsed: base.hasResults,
-      placeholder: t("[toolName].files.placeholder", "Select files to get started"),
-    },
-    steps: [
-      // Add settings steps if needed
-    ],
-    executeButton: {
-      text: t("[toolName].submit", "Process"),
-      isVisible: !base.hasResults,
-      loadingText: t("loading"),
-      onClick: base.handleExecute,
-      disabled: !base.params.validateParameters() || !base.hasFiles || !base.endpointEnabled,
-    },
-    review: {
-      isVisible: base.hasResults,
-      operation: base.operation,
-      title: t("[toolName].results.title", "Results"),
-      onFileClick: base.handleThumbnailClick,
-      onUndo: base.handleUndo,
-    },
-  });
-};
-
-[ToolName].tool = () => use[ToolName]Operation;
-export default [ToolName] as ToolComponent;
-```
-
-**Note**: Some existing tools (like AddPassword, Compress) use a legacy pattern with manual hook management. **Always use the Modern Pattern above for new tools** - it's cleaner, more maintainable, and includes automation support.
-
-## 3. Register Tool in System
-Update these files to register your new tool:
-
-**Tool Registry** (`frontend/editor/src/data/useTranslatedToolRegistry.tsx`):
-1. Add imports at the top:
-```typescript
-import [ToolName] from "../tools/[ToolName]";
-import { [toolName]OperationConfig } from "../hooks/tools/[toolName]/use[ToolName]Operation";
-import [ToolName]Settings from "../components/tools/[toolName]/[ToolName]Settings";
-```
-
-2. Add tool entry in the `allTools` object:
-```typescript
-[toolName]: {
-  icon: <LocalIcon icon="your-icon-name" width="1.5rem" height="1.5rem" />,
-  name: t("home.[toolName].title", "Tool Name"),
-  component: [ToolName],
-  description: t("home.[toolName].desc", "Tool description"),
-  categoryId: ToolCategoryId.STANDARD_TOOLS, // or appropriate category
-  subcategoryId: SubcategoryId.APPROPRIATE_SUBCATEGORY,
-  maxFiles: -1, // or specific number
-  endpoints: ["endpoint-name"],
-  operationConfig: [toolName]OperationConfig,
-  settingsComponent: [ToolName]Settings, // if settings exist
-},
-```
-
-## 4. Add Tooltips (Optional but Recommended)
-Create user-friendly tooltips to help non-technical users understand your tool. **Use simple, clear language - avoid technical jargon:**
-
-**Tooltip Hook** (`frontend/editor/src/components/tooltips/use[ToolName]Tips.ts`):
-```typescript
-import { useTranslation } from 'react-i18next';
-import { TooltipContent } from '../../types/tips';
-
-export const use[ToolName]Tips = (): TooltipContent => {
-  const { t } = useTranslation();
-
-  return {
-    header: {
-      title: t("[toolName].tooltip.header.title", "Tool Overview")
-    },
-    tips: [
-      {
-        title: t("[toolName].tooltip.description.title", "What does this tool do?"),
-        description: t("[toolName].tooltip.description.text", "Simple explanation in everyday language that non-technical users can understand."),
-        bullets: [
-          t("[toolName].tooltip.description.bullet1", "Easy-to-understand benefit 1"),
-          t("[toolName].tooltip.description.bullet2", "Easy-to-understand benefit 2")
-        ]
-      }
-      // Add more tip sections as needed
-    ]
-  };
-};
-```
-
-**Add tooltip to your main component:**
-```typescript
-import { use[ToolName]Tips } from "../components/tooltips/use[ToolName]Tips";
-
-const [ToolName] = (props: BaseToolProps) => {
-  const tips = use[ToolName]Tips();
-
-  // In your steps array:
-  steps: [
-    {
-      title: t("[toolName].steps.settings", "Settings"),
-      tooltip: tips, // Add this line
-      content: <[ToolName]Settings ... />
-    }
-  ]
-```
-
-## 5. Add Translations
-Update translation files. **Important: Only update `en-US` files** - other languages are handled separately.
-
-**File to update:** `frontend/editor/public/locales/en-US/translation.toml`
-
-**Required Translation Keys**:
-```toml
-{
-  "home": {
-    "[toolName]": {
-      "title": "Tool Name",
-      "desc": "Tool description"
-    }
-  },
-  "[toolName]": {
-    "title": "Tool Name",
-    "submit": "Process",
-    "filenamePrefix": "processed",
-    "files": {
-      "placeholder": "Select files to get started"
-    },
-    "steps": {
-      "settings": "Settings"
-    },
-    "options": {
-      "title": "Tool Options",
-      "someOption": "Option Label",
-      "someOption.desc": "Option description",
-      "note": "General information about the tool."
-    },
-    "results": {
-      "title": "Results"
-    },
-    "error": {
-      "failed": "Operation failed"
-    },
-    "tooltip": {
-      "header": {
-        "title": "Tool Overview"
-      },
-      "description": {
-        "title": "What does this tool do?",
-        "text": "Simple explanation in everyday language",
-        "bullet1": "Easy-to-understand benefit 1",
-        "bullet2": "Easy-to-understand benefit 2"
-      }
-    }
-  }
-}
-```
-
-**Translation Notes:**
-- **Only update `en-US/translation.toml`** - other locale files are managed separately
-- Use descriptive keys that match your component's `t()` calls
-- Include tooltip translations if you created tooltip hooks
-- Add `options.*` keys if your tool has settings with descriptions
-
-**Tooltip Writing Guidelines:**
-- **Use simple, everyday language** - avoid technical terms like "converts interactive elements"
-- **Focus on benefits** - explain what the user gains, not how it works internally
-- **Use concrete examples** - "text boxes become regular text" vs "form fields are flattened"
-- **Answer user questions** - "What does this do?", "When should I use this?", "What's this option for?"
-- **Keep descriptions concise** - 1-2 sentences maximum per section
-- **Use bullet points** for multiple benefits or features
-
-## 6. Testing Your Tool
-- Verify tool appears in UI with correct icon and description
-- Test with various file sizes and types
-- Confirm translations work
-- Check error handling
-- Test undo functionality
-- Verify results display correctly
-
-## Tool Development Patterns
-
-### Three Tool Patterns:
-
-**Pattern 1: Single-File Tools** (Individual processing)
-- Backend processes one file per API call
-- Set `multiFileEndpoint: false`
-- Examples: Compress, Rotate
-
-**Pattern 2: Multi-File Tools** (Batch processing)
-- Backend accepts `MultipartFile[]` arrays in single API call
-- Set `multiFileEndpoint: true`
-- Examples: Split, Merge, Overlay
-
-**Pattern 3: Complex Tools** (Custom processing)
-- Tools with complex routing logic or non-standard processing
-- Provide `customProcessor` for full control
-- Examples: Convert, OCR

AGENTS.md

@@ -1,509 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to AI Agents when working with code in this repository.
-
-## Taskfile (Recommended)
-
-This project uses [Task](https://taskfile.dev/) as a unified command runner. All build, dev, test, lint, and docker commands can be run from the repo root via `task <command>`. Run `task --list` to see all available commands.
-
-Task `desc:` fields should describe **what** the task does, not **how** it does it. Keep them generic and stable: don't reference implementation details like aliases, internal helpers, mode flags, or which other task delegates to which. The description is for users picking a command from `task --list`, not a changelog of refactors.
-
-### Quick Reference
-- `task install` — install all dependencies
-- `task dev` — start backend + frontend concurrently
-- `task dev:all` — start backend + frontend + engine concurrently
-- `task build` — build all components
-- `task test` — run all tests (backend + frontend + engine)
-- `task lint` — run all linters
-- `task format` — auto-fix formatting across all components
-- `task check` — full quality gate (lint + typecheck + test)
-- `task clean` — clean all build artifacts
-- `task docker:build` — build standard Docker image
-- `task docker:up` — start Docker compose stack
-
-## Common Development Commands
-
-### Build and Test
-- **Build project**: `task build`
-- **Run backend locally**: `task backend:dev`
-- **Run all tests**: `task test` (or individually: `task backend:test`, `task frontend:test`, `task engine:test`)
-- **Docker integration tests**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
-- **Code formatting**: `task format` (or `task backend:format` for Java only)
-- **Full quality gate**: `task check` (runs lint + typecheck + test across all components)
-
-After modifying any files in the project, you must run the relevant `task check` command that covers that area of the code. For example, when editing frontend files run `task frontend:check`; for Python engine files run `task engine:check`; for Java backend files run `task backend:check`.
-
-### Docker Development
-- **Build standard**: `task docker:build` (or `docker build -t stirling-pdf -f docker/embedded/Dockerfile .`)
-- **Build fat version**: `task docker:build:fat`
-- **Build ultra-lite**: `task docker:build:ultra-lite`
-- **Start compose stack**: `task docker:up` (or `task docker:up:fat`, `task docker:up:ultra-lite`)
-- **Stop compose stack**: `task docker:down`
-- **View logs**: `task docker:logs`
-- **Example compose files**: Located in `exampleYmlFiles/` directory
-
-### Security Mode Development
-Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.
-
-### Python Development (AI Engine)
-
-The engine is a Python reasoning service for Stirling: it plans and interprets work, but it does not own durable state, and it does not execute Stirling PDF operations directly. Keep the service narrow: typed contracts in, typed contracts out, with AI only where it adds reasoning value. The frontend calls the Python engine via Java as a proxy.
-
-#### Python Commands
-All engine commands run from the repo root using Task:
-- `task engine:check` — run all checks (typecheck + lint + format-check + test)
-- `task engine:fix` — auto-fix lint + formatting
-- `task engine:install` — install Python dependencies via uv
-- `task engine:dev` — start FastAPI with hot reload (localhost:5001)
-- `task engine:test` — run pytest
-- `task engine:lint` — run ruff linting
-- `task engine:typecheck` — run pyright
-- `task engine:format` — format code with ruff
-- `task engine:tool-models` — generate `tool_models.py` from the Java OpenAPI spec
-
-The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `task engine:install`.
-
-#### Python Code Style
-- Keep `task engine:check` passing.
-- Use modern Python when it improves clarity.
-- Prefer explicit names to cleverness.
-- Avoid nested functions and nested classes unless the language construct requires them.
-- Prefer composition to inheritance when combining concepts.
-- Avoid speculative abstractions. Add a layer only when it removes real duplication or clarifies lifecycle.
-- Add comments sparingly and only when they explain non-obvious intent.
-
-#### Python Typing and Models
-- Deserialize into Pydantic models as early as possible.
-- Serialize from Pydantic models as late as possible.
-- Do not pass raw `dict[str, Any]` or `dict[str, object]` across important boundaries when a typed model can exist instead.
-- Avoid `Any` wherever possible.
-- Avoid `cast()` wherever possible (reconsider the structure first).
-- All shared models should subclass `stirling.models.ApiModel` so the service behaves consistently.
-- Do not use string literals for any type annotations, including `cast()`.
-
-#### Python Configuration
-- Keep application-owned configuration in `stirling.config`.
-- Only add `STIRLING_*` environment variables that the engine itself truly owns.
-- Do not mirror third-party provider environment variables unless the engine is actually interpreting them.
-- Let `pydantic-ai` own provider authentication configuration when possible.
-
-#### Python Architecture
-
-**Package roles:**
-- `stirling.contracts`: request/response models and shared typed workflow contracts. If a shape crosses a module or service boundary, it probably belongs here.
-- `stirling.models`: shared model primitives and generated tool models.
-- `stirling.agents`: reasoning modules for individual capabilities.
-- `stirling.api`: HTTP layer, dependency access, and app startup wiring.
-- `stirling.services`: shared runtime and non-AI infrastructure.
-- `stirling.config`: application-owned settings.
-
-**Source of truth:**
-- `stirling.models.tool_models` is the source of truth for operation IDs and parameter models.
-- Do not duplicate operation lists if they can be derived from `tool_models.OPERATIONS`.
-- Do not hand-maintain parallel parameter schemas when the generated tool models already define them.
-- If a tool ID must match a parameter model, validate that relationship explicitly in code.
-
-**Boundaries:**
-- Keep the API layer thin. Route modules should bind requests, resolve dependencies, and call agents or services. They should not contain business logic.
-- Keep agents focused on one reasoning domain. They should not own FastAPI routing, persistence, or execution of Stirling operations.
-- Build long-lived runtime objects centrally at startup when possible rather than reconstructing heavy AI objects per request.
-- If an agent delegates to another agent, the delegated agent should remain the source of truth for its own domain output.
-
-#### Python AI Usage
-- The system must work with any AI, including self-hosted models. We require that the models support structured outputs, but should minimise model-specific code beyond that.
-- Use AI for reasoning-heavy outputs, not deterministic glue.
-- Do not ask the model to invent data that Python can derive safely.
-- Do not fabricate fallback user-facing copy in code to hide incomplete model output.
-- AI output schemas should be impossible to instantiate incorrectly.
-  - Do not require the model to keep separate structures in sync. For example, instead of generating two lists which must be the same length, generate one list of a model containing the same data.
-  - Prefer Python to derive deterministic follow-up structure from a valid AI result.
-- Use `NativeOutput(...)` for structured model outputs.
-- Use `ToolOutput(...)` when the model should select and call delegate functions.
-
-#### Python Testing
-- Test contracts directly.
-- Test agents directly where behaviour matters.
-- Test API routes as thin integration points.
-- Prefer dependency overrides or startup-state seams to monkeypatching random globals.
-
-### Frontend Development
-- **Frontend dev server**: `task frontend:dev` — requires backend on localhost:8080
-- **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
-- **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
-- **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
-- **Package Installation**: `task frontend:install`
-- **Deployment Options**:
-  - **Desktop App**: `task desktop:build`
-  - **Web Server**: `task frontend:build` then serve dist/ folder
-  - **Development**: `task desktop:dev` for desktop dev mode
-
-#### Environment Variables
-- All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/editor/.env` — core and shared vars (base, loaded in every mode)
-  - `frontend/editor/.env.proprietary` — proprietary-only vars, e.g. the admin portal's SaaS/account-link keys (layered on top of `.env` in proprietary mode)
-  - `frontend/editor/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/editor/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
-- These files are committed to Git and must not contain private keys
-- Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
-- Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
-- `task frontend:prepare` creates empty `.local` override files on first run; pass `MODE=saas` or `MODE=desktop` to also create the mode-specific `.local` file
-- Prepare runs automatically as a dependency of all `dev*`, `build*`, and `desktop*` tasks
-- See `frontend/README.md#environment-variables` for full documentation
-
-#### Import Paths - CRITICAL
-**ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
-
-For a broader explanation of the frontend layering and override architecture, read @frontend/editor/DeveloperGuide.md
-
-```typescript
-// ✅ CORRECT - Use @app/* for all imports
-import { AppLayout } from "@app/components/AppLayout";
-import { useFileContext } from "@app/contexts/FileContext";
-import { FileContext } from "@app/contexts/FileContext";
-
-// ❌ WRONG - Do not use @core/* or @proprietary/* in normal code
-import { AppLayout } from "@core/components/AppLayout";
-import { useFileContext } from "@proprietary/contexts/FileContext";
-```
-
-**Only use explicit aliases when:**
-- Building layer-specific override that wraps a lower layer's component
-- Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
-
-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/saas/desktop/cloud) and handles the fallback cascade — see "Frontend `cloud/` Layer" below for the full per-flavor order.
-
-#### Frontend `cloud/` Layer
-
-`@app/*` resolves through a per-flavor cascade — first existing file wins (shadow/override):
-
-- **core** → core
-- **proprietary** → proprietary → core
-- **saas** → saas → cloud → proprietary → core
-- **desktop** → desktop → cloud → proprietary → core
-- **cloud** → cloud → proprietary → core
-
-What goes where:
-
-- **core** — OSS base.
-- **proprietary** — licensed / offline features.
-- **cloud** — the SHARED hosted/SaaS experience used by BOTH saas + desktop: PAYG, wallet, plan, billing, usage meters, cloud config/team/onboarding.
-- **saas** — web-only: Supabase web auth, AuthCallback, avatar canvas, `window.location`.
-- **desktop** — Tauri-only: keyring authService, tauriHttpClient, native files/windows, backend routing.
-
-`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (enforced by ESLint). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
-
-Rule of thumb — **move, don't copy**: share via `cloud/`, override by shadowing the same `@app/*` path in a leaf (`saas/` or `desktop/`).
-
-**Cloud feature flags on desktop.** The local `AppConfigContext` reads `/api/v1/config/app-config` from the LOCAL bundled backend, so cloud-only flags (`aiEngineEnabled`, `premiumEnabled`, …) are never seen on desktop. To read the cloud's view, use `useSaasAppConfig()` (`desktop/hooks/useSaasAppConfig.ts`, backed by the general `saasAppConfigService` — SaaS-mode-only, public endpoint, native HTTP, 5-min cache). It returns `null` outside SaaS mode, so cloud features stay off in local/self-hosted and the server keeps the on/off switch (no desktop release needed to flip a flag). Gate a feature behind a per-platform seam — e.g. `useAiEngineEnabled()` (core reads `useAppConfig()`, desktop reads `useSaasAppConfig()`) — rather than hardcoding the flag on.
-
-#### Component Override Pattern (Stub/Shadow)
-Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
-
-**How it works:**
-1. Core defines stub component (returns null or no-op)
-2. Desktop/proprietary overrides with same path/name
-3. Core imports via `@app/*` - higher layer "shadows" core in those builds
-4. No `@ts-ignore`, no `isTauri()` checks, no runtime conditionals!
-
-**Example - Desktop-specific footer:**
-
-```typescript
-// core/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (stub)
-interface WorkbenchBarFooterExtensionsProps {
-  className?: string;
-}
-
-export function WorkbenchBarFooterExtensions(_props: WorkbenchBarFooterExtensionsProps) {
-  return null; // Stub - does nothing in web builds
-}
-```
-
-```tsx
-// desktop/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (real implementation)
-import { Box } from '@mantine/core';
-import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
-
-interface WorkbenchBarFooterExtensionsProps {
-  className?: string;
-}
-
-export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterExtensionsProps) {
-  return (
-    <Box className={className}>
-      <BackendHealthIndicator />
-    </Box>
-  );
-}
-```
-
-```tsx
-// core/components/shared/WorkbenchBar.tsx (usage - works in ALL builds)
-import { WorkbenchBarFooterExtensions } from '@app/components/workbenchBar/WorkbenchBarFooterExtensions';
-
-export function WorkbenchBar() {
-  return (
-    <div>
-      {/* In web builds: renders nothing (stub returns null) */}
-      {/* In desktop builds: renders BackendHealthIndicator */}
-      <WorkbenchBarFooterExtensions className="workbench-bar-footer" />
-    </div>
-  );
-}
-```
-
-**Build resolution:**
-- **Core build**: `@app/*` → `core/*` → Gets stub (returns null)
-- **Desktop build**: `@app/*` → `desktop/*` → Gets real implementation (shadows core)
-
-**Benefits:**
-- No runtime checks or feature flags
-- Type-safe across all builds
-- Clean, readable code
-- Build-time optimization (dead code elimination)
-
-#### Multi-Tool Workflow Architecture
-Frontend designed for **stateful document processing**:
-- Users upload PDFs once, then chain tools (split → merge → compress → view)
-- File state and processing results persist across tool switches
-- No file reloading between tools - performance critical for large PDFs (up to 100GB+)
-
-#### FileContext - Central State Management
-**Location**: `frontend/editor/src/core/contexts/FileContext.tsx`
-- **Active files**: Currently loaded PDFs and their variants
-- **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
-- **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
-- **IndexedDB persistence**: File storage with thumbnail caching
-- **Preview system**: Tools can preview results (e.g., Split → Viewer → back to Split) without context pollution
-
-**Critical**: All file operations go through FileContext. Don't bypass with direct file handling.
-
-#### Processing Services
-- **enhancedPDFProcessingService**: Background PDF parsing and manipulation
-- **thumbnailGenerationService**: Web Worker-based with main-thread fallback
-- **fileStorage**: IndexedDB with LRU cache management
-
-#### Memory Management Strategy
-**Why manual cleanup exists**: Large PDFs (up to 100GB+) through multiple tools accumulate:
-- PDF.js documents that need explicit .destroy() calls
-- Blob URLs from tool outputs that need revocation
-- Web Workers that need termination
-Without cleanup: browser crashes with memory leaks.
-
-#### Tool Development
-
-**Architecture**: Modular hook-based system with clear separation of concerns:
-
-- **useToolOperation** (`frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
-  - Coordinates all tool operations with consistent interface
-  - Integrates with FileContext for operation tracking
-  - Handles validation, error handling, and UI state management
-
-- **Supporting Hooks**:
-  - **useToolState**: UI state management (loading, progress, error, files)
-  - **useToolApiCalls**: HTTP requests and file processing
-  - **useToolResources**: Blob URLs, thumbnails, ZIP downloads
-
-- **Utilities**:
-  - **toolErrorHandler**: Standardized error extraction and i18n support
-  - **toolResponseProcessor**: API response handling (single/zip/custom)
-  - **toolOperationTracker**: FileContext integration utilities
-
-**Three Tool Patterns**:
-
-**Pattern 1: Single-File Tools** (Individual processing)
-- Backend processes one file per API call
-- Set `multiFileEndpoint: false`
-- Examples: Compress, Rotate
-```typescript
-return useToolOperation({
-  operationType: 'compress',
-  endpoint: '/api/v1/misc/compress-pdf',
-  buildFormData: (params, file: File) => { /* single file */ },
-  multiFileEndpoint: false,
-});
-```
-
-**Pattern 2: Multi-File Tools** (Batch processing)
-- Backend accepts `MultipartFile[]` arrays in single API call
-- Set `multiFileEndpoint: true`
-- Examples: Split, Merge, Overlay
-```typescript
-return useToolOperation({
-  operationType: 'split',
-  endpoint: '/api/v1/general/split-pages',
-  buildFormData: (params, files: File[]) => { /* all files */ },
-  multiFileEndpoint: true,
-  filePrefix: 'split_',
-});
-```
-
-**Pattern 3: Complex Tools** (Custom processing)
-- Tools with complex routing logic or non-standard processing
-- Provide `customProcessor` for full control
-- Examples: Convert, OCR
-```typescript
-return useToolOperation({
-  operationType: 'convert',
-  customProcessor: async (params, files) => { /* custom logic */ },
-});
-```
-
-**Benefits**:
-- **No Timeouts**: Operations run until completion (supports 100GB+ files)
-- **Consistent**: All tools follow same pattern and interface
-- **Maintainable**: Single responsibility hooks, easy to test and modify
-- **i18n Ready**: Built-in internationalization support
-- **Type Safe**: Full TypeScript support with generic interfaces
-- **Memory Safe**: Automatic resource cleanup and blob URL management
-
-## Architecture Overview
-
-### Project Structure
-- **Backend**: Spring Boot application
-- **Frontend**: React-based SPA in `/frontend` directory
-  - **File Storage**: IndexedDB for client-side file persistence and thumbnails
-  - **Internationalization**: JSON-based translations (converted from backend .properties)
-- **PDF Processing**: PDFBox for core PDF operations, LibreOffice for conversions, PDF.js for client-side rendering
-- **Security**: Spring Security with optional authentication (controlled by `DOCKER_ENABLE_SECURITY`)
-- **Configuration**: YAML-based configuration with environment variable overrides
-
-### Controller Architecture
-- **API Controllers** (`src/main/java/.../controller/api/`): REST endpoints for PDF operations
-  - Organized by function: converters, security, misc, pipeline
-  - Follow pattern: `@RestController` + `@RequestMapping("/api/v1/...")`
-
-### Key Components
-- **SPDFApplication.java**: Main application class with desktop UI and browser launching logic
-- **ConfigInitializer**: Handles runtime configuration and settings files
-- **Pipeline System**: Automated PDF processing workflows via `PipelineController`
-- **Security Layer**: Authentication, authorization, and user management (when enabled)
-
-### Frontend Directory Structure
-The frontend is organized with a clear separation of concerns:
-
-- **`frontend/editor/src/core/`**: Main application code (shared, production-ready components)
-  - **`core/components/`**: React components organized by feature
-    - `core/components/tools/`: Individual PDF tool implementations
-    - `core/components/viewer/`: PDF viewer components
-    - `core/components/pageEditor/`: Page manipulation UI
-    - `core/components/tooltips/`: Help tooltips for tools
-    - `core/components/shared/`: Reusable UI components
-  - **`core/contexts/`**: React Context providers
-    - `FileContext.tsx`: Central file state management
-    - `file/`: File reducer and selectors
-    - `toolWorkflow/`: Tool workflow state
-  - **`core/hooks/`**: Custom React hooks
-    - `hooks/tools/`: Tool-specific operation hooks (one directory per tool)
-    - `hooks/tools/shared/`: Shared hook utilities (useToolOperation, etc.)
-  - **`core/constants/`**: Application constants and configuration
-  - **`core/data/`**: Static data (tool taxonomy, etc.)
-  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)
-
-- **`frontend/editor/src/desktop/`**: Desktop-specific (Tauri) code
-- **`frontend/editor/src/proprietary/`**: Proprietary/licensed features
-- **`frontend/editor/src-tauri/`**: Tauri (Rust) native desktop application code
-- **`frontend/editor/public/`**: Static assets served directly
-  - `public/locales/`: Translation JSON files
-
-### Component Architecture
-- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/editor/public/` (modern)
-- **Internationalization**:
-  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/editor/public/locales/` (converted from .properties)
-  - Conversion Script: `scripts/convert_properties_to_json.py`
-
-### Configuration Modes
-- **Ultra-lite**: Basic PDF operations only
-- **Standard**: Full feature set
-- **Fat**: Pre-downloaded dependencies for air-gapped environments
-- **Security Mode**: Adds authentication, user management, and enterprise features
-
-### Testing Strategy
-- **Integration Tests**: Cucumber tests in `testing/cucumber/`
-- **Docker Testing**: `test.sh` validates all Docker variants
-- **Manual Testing**: No unit tests currently - relies on UI and API testing
-
-## Development Workflow
-
-1. **Local Development** (using Taskfile):
-   - Backend + frontend: `task dev`
-   - All services (including AI engine): `task dev:all`
-   - Or individually: `task backend:dev` (localhost:8080), `task frontend:dev` (localhost:5173), `task engine:dev` (localhost:5001)
-2. **Quality Gate**: Run `task check` before submitting PRs
-3. **Docker Testing**: Use `./test.sh` for full Docker integration tests
-4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
-5. **Translations**:
-   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/editor/public/locales/` or use conversion script
-6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
-
-## Frontend Architecture Status
-
-- **Core Status**: React SPA architecture complete with multi-tool workflow support
-- **State Management**: FileContext handles all file operations and tool navigation
-- **File Processing**: Production-ready with memory management for large PDF workflows (up to 100GB+)
-- **Tool Integration**: Modular hook architecture with `useToolOperation` orchestrator
-  - Individual hooks: `useToolState`, `useToolApiCalls`, `useToolResources`
-  - Utilities: `toolErrorHandler`, `toolResponseProcessor`, `toolOperationTracker`
-  - Pattern: Each tool creates focused operation hook, UI consumes state/actions
-- **Preview System**: Tool results can be previewed without polluting file context (Split tool example)
-- **Performance**: Web Worker thumbnails, IndexedDB persistence, background processing
-
-## Translation Rules
-
-- **CRITICAL**: Always update translations in `en-US` only - all other languages (including `en-GB`) are handled separately
-- Translation files are located in `frontend/editor/public/locales/`
-- After changing any translation file, run `task pre-commit:fix`
-
-## Important Notes
-
-- **Java Version**: Requires JDK 25.
-- **Lombok**: Used extensively - ensure IDE plugin is installed
-- **File Persistence**:
-  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
-  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
-- **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
-- **Import Paths**: ALWAYS use `@app/*` for imports - never use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer
-- **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
-- **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
-- **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
-- **Performance Target**: Must handle PDFs up to 100GB+ without browser crashes
-- **Preview System**: Tools can preview results without polluting main file context (see Split tool implementation)
-- **Adding Tools**: See `ADDING_TOOLS.md` for complete guide to creating new PDF tools
-
-## Communication Style
-- Be direct and to the point
-- No apologies or conversational filler
-- Answer questions directly without preamble
-- Explain reasoning concisely when asked
-- Avoid unnecessary elaboration
-
-## Decision Making
-- Ask clarifying questions before making assumptions
-- Stop and ask when uncertain about project-specific details
-- Confirm approach before making structural changes
-- Request guidance on preferences (cross-platform vs specific tools, etc.)
-- Verify understanding of requirements before proceeding
-
-
-## Stack reality check (don't trust LLM training data) <!-- bleeding-edge-stack-note -->
-
-This codebase is on bleeding-edge versions of its core JVM stack: **Spring Boot 4.0.6**,
-**Jackson 3 (`tools.jackson`)**, **JDK 21/25 source/target with JDK 25 toolchain**.
-All three are *post*-2024 releases and your training corpus is overwhelmingly Spring Boot 2/3 and
-Jackson 2 patterns — those patterns will compile, run differently, or hallucinate APIs that no
-longer exist.
-
-Before writing or editing Spring / Jackson / JDK code:
-
-1. Open an existing module in `app/core/` or `app/common/` and grep for the actual imports being
-   used — `import tools.jackson...` not `import com.fasterxml.jackson...`, and the new
-   `org.springframework.boot` 4.x package layout.
-2. If you're not sure whether an API exists in this stack version, **check the source on disk
-   first** (the dependency JARs are downloaded under `~/.gradle/caches/modules-2/`).
-3. Do not silently downgrade a Spring Boot 4 pattern to a Spring Boot 3 equivalent. If something
-   doesn't work, surface it to the human — don't guess.
-
-Same goes for Jackson 3's API surface (renamed `ObjectMapper` builder methods, new
-`tools.jackson.databind` namespace) and JDK 25 preview features. Ground your code in this repo's
-actual imports, not what worked three years ago.

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md