fix(payg): land limit-modal CTAs on the Plan section (fix at the source)

My previous swap to openPlanSettings() regressed: openAppSettings dispatches
appConfig:open, which nothing listens for, so the modal never opened at all.

Root cause: the config opener (QuickAccessBar) opens the modal whenever the path
is /settings/*, but it never carries the section, and AppConfigModal defaults
`active` to "overview" — so navigateToSettings("plan") opened config on Overview,
not Plan.

Fix: revert both modal CTAs to navigateToSettings("plan") (which does open the
modal via the URL), and have the saas AppConfigModal select its section from the
/settings/<section> path when it opens. This fixes the CTAs at the source and
makes any /settings/<section> deep link land correctly, with no event-timing race.

.dockerignore

@@ -26,8 +26,9 @@ version_builds/
 node_modules/
 **/node_modules/
 frontend/node_modules/
-frontend/dist/
-frontend/playwright-report/
+frontend/editor/dist/
+frontend/dist-portal/
+frontend/editor/playwright-report/
 .npm/
 .yarn/
 

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.11.0
+pkgver=2.12.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.11.0
+pkgver=2.12.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')

.github/scripts/verify-updater-signatures.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""Verify Tauri updater .sig files against plugins.updater.pubkey in tauri.conf.json.
+
+Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
+"""
+
+import binascii
+import sys
+import json
+import base64
+import hashlib
+from pathlib import Path
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.exceptions import InvalidSignature
+
+ART_ROOT = Path(sys.argv[1])
+CONF = Path(
+    sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json"
+)
+
+
+def load_pubkey():
+    # tauri pubkey = base64 of a minisign .pub file; last line is base64 of
+    # [2 algo][8 key-id][32 ed25519 public key].
+    raw = json.loads(CONF.read_text())["plugins"]["updater"]["pubkey"]
+    blob = base64.b64decode(base64.b64decode(raw).decode().splitlines()[-1])
+    return blob[2:10], Ed25519PublicKey.from_public_bytes(blob[10:])
+
+
+def hash_file(path: Path) -> bytes:
+    h = hashlib.blake2b(digest_size=64)
+    with path.open("rb") as f:
+        for chunk in iter(lambda: f.read(1 << 16), b""):
+            h.update(chunk)
+    return h.digest()
+
+
+def verify(artifact: Path, sig_file: Path, keyid_pub, pub) -> str:
+    # tauri .sig = base64 of a minisign signature file (4 lines).
+    try:
+        lines = base64.b64decode(sig_file.read_text()).decode().splitlines()
+        sig_blob = base64.b64decode(lines[1])
+    except (binascii.Error, IndexError, UnicodeDecodeError) as e:
+        return f"FAIL malformed sig ({type(e).__name__})"
+    algo, keyid, sig = sig_blob[:2], sig_blob[2:10], sig_blob[10:74]
+    if keyid != keyid_pub:
+        return f"FAIL key-id mismatch (sig {keyid.hex()} vs pub {keyid_pub.hex()})"
+    # 'ED' = prehashed (BLAKE2b-512), 'Ed' = legacy (raw message).
+    msg = hash_file(artifact) if algo == b"ED" else artifact.read_bytes()
+    try:
+        pub.verify(sig, msg)
+    except InvalidSignature:
+        return f"FAIL signature invalid (algo={algo.decode()})"
+    # Global signature covers sig + trusted_comment.
+    gc = "global-sig FAIL"
+    try:
+        tc = lines[2].split("trusted comment: ", 1)[1]
+        pub.verify(base64.b64decode(lines[3]), sig + tc.encode())
+        gc = "global-sig OK"
+    except (InvalidSignature, IndexError, binascii.Error):
+        pass
+    return f"VALID (algo={algo.decode()}, keyid={keyid.hex()}, {gc})"
+
+
+keyid_pub, pub = load_pubkey()
+print(f"updater pubkey keyid={keyid_pub.hex()}\n")
+sigs = sorted(ART_ROOT.rglob("*.sig"))
+if not sigs:
+    print(f"WARN: no .sig files under {ART_ROOT} - nothing to verify")
+    sys.exit(0)
+bad = 0
+for sig_file in sigs:
+    artifact = sig_file.with_suffix("")
+    if not artifact.exists():
+        print(f"  ? {sig_file.name}: artifact missing")
+        bad += 1
+        continue
+    res = verify(artifact, sig_file, keyid_pub, pub)
+    print(f"  {artifact.name}: {res}")
+    if not res.startswith("VALID") or "global-sig FAIL" in res:
+        bad += 1
+print(f"\n{'ALL SIGNATURES VALID' if bad == 0 else f'{bad} SIGNATURE(S) FAILED'}")
+sys.exit(1 if bad else 0)

.github/workflows/backend-build.yml

@@ -1,8 +1,14 @@
 name: Backend build, format check, and coverage
 
 # Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × spring-security on/off), Spotless formatting check, JUnit, and
+# (JDK 25 × every flavor), Spotless formatting check, JUnit, and
 # posts Jacoco coverage to PRs.
+#
+# Flavor axis (maps to STIRLING_FLAVOR in settings.gradle):
+#   core         - DISABLE_ADDITIONAL_FEATURES=true, no proprietary, no saas
+#   proprietary  - default build, no saas
+#   saas         - proprietary + the saas subproject (build + JUnit only,
+#                  never any runtime/integration testing)
 on:
   workflow_call:
 
@@ -25,7 +31,7 @@ jobs:
       fail-fast: false
       matrix:
         jdk-version: [25]
-        spring-security: [true, false]
+        flavor: [core, proprietary, saas]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -58,7 +64,10 @@ jobs:
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Check Java formatting (Spotless)
-        if: matrix.jdk-version == 25 && matrix.spring-security == false
+        # Runs once per matrix combination - pick the cheapest leg
+        # (core - no proprietary, no saas) so we don't wait for the
+        # heavier flavors just to fail formatting.
+        if: matrix.jdk-version == 25 && matrix.flavor == 'core'
         id: spotless-check
         run: task backend:format:check
         continue-on-error: true
@@ -143,17 +152,24 @@ jobs:
               });
             }
 
-      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
+      - name: Build with Gradle (flavor=${{ matrix.flavor }})
+        # STIRLING_FLAVOR is read by settings.gradle and expands into the
+        # right combination of DISABLE_ADDITIONAL_FEATURES + ENABLE_SAAS
+        # so we don't have to set them by hand. The saas flavor pulls in
+        # the app/saas subproject (unit tests only - no runtime tests).
         run: task backend:build:ci
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
+          STIRLING_FLAVOR: ${{ matrix.flavor }}
 
       - name: Check Test Reports Exist
         if: always()
         run: |
+          # Common + core + proprietary always build (proprietary is
+          # excluded only at runtime, not from the gradle subproject
+          # graph). Saas builds add a fourth report dir.
           declare -a dirs=(
             "app/core/build/reports/tests/"
             "app/core/build/test-results/"
@@ -162,6 +178,9 @@ jobs:
             "app/proprietary/build/reports/tests/"
             "app/proprietary/build/test-results/"
           )
+          if [ "${{ matrix.flavor }}" = "saas" ]; then
+            dirs+=("app/saas/build/reports/tests/" "app/saas/build/test-results/")
+          fi
           for dir in "${dirs[@]}"; do
             if [ ! -d "$dir" ]; then
               echo "Missing $dir"
@@ -173,7 +192,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
+          name: test-reports-jdk-${{ matrix.jdk-version }}-flavor-${{ matrix.flavor }}
           path: |
             app/**/build/reports/jacoco/test
             app/**/build/reports/tests/
@@ -183,7 +202,47 @@ jobs:
           retention-days: 3
           if-no-files-found: warn
 
-      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py parses JaCoCo XML through defusedxml to
+        # silence security scanners that pattern-match on the stdlib
+        # xml.etree.ElementTree.parse call.
+        if: always() && matrix.flavor == 'saas'
+        run: python -m pip install --quiet defusedxml
+
+      - name: JaCoCo coverage step summary
+        # Only the saas leg posts the JUnit summary - it's a strict
+        # superset of the core + proprietary legs (same .exec files plus
+        # the saas subproject). Posting from all three would mean three
+        # near-identical tables crowding out the aggregate report.
+        if: always() && matrix.flavor == 'saas'
+        run: |
+          python scripts/coverage-summary.py \
+            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
+            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
+            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
+            --jacoco "proprietary=app/proprietary/build/reports/jacoco/test/jacocoTestReport.xml" \
+            --jacoco "saas=app/saas/build/reports/jacoco/test/jacocoTestReport.xml" \
+            --github-step-summary
+
+      - name: Upload raw JUnit .exec for aggregate merge
+        # Same dedup rationale as the summary step: upload from the saas
+        # leg only (the most complete set, includes app/saas/.../test.exec)
+        # so the aggregate workflow merges the union rather than three
+        # overlapping subsets.
+        #
+        # Separate artifact from the HTML reports so the aggregate
+        # workflow can grab just the .exec files with a name pattern
+        # (`jacoco-exec-*`) instead of unpacking the whole test-reports
+        # tarball.
+        if: always() && matrix.flavor == 'saas'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jacoco-exec-junit-jdk-${{ matrix.jdk-version }}
+          path: app/*/build/jacoco/*.exec
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: Add coverage to PR (flavor=${{ matrix.flavor }}, JDK=${{ matrix.jdk-version }})
         # The action only supports the pull_request event (it posts a PR comment),
         # so skip it for merge_group runs and workflow_dispatch.
         if: github.event_name == 'pull_request'

.github/workflows/build.yml

@@ -185,6 +185,24 @@ jobs:
     uses: ./.github/workflows/dependency-review.yml
     secrets: inherit
 
+  # Coverage aggregate: merges the JUnit + e2e:live + cucumber .exec
+  # artifacts produced by the jobs above into one report, plus pulls
+  # in vitest + Playwright frontend coverage for the per-area matrix.
+  # `if: always()` so a producer failing partway still gets credit
+  # for whatever did record. Advisory only - intentionally NOT in
+  # all-checks-passed, so a flaky aggregate run never blocks merging.
+  coverage-aggregate:
+    if: always()
+    needs:
+      - build
+      - playwright-e2e-live
+      - docker-compose-tests
+      - frontend-validation
+    permissions:
+      contents: read
+    uses: ./.github/workflows/coverage-aggregate.yml
+    secrets: inherit
+
   # Single status check that branch protection should mark as required.
   # Succeeds when every upstream job is either `success` or `skipped` (path-
   # gated jobs that didn't apply this run). Any `failure` or `cancelled`

.github/workflows/coverage-aggregate.yml

@@ -0,0 +1,230 @@
+name: Aggregate backend coverage
+
+# Reusable workflow called from build.yml after every backend coverage
+# producer (JUnit, e2e:live, cucumber) has run. Downloads each job's raw
+# .exec, merges them into one JaCoCo report, and posts a combined step
+# summary alongside the per-source ones.
+#
+# Kept separate from the per-source jobs so:
+#   - the per-source jobs stay fast and independent (no cross-job waits)
+#   - this job can `if: always()` and still produce something useful when
+#     one of the producers fails partway through
+#   - frontend producers can be added later without touching the
+#     producers themselves
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
+  aggregate:
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    timeout-minutes: 15
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Install defusedxml for coverage scripts
+        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
+        # XML through defusedxml - see the script headers for context.
+        run: python -m pip install --quiet defusedxml
+
+      # Pattern matches every artifact this PR's producers might upload:
+      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
+      #                                         leg of backend-build, which
+      #                                         is a strict superset of the
+      #                                         core + proprietary legs)
+      #   jacoco-exec-e2e-live
+      #   jacoco-exec-cucumber
+      # Each lands as a sibling dir under coverage-execs/, with the .exec
+      # files preserving their original relative paths.
+      - name: Download all .exec artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
+        with:
+          pattern: jacoco-exec-*
+          path: coverage-execs/
+          merge-multiple: false
+        continue-on-error: true
+
+      - name: Inventory .exec files
+        id: inventory
+        # Splits the downloaded artifacts into two buckets:
+        #   * e2e-only  = cucumber + Playwright live (user-flow coverage)
+        #   * all       = the above plus JUnit (everything we test)
+        #
+        # Bucketing is by artifact-name prefix: download-artifact preserves
+        # the artifact name as the top-level dir, so JUnit's `.exec`s live
+        # under coverage-execs/jacoco-exec-junit-*/... while the others
+        # are under coverage-execs/jacoco-exec-{e2e-live,cucumber}/...
+        #
+        # If nothing was uploaded (e.g. all producers crashed before
+        # writing) we exit gracefully so this advisory job never fails CI.
+        run: |
+          mapfile -t all_execs < <(find coverage-execs -name '*.exec' -type f | sort)
+          mapfile -t e2e_execs < <(find coverage-execs -name '*.exec' -type f -not -path '*/jacoco-exec-junit-*' | sort)
+          if [ "${#all_execs[@]}" -eq 0 ]; then
+            echo "::warning::No .exec artifacts found - skipping aggregate report"
+            echo "found_all=false" >> "$GITHUB_OUTPUT"
+            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          printf 'All %d .exec files:\n' "${#all_execs[@]}"
+          printf '  %s\n' "${all_execs[@]}"
+          IFS=','; all_joined="${all_execs[*]}"
+          echo "files_all=$all_joined" >> "$GITHUB_OUTPUT"
+          echo "found_all=true" >> "$GITHUB_OUTPUT"
+          if [ "${#e2e_execs[@]}" -eq 0 ]; then
+            echo "::notice::No e2e/cucumber .exec files - e2e-only report will be skipped"
+            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
+          else
+            printf 'E2E-only %d .exec files:\n' "${#e2e_execs[@]}"
+            printf '  %s\n' "${e2e_execs[@]}"
+            unset IFS
+            IFS=','; e2e_joined="${e2e_execs[*]}"
+            echo "files_e2e=$e2e_joined" >> "$GITHUB_OUTPUT"
+            echo "found_e2e=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compile classes for JaCoCo class lookup
+        # jacocoReportFromExec only needs the compiled .class files
+        # under each subproject's build/classes/java/main/. `classes`
+        # (compileJava + processResources) is enough; we skipped the
+        # heavier `assemble` to avoid building bootJar / fat jars that
+        # add 60+ seconds per run for no gain to the report.
+        if: steps.inventory.outputs.found_all == 'true'
+        run: ./gradlew classes -PnoSpotless
+
+      - name: Generate e2e-only JaCoCo report
+        # "Real user-flow" coverage: only counts code reached by an actual
+        # HTTP request from cucumber or live Playwright. Useful for
+        # questions like "how much of our backend does a user actually
+        # hit?". Skipped when neither producer uploaded a .exec.
+        if: steps.inventory.outputs.found_e2e == 'true'
+        run: |
+          ./gradlew jacocoReportFromExec \
+            -PexecFile="${{ steps.inventory.outputs.files_e2e }}" \
+            -PreportDir=build/reports/jacoco/aggregate-e2e \
+            -PnoSpotless
+
+      - name: Generate combined JaCoCo report (everything)
+        if: steps.inventory.outputs.found_all == 'true'
+        run: |
+          ./gradlew jacocoReportFromExec \
+            -PexecFile="${{ steps.inventory.outputs.files_all }}" \
+            -PreportDir=build/reports/jacoco/aggregate-all \
+            -PnoSpotless
+
+      - name: E2E-only step summary
+        # Rendered first so it gets prime real estate in the Summary
+        # tab - this is the number most readers actually want
+        # ("how much of the backend do real user flows cover?").
+        if: steps.inventory.outputs.found_e2e == 'true'
+        run: |
+          python scripts/coverage-summary.py \
+            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
+            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
+            --github-step-summary
+
+      - name: ALL-sources step summary
+        # Separate call (not a multi-input one) because the helper's
+        # rightmost "Aggregate" column would sum the two reports - which
+        # is meaningless when one is a strict superset of the other.
+        if: steps.inventory.outputs.found_all == 'true'
+        run: |
+          python scripts/coverage-summary.py \
+            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
+            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
+            --github-step-summary
+
+      - name: Upload combined aggregate report
+        if: steps.inventory.outputs.found_all == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jacoco-aggregate-all-${{ github.run_id }}
+          path: build/reports/jacoco/aggregate-all/
+          retention-days: 14
+
+      - name: Upload e2e-only aggregate report
+        if: steps.inventory.outputs.found_e2e == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jacoco-aggregate-e2e-${{ github.run_id }}
+          path: build/reports/jacoco/aggregate-e2e/
+          retention-days: 14
+
+      # --------------------------------------------------------------
+      # Per-area matrix: rolls backend + frontend coverage into one
+      # table indexed by core/proprietary/saas/desktop. Pulls the
+      # frontend artifacts now (after the JaCoCo step has done its
+      # work) so the per-source backend summaries still render first
+      # even if the matrix step fails.
+      # --------------------------------------------------------------
+      - name: Download vitest coverage artifact
+        # frontend-validation uploads as `frontend-coverage`. Tolerate
+        # absence so a backend-only PR still produces the matrix with
+        # just backend rows populated.
+        if: always()
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
+        with:
+          name: frontend-coverage
+          path: matrix-inputs/vitest/
+        continue-on-error: true
+
+      - name: Download Playwright frontend coverage artifact
+        # e2e-live uploads as `playwright-frontend-coverage-<run_id>`.
+        # Same tolerance as vitest - matrix script handles missing inputs.
+        if: always()
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
+        with:
+          name: playwright-frontend-coverage-${{ github.run_id }}
+          path: matrix-inputs/playwright/
+        continue-on-error: true
+
+      - name: Coverage matrix step summary
+        if: always()
+        # Matrix references the two aggregate JaCoCo XMLs (already
+        # generated above) plus whichever frontend artifacts landed.
+        # Every input is optional; missing ones render as "-".
+        run: |
+          python scripts/coverage-matrix.py \
+            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
+            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
+            --vitest matrix-inputs/vitest/coverage-summary.json \
+            --playwright-frontend matrix-inputs/playwright/coverage-pw-summary/coverage-summary.json \
+            --title "Coverage matrix (per-area, e2e vs all)" \
+            --github-step-summary

.github/workflows/docker-compose-tests-saas.yml

@@ -0,0 +1,136 @@
+name: Docker Compose Cucumber tests (saas / PAYG)
+
+# Self-contained CI job for the PAYG shadow-mode cucumber scenarios.
+# Triggers only on PAYG-relevant paths so we don't add CI minutes to every PR
+# that doesn't touch the saas flavour.
+#
+# Companion to `docker-compose-tests.yml` (which runs against the
+# proprietary-flavour stack and skips features/payg via behave.ini's
+# exclude_re). Kept as a separate workflow so the saas matrix can fail and
+# succeed independently without touching the main cucumber harness.
+
+on:
+  pull_request:
+    paths:
+      - "app/saas/**"
+      - "testing/cucumber/features/payg/**"
+      - "testing/cucumber/features/steps/payg_step_definitions.py"
+      - "testing/cucumber/requirements.txt"
+      - "testing/compose/docker-compose-saas.yml"
+      - "testing/compose/payg/**"
+      - "testing/test-payg.sh"
+      - ".github/workflows/docker-compose-tests-saas.yml"
+  push:
+    branches: [main]
+    paths:
+      - "app/saas/**"
+      - "testing/cucumber/features/payg/**"
+      - "testing/cucumber/features/steps/payg_step_definitions.py"
+      - "testing/cucumber/requirements.txt"
+      - "testing/compose/docker-compose-saas.yml"
+      - "testing/compose/payg/**"
+      - "testing/test-payg.sh"
+      - ".github/workflows/docker-compose-tests-saas.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
+  docker-compose-tests-saas:
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    permissions:
+      actions: write
+      contents: read
+      checks: write
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-saas-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Expose GitHub runtime for Buildx cache
+        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
+
+      # No "Install Docker Compose" step: Ubuntu runners ship with `docker compose`
+      # v2 (built into the Docker CLI). test-payg.sh uses the v2 form throughout
+      # (`docker compose …`, no hyphen), so the legacy v1 `docker-compose` binary
+      # isn't needed. Avoids a `curl | sudo install` without checksum verification
+      # (Aikido flagged this when copy-pasted from docker-compose-tests.yml).
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: ./testing/cucumber/requirements.txt
+
+      - name: Pip requirements
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
+
+      - name: Run PAYG Cucumber Tests
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+        run: |
+          chmod +x ./testing/test-payg.sh
+          ./testing/test-payg.sh
+
+      - name: Dump saas container logs on failure
+        if: failure()
+        run: |
+          docker compose -f testing/compose/docker-compose-saas.yml logs --tail 500 stirling-pdf-saas || true
+          docker compose -f testing/compose/docker-compose-saas.yml logs --tail 200 postgres-saas || true
+
+      - name: Upload PAYG Cucumber Report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: payg-cucumber-report
+          path: testing/cucumber/report-payg.html
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: PAYG Cucumber Test Report
+        if: always()
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
+        with:
+          name: PAYG Cucumber Tests
+          path: testing/cucumber/junit-payg/*.xml
+          reporter: java-junit
+          fail-on-error: false

.github/workflows/docker-compose-tests.yml

@@ -87,6 +87,12 @@ jobs:
         run: |
           pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
 
+      - name: Extract JaCoCo agent for cucumber coverage
+        # Stages build/jacoco/jacocoagent.jar where the coverage override
+        # file bind-mounts it into the cucumber container. The agent jar
+        # never goes into the published image - this is host-only.
+        run: ./gradlew copyJacocoAgent -PnoSpotless
+
       - name: Run Docker Compose Tests
         run: |
           chmod +x ./testing/test_webpages.sh
@@ -98,6 +104,62 @@ jobs:
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
+          # Tells test.sh to layer testing/compose/docker-compose-coverage.override.yml
+          # over the cucumber compose so the container starts with the
+          # JaCoCo agent attached via JAVA_CUSTOM_OPTS.
+          STIRLING_PDF_TEST_COVERAGE: "1"
+
+      - name: Generate cucumber JaCoCo report
+        # `if: always()` so a behave failure still produces partial
+        # coverage from whatever endpoints did run. The exec file only
+        # exists when the container shut down cleanly - guard so the step
+        # is silent on the (rare) crash path.
+        if: always()
+        id: cucumber-coverage
+        run: |
+          if [ -s testing/cucumber-coverage/cucumber.exec ]; then
+            ./gradlew jacocoReportFromExec \
+              -PexecFile=testing/cucumber-coverage/cucumber.exec \
+              -PreportDir=build/reports/jacoco/cucumber \
+              -PnoSpotless
+            echo "report=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::No cucumber .exec at testing/cucumber-coverage/cucumber.exec (container may have crashed before flushing)"
+            echo "report=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py parses JaCoCo XML through defusedxml -
+        # see the script header for context.
+        if: always() && steps.cucumber-coverage.outputs.report == 'true'
+        run: python -m pip install --quiet defusedxml
+
+      - name: Cucumber coverage step summary
+        if: always() && steps.cucumber-coverage.outputs.report == 'true'
+        run: |
+          python scripts/coverage-summary.py \
+            --title "Cucumber (docker) JaCoCo coverage" \
+            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
+            --github-step-summary
+
+      - name: Upload cucumber JaCoCo report
+        if: always() && steps.cucumber-coverage.outputs.report == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jacoco-cucumber-${{ github.run_id }}
+          path: build/reports/jacoco/cucumber/
+          retention-days: 7
+
+      - name: Upload raw cucumber .exec for aggregate merge
+        # Picked up by the coverage-aggregate workflow via the
+        # `jacoco-exec-*` artifact name pattern.
+        if: always() && steps.cucumber-coverage.outputs.report == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jacoco-exec-cucumber
+          path: testing/cucumber-coverage/cucumber.exec
+          retention-days: 7
+          if-no-files-found: warn
 
       - name: Upload Cucumber Report
         if: always()

.github/workflows/e2e-live.yml

@@ -49,9 +49,132 @@ jobs:
         env:
           VITE_BUILD_FOR_PREVIEW: "1"
         run: task frontend:build
-      - name: Run live E2E tests (chromium)
+      - name: Run live E2E tests (chromium) with coverage
         id: live-tests
+        env:
+          # Attaches the JaCoCo agent to the bootRun JVM (see
+          # .taskfiles/e2e.yml live:backend). The .exec gets flushed on
+          # graceful shutdown when the runner traps EXIT/INT/TERM, so the
+          # report step below sees a populated file.
+          COVERAGE: "1"
+          # Tells the Playwright fixture (test-base.ts) to capture per-test
+          # V8 JS coverage. Raw dumps land under
+          # .test-state/playwright/coverage-pw/ for the post-process step
+          # to aggregate. Chromium-only - other engines silently skip.
+          PW_COVERAGE: "1"
         run: task e2e:live
+      - name: Generate JaCoCo report from e2e:live .exec
+        if: always()
+        id: live-coverage
+        # `if: always()` so even a failed test run still produces a
+        # report from whatever flows did exercise the backend before
+        # the failure. The task itself tolerates a missing .exec
+        # (jacoco emits an empty report rather than crashing) but we
+        # guard with `test -s` to keep the job log clean.
+        run: |
+          if [ -s .test-state/playwright/jacoco.exec ]; then
+            ./gradlew jacocoReportFromExec \
+              -PexecFile=.test-state/playwright/jacoco.exec \
+              -PreportDir=build/reports/jacoco/e2e-live \
+              -PnoSpotless
+            echo "report=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
+            echo "report=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Set up Python for coverage summary
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
+        # to dodge XXE / billion-laughs scanner findings.
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        run: python -m pip install --quiet defusedxml
+      - name: e2e:live coverage step summary
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        run: |
+          python scripts/coverage-summary.py \
+            --title "Playwright (live backend) JaCoCo coverage" \
+            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
+            --github-step-summary
+      - name: Upload e2e:live JaCoCo report
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jacoco-e2e-live-${{ github.run_id }}
+          path: build/reports/jacoco/e2e-live/
+          retention-days: 7
+
+      - name: Upload raw e2e:live .exec for aggregate merge
+        # Picked up by the coverage-aggregate workflow via the
+        # `jacoco-exec-*` artifact name pattern.
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jacoco-exec-e2e-live
+          path: .test-state/playwright/jacoco.exec
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: Set up Python for frontend coverage summary
+        # Separate from the backend-coverage python step because the
+        # frontend path doesn't depend on a JaCoCo report - it produces
+        # a summary even on backend failure, as long as some Playwright
+        # tests ran far enough to dump V8 coverage.
+        if: always()
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Install defusedxml for frontend coverage summary
+        # Idempotent re-install: the backend-coverage step may have
+        # installed it already, but this leg can run on its own when the
+        # backend report step skips (e.g. .exec missing).
+        if: always()
+        run: python -m pip install --quiet defusedxml
+
+      - name: Aggregate Playwright frontend (V8) coverage
+        # Rolls per-test V8 dumps from the test-base fixture into one
+        # vitest-shaped coverage-summary.json. Tolerates a missing dump
+        # dir (firefox/webkit runs, or a failure before any test got
+        # far enough to dump).
+        if: always()
+        id: pw-frontend-coverage
+        run: |
+          if [ -d .test-state/playwright/coverage-pw ] && \
+             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
+            python scripts/playwright-coverage-summary.py \
+              .test-state/playwright/coverage-pw \
+              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
+            echo "summary=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::No Playwright frontend coverage dumps found (chromium-only feature)"
+            echo "summary=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Playwright frontend coverage step summary
+        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
+        run: |
+          python scripts/coverage-summary.py \
+            --title "Playwright (live) frontend coverage" \
+            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
+            --github-step-summary
+
+      - name: Upload Playwright frontend coverage
+        # Bundle both the aggregated summary and the raw V8 dumps so
+        # someone debugging "why is this function showing as covered"
+        # can trace it back to the source dump.
+        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: playwright-frontend-coverage-${{ github.run_id }}
+          path: |
+            .test-state/playwright/coverage-pw-summary/
+            .test-state/playwright/coverage-pw/
+          retention-days: 7
+
       - name: Print backend log on failure
         if: failure() && steps.live-tests.conclusion == 'failure'
         run: |

.github/workflows/frontend-backend-licenses-update.yml

@@ -110,8 +110,8 @@ jobs:
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
         working-directory: frontend
         run: |
-          mkdir -p src/assets
-          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
+          mkdir -p editor/src/assets
+          npx --yes license-report --only=prod --output=json > editor/src/assets/3rdPartyLicenses.json
 
       - name: Postprocess with project script (BASE version)
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true

.github/workflows/frontend-validation.yml

@@ -109,6 +109,41 @@ jobs:
                 comment_id: existing.id,
               });
             }
+      - name: Vitest coverage
+        # Separate from `frontend:check:all` so the quality-gate run stays
+        # uninstrumented (faster signal) and coverage stays an informational
+        # follow-up. Continue-on-error keeps the workflow green even when
+        # a handful of test files refuse to import (e.g. missing icon
+        # specifiers) - the summary still gets posted with whatever
+        # vitest managed to instrument.
+        id: frontend-coverage
+        continue-on-error: true
+        run: task frontend:test:coverage
+      - name: Set up Python for coverage summary
+        if: always()
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+      - name: Install defusedxml for coverage summary
+        # See coverage-summary.py header - it parses XML through defusedxml
+        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
+        if: always()
+        run: python -m pip install --quiet defusedxml
+      - name: Vitest coverage step summary
+        if: always()
+        run: |
+          python scripts/coverage-summary.py \
+            --title "Frontend Vitest coverage" \
+            --vitest frontend/editor/coverage/coverage-summary.json \
+            --github-step-summary
+      - name: Upload vitest coverage report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: frontend-coverage
+          path: frontend/editor/coverage/
+          retention-days: 7
+          if-no-files-found: warn
       - name: Upload frontend build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

.github/workflows/multiOSReleases.yml

@@ -442,10 +442,6 @@ jobs:
           echo "Generated tauri.windows.conf.json (alias masked):"
           sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
 
-      - name: Sign JPDFium dylibs inside bootJar (macOS only)
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
-
       - name: Import release GPG signing key (Linux)
         if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         run: |
@@ -495,6 +491,7 @@ jobs:
           projectPath: ./frontend/editor
           tauriScript: npx tauri
           args: ${{ matrix.args }}
+          updaterJsonKeepUniversal: true
 
       - name: Clear release GPG key from runner keyring (Linux)
         if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -591,18 +588,32 @@ jobs:
           mkdir -p "$DIST"
           cd ./frontend/editor/src-tauri/target
 
-          # Find and rename artifacts based on platform
+          echo "=== tauri bundle artifacts ==="
+          find . -path "*/bundle/*" \( -name "*.msi" -o -name "*.deb" \
+            -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.dmg" \
+            -o -name "*.app.tar.gz" -o -name "*.sig" \) 2>/dev/null | sort || true
+          echo "=============================="
+
+          # createUpdaterArtifacts:true signs the native installers in place;
+          # each <bundle> ships with a sibling <bundle>.sig consumed by latest.json.
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
-            # are not the user-facing installer - the MSI contains the signed inner exe.
             find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
+            find . -name "*.msi.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi.sig" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+            # DMG = manual install; .app.tar.gz (+ .sig) = updater payload.
+            # Raw .app is intentionally not shipped (hundreds of MB of uncompressed input).
             find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "$DIST/Stirling-PDF-${{ matrix.name }}.app" \;
+            find . -name "*.app.tar.gz" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz" \;
+            find . -name "*.app.tar.gz.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz.sig" \;
           else
+            # The raw .AppImage IS its updater payload (signed -> .AppImage.sig),
+            # not a .tar.gz wrapper - that's only produced under v1Compatible.
             find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.deb.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb.sig" \;
             find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.rpm.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm.sig" \;
             find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.AppImage.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage.sig" \;
           fi
 
       - name: Upload build artifacts
@@ -613,8 +624,7 @@ jobs:
           path: ./dist/*
           retention-days: 1
 
-  create-release:
-    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
+  collect-and-release:
     needs: [pick, determine-matrix, build, build-jars]
     runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
     permissions:
@@ -625,6 +635,16 @@ jobs:
         with:
           egress-policy: audit
 
+      # Sparse-check out the verifier + pubkey before the artifact downloads
+      # so the checkout cannot clobber ./artifacts.
+      - name: Checkout updater verifier
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout: |
+            .github/scripts/verify-updater-signatures.py
+            frontend/editor/src-tauri/tauri.conf.json
+          sparse-checkout-cone-mode: false
+
       - name: Download all Tauri artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -652,17 +672,146 @@ jobs:
       - name: Display structure of downloaded files
         run: ls -R ./artifacts
 
+      # tauri-action only emits latest.json when it also publishes the release
+      # (tagName/releaseId set). We publish separately via action-gh-release,
+      # so build latest.json here from the per-platform .sig files.
+      - name: Generate updater latest.json
+        env:
+          VERSION: ${{ needs.determine-matrix.outputs.version }}
+          TAG: v${{ needs.determine-matrix.outputs.version }}
+          REPO: ${{ github.repository }}
+        run: |
+          python3 - << 'PYEOF'
+          import json, os, sys
+          from pathlib import Path
+          from datetime import datetime, timezone
+
+          VERSION = os.environ['VERSION']
+          TAG = os.environ['TAG']
+          REPO = os.environ['REPO']
+
+          ART = Path('./artifacts/tauri')
+
+          # Tauri updater looks up {os}-{arch}-{installer} (e.g. linux-x86_64-deb)
+          # before bare {os}-{arch}, so per-format Linux keys let deb/rpm/appimage
+          # each self-update from their matching file. macOS universal serves both
+          # arches from the one .app.tar.gz.
+          PLATFORM_MAP = [
+              {
+                  'bundles': ['Stirling-PDF-linux-x86_64.deb'],
+                  'targets': ['linux-x86_64-deb'],
+              },
+              {
+                  'bundles': ['Stirling-PDF-linux-x86_64.rpm'],
+                  'targets': ['linux-x86_64-rpm'],
+              },
+              {
+                  'bundles': ['Stirling-PDF-linux-x86_64.AppImage'],
+                  'targets': ['linux-x86_64-appimage'],
+              },
+              {
+                  'bundles': ['Stirling-PDF-windows-x86_64.msi'],
+                  'targets': ['windows-x86_64-msi', 'windows-x86_64'],
+              },
+              {
+                  'bundles': ['Stirling-PDF-macos-universal.app.tar.gz'],
+                  'targets': ['darwin-x86_64', 'darwin-aarch64'],
+              },
+          ]
+
+          # rglob() because download-artifact varies layout: one artifact -> flat,
+          # many -> nested under <artifact-name>/.
+          def find_signed(name):
+              for bundle_path in sorted(ART.rglob(name)):
+                  sig_path = bundle_path.with_name(bundle_path.name + '.sig')
+                  if sig_path.exists():
+                      return bundle_path, sig_path
+              return None
+
+          platforms = {}
+          skipped = []
+          for entry in PLATFORM_MAP:
+              picked = None
+              for name in entry['bundles']:
+                  picked = find_signed(name)
+                  if picked:
+                      break
+              if not picked:
+                  skipped.append(
+                      f"{entry['targets']} (no signed bundle among "
+                      f"{entry['bundles']} - TAURI_SIGNING_PRIVATE_KEY unset "
+                      f"or createUpdaterArtifacts disabled?)"
+                  )
+                  continue
+              bundle_path, sig_path = picked
+              signature = sig_path.read_text(encoding='utf-8').strip()
+              url = f"https://github.com/{REPO}/releases/download/{TAG}/{bundle_path.name}"
+              for target in entry['targets']:
+                  platforms[target] = {'signature': signature, 'url': url}
+              print(f"Added {entry['targets']} from {bundle_path.name}")
+
+          if skipped:
+              print("Skipped platforms:")
+              for s in skipped:
+                  print(f"  - {s}")
+
+          if not platforms:
+              print(
+                  "WARN: no signed updater bundles found - "
+                  "skipping latest.json generation"
+              )
+              sys.exit(0)
+
+          manifest = {
+              'version': VERSION,
+              'notes': f"See https://github.com/{REPO}/releases/tag/{TAG}",
+              'pub_date': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'),
+              'platforms': platforms,
+          }
+
+          out = Path('./artifacts/latest.json')
+          out.write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8')
+          print(f"Generated {out} with platforms: {sorted(platforms.keys())}")
+          PYEOF
+
+      - name: Upload merged artifacts for review
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: release-artifacts
+          path: ./artifacts/
+          retention-days: 7
+
+      # Gate publish on valid updater sigs. Runs after the review upload (so
+      # artifacts survive for debugging) and before action-gh-release.
+      - name: Verify updater signatures
+        run: |
+          python3 -m pip install --quiet 'cryptography==44.0.0'
+          python3 .github/scripts/verify-updater-signatures.py \
+            ./artifacts/tauri frontend/editor/src-tauri/tauri.conf.json
+
+      # workflow_dispatch path requires platform=='all' so a single-platform
+      # dispatch can't overwrite an existing release's full latest.json with a
+      # partial one (action-gh-release defaults overwrite_files:true).
+      # release / V2-master always build the full matrix so no extra guard needed.
+      # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
+      # instead of silently shipping a broken auto-update.
       - name: Upload binaries to Release
+        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
+          fail_on_unmatched_files: true
+          # Installers + updater payloads + manifest. .sig contents are embedded
+          # in latest.json so the .sig files themselves are not uploaded.
           files: |
             ./artifacts/**/*.jar
             ./artifacts/**/*.msi
             ./artifacts/**/*.dmg
+            ./artifacts/**/*.app.tar.gz
             ./artifacts/**/*.deb
             ./artifacts/**/*.rpm
             ./artifacts/**/*.AppImage
+            ./artifacts/latest.json
           draft: false
           prerelease: false

.github/workflows/tauri-build.yml

@@ -271,10 +271,6 @@ jobs:
           echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
           echo "Certificate imported successfully."
 
-      - name: Sign JPDFium dylibs inside bootJar (macOS only)
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
-
       - name: Check DMG creation dependencies (macOS only)
         if: matrix.platform == 'macos-15'
         run: |

.gitignore

@@ -57,6 +57,8 @@ app/core/src/main/resources/static/robots.txt
 app/core/src/main/resources/static/pdfium/
 app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
+app/core/src/main/resources/static/**/*.gz
+app/core/src/main/resources/static/**/*.br
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
 
 # Gradle
@@ -212,7 +214,7 @@ out/
 *.asc
 
 # Allow test fixture certificates (synthetic, no real credentials)
-!frontend/src/core/tests/test-fixtures/certs/**
+!frontend/editor/src/core/tests/test-fixtures/certs/**
 
 # SSH Keys
 *.pub
@@ -254,7 +256,7 @@ node_modules/
 *compact*.json
 test_batch.json
 *.backup.*.json
-frontend/public/locales/*/translation.backup*.json
+frontend/editor/public/locales/*/translation.backup*.json
 
 # Development/build artifacts
 .gradle-cache/
@@ -279,4 +281,4 @@ docs/type3/signatures/
 *.playwright-mcp.png
 
 # Local screenshot artifacts from *-screenshots.spec.ts
-frontend/screenshots/
+frontend/editor/screenshots/

.gitleaksignore

@@ -0,0 +1,14 @@
+# PostHog project-level key — phc_ prefix keys are public/client-side by design
+# (PostHog client-side tracking embeds them in the browser bundle). Committed
+# intentionally in #6150 so engine/.env has a working default, with real
+# credentials overridden via engine/.env.local.
+engine/.env:generic-api-key:41
+
+# MCP test fixtures / harness - no real secrets:
+# - test-only API key constant in an integration test
+# - JDBC URL + throwaway Keycloak creds in the local test compose
+# - placeholder / shell-variable Bearer headers in curl-based validation scripts
+app/proprietary/src/test/java/stirling/software/proprietary/mcp/security/McpApiKeyIntegrationTest.java:generic-api-key:40
+testing/compose/docker-compose-keycloak-mcp.yml:generic-api-key:25
+testing/compose/validate-mcp-apikey.sh:curl-auth-header:73
+testing/compose/validate-mcp-test.sh:curl-auth-header:92

.taskfiles/backend.yml

@@ -18,6 +18,15 @@ version: '3'
 tasks:
   dev:
     desc: "Start backend dev server"
+    cmds:
+      - task: dev:proprietary
+        vars:
+          PORT: '{{.PORT}}'
+          AIENGINE_URL: '{{.AIENGINE_URL}}'
+          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
+
+  dev:proprietary:
+    desc: "Start backend dev server in proprietary mode"
     ignore_error: true
     vars:
       PORT: '{{.PORT | default "8080"}}'
@@ -50,9 +59,14 @@ tasks:
       PORT: '{{.PORT | default "8080"}}'
       # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
       PROFILES: '{{.PROFILES | default "dev"}}'
+      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
+      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
     env:
       SERVER_PORT: '{{.PORT}}'
       STIRLING_FLAVOR: saas
+      AIENGINE_URL: '{{.AIENGINE_URL}}'
+      AIENGINE_ENABLED: '{{if .AIENGINE_URL}}true{{else}}false{{end}}'
+      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
     cmds:
       - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
         platforms: [windows]

.taskfiles/desktop.yml

@@ -1,7 +1,9 @@
 version: '3'
 
 vars:
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+  # jdk.dynalink is required by VeraPDF (PDF/A validation); without it the bundled JRE throws
+  # NoClassDefFoundError: jdk/dynalink/Namespace at runtime in get-info-on-pdf and verify-pdf
+  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.dynalink"
 
   # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
   JPDFIUM_PLATFORMS:
@@ -62,21 +64,21 @@ tasks:
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles app
+      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
   build:dev:windows:
     desc: "Build Tauri desktop NSIS installer (Windows)"
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles nsis
+      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
   build:dev:linux:
     desc: "Build Tauri desktop AppImage (Linux)"
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles appimage
+      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
   test:
     desc: "Run Tauri/Cargo tests"

.taskfiles/docker.yml

@@ -20,6 +20,11 @@ tasks:
     cmds:
       - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
 
+  build:backend:
+    desc: "Build backend-only Docker image (no embedded frontend)"
+    cmds:
+      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
+
   build:frontend:
     desc: "Build frontend-only Docker image"
     cmds:

.taskfiles/e2e.yml

@@ -34,6 +34,9 @@ tasks:
     ignore_error: true
     vars:
       BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
+    # COVERAGE=1 in the calling environment attaches the JaCoCo agent to
+    # the bootRun JVM and writes to BASE_DIR/jacoco.exec on shutdown.
+    # Off by default to keep local dev runs uninstrumented; CI flips it.
     env:
       STIRLING_BASE_PATH: '{{.BASE_DIR}}'
       # Suppress the analytics opt-in modal that fires on first admin login.
@@ -58,12 +61,19 @@ tasks:
           set -e
           rm -rf "{{.BASE_DIR}}"
           mkdir -p "{{.BASE_DIR}}"
+          GRADLE_ARGS=":stirling-pdf:bootRun"
+          if [ -n "${COVERAGE:-}" ]; then
+            # copyJacocoAgent is wired as a dependency of bootRun when
+            # -PjacocoAgent=true, so we do not need to invoke it separately.
+            GRADLE_ARGS="$GRADLE_ARGS -PjacocoAgent=true -PjacocoExec={{.BASE_DIR}}/jacoco.exec"
+            echo "JaCoCo coverage enabled, writing to {{.BASE_DIR}}/jacoco.exec"
+          fi
           # Background gradle and record its PID so the runner can clean up
           # the exact process tree (wrapper + forked Spring Boot JVM) without
           # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
           # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
           # synchronised.
-          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
+          bash gradlew $GRADLE_ARGS > "{{.BASE_DIR}}/backend.log" 2>&1 &
           GRADLE_PID=$!
           echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
           wait $GRADLE_PID
@@ -202,3 +212,55 @@ tasks:
     desc: "Stop the SAML keycloak test environment"
     cmds:
       - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
+
+  mcp:up:
+    desc: "Start the MCP keycloak test environment (Stirling as OAuth resource server)"
+    summary: |
+      Brings up Keycloak (OAuth authorization server) + Stirling configured as an
+      MCP resource server, then you can exercise /mcp with real Keycloak tokens.
+      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
+        task e2e:mcp:up LICENSE_KEY=abc123
+      Pass extra flags via -- :
+        task e2e:mcp:up -- --validate --nobuild
+    ignore_error: true
+    cmds:
+      - bash testing/compose/start-mcp-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
+
+  mcp:manual:
+    desc: "Start the MCP keycloak test env in manual mode (prints URLs + a live token for your client)"
+    summary: |
+      Brings the stack up and prints copy-paste URLs/commands plus a freshly minted
+      access token so you can drive your own MCP client (Inspector, curl, ...).
+        task e2e:mcp:manual LICENSE_KEY=<your-license-key>
+      Add --nobuild if the images are already built:
+        task e2e:mcp:manual LICENSE_KEY=<your-license-key> -- --nobuild
+    ignore_error: true
+    cmds:
+      - bash testing/compose/start-mcp-test.sh --manual {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
+
+  mcp:apikey:
+    desc: "Start the MCP test env in API-KEY manual mode (no OAuth/IdP): mints a key + prints client settings"
+    summary: |
+      Brings Stirling up in apikey auth mode and prints copy-paste client settings with a freshly
+      minted X-API-KEY - ideal for clients whose OAuth layer can't reach localhost.
+        task e2e:mcp:apikey LICENSE_KEY=<your-license-key>
+      Add --nobuild if images are already built:
+        task e2e:mcp:apikey LICENSE_KEY=<your-license-key> -- --nobuild
+    ignore_error: true
+    cmds:
+      - bash testing/compose/start-mcp-test.sh --apikey {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
+
+  mcp:validate:
+    desc: "Validate the running MCP keycloak test environment end-to-end (oauth mode + real MCP SDK client)"
+    cmds:
+      - bash testing/compose/validate-mcp-test.sh
+
+  mcp:validate-apikey:
+    desc: "Validate the MCP server in API-KEY auth mode (mints a key + real MCP SDK client), then restore oauth"
+    cmds:
+      - bash testing/compose/validate-mcp-apikey.sh
+
+  mcp:down:
+    desc: "Stop the MCP keycloak test environment"
+    cmds:
+      - docker compose -f testing/compose/docker-compose-keycloak-mcp.yml down -v

.taskfiles/engine.yml

@@ -1,5 +1,12 @@
 version: '3'
 
+vars:
+  # Engine-specific names to avoid overriding the root Taskfile's FIND_FREE_PORT_*
+  # vars (Task merges included-file vars into the global scope).
+  # Paths are relative to the engine/ include dir.
+  ENGINE_FIND_FREE_PORT_SH: "bash ../scripts/find-free-port.sh"
+  ENGINE_FIND_FREE_PORT_PS: "powershell -NoProfile -File ../scripts/find-free-port.ps1"
+
 tasks:
   install:
     desc: "Install engine dependencies"
@@ -29,11 +36,28 @@ tasks:
     ignore_error: true
     dir: src
     vars:
-      PORT: '{{.PORT | default "5001"}}'
+      # When PORT is provided (e.g. from dev:all), use it directly.
+      # With ENGINE_PORT_PROBE=false (Docker), use the fixed STIRLING_ENGINE_PORT
+      # (default 5001) without probing. Otherwise probe for a free port from 5001.
+      PORT:
+        sh: |
+          if [ -n "{{.PORT}}" ]; then
+            echo "{{.PORT}}"
+          elif [ -f /.dockerenv ] || [ "${ENGINE_PORT_PROBE:-true}" = "false" ]; then
+            # Never probe in a container: the port is fixed and the probe script
+            # isn't shipped in the image. /.dockerenv auto-detects Docker; the
+            # ENGINE_PORT_PROBE=false flag forces fixed-port mode anywhere else.
+            # The probe is a dev-only convenience for avoiding local port clashes.
+            echo "${STIRLING_ENGINE_PORT:-5001}"
+          elif [ "{{OS}}" = "windows" ]; then
+            {{.ENGINE_FIND_FREE_PORT_PS}} 5001
+          else
+            {{.ENGINE_FIND_FREE_PORT_SH}} 5001
+          fi
     env:
       PYTHONUNBUFFERED: "1"
     cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}}
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
 
   dev:
     desc: "Start engine dev server with hot reload"
@@ -41,7 +65,24 @@ tasks:
     ignore_error: true
     dir: src
     vars:
-      PORT: '{{.PORT | default "5001"}}'
+      # When PORT is provided (e.g. from dev:all), use it directly.
+      # With ENGINE_PORT_PROBE=false (Docker), use the fixed STIRLING_ENGINE_PORT
+      # (default 5001) without probing. Otherwise probe for a free port from 5001.
+      PORT:
+        sh: |
+          if [ -n "{{.PORT}}" ]; then
+            echo "{{.PORT}}"
+          elif [ -f /.dockerenv ] || [ "${ENGINE_PORT_PROBE:-true}" = "false" ]; then
+            # Never probe in a container: the port is fixed and the probe script
+            # isn't shipped in the image. /.dockerenv auto-detects Docker; the
+            # ENGINE_PORT_PROBE=false flag forces fixed-port mode anywhere else.
+            # The probe is a dev-only convenience for avoiding local port clashes.
+            echo "${STIRLING_ENGINE_PORT:-5001}"
+          elif [ "{{OS}}" = "windows" ]; then
+            {{.ENGINE_FIND_FREE_PORT_PS}} 5001
+          else
+            {{.ENGINE_FIND_FREE_PORT_SH}} 5001
+          fi
     env:
       PYTHONUNBUFFERED: "1"
     cmds:

.taskfiles/frontend.yml

@@ -112,6 +112,12 @@ tasks:
       - task: dev:_run
         vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
 
+  dev:portal:
+    desc: "Start developer portal dev server"
+    deps: [install]
+    cmds:
+      - npx vite portal --port {{.PORT | default "5173"}}{{if .OPEN}} --open{{end}}
+
   # ============================================================
   # Build
   # ============================================================
@@ -156,6 +162,24 @@ tasks:
     cmds:
       - npx vite build editor --mode prototypes
 
+  build:portal:
+    desc: "Build developer portal"
+    deps: [install]
+    cmds:
+      - npx vite build portal
+
+  storybook:
+    desc: "Start Storybook dev server"
+    deps: [install]
+    cmds:
+      - npx storybook dev -p 6006 {{.CLI_ARGS}}
+
+  storybook:build:
+    desc: "Build static Storybook"
+    deps: [install]
+    cmds:
+      - npx storybook build {{.CLI_ARGS}}
+
   # ============================================================
   # Code quality
   # ============================================================
@@ -163,9 +187,23 @@ tasks:
   lint:
     desc: "Run linting"
     deps: [install]
+    cmds:
+      - task: lint:eslint
+      - task: lint:dpdm
+
+  lint:eslint:
+    desc: "Run ESLint linting"
+    deps: [install]
     cmds:
       - npx eslint --max-warnings=0
-      - npx dpdm editor/src --circular --no-warning --no-tree --exit-code circular:1
+
+  lint:dpdm:
+    desc: "Run circular import linting"
+    deps: [install]
+    cmds:
+      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
+      # shell-agnostic. Covers editor, portal, and the shared design system.
+      - npx dpdm "editor/src/**/*.{ts,tsx}" "portal/src/**/*.{ts,tsx}" "shared/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
 
   lint:fix:
     desc: "Auto-fix lint issues"
@@ -236,6 +274,18 @@ tasks:
     cmds:
       - npx tsc --noEmit --project editor/src/prototypes/tsconfig.json
 
+  typecheck:portal:
+    desc: "Typecheck developer portal build variant"
+    deps: [install]
+    cmds:
+      - npx tsc --noEmit --project portal/tsconfig.json
+
+  typecheck:shared:
+    desc: "Typecheck the shared design system"
+    deps: [install]
+    cmds:
+      - npx tsc --noEmit --project shared/tsconfig.json
+
   typecheck:all:
     desc: "Typecheck all build variants"
     cmds:
@@ -245,6 +295,8 @@ tasks:
       - task: typecheck:desktop
       - task: typecheck:scripts
       - task: typecheck:prototypes
+      - task: typecheck:portal
+      - task: typecheck:shared
 
   # ============================================================
   # Quality Gate
@@ -265,7 +317,9 @@ tasks:
       - task: lint
       - task: format:check
       - task: build
+      - task: build:portal
       - task: test
+      - task: storybook:build
 
   # ============================================================
   # Test
@@ -273,21 +327,36 @@ tasks:
 
   test:
     desc: "Run tests"
-    deps: [install]
+    deps: [prepare]
     cmds:
       - npx vitest run --root editor
 
   test:watch:
     desc: "Run tests in watch mode"
-    deps: [install]
+    deps: [prepare]
     cmds:
       - npx vitest --watch --root editor
 
   test:coverage:
-    desc: "Run tests with coverage"
-    deps: [install]
+    desc: "Run tests with coverage (one-shot; CI-friendly)."
+    deps: [prepare]
     cmds:
-      - npx vitest --coverage --root editor
+      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
+      # mode). Explicit reporter list because v8 + json-summary is what the
+      # coverage-summary.py helper consumes; html/text are kept for humans.
+      #
+      # reportsDirectory is pinned to ./coverage relative to vitest's root
+      # (--root editor), so output lands at frontend/editor/coverage/. The
+      # CI upload step reads from that path. An earlier attempt with
+      # `./editor/coverage` double-nested into frontend/editor/editor/coverage;
+      # pinning future-proofs against vitest changing the default.
+      - >
+        npx vitest run --root editor --coverage
+        --coverage.provider=v8
+        --coverage.reporter=text-summary
+        --coverage.reporter=json-summary
+        --coverage.reporter=html
+        --coverage.reportsDirectory=./coverage
 
   # ============================================================
   # Code Generation

LICENSE

@@ -10,14 +10,16 @@ if that directory exists, is licensed under the license defined in "app/propriet
 if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
-* All content that resides under the "frontend/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
-* All content that resides under the "frontend/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
-* All content that resides under the "frontend/src/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
-* All content that resides under the "frontend/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
+* All content that resides under the "frontend/editor/src/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/editor/src/proprietary/LICENSE".
+* All content that resides under the "frontend/editor/src/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/editor/src/desktop/LICENSE".
+* All content that resides under the "frontend/editor/src/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/editor/src/saas/LICENSE".
+* All content that resides under the "frontend/editor/src/prototypes/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/editor/src/prototypes/LICENSE".
+* All content that resides under the "frontend/portal/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/portal/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

Taskfile.yml

@@ -60,24 +60,20 @@ tasks:
 
   dev:saas:
     desc: "Start SaaS backend + frontend concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-    deps:
-      - task: backend:dev:saas
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-      - task: frontend:dev:saas
-        vars:
-          PORT: '{{.FRONTEND_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          OPEN: "true"
+    cmds:
+      - task: dev:_all
+        vars: { FRONTEND: saas, BACKEND: saas }
 
   dev:all:
     desc: "Start backend + frontend + engine concurrently on free ports"
+    cmds:
+      - task: dev:_all
+
+  dev:_all:
+    internal: true
     vars:
+      FRONTEND: '{{.FRONTEND | default "proprietary"}}'
+      BACKEND: '{{.BACKEND | default "proprietary"}}'
       PORTS:
         sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
       BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
@@ -87,11 +83,11 @@ tasks:
       - task: engine:dev
         vars:
           PORT: '{{.ENGINE_PORT}}'
-      - task: backend:dev
+      - task: 'backend:dev:{{.BACKEND}}'
         vars:
           PORT: '{{.BACKEND_PORT}}'
           AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-      - task: frontend:dev
+      - task: 'frontend:dev:{{.FRONTEND}}'
         vars:
           PORT: '{{.FRONTEND_PORT}}'
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'

app/common/build.gradle

@@ -60,7 +60,7 @@ dependencies {
         exclude group: 'com.google.code.gson', module: 'gson'
     }
 
-    api 'com.stirling:jpdfium:1.0.1'
+    api 'com.stirling:jpdfium:1.0.2'
 
     // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
     def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
@@ -75,7 +75,7 @@ dependencies {
     }
     logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
     jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.1"
+        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2"
     }
 
     // Bucket4j (local in-process token bucket for RateLimitStore default impl)

app/common/src/main/java/stirling/software/SPDF/pdf/parser/CompositeTableParser.java

@@ -1,73 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.context.annotation.Primary;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Chains table parsers in priority order: Tabula lattice → Tabula stream → {@link
- * LineAlignmentTableParser}. The first parser returning a result above {@link
- * #TABULA_CONFIDENCE_THRESHOLD} wins; results from different parsers are never mixed on one page.
- */
-@Service
-@Primary
-@RequiredArgsConstructor
-@Slf4j
-public class CompositeTableParser implements TableParser {
-
-    /** Min Tabula confidence to accept results; below this LineAlignment is tried instead. */
-    static final float TABULA_CONFIDENCE_THRESHOLD = 0.5f;
-
-    private final TabulaTableParser tabulaParser;
-    private final LineAlignmentTableParser lineAlignmentParser;
-
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        // Step 1: Tabula lattice mode (ruled/bordered tables).
-        List<TableFragment> latticeResults = filterConfident(tabulaParser.parse(document, rawPage));
-        if (!latticeResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using Tabula lattice ({} table(s))",
-                    rawPage.pageNumber(),
-                    latticeResults.size());
-            return latticeResults;
-        }
-
-        // Step 2: Tabula stream mode (borderless/whitespace-delimited tables).
-        // parseStream is not on the TableParser interface — this intentionally couples to the
-        // concrete TabulaTableParser since stream mode is a Tabula-specific concept.
-        List<TableFragment> streamResults =
-                filterConfident(tabulaParser.parseStream(document, rawPage));
-        if (!streamResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using Tabula stream ({} table(s))",
-                    rawPage.pageNumber(),
-                    streamResults.size());
-            return streamResults;
-        }
-
-        // Step 3: Geometry-based line-alignment fallback.
-        List<TableFragment> lineResults = lineAlignmentParser.parse(document, rawPage);
-        if (!lineResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using LineAlignment ({} table(s))",
-                    rawPage.pageNumber(),
-                    lineResults.size());
-            return lineResults;
-        }
-
-        return List.of();
-    }
-
-    private List<TableFragment> filterConfident(List<TableFragment> tables) {
-        return tables.stream().filter(t -> t.confidence() >= TABULA_CONFIDENCE_THRESHOLD).toList();
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineAlignmentTableParser.java

@@ -1,528 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.TreeMap;
-import java.util.regex.Pattern;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Fallback {@link TableParser} for borderless financial tables using text geometry.
- *
- * <p>Identifies "anchor lines" (≥2 numeric tokens), builds a column grid from their right-edge
- * positions, groups vertically proximate anchor lines into table candidates, then scores each group
- * on column consistency and anchor density (confidence ceiling 0.85).
- */
-@Service
-@Slf4j
-public class LineAlignmentTableParser implements TableParser {
-
-    /** Width in points of each column position bucket. */
-    static final float COLUMN_BUCKET_PT = 5f;
-
-    /** Tolerance in buckets when matching a token's right-edge to a confirmed column position. */
-    private static final int COLUMN_MATCH_BUCKETS = 2;
-
-    /** Maximum gap (as a multiple of modal line spacing) before splitting a group. */
-    private static final float MAX_GAP_FACTOR = 2.5f;
-
-    /** Minimum anchor rows (numeric-heavy) to form a valid table. */
-    static final int MIN_TABLE_ROWS = 3;
-
-    /** Minimum confirmed column positions to form a valid table. */
-    static final int MIN_COLUMNS = 2;
-
-    /**
-     * Min fraction of anchor lines a column must appear on to be confirmed (permissive for N/A
-     * rows).
-     */
-    private static final double COLUMN_MIN_FREQUENCY = 0.40;
-
-    /**
-     * Matches financial numeric tokens: integers, decimals, parenthetical negatives, currency,
-     * percent, nil dashes.
-     */
-    private static final Pattern NUMERIC =
-            Pattern.compile("^[\\(\\-\\$£€¥]?\\d[\\d,\\.]*[\\)%]?$|^[-–—]$");
-
-    /**
-     * Lines within this y-distance are merged into one row (restores rows split by LineBuilder's
-     * column-gap logic).
-     */
-    static final float ROW_MERGE_TOLERANCE_PT = 2f;
-
-    // ── public API ───────────────────────────────────────────────────────────────────────────────
-
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        List<RawLine> lines = rawPage.lines();
-        if (lines.size() < MIN_TABLE_ROWS) return List.of();
-
-        float modalSpacing = computeModalSpacing(lines);
-        List<TokenizedLine> tokenized =
-                mergeCoincidentLines(lines.stream().map(this::tokenize).toList());
-
-        List<TokenizedLine> anchors = tokenized.stream().filter(TokenizedLine::isAnchor).toList();
-
-        if (anchors.size() < MIN_TABLE_ROWS) return List.of();
-
-        List<Float> columnGrid = buildColumnGrid(anchors);
-        if (columnGrid.size() < MIN_COLUMNS) {
-            log.debug(
-                    "Page {}: LineAlignment — fewer than {} confirmed columns, skipping",
-                    rawPage.pageNumber(),
-                    MIN_COLUMNS);
-            return List.of();
-        }
-
-        List<List<TokenizedLine>> groups = groupRows(tokenized, columnGrid, modalSpacing);
-
-        List<TableFragment> results = new ArrayList<>();
-        for (int i = 0; i < groups.size(); i++) {
-            buildFragment(groups.get(i), columnGrid, rawPage.pageNumber(), i)
-                    .ifPresent(results::add);
-        }
-
-        log.debug(
-                "Page {}: LineAlignment detected {} table(s) ({} anchor lines, {} columns)",
-                rawPage.pageNumber(),
-                results.size(),
-                anchors.size(),
-                columnGrid.size());
-        return results;
-    }
-
-    // ── coincident-line merging ──────────────────────────────────────────────────────────────────
-
-    /**
-     * Merges tokenised lines sharing the same y-position into one row, rejoining label/value halves
-     * split by LineBuilder.
-     */
-    List<TokenizedLine> mergeCoincidentLines(List<TokenizedLine> tokenized) {
-        if (tokenized.size() < 2) return tokenized;
-
-        List<TokenizedLine> result = new ArrayList<>();
-        int i = 0;
-
-        while (i < tokenized.size()) {
-            float baseY = tokenized.get(i).line().bounds().y();
-            int j = i + 1;
-            while (j < tokenized.size()
-                    && Math.abs(tokenized.get(j).line().bounds().y() - baseY)
-                            <= ROW_MERGE_TOLERANCE_PT) {
-                j++;
-            }
-
-            if (j == i + 1) {
-                result.add(tokenized.get(i));
-            } else {
-                result.add(mergeGroup(tokenized.subList(i, j)));
-            }
-            i = j;
-        }
-
-        return result;
-    }
-
-    private TokenizedLine mergeGroup(List<TokenizedLine> group) {
-        List<TextFragment> mergedFragments =
-                group.stream()
-                        .flatMap(tl -> tl.line().fragments().stream())
-                        .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
-                        .toList();
-
-        Bounds mergedBounds =
-                group.stream()
-                        .map(tl -> tl.line().bounds())
-                        .reduce(Bounds::merge)
-                        .orElse(group.get(0).line().bounds());
-
-        RawLine mergedLine =
-                new RawLine(
-                        group.get(0).line().lineId(),
-                        mergedFragments,
-                        mergedBounds,
-                        group.get(0).line().pageNumber());
-
-        return tokenize(mergedLine);
-    }
-
-    // ── tokenisation ─────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Splits fragments into word-level tokens; x-positions are estimated linearly within each
-     * fragment.
-     */
-    TokenizedLine tokenize(RawLine line) {
-        List<LineToken> tokens = new ArrayList<>();
-        for (TextFragment frag : line.fragments()) {
-            tokens.addAll(tokensFromFragment(frag));
-        }
-        List<LineToken> numeric = tokens.stream().filter(LineToken::numeric).toList();
-        return new TokenizedLine(line, tokens, numeric);
-    }
-
-    private List<LineToken> tokensFromFragment(TextFragment frag) {
-        String raw = frag.text();
-        if (raw == null || raw.isBlank()) return List.of();
-
-        float fragX = frag.bounds().x();
-        float fragWidth = frag.bounds().width();
-        int rawLen = raw.length();
-
-        List<LineToken> result = new ArrayList<>();
-        int offset = 0;
-        for (String part : raw.split("\\s+")) {
-            if (part.isEmpty()) {
-                offset++;
-                continue;
-            }
-            int idx = raw.indexOf(part, offset);
-            if (idx < 0) idx = offset;
-
-            float tokenX = rawLen > 0 ? fragX + ((float) idx / rawLen) * fragWidth : fragX;
-            float tokenRight =
-                    rawLen > 0
-                            ? fragX + ((float) (idx + part.length()) / rawLen) * fragWidth
-                            : fragX + fragWidth;
-
-            result.add(new LineToken(part, tokenX, tokenRight, NUMERIC.matcher(part).matches()));
-            offset = idx + part.length();
-        }
-        return result;
-    }
-
-    // ── column grid ──────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Returns confirmed column right-edge positions — those appearing on ≥ {@value
-     * #COLUMN_MIN_FREQUENCY} × N anchor lines.
-     */
-    private List<Float> buildColumnGrid(List<TokenizedLine> anchors) {
-        // bucket → set of line indices that contributed a numeric token to that bucket
-        Map<Integer, List<Integer>> bucketLines = new HashMap<>();
-        for (int i = 0; i < anchors.size(); i++) {
-            for (LineToken t : anchors.get(i).numeric()) {
-                int bucket = bucket(t.right());
-                bucketLines.computeIfAbsent(bucket, k -> new ArrayList<>()).add(i);
-            }
-        }
-
-        int minHits =
-                Math.max(MIN_TABLE_ROWS, (int) Math.ceil(anchors.size() * COLUMN_MIN_FREQUENCY));
-
-        // Confirmed buckets → average right-edge for that bucket
-        TreeMap<Integer, Float> confirmed = new TreeMap<>();
-        for (Map.Entry<Integer, List<Integer>> entry : bucketLines.entrySet()) {
-            // Count distinct lines
-            long distinctLines = entry.getValue().stream().distinct().count();
-            if (distinctLines >= minHits) {
-                double avg =
-                        entry.getValue().stream()
-                                .distinct() // weight each line equally regardless of token count
-                                .mapToDouble(
-                                        lineIdx ->
-                                                avgRightEdgeForBucket(
-                                                        anchors, lineIdx, entry.getKey()))
-                                .average()
-                                .orElse(entry.getKey() * (double) COLUMN_BUCKET_PT);
-                confirmed.put(entry.getKey(), (float) avg);
-            }
-        }
-
-        return new ArrayList<>(confirmed.values()); // already sorted by bucket (left to right)
-    }
-
-    /**
-     * Returns the average right-edge position of tokens in {@code line} whose bucket matches {@code
-     * targetBucket}, falling back to the bucket's nominal centre when no tokens match.
-     */
-    private double avgRightEdgeForBucket(
-            List<TokenizedLine> anchors, int lineIdx, int targetBucket) {
-        return anchors.get(lineIdx).numeric().stream()
-                .filter(t -> bucket(t.right()) == targetBucket)
-                .mapToDouble(LineToken::right)
-                .average()
-                .orElse(targetBucket * (double) COLUMN_BUCKET_PT);
-    }
-
-    // ── grouping ─────────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Groups anchor lines into table candidates, including adjacent label rows; a gap &gt;
-     * MAX_GAP_FACTOR × modal spacing splits groups.
-     */
-    private List<List<TokenizedLine>> groupRows(
-            List<TokenizedLine> all, List<Float> columnGrid, float modalSpacing) {
-        float maxGap = modalSpacing > 0 ? modalSpacing * MAX_GAP_FACTOR : 30f;
-
-        List<List<TokenizedLine>> groups = new ArrayList<>();
-        List<TokenizedLine> current = new ArrayList<>();
-
-        for (int i = 0; i < all.size(); i++) {
-            TokenizedLine tl = all.get(i);
-            boolean fits = tl.isAnchor() && matchesGrid(tl, columnGrid);
-
-            if (current.isEmpty()) {
-                if (fits) current.add(tl);
-                continue;
-            }
-
-            float gap =
-                    tl.line().bounds().y()
-                            - current.get(current.size() - 1).line().bounds().bottom();
-
-            if (gap > maxGap) {
-                groups.add(current);
-                current = new ArrayList<>();
-                if (fits) current.add(tl);
-                continue;
-            }
-
-            if (fits) {
-                current.add(tl);
-            } else if (!tl.line().text().isBlank()) {
-                // Include non-anchor lines (labels) only if they have text and are within
-                // proximity.
-                current.add(tl);
-            }
-        }
-
-        if (!current.isEmpty()) groups.add(current);
-
-        return groups.stream().filter(g -> hasEnoughAnchorRows(g, columnGrid)).toList();
-    }
-
-    private boolean hasEnoughAnchorRows(List<TokenizedLine> group, List<Float> columnGrid) {
-        return group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count()
-                >= MIN_TABLE_ROWS;
-    }
-
-    /** A line "matches" the grid when ≥ 60 % of its numeric tokens land in confirmed columns. */
-    private boolean matchesGrid(TokenizedLine tl, List<Float> columnGrid) {
-        if (tl.numeric().isEmpty()) return false;
-        long matches =
-                tl.numeric().stream()
-                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
-                        .count();
-        return (double) matches / tl.numeric().size() >= 0.60;
-    }
-
-    private boolean hasInconsistentColumnMatch(TokenizedLine tl, List<Float> columnGrid) {
-        if (tl.numeric().isEmpty()) return false;
-        long hits =
-                tl.numeric().stream()
-                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
-                        .count();
-        return (double) hits / tl.numeric().size() < 0.60;
-    }
-
-    // ── fragment assembly ────────────────────────────────────────────────────────────────────────
-
-    private Optional<TableFragment> buildFragment(
-            List<TokenizedLine> group, List<Float> columnGrid, int pageNumber, int tableIndex) {
-
-        long anchorCount =
-                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
-        if (anchorCount < MIN_TABLE_ROWS) return Optional.empty();
-
-        List<String> warnings = new ArrayList<>();
-        List<List<String>> rawRows = new ArrayList<>();
-        List<TableRow> rows = new ArrayList<>();
-
-        for (int rowIdx = 0; rowIdx < group.size(); rowIdx++) {
-            TokenizedLine tl = group.get(rowIdx);
-            List<String> rawRow = buildRawRow(tl, columnGrid);
-            rawRows.add(Collections.unmodifiableList(rawRow));
-            rows.add(buildTableRow(rowIdx, tl, rawRow, columnGrid));
-        }
-
-        // Column count = 1 label column + confirmed numeric columns
-        int colCount = columnGrid.size() + 1;
-        Bounds bounds = computeGroupBounds(group);
-        float confidence = computeConfidence(group, columnGrid, warnings);
-
-        return Optional.of(
-                new TableFragment(
-                        "tbl-la-p" + pageNumber + "-" + tableIndex,
-                        pageNumber,
-                        bounds,
-                        List.of(),
-                        Collections.unmodifiableList(rows),
-                        Collections.unmodifiableList(rawRows),
-                        colCount,
-                        confidence,
-                        Collections.unmodifiableList(warnings),
-                        null));
-    }
-
-    /**
-     * Builds a raw row as a list of strings: index 0 = label text, indices 1..N = column values.
-     */
-    private List<String> buildRawRow(TokenizedLine tl, List<Float> columnGrid) {
-        String[] cells = new String[columnGrid.size() + 1];
-        Arrays.fill(cells, "");
-
-        // Separate label tokens (those not landing in any confirmed column) from column tokens.
-        List<String> labelParts = new ArrayList<>();
-        for (LineToken token : tl.all()) {
-            int col = nearestColumnIndex(token.right(), columnGrid);
-            if (col >= 0 && token.numeric()) {
-                int cellIdx = col + 1;
-                cells[cellIdx] =
-                        cells[cellIdx].isEmpty()
-                                ? token.text()
-                                : cells[cellIdx] + " " + token.text();
-            } else {
-                labelParts.add(token.text());
-            }
-        }
-        cells[0] = String.join(" ", labelParts).trim();
-        return Arrays.asList(cells);
-    }
-
-    private TableRow buildTableRow(
-            int rowIdx, TokenizedLine tl, List<String> rawRow, List<Float> columnGrid) {
-        List<TableCell> cells = new ArrayList<>(rawRow.size());
-
-        // Label cell: use the line's full bounds as an approximation.
-        cells.add(TableCell.of(0, rawRow.get(0), tl.line().bounds()));
-
-        for (int col = 0; col < columnGrid.size(); col++) {
-            String text = col + 1 < rawRow.size() ? rawRow.get(col + 1) : "";
-            float right = columnGrid.get(col);
-            float left = col > 0 ? columnGrid.get(col - 1) : right - 50f;
-            Bounds cellBounds =
-                    new Bounds(
-                            left,
-                            tl.line().bounds().y(),
-                            right - left,
-                            tl.line().bounds().height());
-            cells.add(TableCell.of(col + 1, text, cellBounds));
-        }
-        return new TableRow(rowIdx, Collections.unmodifiableList(cells));
-    }
-
-    // ── confidence scoring ───────────────────────────────────────────────────────────────────────
-
-    /**
-     * Heuristic score in [0.0, 0.85] (ceiling keeps results below Tabula lattice which starts at
-     * 1.0). Base 0.70; +0.05/col beyond 2 (max +0.10); +0.05 at ≥5 anchors, +0.05 at ≥8; −0.15 if
-     * &gt;30 % of anchors have inconsistent columns; −0.10 if non-anchors outnumber anchors.
-     */
-    private float computeConfidence(
-            List<TokenizedLine> group, List<Float> columnGrid, List<String> warnings) {
-        float score = 0.70f;
-
-        long anchorCount =
-                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
-        long totalRows = group.size();
-
-        // More columns
-        int extraCols = Math.min(columnGrid.size() - MIN_COLUMNS, 2);
-        score += extraCols * 0.05f;
-
-        // More anchor rows
-        if (anchorCount >= 5) score += 0.05f;
-        if (anchorCount >= 8) score += 0.05f;
-
-        // Inconsistent column matching
-        long inconsistent =
-                group.stream()
-                        .filter(TokenizedLine::isAnchor)
-                        .filter(tl -> hasInconsistentColumnMatch(tl, columnGrid))
-                        .count();
-        if (inconsistent > anchorCount * 0.30) {
-            score -= 0.15f;
-            warnings.add(
-                    "Column match inconsistent on "
-                            + inconsistent
-                            + "/"
-                            + anchorCount
-                            + " anchor rows");
-        }
-
-        // Label-heavy
-        long nonAnchor = totalRows - anchorCount;
-        if (nonAnchor > anchorCount) {
-            score -= 0.10f;
-            warnings.add(
-                    "Non-anchor rows ("
-                            + nonAnchor
-                            + ") outnumber anchor rows ("
-                            + anchorCount
-                            + ")");
-        }
-
-        return Math.max(0f, Math.min(0.85f, score));
-    }
-
-    // ── utility ──────────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Returns the grid index nearest to {@code rightEdge}, or -1 if none is within {@value
-     * #COLUMN_MATCH_BUCKETS} buckets.
-     */
-    private int nearestColumnIndex(float rightEdge, List<Float> grid) {
-        int nearest = -1;
-        float minDist = COLUMN_MATCH_BUCKETS * COLUMN_BUCKET_PT + 1f;
-        for (int i = 0; i < grid.size(); i++) {
-            float dist = Math.abs(rightEdge - grid.get(i));
-            if (dist < minDist) {
-                minDist = dist;
-                nearest = i;
-            }
-        }
-        return nearest;
-    }
-
-    private Bounds computeGroupBounds(List<TokenizedLine> group) {
-        return group.stream()
-                .map(tl -> tl.line().bounds())
-                .reduce(Bounds::merge)
-                .orElse(new Bounds(0, 0, 0, 0));
-    }
-
-    /** Modal gap between consecutive line edges, used to calibrate the group-split threshold. */
-    private float computeModalSpacing(List<RawLine> lines) {
-        if (lines.size() < 2) return 0f;
-        Map<Float, Long> freq = new HashMap<>();
-        for (int i = 1; i < lines.size(); i++) {
-            float gap = lines.get(i).bounds().y() - lines.get(i - 1).bounds().bottom();
-            if (gap > 0) freq.merge(Math.round(gap / 2f) * 2f, 1L, Long::sum);
-        }
-        return freq.entrySet().stream()
-                .max(Map.Entry.comparingByValue())
-                .map(Map.Entry::getKey)
-                .orElse(0f);
-    }
-
-    private static int bucket(float x) {
-        return Math.round(x / COLUMN_BUCKET_PT);
-    }
-
-    // ── private data types ───────────────────────────────────────────────────────────────────────
-
-    /** A word-level token with an approximate right-edge x-position. */
-    record LineToken(String text, float x, float right, boolean numeric) {}
-
-    /** A {@link RawLine} with tokens pre-computed; an "anchor" has ≥ 2 numeric tokens. */
-    record TokenizedLine(RawLine line, List<LineToken> all, List<LineToken> numeric) {
-        boolean isAnchor() {
-            return numeric.size() >= 2;
-        }
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineBuilder.java

@@ -1,139 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.List;
-
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Groups {@link TextFragment} objects into visual {@link RawLine}s using baseline proximity.
- *
- * <p>Fragments are on the same line when their baselines are within a font-size-derived tolerance.
- * A new line starts whenever the horizontal gap exceeds an adaptive column-gap threshold ({@code
- * max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT)}), splitting two-column text.
- */
-@Service
-@Slf4j
-public class LineBuilder {
-
-    /** Baseline tolerance as a fraction of font size; 0.5 keeps mixed-size text on one line. */
-    private static final float BASELINE_TOLERANCE_FACTOR = 0.5f;
-
-    /** Absolute minimum tolerance so tiny font sizes don't collapse multi-line content. */
-    private static final float MIN_BASELINE_TOLERANCE = 2f;
-
-    /**
-     * Column-gap threshold as a fraction of page width; 0.10 clears tab stops but stays below
-     * two-column gutters.
-     */
-    static final float COLUMN_GAP_RATIO = 0.10f;
-
-    /** Floor for the column-gap threshold so narrow pages don't over-split lines. */
-    static final float COLUMN_GAP_MIN_PT = 40f;
-
-    public List<RawLine> build(List<TextFragment> fragments, int pageNumber) {
-        if (fragments.isEmpty()) return List.of();
-
-        float effectiveWidth = inferEffectiveWidth(fragments);
-        float columnGapThreshold = Math.max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT);
-        log.debug(
-                "LineBuilder page {}: effectiveWidth={:.1f}pt, columnGapThreshold={:.1f}pt",
-                pageNumber,
-                effectiveWidth,
-                columnGapThreshold);
-
-        // Sort top-to-bottom first, then left-to-right within the same baseline band.
-        List<TextFragment> sorted =
-                fragments.stream()
-                        .sorted(
-                                Comparator.comparingDouble(TextFragment::baseline)
-                                        .thenComparingDouble(f -> f.bounds().x()))
-                        .toList();
-
-        List<List<TextFragment>> groups = groupByBaseline(sorted, columnGapThreshold);
-
-        List<RawLine> lines = new ArrayList<>(groups.size());
-        for (int i = 0; i < groups.size(); i++) {
-            List<TextFragment> group =
-                    groups.get(i).stream()
-                            .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
-                            .toList();
-
-            Bounds lineBounds =
-                    group.stream()
-                            .map(TextFragment::bounds)
-                            .reduce(Bounds::merge)
-                            .orElse(new Bounds(0, 0, 0, 0));
-
-            lines.add(new RawLine("ln-p" + pageNumber + "-" + i, group, lineBounds, pageNumber));
-        }
-        return lines;
-    }
-
-    private List<List<TextFragment>> groupByBaseline(
-            List<TextFragment> sorted, float columnGapThreshold) {
-        List<List<TextFragment>> groups = new ArrayList<>();
-        List<TextFragment> current = new ArrayList<>();
-        float currentBaseline = Float.NaN;
-
-        for (TextFragment fragment : sorted) {
-            if (current.isEmpty()) {
-                current.add(fragment);
-                currentBaseline = fragment.baseline();
-                continue;
-            }
-
-            float maxFontSize =
-                    Math.max(
-                            fragment.fontSize(),
-                            (float)
-                                    current.stream()
-                                            .mapToDouble(TextFragment::fontSize)
-                                            .max()
-                                            .orElse(0));
-            float tolerance =
-                    Math.max(maxFontSize * BASELINE_TOLERANCE_FACTOR, MIN_BASELINE_TOLERANCE);
-
-            boolean sameBaseline = Math.abs(fragment.baseline() - currentBaseline) <= tolerance;
-            boolean columnGap = sameBaseline && hasColumnGap(fragment, current, columnGapThreshold);
-
-            if (sameBaseline && !columnGap) {
-                current.add(fragment);
-                // Anchor to the weighted mean baseline so long lines stay stable.
-                currentBaseline =
-                        (currentBaseline * (current.size() - 1) + fragment.baseline())
-                                / current.size();
-            } else {
-                groups.add(current);
-                current = new ArrayList<>();
-                current.add(fragment);
-                currentBaseline = fragment.baseline();
-            }
-        }
-
-        if (!current.isEmpty()) groups.add(current);
-        return groups;
-    }
-
-    /**
-     * True when the gap from the rightmost fragment in {@code group} to {@code next} exceeds {@code
-     * threshold}.
-     */
-    private static boolean hasColumnGap(
-            TextFragment next, List<TextFragment> group, float threshold) {
-        float lastRight = group.get(group.size() - 1).bounds().right();
-        return next.bounds().x() - lastRight > threshold;
-    }
-
-    /** Infers effective page width from the rightmost fragment right-edge plus a 10 % margin. */
-    private static float inferEffectiveWidth(List<TextFragment> fragments) {
-        double maxRight =
-                fragments.stream().mapToDouble(f -> f.bounds().right()).max().orElse(500.0);
-        return (float) maxRight * 1.10f;
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PageColumnLayout.java

@@ -0,0 +1,142 @@
+package stirling.software.SPDF.pdf.parser;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Detects whether a page is one- or two-column from per-line bounding boxes, and classifies an
+ * X-span into the column it belongs to. Detection is a midpoint vote at {@code pageWidth / 2}.
+ *
+ * <p>Capped at two columns by design — sufficient for the redaction target set (single-column
+ * documents and IEEE-style two-column papers). 3+ column layouts (newspapers, magazines) and
+ * off-centre gutters (asymmetric two-column) would need a histogram or clustering approach to
+ * detect the actual gutter X. (future work)
+ *
+ * <p>Coordinates are PDFTextStripper screen space (top-left origin, Y increases downward).
+ */
+public final class PageColumnLayout {
+
+    /**
+     * Slack when checking "crosses a gutter" so single-pixel overshoots don't mark a line as
+     * spanning.
+     */
+    public static final float SPAN_SLACK_PT = 2f;
+
+    /**
+     * Slack on each side of the page midpoint inside which a line is considered "spanning"
+     * (covering both columns) rather than belonging to one side.
+     */
+    private static final float MIDPOINT_SLACK_PT = 30f;
+
+    /**
+     * Minimum line width (points) for a line to count toward the two-column tally. Avoids false
+     * positives where right-aligned dates, page numbers, or short "Link" fragments next to a
+     * heading look like a second column when they're really just inline metadata.
+     */
+    private static final float MIN_COLUMN_LINE_WIDTH_PT = 100f;
+
+    /**
+     * Minimum number of clearly leftish AND clearly rightish lines (each of width &ge; {@link
+     * #MIN_COLUMN_LINE_WIDTH_PT}) required to call the page two-column. Anything below this falls
+     * back to single-column.
+     */
+    private static final int MIN_SIDE_LINES = 3;
+
+    private final List<float[]> columns;
+    private final List<float[]> gutters;
+
+    private PageColumnLayout(List<float[]> columns, List<float[]> gutters) {
+        this.columns = columns;
+        this.gutters = gutters;
+    }
+
+    /**
+     * Determines column layout from per-line bounding boxes ({@code [x1, _, x2, _]}). Counts lines
+     * whose X-midpoint sits clearly left of, or clearly right of, the page midpoint (with {@link
+     * #MIDPOINT_SLACK_PT} slack each side). If both sides have at least {@link #MIN_SIDE_LINES}
+     * lines, the page is treated as two-column with the gutter at the page midpoint. Otherwise it's
+     * single-column.
+     *
+     * <p>Cross-column lines must already be split: callers should feed boxes from a line extractor
+     * that splits same-Y glyphs at large X gaps (see {@code AllTextLineExtractor}). Without that
+     * split, IEEE-style aligned-baseline 2-column PDFs produce one wide merged box per row and the
+     * side tallies all end up classified as "spanning", falling to single-column.
+     */
+    public static PageColumnLayout fromLineBoxes(List<float[]> lineBoxes, float pageWidth) {
+        if (lineBoxes == null || lineBoxes.isEmpty()) {
+            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
+        }
+        float pageMid = pageWidth / 2f;
+        int left = 0, right = 0;
+        for (float[] lb : lineBoxes) {
+            if (lb == null || lb.length < 3) continue;
+            float width = lb[2] - lb[0];
+            // Skip narrow lines — dates, page numbers, "Link" labels next to a heading should
+            // not, on their own, make a single-column doc look two-column.
+            if (width < MIN_COLUMN_LINE_WIDTH_PT) continue;
+            float mid = (lb[0] + lb[2]) * 0.5f;
+            if (mid < pageMid - MIDPOINT_SLACK_PT) left++;
+            else if (mid > pageMid + MIDPOINT_SLACK_PT) right++;
+        }
+        if (left < MIN_SIDE_LINES || right < MIN_SIDE_LINES) {
+            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
+        }
+        float gutterL = pageMid - MIDPOINT_SLACK_PT;
+        float gutterR = pageMid + MIDPOINT_SLACK_PT;
+        return new PageColumnLayout(
+                List.of(new float[] {0f, gutterL}, new float[] {gutterR, pageWidth}),
+                List.of(new float[] {gutterL, gutterR}));
+    }
+
+    /** All columns, left-to-right, as {@code [leftX, rightX]} pairs. Never empty. */
+    public List<float[]> columns() {
+        return columns;
+    }
+
+    /** Gutters between columns, left-to-right, as {@code [leftX, rightX]} pairs. */
+    public List<float[]> gutters() {
+        return gutters;
+    }
+
+    public int columnCount() {
+        return columns.size();
+    }
+
+    /**
+     * Returns the column index containing the X-midpoint of {@code [x1, x2]}, falling back to the
+     * closest column if the midpoint sits inside a gutter.
+     */
+    public int columnOf(float x1, float x2) {
+        float mid = (x1 + x2) * 0.5f;
+        int best = 0;
+        float bestDist = Float.MAX_VALUE;
+        for (int i = 0; i < columns.size(); i++) {
+            float[] c = columns.get(i);
+            if (mid >= c[0] && mid <= c[1]) return i;
+            float dist = mid < c[0] ? c[0] - mid : mid - c[1];
+            if (dist < bestDist) {
+                bestDist = dist;
+                best = i;
+            }
+        }
+        return best;
+    }
+
+    /**
+     * Returns every column index whose X-range overlaps {@code [x1, x2]} with at least {@link
+     * #SPAN_SLACK_PT} of intrusion. A normal in-column line returns one index; a line crossing a
+     * gutter returns two or more.
+     */
+    public int[] columnsCrossing(float x1, float x2) {
+        List<Integer> hits = new ArrayList<>();
+        for (int i = 0; i < columns.size(); i++) {
+            float[] c = columns.get(i);
+            float overlap = Math.min(x2, c[1]) - Math.max(x1, c[0]);
+            if (overlap > SPAN_SLACK_PT) hits.add(i);
+        }
+        if (hits.isEmpty()) hits.add(columnOf(x1, x2));
+        int[] out = new int[hits.size()];
+        for (int i = 0; i < hits.size(); i++) out[i] = hits.get(i);
+        return out;
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PageImageLocator.java

@@ -0,0 +1,133 @@
+package stirling.software.SPDF.pdf.parser;
+
+import java.awt.geom.Point2D;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.pdfbox.contentstream.PDFGraphicsStreamEngine;
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.graphics.image.PDImage;
+import org.apache.pdfbox.util.Matrix;
+
+/**
+ * PDFGraphicsStreamEngine that intercepts {@code drawImage} calls and records each image's bounding
+ * box in PDF user-space (origin bottom-left, Y up) by transforming the unit square through the
+ * current transformation matrix (CTM).
+ *
+ * <p>Usage:
+ *
+ * <pre>{@code
+ * PageImageLocator locator = new PageImageLocator(page, pageIndex);
+ * locator.processPage(page);
+ * List<ImageBox> boxes = locator.getImageBoxes();
+ * }</pre>
+ *
+ * <p>Each {@link ImageBox} carries the 0-based page index and the axis-aligned bounding box {@code
+ * (x1, y1, x2, y2)} in PDF user-space coordinates.
+ */
+public final class PageImageLocator extends PDFGraphicsStreamEngine {
+
+    /**
+     * Bounding box of a raster or vector image found on a PDF page.
+     *
+     * @param pageIndex 0-based page index
+     * @param x1 left edge in PDF user-space (origin bottom-left)
+     * @param y1 bottom edge in PDF user-space
+     * @param x2 right edge
+     * @param y2 top edge
+     */
+    public record ImageBox(int pageIndex, float x1, float y1, float x2, float y2) {}
+
+    private final int pageIndex;
+    private final List<ImageBox> imageBoxes = new ArrayList<>();
+    private final Point2D.Float currentPoint = new Point2D.Float();
+
+    /**
+     * @param page the PDPage to process
+     * @param pageIndex 0-based index of this page in the document (stored on each returned {@link
+     *     ImageBox})
+     */
+    public PageImageLocator(PDPage page, int pageIndex) {
+        super(page);
+        this.pageIndex = pageIndex;
+    }
+
+    /** Returns all image bounding boxes collected during {@link #processPage}. */
+    public List<ImageBox> getImageBoxes() {
+        return imageBoxes;
+    }
+
+    @Override
+    public void drawImage(PDImage pdImage) throws IOException {
+        Matrix ctm = getGraphicsState().getCurrentTransformationMatrix();
+        // An image occupies the unit square (0,0)→(1,1) in image space.
+        // Transform all four corners through the CTM to get the page-space bounding box.
+        float a = ctm.getScaleX();
+        float b = ctm.getShearY();
+        float c = ctm.getShearX();
+        float d = ctm.getScaleY();
+        float e = ctm.getTranslateX();
+        float f = ctm.getTranslateY();
+        float[] xs = {e, a + e, c + e, a + c + e};
+        float[] ys = {f, b + f, d + f, b + d + f};
+        float x1 = Float.MAX_VALUE, y1 = Float.MAX_VALUE;
+        float x2 = -Float.MAX_VALUE, y2 = -Float.MAX_VALUE;
+        for (float x : xs) {
+            x1 = Math.min(x1, x);
+            x2 = Math.max(x2, x);
+        }
+        for (float y : ys) {
+            y1 = Math.min(y1, y);
+            y2 = Math.max(y2, y);
+        }
+        imageBoxes.add(new ImageBox(pageIndex, x1, y1, x2, y2));
+    }
+
+    // ---------- required abstract methods (no-op for path operations) ----------
+
+    @Override
+    public void appendRectangle(Point2D p0, Point2D p1, Point2D p2, Point2D p3) {}
+
+    @Override
+    public void clip(int windingRule) {}
+
+    @Override
+    public void moveTo(float x, float y) {
+        currentPoint.setLocation(x, y);
+    }
+
+    @Override
+    public void lineTo(float x, float y) {
+        currentPoint.setLocation(x, y);
+    }
+
+    @Override
+    public void curveTo(float x1, float y1, float x2, float y2, float x3, float y3) {
+        currentPoint.setLocation(x3, y3);
+    }
+
+    @Override
+    public Point2D getCurrentPoint() {
+        return currentPoint;
+    }
+
+    @Override
+    public void closePath() {}
+
+    @Override
+    public void endPath() {}
+
+    @Override
+    public void strokePath() {}
+
+    @Override
+    public void fillPath(int windingRule) {}
+
+    @Override
+    public void fillAndStrokePath(int windingRule) {}
+
+    @Override
+    public void shadingFill(COSName shadingName) {}
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PdfIngester.java

@@ -1,79 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Runs the per-page ingestion pipeline: {@link WordExtractingStripper} → {@link LineBuilder} →
- * {@link TableParser}, producing a {@link PdfModels.ParsedPage} per page. The caller owns the
- * {@link PDDocument} lifecycle.
- */
-@Service
-@RequiredArgsConstructor
-@Slf4j
-public class PdfIngester {
-
-    private final LineBuilder lineBuilder;
-    private final TableParser tableParser;
-
-    public List<ParsedPage> parse(PDDocument document) throws IOException {
-        return parse(document, document.getNumberOfPages());
-    }
-
-    public List<ParsedPage> parse(PDDocument document, int maxPages) throws IOException {
-        int pageCount = Math.min(document.getNumberOfPages(), maxPages);
-        List<ParsedPage> pages = new ArrayList<>(pageCount);
-        long fragmentsMs = 0;
-        long tablesMs = 0;
-        long t0 = System.currentTimeMillis();
-
-        for (int p = 1; p <= pageCount; p++) {
-            long ft = System.currentTimeMillis();
-            List<TextFragment> fragments = extractFragments(document, p);
-            fragmentsMs += System.currentTimeMillis() - ft;
-
-            PDPage page = document.getPage(p - 1);
-            PDRectangle mediaBox = page.getMediaBox();
-            List<RawLine> lines = lineBuilder.build(fragments, p);
-            RawPage rawPage = new RawPage(p, mediaBox.getWidth(), mediaBox.getHeight(), lines);
-
-            long tt = System.currentTimeMillis();
-            List<TableFragment> tables = tableParser.parse(document, rawPage);
-            tablesMs += System.currentTimeMillis() - tt;
-
-            log.debug(
-                    "Page {}: {} fragments → {} lines, {} table(s)",
-                    p,
-                    fragments.size(),
-                    lines.size(),
-                    tables.size());
-            pages.add(new ParsedPage(p, mediaBox.getWidth(), mediaBox.getHeight(), tables, lines));
-        }
-
-        log.info(
-                "[timing] parse pages={} total={}ms fragments={}ms tables={}ms",
-                pageCount,
-                System.currentTimeMillis() - t0,
-                fragmentsMs,
-                tablesMs);
-        return pages;
-    }
-
-    private List<TextFragment> extractFragments(PDDocument document, int pageNumber)
-            throws IOException {
-        WordExtractingStripper stripper = new WordExtractingStripper(pageNumber);
-        stripper.getText(document);
-        return stripper.getFragments();
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/WordExtractingStripper.java

@@ -1,113 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.font.PDFont;
-import org.apache.pdfbox.text.PDFTextStripper;
-import org.apache.pdfbox.text.TextPosition;
-
-/**
- * Extends {@link PDFTextStripper} to capture per-fragment geometry and font metadata.
- *
- * <p>Overrides {@link #writeString} to split each content-stream string into word-level {@link
- * TextFragment}s with bounding boxes, baseline, font name, and bold flag. Coordinates are in
- * PDFTextStripper space: (0,0) top-left, Y increases downward, {@code getY()} is the baseline.
- */
-class WordExtractingStripper extends PDFTextStripper {
-
-    private final int targetPage;
-    private final List<TextFragment> fragments = new ArrayList<>();
-    private int fragmentIndex = 0;
-
-    WordExtractingStripper(int pageNumber) throws IOException {
-        this.targetPage = pageNumber;
-        setStartPage(pageNumber);
-        setEndPage(pageNumber);
-        setSortByPosition(true);
-    }
-
-    @Override
-    protected void startPage(PDPage page) throws IOException {
-        super.startPage(page);
-        fragments.clear();
-        fragmentIndex = 0;
-    }
-
-    @Override
-    protected void writeString(String text, List<TextPosition> textPositions) throws IOException {
-        if (text == null || text.isBlank()) return;
-
-        // Fast path: no whitespace → emit one fragment (most financial PDFs have each
-        // number as its own string operation, so this is the common case).
-        if (text.indexOf(' ') < 0) {
-            emitFragment(text, textPositions);
-            return;
-        }
-
-        // Per-word splitting requires 1:1 text-char to TextPosition correspondence.
-        // Fall back to one fragment when sizes differ (ligatures, encoding edge cases).
-        if (textPositions.size() != text.length()) {
-            emitFragment(text, textPositions);
-            return;
-        }
-
-        // Emit one TextFragment per whitespace-delimited word with accurate per-word bounds.
-        int start = 0;
-        for (int i = 0; i <= text.length(); i++) {
-            if (i == text.length() || text.charAt(i) == ' ') {
-                if (start < i) {
-                    emitFragment(text.substring(start, i), textPositions.subList(start, i));
-                }
-                start = i + 1;
-            }
-        }
-    }
-
-    private void emitFragment(String text, List<TextPosition> positions) {
-        if (positions.isEmpty()) return;
-
-        float minX = Float.MAX_VALUE;
-        float minY = Float.MAX_VALUE;
-        float maxRight = -Float.MAX_VALUE;
-        float maxBaseline = -Float.MAX_VALUE;
-        TextPosition first = null;
-
-        for (TextPosition tp : positions) {
-            if (tp == null) continue;
-            if (first == null) first = tp;
-
-            float x = tp.getX();
-            // getY() is the baseline; top of character = getY() - getHeight().
-            float top = tp.getY() - tp.getHeight();
-            float right = x + tp.getWidth();
-            float baseline = tp.getY();
-
-            minX = Math.min(minX, x);
-            minY = Math.min(minY, top);
-            maxRight = Math.max(maxRight, right);
-            maxBaseline = Math.max(maxBaseline, baseline);
-        }
-
-        if (first == null) return;
-
-        PDFont font = first.getFont();
-        String fontName = font != null ? font.getName() : "";
-        boolean bold = fontName != null && fontName.toLowerCase().contains("bold");
-        // getHeight() gives the rendered glyph height, which is the most reliable visual size.
-        float fontSize = first.getHeight();
-
-        Bounds bounds = new Bounds(minX, minY, maxRight - minX, maxBaseline - minY);
-        String id = "tf-p" + targetPage + "-" + fragmentIndex++;
-        fragments.add(new TextFragment(id, text, bounds, maxBaseline, fontSize, fontName, bold));
-    }
-
-    List<TextFragment> getFragments() {
-        return Collections.unmodifiableList(fragments);
-    }
-}

app/common/src/main/java/stirling/software/common/cluster/FileStore.java

@@ -11,23 +11,39 @@ public interface FileStore {
     /** Stored file record. */
     record Stored(String fileId, long size) {}
 
-    /** Store the given stream and return a generated file id and total bytes written. */
-    Stored store(InputStream in, String originalName) throws IOException;
+    /**
+     * Store the given stream and return a generated file id and total bytes written. {@code owner}
+     * may be null to indicate the file has no associated user (anonymous / desktop / async job with
+     * no propagated security context); a non-null value is persisted alongside the data so {@link
+     * #getOwner(String)} can return it later for authorization checks.
+     */
+    Stored store(InputStream in, String originalName, String owner) throws IOException;
+
+    /** Store with no owner. Equivalent to {@link #store(InputStream, String, String)} with null. */
+    default Stored store(InputStream in, String originalName) throws IOException {
+        return store(in, originalName, null);
+    }
 
     /**
      * Store the file at {@code source} and return a generated file id and total bytes written.
      *
      * <p>Default implementation opens {@code source} as a stream and delegates to {@link
-     * #store(InputStream, String)}. Local-disk implementations should override to use a direct
-     * file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on Linux),
-     * which avoids the two-memory-copy hit of streaming a disk-backed upload through the JVM heap.
+     * #store(InputStream, String, String)}. Local-disk implementations should override to use a
+     * direct file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on
+     * Linux), which avoids the two-memory-copy hit of streaming a disk-backed upload through the
+     * JVM heap.
      */
-    default Stored store(Path source, String originalName) throws IOException {
+    default Stored store(Path source, String originalName, String owner) throws IOException {
         try (InputStream in = Files.newInputStream(source)) {
-            return store(in, originalName);
+            return store(in, originalName, owner);
         }
     }
 
+    /** Store with no owner. Equivalent to {@link #store(Path, String, String)} with null. */
+    default Stored store(Path source, String originalName) throws IOException {
+        return store(source, originalName, null);
+    }
+
     /** Open the stored file for streaming reads. Caller closes. */
     InputStream retrieve(String fileId) throws IOException;
 
@@ -42,4 +58,12 @@ public interface FileStore {
 
     /** Whether the file id exists in the store. */
     boolean exists(String fileId);
+
+    /**
+     * Returns the owner identifier recorded at store time, or {@code null} if the file does not
+     * exist or was stored without an owner. Implementations must not throw when the file is missing
+     * or when the owner record is absent; they should return null so callers can treat "no owner"
+     * as a non-authoritative case.
+     */
+    String getOwner(String fileId) throws IOException;
 }

app/common/src/main/java/stirling/software/common/cluster/RateLimitStore.java

@@ -2,7 +2,13 @@ package stirling.software.common.cluster;
 
 import java.time.Duration;
 
-/** Token-bucket rate limiting backed by the cluster backplane. */
+/**
+ * Token-bucket rate limiting backed by the cluster backplane.
+ *
+ * <p>In-process implementations enforce a per-JVM limit; distributed implementations enforce a
+ * single global limit across every node. Both use a Bucket4j greedy-refill token bucket so the
+ * semantics match across single-node and cluster deployments.
+ */
 public interface RateLimitStore {
 
     /**

app/common/src/main/java/stirling/software/common/cluster/inprocess/LocalDiskFileStore.java

@@ -3,9 +3,12 @@ package stirling.software.common.cluster.inprocess;
 import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;
+import java.util.concurrent.locks.ReentrantLock;
+import java.util.regex.Pattern;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -15,33 +18,47 @@ import stirling.software.common.cluster.FileStore;
 @Slf4j
 public class LocalDiskFileStore implements FileStore {
 
+    private static final String OWNER_SUFFIX = ".owner";
+
+    // File ids are generated as random UUIDs; reject anything else so a tainted id can never reach
+    // Files.* APIs (defence in depth on top of the resolve() prefix check, and silences CodeQL's
+    // path-injection finding on the resolveOwner sidecar lookup).
+    private static final Pattern UUID_PATTERN =
+            Pattern.compile(
+                    "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$");
+
     private final String baseDirPath;
+    // Fixed-size lock stripes so concurrent store/delete on the same (or colliding) fileId
+    // serialise the data-file + owner-sidecar pair as one critical section. Striped (not
+    // per-id) so the map never has to be cleaned up; collisions across unrelated ids are
+    // harmless contention.
+    private static final int LOCK_STRIPES = 64;
+    private final ReentrantLock[] stripes = new ReentrantLock[LOCK_STRIPES];
 
     public LocalDiskFileStore(String baseDirPath) {
         this.baseDirPath = baseDirPath;
+        for (int i = 0; i < LOCK_STRIPES; i++) {
+            stripes[i] = new ReentrantLock();
+        }
     }
 
     @Override
-    public Stored store(InputStream in, String originalName) throws IOException {
+    public Stored store(InputStream in, String originalName, String owner) throws IOException {
         String fileId = UUID.randomUUID().toString();
         Path filePath = resolve(fileId);
         Files.createDirectories(filePath.getParent());
+        ReentrantLock lock = acquire(fileId);
         boolean success = false;
         try {
             long size = Files.copy(in, filePath);
+            writeOwner(fileId, owner);
             success = true;
             return new Stored(fileId, size);
         } finally {
             if (!success) {
-                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
-                }
+                cleanupAfterFailedStore(fileId, filePath);
             }
+            release(fileId, lock);
         }
     }
 
@@ -52,27 +69,44 @@ public class LocalDiskFileStore implements FileStore {
      * the source size before copying so the post-copy stat is unnecessary.
      */
     @Override
-    public Stored store(Path source, String originalName) throws IOException {
+    public Stored store(Path source, String originalName, String owner) throws IOException {
         String fileId = UUID.randomUUID().toString();
         Path filePath = resolve(fileId);
         Files.createDirectories(filePath.getParent());
         long size = Files.size(source);
+        ReentrantLock lock = acquire(fileId);
         boolean success = false;
         try {
             Files.copy(source, filePath);
+            writeOwner(fileId, owner);
             success = true;
             return new Stored(fileId, size);
         } finally {
             if (!success) {
-                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
-                }
+                cleanupAfterFailedStore(fileId, filePath);
             }
+            release(fileId, lock);
+        }
+    }
+
+    private void writeOwner(String fileId, String owner) throws IOException {
+        if (owner == null || owner.isBlank()) {
+            return;
+        }
+        Path ownerPath = resolveOwner(fileId);
+        Files.write(ownerPath, owner.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private void cleanupAfterFailedStore(String fileId, Path filePath) {
+        try {
+            Files.deleteIfExists(filePath);
+        } catch (IOException cleanupEx) {
+            log.warn("Failed to clean up partial file {} after store failure", filePath, cleanupEx);
+        }
+        try {
+            Files.deleteIfExists(resolveOwner(fileId));
+        } catch (IOException cleanupEx) {
+            log.warn("Failed to clean up owner sidecar for {} after store failure", fileId);
         }
     }
 
@@ -101,11 +135,26 @@ public class LocalDiskFileStore implements FileStore {
 
     @Override
     public boolean delete(String fileId) {
+        ReentrantLock lock = acquire(fileId);
         try {
-            return Files.deleteIfExists(resolve(fileId));
-        } catch (IOException e) {
-            log.error("Error deleting file with ID: {}", fileId, e);
-            return false;
+            // Data first, owner second: a concurrent retrieve that observes the transient
+            // (data-gone, owner-still-present) window simply fails with IOException; the inverse
+            // order would briefly look like an unowned file and could grant cross-user access.
+            boolean removed;
+            try {
+                removed = Files.deleteIfExists(resolve(fileId));
+            } catch (IOException e) {
+                log.error("Error deleting file with ID: {}", fileId, e);
+                return false;
+            }
+            try {
+                Files.deleteIfExists(resolveOwner(fileId));
+            } catch (IOException e) {
+                log.warn("Error deleting owner sidecar for file ID: {}", fileId, e);
+            }
+            return removed;
+        } finally {
+            release(fileId, lock);
         }
     }
 
@@ -114,8 +163,21 @@ public class LocalDiskFileStore implements FileStore {
         return Files.exists(resolve(fileId));
     }
 
+    @Override
+    public String getOwner(String fileId) throws IOException {
+        Path ownerPath = resolveOwner(fileId);
+        if (!Files.exists(ownerPath)) {
+            return null;
+        }
+        byte[] bytes = Files.readAllBytes(ownerPath);
+        if (bytes.length == 0) {
+            return null;
+        }
+        return new String(bytes, StandardCharsets.UTF_8);
+    }
+
     public Path resolve(String fileId) {
-        if (fileId.contains("..") || fileId.contains("/") || fileId.contains("\\")) {
+        if (fileId == null || !UUID_PATTERN.matcher(fileId).matches()) {
             throw new IllegalArgumentException("Invalid file ID");
         }
         Path basePath = Path.of(baseDirPath).normalize().toAbsolutePath();
@@ -125,4 +187,19 @@ public class LocalDiskFileStore implements FileStore {
         }
         return resolvedPath;
     }
+
+    private Path resolveOwner(String fileId) {
+        Path data = resolve(fileId);
+        return data.resolveSibling(data.getFileName().toString() + OWNER_SUFFIX);
+    }
+
+    private ReentrantLock acquire(String fileId) {
+        ReentrantLock lock = stripes[(fileId.hashCode() & Integer.MAX_VALUE) % LOCK_STRIPES];
+        lock.lock();
+        return lock;
+    }
+
+    private void release(String fileId, ReentrantLock lock) {
+        lock.unlock();
+    }
 }

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -77,8 +77,10 @@ public class ApplicationProperties {
     private ProcessExecutor processExecutor = new ProcessExecutor();
     private PdfEditor pdfEditor = new PdfEditor();
     private AiEngine aiEngine = new AiEngine();
+    private Mcp mcp = new Mcp();
     private InternalApi internalApi = new InternalApi();
     private Cluster cluster = new Cluster();
+    private Policies policies = new Policies();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -202,6 +204,45 @@ public class ApplicationProperties {
         }
     }
 
+    @Data
+    public static class Policies {
+        /**
+         * Absolute directories that policy folder input sources and output sinks may read from or
+         * write to. Empty (the default) disables folder access entirely, so a policy can never be
+         * pointed at an arbitrary server path. Stirling's own config directory is always
+         * off-limits, and folder access is always disabled in SaaS mode regardless of this list.
+         */
+        private List<String> allowedFolderRoots = new java.util.ArrayList<>();
+
+        /** How often (seconds) the schedule trigger checks for policies whose schedule is due. */
+        private long scheduleSweepSeconds = 60;
+
+        /**
+         * How often (seconds) the folder-watch trigger reconciles its watch registrations and
+         * re-runs every folder-watch policy as a safety net for filesystem events that were missed
+         * (NFS, bind mounts, inotify-queue overflow).
+         */
+        private long watchReconcileSeconds = 300;
+
+        /**
+         * How long (milliseconds) the folder-watch trigger keeps draining filesystem events after
+         * the first, so a burst from a single file copy coalesces into one run instead of many.
+         */
+        private long watchQuietPeriodMs = 500;
+
+        /**
+         * SSE emitter timeout (milliseconds) for streamed runs; generous for long multi-step runs.
+         */
+        private long streamTimeoutMs = 1800000;
+
+        /**
+         * How long (minutes) a finished run's in-memory state is retained before eviction,
+         * mirroring the job-result expiry so rich run state does not outlive the process. Active
+         * and paused runs are kept regardless of age.
+         */
+        private int runExpiryMinutes = 30;
+    }
+
     @Data
     public static class PdfEditor {
         private Cache cache = new Cache();
@@ -256,6 +297,103 @@ public class ApplicationProperties {
         private int longRunningTimeoutSeconds = 600;
     }
 
+    /**
+     * Model Context Protocol (MCP) server configuration. All keys live under the top-level {@code
+     * mcp.*} prefix. {@link #enabled} defaults to {@code false}: when off, no MCP beans are wired,
+     * no /mcp endpoint exists, and no protected-resource metadata is published.
+     */
+    @Data
+    public static class Mcp {
+
+        /** Master switch. When {@code false} (default), no MCP beans are wired. */
+        private boolean enabled = false;
+
+        /**
+         * When {@code true} (default), invocations require an OAuth scope: {@code mcp.tools.read}
+         * for read-style operations and {@code mcp.tools.write} for write/destructive ones. When
+         * {@code false}, scope checks are skipped (use only if your IdP issues a single coarse
+         * scope).
+         */
+        private boolean scopesEnabled = true;
+
+        /** How often to refresh the AI capabilities manifest from the engine. */
+        private int engineCapabilityRefreshMinutes = 5;
+
+        /**
+         * Tool allow-list (operation ids, e.g. {@code compress-pdf}). When non-empty, ONLY these
+         * operations are exposed over MCP; everything else is hidden, undescribable, and
+         * uninvocable - on top of the global endpoint enable/disable config. Empty = allow all.
+         */
+        private List<String> allowedOperations = new ArrayList<>();
+
+        /**
+         * Tool deny-list (operation ids). Any operation listed here is removed from MCP even if it
+         * would otherwise be allowed. Applied after {@link #allowedOperations}.
+         */
+        private List<String> blockedOperations = new ArrayList<>();
+
+        /** Max MCP request body size in bytes; inline file uploads ride in the JSON-RPC body. */
+        private long maxRequestBytes = 10L * 1024 * 1024;
+
+        /** Results up to this size return inline as base64; larger ones return a fileId only. */
+        private long maxInlineResponseBytes = 10L * 1024 * 1024;
+
+        private Auth auth = new Auth();
+
+        @Data
+        public static class Auth {
+            /**
+             * Authentication mode for the MCP endpoint. {@code oauth} (default) runs a full OAuth2
+             * resource server (JWT, RFC 8707 audience, RFC 9728 metadata). {@code apikey} accepts a
+             * Stirling per-user API key via the {@code X-API-KEY} header (or {@code Authorization:
+             * Bearer <key>}) and binds the request to that user - the low-friction self-host path,
+             * no external IdP required.
+             */
+            private String mode = "oauth";
+
+            /** OAuth2 issuer URI, e.g. {@code http://localhost:9000}. Required when MCP is on. */
+            private String issuerUri = "";
+
+            /**
+             * JWKS URI. When blank, derived from the issuer's {@code
+             * /.well-known/openid-configuration} document.
+             */
+            private String jwksUri = "";
+
+            /**
+             * RFC 8707 resource identifier of THIS MCP server, e.g. {@code
+             * http://localhost:8080/mcp}. Tokens that do not list this id in their {@code aud}
+             * claim are rejected with HTTP 401.
+             */
+            private String resourceId = "";
+
+            /**
+             * Additional JWT audiences accepted at the MCP endpoint, on top of {@link #resourceId}.
+             * Empty (default) keeps strict RFC 8707 binding. Some IdPs cannot mint
+             * resource-specific audiences - e.g. Supabase's OAuth server always issues {@code
+             * aud=authenticated} - so operators list the audience their IdP actually emits here
+             * (env: {@code MCP_AUTH_ACCEPTEDAUDIENCES}, comma-separated).
+             */
+            private List<String> acceptedAudiences = new ArrayList<>();
+
+            /**
+             * JWT claim whose value is matched against a provisioned Stirling username. Defaults to
+             * {@code sub}; set to {@code email} or {@code preferred_username} to match how your IdP
+             * maps users to Stirling accounts.
+             */
+            private String usernameClaim = "sub";
+
+            /**
+             * When {@code true} (default), a validated token is accepted only if its {@link
+             * #usernameClaim} value resolves to an existing, enabled Stirling user account. Tokens
+             * whose subject has no Stirling account (or a disabled one) are rejected with HTTP 403.
+             * Set to {@code false} only if you intentionally want any IdP-valid token to use MCP
+             * without a local account.
+             */
+            private boolean requireExistingAccount = true;
+        }
+    }
+
     /**
      * Cluster backplane configuration. All keys live under the top-level {@code cluster.*} prefix
      * (e.g. env var {@code CLUSTER_ENABLED}). The master switch is {@link #enabled} and defaults to

app/common/src/main/java/stirling/software/common/pdf/HeadingDetector.java

@@ -0,0 +1,191 @@
+package stirling.software.common.pdf;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import stirling.software.jpdfium.text.PageText;
+import stirling.software.jpdfium.text.TextChar;
+import stirling.software.jpdfium.text.TextLine;
+import stirling.software.jpdfium.text.TextWord;
+
+final class HeadingDetector {
+
+    private HeadingDetector() {}
+
+    /** A heading is at most this many words; longer lines are treated as body text. */
+    private static final int MAX_HEADING_WORDS = 12;
+
+    /**
+     * Returns the Markdown heading prefix for a line. The decision combines several signals, never
+     * text matching, so a plain line that merely shares text with a heading is never promoted:
+     *
+     * <ul>
+     *   <li><b>Size</b> — dominant glyph font size vs. the document body median (primary signal).
+     *       Some PDFs encode visual size in the text matrix, so every glyph reports ~1.0; for those
+     *       the line height is used as the proxy instead.
+     *   <li><b>Brevity</b> — headings are short labels; a line over {@value #MAX_HEADING_WORDS}
+     *       words is body text regardless of size.
+     *   <li><b>Not a sentence</b> — a line ending in {@code . ! ?} reads as prose, not a heading.
+     * </ul>
+     *
+     * <p>Boldness is deliberately <em>not</em> a heading signal — a bold-but-not-larger line is
+     * emphasis, not a heading (see {@link #isBoldLabel}); promoting it to {@code #}/{@code ##} is
+     * the main source of false-positive headings.
+     *
+     * <ul>
+     *   <li>size &gt; baseline * 1.4 → {@code "# "}
+     *   <li>size &gt; baseline * 1.2 → {@code "## "}
+     *   <li>otherwise → {@code ""}
+     * </ul>
+     */
+    static String headingPrefix(TextLine line, float medianBodySize, float medianBodyHeight) {
+        String text = line.text().strip();
+        if (text.isEmpty() || wordCount(text) > MAX_HEADING_WORDS || endsLikeSentence(text)) {
+            return "";
+        }
+
+        float dominant = dominantFontSize(line);
+        float value;
+        float baseline;
+        if (dominant > 2f && medianBodySize > 2f) {
+            value = dominant;
+            baseline = medianBodySize;
+        } else {
+            value = line.height();
+            baseline = medianBodyHeight;
+        }
+        if (baseline <= 0f) {
+            return "";
+        }
+
+        float ratio = value / baseline;
+        if (ratio > 1.4f) {
+            return "# ";
+        }
+        if (ratio > 1.2f) {
+            return "## ";
+        }
+        return "";
+    }
+
+    /**
+     * True when a line should be emphasised as bold (rendered {@code **like this**}) rather than
+     * promoted to a heading: it is bold, short, and not a full sentence. Used for bold labels that
+     * are not large enough to be headings.
+     */
+    static boolean isBoldLabel(TextLine line) {
+        String text = line.text().strip();
+        if (text.isEmpty() || wordCount(text) > MAX_HEADING_WORDS || endsLikeSentence(text)) {
+            return false;
+        }
+        return isBold(line);
+    }
+
+    private static int wordCount(String text) {
+        return text.split("\\s+").length;
+    }
+
+    private static boolean endsLikeSentence(String text) {
+        char last = text.charAt(text.length() - 1);
+        return last == '.' || last == '!' || last == '?';
+    }
+
+    /** True when the line's dominant font is bold, inferred from PostScript font names. */
+    private static boolean isBold(TextLine line) {
+        Map<String, Integer> counts = new HashMap<>();
+        for (TextWord word : line.words()) {
+            for (TextChar ch : word.chars()) {
+                if (ch.isWhitespace() || ch.isNewline()) {
+                    continue;
+                }
+                String name = ch.fontName();
+                if (name != null && !name.isBlank()) {
+                    counts.merge(name, 1, Integer::sum);
+                }
+            }
+        }
+        String dominantFont = "";
+        int max = -1;
+        for (Map.Entry<String, Integer> e : counts.entrySet()) {
+            if (e.getValue() > max) {
+                max = e.getValue();
+                dominantFont = e.getKey();
+            }
+        }
+        String lower = dominantFont.toLowerCase(java.util.Locale.ROOT);
+        return lower.contains("bold")
+                || lower.contains("black")
+                || lower.contains("heavy")
+                || lower.contains("semibold");
+    }
+
+    /** Computes the median glyph font size across all pages. */
+    static float medianFontSize(List<PageText> allPages) {
+        List<Float> sizes = new ArrayList<>();
+        for (PageText page : allPages) {
+            for (TextChar ch : page.chars()) {
+                if (!ch.isWhitespace() && !ch.isNewline() && ch.fontSize() > 0f) {
+                    sizes.add(ch.fontSize());
+                }
+            }
+        }
+        return median(sizes, 12f);
+    }
+
+    /** Computes the median TextLine height across all pages. Used when font size is degenerate. */
+    static float medianLineHeight(List<PageText> allPages) {
+        List<Float> heights = new ArrayList<>();
+        for (PageText page : allPages) {
+            for (TextLine line : page.lines()) {
+                if (line.height() > 0f && !line.text().isBlank()) {
+                    heights.add(line.height());
+                }
+            }
+        }
+        return median(heights, 12f);
+    }
+
+    private static float median(List<Float> values, float fallback) {
+        if (values.isEmpty()) {
+            return fallback;
+        }
+        Collections.sort(values);
+        int mid = values.size() / 2;
+        if (values.size() % 2 == 0) {
+            return (values.get(mid - 1) + values.get(mid)) / 2f;
+        }
+        return values.get(mid);
+    }
+
+    /**
+     * Returns the font size that appears most often (by character count) in the given line. Ties
+     * are broken in favour of the larger size.
+     */
+    private static float dominantFontSize(TextLine line) {
+        Map<Float, Integer> counts = new HashMap<>();
+        for (TextWord word : line.words()) {
+            for (TextChar ch : word.chars()) {
+                if (!ch.isWhitespace() && !ch.isNewline() && ch.fontSize() > 0f) {
+                    counts.merge(ch.fontSize(), 1, Integer::sum);
+                }
+            }
+        }
+        if (counts.isEmpty()) {
+            return 0f;
+        }
+        float dominant = 0f;
+        int maxCount = -1;
+        for (Map.Entry<Float, Integer> entry : counts.entrySet()) {
+            int count = entry.getValue();
+            float size = entry.getKey();
+            if (count > maxCount || (count == maxCount && size > dominant)) {
+                maxCount = count;
+                dominant = size;
+            }
+        }
+        return dominant;
+    }
+}

app/common/src/main/java/stirling/software/common/pdf/TableRenderer.java

@@ -0,0 +1,82 @@
+package stirling.software.common.pdf;
+
+import stirling.software.jpdfium.text.Table;
+
+final class TableRenderer {
+    private TableRenderer() {}
+
+    /** Renders a Table as a GitHub-Flavoured Markdown table string. */
+    static String render(Table table) {
+        if (table.rowCount() == 0) {
+            return "";
+        }
+
+        String[][] grid = table.asGrid();
+
+        if (table.rowCount() < 2) {
+            // No separator row possible — return plain lines
+            StringBuilder sb = new StringBuilder();
+            for (int c = 0; c < grid[0].length; c++) {
+                if (c > 0) sb.append('\n');
+                sb.append(escape(grid[0][c].trim()));
+            }
+            return sb.toString();
+        }
+
+        int cols = grid[0].length;
+
+        // Compute column widths: max(3, max content length across all rows)
+        int[] widths = new int[cols];
+        for (int c = 0; c < cols; c++) {
+            widths[c] = 3;
+        }
+        for (String[] row : grid) {
+            for (int c = 0; c < cols; c++) {
+                String cell = c < row.length ? row[c].trim() : "";
+                widths[c] = Math.max(widths[c], escape(cell).length());
+            }
+        }
+
+        StringBuilder sb = new StringBuilder();
+
+        // Header row
+        sb.append(buildRow(grid[0], widths, cols));
+        sb.append('\n');
+
+        // Separator row
+        sb.append('|');
+        for (int c = 0; c < cols; c++) {
+            sb.append('-').append("-".repeat(widths[c])).append('-').append('|');
+        }
+        sb.append('\n');
+
+        // Data rows
+        for (int r = 1; r < grid.length; r++) {
+            sb.append(buildRow(grid[r], widths, cols));
+            if (r < grid.length - 1) {
+                sb.append('\n');
+            }
+        }
+
+        return sb.toString();
+    }
+
+    private static String buildRow(String[] row, int[] widths, int cols) {
+        StringBuilder sb = new StringBuilder();
+        sb.append('|');
+        for (int c = 0; c < cols; c++) {
+            String cell = c < row.length ? escape(row[c].trim()) : "";
+            sb.append(' ').append(padRight(cell, widths[c])).append(' ').append('|');
+        }
+        return sb.toString();
+    }
+
+    private static String escape(String cell) {
+        return cell.replace("|", "\\|");
+    }
+
+    private static String padRight(String s, int width) {
+        if (s.length() >= width) return s;
+        return s + " ".repeat(width - s.length());
+    }
+}

app/common/src/main/java/stirling/software/common/service/FileStorage.java

@@ -5,6 +5,7 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.PipedInputStream;
 import java.io.PipedOutputStream;
+import java.util.Optional;
 import java.util.concurrent.Executors;
 import java.util.concurrent.atomic.AtomicReference;
 
@@ -17,6 +18,7 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.cluster.FileStore;
+import stirling.software.common.util.JobContext;
 
 /**
  * Service for storing and retrieving files with unique file IDs. Used by the AutoJobPostMapping
@@ -32,8 +34,10 @@ public class FileStorage {
 
     private final FileOrUploadService fileOrUploadService;
     private final FileStore fileStore;
+    private final Optional<JobOwnershipService> jobOwnershipService;
 
     public String storeFile(MultipartFile file) throws IOException {
+        String owner = resolveOwner();
         // Fast path: when Spring buffered the multipart to disk (typical for large uploads), the
         // backing Resource exposes a real File. Hand the Path to the FileStore so it can do a
         // file-to-file copy (Linux sendfile, no copy through Java heap) rather than streaming
@@ -48,7 +52,7 @@ public class FileStorage {
         if (res != null && res.isFile()) {
             try {
                 FileStore.Stored stored =
-                        fileStore.store(res.getFile().toPath(), file.getOriginalFilename());
+                        fileStore.store(res.getFile().toPath(), file.getOriginalFilename(), owner);
                 log.debug("Stored file with ID: {} (fast path)", stored.fileId());
                 return stored.fileId();
             } catch (IOException ex) {
@@ -57,40 +61,45 @@ public class FileStorage {
             }
         }
         try (InputStream in = file.getInputStream()) {
-            FileStore.Stored stored = fileStore.store(in, file.getOriginalFilename());
+            FileStore.Stored stored = fileStore.store(in, file.getOriginalFilename(), owner);
             log.debug("Stored file with ID: {}", stored.fileId());
             return stored.fileId();
         }
     }
 
     public String storeBytes(byte[] bytes, String originalName) throws IOException {
-        FileStore.Stored stored = fileStore.store(new ByteArrayInputStream(bytes), originalName);
+        FileStore.Stored stored =
+                fileStore.store(new ByteArrayInputStream(bytes), originalName, resolveOwner());
         log.debug("Stored byte array with ID: {}", stored.fileId());
         return stored.fileId();
     }
 
     public MultipartFile retrieveFile(String fileId) throws IOException {
+        enforceOwnership(fileId);
         byte[] fileData = fileStore.retrieveBytes(fileId);
         return fileOrUploadService.toMockMultipartFile(fileId, fileData);
     }
 
     public byte[] retrieveBytes(String fileId) throws IOException {
+        enforceOwnership(fileId);
         return fileStore.retrieveBytes(fileId);
     }
 
     public InputStream retrieveInputStream(String fileId) throws IOException {
+        enforceOwnership(fileId);
         return fileStore.retrieve(fileId);
     }
 
     public StoredFile storeInputStream(InputStream inputStream, String originalName)
             throws IOException {
-        FileStore.Stored stored = fileStore.store(inputStream, originalName);
+        FileStore.Stored stored = fileStore.store(inputStream, originalName, resolveOwner());
         log.debug("Stored input stream with ID: {}", stored.fileId());
         return new StoredFile(stored.fileId(), stored.size());
     }
 
     public String storeFromStreamingBody(StreamingResponseBody body, String originalName)
             throws IOException {
+        String owner = resolveOwner();
         // Hold Throwable not IOException: an unchecked failure (NPE, IllegalState, OOM, etc.)
         // from the body writer would otherwise close the pipe with EOF and the consumer would
         // return a truncated file with no error surfaced to the caller.
@@ -115,7 +124,7 @@ public class FileStorage {
                                         }
                                     }
                                 });
-                FileStore.Stored stored = fileStore.store(in, originalName);
+                FileStore.Stored stored = fileStore.store(in, originalName, owner);
                 Throwable writerErr = bodyError.get();
                 if (writerErr != null) {
                     // Body failed mid-write: the FileStore persisted a truncated entry.
@@ -159,21 +168,62 @@ public class FileStorage {
 
     public String storeFromResource(Resource resource, String originalName) throws IOException {
         try (InputStream in = resource.getInputStream()) {
-            FileStore.Stored stored = fileStore.store(in, originalName);
+            FileStore.Stored stored = fileStore.store(in, originalName, resolveOwner());
             log.debug("Stored Resource with ID: {}", stored.fileId());
             return stored.fileId();
         }
     }
 
     public boolean deleteFile(String fileId) {
+        enforceOwnership(fileId);
         return fileStore.delete(fileId);
     }
 
     public boolean fileExists(String fileId) {
+        enforceOwnership(fileId);
         return fileStore.exists(fileId);
     }
 
     public long getFileSize(String fileId) throws IOException {
+        enforceOwnership(fileId);
         return fileStore.size(fileId);
     }
+
+    private String resolveOwner() {
+        String propagated = JobContext.getOwner();
+        if (propagated != null) {
+            return propagated;
+        }
+        return jobOwnershipService.flatMap(JobOwnershipService::getCurrentUserId).orElse(null);
+    }
+
+    private void enforceOwnership(String fileId) {
+        if (jobOwnershipService.isEmpty()) {
+            return;
+        }
+        Optional<String> currentUser = jobOwnershipService.get().getCurrentUserId();
+        if (currentUser.isEmpty()) {
+            return;
+        }
+        String owner;
+        try {
+            owner = fileStore.getOwner(fileId);
+        } catch (IOException e) {
+            log.warn("Failed to read owner for file {}: {}", fileId, e.getMessage());
+            throw new SecurityException(
+                    "Access denied: could not verify ownership of the requested file");
+        }
+        if (owner == null) {
+            return;
+        }
+        if (!owner.equals(currentUser.get())) {
+            log.warn(
+                    "Access denied: user {} attempted to access file {} owned by {}",
+                    currentUser.get(),
+                    fileId,
+                    owner);
+            throw new SecurityException(
+                    "Access denied: you do not have permission to access this file");
+        }
+    }
 }

app/common/src/main/java/stirling/software/common/service/InternalApiClient.java

@@ -50,6 +50,16 @@ public class InternalApiClient {
                     "^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$"
                             + "|^/api/v1/ai/tools(/[A-Za-z0-9_-]+)+$");
 
+    /**
+     * Marker propagated on every internal sub-step dispatch so the saas PAYG interceptor classifies
+     * the call as {@code BillingCategory.AUTOMATION}. By construction every {@link
+     * InternalApiClient#post} caller is an automation surface (pipeline executor, AI workflow,
+     * policy runner) running a child tool inside a parent automation flow — see the saas {@code
+     * PaygChargeInterceptor.determineCategory} precedence chain, where this header dominates any
+     * per-tool {@code @RequiresFeature} annotation.
+     */
+    public static final String AUTOMATION_HEADER = "X-Stirling-Automation";
+
     private final ServletContext servletContext;
     private final UserServiceInterface userService;
     private final TempFileManager tempFileManager;
@@ -96,6 +106,11 @@ public class InternalApiClient {
         if (apiKey != null && !apiKey.isEmpty()) {
             headers.add("X-API-KEY", apiKey);
         }
+        // Tag the sub-step as automation so PAYG bills it under AUTOMATION regardless of which
+        // tool-level @RequiresFeature annotation the dispatched controller carries (e.g. an AI-OCR
+        // step inside a policy run must bill as AUTOMATION, not AI). Set unconditionally because
+        // every caller of this dispatcher is an automation surface by design.
+        headers.add(AUTOMATION_HEADER, "true");
 
         HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
         RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -57,85 +57,43 @@ public class JobExecutorService {
         this.resourceMonitor = resourceMonitor;
         this.jobQueue = jobQueue;
 
-        // Parse session timeout and calculate effective timeout once during initialization
         long sessionTimeoutMs = parseSessionTimeout(sessionTimeout);
         this.effectiveTimeoutMs = Math.min(asyncRequestTimeoutMs, sessionTimeoutMs);
         log.debug(
                 "Job executor configured with effective timeout of {} ms", this.effectiveTimeoutMs);
     }
 
-    /**
-     * Run a job either asynchronously or synchronously
-     *
-     * @param async Whether to run the job asynchronously
-     * @param work The work to be done
-     * @return The response
-     */
     public ResponseEntity<?> runJobGeneric(boolean async, Supplier<Object> work) {
         return runJobGeneric(async, work, -1);
     }
 
-    /**
-     * Run a job either asynchronously or synchronously with a custom timeout
-     *
-     * @param async Whether to run the job asynchronously
-     * @param work The work to be done
-     * @param customTimeoutMs Custom timeout in milliseconds, or -1 to use the default
-     * @return The response
-     */
     public ResponseEntity<?> runJobGeneric(
             boolean async, Supplier<Object> work, long customTimeoutMs) {
         return runJobGeneric(async, work, customTimeoutMs, false, 50);
     }
 
-    /**
-     * Run a job either asynchronously or synchronously with custom parameters
-     *
-     * @param async Whether to run the job asynchronously
-     * @param work The work to be done
-     * @param customTimeoutMs Custom timeout in milliseconds, or -1 to use the default
-     * @param queueable Whether this job can be queued when system resources are limited
-     * @param resourceWeight The resource weight of this job (1-100)
-     * @return The response
-     */
     public ResponseEntity<?> runJobGeneric(
             boolean async,
             Supplier<Object> work,
             long customTimeoutMs,
             boolean queueable,
             int resourceWeight) {
-        // Generate base UUID
         String baseJobId = UUID.randomUUID().toString();
-
-        // Scope job to authenticated user if security is enabled
         String scopedJobKey = getScopedJobKey(baseJobId);
 
         log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
 
-        // Store the scoped job ID in the request for potential use by other components
         if (request != null) {
             request.setAttribute("jobId", scopedJobKey);
-
-            // Also track this job ID in the user's session for authorization purposes
-            // This ensures users can only cancel their own jobs
-            if (request.getSession() != null) {
-                @SuppressWarnings("unchecked")
-                java.util.Set<String> userJobIds =
-                        (java.util.Set<String>) request.getSession().getAttribute("userJobIds");
-
-                if (userJobIds == null) {
-                    userJobIds = new java.util.concurrent.ConcurrentSkipListSet<>();
-                    request.getSession().setAttribute("userJobIds", userJobIds);
-                }
-
-                userJobIds.add(scopedJobKey);
-                log.debug("Added scoped job ID {} to user session", scopedJobKey);
-            }
         }
 
         String jobId = scopedJobKey;
 
-        // Determine which timeout to use
+        final String jobOwner =
+                jobOwnershipService != null
+                        ? jobOwnershipService.getCurrentUserId().orElse(null)
+                        : null;
+
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
 
         log.debug(
@@ -146,7 +104,6 @@ public class JobExecutorService {
                 queueable,
                 resourceWeight);
 
-        // Check if we need to queue this job based on resource availability
         boolean shouldQueue =
                 queueable
                         && async
@@ -154,7 +111,6 @@ public class JobExecutorService {
                         resourceMonitor.shouldQueueJob(resourceWeight);
 
         if (shouldQueue) {
-            // Queue the job instead of executing immediately
             log.debug(
                     "Queueing job {} due to resource constraints (weight: {})",
                     jobId,
@@ -162,18 +118,13 @@ public class JobExecutorService {
 
             taskManager.createTask(jobId);
 
-            // Create a specialized wrapper that updates the TaskManager
             final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
                     () -> {
                         try {
-                            // Set jobId in ThreadLocal context for the queued job
                             stirling.software.common.util.JobContext.setJobId(
                                     capturedJobIdForQueue);
-                            log.debug(
-                                    "Set jobId {} in JobContext for queued job execution",
-                                    capturedJobIdForQueue);
-
+                            stirling.software.common.util.JobContext.setOwner(jobOwner);
                             Object result = work.get();
                             processJobResult(capturedJobIdForQueue, result);
                             return result;
@@ -186,21 +137,17 @@ public class JobExecutorService {
                             taskManager.setError(capturedJobIdForQueue, e.getMessage());
                             throw e;
                         } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
                             stirling.software.common.util.JobContext.clear();
                         }
                     };
 
-            // Queue the job and get the future
             CompletableFuture<ResponseEntity<?>> future =
                     jobQueue.queueJob(jobId, resourceWeight, wrappedWork, timeoutToUse);
 
-            // Return immediately with job ID
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
 
-            // Capture the jobId for the async thread
             final String capturedJobId = jobId;
 
             executor.execute(
@@ -211,13 +158,8 @@ public class JobExecutorService {
                                     capturedJobId,
                                     timeoutToUse);
 
-                            // Set jobId in ThreadLocal context for the async thread
                             stirling.software.common.util.JobContext.setJobId(capturedJobId);
-                            log.debug(
-                                    "Set jobId {} in JobContext for async execution",
-                                    capturedJobId);
-
-                            // Execute with timeout
+                            stirling.software.common.util.JobContext.setOwner(jobOwner);
                             Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
                             processJobResult(capturedJobId, result);
                         } catch (TimeoutException te) {
@@ -227,7 +169,6 @@ public class JobExecutorService {
                             log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                             taskManager.setError(jobId, e.getMessage());
                         } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
                             stirling.software.common.util.JobContext.clear();
                         }
                     });
@@ -237,27 +178,19 @@ public class JobExecutorService {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
 
-                // Make jobId available to downstream components on the worker thread
                 stirling.software.common.util.JobContext.setJobId(jobId);
-                log.debug("Set jobId {} in JobContext for sync execution", jobId);
-
-                // Execute with timeout
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
-                // If the result is already a ResponseEntity, return it directly
                 if (result instanceof ResponseEntity) {
                     return (ResponseEntity<?>) result;
                 }
 
-                // Process different result types
                 return handleResultForSyncJob(result);
             } catch (TimeoutException te) {
                 log.error("Synchronous job timed out after {} ms", timeoutToUse);
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
             } catch (RuntimeException e) {
-                // Check if this is a typed exception that should be handled by
-                // GlobalExceptionHandler (either directly or wrapped)
                 Throwable cause = e.getCause();
                 if (e instanceof IllegalArgumentException
                         || cause
@@ -267,16 +200,13 @@ public class JobExecutorService {
                                 instanceof
                                 stirling.software.common.util.ExceptionUtils
                                         .BaseValidationException) {
-                    // Rethrow so GlobalExceptionHandler can handle with proper HTTP status codes
                     throw e;
                 }
-                // Handle other RuntimeExceptions as generic errors
                 log.error("Error executing synchronous job: {}", e.getMessage(), e);
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
             } catch (Exception e) {
                 log.error("Error executing synchronous job: {}", e.getMessage(), e);
-                // Construct a JSON error response
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
             } finally {
@@ -285,23 +215,13 @@ public class JobExecutorService {
         }
     }
 
-    /**
-     * Process the result of an asynchronous job
-     *
-     * @param jobId The job ID
-     * @param result The result
-     */
     private void processJobResult(String jobId, Object result) {
         try {
             if (result instanceof byte[]) {
-                // Store byte array directly to disk to avoid double memory consumption
                 String fileId = fileStorage.storeBytes((byte[]) result, "result.pdf");
                 taskManager.setFileResult(
                         jobId, fileId, "result.pdf", MediaType.APPLICATION_PDF_VALUE);
                 log.debug("Stored byte[] result with fileId: {}", fileId);
-
-                // Let the byte array get collected naturally in the next GC cycle
-                // We don't need to force System.gc() which can be harmful
             } else if (result instanceof ResponseEntity) {
                 ResponseEntity<?> response = (ResponseEntity<?>) result;
                 Object body = response.getBody();
@@ -330,16 +250,13 @@ public class JobExecutorService {
                     taskManager.setFileResult(jobId, fileId, filename, contentType);
                     log.debug("Stored ResponseEntity<Resource> result with fileId: {}", fileId);
                 } else {
-                    // Check if the response body contains a fileId
                     if (body != null && body.toString().contains("fileId")) {
                         try {
-                            // Try to extract fileId using reflection
                             java.lang.reflect.Method getFileId =
                                     body.getClass().getMethod("getFileId");
                             String fileId = (String) getFileId.invoke(body);
 
                             if (fileId != null && !fileId.isEmpty()) {
-                                // Try to get filename and content type
                                 String filename = "result.pdf";
                                 String contentType = MediaType.APPLICATION_PDF_VALUE;
 
@@ -379,7 +296,6 @@ public class JobExecutorService {
                         }
                     }
 
-                    // Store generic result
                     taskManager.setResult(jobId, body);
                 }
             } else if (result instanceof MultipartFile file) {
@@ -388,16 +304,13 @@ public class JobExecutorService {
                         jobId, fileId, file.getOriginalFilename(), file.getContentType());
                 log.debug("Stored MultipartFile result with fileId: {}", fileId);
             } else {
-                // Check if result has a fileId field
                 if (result != null) {
                     try {
-                        // Try to extract fileId using reflection
                         java.lang.reflect.Method getFileId =
                                 result.getClass().getMethod("getFileId");
                         String fileId = (String) getFileId.invoke(result);
 
                         if (fileId != null && !fileId.isEmpty()) {
-                            // Try to get filename and content type
                             String filename = "result.pdf";
                             String contentType = MediaType.APPLICATION_PDF_VALUE;
 
@@ -435,7 +348,6 @@ public class JobExecutorService {
                     }
                 }
 
-                // Default case: store the result as is
                 taskManager.setResult(jobId, result);
             }
 
@@ -446,16 +358,8 @@ public class JobExecutorService {
         }
     }
 
-    /**
-     * Handle different result types for synchronous jobs
-     *
-     * @param result The result object
-     * @return The appropriate ResponseEntity
-     * @throws IOException If there is an error processing the result
-     */
     private ResponseEntity<?> handleResultForSyncJob(Object result) throws IOException {
         if (result instanceof byte[]) {
-            // Return byte array as PDF
             return ResponseEntity.ok()
                     .contentType(MediaType.APPLICATION_PDF)
                     .header(
@@ -463,7 +367,6 @@ public class JobExecutorService {
                             "form-data; name=\"attachment\"; filename=\"result.pdf\"")
                     .body(result);
         } else if (result instanceof MultipartFile file) {
-            // Return MultipartFile content
             return ResponseEntity.ok()
                     .contentType(MediaType.parseMediaType(file.getContentType()))
                     .header(
@@ -473,7 +376,6 @@ public class JobExecutorService {
                                     + "\"")
                     .body(file.getBytes());
         } else {
-            // Default case: return as JSON
             return ResponseEntity.ok(result);
         }
     }
@@ -493,15 +395,9 @@ public class JobExecutorService {
         return mediaType != null ? mediaType.toString() : MediaType.APPLICATION_PDF_VALUE;
     }
 
-    /**
-     * Parse session timeout string (e.g., "30m", "1h") to milliseconds
-     *
-     * @param timeout The timeout string
-     * @return The timeout in milliseconds
-     */
     private long parseSessionTimeout(String timeout) {
         if (timeout == null || timeout.isEmpty()) {
-            return 30 * 60 * 1000; // Default: 30 minutes
+            return 30 * 60 * 1000;
         }
 
         try {
@@ -523,27 +419,16 @@ public class JobExecutorService {
                 case "m" -> (long) (numericValue * 60 * 1000);
                 case "h" -> (long) (numericValue * 60 * 60 * 1000);
                 case "d" -> (long) (numericValue * 24 * 60 * 60 * 1000);
-                default -> (long) (numericValue * 60 * 1000); // Default to minutes
+                default -> (long) (numericValue * 60 * 1000);
             };
         } catch (Exception e) {
             log.warn("Could not parse session timeout '{}', using default", timeout);
-            return 30 * 60 * 1000; // Default: 30 minutes
+            return 30 * 60 * 1000;
         }
     }
 
-    /**
-     * Execute a supplier with a timeout
-     *
-     * @param supplier The supplier to execute
-     * @param timeoutMs The timeout in milliseconds
-     * @return The result from the supplier
-     * @throws TimeoutException If the execution times out
-     * @throws Exception If the supplier throws an exception
-     */
     private <T> T executeWithTimeout(Supplier<T> supplier, long timeoutMs)
             throws TimeoutException, Exception {
-        // Use the same executor as other async jobs for consistency
-        // This ensures all operations run on the same thread pool
         String currentJobId = stirling.software.common.util.JobContext.getJobId();
 
         java.util.concurrent.CompletableFuture<T> future =
@@ -577,17 +462,10 @@ public class JobExecutorService {
         }
     }
 
-    /**
-     * Get a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param baseJobId the base job identifier
-     * @return scoped job key, or just baseJobId if no ownership service available
-     */
     private String getScopedJobKey(String baseJobId) {
         if (jobOwnershipService != null) {
             return jobOwnershipService.createScopedJobKey(baseJobId);
         }
-        // Security disabled, return unsecured job key
         return baseJobId;
     }
 }

app/common/src/main/java/stirling/software/common/service/ToolMetadataService.java

@@ -1,11 +1,21 @@
 package stirling.software.common.service;
 
+import java.util.List;
+
 /** Provides metadata about tool endpoints for internal dispatch. */
 public interface ToolMetadataService {
 
     /** Returns true if the given operation path accepts multiple input files. */
     boolean isMultiInput(String operationPath);
 
+    /**
+     * Returns the file extensions (lowercase, no leading dot, e.g. {@code "pdf"}) that the
+     * operation accepts as input ({@code output=false}) or produces as output ({@code
+     * output=true}), derived from the endpoint's declared type. Returns {@code null} when the
+     * endpoint declares no specific type, which callers should treat as "any type accepted".
+     */
+    List<String> getExtensionTypes(boolean output, String operationPath);
+
     /**
      * Returns true when the endpoint's ZIP response is a transport for multiple typed results and
      * should be unpacked: multi-output endpoints (Type:SIMO / Type:MIMO) and wrapper declarations

app/common/src/main/java/stirling/software/common/util/JobContext.java

@@ -1,8 +1,9 @@
 package stirling.software.common.util;
 
-/** Thread-local context for passing job ID across async boundaries */
+/** Thread-local context for passing job ID and owner across async boundaries */
 public class JobContext {
     private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
+    private static final ThreadLocal<String> CURRENT_OWNER = new ThreadLocal<>();
 
     public static void setJobId(String jobId) {
         CURRENT_JOB_ID.set(jobId);
@@ -12,7 +13,16 @@ public class JobContext {
         return CURRENT_JOB_ID.get();
     }
 
+    public static void setOwner(String owner) {
+        CURRENT_OWNER.set(owner);
+    }
+
+    public static String getOwner() {
+        return CURRENT_OWNER.get();
+    }
+
     public static void clear() {
         CURRENT_JOB_ID.remove();
+        CURRENT_OWNER.remove();
     }
 }

app/common/src/main/java/stirling/software/common/util/OfficeDocumentSanitizer.java

@@ -0,0 +1,310 @@
+package stirling.software.common.util;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.Set;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+import java.util.zip.ZipOutputStream;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.transform.OutputKeys;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+
+import org.springframework.stereotype.Component;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.NamedNodeMap;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+import org.xml.sax.SAXException;
+
+import io.github.pixee.security.ZipSecurity;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.service.SsrfProtectionService;
+
+// Strips external refs from OOXML/ODF uploads so LibreOffice can't be made to fetch them.
+@Component
+@Slf4j
+public class OfficeDocumentSanitizer {
+
+    private static final Set<String> OOXML_EXTENSIONS =
+            Set.of(
+                    "docx", "docm", "dotx", "dotm", "xlsx", "xlsm", "xltx", "xltm", "pptx", "pptm",
+                    "potx", "potm", "ppsx", "ppsm");
+
+    private static final Set<String> ODF_EXTENSIONS =
+            Set.of(
+                    "odt", "ott", "ods", "ots", "odp", "otp", "odg", "otg", "odf", "odc", "odi",
+                    "odm");
+
+    private static final Set<String> ODF_XML_PARTS =
+            Set.of("content.xml", "styles.xml", "meta.xml", "settings.xml");
+
+    private final SsrfProtectionService ssrfProtectionService;
+    private final ApplicationProperties applicationProperties;
+
+    public OfficeDocumentSanitizer(
+            SsrfProtectionService ssrfProtectionService,
+            ApplicationProperties applicationProperties) {
+        this.ssrfProtectionService = ssrfProtectionService;
+        this.applicationProperties = applicationProperties;
+    }
+
+    public boolean isSanitizableExtension(String extension) {
+        if (extension == null) {
+            return false;
+        }
+        String lower = extension.toLowerCase(Locale.ROOT);
+        return OOXML_EXTENSIONS.contains(lower) || ODF_EXTENSIONS.contains(lower);
+    }
+
+    public byte[] sanitize(byte[] documentBytes, String extension) throws IOException {
+        if (documentBytes == null || documentBytes.length == 0) {
+            throw new IOException("Office document input is empty or null");
+        }
+        if (applicationProperties.getSystem().isDisableSanitize()) {
+            log.debug("Office document sanitization disabled by configuration");
+            return documentBytes;
+        }
+        if (!isSanitizableExtension(extension)) {
+            return documentBytes;
+        }
+
+        ByteArrayOutputStream out = new ByteArrayOutputStream(documentBytes.length);
+        try (ZipInputStream zipIn =
+                        ZipSecurity.createHardenedInputStream(
+                                new ByteArrayInputStream(documentBytes));
+                ZipOutputStream zipOut = new ZipOutputStream(out)) {
+
+            ZipEntry entry;
+            while ((entry = zipIn.getNextEntry()) != null) {
+                String name = entry.getName();
+                byte[] bytes = entry.isDirectory() ? new byte[0] : zipIn.readAllBytes();
+
+                if (!entry.isDirectory()) {
+                    bytes = sanitizeEntry(name, bytes);
+                }
+
+                ZipEntry outEntry = new ZipEntry(name);
+                if (entry.getComment() != null) {
+                    outEntry.setComment(entry.getComment());
+                }
+                if (entry.getExtra() != null) {
+                    outEntry.setExtra(entry.getExtra());
+                }
+                zipOut.putNextEntry(outEntry);
+                if (!entry.isDirectory()) {
+                    zipOut.write(bytes);
+                }
+                zipOut.closeEntry();
+            }
+        }
+        return out.toByteArray();
+    }
+
+    private byte[] sanitizeEntry(String entryName, byte[] entryBytes) {
+        String lower = entryName.toLowerCase(Locale.ROOT);
+        try {
+            if (lower.endsWith(".rels")) {
+                return sanitizeOoxmlRels(entryBytes);
+            }
+            if (isOdfXmlPart(lower)) {
+                return sanitizeOdfXml(entryBytes);
+            }
+        } catch (ParserConfigurationException
+                | SAXException
+                | IOException
+                | TransformerException e) {
+            log.warn(
+                    "Failed to parse XML part '{}' for sanitization, leaving as-is: {}",
+                    entryName,
+                    e.getMessage());
+        }
+        return entryBytes;
+    }
+
+    private boolean isOdfXmlPart(String lowerName) {
+        int slash = lowerName.lastIndexOf('/');
+        String base = slash >= 0 ? lowerName.substring(slash + 1) : lowerName;
+        return ODF_XML_PARTS.contains(base);
+    }
+
+    private byte[] sanitizeOoxmlRels(byte[] xmlBytes)
+            throws IOException, ParserConfigurationException, SAXException, TransformerException {
+        Document doc = parseSecurely(xmlBytes);
+        Element root = doc.getDocumentElement();
+        if (root == null) {
+            return xmlBytes;
+        }
+        NodeList relationships = root.getElementsByTagNameNS("*", "Relationship");
+        List<Node> toRemove = new ArrayList<>();
+        for (int i = 0; i < relationships.getLength(); i++) {
+            Node node = relationships.item(i);
+            NamedNodeMap attrs = node.getAttributes();
+            if (attrs == null) {
+                continue;
+            }
+            Node targetMode = attrs.getNamedItem("TargetMode");
+            if (targetMode == null || !"external".equalsIgnoreCase(targetMode.getNodeValue())) {
+                continue;
+            }
+            Node target = attrs.getNamedItem("Target");
+            String targetValue = target == null ? "" : target.getNodeValue();
+            if (isAdminAllowed(targetValue)) {
+                continue;
+            }
+            log.warn(
+                    "Stripping OOXML external relationship target: {}",
+                    truncateForLog(targetValue));
+            toRemove.add(node);
+        }
+        if (toRemove.isEmpty()) {
+            return xmlBytes;
+        }
+        for (Node n : toRemove) {
+            n.getParentNode().removeChild(n);
+        }
+        return serializeDocument(doc);
+    }
+
+    private byte[] sanitizeOdfXml(byte[] xmlBytes)
+            throws IOException, ParserConfigurationException, SAXException, TransformerException {
+        Document doc = parseSecurely(xmlBytes);
+        Element root = doc.getDocumentElement();
+        if (root == null) {
+            return xmlBytes;
+        }
+        boolean modified = stripExternalHrefs(root);
+        if (!modified) {
+            return xmlBytes;
+        }
+        return serializeDocument(doc);
+    }
+
+    private boolean stripExternalHrefs(Node node) {
+        boolean modified = false;
+        if (node.getNodeType() == Node.ELEMENT_NODE) {
+            NamedNodeMap attrs = node.getAttributes();
+            List<String> hrefAttrsToRemove = new ArrayList<>();
+            for (int i = 0; i < attrs.getLength(); i++) {
+                Node attr = attrs.item(i);
+                String name = attr.getNodeName();
+                if (name == null) {
+                    continue;
+                }
+                String lower = name.toLowerCase(Locale.ROOT);
+                if (!(lower.equals("xlink:href")
+                        || lower.endsWith(":href")
+                        || lower.equals("href"))) {
+                    continue;
+                }
+                String value = attr.getNodeValue();
+                if (!isExternalUrl(value)) {
+                    continue;
+                }
+                if (isAdminAllowed(value)) {
+                    continue;
+                }
+                log.warn(
+                        "Stripping ODF external href attribute ({}): {}",
+                        name,
+                        truncateForLog(value));
+                hrefAttrsToRemove.add(name);
+            }
+            Element element = (Element) node;
+            for (String attrName : hrefAttrsToRemove) {
+                element.removeAttribute(attrName);
+                modified = true;
+            }
+        }
+        NodeList children = node.getChildNodes();
+        for (int i = 0; i < children.getLength(); i++) {
+            if (stripExternalHrefs(children.item(i))) {
+                modified = true;
+            }
+        }
+        return modified;
+    }
+
+    private boolean isExternalUrl(String url) {
+        if (url == null) {
+            return false;
+        }
+        String trimmed = url.trim().toLowerCase(Locale.ROOT);
+        if (trimmed.isEmpty() || trimmed.startsWith("#") || trimmed.startsWith("../")) {
+            return false;
+        }
+        return trimmed.startsWith("http://")
+                || trimmed.startsWith("https://")
+                || trimmed.startsWith("ftp://")
+                || trimmed.startsWith("ftps://")
+                || trimmed.startsWith("file:")
+                || trimmed.startsWith("smb:")
+                || trimmed.startsWith("\\\\")
+                || trimmed.startsWith("//");
+    }
+
+    // Preserved only with an explicit allowedDomains entry; MEDIUM default would admit public URLs.
+    private boolean isAdminAllowed(String url) {
+        if (ssrfProtectionService == null || url == null || url.isBlank()) {
+            return false;
+        }
+        ApplicationProperties.Html.UrlSecurity config =
+                applicationProperties.getSystem().getHtml().getUrlSecurity();
+        if (config == null
+                || config.getAllowedDomains() == null
+                || config.getAllowedDomains().isEmpty()) {
+            return false;
+        }
+        return ssrfProtectionService.isUrlAllowed(url);
+    }
+
+    private Document parseSecurely(byte[] xmlBytes)
+            throws ParserConfigurationException, SAXException, IOException {
+        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        factory.setXIncludeAware(false);
+        factory.setExpandEntityReferences(false);
+        factory.setNamespaceAware(true);
+        DocumentBuilder builder = factory.newDocumentBuilder();
+        return builder.parse(new ByteArrayInputStream(xmlBytes));
+    }
+
+    private byte[] serializeDocument(Document doc) throws TransformerException {
+        TransformerFactory tf = TransformerFactory.newInstance();
+        tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        Transformer transformer = tf.newTransformer();
+        transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8");
+        transformer.setOutputProperty(OutputKeys.INDENT, "no");
+        transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "no");
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        transformer.transform(new DOMSource(doc), new StreamResult(baos));
+        return baos.toByteArray();
+    }
+
+    private String truncateForLog(String value) {
+        if (value == null) {
+            return "null";
+        }
+        return value.length() > 80 ? value.substring(0, 80) + "..." : value;
+    }
+}

app/common/src/main/java/stirling/software/common/util/propertyeditor/JsonListPropertyEditor.java

@@ -0,0 +1,48 @@
+package stirling.software.common.util.propertyeditor;
+
+import java.beans.PropertyEditorSupport;
+import java.util.ArrayList;
+import java.util.List;
+
+import lombok.extern.slf4j.Slf4j;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Binds a multipart form value containing a JSON array into a typed {@code List<T>}. Used for
+ * endpoints that accept structured list parameters via {@code @ModelAttribute} — the form field
+ * carries the full JSON array as its value and the editor parses it once.
+ */
+@Slf4j
+public class JsonListPropertyEditor<T> extends PropertyEditorSupport {
+
+    private static final ObjectMapper OBJECT_MAPPER =
+            JsonMapper.builder()
+                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
+                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                    .build();
+
+    private final TypeReference<? extends List<T>> typeRef;
+
+    public JsonListPropertyEditor(TypeReference<? extends List<T>> typeRef) {
+        this.typeRef = typeRef;
+    }
+
+    @Override
+    public void setAsText(String text) throws IllegalArgumentException {
+        if (text == null || text.trim().isEmpty()) {
+            setValue(new ArrayList<T>());
+            return;
+        }
+        try {
+            setValue(OBJECT_MAPPER.readValue(text, typeRef));
+        } catch (Exception e) {
+            log.error("Failed to parse JSON list value", e);
+            throw new IllegalArgumentException(
+                    "Expected a JSON array but could not parse: " + e.getMessage());
+        }
+    }
+}

app/common/src/main/java/stirling/software/common/util/propertyeditor/JsonObjectPropertyEditor.java

@@ -0,0 +1,41 @@
+package stirling.software.common.util.propertyeditor;
+
+import java.beans.PropertyEditorSupport;
+
+import lombok.extern.slf4j.Slf4j;
+
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Binds a multipart form value containing a JSON object into a typed {@code T}. Companion to {@link
+ * JsonListPropertyEditor} for single-object nested fields on {@code @ModelAttribute} endpoints.
+ */
+@Slf4j
+public class JsonObjectPropertyEditor<T> extends PropertyEditorSupport {
+
+    private static final ObjectMapper OBJECT_MAPPER =
+            JsonMapper.builder().disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES).build();
+
+    private final Class<T> type;
+
+    public JsonObjectPropertyEditor(Class<T> type) {
+        this.type = type;
+    }
+
+    @Override
+    public void setAsText(String text) throws IllegalArgumentException {
+        if (text == null || text.trim().isEmpty()) {
+            setValue(null);
+            return;
+        }
+        try {
+            setValue(OBJECT_MAPPER.readValue(text, type));
+        } catch (Exception e) {
+            log.error("Failed to parse JSON object value", e);
+            throw new IllegalArgumentException(
+                    "Expected a JSON object but could not parse: " + e.getMessage());
+        }
+    }
+}

app/common/src/main/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditor.java

@@ -1,53 +0,0 @@
-package stirling.software.common.util.propertyeditor;
-
-import java.beans.PropertyEditorSupport;
-import java.util.ArrayList;
-import java.util.List;
-
-import lombok.extern.slf4j.Slf4j;
-
-import tools.jackson.databind.DeserializationFeature;
-import tools.jackson.databind.JavaType;
-import tools.jackson.databind.ObjectMapper;
-import tools.jackson.databind.json.JsonMapper;
-
-/**
- * Spring property editor that decodes a JSON string into a typed {@link ArrayList}. Used to bind
- * complex list parameters (e.g. {@code List<RedactionArea>}, {@code List<EditTextOperation>}) from
- * multipart form fields, where Spring's default binding cannot deserialize a JSON array.
- */
-@Slf4j
-public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
-
-    private final ObjectMapper objectMapper =
-            JsonMapper.builder()
-                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
-                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
-                    .build();
-
-    private final Class<T> elementType;
-
-    public StringToArrayListPropertyEditor(Class<T> elementType) {
-        this.elementType = elementType;
-    }
-
-    @Override
-    public void setAsText(String text) throws IllegalArgumentException {
-        if (text == null || text.trim().isEmpty()) {
-            setValue(new ArrayList<>());
-            return;
-        }
-        try {
-            JavaType listType =
-                    objectMapper
-                            .getTypeFactory()
-                            .constructCollectionType(ArrayList.class, elementType);
-            List<T> list = objectMapper.readValue(text, listType);
-            setValue(list);
-        } catch (Exception e) {
-            log.error("Exception while converting {}", e);
-            throw new IllegalArgumentException(
-                    "Failed to convert java.lang.String to java.util.List");
-        }
-    }
-}

app/common/src/test/java/stirling/software/SPDF/pdf/parser/LineAlignmentTableParserTest.java

@@ -1,153 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.util.List;
-
-import org.junit.jupiter.api.Test;
-
-/**
- * Unit tests for {@link LineAlignmentTableParser}, focused on the coincident-line merge logic and
- * column-grid construction.
- */
-class LineAlignmentTableParserTest {
-
-    private final LineAlignmentTableParser parser = new LineAlignmentTableParser();
-
-    // ── mergeCoincidentLines ─────────────────────────────────────────────────────────────────────
-
-    @Test
-    void mergeCoincidentLines_singleLine_unchanged() {
-        var lines = List.of(tokenized(rawLine(10f, 100f, "Revenue")));
-        assertThat(parser.mergeCoincidentLines(lines)).hasSize(1);
-    }
-
-    @Test
-    void mergeCoincidentLines_distinctYLines_unchanged() {
-        // Two lines at different y positions — must NOT be merged.
-        var lines =
-                List.of(
-                        tokenized(rawLine(10f, 100f, "Revenue")),
-                        tokenized(rawLine(10f, 115f, "Cost")));
-        assertThat(parser.mergeCoincidentLines(lines)).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_sameY_merged() {
-        // Simulates a financial-table row split by LineBuilder at the column gap:
-        //   label fragment at x=72  → "Revenue"
-        //   value fragment at x=350 → "1,234"
-        // Both have y=100. After merge they should form one TokenizedLine.
-        var label = rawLine(72f, 100f, "Revenue");
-        var value = rawLine(350f, 100f, "1,234");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
-
-        assertThat(merged).hasSize(1);
-        // The merged line should contain tokens from both halves.
-        var tokens = merged.get(0).all();
-        assertThat(tokens.stream().map(t -> t.text()).toList())
-                .containsExactlyInAnyOrder("Revenue", "1,234");
-    }
-
-    @Test
-    void mergeCoincidentLines_sameY_mergedLineHasCorrectBounds() {
-        var label = rawLine(72f, 100f, "Revenue"); // 7 chars × 6pt = 42pt wide → right = 114
-        var value = rawLine(350f, 100f, "1,234"); // 5 chars × 6pt = 30pt wide → right = 380
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
-
-        var bounds = merged.get(0).line().bounds();
-        assertThat(bounds.x()).isEqualTo(72f);
-        assertThat(bounds.right()).isEqualTo(380f);
-    }
-
-    @Test
-    void mergeCoincidentLines_withinTolerance_merged() {
-        // Lines 1.5pt apart (within ROW_MERGE_TOLERANCE_PT = 2pt) should merge.
-        var a = rawLine(10f, 100.0f, "Alpha");
-        var b = rawLine(200f, 101.5f, "99");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
-        assertThat(merged).hasSize(1);
-    }
-
-    @Test
-    void mergeCoincidentLines_beyondTolerance_notMerged() {
-        // Lines 3pt apart (beyond ROW_MERGE_TOLERANCE_PT = 2pt) should NOT merge.
-        var a = rawLine(10f, 100.0f, "Alpha");
-        var b = rawLine(200f, 103.0f, "99");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
-        assertThat(merged).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_threeCoincident_allMerged() {
-        // Three fragments at the same y (e.g. wide financial table with two value columns).
-        var a = rawLine(72f, 100f, "Revenue");
-        var b = rawLine(300f, 100f, "1,234");
-        var c = rawLine(400f, 100f, "5,678");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
-        assertThat(merged).hasSize(1);
-        assertThat(merged.get(0).all()).hasSize(3);
-    }
-
-    @Test
-    void mergeCoincidentLines_coincidentPairFollowedByDistinctLine_twoGroups() {
-        var a = rawLine(72f, 100f, "Revenue");
-        var b = rawLine(350f, 100f, "1,234"); // same y as a → merges with a
-        var c = rawLine(10f, 115f, "Expenses"); // different y → stays separate
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
-        assertThat(merged).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_numericAnchorStatus_correctAfterMerge() {
-        // After merging, the combined line should be an anchor (≥2 numeric tokens).
-        // "Revenue" alone → not an anchor. "1,234  567" alone → anchor.
-        // Merged → anchor with at least 2 numerics.
-        var label = rawLine(72f, 100f, "Revenue");
-        var values = rawLineMultiWord(350f, 100f, "1,234", 30f, "567", 30f);
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(values)));
-
-        assertThat(merged).hasSize(1);
-        assertThat(merged.get(0).isAnchor()).isTrue();
-    }
-
-    // ── helpers ──────────────────────────────────────────────────────────────────────────────────
-
-    /** Creates a RawLine with a single TextFragment of the given text at the given position. */
-    private static RawLine rawLine(float x, float y, String text) {
-        float width = text.length() * 6f; // ~6pt per char — rough but consistent
-        float height = 12f;
-        Bounds bounds = new Bounds(x, y, width, height);
-        TextFragment fragment =
-                new TextFragment("tf-test", text, bounds, y + height, 11f, "Helvetica", false);
-        return new RawLine("ln-test", List.of(fragment), bounds, 1);
-    }
-
-    /**
-     * Creates a RawLine with two TextFragments representing two words separated by a small gap.
-     * Used to simulate a values-only line with multiple numeric tokens.
-     */
-    private static RawLine rawLineMultiWord(
-            float x, float y, String word1, float w1, String word2, float w2) {
-        float height = 12f;
-        Bounds b1 = new Bounds(x, y, w1, height);
-        Bounds b2 = new Bounds(x + w1 + 5f, y, w2, height);
-        TextFragment f1 = new TextFragment("tf-1", word1, b1, y + height, 11f, "Helvetica", false);
-        TextFragment f2 = new TextFragment("tf-2", word2, b2, y + height, 11f, "Helvetica", false);
-        Bounds lineBounds = new Bounds(x, y, x + w1 + 5f + w2 - x, height);
-        return new RawLine("ln-test", List.of(f1, f2), lineBounds, 1);
-    }
-
-    /** Tokenises a RawLine via the parser's own tokenise logic (package-private access). */
-    private LineAlignmentTableParser.TokenizedLine tokenized(RawLine line) {
-        return parser.tokenize(line);
-    }
-}

app/common/src/test/java/stirling/software/SPDF/pdf/parser/PageColumnLayoutTest.java

@@ -0,0 +1,149 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.junit.jupiter.api.Test;
+
+/** Unit tests for {@link PageColumnLayout} gutter detection and column classification. */
+class PageColumnLayoutTest {
+
+    private static final float PAGE_WIDTH = 612f; // Letter portrait
+
+    // ── single-column ────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void singleColumn_oneColumnNoGutters() {
+        List<float[]> lines = List.of(lineBox(72f, 396f));
+
+        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
+
+        assertThat(layout.columnCount()).isEqualTo(1);
+        assertThat(layout.gutters()).isEmpty();
+    }
+
+    @Test
+    void singleColumn_classifyAnchor_returnsZero() {
+        PageColumnLayout layout =
+                PageColumnLayout.fromLineBoxes(List.of(lineBox(72f, 396f)), PAGE_WIDTH);
+
+        assertThat(layout.columnOf(100f, 200f)).isEqualTo(0);
+    }
+
+    // ── two-column ───────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void twoColumn_detectsGutter() {
+        PageColumnLayout layout =
+                PageColumnLayout.fromLineBoxes(buildTwoColumnLines(3), PAGE_WIDTH);
+
+        assertThat(layout.columnCount()).isEqualTo(2);
+        assertThat(layout.gutters()).hasSize(1);
+        float[] gutter = layout.gutters().get(0);
+        // Gutter is centered on pageWidth/2 with PageColumnLayout.MIDPOINT_SLACK_PT slack each
+        // side.
+        float pageMid = PAGE_WIDTH / 2f;
+        assertThat(gutter[0]).isBetween(pageMid - 40f, pageMid - 20f);
+        assertThat(gutter[1]).isBetween(pageMid + 20f, pageMid + 40f);
+    }
+
+    @Test
+    void twoColumn_classifyLeftAndRightAnchors() {
+        PageColumnLayout layout =
+                PageColumnLayout.fromLineBoxes(buildTwoColumnLines(3), PAGE_WIDTH);
+        assertThat(layout.columnOf(100f, 200f)).isEqualTo(0);
+        assertThat(layout.columnOf(380f, 460f)).isEqualTo(1);
+    }
+
+    @Test
+    void twoColumn_columnsCrossing_leftLineOnlyHitsLeft() {
+        PageColumnLayout layout =
+                PageColumnLayout.fromLineBoxes(buildTwoColumnLines(3), PAGE_WIDTH);
+        assertThat(layout.columnsCrossing(72f, 280f)).containsExactly(0);
+        assertThat(layout.columnsCrossing(320f, 540f)).containsExactly(1);
+    }
+
+    @Test
+    void twoColumn_spanningLine_returnsBothColumns() {
+        List<float[]> lines = new ArrayList<>(buildTwoColumnLines(3));
+        // Full-width header that crosses pageWidth/2.
+        lines.add(lineBox(72f, 396f));
+
+        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
+
+        assertThat(layout.columnsCrossing(72f, 540f)).containsExactly(0, 1);
+        assertThat(layout.columnsCrossing(72f, 280f)).containsExactly(0);
+    }
+
+    private static List<float[]> buildTwoColumnLines(int rowsPerColumn) {
+        List<float[]> lines = new ArrayList<>();
+        for (int i = 0; i < rowsPerColumn; i++) {
+            lines.add(lineBox(72f, 136f)); // left column body (72..208)
+            lines.add(lineBox(320f, 220f)); // right column body (320..540)
+        }
+        return lines;
+    }
+
+    // ── three-column ─────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void threeColumn_collapsesToLeftRightSplit() {
+        // The midpoint-based detector splits the page at pageWidth/2 and treats anything else as
+        // single-column or spanning. A genuine 3-column layout collapses to 2 columns; the middle
+        // column's content ends up classified by midpoint as left or right of pageMid.
+        List<float[]> lines = new ArrayList<>();
+        for (int i = 0; i < 6; i++) {
+            lines.add(lineBox(72f, 150f)); // 72..222
+            lines.add(lineBox(252f, 150f)); // 252..402
+            lines.add(lineBox(432f, 150f)); // 432..582
+        }
+
+        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
+
+        assertThat(layout.columnCount()).isEqualTo(2);
+        assertThat(layout.gutters()).hasSize(1);
+    }
+
+    // ── empty page ───────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void emptyPage_singleColumnFallback() {
+        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(List.of(), PAGE_WIDTH);
+        assertThat(layout.columnCount()).isEqualTo(1);
+        assertThat(layout.gutters()).isEmpty();
+    }
+
+    @Test
+    void onlyShortFragments_singleColumnFallback() {
+        // Page numbers / decorations — too narrow to vote either side.
+        List<float[]> lines = List.of(lineBox(300f, 6f));
+        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
+        assertThat(layout.columnCount()).isEqualTo(1);
+    }
+
+    // ── narrow gap should not be confused for a gutter ───────────────────────────────────────────
+
+    @Test
+    void narrowInternalGap_doesNotProduceGutter() {
+        // Both halves sit left of the page midpoint, so no line votes for a right column and
+        // detection falls back to single-column.
+        List<float[]> lines = new ArrayList<>();
+        lines.add(lineBox(72f, 100f));
+        lines.add(lineBox(180f, 100f));
+        for (int i = 0; i < 5; i++) {
+            lines.add(lineBox(72f, 208f));
+        }
+
+        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
+        assertThat(layout.columnCount()).isEqualTo(1);
+    }
+
+    // ── helpers ──────────────────────────────────────────────────────────────────────────────────
+
+    /** Builds a line bounding box {@code [x1, 0, x1+width, 0]}; Y is unused by detection. */
+    private static float[] lineBox(float x1, float width) {
+        return new float[] {x1, 0f, x1 + width, 0f};
+    }
+}

app/common/src/test/java/stirling/software/common/cluster/inprocess/InProcessDistributedLockTest.java

@@ -24,7 +24,9 @@ class InProcessDistributedLockTest {
     }
 
     @Test
-    void reentryFromSameThreadFails() {
+    void reentryFromSameThreadFails_parityWithValkey() {
+        // The Valkey impl refuses reentry (SET NX semantics); the in-process impl must match,
+        // otherwise code working in single-instance silently breaks in cluster mode.
         DistributedLock lock = new InProcessDistributedLock();
         DistributedLock.LockHandle h1 = lock.tryAcquire("k", Duration.ofSeconds(30)).orElseThrow();
         Optional<DistributedLock.LockHandle> reentry = lock.tryAcquire("k", Duration.ofSeconds(30));

app/common/src/test/java/stirling/software/common/cluster/inprocess/LocalDiskFileStoreTest.java

@@ -3,11 +3,13 @@ package stirling.software.common.cluster.inprocess;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.nio.file.Path;
 
 import org.junit.jupiter.api.Test;
@@ -39,4 +41,46 @@ class LocalDiskFileStoreTest {
         assertThrows(IllegalArgumentException.class, () -> store.resolve("a/b"));
         assertThrows(IllegalArgumentException.class, () -> store.resolve("a\\b"));
     }
+
+    @Test
+    void ownerSidecarCannotBeReadAsFileId(@TempDir Path dir) throws IOException {
+        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
+        FileStore.Stored stored =
+                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", "alice");
+        String sidecarId = stored.fileId() + ".owner";
+        assertThrows(IllegalArgumentException.class, () -> store.resolve(sidecarId));
+        assertThrows(IllegalArgumentException.class, () -> store.retrieveBytes(sidecarId));
+    }
+
+    @Test
+    void ownerIsPersistedAndReturnedByGetOwner(@TempDir Path dir) throws IOException {
+        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
+        FileStore.Stored stored =
+                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", "alice");
+        assertEquals("alice", store.getOwner(stored.fileId()));
+    }
+
+    @Test
+    void getOwnerReturnsNullWhenNoOwnerWasRecorded(@TempDir Path dir) throws IOException {
+        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
+        FileStore.Stored stored =
+                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", null);
+        assertNull(store.getOwner(stored.fileId()));
+    }
+
+    @Test
+    void getOwnerReturnsNullForUnknownFileId(@TempDir Path dir) throws IOException {
+        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
+        assertNull(store.getOwner("00000000-0000-0000-0000-000000000000"));
+    }
+
+    @Test
+    void deleteRemovesOwnerSidecar(@TempDir Path dir) throws IOException {
+        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
+        FileStore.Stored stored =
+                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", "alice");
+        assertTrue(store.delete(stored.fileId()));
+        assertFalse(Files.exists(dir.resolve(stored.fileId() + ".owner")));
+        assertNull(store.getOwner(stored.fileId()));
+    }
 }

app/common/src/test/java/stirling/software/common/pdf/PdfMarkdownConverterTest.java

@@ -0,0 +1,269 @@
+package stirling.software.common.pdf;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+import stirling.software.jpdfium.PdfDocument;
+import stirling.software.jpdfium.text.TextLine;
+import stirling.software.jpdfium.text.TextWord;
+
+/**
+ * Accuracy and robustness tests for {@link PdfMarkdownConverter}, comparing conversion output
+ * against hand-authored golden Markdown for a set of owned/synthetic fixtures.
+ *
+ * <p>The {@link #gatedFixtures()} set is enforced in CI: those fixtures currently convert within
+ * the accuracy threshold and guard against regressions. Fixtures still being iterated on live in
+ * {@link #wipFixtures()} under a {@link Disabled} test so the goldens stay in the tree without
+ * breaking the build. Enable the WIP test locally to see per-fixture scores while working on the
+ * converter.
+ */
+class PdfMarkdownConverterTest {
+
+    /** Accuracy threshold: output must share at least this fraction of content with the golden. */
+    private static final double THRESHOLD = 0.95;
+
+    @TempDir Path tmp;
+
+    /** Fixtures that meet the accuracy threshold today and therefore gate CI. */
+    static Stream<Arguments> gatedFixtures() {
+        return Stream.of(
+                Arguments.of("multi-column-test_lorem.pdf", "multi-column-test_lorem.md"),
+                Arguments.of("bordered-table-test_widget.pdf", "bordered-table-test_widget.md"),
+                Arguments.of("many-tables-test_stress.pdf", "many-tables-test_stress.md"));
+    }
+
+    /** Fixtures still below the threshold; tracked here, enable locally to iterate. */
+    static Stream<Arguments> wipFixtures() {
+        return Stream.of(
+                Arguments.of(
+                        "wrapped-cell-test_expense-report.pdf",
+                        "wrapped-cell-test_expense-report.md"));
+    }
+
+    @ParameterizedTest(name = "{0}")
+    @MethodSource("gatedFixtures")
+    void convertMatchesGoldenMarkdown(String pdfName, String mdName) throws IOException {
+        assertConversionMatchesGolden(pdfName, mdName);
+    }
+
+    @Disabled("WIP fixtures below the accuracy threshold; enable locally to iterate")
+    @ParameterizedTest(name = "{0}")
+    @MethodSource("wipFixtures")
+    void convertMatchesGoldenMarkdownWip(String pdfName, String mdName) throws IOException {
+        assertConversionMatchesGolden(pdfName, mdName);
+    }
+
+    /**
+     * Degenerate/extreme geometry must not crash the converter. A crafted or malformed PDF can
+     * position text anywhere via a text matrix, so a row's words can span from near the origin to a
+     * coordinate beyond {@link Integer#MAX_VALUE}. The old column-detection code sized an {@code
+     * int[]} straight from {@code (int) Math.ceil(maxX) - lo}, which either allocated a multi-GB
+     * array (OutOfMemoryError) or overflowed to a negative length (NegativeArraySizeException) —
+     * taking down the request thread. Detection must instead bail out and return no columns.
+     */
+    @Test
+    void columnDetectionSurvivesDegenerateGeometry() {
+        // x ≈ 2.5e9 is past Integer.MAX_VALUE; combined with a near-origin word it yields an
+        // implausible span that the pre-fix code turned into a fatal array allocation.
+        List<TextLine> rows = new ArrayList<>();
+        for (int r = 0; r < 4; r++) {
+            float y = 400f - r * 12f;
+            TextWord near = new TextWord(List.of(), 50f, y, 30f, 10f);
+            TextWord far = new TextWord(List.of(), 2_500_000_000f, y, 30f, 10f);
+            rows.add(new TextLine(List.of(near, far), 50f, y, 2_499_999_980f, 10f));
+        }
+
+        List<float[]> columns =
+                assertDoesNotThrow(() -> PdfMarkdownConverter.findColumnRangesFromLines(rows));
+        assertTrue(
+                columns.isEmpty(),
+                "implausible page span should disable column detection, not allocate from it");
+    }
+
+    private void assertConversionMatchesGolden(String pdfName, String mdName) throws IOException {
+        Path pdfPath = tmp.resolve(pdfName);
+        try (InputStream in =
+                getClass().getResourceAsStream("/pdf-ingestion-fixtures/" + pdfName)) {
+            if (in == null) {
+                fail("Fixture not found on classpath: /pdf-ingestion-fixtures/" + pdfName);
+            }
+            Files.copy(in, pdfPath);
+        }
+
+        String actual;
+        try (PdfDocument doc = PdfDocument.open(pdfPath)) {
+            actual = new PdfMarkdownConverter().convert(doc);
+        }
+
+        String expected;
+        try (InputStream in = getClass().getResourceAsStream("/pdf-ingestion-fixtures/" + mdName)) {
+            if (in == null) {
+                fail("Golden file not found on classpath: /pdf-ingestion-fixtures/" + mdName);
+            }
+            expected = new String(in.readAllBytes(), StandardCharsets.UTF_8);
+        }
+
+        // Image placeholders are not scored: their body text is a TODO ("ideally, add the info
+        // available about the image...") rather than real content, so comparing it would penalise
+        // output for matching a placeholder we intend to replace. Drop those lines from both sides.
+        expected = stripImagePlaceholders(expected);
+        actual = stripImagePlaceholders(actual);
+
+        double similarity = similarity(expected, actual);
+        if (similarity < THRESHOLD) {
+            fail(
+                    String.format(
+                            "Markdown output differs from golden file '%s' by %.1f%% (threshold %.0f%%):%n%s",
+                            mdName,
+                            (1.0 - similarity) * 100,
+                            (1.0 - THRESHOLD) * 100,
+                            unifiedDiff(expected, actual)));
+        }
+    }
+
+    /** Substring identifying an image-placeholder line, which is excluded from scoring. */
+    private static final String IMAGE_PLACEHOLDER_MARKER = "Image intentionally redacted";
+
+    /**
+     * Removes non-content lines from the comparison: image placeholders (TODO text we intend to
+     * replace) and GFM table separator rows (the {@code |---|---|} divider, whose exact dash count
+     * is cosmetic — any run of three or more dashes is valid Markdown).
+     */
+    private static String stripImagePlaceholders(String md) {
+        StringBuilder sb = new StringBuilder();
+        for (String line : md.split("\n", -1)) {
+            if (line.contains(IMAGE_PLACEHOLDER_MARKER)
+                    || line.strip().startsWith("<image redacted")
+                    || isTableSeparatorRow(line)) {
+                continue;
+            }
+            if (sb.length() > 0) {
+                sb.append('\n');
+            }
+            sb.append(line);
+        }
+        return sb.toString();
+    }
+
+    /** True for a GFM table separator row, e.g. {@code |---|:--:|---|} (only |, -, :, space). */
+    private static boolean isTableSeparatorRow(String line) {
+        String t = line.strip();
+        if (!t.contains("-")) {
+            return false;
+        }
+        return t.chars().allMatch(c -> c == '|' || c == '-' || c == ':' || c == ' ');
+    }
+
+    /**
+     * Character-level similarity: proportion of expected characters that appear in the LCS. O(n*m)
+     * but golden files are small enough that this is fine.
+     */
+    private static double similarity(String expected, String actual) {
+        if (expected.isEmpty() && actual.isEmpty()) return 1.0;
+        if (expected.isEmpty() || actual.isEmpty()) return 0.0;
+        // Strip all whitespace for a content-focused comparison
+        String e = expected.replaceAll("\\s+", " ").strip();
+        String a = actual.replaceAll("\\s+", " ").strip();
+        int lcs = lcsLength(e, a);
+        return (double) lcs / Math.max(e.length(), a.length());
+    }
+
+    private static int lcsLength(String a, String b) {
+        // Use two-row DP to keep memory reasonable
+        int m = a.length(), n = b.length();
+        int[] prev = new int[n + 1];
+        int[] curr = new int[n + 1];
+        for (int i = 1; i <= m; i++) {
+            for (int j = 1; j <= n; j++) {
+                if (a.charAt(i - 1) == b.charAt(j - 1)) {
+                    curr[j] = prev[j - 1] + 1;
+                } else {
+                    curr[j] = Math.max(curr[j - 1], prev[j]);
+                }
+            }
+            int[] tmp = prev;
+            prev = curr;
+            curr = tmp;
+            java.util.Arrays.fill(curr, 0);
+        }
+        return prev[n];
+    }
+
+    private static String unifiedDiff(String expected, String actual) {
+        String[] expectedLines = expected.split("\n", -1);
+        String[] actualLines = actual.split("\n", -1);
+
+        List<String> diff = new ArrayList<>();
+        diff.add("--- expected");
+        diff.add("+++ actual");
+
+        int maxLines = Math.max(expectedLines.length, actualLines.length);
+        int context = 3;
+        boolean inHunk = false;
+        int hunkStart = -1;
+        List<String> hunkLines = new ArrayList<>();
+
+        for (int i = 0; i < maxLines; i++) {
+            String exp = i < expectedLines.length ? expectedLines[i] : null;
+            String act = i < actualLines.length ? actualLines[i] : null;
+
+            boolean changed = exp == null || act == null || !exp.equals(act);
+            if (changed) {
+                if (!inHunk) {
+                    inHunk = true;
+                    hunkStart = Math.max(0, i - context);
+                    // add context lines before change
+                    for (int c = hunkStart; c < i; c++) {
+                        hunkLines.add(" " + (c < expectedLines.length ? expectedLines[c] : ""));
+                    }
+                }
+                if (exp != null) hunkLines.add("-" + exp);
+                if (act != null) hunkLines.add("+" + act);
+            } else {
+                if (inHunk) {
+                    hunkLines.add(" " + exp);
+                    // check if we're far enough past the last change to close the hunk
+                    boolean moreChanges = false;
+                    for (int j = i + 1; j < Math.min(i + context, maxLines); j++) {
+                        String e2 = j < expectedLines.length ? expectedLines[j] : null;
+                        String a2 = j < actualLines.length ? actualLines[j] : null;
+                        if (e2 == null || a2 == null || !e2.equals(a2)) {
+                            moreChanges = true;
+                            break;
+                        }
+                    }
+                    if (!moreChanges && (i - hunkStart) >= context) {
+                        diff.add("@@ -" + (hunkStart + 1) + " @@");
+                        diff.addAll(hunkLines);
+                        hunkLines.clear();
+                        inHunk = false;
+                    }
+                }
+            }
+        }
+
+        if (inHunk && !hunkLines.isEmpty()) {
+            diff.add("@@ -" + (hunkStart + 1) + " @@");
+            diff.addAll(hunkLines);
+        }
+
+        return String.join("\n", diff);
+    }
+}

app/common/src/test/java/stirling/software/common/service/FileStorageDelegationTest.java

@@ -5,6 +5,7 @@ import static org.mockito.Mockito.mock;
 
 import java.io.IOException;
 import java.nio.file.Path;
+import java.util.Optional;
 
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
@@ -19,7 +20,8 @@ class FileStorageDelegationTest {
         FileStorage fs =
                 new FileStorage(
                         mock(FileOrUploadService.class),
-                        new LocalDiskFileStore(tempDir.toString()));
+                        new LocalDiskFileStore(tempDir.toString()),
+                        Optional.empty());
         byte[] payload = "round-trip".getBytes();
         String id = fs.storeBytes(payload, "x.bin");
         assertArrayEquals(payload, fs.retrieveBytes(id));

app/common/src/test/java/stirling/software/common/service/FileStorageOwnershipTest.java

@@ -0,0 +1,107 @@
+package stirling.software.common.service;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import stirling.software.common.cluster.inprocess.LocalDiskFileStore;
+import stirling.software.common.util.JobContext;
+
+class FileStorageOwnershipTest {
+
+    private FileStorage newStorageWithoutSecurity(Path tempDir) {
+        return new FileStorage(
+                mock(FileOrUploadService.class),
+                new LocalDiskFileStore(tempDir.toString()),
+                Optional.empty());
+    }
+
+    private FileStorage newStorageWithCurrentUser(Path tempDir, AtomicReference<String> userRef) {
+        JobOwnershipService svc = mock(JobOwnershipService.class);
+        when(svc.getCurrentUserId()).thenAnswer(invocation -> Optional.ofNullable(userRef.get()));
+        return new FileStorage(
+                mock(FileOrUploadService.class),
+                new LocalDiskFileStore(tempDir.toString()),
+                Optional.of(svc));
+    }
+
+    @Test
+    void desktopMode_noOwnershipService_storesAndRetrievesWithoutChecks(@TempDir Path tempDir)
+            throws IOException {
+        FileStorage fs = newStorageWithoutSecurity(tempDir);
+        byte[] payload = "desktop".getBytes();
+        String id = fs.storeBytes(payload, "x.bin");
+        assertArrayEquals(payload, fs.retrieveBytes(id));
+    }
+
+    @Test
+    void sameUserStoresAndRetrieves_allowed(@TempDir Path tempDir) throws IOException {
+        AtomicReference<String> user = new AtomicReference<>("alice");
+        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
+        byte[] payload = "alice's file".getBytes();
+        String id = fs.storeBytes(payload, "x.bin");
+        assertArrayEquals(payload, fs.retrieveBytes(id));
+    }
+
+    @Test
+    void differentUserRetrieves_throwsSecurityException(@TempDir Path tempDir) throws IOException {
+        AtomicReference<String> user = new AtomicReference<>("alice");
+        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
+        String id = fs.storeBytes("alice's file".getBytes(), "x.bin");
+        user.set("bob");
+        assertThrows(SecurityException.class, () -> fs.retrieveBytes(id));
+        assertThrows(SecurityException.class, () -> fs.retrieveInputStream(id));
+        assertThrows(SecurityException.class, () -> fs.getFileSize(id));
+        assertThrows(SecurityException.class, () -> fs.fileExists(id));
+        assertThrows(SecurityException.class, () -> fs.deleteFile(id));
+    }
+
+    @Test
+    void anonymousRetrieveOfOwnedFile_allowed_noCurrentUserMeansNoCompare(@TempDir Path tempDir)
+            throws IOException {
+        AtomicReference<String> user = new AtomicReference<>("alice");
+        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
+        byte[] payload = "alice's file".getBytes();
+        String id = fs.storeBytes(payload, "x.bin");
+        user.set(null);
+        assertArrayEquals(payload, fs.retrieveBytes(id));
+    }
+
+    @Test
+    void authedRetrieveOfAnonymousFile_allowed_noOwnerOnFile(@TempDir Path tempDir)
+            throws IOException {
+        AtomicReference<String> user = new AtomicReference<>(null);
+        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
+        byte[] payload = "no-owner".getBytes();
+        String id = fs.storeBytes(payload, "x.bin");
+        user.set("alice");
+        assertArrayEquals(payload, fs.retrieveBytes(id));
+    }
+
+    @Test
+    void propagatedOwner_scopesAsyncWriteWithNoLiveUser(@TempDir Path tempDir) throws IOException {
+        AtomicReference<String> user = new AtomicReference<>(null);
+        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
+        byte[] payload = "alice's async result".getBytes();
+        String id;
+        try {
+            JobContext.setOwner("alice");
+            id = fs.storeBytes(payload, "x.bin");
+        } finally {
+            JobContext.clear();
+        }
+        user.set("alice");
+        assertArrayEquals(payload, fs.retrieveBytes(id));
+        user.set("bob");
+        assertThrows(SecurityException.class, () -> fs.retrieveBytes(id));
+    }
+}

app/common/src/test/java/stirling/software/common/service/FileStorageTest.java

@@ -9,6 +9,8 @@ import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.Optional;
+import java.util.UUID;
 import java.util.stream.Stream;
 
 import org.junit.jupiter.api.BeforeEach;
@@ -37,7 +39,10 @@ class FileStorageTest {
     void setUp() throws IOException {
         MockitoAnnotations.openMocks(this);
         fileStorage =
-                new FileStorage(fileOrUploadService, new LocalDiskFileStore(tempDir.toString()));
+                new FileStorage(
+                        fileOrUploadService,
+                        new LocalDiskFileStore(tempDir.toString()),
+                        Optional.empty());
 
         // Create a mock MultipartFile
         mockFile = mock(MultipartFile.class);
@@ -79,7 +84,7 @@ class FileStorageTest {
     void testRetrieveFile() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-1";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -99,7 +104,7 @@ class FileStorageTest {
     void testRetrieveBytes() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-2";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -113,7 +118,7 @@ class FileStorageTest {
     @Test
     void testRetrieveFile_FileNotFound() {
         // Arrange
-        String nonExistentFileId = "non-existent-file";
+        String nonExistentFileId = UUID.randomUUID().toString();
 
         // Act & Assert
         assertThrows(IOException.class, () -> fileStorage.retrieveFile(nonExistentFileId));
@@ -122,7 +127,7 @@ class FileStorageTest {
     @Test
     void testRetrieveBytes_FileNotFound() {
         // Arrange
-        String nonExistentFileId = "non-existent-file";
+        String nonExistentFileId = UUID.randomUUID().toString();
 
         // Act & Assert
         assertThrows(IOException.class, () -> fileStorage.retrieveBytes(nonExistentFileId));
@@ -132,7 +137,7 @@ class FileStorageTest {
     void testDeleteFile() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-3";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -147,7 +152,7 @@ class FileStorageTest {
     @Test
     void testDeleteFile_FileNotFound() {
         // Arrange
-        String nonExistentFileId = "non-existent-file";
+        String nonExistentFileId = UUID.randomUUID().toString();
 
         // Act
         boolean result = fileStorage.deleteFile(nonExistentFileId);
@@ -160,7 +165,7 @@ class FileStorageTest {
     void testFileExists() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-4";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -174,7 +179,7 @@ class FileStorageTest {
     @Test
     void testFileExists_FileNotFound() {
         // Arrange
-        String nonExistentFileId = "non-existent-file";
+        String nonExistentFileId = UUID.randomUUID().toString();
 
         // Act
         boolean result = fileStorage.fileExists(nonExistentFileId);

app/common/src/test/java/stirling/software/common/service/InternalApiClientTest.java

@@ -59,6 +59,53 @@ class InternalApiClientTest {
                 servletContext, userService, tempFileManager, environment, applicationProperties);
     }
 
+    @Test
+    void postTagsRequestAsAutomation() throws Exception {
+        // Every InternalApiClient.post() caller is a parent automation flow dispatching a child
+        // tool (pipeline executor, AI workflow, policy runner). Tagging the sub-step here means
+        // the saas PaygChargeInterceptor classifies it as BillingCategory.AUTOMATION regardless of
+        // the dispatched controller's @RequiresFeature — so an AI-OCR step inside a policy run
+        // bills as AUTOMATION, not AI. The header value is the literal string "true" because the
+        // interceptor compares case-insensitively-trimmed against that token.
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        body.add("fileInput", namedResource("input.pdf", "data"));
+
+        Path tempPath = Files.createTempFile("internal-api-automation-test", ".tmp");
+        TempFile tempFile = mock(TempFile.class);
+        when(tempFile.getPath()).thenReturn(tempPath);
+        when(tempFile.getFile()).thenReturn(tempPath.toFile());
+        when(tempFileManager.createManagedTempFile("internal-api")).thenReturn(tempFile);
+
+        HttpHeaders[] captured = {null};
+
+        try (var ignored =
+                mockConstruction(
+                        RestTemplate.class,
+                        (rt, ctx) -> {
+                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
+                                    .thenAnswer(
+                                            inv -> {
+                                                HttpEntity<?> entity = inv.getArgument(0);
+                                                captured[0] = entity.getHeaders();
+                                                return (RequestCallback) req -> {};
+                                            });
+                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
+                                    .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
+                        })) {
+
+            InternalApiClient mockedClient = newClient();
+            mockedClient.post("/api/v1/general/merge-pdfs", body);
+
+            assertNotNull(captured[0]);
+            assertEquals(
+                    "true",
+                    captured[0].getFirst(InternalApiClient.AUTOMATION_HEADER),
+                    "Sub-step dispatch must carry the automation marker header");
+        } finally {
+            Files.deleteIfExists(tempPath);
+        }
+    }
+
     @Test
     void postDoesNotForceContentType() throws Exception {
         MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();

app/common/src/test/java/stirling/software/common/service/TaskManagerJobStoreDelegationTest.java

@@ -86,6 +86,8 @@ class TaskManagerJobStoreDelegationTest {
 
                     @Override
                     public boolean shouldRunLocalCleanup() {
+                        // Distributed backplanes own job TTL eviction themselves; this mock
+                        // mirrors the real ValkeyClusterBackplane override of the default true.
                         return false;
                     }
                 };

app/common/src/test/java/stirling/software/common/util/OfficeDocumentSanitizerTest.java

@@ -0,0 +1,370 @@
+package stirling.software.common.util;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.mock;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+import java.util.zip.ZipOutputStream;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.service.SsrfProtectionService;
+
+class OfficeDocumentSanitizerTest {
+
+    private static final String EXTERNAL_URL = "https://webhook.site/ssrf-callback";
+    private static final String INTERNAL_TARGET = "media/image1.png";
+
+    private static final String DOCX_RELS =
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                    + "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+                    + "<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\""
+                    + " Target=\""
+                    + EXTERNAL_URL
+                    + "\" TargetMode=\"External\"/>"
+                    + "<Relationship Id=\"rId2\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\""
+                    + " Target=\""
+                    + INTERNAL_TARGET
+                    + "\"/>"
+                    + "</Relationships>";
+
+    private static final String DOCX_DOCUMENT =
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                    + "<w:document xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\">"
+                    + "<w:body><w:p/></w:body></w:document>";
+
+    private static final String ODF_CONTENT_EXTERNAL =
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                    + "<office:document-content"
+                    + " xmlns:office=\"urn:oasis:names:tc:opendocument:xmlns:office:1.0\""
+                    + " xmlns:draw=\"urn:oasis:names:tc:opendocument:xmlns:drawing:1.0\""
+                    + " xmlns:xlink=\"http://www.w3.org/1999/xlink\">"
+                    + "<office:body><office:text>"
+                    + "<draw:frame><draw:image xlink:href=\""
+                    + EXTERNAL_URL
+                    + "\" xlink:type=\"simple\"/></draw:frame>"
+                    + "<draw:frame><draw:image xlink:href=\"Pictures/image1.png\" xlink:type=\"simple\"/></draw:frame>"
+                    + "</office:text></office:body></office:document-content>";
+
+    private SsrfProtectionService ssrfProtectionService;
+    private ApplicationProperties applicationProperties;
+    private OfficeDocumentSanitizer sanitizer;
+
+    @BeforeEach
+    void setUp() {
+        applicationProperties = new ApplicationProperties();
+        ssrfProtectionService = mock(SsrfProtectionService.class);
+        sanitizer = new OfficeDocumentSanitizer(ssrfProtectionService, applicationProperties);
+    }
+
+    @Test
+    void isSanitizableExtension_recognizesOoxmlAndOdf() {
+        assertTrue(sanitizer.isSanitizableExtension("docx"));
+        assertTrue(sanitizer.isSanitizableExtension("DOCX"));
+        assertTrue(sanitizer.isSanitizableExtension("xlsx"));
+        assertTrue(sanitizer.isSanitizableExtension("pptx"));
+        assertTrue(sanitizer.isSanitizableExtension("odt"));
+        assertTrue(sanitizer.isSanitizableExtension("ods"));
+        assertTrue(sanitizer.isSanitizableExtension("odp"));
+        assertFalse(sanitizer.isSanitizableExtension("pdf"));
+        assertFalse(sanitizer.isSanitizableExtension("html"));
+        assertFalse(sanitizer.isSanitizableExtension(""));
+        assertFalse(sanitizer.isSanitizableExtension(null));
+    }
+
+    @Test
+    void sanitize_stripsOoxmlExternalRelationship() throws IOException {
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("word/_rels/document.xml.rels", DOCX_RELS.getBytes(StandardCharsets.UTF_8));
+        entries.put("word/document.xml", DOCX_DOCUMENT.getBytes(StandardCharsets.UTF_8));
+        byte[] docx = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(docx, "docx");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String rels =
+                new String(result.get("word/_rels/document.xml.rels"), StandardCharsets.UTF_8);
+        assertFalse(rels.contains(EXTERNAL_URL), "External URL should be stripped from .rels");
+        assertFalse(
+                rels.toLowerCase().contains("targetmode=\"external\""),
+                "TargetMode=External relationship should be removed");
+        assertTrue(rels.contains(INTERNAL_TARGET), "Internal image target should be preserved");
+        assertArrayEquals(
+                DOCX_DOCUMENT.getBytes(StandardCharsets.UTF_8),
+                result.get("word/document.xml"),
+                "Non-rels entries must be untouched");
+    }
+
+    @Test
+    void sanitize_pptxExternalImageRelStripped() throws IOException {
+        String pptxRels =
+                "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                        + "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+                        + "<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\""
+                        + " Target=\""
+                        + EXTERNAL_URL
+                        + "\" TargetMode=\"External\"/>"
+                        + "</Relationships>";
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("ppt/slides/_rels/slide1.xml.rels", pptxRels.getBytes(StandardCharsets.UTF_8));
+        byte[] pptx = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(pptx, "pptx");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String rels =
+                new String(result.get("ppt/slides/_rels/slide1.xml.rels"), StandardCharsets.UTF_8);
+        assertFalse(rels.contains(EXTERNAL_URL));
+    }
+
+    @Test
+    void sanitize_xlsxExternalImageRelStripped() throws IOException {
+        String xlsxRels =
+                "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                        + "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+                        + "<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\""
+                        + " Target=\""
+                        + EXTERNAL_URL
+                        + "\" TargetMode=\"External\"/>"
+                        + "</Relationships>";
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put(
+                "xl/drawings/_rels/drawing1.xml.rels", xlsxRels.getBytes(StandardCharsets.UTF_8));
+        byte[] xlsx = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(xlsx, "xlsx");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String rels =
+                new String(
+                        result.get("xl/drawings/_rels/drawing1.xml.rels"), StandardCharsets.UTF_8);
+        assertFalse(rels.contains(EXTERNAL_URL));
+    }
+
+    @Test
+    void sanitize_odtStripsExternalXlinkHrefButKeepsInternal() throws IOException {
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("content.xml", ODF_CONTENT_EXTERNAL.getBytes(StandardCharsets.UTF_8));
+        String manifestXml =
+                "<?xml version=\"1.0\"?><manifest:manifest"
+                        + " xmlns:manifest=\"urn:oasis:names:tc:opendocument:xmlns:manifest:1.0\"/>";
+        entries.put("META-INF/manifest.xml", manifestXml.getBytes(StandardCharsets.UTF_8));
+        byte[] odt = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(odt, "odt");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String content = new String(result.get("content.xml"), StandardCharsets.UTF_8);
+        assertFalse(content.contains(EXTERNAL_URL), "External xlink:href should be stripped");
+        assertTrue(content.contains("Pictures/image1.png"), "Internal href should be preserved");
+    }
+
+    @Test
+    void sanitize_odsStripsExternalXlinkHref() throws IOException {
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("content.xml", ODF_CONTENT_EXTERNAL.getBytes(StandardCharsets.UTF_8));
+        byte[] ods = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(ods, "ods");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String content = new String(result.get("content.xml"), StandardCharsets.UTF_8);
+        assertFalse(content.contains(EXTERNAL_URL));
+    }
+
+    @Test
+    void sanitize_odpStripsExternalXlinkHrefInStylesXml() throws IOException {
+        String stylesXml =
+                "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                        + "<office:document-styles"
+                        + " xmlns:office=\"urn:oasis:names:tc:opendocument:xmlns:office:1.0\""
+                        + " xmlns:draw=\"urn:oasis:names:tc:opendocument:xmlns:drawing:1.0\""
+                        + " xmlns:xlink=\"http://www.w3.org/1999/xlink\">"
+                        + "<draw:image xlink:href=\""
+                        + EXTERNAL_URL
+                        + "\"/></office:document-styles>";
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("styles.xml", stylesXml.getBytes(StandardCharsets.UTF_8));
+        byte[] odp = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(odp, "odp");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String content = new String(result.get("styles.xml"), StandardCharsets.UTF_8);
+        assertFalse(content.contains(EXTERNAL_URL));
+    }
+
+    @Test
+    void sanitize_disabledByConfigReturnsOriginal() throws IOException {
+        applicationProperties.getSystem().setDisableSanitize(true);
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("word/_rels/document.xml.rels", DOCX_RELS.getBytes(StandardCharsets.UTF_8));
+        byte[] docx = zip(entries);
+
+        byte[] result = sanitizer.sanitize(docx, "docx");
+        assertArrayEquals(docx, result);
+    }
+
+    @Test
+    void sanitize_unrecognizedExtensionReturnsOriginal() throws IOException {
+        byte[] original = "irrelevant".getBytes(StandardCharsets.UTF_8);
+        byte[] result = sanitizer.sanitize(original, "pdf");
+        assertArrayEquals(original, result);
+    }
+
+    @Test
+    void sanitize_emptyInputThrows() {
+        assertThrows(IOException.class, () -> sanitizer.sanitize(new byte[0], "docx"));
+    }
+
+    @Test
+    void sanitize_nullInputThrows() {
+        assertThrows(IOException.class, () -> sanitizer.sanitize(null, "docx"));
+    }
+
+    @Test
+    void sanitize_preservesEntryWithExternalRefWhenAdminAllowsDomain() throws IOException {
+        applicationProperties
+                .getSystem()
+                .getHtml()
+                .getUrlSecurity()
+                .getAllowedDomains()
+                .add("webhook.site");
+        lenient().when(ssrfProtectionService.isUrlAllowed(eq(EXTERNAL_URL))).thenReturn(true);
+
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("word/_rels/document.xml.rels", DOCX_RELS.getBytes(StandardCharsets.UTF_8));
+        byte[] docx = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(docx, "docx");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String rels =
+                new String(result.get("word/_rels/document.xml.rels"), StandardCharsets.UTF_8);
+        assertTrue(rels.contains(EXTERNAL_URL), "Allow-listed external URL should be preserved");
+    }
+
+    @Test
+    void sanitize_doesNotConsultSsrfServiceWhenAllowedDomainsEmpty() throws IOException {
+        // Even if mock would say allowed, we should not invoke it when there is no allow-list,
+        // because MEDIUM default would let public URLs through and re-introduce the vulnerability.
+        lenient().when(ssrfProtectionService.isUrlAllowed(eq(EXTERNAL_URL))).thenReturn(true);
+
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("word/_rels/document.xml.rels", DOCX_RELS.getBytes(StandardCharsets.UTF_8));
+        byte[] docx = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(docx, "docx");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String rels =
+                new String(result.get("word/_rels/document.xml.rels"), StandardCharsets.UTF_8);
+        assertFalse(rels.contains(EXTERNAL_URL));
+    }
+
+    @Test
+    void sanitize_handlesNonXmlEntriesSafely() throws IOException {
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        byte[] imageBytes = new byte[] {(byte) 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a};
+        entries.put("word/media/image1.png", imageBytes);
+        entries.put("word/_rels/document.xml.rels", DOCX_RELS.getBytes(StandardCharsets.UTF_8));
+        byte[] docx = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(docx, "docx");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        assertArrayEquals(imageBytes, result.get("word/media/image1.png"));
+    }
+
+    @Test
+    void sanitize_internalLinksKeptWhenNoExternalPresent() throws IOException {
+        String internalOnlyRels =
+                "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                        + "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+                        + "<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\""
+                        + " Target=\"media/image1.png\"/>"
+                        + "</Relationships>";
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put(
+                "word/_rels/document.xml.rels", internalOnlyRels.getBytes(StandardCharsets.UTF_8));
+        byte[] docx = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(docx, "docx");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String rels =
+                new String(result.get("word/_rels/document.xml.rels"), StandardCharsets.UTF_8);
+        assertTrue(rels.contains("media/image1.png"));
+    }
+
+    @Test
+    void sanitize_corruptZipProducesSafeOutput() throws IOException {
+        byte[] garbage = "this is not a zip file".getBytes(StandardCharsets.UTF_8);
+        byte[] result = sanitizer.sanitize(garbage, "docx");
+        Map<String, byte[]> entries = unzip(result);
+        assertTrue(entries.isEmpty(), "Garbage input must not yield exploitable entries");
+    }
+
+    @Test
+    void sanitize_relativeOdfPathsArePreserved() throws IOException {
+        String content =
+                "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+                        + "<office:document-content"
+                        + " xmlns:office=\"urn:oasis:names:tc:opendocument:xmlns:office:1.0\""
+                        + " xmlns:draw=\"urn:oasis:names:tc:opendocument:xmlns:drawing:1.0\""
+                        + " xmlns:xlink=\"http://www.w3.org/1999/xlink\">"
+                        + "<draw:image xlink:href=\"../Pictures/image1.png\"/>"
+                        + "<draw:image xlink:href=\"#anchor\"/>"
+                        + "</office:document-content>";
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put("content.xml", content.getBytes(StandardCharsets.UTF_8));
+        byte[] odt = zip(entries);
+
+        byte[] cleaned = sanitizer.sanitize(odt, "odt");
+
+        Map<String, byte[]> result = unzip(cleaned);
+        String out = new String(result.get("content.xml"), StandardCharsets.UTF_8);
+        assertTrue(out.contains("../Pictures/image1.png"));
+        assertTrue(out.contains("#anchor"));
+    }
+
+    private static byte[] zip(Map<String, byte[]> entries) throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        try (ZipOutputStream zos = new ZipOutputStream(baos)) {
+            for (Map.Entry<String, byte[]> e : entries.entrySet()) {
+                ZipEntry entry = new ZipEntry(e.getKey());
+                zos.putNextEntry(entry);
+                zos.write(e.getValue());
+                zos.closeEntry();
+            }
+        }
+        return baos.toByteArray();
+    }
+
+    private static Map<String, byte[]> unzip(byte[] data) throws IOException {
+        Map<String, byte[]> entries = new HashMap<>();
+        try (ZipInputStream zis = new ZipInputStream(new ByteArrayInputStream(data))) {
+            ZipEntry e;
+            while ((e = zis.getNextEntry()) != null) {
+                entries.put(e.getName(), zis.readAllBytes());
+                zis.closeEntry();
+            }
+        }
+        return entries;
+    }
+}

app/common/src/test/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditorTest.java

@@ -1,163 +0,0 @@
-package stirling.software.common.util.propertyeditor;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import java.util.List;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import stirling.software.common.model.api.security.RedactionArea;
-
-class StringToArrayListPropertyEditorTest {
-
-    private StringToArrayListPropertyEditor<RedactionArea> editor;
-
-    @BeforeEach
-    void setUp() {
-        editor = new StringToArrayListPropertyEditor<>(RedactionArea.class);
-    }
-
-    @Test
-    void testSetAsText_ValidJson() {
-        // Arrange
-        String json =
-                "[{\"x\":10.5,\"y\":20.5,\"width\":100.0,\"height\":50.0,\"page\":1,\"color\":\"#FF0000\"}]";
-
-        // Act
-        editor.setAsText(json);
-        Object value = editor.getValue();
-
-        // Assert
-        assertNotNull(value, "Value should not be null");
-        assertInstanceOf(List.class, value, "Value should be a List");
-
-        @SuppressWarnings("unchecked")
-        List<RedactionArea> list = (List<RedactionArea>) value;
-        assertEquals(1, list.size(), "List should have 1 entry");
-
-        RedactionArea area = list.get(0);
-        assertEquals(10.5, area.getX(), "X should be 10.5");
-        assertEquals(20.5, area.getY(), "Y should be 20.5");
-        assertEquals(100.0, area.getWidth(), "Width should be 100.0");
-        assertEquals(50.0, area.getHeight(), "Height should be 50.0");
-        assertEquals(1, area.getPage(), "Page should be 1");
-        assertEquals("#FF0000", area.getColor(), "Color should be #FF0000");
-    }
-
-    @Test
-    void testSetAsText_MultipleItems() {
-        // Arrange
-        String json =
-                "["
-                        + "{\"x\":10.0,\"y\":20.0,\"width\":100.0,\"height\":50.0,\"page\":1,\"color\":\"#FF0000\"},"
-                        + "{\"x\":30.0,\"y\":40.0,\"width\":200.0,\"height\":150.0,\"page\":2,\"color\":\"#00FF00\"}"
-                        + "]";
-
-        // Act
-        editor.setAsText(json);
-        Object value = editor.getValue();
-
-        // Assert
-        assertNotNull(value, "Value should not be null");
-        assertInstanceOf(List.class, value, "Value should be a List");
-
-        @SuppressWarnings("unchecked")
-        List<RedactionArea> list = (List<RedactionArea>) value;
-        assertEquals(2, list.size(), "List should have 2 entries");
-
-        RedactionArea area1 = list.get(0);
-        assertEquals(10.0, area1.getX(), "X should be 10.0");
-        assertEquals(20.0, area1.getY(), "Y should be 20.0");
-        assertEquals(1, area1.getPage(), "Page should be 1");
-
-        RedactionArea area2 = list.get(1);
-        assertEquals(30.0, area2.getX(), "X should be 30.0");
-        assertEquals(40.0, area2.getY(), "Y should be 40.0");
-        assertEquals(2, area2.getPage(), "Page should be 2");
-    }
-
-    @Test
-    void testSetAsText_EmptyString() {
-        // Arrange
-        String json = "";
-
-        // Act
-        editor.setAsText(json);
-        Object value = editor.getValue();
-
-        // Assert
-        assertNotNull(value, "Value should not be null");
-        assertInstanceOf(List.class, value, "Value should be a List");
-
-        @SuppressWarnings("unchecked")
-        List<RedactionArea> list = (List<RedactionArea>) value;
-        assertTrue(list.isEmpty(), "List should be empty");
-    }
-
-    @Test
-    void testSetAsText_NullString() {
-        // Act
-        editor.setAsText(null);
-        Object value = editor.getValue();
-
-        // Assert
-        assertNotNull(value, "Value should not be null");
-        assertInstanceOf(List.class, value, "Value should be a List");
-
-        @SuppressWarnings("unchecked")
-        List<RedactionArea> list = (List<RedactionArea>) value;
-        assertTrue(list.isEmpty(), "List should be empty");
-    }
-
-    @Test
-    void testSetAsText_SingleItemAsArray() {
-        // Arrange - note this is a single object, not an array
-        String json =
-                "{\"x\":10.0,\"y\":20.0,\"width\":100.0,\"height\":50.0,\"page\":1,\"color\":\"#FF0000\"}";
-
-        // Act
-        editor.setAsText(json);
-        Object value = editor.getValue();
-
-        // Assert
-        assertNotNull(value, "Value should not be null");
-        assertInstanceOf(List.class, value, "Value should be a List");
-
-        @SuppressWarnings("unchecked")
-        List<RedactionArea> list = (List<RedactionArea>) value;
-        assertEquals(1, list.size(), "List should have 1 entry");
-
-        RedactionArea area = list.get(0);
-        assertEquals(10.0, area.getX(), "X should be 10.0");
-        assertEquals(20.0, area.getY(), "Y should be 20.0");
-    }
-
-    @Test
-    void testSetAsText_InvalidJson() {
-        // Arrange
-        String json = "invalid json";
-
-        // Act & Assert
-        assertThrows(IllegalArgumentException.class, () -> editor.setAsText(json));
-    }
-
-    @Test
-    void testSetAsText_UnknownProperties() {
-        // Arrange - this JSON contains properties not in RedactionArea
-        // With FAIL_ON_UNKNOWN_PROPERTIES disabled, this should ignore the unknown properties
-        String json = "[{\"invalid\":\"structure\"}]";
-
-        // Act
-        editor.setAsText(json);
-        Object value = editor.getValue();
-
-        // Assert
-        assertNotNull(value, "Value should not be null");
-        assertInstanceOf(List.class, value, "Value should be a List");
-
-        @SuppressWarnings("unchecked")
-        List<RedactionArea> list = (List<RedactionArea>) value;
-        assertEquals(1, list.size(), "List should have 1 entry (empty object)");
-    }
-}

app/common/src/test/resources/pdf-ingestion-fixtures/bordered-table-test_widget.md

@@ -0,0 +1,10 @@
+# Widget Inventory Report
+
+This report lists current stock levels for each warehouse.
+
+| Region | Units | Status |
+|---|---|---|
+| North | 1200 | OK |
+| South | 950 | Low |
+| East | 1430 | OK |
+| West | 875 | Low |

app/common/src/test/resources/pdf-ingestion-fixtures/bordered-table-test_widget.pdf

@@ -0,0 +1,74 @@
+%PDF-1.4
+%“Œ‹ž ReportLab Generated PDF document (opensource)
+1 0 obj
+<<
+/F1 2 0 R /F2 3 0 R
+>>
+endobj
+2 0 obj
+<<
+/BaseFont /Helvetica /Encoding /WinAnsiEncoding /Name /F1 /Subtype /Type1 /Type /Font
+>>
+endobj
+3 0 obj
+<<
+/BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding /Name /F2 /Subtype /Type1 /Type /Font
+>>
+endobj
+4 0 obj
+<<
+/Contents 8 0 R /MediaBox [ 0 0 612 792 ] /Parent 7 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+5 0 obj
+<<
+/PageMode /UseNone /Pages 7 0 R /Type /Catalog
+>>
+endobj
+6 0 obj
+<<
+/Author (\(anonymous\)) /CreationDate (D:20260603003133+01'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260603003133+01'00') /Producer (ReportLab PDF Library - \(opensource\)) 
+  /Subject (\(unspecified\)) /Title (\(anonymous\)) /Trapped /False
+>>
+endobj
+7 0 obj
+<<
+/Count 1 /Kids [ 4 0 R ] /Type /Pages
+>>
+endobj
+8 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 500
+>>
+stream
+Gas1[9i&Y\%))C:pc(6t3;pQ8%0T@tD+-Nf,MP8j(><jDruNO^VsZ'm=ue7^Ia=;l(`h-+jUU3'Knh#YjH-MEIFj6r!oqf+FjMh;(rCq>R4tMCHL4NI*\1+UNiI'V9NC%VeJKn/YI0J];XQt&X83?=ihrg<*Mcn1n!1nWcDaQPe\P"9gnJuHl(jf]JQgZ[,&^uobI4QF',k"*^S)3c;)GMWC(T'=",ErnS#U=YCUN0&q4+*KmK1Zd*NI\GQDiZUG7;PTja8lulb"\PWWO#WcfI[ZB:6s*3g$be%?JH<b[c(?4J1!2SLDmbmkh8.c&CU)B?Xu,cp$<hP@=fLc>(n`oaEJ[XE'%QW=HE04M<,;ERm[MS=uYF=nN3jG'f@#?O48Ia,6Y-3m&tTWVq1?DeiBkp.Ug*;lVZX`Z=P.eklHhNV;!R_?QOuoeJ<0%7idG7GM8boU$^>N.N,2^;25]0Z8M<<]XMCct>noC'Qfb?`*[Mo+,F9#>t~>endstream
+endobj
+xref
+0 9
+0000000000 65535 f 
+0000000061 00000 n 
+0000000102 00000 n 
+0000000209 00000 n 
+0000000321 00000 n 
+0000000514 00000 n 
+0000000582 00000 n 
+0000000862 00000 n 
+0000000921 00000 n 
+trailer
+<<
+/ID 
+[<ee376a59c53e3f2af87024f65fd4222c><ee376a59c53e3f2af87024f65fd4222c>]
+% ReportLab generated PDF document -- digest (opensource)
+
+/Info 6 0 R
+/Root 5 0 R
+/Size 9
+>>
+startxref
+1511
+%%EOF

app/common/src/test/resources/pdf-ingestion-fixtures/many-tables-test_stress.md

@@ -0,0 +1,222 @@
+Intro paragraph for section 1.
+
+| Name | Qty |
+|---|---|
+| alpha | 101 |
+| delta | 201 |
+
+# Section 2 Heading
+
+| Name | Qty | Price |
+|---|---|---|
+| alpha | 101 | charlie |
+| delta | 201 | foxtrot |
+| golf | 301 | india |
+
+## Section 3 Heading
+
+| Name | Qty | Price | Region |
+|---|---|---|---|
+| alpha | 101 | charlie | 3 |
+| delta | 201 | foxtrot | 13 |
+| golf | 301 | india | 23 |
+| juliet | 401 | lima | 33 |
+
+Intro paragraph for section 4.
+
+| Name | Qty | Price | Region | Status |
+|---|---|---|---|---|
+| alpha | 101 | charlie | 3 | echo |
+| delta | 201 | foxtrot | 13 | hotel |
+| golf | 301 | india | 23 | kilo |
+| juliet | 401 | lima | 33 | november |
+| mike | 501 | oscar | 43 | alpha |
+
+# Section 5 Heading
+
+| Name | Qty |
+|---|---|
+| alpha | 101 |
+| delta | 201 |
+| golf | 301 |
+| juliet | 401 |
+| mike | 501 |
+| papa | 601 |
+
+| Name | Qty | Price |
+|---|---|---|
+| alpha | 101 | charlie |
+| delta | 201 | foxtrot |
+
+# Section 7 Heading
+
+Intro paragraph for section 7.
+
+| Name | Qty | Price | Region |
+|---|---|---|---|
+| alpha | 101 | charlie | 3 |
+| delta | 201 | foxtrot | 13 |
+| golf | 301 | india | 23 |
+
+## Section 8 Heading
+
+| Name | Qty | Price | Region | Status |
+|---|---|---|---|---|
+| alpha | 101 | charlie | 3 | echo |
+| delta | 201 | foxtrot | 13 | hotel |
+| golf | 301 | india | 23 | kilo |
+| juliet | 401 | lima | 33 | november |
+
+| Name | Qty |
+|---|---|
+| alpha | 101 |
+| delta | 201 |
+| golf | 301 |
+| juliet | 401 |
+| mike | 501 |
+
+# Section 10 Heading
+
+Intro paragraph for section 10.
+
+| Name | Qty | Price |
+|---|---|---|
+| alpha | 101 | charlie |
+| delta | 201 | foxtrot |
+| golf | 301 | india |
+| juliet | 401 | lima |
+| mike | 501 | oscar |
+| papa | 601 | bravo |
+
+| Name | Qty | Price | Region |
+|---|---|---|---|
+| alpha | 101 | charlie | 3 |
+| delta | 201 | foxtrot | 13 |
+
+# Section 12 Heading
+
+| Name | Qty | Price | Region | Status |
+|---|---|---|---|---|
+| alpha | 101 | charlie | 3 | echo |
+| delta | 201 | foxtrot | 13 | hotel |
+| golf | 301 | india | 23 | kilo |
+
+## Section 13 Heading
+
+Intro paragraph for section 13.
+
+| Name | Qty |
+|---|---|
+| alpha | 101 |
+| delta | 201 |
+| golf | 301 |
+| juliet | 401 |
+
+| Name | Qty | Price |
+|---|---|---|
+| alpha | 101 | charlie |
+| delta | 201 | foxtrot |
+| golf | 301 | india |
+| juliet | 401 | lima |
+| mike | 501 | oscar |
+
+# Section 15 Heading
+
+| Name | Qty | Price | Region |
+|---|---|---|---|
+| alpha | 101 | charlie | 3 |
+| delta | 201 | foxtrot | 13 |
+| golf | 301 | india | 23 |
+| juliet | 401 | lima | 33 |
+| mike | 501 | oscar | 43 |
+| papa | 601 | bravo | 53 |
+
+Intro paragraph for section 16.
+
+| Name | Qty | Price | Region | Status |
+|---|---|---|---|---|
+| alpha | 101 | charlie | 3 | echo |
+| delta | 201 | foxtrot | 13 | hotel |
+
+# Section 17 Heading
+
+| Name | Qty |
+|---|---|
+| alpha | 101 |
+| delta | 201 |
+| golf | 301 |
+
+## Section 18 Heading
+
+| Name | Qty | Price |
+|---|---|---|
+| alpha | 101 | charlie |
+| delta | 201 | foxtrot |
+| golf | 301 | india |
+| juliet | 401 | lima |
+
+Intro paragraph for section 19.
+
+| Name | Qty | Price | Region |
+|---|---|---|---|
+| alpha | 101 | charlie | 3 |
+| delta | 201 | foxtrot | 13 |
+| golf | 301 | india | 23 |
+| juliet | 401 | lima | 33 |
+| mike | 501 | oscar | 43 |
+
+# Section 20 Heading
+
+| Name | Qty | Price | Region | Status |
+|---|---|---|---|---|
+| alpha | 101 | charlie | 3 | echo |
+| delta | 201 | foxtrot | 13 | hotel |
+| golf | 301 | india | 23 | kilo |
+| juliet | 401 | lima | 33 | november |
+| mike | 501 | oscar | 43 | alpha |
+| papa | 601 | bravo | 53 | delta |
+
+| Name | Qty |
+|---|---|
+| alpha | 101 |
+| delta | 201 |
+
+# Section 22 Heading
+
+Intro paragraph for section 22.
+
+| Name | Qty | Price |
+|---|---|---|
+| alpha | 101 | charlie |
+| delta | 201 | foxtrot |
+| golf | 301 | india |
+
+## Section 23 Heading
+
+| Name | Qty | Price | Region |
+|---|---|---|---|
+| alpha | 101 | charlie | 3 |
+| delta | 201 | foxtrot | 13 |
+| golf | 301 | india | 23 |
+| juliet | 401 | lima | 33 |
+
+| Name | Qty | Price | Region | Status |
+|---|---|---|---|---|
+| alpha | 101 | charlie | 3 | echo |
+| delta | 201 | foxtrot | 13 | hotel |
+| golf | 301 | india | 23 | kilo |
+| juliet | 401 | lima | 33 | november |
+| mike | 501 | oscar | 43 | alpha |
+
+# Section 25 Heading
+
+Intro paragraph for section 25.
+
+| Name | Qty |
+|---|---|
+| alpha | 101 |
+| delta | 201 |
+| golf | 301 |
+| juliet | 401 |
+| mike | 501 |
+| papa | 601 |

app/common/src/test/resources/pdf-ingestion-fixtures/many-tables-test_stress.pdf

@@ -0,0 +1,169 @@
+%PDF-1.4
+%“Œ‹ž ReportLab Generated PDF document (opensource)
+1 0 obj
+<<
+/F1 2 0 R /F2 3 0 R
+>>
+endobj
+2 0 obj
+<<
+/BaseFont /Helvetica /Encoding /WinAnsiEncoding /Name /F1 /Subtype /Type1 /Type /Font
+>>
+endobj
+3 0 obj
+<<
+/BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding /Name /F2 /Subtype /Type1 /Type /Font
+>>
+endobj
+4 0 obj
+<<
+/Contents 13 0 R /MediaBox [ 0 0 612 792 ] /Parent 12 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+5 0 obj
+<<
+/Contents 14 0 R /MediaBox [ 0 0 612 792 ] /Parent 12 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+6 0 obj
+<<
+/Contents 15 0 R /MediaBox [ 0 0 612 792 ] /Parent 12 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+7 0 obj
+<<
+/Contents 16 0 R /MediaBox [ 0 0 612 792 ] /Parent 12 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+8 0 obj
+<<
+/Contents 17 0 R /MediaBox [ 0 0 612 792 ] /Parent 12 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+9 0 obj
+<<
+/Contents 18 0 R /MediaBox [ 0 0 612 792 ] /Parent 12 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+10 0 obj
+<<
+/PageMode /UseNone /Pages 12 0 R /Type /Catalog
+>>
+endobj
+11 0 obj
+<<
+/Author (\(anonymous\)) /CreationDate (D:20260603005358+01'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260603005358+01'00') /Producer (ReportLab PDF Library - \(opensource\)) 
+  /Subject (\(unspecified\)) /Title (\(anonymous\)) /Trapped /False
+>>
+endobj
+12 0 obj
+<<
+/Count 6 /Kids [ 4 0 R 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R ] /Type /Pages
+>>
+endobj
+13 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 1007
+>>
+stream
+GauHKgN)$k&:O:Sn<io8&IUqd[51N1e*/]GIR%m`>DZmeMUK]*(BdhV"2[X,j0;*\%_E*0HXJRc`<Z.PlPcH-)*5ON#Qr4-#h+U(ll5egXa[FW7^<l-+Mko1pU57W'%??d'1Q-,]\qWS80;JOp0HFGa1T[+D>q%4S#/VM`O[Rh4i5T.Phi,$]aT$05!q:PBuCQU/.p2]@1koN*Tb*K9k5G\ht+Dr\K=+8\NZ"alMaOEo**@OK:8-.O1X3-?Gg`@m3%,ti3'">T-&c=M&Wuu?cDbGDp.gO<KniopM)A\M"ajn9N]6p@tefHlX67:iW3SE/[O\LV1TKe.i9es,%kWY+1-s,ft.u27]:^>F0!r6&&CLC$tM?fIR"M37["/*k9@YkpKKSS@Np"1/4#R]`I^(g*1Sc,9L3Qt6N(T@F`A>oBGgL-!r#Y4)R\G`D,iVtFeJUE9u4iuUQ?D%C&SB4kkp.>D5tii>nDKJ"Y07jANhOb$R(_$=U7Stjs)-/KZ(6IBm`6<Z:IO1/g<Q6n^@fdK*]SO#g&Wj4B)g1,#O?30",57V_ONl0p`%uQN]'EAZV$475Z"'DApH2)Sg6UQ75XC?4^'<&6&d?YC`OF9F3eE;WIMt@a?'q)c\3oWQ_BD]d`4=O\,'aSUFV4HsE7)O:lPOi6Ht1,[dTm6JqQM6es[?9G4VC(YieF*)uM6[SZT#[TN2,BIir^1;/Ku"E1laH[\"M+F'8=n0!;?_#hHd!hkpV0u\Ij\4VC-km.[F&JhGmbc`6@I1=mf>u<3;i.Bh4+MFJ"H:.XWUQX6%LU(sg4Tt$_":5`p.2,gZkpUfdg,Hd(qR1)9\ltF2^8b5,,XbY%VfhD52O7A.c.u]dhTc5t%0<0L5E38`Bq+i;"%J7kcc#@i)@okdN-qiaA"33DdPgPrUs7;j%+47_cnGN@&ug9/dqGOAHA4f.N*&guHspf?E;GIc-Wt>:<(m1AmcS_Zc2VlEI'_S_>@#!MF^m1$$<mB1`gt\X~>endstream
+endobj
+14 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 987
+>>
+stream
+GatU3gN&c;&:O:SkV;H,eI!J\f?X"LSPIZ'"4Y.F#oAAY?N.Y?8Iu:s)eV;,aNG1Lea>G$!MSc\rU6m7jF'AOI09V1,^TSTi$A+f4sZVQ%2^>uj$40\AI>WbZo9q!NL^CS9P3E9X.:XEMb$a/X"qH9hN6fY,]D!OEOVT,722%RJnVqK4f'[4d3(/hbJWJRs,>>28jk5A:nCl/%FlC#LntsAC5cE$q`QO_@Pk%Lp>7V23")NNrFkcXfuoI=SJJ-`g)_+K\@,SQ@8ORGg(_(B.[u[WXD%Q8@I";9d(]M62K_)Q+-<\kHY5,)o99%BB2bcQVkd:+MZVH=$Z`S@BhH]-XfPANk@qBN.:Jc'?.Kn\p7(aPI<Cb@g:XRZ9Km+RD-e6S\N*kQMA?P5>QOI(du7U]WDrNNPW%d"8P_j^Y8d%G<t1\CJ_5-m+>,'JJLXrV.UD!ah19&9b#*fgR2o730<9)QX)X0"EK6u;mBJs3/fl\d&K$B3bXI5R>F*E,^\%+b?0o8s$o.CuX4uDAT_?G0(p4N3La,8qfi'j?e`e88KrZ8*NDgc:62'icCb],4B]Z"SO&e/BRC*C$2PmbSKAjc\$FLD8?&qHVH3G4p834/77n[%()-p/JDRBapcO2b\,3dW%#U9u!ilSkd%2'rr&g[u".1O]W%0J<@#(ptUD;%0:^.^ls:.#.V6NgR[`2\RUW!k$-*GZIf3DO<K8np=hCA>BiB_Mu"=LVGlO\1Z]0pF(@UaiVQ=dh?h5kfQ_gj>$jHW$8TCt:C.jVU98ne.XoiMtoV;q8XhnlOE;3a]=dGJ8KL&+Khj"&P4Q=P-:nHsDprY"B4+#A3dF,<W=NC>;b&gf(sT\Ts*iH)f!KhfHV;\mMSHej.9.XrBG41_<:b)MG;-Y(:&nCKS0F]r&CGl>EfMc0td\0GHScl3Lr;?OUoo6619Qdr)S8S);]7L5rmWW&(5t4Dil"USDhhY/Y=!=!X:85**$:~>endstream
+endobj
+15 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 976
+>>
+stream
+GatU3gN&c;'R]XVkgAc"70atdYFXp#3h7VV#7/=-%N$"G?N.YO&iX#cVsS_l_5i8)eum:1-)(7`mXJ7LnhqY0hGZal,We=q^e"$M]Lu;_=4AoIN$QOjOF.@i*Sg!_rLL=-'?kk;m;M&R`$D>'HCL7<qMHOgP.\NgCm:Zf5tLAgarh6YCKLONS%?!`3T6F7YKNJ(dBFh(U1"e7D6YdC:71/`?cjR"QrKtsGg*:'=Ck>]$A,-S`H1I/1T]4\B3=gQ9:I4j9f]+af*Z7*GH5H+;j73Z-T#DAcgpO<SFuA['l7@MF*6c^<pB]o84rG$&I@Cs3`KIG,N/bG0f<k/M@gUKb"%\W-lZ#AU+i=gUKkm46K-b>W(/'b?XF9+X+'-Dqi"+1U7?6=ZRJNBSJ6ojDTa+]o4RF^26C+i0s(9G2o;$@RNbs\(f75],L(SVpI0M!'7JVhZ"$t/%kb1+)F\p54/@jpVJF2+)7^F=gVcp8(h*m%F#'p9c%9Ep9?b7g^F5>(>I3t^d_"f'aue%^E\X4kN:g\P[;sC=g3h,nD/n9*`94uoM?sBCL<kr$AOqh:,Y&c90,npSDXN*bEfY(k^0LZ_\I@Y+L2nn64-qsuX5D'=o'B2"8rCsRJ?h/-4Ur6khb;ph%X"8-mXTUU5-!Uh$iVuRi1.=>4;XilfMPT4]&FC.U%DI(c6uf3*XPJP2MRdq@Ag3uYF().nqLFAE2Nih'(^p\5FnSNa>n+cI?U65A61_N1<9ZXH4Xr)Fgq(6md3H9[MQ3Q^%aq>E?XM:O:RKGjc+QV2MB!.I.17QpSt]X[C*6ap.`#'o;8F(ebZ.VMM6k`BkZB\I,2MNoX]J"k]Qd";,@($aWX&29q"6k;>Let)@]QHm:i/lf[DB_&U@ROq-0MLQp;@j+]?$"E)brXVun52AVQo$"[a7@!?!LT*>$&:5X_.R;9)'$l-S.>WjLQIVTo.JU%(H\,-*pl_kP9~>endstream
+endobj
+16 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 1024
+>>
+stream
+GauHKflEQ9'Rf^WgrHc4<#\/Qm7c-rFIIq+TFSD%Z#L'6o(Nl&^_!k0ds=.%-s&pt#i0QBKE91*<^/MJJCcfoHA_e;aL?\&_BAj]Dt;HW$6(8Ql\%O7-5%uT8<qrc9!'@hZ!'`C3a&iu\ZDZi+5lF*E@>0ZIL#\l)(+[ABOTNKmq!2F,S:.F93Z6QIu[nf\Q[qCE`Y-=.8k$67iCR!7=El+50a@f&b^6'Yg'mqlcRQ-5j:%[K@'5!A_m0L)&VlW1T50^X)"3Ma3,U1P8Di$>uPZ)Zj_igBc0lm]WE0#e>*M53(Yh6\9jHYh6B+3bM\b[Q9j'O_9:!:W0<K\bX;'ZV[%iHrL=:rH.Wh5O-II8-Rh3..Sd^\dNItUUd<nli^`$=A@?\WW4/7Wnp>$Ijm,#(bKn_D?UYMGJ7LLqC0\[$l<8U*O5^GnN;!N6YB'?d[d8DAPt^>+E:r0<2$'VL/TtuNg;C@5iM#%KdS-GU->0]`/20eLXVW#qnjsU.P:Xj&=enVE[mpqDCn2!qDRuQhI/#cZ-#m6`U9'SI4"9\<WSWoVPaf@]<NRl?FrTPOd:V_=>"r:4p.\W>IK_$#C,EkU#uO1g6*HoUK':XiJjtQfI'Sdc)B3J1eqgGJ+l?"$<J+^?VHgiq^90uD"@6ar+/_WhKG+8t!Slo>//&C$^f'TA!2:K!0pd;^Zif)c[:f!C/8hNKc7+'+1WbOFKr9T7c_G$s*O634O2Zs:"iN>j,pWU+:kEQ>5YbF=$27*59iJE<glrr=EAMssR&N"lVT1:*a,OcI=8\"6/>A//7(KsL\pUG.G[+JB-r8t;Sih+(W.A'8Q*LZK*I9WjCLjEt>lT%2RFJZg0Ps:5c,HdK#tSNI:#Rp!]O$Ic=T%K0[._E_Fcjn>OcM,iSAf9iF7,,+Qe:@o'Y4o_:54t*l+TAg<i_F?ke9:\G<n<b*t@"_`_;08ft@[9;qtKC#H0Z6cJ+d)MdidY-OFV1K"=!=K=^?hK-Q.s+?\[I98%IXRiAI.!:AVTf`~>endstream
+endobj
+17 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 1075
+>>
+stream
+GauHKgN&c;&:O:SkV;H,6&Q<FCM0)BVUK5trr=4p-3<-<P.#jI+b[BoQ`]$,GaorC,Bfp>Z[5)3-pL]0bpl':D91fR,o"F49.1/bfmFt32ljt6eO[j7!K]\nZ:^QQASu[l@3no(6*HL'@3I!Qfi7%,.N\.>A91O)D\n5*o@JWSOI@ng5p/"_I`g*Y$j0+5PWaso'25ltcglFd,QIaO'dPO0Yr\h5/,=m\PiP:P+Gg0&N;_5iLN$]BD.#VL+h,tSe\fL&,;+2fg&%\pAJiV#eVhq@ro%%/`[(&8n29YiYd>bDF^Bg[AVf/n>[FE(au"ZAe&>%Q[7/n3-QhsPXuPbp#<$d"UR8u-nBnr!Q$Wjd1;9WN/,KG8])Ca5rrDrI'Ue'*I0C%pn+f`Hd"4sB_&2*)S$pX=F/6"DC"TU`bMtd/m7u]?]=J5L[SNBuE:6Ri,NmW7.*qUp)97Tt+a84b\os`Ti8/uRD<mg2;n&q)23L#\f:[QJk+sYYhIC_O\TNS/;3<qfN@GE^L#jl^i&)"7_/%Cb;-M;;ooT&`R;C&\WTZ4"\YIcTZDa;0CKTX+?@ra\94$H:Q<l)r*NHFJWjMr7[tCBb^PX,G]H!fs0g3,5^'AZ%<4Zqp(JCd+;^lkoDJ%q(Bb84V=:PCgOtM#Rr-=oHW&DmO?/!mYrV;g]MR?14cGuH_H*]73!34(()[A.)c<V3:@I>lhrl*Xrn(a0\,%4%*k^rL\k3%6ako`&A3MoN^CXV77D!Qg<S_OEMIh5(T*nFt'&4]_38'Q<s*V7!;A%5-@W.E/(oCu;?^7kb[#R/-P*GF@KHDm6E*dLMg/4Q$W(<Ta[fVpGB5td>%=j9Ge+0B@dZDHELb2fDU(,iiXXRl^*U,U#Fld!R72UIpK<KU`cn&R/_eYS//1PE/$d7p:t-BP62fL<3/QQ4%=NoD?Tlf:A,GpJc<]*uYaL6fSAqm"-E.#%h]idd9$6\DZKKp8Vd[>GWu#-DXi653a?U$fqCs18gt(5/#U%!u,gkMK;>OT_/='S:kn,iD@u]<8-rlTRu'+\7L$U7-#!5-5\WQn(n:q@-p24u!~>endstream
+endobj
+18 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 590
+>>
+stream
+GasbXgMWc?&;KY!MRgt!"n`^Bf\9$c*`Q-Sb6tfd8P(q-dT1eng=QV-!OG*\kiWo2AGBdKLqI^%h,XNB)-gDk+GFVBa?g*a%:!J\97Vc8-jH8>8P>0S@Wr)o*"Hu<6qPp`EF:M3'l4@S\c2]`&[J%dO@5p$<(([H6:SlB;FS8L`&pO%6Y\V"/O7F]E%L@d.%>L@"4bK_XXs&";n_.W^Nr847HH,X@$.pC"4bYC?9RH,dN?h8<BTH9l89:QMq:es\ePUpFRc4?hV'h3b4`sE_b4r->a+8/!?Q=D\F41Nc@'B`';4XgMeh!;U23C+>AbMQD-o--lJ/":m#(Yt,X5(`1KL,GTMBLlr6=-1mi#k.-Ou\\T4$Pun2dEU(\?$&;1@T4dm^t!KuOD-U@N_AMr"&uVpsGm,+8I7B*f!%9.o4cC1<Nr^$d5!dH-#UIr,n6Z;JUFYWCTVA\,or>a[CZ12(hd>1*0bU`k2-MXo1[Gor#kmXGIM'#R49X#NSAOpdf'0ilUH4:M(^Snc3;m/+><UlJ1jSN&ZuoQ68F8`c/Y-e0[!aljuioC5fR7-VUAX`%g<0P5J7"CFlQJT1~>endstream
+endobj
+xref
+0 19
+0000000000 65535 f 
+0000000061 00000 n 
+0000000102 00000 n 
+0000000209 00000 n 
+0000000321 00000 n 
+0000000516 00000 n 
+0000000711 00000 n 
+0000000906 00000 n 
+0000001101 00000 n 
+0000001296 00000 n 
+0000001491 00000 n 
+0000001561 00000 n 
+0000001842 00000 n 
+0000001932 00000 n 
+0000003031 00000 n 
+0000004109 00000 n 
+0000005176 00000 n 
+0000006292 00000 n 
+0000007459 00000 n 
+trailer
+<<
+/ID 
+[<ba877f458edd6b06b69a7e843c67586d><ba877f458edd6b06b69a7e843c67586d>]
+% ReportLab generated PDF document -- digest (opensource)
+
+/Info 11 0 R
+/Root 10 0 R
+/Size 19
+>>
+startxref
+8140
+%%EOF

app/common/src/test/resources/pdf-ingestion-fixtures/multi-column-test_lorem.md

@@ -0,0 +1,25 @@
+# Lorem Ipsum in Two Columns
+
+## 1. Origins
+
+Lorem ipsum dolor sit amet consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.
+
+## 2. Structure
+
+Ut enim ad minim veniam quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.
+
+## 3. Usage
+
+Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.
+
+## 4. Variations
+
+Excepteur sint occaecat cupidatat non proident sunt in culpa qui officia deserunt mollit anim id est laborum.
+
+## 5. Typography
+
+Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam various turpis et commodo pharetra est.
+
+## 6. Conclusion
+
+Nunc nonummy metus. Vestibulum volutpat pretium libero. Cras id dui. Aenean ut eros et nisl sagittis vestibulum.

app/common/src/test/resources/pdf-ingestion-fixtures/multi-column-test_lorem.pdf

@@ -0,0 +1,74 @@
+%PDF-1.4
+%“Œ‹ž ReportLab Generated PDF document (opensource)
+1 0 obj
+<<
+/F1 2 0 R /F2 3 0 R
+>>
+endobj
+2 0 obj
+<<
+/BaseFont /Helvetica /Encoding /WinAnsiEncoding /Name /F1 /Subtype /Type1 /Type /Font
+>>
+endobj
+3 0 obj
+<<
+/BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding /Name /F2 /Subtype /Type1 /Type /Font
+>>
+endobj
+4 0 obj
+<<
+/Contents 8 0 R /MediaBox [ 0 0 612 792 ] /Parent 7 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+5 0 obj
+<<
+/PageMode /UseNone /Pages 7 0 R /Type /Catalog
+>>
+endobj
+6 0 obj
+<<
+/Author (\(anonymous\)) /CreationDate (D:20260603021636+01'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260603021636+01'00') /Producer (ReportLab PDF Library - \(opensource\)) 
+  /Subject (\(unspecified\)) /Title (\(anonymous\)) /Trapped /False
+>>
+endobj
+7 0 obj
+<<
+/Count 1 /Kids [ 4 0 R ] /Type /Pages
+>>
+endobj
+8 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 861
+>>
+stream
+Gat=i>Ak00&;B$5/*8Q/Z)fmNp(^2^OK'MC[dT6#Oq.&b^4c4;1No6>+D%TC.n+fice+l9R0[L%'(o<DJBpB+r$jsRcu23$RjI].E7rS*BB"3t\qRKaS-SYt[_<-]),Cp@'$i;6dQuJ#Q*+lGY?X<phgEWPa?op]_1g@kf_>sQ?dQP@AUa.A:T=#%ZIIl18hB7Zf<piVi-V+;]ct^jS<=Z4l:IOd[,o"%q.hK[[k]r1!^oX'%44os7T9[m%YrbZ3KU/;aR0$cV$;D._".OT8)jeEBKU'l<A`'aD&R'L"Bo]Q)R+=cKOEld8s#M0ZYZN4[lRm1*F6^d9-Gfl5>I(hVU+?`]UK%;aabAH:q>9NUGQq^.=u])Wt-ETI))C'a[FE@elj!RSrf2Q'F>URAO.C,!DneTPqrj#4e2kb9%1"4qfZ)"#&^0j9nHQ?9nF!j7mVPP5\*Uq'_jMVS]9%`kQB\8*AF_bpr/hGj;HCUOSQU-%5:6S79Ud\b!*tPbr_'pCr$Ea#(FYP31NFhSX.-("1M:$cgH#hX8L(2]R3Q>'BYHCS%pI!;=WdJp,'ii[`QPZ_9mcd\baZ2U(_;c\-p,8EoIEpQ*lstL>]LE;C#\dLnT2R:)BM-fTc['3_He[U,k'!Bo".uERd>SkhRj^J+koSIrZ_dEf_5L'/1h.`+DTK(R:P,WH)h5\se=SZ"L/5b8b..,e/E\o+4YQ+*im^C>AERG/TieEK\)#>U@HXnJ,H0A9-MqhhkDp8%.6Lr,OrK*lih;B<-opZ8%EU?,$r^jmCDAQ`-0/-8/`[p]7Fm%0f:E&S*FV)DX2>#q\bRqA=^_`43#8EA$u%8r6F5`rc9>K@q>E4q^*~>endstream
+endobj
+xref
+0 9
+0000000000 65535 f 
+0000000061 00000 n 
+0000000102 00000 n 
+0000000209 00000 n 
+0000000321 00000 n 
+0000000514 00000 n 
+0000000582 00000 n 
+0000000862 00000 n 
+0000000921 00000 n 
+trailer
+<<
+/ID 
+[<21a9fbd0a0991a91b6e6e2db0856056e><21a9fbd0a0991a91b6e6e2db0856056e>]
+% ReportLab generated PDF document -- digest (opensource)
+
+/Info 6 0 R
+/Root 5 0 R
+/Size 9
+>>
+startxref
+1872
+%%EOF

app/common/src/test/resources/pdf-ingestion-fixtures/wrapped-cell-test_expense-report.md

@@ -0,0 +1,62 @@
+# Employee Expense Report
+
+Reimbursement Request
+
+EMP-1047
+
+**Report Header**
+
+| Employee Name | Michael Tran |
+|---|---|
+| Employee ID | EMP-1047 |
+| Department | Client Services |
+| Report Date | January 20th, 2026 |
+| Reporting Period | January 5th–16th, 2026 |
+| Manager Approver | Laura Simmons |
+
+**Company Information**
+
+| Company | Summit Consulting Partners |
+|---|---|
+| Company Address | 88 Riverside Plaza, Suite 1400, New York, NY 10069 |
+| Accounting Department Email | expenses@example.com |
+
+**Trip Purpose**
+
+The trip was undertaken for client onsite meetings with Atlantic Energy Solutions in Boston, MA.
+
+**Expense Details**
+
+| Description | Amount | Date | Category |
+|---|---|---|---|
+| Flight (NYC to Boston roundtrip) | $325.40 | January 5th, 2026 | Airline ticket |
+| Hotel (3 nights at Harborview Hotel) | $822.75 | January 5th–8th, 2026 | Lodging |
+| Taxi from airport to hotel | $48.00 | January 5th, 2026 | Ground transportation |
+| Client dinner (3 attendees) | $186.20 | January 6th, 2026 | Meals |
+| Parking at JFK Airport | $72.00 | January 5th–8th, 2026 | Parking |
+| Breakfast (per diem not used) | $18.50 | January 7th, 2026 | Meals |
+
+| Description | Amount | Date | Category |
+|---|---|---|---|
+| Uber to client office | $22.10 | January 7th, 2026 | Ground transportation |
+| Printing + presentation materials | $46.90 | January 8th, 2026 | Materials |
+| Lunch with client | $39.75 | January 8th, 2026 | Meals |
+| Office supplies (notebooks, pens) | $27.60 | January 10th, 2026 | Supplies |
+| Mileage reimbursement (client visit in NJ, 42 miles @ $0.67/mile) | $28.14 | January 14th, 2026 | Mileage |
+| Team lunch meeting (internal) | $64.30 | January 15th, 2026 | Meals |
+
+Total Expenses $1,701.64
+
+Reimbursement Method
+
+Reimbursement method Direct deposit
+
+Notes
+
+All receipts are attached. Expenses are business-related and comply with company travel policy.
+
+**Approval**
+
+Michael Tran, Employee
+
+Laura Simmons, Manager

app/core/build.gradle

@@ -207,13 +207,29 @@ def resourcesStaticDir = file('src/main/resources/static')
 def generatedFrontendPaths = [
     'assets',
     'index.html',
+    'index.html.gz',
+    'index.html.br',
+    'sw.js',
+    'sw.js.gz',
+    'sw.js.br',
+    'manifest.json.gz',
+    'manifest.json.br',
+    'site.webmanifest.gz',
+    'site.webmanifest.br',
+    'browserconfig.xml.gz',
+    'browserconfig.xml.br',
+    'manifest-classic.json',
+    'manifest-classic.json.gz',
+    'manifest-classic.json.br',
     'locales',
     'Login',
     'classic-logo',
     'modern-logo',
     'og_images',
     'samples',
-    'manifest-classic.json'
+    'pdfium',
+    'vendor',
+    'pdfjs'
 ]
 
 tasks.register('npmInstall', Exec) {

app/core/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java

@@ -18,6 +18,7 @@ import io.swagger.v3.oas.models.media.StringSchema;
 import io.swagger.v3.oas.models.security.SecurityRequirement;
 import io.swagger.v3.oas.models.security.SecurityScheme;
 import io.swagger.v3.oas.models.servers.Server;
+import io.swagger.v3.oas.models.tags.Tag;
 
 import lombok.RequiredArgsConstructor;
 
@@ -60,6 +61,15 @@ public class OpenApiConfig {
 
         OpenAPI openAPI = new OpenAPI().info(info).openapi("3.0.3");
 
+        // Register a single global "AI" tag so every AI endpoint groups under it in the docs.
+        // The AI controllers are currently @Hidden, so they don't emit this tag themselves yet;
+        // defining it here keeps the grouping ready for when those endpoints are unhidden.
+        openAPI.addTagsItem(
+                new Tag()
+                        .name("AI")
+                        .description(
+                                "AI-powered document creation, editing, and assistant endpoints."));
+
         // Add server configuration from environment variable
         String swaggerServerUrl = System.getenv("SWAGGER_SERVER_URL");
         Server server;

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -13,6 +13,7 @@ import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.web.servlet.resource.EncodedResourceResolver;
 
 import lombok.RequiredArgsConstructor;
 
@@ -49,14 +50,16 @@ public class WebMvcConfig implements WebMvcConfigurer {
                         "/sw.js", "/manifest.json", "/site.webmanifest", "/browserconfig.xml")
                 .addResourceLocations(staticPath, "classpath:/static/")
                 .setCacheControl(CacheControl.noStore())
-                .resourceChain(true);
+                .resourceChain(true)
+                .addResolver(new EncodedResourceResolver());
 
         // 2. Vite fingerprinted assets (immutable)
         // These already have content hashes in filenames (e.g. index-ChAS4tCC.js)
         registry.addResourceHandler("/assets/**")
                 .addResourceLocations(staticPath + "assets/", "classpath:/static/assets/")
                 .setCacheControl(IMMUTABLE_ONE_YEAR)
-                .resourceChain(true);
+                .resourceChain(true)
+                .addResolver(new EncodedResourceResolver());
 
         // 3. Media and fonts (immutable)
         registry.addResourceHandler("/images/**", "/fonts/**")
@@ -66,7 +69,8 @@ public class WebMvcConfig implements WebMvcConfigurer {
                         staticPath + "fonts/",
                         "classpath:/static/fonts/")
                 .setCacheControl(IMMUTABLE_ONE_YEAR)
-                .resourceChain(true);
+                .resourceChain(true)
+                .addResolver(new EncodedResourceResolver());
 
         // 4. Branding and stable non-fingerprinted assets (1 day + SWR)
         // Use stale-while-revalidate to improve perceived performance.
@@ -114,19 +118,27 @@ public class WebMvcConfig implements WebMvcConfigurer {
                         staticPath + "og_images/",
                         "classpath:/static/og_images/",
                         staticPath + "Login/",
-                        "classpath:/static/Login/")
+                        "classpath:/static/Login/",
+                        staticPath + "icons/",
+                        "classpath:/static/icons/",
+                        staticPath + "modern-logo/",
+                        "classpath:/static/modern-logo/",
+                        staticPath + "classic-logo/",
+                        "classpath:/static/classic-logo/")
                 .setCacheControl(
                         CacheControl.maxAge(Duration.ofDays(1))
                                 .cachePublic()
                                 .staleWhileRevalidate(Duration.ofDays(7)))
-                .resourceChain(true);
+                .resourceChain(true)
+                .addResolver(new EncodedResourceResolver());
 
         // 5. Catch-all (SPA fallback)
         // Must check with server to ensure index.html is always fresh.
         registry.addResourceHandler("/**")
                 .addResourceLocations(staticPath, "classpath:/static/")
                 .setCacheControl(NO_CACHE)
-                .resourceChain(true);
+                .resourceChain(true)
+                .addResolver(new EncodedResourceResolver());
     }
 
     @Override

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTextController.java

@@ -39,7 +39,9 @@ import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
-import stirling.software.common.util.propertyeditor.StringToArrayListPropertyEditor;
+import stirling.software.common.util.propertyeditor.JsonListPropertyEditor;
+
+import tools.jackson.core.type.TypeReference;
 
 /**
  * Find/replace text editing for PDFs. Round-trips through {@link PdfJsonConversionService}: the
@@ -73,7 +75,7 @@ public class EditTextController {
         binder.registerCustomEditor(
                 List.class,
                 "edits",
-                new StringToArrayListPropertyEditor<>(EditTextOperation.class));
+                new JsonListPropertyEditor<>(new TypeReference<List<EditTextOperation>>() {}));
     }
 
     @AutoJobPostMapping(

app/core/src/main/java/stirling/software/SPDF/controller/api/PdfOverlayController.java

@@ -10,6 +10,7 @@ import java.util.Map;
 
 import org.apache.pdfbox.Loader;
 import org.apache.pdfbox.multipdf.Overlay;
+import org.apache.pdfbox.pdfwriter.compress.CompressParameters;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
@@ -157,7 +158,10 @@ public class PdfOverlayController {
                     PDDocument singlePageDocument = new PDDocument()) {
                 singlePageDocument.addPage(overlayPdf.getPage(pageCountInCurrentOverlay));
                 File tempFile = Files.createTempFile("overlay-page-", ".pdf").toFile();
-                singlePageDocument.save(tempFile);
+                // NO_COMPRESSION: this single-page doc holds a page copied from overlayPdf.
+                // PDFBox 3.0.7's compressed writer (PDFBOX-6203) drops shared resources imported
+                // across documents, corrupting overlay fonts. Revert once on 3.0.8.
+                singlePageDocument.save(tempFile, CompressParameters.NO_COMPRESSION);
 
                 overlayGuide.put(basePageIndex, tempFile.getAbsolutePath());
                 tempFiles.add(tempFile); // Keep track of the temporary file for cleanup

app/core/src/main/java/stirling/software/SPDF/controller/api/RearrangePagesPDFController.java

@@ -6,11 +6,9 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Locale;
 
-import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
 import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
+import org.apache.pdfbox.pdmodel.PDPageTree;
 import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -262,38 +260,31 @@ public class RearrangePagesPDFController {
                 }
                 log.info("newPageOrder = {}", newPageOrder);
                 log.info("totalPages = {}", totalPages);
-                // Create a new list to hold the pages in the new order
-                List<PDPage> newPages = new ArrayList<>();
-                for (int i = 0; i < newPageOrder.size(); i++) {
-                    newPages.add(document.getPage(newPageOrder.get(i)));
+
+                // Snapshot the desired pages before mutating the source document's page tree.
+                List<PDPage> newPages = new ArrayList<>(newPageOrder.size());
+                for (Integer idx : newPageOrder) {
+                    newPages.add(document.getPage(idx));
                 }
 
-                // Create a new document based on the original one
-                try (PDDocument rearrangedDocument =
-                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document)) {
-
-                    // Add the pages in the new order
-                    for (PDPage page : newPages) {
-                        rearrangedDocument.addPage(page);
-                    }
-
-                    PDDocumentCatalog sourceCatalog = document.getDocumentCatalog();
-                    if (sourceCatalog != null) {
-                        PDAcroForm sourceForm = sourceCatalog.getAcroForm(null);
-                        if (sourceForm != null) {
-                            rearrangedDocument
-                                    .getDocumentCatalog()
-                                    .getCOSObject()
-                                    .setItem(COSName.ACRO_FORM, sourceForm.getCOSObject());
-                        }
-                    }
-
-                    return WebResponseUtils.pdfDocToWebResponse(
-                            rearrangedDocument,
-                            GeneralUtils.generateFilename(
-                                    pdfFile.getOriginalFilename(), "_rearranged.pdf"),
-                            tempFileManager);
+                // Rearrange in-place on the source document rather than copying pages into a
+                // freshly-created PDDocument. Copying pages across documents triggers a PDFBox
+                // 3.0.7 compressed-save regression (PDFBOX-6203, fixed for 3.0.8) where shared
+                // resource objects (fonts, etc.) imported from the source can be silently
+                // dropped from the output, producing pages with "font not found" errors.
+                PDPageTree pages = document.getPages();
+                for (int i = totalPages - 1; i >= 0; i--) {
+                    pages.remove(i);
                 }
+                for (PDPage page : newPages) {
+                    pages.add(page);
+                }
+
+                return WebResponseUtils.pdfDocToWebResponse(
+                        document,
+                        GeneralUtils.generateFilename(
+                                pdfFile.getOriginalFilename(), "_rearranged.pdf"),
+                        tempFileManager);
             }
         } catch (IOException e) {
             ExceptionUtils.logException("document rearrangement", e);

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertOfficeController.java

@@ -35,6 +35,7 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.CustomHtmlSanitizer;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.OfficeDocumentSanitizer;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 import stirling.software.common.util.RegexPatternUtils;
@@ -50,6 +51,7 @@ public class ConvertOfficeController {
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final RuntimePathConfig runtimePathConfig;
     private final CustomHtmlSanitizer customHtmlSanitizer;
+    private final OfficeDocumentSanitizer officeDocumentSanitizer;
     private final EndpointConfiguration endpointConfiguration;
     private final TempFileManager tempFileManager;
 
@@ -83,14 +85,16 @@ public class ConvertOfficeController {
         Path inputPath = workDir.resolve(baseName + "." + extensionLower);
         Path outputPath = workDir.resolve(baseName + ".pdf");
 
-        // Check if the file is HTML and apply sanitization if needed
+        // Sanitize input before LibreOffice sees it so embedded URLs can't trigger SSRF.
         if ("html".equals(extensionLower) || "htm".equals(extensionLower)) {
-            // Read and sanitize HTML content
             String htmlContent = new String(inputFile.getBytes(), StandardCharsets.UTF_8);
             String sanitizedHtml = customHtmlSanitizer.sanitize(htmlContent);
             Files.writeString(inputPath, sanitizedHtml, StandardCharsets.UTF_8);
+        } else if (officeDocumentSanitizer.isSanitizableExtension(extensionLower)) {
+            byte[] sanitized =
+                    officeDocumentSanitizer.sanitize(inputFile.getBytes(), extensionLower);
+            Files.write(inputPath, sanitized);
         } else {
-            // copy file content
             Files.copy(inputFile.getInputStream(), inputPath, StandardCopyOption.REPLACE_EXISTING);
         }
 

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/AutoSplitPdfController.java

@@ -14,6 +14,7 @@ import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
 import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdfwriter.compress.CompressParameters;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
@@ -357,7 +358,10 @@ public class AutoSplitPdfController {
                 for (int i = 0; i < splitDocuments.size(); i++) {
                     String fileName = filename + "_" + (i + 1) + ".pdf";
                     zipOut.putNextEntry(new ZipEntry(fileName));
-                    splitDocuments.get(i).save(zipOut);
+                    // NO_COMPRESSION: split docs are built by addPage()-ing pages copied from the
+                    // source document. PDFBox 3.0.7's compressed writer (PDFBOX-6203) drops shared
+                    // resources imported across documents, corrupting fonts. Revert once on 3.0.8.
+                    splitDocuments.get(i).save(zipOut, CompressParameters.NO_COMPRESSION);
                     zipOut.closeEntry();
                 }
             }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/OCRController.java

@@ -17,6 +17,7 @@ import javax.imageio.ImageIO;
 
 import org.apache.pdfbox.io.IOUtils;
 import org.apache.pdfbox.multipdf.PDFMergerUtility;
+import org.apache.pdfbox.pdfwriter.compress.CompressParameters;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.rendering.PDFRenderer;
@@ -427,7 +428,10 @@ public class OCRController {
                             // Save original page without OCR as fallback
                             try (PDDocument pageDoc = new PDDocument()) {
                                 pageDoc.addPage(page);
-                                pageDoc.save(pageOutputPath);
+                                // NO_COMPRESSION: page is copied from another document;
+                                // PDFBox 3.0.7 compressed writer (PDFBOX-6203) drops shared
+                                // resources, corrupting fonts. Revert once on 3.0.8.
+                                pageDoc.save(pageOutputPath, CompressParameters.NO_COMPRESSION);
                             }
                         }
 
@@ -437,7 +441,10 @@ public class OCRController {
                         // Save original page without OCR
                         try (PDDocument pageDoc = new PDDocument()) {
                             pageDoc.addPage(page);
-                            pageDoc.save(pageOutputPath);
+                            // NO_COMPRESSION: page is copied from another document; PDFBox 3.0.7
+                            // compressed writer (PDFBOX-6203) drops shared resources, corrupting
+                            // fonts on retained text pages. Revert once on 3.0.8.
+                            pageDoc.save(pageOutputPath, CompressParameters.NO_COMPRESSION);
                             merger.addSource(pageOutputPath);
                         }
                     }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/OverlayImageController.java

@@ -25,6 +25,7 @@ import stirling.software.common.annotations.api.MiscApi;
 import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.SvgSanitizer;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
@@ -36,6 +37,7 @@ public class OverlayImageController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final TempFileManager tempFileManager;
+    private final SvgSanitizer svgSanitizer;
 
     @AutoJobPostMapping(
             consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
@@ -61,6 +63,9 @@ public class OverlayImageController {
             byte[] imageBytes = imageFile.getBytes();
 
             boolean isSvg = SvgOverlayUtil.isSvgImage(imageBytes);
+            if (isSvg) {
+                imageBytes = svgSanitizer.sanitize(imageBytes);
+            }
 
             try (PDDocument document = pdfDocumentFactory.load(pdfBytes)) {
                 int pages = document.getNumberOfPages();

app/core/src/main/java/stirling/software/SPDF/controller/api/security/AllTextLineExtractor.java

@@ -0,0 +1,127 @@
+package stirling.software.SPDF.controller.api.security;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.text.PDFTextStripper;
+import org.apache.pdfbox.text.TextPosition;
+
+/**
+ * PDFTextStripper subclass that collects all text positions and groups them into line-level
+ * bounding boxes.
+ *
+ * <p>Two outputs are maintained in parallel:
+ *
+ * <ul>
+ *   <li>{@link #getLineBoxes()} returns {@code [x1, pdfYbottom, x2, pdfYtop]} in PDF user-space
+ *       (origin bottom-left, Y up). This is what existing callers expect.
+ *   <li>{@link #getScreenLineBoxes()} returns {@code [x1, screenYtop, x2, screenYbottom]} computed
+ *       directly from glyph positions without a PDF↔screen round-trip — used by column-aware
+ *       redaction where ulp-level drift in the round-trip caused false rejects against anchors.
+ * </ul>
+ *
+ * <p>Lines are flushed not only on Y jumps but also on large X gaps within the same Y row. That way
+ * left-column glyphs and right-column glyphs that happen to share a baseline (common in IEEE
+ * conference templates) get emitted as two distinct line boxes instead of one wide merged box.
+ */
+final class AllTextLineExtractor extends PDFTextStripper {
+
+    /** Min vertical jump (screen Y) before the next glyph is treated as a new line. */
+    private static final float LINE_Y_TOLERANCE = 3.0f;
+
+    /**
+     * Min horizontal gap (screen X) between consecutive glyphs on the same Y that indicates a
+     * column boundary. Chosen large enough to not split normal inter-word spacing (~6–10pt for 11pt
+     * text) but small enough to catch standard column gutters (typically ≥15pt).
+     */
+    private static final float COLUMN_GAP_X = 14f;
+
+    private final float pageHeight;
+    private final List<float[]> lineBoxes = new ArrayList<>();
+    private final List<float[]> screenLineBoxes = new ArrayList<>();
+
+    private final List<TextPosition> currentLine = new ArrayList<>();
+    private float lastScreenY = Float.NaN;
+    private float lastGlyphRight = Float.NaN;
+
+    AllTextLineExtractor(int pageNumber, float pageHeight) throws IOException {
+        this.pageHeight = pageHeight;
+        setStartPage(pageNumber);
+        setEndPage(pageNumber);
+        setSortByPosition(true);
+    }
+
+    List<float[]> getLineBoxes() {
+        return lineBoxes;
+    }
+
+    /**
+     * Returns line boxes as {@code [x1, screenYtop, x2, screenYbottom]}. {@code screenYtop} is the
+     * minimum {@code TextPosition.getY() - getHeight()} on the line and {@code screenYbottom} is
+     * the maximum {@code getY()} (the line's baseline). These values come straight from PDFBox
+     * without going through {@code pageHeight - …}, so they're stable for ulp-sensitive comparisons
+     * against anchor screen Ys.
+     */
+    List<float[]> getScreenLineBoxes() {
+        return screenLineBoxes;
+    }
+
+    @Override
+    protected void writeString(String text, List<TextPosition> positions) {
+        for (TextPosition tp : positions) {
+            // Skip whitespace-only positions (spaces, newline markers, indent characters).
+            // These have a TextPosition but no visible glyph; including them causes
+            // space-only "lines" to produce degenerate segments that appear as thin
+            // black bars after redaction.
+            String unicode = tp.getUnicode();
+            if (unicode == null || unicode.isBlank()) {
+                continue;
+            }
+            float screenY = tp.getY();
+            float screenX = tp.getX();
+            boolean yJump =
+                    !Float.isNaN(lastScreenY) && Math.abs(screenY - lastScreenY) > LINE_Y_TOLERANCE;
+            boolean xJump =
+                    !Float.isNaN(lastGlyphRight) && (screenX - lastGlyphRight) > COLUMN_GAP_X;
+            if (yJump || xJump) {
+                flushLine();
+            }
+            lastScreenY = screenY;
+            lastGlyphRight = screenX + tp.getWidth();
+            currentLine.add(tp);
+        }
+    }
+
+    @Override
+    protected void endPage(PDPage page) throws IOException {
+        flushLine();
+        super.endPage(page);
+    }
+
+    private void flushLine() {
+        if (currentLine.isEmpty()) {
+            return;
+        }
+        float minX = Float.MAX_VALUE, maxX = -Float.MAX_VALUE;
+        float minScreenY = Float.MAX_VALUE, maxScreenY = -Float.MAX_VALUE;
+        for (TextPosition tp : currentLine) {
+            minX = Math.min(minX, tp.getX());
+            maxX = Math.max(maxX, tp.getX() + tp.getWidth());
+            minScreenY = Math.min(minScreenY, tp.getY() - tp.getHeight());
+            maxScreenY = Math.max(maxScreenY, tp.getY());
+        }
+        emitSegment(minX, maxX, minScreenY, maxScreenY);
+        currentLine.clear();
+        lastScreenY = Float.NaN;
+        lastGlyphRight = Float.NaN;
+    }
+
+    private void emitSegment(float minX, float maxX, float minScreenY, float maxScreenY) {
+        float pdfY1 = pageHeight - maxScreenY; // bottom in PDF coords
+        float pdfY2 = pageHeight - minScreenY; // top in PDF coords
+        lineBoxes.add(new float[] {minX, pdfY1, maxX, pdfY2});
+        screenLineBoxes.add(new float[] {minX, minScreenY, maxX, maxScreenY});
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/security/ManualRedactionService.java

@@ -0,0 +1,403 @@
+package stirling.software.SPDF.controller.api.security;
+
+import java.awt.Color;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDPageContentStream;
+import org.apache.pdfbox.pdmodel.PDPageTree;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.PDFText;
+import stirling.software.SPDF.model.api.security.ManualRedactPdfRequest;
+import stirling.software.SPDF.pdf.parser.PageImageLocator;
+import stirling.software.common.model.api.security.RedactionArea;
+import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.PdfUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+
+@Service
+@Slf4j
+@RequiredArgsConstructor
+class ManualRedactionService {
+
+    private static final float DEFAULT_TEXT_PADDING_MULTIPLIER = 0.6f;
+    private static final float REDACTION_WIDTH_REDUCTION_FACTOR = 0.9f;
+
+    private final TempFileManager tempFileManager;
+
+    // -----------------------------------------------------------------------
+    // Area and page redaction
+    // -----------------------------------------------------------------------
+
+    void redactAreas(List<RedactionArea> redactionAreas, PDDocument document, PDPageTree allPages)
+            throws IOException {
+
+        if (redactionAreas == null || redactionAreas.isEmpty()) {
+            return;
+        }
+
+        Map<Integer, List<RedactionArea>> redactionsByPage = new HashMap<>();
+
+        for (RedactionArea redactionArea : redactionAreas) {
+            if (redactionArea.getPage() == null
+                    || redactionArea.getPage() <= 0
+                    || redactionArea.getHeight() == null
+                    || redactionArea.getHeight() <= 0.0D
+                    || redactionArea.getWidth() == null
+                    || redactionArea.getWidth() <= 0.0D) {
+                continue;
+            }
+
+            redactionsByPage
+                    .computeIfAbsent(redactionArea.getPage(), k -> new ArrayList<>())
+                    .add(redactionArea);
+        }
+
+        for (Map.Entry<Integer, List<RedactionArea>> entry : redactionsByPage.entrySet()) {
+            Integer pageNumber = entry.getKey();
+            List<RedactionArea> areasForPage = entry.getValue();
+
+            if (pageNumber > allPages.getCount()) {
+                continue;
+            }
+
+            PDPage page = allPages.get(pageNumber - 1);
+
+            try (PDPageContentStream contentStream =
+                    new PDPageContentStream(
+                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
+
+                contentStream.saveGraphicsState();
+                for (RedactionArea redactionArea : areasForPage) {
+                    Color redactColor = decodeOrDefault(redactionArea.getColor());
+
+                    contentStream.setNonStrokingColor(redactColor);
+
+                    float x = redactionArea.getX().floatValue();
+                    float y = redactionArea.getY().floatValue();
+                    float width = redactionArea.getWidth().floatValue();
+                    float height = redactionArea.getHeight().floatValue();
+
+                    float pdfY = page.getBBox().getHeight() - y - height;
+
+                    contentStream.addRect(x, pdfY, width, height);
+                    contentStream.fill();
+                }
+                contentStream.restoreGraphicsState();
+            }
+        }
+    }
+
+    void redactPages(ManualRedactPdfRequest request, PDDocument document, PDPageTree allPages)
+            throws IOException {
+
+        Color redactColor = decodeOrDefault(request.getPageRedactionColor());
+        List<Integer> pageNumbers = getPageNumbers(request, allPages.getCount());
+
+        for (Integer pageNumber : pageNumbers) {
+            PDPage page = allPages.get(pageNumber);
+
+            try (PDPageContentStream contentStream =
+                    new PDPageContentStream(
+                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
+                contentStream.setNonStrokingColor(redactColor);
+
+                PDRectangle box = page.getBBox();
+                contentStream.addRect(0, 0, box.getWidth(), box.getHeight());
+                contentStream.fill();
+            }
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Overlay drawing
+    // -----------------------------------------------------------------------
+
+    void redactFoundText(
+            PDDocument document,
+            List<PDFText> blocks,
+            float customPadding,
+            Color redactColor,
+            boolean isTextRemovalMode)
+            throws IOException {
+
+        var allPages = document.getDocumentCatalog().getPages();
+
+        Map<Integer, List<PDFText>> blocksByPage = new HashMap<>();
+        for (PDFText block : blocks) {
+            blocksByPage.computeIfAbsent(block.getPageIndex(), k -> new ArrayList<>()).add(block);
+        }
+
+        for (Map.Entry<Integer, List<PDFText>> entry : blocksByPage.entrySet()) {
+            Integer pageIndex = entry.getKey();
+            List<PDFText> pageBlocks = entry.getValue();
+
+            if (pageIndex >= allPages.getCount()) {
+                continue;
+            }
+
+            var page = allPages.get(pageIndex);
+            try (PDPageContentStream contentStream =
+                    new PDPageContentStream(
+                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
+
+                contentStream.saveGraphicsState();
+
+                try {
+                    contentStream.setNonStrokingColor(redactColor);
+                    PDRectangle pageBox = page.getBBox();
+
+                    for (PDFText block : pageBlocks) {
+                        float padding =
+                                (block.getY2() - block.getY1()) * DEFAULT_TEXT_PADDING_MULTIPLIER
+                                        + customPadding;
+
+                        float originalWidth = block.getX2() - block.getX1();
+                        float boxWidth;
+                        float boxX;
+
+                        if (isTextRemovalMode) {
+                            boxWidth = originalWidth * REDACTION_WIDTH_REDUCTION_FACTOR;
+                            float widthReduction = originalWidth - boxWidth;
+                            boxX = block.getX1() + (widthReduction / 2);
+                        } else {
+                            boxWidth = originalWidth;
+                            boxX = block.getX1();
+                        }
+
+                        contentStream.addRect(
+                                boxX,
+                                pageBox.getHeight() - block.getY2() - padding,
+                                boxWidth,
+                                block.getY2() - block.getY1() + 2 * padding);
+                    }
+
+                    contentStream.fill();
+
+                } finally {
+                    contentStream.restoreGraphicsState();
+                }
+            }
+
+            // Remove annotations whose bounding rect overlaps a redacted block, to prevent
+            // users from hovering over redacted URLs and seeing the underlying destination.
+            try {
+                float pageH = page.getBBox().getHeight();
+                List<PDAnnotation> kept = new ArrayList<>();
+                for (PDAnnotation ann : page.getAnnotations()) {
+                    PDRectangle ar = ann.getRectangle();
+                    boolean overlaps = false;
+                    if (ar != null) {
+                        for (PDFText block : pageBlocks) {
+                            float padding =
+                                    (block.getY2() - block.getY1())
+                                                    * DEFAULT_TEXT_PADDING_MULTIPLIER
+                                            + customPadding;
+                            float bx1 = block.getX1();
+                            float bx2 = block.getX2();
+                            float by1 = pageH - block.getY2() - padding;
+                            float by2 = pageH - block.getY1() + padding;
+                            if (ar.getLowerLeftX() < bx2
+                                    && ar.getUpperRightX() > bx1
+                                    && ar.getLowerLeftY() < by2
+                                    && ar.getUpperRightY() > by1) {
+                                overlaps = true;
+                                break;
+                            }
+                        }
+                    }
+                    if (!overlaps) {
+                        kept.add(ann);
+                    }
+                }
+                page.setAnnotations(kept);
+            } catch (Exception e) {
+                log.debug(
+                        "[redact] could not remove annotations on page {}: {}",
+                        pageIndex,
+                        e.getMessage());
+            }
+        }
+    }
+
+    void redactImageBoxes(PDDocument document, List<float[]> imageBoxes, Color color)
+            throws IOException {
+        Map<Integer, List<float[]>> byPage = new HashMap<>();
+        for (float[] box : imageBoxes) {
+            byPage.computeIfAbsent((int) box[0], k -> new ArrayList<>()).add(box);
+        }
+        PDPageTree pages = document.getDocumentCatalog().getPages();
+        for (Map.Entry<Integer, List<float[]>> entry : byPage.entrySet()) {
+            int pageIdx = entry.getKey();
+            if (pageIdx < 0 || pageIdx >= pages.getCount()) {
+                log.warn("[redact/execute] image box references out-of-range page {}", pageIdx);
+                continue;
+            }
+            PDPage page = pages.get(pageIdx);
+            try (PDPageContentStream cs =
+                    new PDPageContentStream(
+                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
+                cs.saveGraphicsState();
+                cs.setNonStrokingColor(color);
+                for (float[] box : entry.getValue()) {
+                    float x1 = box[1], y1 = box[2], x2 = box[3], y2 = box[4];
+                    cs.addRect(x1, y1, x2 - x1, y2 - y1);
+                }
+                cs.fill();
+                cs.restoreGraphicsState();
+            }
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Page element extraction
+    // -----------------------------------------------------------------------
+
+    /**
+     * Returns bounding boxes for every text line and image on {@code page} in PDF user-space
+     * coordinates: {@code [x1, y1, x2, y2]} (origin bottom-left, Y increases upward).
+     */
+    List<float[]> extractPageElementBoxes(PDDocument document, PDPage page, int pageIndex)
+            throws IOException {
+        List<float[]> boxes = new ArrayList<>();
+
+        AllTextLineExtractor textExtractor =
+                new AllTextLineExtractor(pageIndex + 1, page.getBBox().getHeight());
+        textExtractor.getText(document);
+        boxes.addAll(textExtractor.getLineBoxes());
+
+        PageImageLocator imgLocator = new PageImageLocator(page, pageIndex);
+        imgLocator.processPage(page);
+        for (PageImageLocator.ImageBox imgBox : imgLocator.getImageBoxes()) {
+            boxes.add(new float[] {imgBox.x1(), imgBox.y1(), imgBox.x2(), imgBox.y2()});
+        }
+
+        return boxes;
+    }
+
+    // -----------------------------------------------------------------------
+    // Finalization
+    // -----------------------------------------------------------------------
+
+    TempFile finalizeRedaction(
+            PDDocument document,
+            Map<Integer, List<PDFText>> allFoundTextsByPage,
+            String colorString,
+            float customPadding,
+            Boolean convertToImage,
+            boolean isTextRemovalMode)
+            throws IOException {
+
+        List<PDFText> allFoundTexts = new ArrayList<>();
+        for (List<PDFText> pageTexts : allFoundTextsByPage.values()) {
+            allFoundTexts.addAll(pageTexts);
+        }
+
+        if (!allFoundTexts.isEmpty()) {
+            Color redactColor = decodeOrDefault(colorString);
+            redactFoundText(document, allFoundTexts, customPadding, redactColor, isTextRemovalMode);
+            cleanDocumentMetadata(document);
+        }
+
+        if (Boolean.TRUE.equals(convertToImage)) {
+            try (PDDocument convertedPdf = PdfUtils.convertPdfToPdfImage(document)) {
+                cleanDocumentMetadata(convertedPdf);
+
+                TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+                try {
+                    convertedPdf.save(tempOut.getFile());
+                } catch (IOException e) {
+                    tempOut.close();
+                    throw e;
+                }
+
+                log.info(
+                        "Redaction finalized (image mode): {} pages ➜ {} KB",
+                        convertedPdf.getNumberOfPages(),
+                        tempOut.getFile().length() / 1024);
+
+                return tempOut;
+            }
+        }
+
+        TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+        try {
+            document.save(tempOut.getFile());
+        } catch (IOException e) {
+            tempOut.close();
+            throw e;
+        }
+
+        log.info(
+                "Redaction finalized: {} pages ➜ {} KB",
+                document.getNumberOfPages(),
+                tempOut.getFile().length() / 1024);
+
+        return tempOut;
+    }
+
+    private void cleanDocumentMetadata(PDDocument document) {
+        try {
+            var documentInfo = document.getDocumentInformation();
+            if (documentInfo != null) {
+                documentInfo.setAuthor(null);
+                documentInfo.setSubject(null);
+                documentInfo.setKeywords(null);
+                documentInfo.setModificationDate(java.util.Calendar.getInstance());
+                log.debug("Cleaned document metadata for security");
+            }
+
+            if (document.getDocumentCatalog() != null) {
+                try {
+                    document.getDocumentCatalog().setMetadata(null);
+                } catch (Exception e) {
+                    log.debug("Could not clear XMP metadata: {}", e.getMessage());
+                }
+            }
+
+        } catch (Exception e) {
+            log.warn("Failed to clean document metadata: {}", e.getMessage());
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Utilities
+    // -----------------------------------------------------------------------
+
+    static Color decodeOrDefault(String hex) {
+        if (hex == null) {
+            return Color.BLACK;
+        }
+
+        String colorString = hex.startsWith("#") ? hex : "#" + hex;
+
+        try {
+            return Color.decode(colorString);
+        } catch (NumberFormatException e) {
+            return Color.BLACK;
+        }
+    }
+
+    private List<Integer> getPageNumbers(ManualRedactPdfRequest request, int pagesCount) {
+        String pageNumbersInput = request.getPageNumbers();
+        String[] parsedPageNumbers =
+                pageNumbersInput != null ? pageNumbersInput.split(",") : new String[0];
+        List<Integer> pageNumbers =
+                GeneralUtils.parsePageList(parsedPageNumbers, pagesCount, false);
+        Collections.sort(pageNumbers);
+        return pageNumbers;
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/security/MultiPatternTextFinder.java

@@ -0,0 +1,174 @@
+package stirling.software.SPDF.controller.api.security;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.text.PDFTextStripper;
+import org.apache.pdfbox.text.TextPosition;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.PDFText;
+
+/**
+ * Scans a PDF document once and matches all provided patterns in a single pass, collecting
+ * bounding-box positions for every match. Use in place of creating one {@code TextFinder} per
+ * search term to avoid O(n) full-document scans.
+ */
+@Slf4j
+final class MultiPatternTextFinder extends PDFTextStripper {
+
+    private static final long REGEX_MATCH_TIMEOUT_SECONDS = 30;
+    private static final ExecutorService REGEX_EXECUTOR =
+            Executors.newVirtualThreadPerTaskExecutor();
+
+    private final List<Pattern> patterns;
+    private final Map<Integer, List<PDFText>> foundTextsByPage = new HashMap<>();
+
+    private final List<TextPosition> pageTextPositions = new ArrayList<>();
+    private final StringBuilder pageTextBuilder = new StringBuilder();
+
+    MultiPatternTextFinder(List<Pattern> patterns) throws IOException {
+        this.patterns = patterns;
+        this.setWordSeparator(" ");
+        this.setLineSeparator("\n");
+    }
+
+    Map<Integer, List<PDFText>> getFoundTextsByPage() {
+        return foundTextsByPage;
+    }
+
+    @Override
+    protected void startPage(PDPage page) throws IOException {
+        super.startPage(page);
+        pageTextPositions.clear();
+        pageTextBuilder.setLength(0);
+    }
+
+    @Override
+    protected void writeString(String text, List<TextPosition> textPositions) {
+        pageTextBuilder.append(text);
+        pageTextPositions.addAll(textPositions);
+    }
+
+    @Override
+    protected void writeWordSeparator() {
+        pageTextBuilder.append(getWordSeparator());
+        pageTextPositions.add(null);
+    }
+
+    @Override
+    protected void writeLineSeparator() {
+        pageTextBuilder.append(getLineSeparator());
+        pageTextPositions.add(null);
+    }
+
+    @Override
+    protected void endPage(PDPage page) throws IOException {
+        String text = pageTextBuilder.toString();
+        if (!text.isEmpty()) {
+            int pageIndex = getCurrentPageNo() - 1;
+            for (Pattern pattern : patterns) {
+                Matcher matcher = pattern.matcher(text);
+                while (safeFind(matcher)) {
+                    PDFText pdfText = resolveMatchPosition(matcher, pageIndex);
+                    if (pdfText != null) {
+                        foundTextsByPage
+                                .computeIfAbsent(pageIndex, k -> new ArrayList<>())
+                                .add(pdfText);
+                    }
+                }
+            }
+        }
+        super.endPage(page);
+    }
+
+    /**
+     * Wraps a single {@code matcher.find()} call with a {@value #REGEX_MATCH_TIMEOUT_SECONDS}
+     * second timeout. Prevents pathological regex backtracking from blocking the request
+     * indefinitely; per-match timeout so fast legitimate scans are unaffected.
+     */
+    private static boolean safeFind(Matcher matcher) throws IOException {
+        Future<Boolean> future =
+                REGEX_EXECUTOR.submit((java.util.concurrent.Callable<Boolean>) matcher::find);
+        try {
+            return future.get(REGEX_MATCH_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+        } catch (TimeoutException e) {
+            future.cancel(true);
+            throw new IOException(
+                    "Regex match timed out after "
+                            + REGEX_MATCH_TIMEOUT_SECONDS
+                            + "s — pattern may cause catastrophic backtracking");
+        } catch (InterruptedException e) {
+            future.cancel(true);
+            Thread.currentThread().interrupt();
+            throw new IOException("Regex match interrupted", e);
+        } catch (ExecutionException e) {
+            Throwable cause = e.getCause();
+            if (cause instanceof IOException ioEx) throw ioEx;
+            throw new IOException("Regex match failed: " + cause.getMessage(), cause);
+        }
+    }
+
+    private PDFText resolveMatchPosition(Matcher matcher, int pageIndex) {
+        int matchStart = matcher.start();
+        int matchEnd = matcher.end();
+
+        float minX = Float.MAX_VALUE;
+        float minY = Float.MAX_VALUE;
+        float maxX = Float.MIN_VALUE;
+        float maxY = Float.MIN_VALUE;
+        boolean foundPosition = false;
+
+        for (int i = matchStart; i < matchEnd; i++) {
+            if (i >= pageTextPositions.size()) break;
+            TextPosition pos = pageTextPositions.get(i);
+            if (pos != null) {
+                foundPosition = true;
+                minX = Math.min(minX, pos.getX());
+                maxX = Math.max(maxX, pos.getX() + pos.getWidth());
+                minY = Math.min(minY, pos.getY() - pos.getHeight());
+                maxY = Math.max(maxY, pos.getY());
+            }
+        }
+
+        if (!foundPosition && matchStart < pageTextPositions.size()) {
+            for (int i = Math.max(0, matchStart - 5);
+                    i < Math.min(pageTextPositions.size(), matchEnd + 5);
+                    i++) {
+                TextPosition pos = pageTextPositions.get(i);
+                if (pos != null) {
+                    foundPosition = true;
+                    minX = Math.min(minX, pos.getX());
+                    maxX = Math.max(maxX, pos.getX() + pos.getWidth());
+                    minY = Math.min(minY, pos.getY() - pos.getHeight());
+                    maxY = Math.max(maxY, pos.getY());
+                    break;
+                }
+            }
+        }
+
+        if (!foundPosition) {
+            log.warn(
+                    "Found text match '{}' but no valid position data at {}-{}",
+                    matcher.group(),
+                    matchStart,
+                    matchEnd);
+            return null;
+        }
+
+        return new PDFText(pageIndex, minX, minY, maxX, maxY, matcher.group());
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/security/RedactExecuteService.java

@@ -0,0 +1,850 @@
+package stirling.software.SPDF.controller.api.security;
+
+import java.awt.Color;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDPageContentStream;
+import org.apache.pdfbox.pdmodel.PDPageTree;
+import org.apache.pdfbox.pdmodel.PDResources;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.PDFText;
+import stirling.software.SPDF.model.api.security.RedactExecuteRequest;
+import stirling.software.SPDF.model.api.security.RedactExecuteRequest.ImageBox;
+import stirling.software.SPDF.model.api.security.RedactExecuteRequest.RedactStyle;
+import stirling.software.SPDF.model.api.security.RedactExecuteRequest.TextRange;
+import stirling.software.SPDF.pdf.parser.PageColumnLayout;
+import stirling.software.SPDF.pdf.parser.PageImageLocator;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.TempFile;
+
+@Service
+@Slf4j
+@RequiredArgsConstructor
+class RedactExecuteService {
+
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final ManualRedactionService manualRedactionService;
+    private final TextRedactionService textRedactionService;
+
+    TempFile execute(RedactExecuteRequest request) throws IOException {
+        RedactStyle style = request.getStyle() != null ? request.getStyle() : new RedactStyle();
+        List<String> textValues = orEmpty(request.getTextValues());
+        List<String> regexPatterns = orEmpty(request.getRegexPatterns());
+        List<Integer> wipePages = orEmpty(request.getWipePages());
+        List<TextRange> ranges = orEmpty(request.getRanges());
+        List<ImageBox> imageBoxes = orEmpty(request.getImageBoxes());
+
+        boolean hasTargets =
+                !textValues.isEmpty()
+                        || !regexPatterns.isEmpty()
+                        || !wipePages.isEmpty()
+                        || !ranges.isEmpty()
+                        || !imageBoxes.isEmpty()
+                        || request.getRedactImagePages() != null;
+
+        if (!hasTargets) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.redaction.no.targets", "No redaction targets provided");
+        }
+
+        boolean overlayOnly =
+                RedactExecuteRequest.RedactionStrategy.OVERLAY_ONLY.equals(style.getStrategy());
+        boolean imageFinalize =
+                RedactExecuteRequest.RedactionStrategy.IMAGE_FINALIZE.equals(style.getStrategy());
+        boolean convertToImage = imageFinalize || style.isConvertToImage();
+
+        boolean hasTextOps = !textValues.isEmpty() || !regexPatterns.isEmpty();
+
+        log.info(
+                "[redact/execute] strategy={} textValues={} regexPatterns={} wipePages={} ranges={} imageBoxes={} imagePages={}",
+                style.getStrategy(),
+                textValues.size(),
+                regexPatterns.size(),
+                wipePages.size(),
+                ranges.size(),
+                imageBoxes.size(),
+                request.getRedactImagePages());
+
+        if (request.getFileInput() == null) {
+            throw ExceptionUtils.createFileNullOrEmptyException();
+        }
+
+        PDDocument document = null;
+        try {
+            document = pdfDocumentFactory.load(request.getFileInput());
+
+            // Single-pass text scan: collect all text-based targets so we run the PDF
+            // stripper only once across the entire execute() call rather than once per target.
+            Map<Integer, List<PDFText>> foundTexts =
+                    hasTextOps ? collectTextMatches(document, request) : new HashMap<>();
+
+            int totalMatches = foundTexts.values().stream().mapToInt(List::size).sum();
+            log.info(
+                    "[redact/execute] scan complete: {} text matches across {} pages",
+                    totalMatches,
+                    foundTexts.size());
+
+            // Text removal (content-stream rewriting) — skipped in overlay-only mode.
+            boolean needsOverlayOnly = overlayOnly;
+            if (hasTextOps && !foundTexts.isEmpty() && !overlayOnly) {
+                needsOverlayOnly = applyTextRemoval(document, request);
+            } else if (overlayOnly) {
+                log.info(
+                        "[redact/execute] overlay-only mode requested — skipping content-stream rewriting");
+            }
+
+            // Reload fresh document on fallback so we overlay onto clean content.
+            if (needsOverlayOnly && !foundTexts.isEmpty()) {
+                log.info("[redact/execute] reloading document for clean overlay pass");
+                document.close();
+                document = pdfDocumentFactory.load(request.getFileInput());
+                foundTexts.clear();
+                if (hasTextOps) {
+                    foundTexts.putAll(collectTextMatches(document, request));
+                }
+            }
+
+            // Non-text operations.
+            Map<Integer, PageColumnLayout> layoutCache = new HashMap<>();
+
+            if (!wipePages.isEmpty()) {
+                applyPageWipe(document, wipePages, style);
+            }
+
+            for (TextRange range : ranges) {
+                applyRangeRedaction(document, range, style, layoutCache);
+            }
+
+            for (ImageBox box : imageBoxes) {
+                applyImageBoxRedaction(document, box, style);
+            }
+
+            if (request.getRedactImagePages() != null) {
+                applyAllImagesRedaction(document, request.getRedactImagePages(), style);
+            }
+
+            return manualRedactionService.finalizeRedaction(
+                    document,
+                    foundTexts,
+                    style.getColor(),
+                    style.getPadding(),
+                    convertToImage,
+                    !needsOverlayOnly);
+
+        } catch (Exception e) {
+            log.error("Execute redaction failed: {}", e.getMessage(), e);
+            throw new RuntimeException("Failed to perform PDF redaction: " + e.getMessage(), e);
+        } finally {
+            if (document != null) {
+                try {
+                    document.close();
+                } catch (IOException e) {
+                    log.warn("Failed to close document: {}", e.getMessage());
+                }
+            }
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Single-pass text scan (one stripper pass per execute() call)
+    // -----------------------------------------------------------------------
+
+    /**
+     * Runs a single PDF text-stripper pass over all text-based targets and returns the merged hit
+     * map.
+     */
+    private Map<Integer, List<PDFText>> collectTextMatches(
+            PDDocument document, RedactExecuteRequest request) {
+        Map<Integer, List<PDFText>> found = new HashMap<>();
+
+        String[] terms = cleanStrings(request.getTextValues());
+        if (terms.length > 0) {
+            textRedactionService
+                    .findTextToRedact(document, terms, false, false)
+                    .forEach(
+                            (page, hits) ->
+                                    found.computeIfAbsent(page, k -> new ArrayList<>())
+                                            .addAll(hits));
+        }
+
+        String[] patterns = cleanStrings(request.getRegexPatterns());
+        if (patterns.length > 0) {
+            textRedactionService
+                    .findTextToRedact(document, patterns, true, false)
+                    .forEach(
+                            (page, hits) ->
+                                    found.computeIfAbsent(page, k -> new ArrayList<>())
+                                            .addAll(hits));
+        }
+
+        return found;
+    }
+
+    // -----------------------------------------------------------------------
+    // Text removal (content-stream rewriting)
+    // -----------------------------------------------------------------------
+
+    /**
+     * Attempts content-stream text removal for all text/regex targets. Returns {@code true} if the
+     * document fell back to overlay-only mode.
+     */
+    private boolean applyTextRemoval(PDDocument document, RedactExecuteRequest request) {
+        try {
+            boolean fallback = false;
+
+            String[] terms = cleanStrings(request.getTextValues());
+            if (terms.length > 0) {
+                Map<Integer, List<PDFText>> exactFound =
+                        textRedactionService.findTextToRedact(document, terms, false, false);
+                if (!exactFound.isEmpty()) {
+                    fallback |=
+                            textRedactionService.performTextReplacement(
+                                    document, exactFound, terms, false, false);
+                }
+            }
+
+            String[] patterns = cleanStrings(request.getRegexPatterns());
+            if (patterns.length > 0) {
+                Map<Integer, List<PDFText>> regexFound =
+                        textRedactionService.findTextToRedact(document, patterns, true, false);
+                if (!regexFound.isEmpty()) {
+                    fallback |=
+                            textRedactionService.performTextReplacement(
+                                    document, regexFound, patterns, true, false);
+                }
+            }
+
+            if (fallback) {
+                log.warn(
+                        "[redact/execute] font compatibility issue — falling back to overlay-only");
+            } else {
+                log.info("[redact/execute] content-stream text removal applied successfully");
+            }
+            return fallback;
+        } catch (Exception e) {
+            log.warn(
+                    "[redact/execute] text removal failed, falling back to overlay: {}",
+                    e.getMessage());
+            return true;
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Per-operation dispatch methods
+    // -----------------------------------------------------------------------
+
+    private void applyPageWipe(PDDocument document, List<Integer> pageNumbers, RedactStyle style)
+            throws IOException {
+        List<Integer> pageIndices = toZeroBasedIndices(pageNumbers);
+        if (pageIndices.isEmpty()) return;
+
+        PDPageTree allPages = document.getDocumentCatalog().getPages();
+        Color pageColor = ManualRedactionService.decodeOrDefault(style.getColor());
+        Collections.sort(pageIndices);
+        log.info("[redact/execute] full-page wipe: {} pages ({})", pageIndices.size(), pageIndices);
+
+        Map<Integer, List<float[]>> pageElementBoxes = new HashMap<>();
+        for (Integer idx : pageIndices) {
+            if (idx >= 0 && idx < allPages.getCount()) {
+                try {
+                    pageElementBoxes.put(
+                            idx,
+                            manualRedactionService.extractPageElementBoxes(
+                                    document, allPages.get(idx), idx));
+                } catch (Exception e) {
+                    log.warn(
+                            "[redact/execute] element extraction failed for page {}: {}",
+                            idx,
+                            e.getMessage());
+                }
+            }
+        }
+
+        for (Integer idx : pageIndices) {
+            if (idx >= 0 && idx < allPages.getCount()) {
+                PDPage page = allPages.get(idx);
+                List<float[]> elementBoxes =
+                        pageElementBoxes.getOrDefault(idx, Collections.emptyList());
+                page.getCOSObject().removeItem(COSName.CONTENTS);
+                page.setResources(new PDResources());
+                try (PDPageContentStream cs = new PDPageContentStream(document, page)) {
+                    cs.setNonStrokingColor(pageColor);
+                    if (elementBoxes.isEmpty()) {
+                        PDRectangle box = page.getBBox();
+                        cs.addRect(0, 0, box.getWidth(), box.getHeight());
+                    } else {
+                        log.info(
+                                "[redact/execute] page {}: drawing {} element boxes",
+                                idx + 1,
+                                elementBoxes.size());
+                        for (float[] r : elementBoxes) {
+                            cs.addRect(r[0], r[1], r[2] - r[0], r[3] - r[1]);
+                        }
+                    }
+                    cs.fill();
+                }
+            }
+        }
+    }
+
+    private void applyRangeRedaction(
+            PDDocument document,
+            TextRange range,
+            RedactStyle style,
+            Map<Integer, PageColumnLayout> layoutCache)
+            throws IOException {
+        String rangeStart = trimOrEmpty(range.startString());
+        String rangeEnd = trimOrEmpty(range.endString());
+        log.info("[redact/execute] range redaction: start='{}' end='{}'", rangeStart, rangeEnd);
+        try {
+            List<PDFText> blocks = collectRangeBlocks(document, rangeStart, rangeEnd, layoutCache);
+            if (!blocks.isEmpty()) {
+                manualRedactionService.redactFoundText(
+                        document,
+                        blocks,
+                        style.getPadding(),
+                        ManualRedactionService.decodeOrDefault(style.getColor()),
+                        false);
+            } else {
+                log.warn(
+                        "[redact/execute] range not found: start='{}' end='{}'",
+                        rangeStart,
+                        rangeEnd);
+            }
+        } catch (Exception e) {
+            log.warn("[redact/execute] range redaction failed: {}", e.getMessage());
+        }
+    }
+
+    private void applyImageBoxRedaction(PDDocument document, ImageBox box, RedactStyle style)
+            throws IOException {
+        List<float[]> boxes =
+                List.of(
+                        new float[] {
+                            (float) box.pageIndex(), box.x1(), box.y1(), box.x2(), box.y2()
+                        });
+        log.info("[redact/execute] image box overlay on page {}", box.pageIndex());
+        Color boxColor = ManualRedactionService.decodeOrDefault(style.getColor());
+        manualRedactionService.redactImageBoxes(document, boxes, boxColor);
+    }
+
+    private void applyAllImagesRedaction(
+            PDDocument document, List<Integer> pageNumbers, RedactStyle style) throws IOException {
+        PDPageTree allPages = document.getDocumentCatalog().getPages();
+        Color imgColor = ManualRedactionService.decodeOrDefault(style.getColor());
+
+        List<Integer> imagePageIndices = toZeroBasedIndices(pageNumbers);
+        if (imagePageIndices.isEmpty()) {
+            imagePageIndices = new ArrayList<>();
+            for (int i = 0; i < allPages.getCount(); i++) {
+                imagePageIndices.add(i);
+            }
+        }
+
+        List<float[]> detectedBoxes = new ArrayList<>();
+        for (int pageIdx : imagePageIndices) {
+            if (pageIdx < 0 || pageIdx >= allPages.getCount()) continue;
+            try {
+                PDPage page = allPages.get(pageIdx);
+                PageImageLocator locator = new PageImageLocator(page, pageIdx);
+                locator.processPage(page);
+                for (PageImageLocator.ImageBox ib : locator.getImageBoxes()) {
+                    detectedBoxes.add(new float[] {pageIdx, ib.x1(), ib.y1(), ib.x2(), ib.y2()});
+                }
+            } catch (Exception e) {
+                log.warn(
+                        "[redact/execute] image detection failed for page {}: {}",
+                        pageIdx + 1,
+                        e.getMessage());
+            }
+        }
+
+        log.info(
+                "[redact/execute] auto image detection: {} images across {} pages",
+                detectedBoxes.size(),
+                imagePageIndices.size());
+
+        if (!detectedBoxes.isEmpty()) {
+            manualRedactionService.redactImageBoxes(document, detectedBoxes, imgColor);
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Range collection helpers
+    // -----------------------------------------------------------------------
+
+    /**
+     * Locates {@code startStr} in the document and returns {@link PDFText} blocks for every text
+     * line and image from that point up to (but NOT including) the line where {@code endStr}
+     * begins. If {@code endStr} is blank, redacts from {@code startStr} to the end of the document.
+     *
+     * <p>Multi-column pages follow reading order: down the start column, jump to the top of the
+     * next column, continue to the end anchor. Single-column pages reduce to a plain Y-band check.
+     */
+    List<PDFText> collectRangeBlocks(
+            PDDocument document,
+            String startStr,
+            String endStr,
+            Map<Integer, PageColumnLayout> layoutCache)
+            throws IOException {
+
+        PDPageTree allPages = document.getDocumentCatalog().getPages();
+        int totalPages = allPages.getCount();
+
+        Map<Integer, List<PDFText>> startMatchesByPage = findWithFallbacks(document, startStr);
+        if (startMatchesByPage.isEmpty()) {
+            log.warn("[redact/execute] range start not found: '{}'", startStr);
+            return Collections.emptyList();
+        }
+
+        List<Anchor> starts = toAnchors(document, startMatchesByPage, layoutCache);
+        starts.sort(READING_ORDER);
+        log.info(
+                "[redact/execute] start='{}' matched {} anchor(s): {}",
+                startStr,
+                starts.size(),
+                anchorSummary(starts));
+
+        boolean openEnded = (endStr == null || endStr.isBlank());
+        List<Anchor> ends = new ArrayList<>();
+        if (!openEnded) {
+            Map<Integer, List<PDFText>> endMatchesByPage = findWithFallbacks(document, endStr);
+            if (endMatchesByPage.isEmpty()) {
+                log.warn(
+                        "[redact/execute] range end '{}' not found in document - skipping range"
+                                + " (start='{}')",
+                        endStr,
+                        startStr);
+                return Collections.emptyList();
+            }
+            ends = toAnchors(document, endMatchesByPage, layoutCache);
+            ends.sort(READING_ORDER);
+            log.info(
+                    "[redact/execute] end='{}' matched {} anchor(s): {}",
+                    endStr,
+                    ends.size(),
+                    anchorSummary(ends));
+        }
+
+        List<PDFText> blocks = new ArrayList<>();
+        for (Anchor start : starts) {
+            Anchor end = null;
+            int endPage;
+            if (openEnded) {
+                endPage = totalPages - 1;
+            } else {
+                for (Anchor candidate : ends) {
+                    if (READING_ORDER.compare(candidate, start) > 0) {
+                        end = candidate;
+                        break;
+                    }
+                }
+                if (end == null) {
+                    log.warn(
+                            "[redact/execute] no end anchor after start at (page={}, col={}, y={}) — skipping",
+                            start.page + 1,
+                            start.col,
+                            start.y);
+                    continue;
+                }
+                endPage = end.page;
+            }
+
+            log.info(
+                    "[redact/execute] range pages {}-{}: start='{}' (col {}) end='{}'",
+                    start.page + 1,
+                    endPage + 1,
+                    startStr,
+                    start.col,
+                    openEnded ? "<end of document>" : endStr);
+
+            collectBlocksForRange(document, allPages, start, end, openEnded, blocks, layoutCache);
+        }
+
+        log.info(
+                "[redact/execute] range '{}'→'{}': {} total blocks",
+                startStr,
+                openEnded ? "<end of document>" : endStr,
+                blocks.size());
+        return blocks;
+    }
+
+    /**
+     * Collects all redactable content (text line segments and images) between two anchor positions.
+     *
+     * <p>Line boxes are cached per page number in {@code lineBoxCache} and reused across range
+     * iterations within one execute() call, avoiding redundant {@link AllTextLineExtractor} passes.
+     */
+    private void collectBlocksForRange(
+            PDDocument document,
+            PDPageTree allPages,
+            Anchor start,
+            Anchor end,
+            boolean openEnded,
+            List<PDFText> blocks,
+            Map<Integer, PageColumnLayout> layoutCache)
+            throws IOException {
+
+        int startPage = start.page;
+        int endPage = openEnded ? allPages.getCount() - 1 : end.page;
+        int endCol =
+                openEnded ? layoutFor(document, endPage, layoutCache).columnCount() - 1 : end.col;
+        float startY = start.y;
+        // Use bottom of end anchor so the end anchor line itself is included (inclusive range).
+        float endY = openEnded ? Float.POSITIVE_INFINITY : end.text.getY2();
+
+        // Line-box cache: populated lazily per page, reused across range iterations.
+        // Cannot use computeIfAbsent because AllTextLineExtractor's constructor throws IOException.
+        Map<Integer, List<float[]>> lineBoxCache = new HashMap<>();
+
+        for (int pageIdx = startPage; pageIdx <= endPage; pageIdx++) {
+            PDPage page = allPages.get(pageIdx);
+            float pageHeight = page.getBBox().getHeight();
+            PageColumnLayout layout = layoutFor(document, pageIdx, layoutCache);
+
+            List<float[]> screenLineBoxes = lineBoxCache.get(pageIdx);
+            if (screenLineBoxes == null) {
+                AllTextLineExtractor textExtractor =
+                        new AllTextLineExtractor(pageIdx + 1, pageHeight);
+                textExtractor.getText(document);
+                screenLineBoxes = textExtractor.getScreenLineBoxes();
+                lineBoxCache.put(pageIdx, screenLineBoxes);
+            }
+
+            for (float[] sb : screenLineBoxes) {
+                emitColumnSlices(
+                        pageIdx, layout, sb[0], sb[2], sb[1], sb[3], start.col, startPage, startY,
+                        endCol, endPage, endY, blocks);
+            }
+
+            PageImageLocator imgLocator = new PageImageLocator(page, pageIdx);
+            imgLocator.processPage(page);
+            for (PageImageLocator.ImageBox ib : imgLocator.getImageBoxes()) {
+                // ImageBox coordinates are in PDF user-space (Y up); convert to screen-Y (Y down).
+                float screenY1 = pageHeight - ib.y2();
+                float screenY2 = pageHeight - ib.y1();
+                emitColumnSlices(
+                        pageIdx, layout, ib.x1(), ib.x2(), screenY1, screenY2, start.col, startPage,
+                        startY, endCol, endPage, endY, blocks);
+            }
+        }
+    }
+
+    /** Emits each per-column sub-box accepted by the reading-order predicate. */
+    private static void emitColumnSlices(
+            int pageIdx,
+            PageColumnLayout layout,
+            float x1,
+            float x2,
+            float yTop,
+            float yBottom,
+            int startCol,
+            int startPage,
+            float startY,
+            int endCol,
+            int endPage,
+            float endY,
+            List<PDFText> blocks) {
+        int[] cols = layout.columnsCrossing(x1, x2);
+        if (cols.length == 1) {
+            if (inColumnZone(
+                    pageIdx, cols[0], yTop, yBottom, startPage, startCol, startY, endPage, endCol,
+                    endY)) {
+                blocks.add(new PDFText(pageIdx, x1, yTop, x2, yBottom, ""));
+            }
+            return;
+        }
+        for (int col : cols) {
+            if (!inColumnZone(
+                    pageIdx, col, yTop, yBottom, startPage, startCol, startY, endPage, endCol,
+                    endY)) {
+                return;
+            }
+        }
+        blocks.add(new PDFText(pageIdx, x1, yTop, x2, yBottom, ""));
+    }
+
+    /**
+     * Reading-order predicate: true when (col, yBottom) on page {@code pageIdx} sits between the
+     * start anchor (inclusive) and end anchor (inclusive).
+     */
+    static boolean inColumnZone(
+            int pageIdx,
+            int col,
+            float yTop,
+            float yBottom,
+            int startPage,
+            int startCol,
+            float startY,
+            int endPage,
+            int endCol,
+            float endY) {
+        if (pageIdx > startPage && pageIdx < endPage) return true;
+        if (pageIdx == startPage && pageIdx == endPage) {
+            if (startCol == endCol) {
+                return col == startCol && yBottom >= startY && yBottom <= endY;
+            }
+            if (startCol < endCol) {
+                if (col < startCol || col > endCol) return false;
+                if (col == startCol) return yBottom >= startY;
+                if (col == endCol) return yBottom <= endY;
+                return true;
+            }
+            return col == startCol && yBottom >= startY;
+        }
+        if (pageIdx == startPage) {
+            if (col == startCol) return yBottom >= startY;
+            return col > startCol;
+        }
+        if (pageIdx == endPage) {
+            if (col == endCol) return yBottom <= endY;
+            return col < endCol;
+        }
+        return false;
+    }
+
+    /** Lazily builds and caches the column layout for a single page. */
+    private PageColumnLayout layoutFor(
+            PDDocument document, int pageIdx, Map<Integer, PageColumnLayout> cache)
+            throws IOException {
+        PageColumnLayout cached = cache.get(pageIdx);
+        if (cached != null) return cached;
+        PDPage page = document.getDocumentCatalog().getPages().get(pageIdx);
+        float pageWidth = page.getBBox().getWidth();
+        float pageHeight = page.getBBox().getHeight();
+        AllTextLineExtractor extractor = new AllTextLineExtractor(pageIdx + 1, pageHeight);
+        extractor.getText(document);
+        PageColumnLayout layout =
+                PageColumnLayout.fromLineBoxes(extractor.getLineBoxes(), pageWidth);
+        if (layout.columnCount() > 1) {
+            float[] g = layout.gutters().get(0);
+            log.info(
+                    "[redact/execute] page {} layout: 2 cols, gutter x=[{}, {}]",
+                    pageIdx + 1,
+                    g[0],
+                    g[1]);
+        } else {
+            log.info("[redact/execute] page {} layout: 1 col (single-column mode)", pageIdx + 1);
+        }
+        cache.put(pageIdx, layout);
+        return layout;
+    }
+
+    private List<Anchor> toAnchors(
+            PDDocument document,
+            Map<Integer, List<PDFText>> matchesByPage,
+            Map<Integer, PageColumnLayout> layoutCache)
+            throws IOException {
+        List<Anchor> out = new ArrayList<>();
+        for (int page : matchesByPage.keySet().stream().sorted().toList()) {
+            PageColumnLayout layout = layoutFor(document, page, layoutCache);
+            for (PDFText hit : matchesByPage.get(page)) {
+                int col = layout.columnOf(hit.getX1(), hit.getX2());
+                out.add(new Anchor(page, col, hit.getY1(), hit));
+            }
+        }
+        return out;
+    }
+
+    /** Lexicographic ordering by (page, column, screenY). */
+    private static final Comparator<Anchor> READING_ORDER =
+            Comparator.comparingInt((Anchor a) -> a.page)
+                    .thenComparingInt(a -> a.col)
+                    .thenComparingDouble(a -> a.y);
+
+    private static String anchorSummary(List<Anchor> anchors) {
+        StringBuilder sb = new StringBuilder();
+        int max = Math.min(anchors.size(), 5);
+        for (int i = 0; i < max; i++) {
+            Anchor a = anchors.get(i);
+            if (i > 0) sb.append(", ");
+            sb.append(String.format("(p=%d,c=%d,y=%.1f)", a.page + 1, a.col, a.y));
+        }
+        if (anchors.size() > max) sb.append(", …");
+        return sb.toString();
+    }
+
+    private record Anchor(int page, int col, float y, PDFText text) {}
+
+    /**
+     * Tries progressively more permissive variants: raw (regex then literal), letter-spacing
+     * collapsed, then a punctuation-tolerant regex over alphanumeric runs.
+     */
+    private Map<Integer, List<PDFText>> findWithFallbacks(PDDocument document, String raw) {
+        String trimmed = raw.trim();
+        String collapsed = collapseLetterSpacing(trimmed);
+        String tolerant = punctuationTolerantRegex(trimmed);
+
+        List<Candidate> candidates = new ArrayList<>();
+        candidates.add(new Candidate(trimmed, true));
+        candidates.add(new Candidate(trimmed, false));
+        if (!collapsed.equals(trimmed)) {
+            candidates.add(new Candidate(collapsed, true));
+            candidates.add(new Candidate(collapsed, false));
+        }
+        if (tolerant != null && !tolerant.equals(trimmed)) {
+            candidates.add(new Candidate(tolerant, true));
+        }
+
+        // If the anchor spans multiple lines (model provided entire paragraph instead of a short
+        // phrase), try just the first non-empty line — it's usually sufficient to locate the
+        // position and avoids mismatches from mid-paragraph text extraction artifacts.
+        if (trimmed.contains("\n")) {
+            String firstLine =
+                    Arrays.stream(trimmed.split("\n"))
+                            .map(String::trim)
+                            .filter(s -> !s.isEmpty())
+                            .findFirst()
+                            .orElse(null);
+            if (firstLine != null && firstLine.length() >= 4) {
+                String firstLineCollapsed = collapseLetterSpacing(firstLine);
+                String firstLineTolerant = punctuationTolerantRegex(firstLine);
+                candidates.add(new Candidate(firstLine, false));
+                if (!firstLineCollapsed.equals(firstLine)) {
+                    candidates.add(new Candidate(firstLineCollapsed, false));
+                }
+                if (firstLineTolerant != null && !firstLineTolerant.equals(firstLine)) {
+                    candidates.add(new Candidate(firstLineTolerant, true));
+                }
+            }
+        }
+
+        for (Candidate c : candidates) {
+            Map<Integer, List<PDFText>> m =
+                    textRedactionService.findTextToRedact(
+                            document, new String[] {c.pattern}, c.useRegex, false);
+            if (!m.isEmpty()) {
+                if (!c.pattern.equals(trimmed)) {
+                    log.info(
+                            "[redact/execute] range boundary matched via fallback: '{}' → '{}'",
+                            trimmed,
+                            c.pattern);
+                }
+                return m;
+            }
+        }
+        return Collections.emptyMap();
+    }
+
+    private record Candidate(String pattern, boolean useRegex) {}
+
+    // -----------------------------------------------------------------------
+    // Static helpers
+    // -----------------------------------------------------------------------
+
+    /**
+     * Joins {@code raw}'s alphanumeric runs with {@code \W*} so anchors match across punctuation
+     * drift. Returns {@code null} when fewer than two tokens exist.
+     */
+    private static String punctuationTolerantRegex(String raw) {
+        List<String> tokens = new ArrayList<>();
+        StringBuilder current = new StringBuilder();
+        for (int i = 0; i < raw.length(); i++) {
+            char ch = raw.charAt(i);
+            if (Character.isLetterOrDigit(ch)) {
+                current.append(ch);
+            } else if (current.length() > 0) {
+                tokens.add(current.toString());
+                current.setLength(0);
+            }
+        }
+        if (current.length() > 0) tokens.add(current.toString());
+        if (tokens.size() < 2) return null;
+        StringBuilder out = new StringBuilder();
+        for (int i = 0; i < tokens.size(); i++) {
+            if (i > 0) out.append("\\W*");
+            out.append(Pattern.quote(tokens.get(i)));
+        }
+        return out.toString();
+    }
+
+    /**
+     * Collapses letter-spaced text produced by position-sorted text extraction.
+     *
+     * <p>When a PDF text stripper runs with {@code setSortByPosition(true)}, letter-spaced headings
+     * come out as {@code "T a b l e o f c o n t e n t s"}. This method converts the spaced form
+     * back to words.
+     */
+    private static String collapseLetterSpacing(String text) {
+        String[] tokens = text.split(" ", -1);
+        StringBuilder result = new StringBuilder();
+        StringBuilder current = new StringBuilder();
+        for (String token : tokens) {
+            if (token.isEmpty()) {
+                if (current.length() > 0) {
+                    if (result.length() > 0) result.append(' ');
+                    result.append(current);
+                    current.setLength(0);
+                }
+            } else if (token.length() == 1) {
+                current.append(token);
+            } else {
+                if (current.length() > 0) {
+                    if (result.length() > 0) result.append(' ');
+                    result.append(current);
+                    current.setLength(0);
+                }
+                if (result.length() > 0) result.append(' ');
+                result.append(token);
+            }
+        }
+        if (current.length() > 0) {
+            if (result.length() > 0) result.append(' ');
+            result.append(current);
+        }
+        return result.toString().trim();
+    }
+
+    private static <T> List<T> orEmpty(List<T> list) {
+        return list != null ? list : List.of();
+    }
+
+    private static String[] cleanStrings(List<String> input) {
+        if (input == null || input.isEmpty()) {
+            return new String[0];
+        }
+        return input.stream()
+                .filter(s -> s != null)
+                .map(String::trim)
+                .filter(s -> !s.isEmpty())
+                .toArray(String[]::new);
+    }
+
+    /**
+     * Converts 1-based page numbers from the request to the 0-based indices used internally.
+     * Out-of-range and non-positive values are silently dropped.
+     */
+    private static List<Integer> toZeroBasedIndices(List<Integer> oneBasedPageNumbers) {
+        if (oneBasedPageNumbers == null || oneBasedPageNumbers.isEmpty()) {
+            return new ArrayList<>();
+        }
+        List<Integer> result = new ArrayList<>();
+        for (Integer page : oneBasedPageNumbers) {
+            if (page != null && page > 0) {
+                result.add(page - 1);
+            }
+        }
+        return result;
+    }
+
+    private static String trimOrEmpty(String s) {
+        return s == null ? "" : s.trim();
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -41,6 +41,8 @@ public class ReactRoutingController {
     private boolean indexHtmlExists = false;
     private boolean useExternalIndexHtml = false;
     private boolean loggedMissingIndex = false;
+    private String cachedSaasLandingHtml;
+    private boolean saasLandingExists = false;
 
     @PostConstruct
     public void init() {
@@ -49,6 +51,20 @@ public class ReactRoutingController {
         // Always initialize callback HTML (used for OAuth desktop flow)
         this.cachedCallbackHtml = buildCallbackHtml();
 
+        // SaaS landing page: only present on the classpath when the :saas module is bundled
+        // (app/saas/src/main/resources/static/saas-landing.html). When present it replaces the
+        // root page so the SaaS API host shows its own landing instead of the OSS API-only page.
+        ClassPathResource saasLanding = new ClassPathResource("static/saas-landing.html");
+        if (saasLanding.exists()) {
+            try (InputStream in = saasLanding.getInputStream()) {
+                this.cachedSaasLandingHtml = new String(in.readAllBytes(), StandardCharsets.UTF_8);
+                this.saasLandingExists = true;
+                log.info("SaaS landing page detected; serving it at '/' and '/index.html'");
+            } catch (Exception ex) {
+                log.warn("Failed to read saas-landing.html; falling back to index.html", ex);
+            }
+        }
+
         // Check for external index.html first (customFiles/static/)
         Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
         log.debug("Checking for custom index.html at: {}", externalIndexPath);
@@ -132,6 +148,18 @@ public class ReactRoutingController {
     @GetMapping(
             value = {"/", "/index.html"},
             produces = MediaType.TEXT_HTML_VALUE)
+    public ResponseEntity<String> serveRootPage(HttpServletRequest request) {
+        // Swap ONLY the root page for SaaS. SPA entry points that delegate to serveIndexHtml
+        // (/auth/callback, /share/{token}, forwarded routes) keep serving the normal shell.
+        if (saasLandingExists && cachedSaasLandingHtml != null) {
+            return ResponseEntity.ok()
+                    .cacheControl(CacheControl.noCache().mustRevalidate())
+                    .contentType(MediaType.TEXT_HTML)
+                    .body(cachedSaasLandingHtml);
+        }
+        return serveIndexHtml(request);
+    }
+
     public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) {
         try {
             if (indexHtmlExists && cachedIndexHtml != null) {

app/core/src/main/java/stirling/software/SPDF/exception/GlobalExceptionHandler.java

@@ -24,6 +24,7 @@ import org.springframework.web.multipart.MaxUploadSizeExceededException;
 import org.springframework.web.multipart.support.MissingServletRequestPartException;
 import org.springframework.web.server.ResponseStatusException;
 import org.springframework.web.servlet.NoHandlerFoundException;
+import org.springframework.web.servlet.resource.NoResourceFoundException;
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
@@ -993,6 +994,49 @@ public class GlobalExceptionHandler {
                 .body(problemDetail);
     }
 
+    /** Unmapped path → clean 404 instead of falling through to the generic 500 catch-all. */
+    @ExceptionHandler(NoResourceFoundException.class)
+    public ResponseEntity<ProblemDetail> handleNoResourceFound(
+            NoResourceFoundException ex, HttpServletRequest request) {
+        // /api/* miss = likely missing controller (operator-relevant); other paths = favicons,
+        // robots.txt, scanner noise. Demote the latter so prod logs aren't flooded.
+        String uri = request.getRequestURI();
+        if (uri != null && uri.startsWith("/api/")) {
+            log.warn("No resource at {}: {}", uri, ex.getMessage());
+        } else {
+            log.debug("No resource at {}: {}", uri, ex.getMessage());
+        }
+
+        String title = getLocalizedMessage("error.notFound.title", ErrorTitles.NOT_FOUND_DEFAULT);
+        String detail =
+                getLocalizedMessage(
+                        "error.notFound.detail",
+                        String.format(
+                                "No endpoint found for %s %s",
+                                request.getMethod(), request.getRequestURI()),
+                        request.getMethod(),
+                        request.getRequestURI());
+
+        ProblemDetail problemDetail =
+                createBaseProblemDetail(HttpStatus.NOT_FOUND, detail, request);
+        problemDetail.setType(URI.create(ErrorTypes.NOT_FOUND));
+        problemDetail.setTitle(title);
+        problemDetail.setProperty("title", title);
+        problemDetail.setProperty("method", request.getMethod());
+        addStandardHints(
+                problemDetail,
+                "error.notFound.hints",
+                List.of(
+                        "Verify the URL path and HTTP method are correct.",
+                        "Check the API base path and version if applicable.",
+                        "Ensure there are no typos in the endpoint path."));
+        problemDetail.setProperty("actionRequired", "Use a valid endpoint URL and method.");
+
+        return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                .contentType(PROBLEM_JSON)
+                .body(problemDetail);
+    }
+
     /**
      * Handle IllegalArgumentException.
      *

app/core/src/main/java/stirling/software/SPDF/model/api/converters/ConvertPDFToMarkdown.java

@@ -1,11 +1,13 @@
 package stirling.software.SPDF.model.api.converters;
 
-import org.springframework.core.io.Resource;
+import java.nio.charset.StandardCharsets;
+
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
 
+import io.github.pixee.security.Filenames;
 import io.swagger.v3.oas.annotations.Operation;
 
 import lombok.RequiredArgsConstructor;
@@ -15,8 +17,11 @@ import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.ConvertApi;
 import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.model.api.PDFFile;
-import stirling.software.common.util.PDFToFile;
+import stirling.software.common.pdf.PdfMarkdownConverter;
+import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
+import stirling.software.common.util.WebResponseUtils;
+import stirling.software.jpdfium.PdfDocument;
 
 @ConvertApi
 @RequiredArgsConstructor
@@ -33,10 +38,27 @@ public class ConvertPDFToMarkdown {
             summary = "Convert PDF to Markdown",
             description =
                     "This endpoint converts a PDF file to Markdown format. Input:PDF Output:Markdown Type:SISO")
-    public ResponseEntity<Resource> processPdfToMarkdown(@ModelAttribute PDFFile file)
+    public ResponseEntity<byte[]> processPdfToMarkdown(@ModelAttribute PDFFile file)
             throws Exception {
         MultipartFile inputFile = file.getFileInput();
-        PDFToFile pdfToFile = new PDFToFile(tempFileManager);
-        return pdfToFile.processPdfToMarkdown(inputFile);
+
+        String originalName = Filenames.toSimpleFileName(inputFile.getOriginalFilename());
+        String baseName =
+                originalName.contains(".")
+                        ? originalName.substring(0, originalName.lastIndexOf('.'))
+                        : originalName;
+
+        String markdown;
+        try (TempFile tempInput = new TempFile(tempFileManager, ".pdf")) {
+            inputFile.transferTo(tempInput.getFile());
+            try (PdfDocument doc = PdfDocument.open(tempInput.getPath())) {
+                markdown = new PdfMarkdownConverter().convert(doc);
+            }
+        }
+
+        return WebResponseUtils.bytesToWebResponse(
+                markdown.getBytes(StandardCharsets.UTF_8),
+                baseName + ".md",
+                MediaType.valueOf("text/markdown"));
     }
 }

app/core/src/main/java/stirling/software/SPDF/model/api/security/RedactExecuteRequest.java

@@ -0,0 +1,132 @@
+package stirling.software.SPDF.model.api.security;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import stirling.software.common.model.api.PDFFile;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class RedactExecuteRequest extends PDFFile {
+
+    @Schema(
+            description =
+                    "Exact strings to find and black out. One entry per phrase to redact."
+                            + " Best for known names, identifiers, and specific text found in the document.")
+    private List<String> textValues = new ArrayList<>();
+
+    @Schema(
+            description =
+                    "Regex patterns to match and redact. Each match anywhere in the document is blacked out."
+                            + " Uses Java/PCRE regex syntax. Well-suited for strings that follow known patterns, like"
+                            + " phone numbers, email addresses, national ID numbers, or"
+                            + " dates (which can appear with different separators, optional country codes,"
+                            + " etc.). For fixed known strings such as names, use textValues instead.")
+    private List<String> regexPatterns = new ArrayList<>();
+
+    @Schema(
+            description =
+                    "1-indexed page numbers to wipe entirely (all content removed from those pages).")
+    private List<Integer> wipePages = new ArrayList<>();
+
+    @Schema(
+            description =
+                    "Text ranges to redact by specifying a start and end anchor phrase. All"
+                            + " content between the two phrases (inclusive) is redacted. Anchors"
+                            + " work best when short and unique. They must appear"
+                            + " verbatim in the document.")
+    private List<TextRange> ranges = new ArrayList<>();
+
+    @Schema(
+            description =
+                    "Rectangular areas to black out, each defined by a page number and bounding box coordinates.")
+    private List<ImageBox> imageBoxes = new ArrayList<>();
+
+    @Schema(
+            description =
+                    "1-indexed page numbers to redact all detected images from. Pass an empty list to redact images from every page. Omit or pass null to skip image redaction entirely.")
+    private List<Integer> redactImagePages;
+
+    @Schema(description = "Redaction style options")
+    private RedactStyle style = new RedactStyle();
+
+    public record TextRange(
+            @Schema(
+                            description =
+                                    "A short, distinctive phrase (5–15 words) that marks where"
+                                            + " redaction begins (inclusive). Must appear verbatim in"
+                                            + " the document — e.g. a section heading or a unique"
+                                            + " sentence fragment.",
+                            requiredMode = Schema.RequiredMode.REQUIRED,
+                            minLength = 1)
+                    String startString,
+            @Schema(
+                            description =
+                                    "A short, distinctive phrase (5–15 words) that marks where"
+                                            + " redaction ends (inclusive). Must appear verbatim in the"
+                                            + " document. Shorter phrases match more reliably.",
+                            requiredMode = Schema.RequiredMode.REQUIRED,
+                            minLength = 1)
+                    String endString) {
+        public TextRange {
+            if (endString == null) endString = "";
+        }
+    }
+
+    public record ImageBox(
+            @Schema(
+                            description = "0-indexed page number (first page = 0).",
+                            requiredMode = Schema.RequiredMode.REQUIRED)
+                    int pageIndex,
+            @Schema(
+                            description =
+                                    "Left x coordinate of the redaction rectangle in PDF user-space points.",
+                            requiredMode = Schema.RequiredMode.REQUIRED)
+                    float x1,
+            @Schema(
+                            description =
+                                    "Top y coordinate of the redaction rectangle in PDF user-space points.",
+                            requiredMode = Schema.RequiredMode.REQUIRED)
+                    float y1,
+            @Schema(
+                            description =
+                                    "Right x coordinate of the redaction rectangle in PDF user-space points.",
+                            requiredMode = Schema.RequiredMode.REQUIRED)
+                    float x2,
+            @Schema(
+                            description =
+                                    "Bottom y coordinate of the redaction rectangle in PDF user-space points.",
+                            requiredMode = Schema.RequiredMode.REQUIRED)
+                    float y2) {}
+
+    public enum RedactionStrategy {
+        AUTO,
+        OVERLAY_ONLY,
+        IMAGE_FINALIZE
+    }
+
+    @Data
+    public static class RedactStyle {
+        @Schema(description = "Hex redaction box color", defaultValue = "#000000")
+        private String color = "#000000";
+
+        @Schema(
+                description = "Extra padding around each box in points",
+                type = "number",
+                defaultValue = "0")
+        private float padding = 0f;
+
+        @Schema(description = "Rasterize output to prevent text extraction", defaultValue = "false")
+        private boolean convertToImage = false;
+
+        @Schema(
+                description = "Execution strategy hint for the redaction pipeline",
+                defaultValue = "AUTO")
+        private RedactionStrategy strategy = RedactionStrategy.AUTO;
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/ApiDocService.java

@@ -63,6 +63,7 @@ public class ApiDocService implements stirling.software.common.service.ToolMetad
         return "http://localhost:" + port + contextPath + "/v1/api-docs";
     }
 
+    @Override
     public List<String> getExtensionTypes(boolean output, String operationName) {
         if (outputToFileTypes.isEmpty()) {
             outputToFileTypes.put("PDF", List.of("pdf"));

app/core/src/main/java/stirling/software/SPDF/utils/SvgOverlayUtil.java

@@ -10,6 +10,7 @@ import org.apache.batik.bridge.GVTBuilder;
 import org.apache.batik.bridge.UserAgent;
 import org.apache.batik.bridge.UserAgentAdapter;
 import org.apache.batik.gvt.GraphicsNode;
+import org.apache.batik.util.ParsedURL;
 import org.apache.batik.util.XMLResourceDescriptor;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
@@ -39,7 +40,16 @@ public class SvgOverlayUtil {
                 svgDoc = factory.createSVGDocument("file:///overlay.svg", inputStream);
             }
 
-            UserAgent userAgent = new UserAgentAdapter();
+            UserAgent userAgent =
+                    new UserAgentAdapter() {
+                        @Override
+                        public void checkLoadExternalResource(
+                                ParsedURL resourceURL, ParsedURL docURL) {
+                            throw new SecurityException(
+                                    "External resource loading is disabled for SVG overlays: "
+                                            + resourceURL);
+                        }
+                    };
             DocumentLoader loader = new DocumentLoader(userAgent);
             BridgeContext ctx = new BridgeContext(userAgent, loader);
             ctx.setDynamicState(BridgeContext.DYNAMIC);

app/core/src/main/java/stirling/software/common/controller/JobController.java

@@ -4,6 +4,7 @@ import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
@@ -22,6 +23,10 @@ import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.cluster.ClusterBackplane;
+import stirling.software.common.cluster.JobStore;
+import stirling.software.common.cluster.JobStoreEntry;
+import stirling.software.common.cluster.StickyMissRecorder;
 import stirling.software.common.model.job.JobResult;
 import stirling.software.common.model.job.ResultFile;
 import stirling.software.common.service.FileStorage;
@@ -30,7 +35,6 @@ import stirling.software.common.service.JobQueue;
 import stirling.software.common.service.TaskManager;
 import stirling.software.common.util.RegexPatternUtils;
 
-/** REST controller for job-related endpoints */
 @RestController
 @RequiredArgsConstructor
 @Slf4j
@@ -42,20 +46,29 @@ public class JobController {
     private final FileStorage fileStorage;
     private final JobQueue jobQueue;
     private final HttpServletRequest request;
+    private final ClusterBackplane clusterBackplane;
+    private final JobStore jobStore;
+
+    // Short-TTL local cache fronting JobStore.get() on the sticky-410 path to avoid a Valkey
+    // HGETALL round-trip on every download retry for the same job.
+    private final JobOwnershipCache ownershipCache = new JobOwnershipCache();
 
     @Autowired(required = false)
     private JobOwnershipService jobOwnershipService;
 
-    /**
-     * Get the status of a job
-     *
-     * @param jobId The job ID
-     * @return The job result
-     */
+    @Autowired(required = false)
+    private StickyMissRecorder stickyMissRecorder;
+
     @GetMapping("/job/{jobId}")
     @Operation(summary = "Get job status")
     public ResponseEntity<?> getJobStatus(@PathVariable("jobId") String jobId) {
-        // Validate job ownership
+        // Sticky-410 must run before user-auth: a 403 here would leak job existence and defeat
+        // LB re-routing. The owner node is where the real auth check should happen.
+        Optional<ResponseEntity<?>> peerOwned = guardNonOwner(jobId);
+        if (peerOwned.isPresent()) {
+            return peerOwned.get();
+        }
+
         if (!validateJobAccess(jobId)) {
             log.warn("Unauthorized attempt to access job status: {}", jobId);
             return ResponseEntity.status(403)
@@ -67,7 +80,6 @@ public class JobController {
             return ResponseEntity.notFound().build();
         }
 
-        // Check if the job is in the queue and add queue information
         if (!result.isComplete() && jobQueue.isJobQueued(jobId)) {
             int position = jobQueue.getJobPosition(jobId);
             Map<String, Object> resultWithQueueInfo =
@@ -82,16 +94,14 @@ public class JobController {
         return ResponseEntity.ok(result);
     }
 
-    /**
-     * Get the result of a job
-     *
-     * @param jobId The job ID
-     * @return The job result
-     */
     @GetMapping("/job/{jobId}/result")
     @Operation(summary = "Get job result")
     public ResponseEntity<?> getJobResult(@PathVariable("jobId") String jobId) {
-        // Validate job ownership
+        Optional<ResponseEntity<?>> peerOwned = guardNonOwner(jobId);
+        if (peerOwned.isPresent()) {
+            return peerOwned.get();
+        }
+
         if (!validateJobAccess(jobId)) {
             log.warn("Unauthorized attempt to access job result: {}", jobId);
             return ResponseEntity.status(403)
@@ -111,7 +121,6 @@ public class JobController {
             return ResponseEntity.badRequest().body("Job failed: " + result.getError());
         }
 
-        // Handle multiple files - return metadata for client to download individually
         if (result.hasMultipleFiles()) {
             return ResponseEntity.ok()
                     .contentType(MediaType.APPLICATION_JSON)
@@ -125,11 +134,11 @@ public class JobController {
                                     result.getAllResultFiles()));
         }
 
-        // Handle single file (download directly)
         if (result.hasFiles() && !result.hasMultipleFiles()) {
             try {
                 List<ResultFile> files = result.getAllResultFiles();
                 ResultFile singleFile = files.get(0);
+
                 byte[] fileContent = fileStorage.retrieveBytes(singleFile.getFileId());
                 return ResponseEntity.ok()
                         .header("Content-Type", singleFile.getContentType())
@@ -147,30 +156,22 @@ public class JobController {
         return ResponseEntity.ok(result.getResult());
     }
 
-    // Admin-only endpoints have been moved to AdminJobController in the proprietary package
-
-    /**
-     * Cancel a job by its ID
-     *
-     * <p>This method should only allow cancellation of jobs that were created by the current user.
-     * The jobId should be part of the user's session or otherwise linked to their identity.
-     *
-     * @param jobId The job ID
-     * @return Response indicating whether the job was cancelled
-     */
     @DeleteMapping("/job/{jobId}")
     @Operation(summary = "Cancel a job")
     public ResponseEntity<?> cancelJob(@PathVariable("jobId") String jobId) {
         log.debug("Request to cancel job: {}", jobId);
 
-        // Validate job ownership
+        Optional<ResponseEntity<?>> peerOwned = guardNonOwner(jobId);
+        if (peerOwned.isPresent()) {
+            return peerOwned.get();
+        }
+
         if (!validateJobAccess(jobId)) {
             log.warn("Unauthorized attempt to cancel job: {}", jobId);
             return ResponseEntity.status(403)
                     .body(Map.of("message", "You are not authorized to cancel this job"));
         }
 
-        // First check if the job is in the queue
         boolean cancelled = false;
         int queuePosition = -1;
 
@@ -180,11 +181,9 @@ public class JobController {
             log.info("Cancelled queued job: {} (was at position {})", jobId, queuePosition);
         }
 
-        // If not in queue or couldn't cancel, try to cancel in TaskManager
         if (!cancelled) {
             JobResult result = taskManager.getJobResult(jobId);
             if (result != null && !result.isComplete()) {
-                // Mark as error with cancellation message
                 taskManager.setError(jobId, "Job was cancelled by user");
                 cancelled = true;
                 log.info("Marked job as cancelled in TaskManager: {}", jobId);
@@ -201,7 +200,6 @@ public class JobController {
                             "queuePosition",
                             queuePosition >= 0 ? queuePosition : "n/a"));
         } else {
-            // Job not found or already complete
             JobResult result = taskManager.getJobResult(jobId);
             if (result == null) {
                 return ResponseEntity.notFound().build();
@@ -215,16 +213,14 @@ public class JobController {
         }
     }
 
-    /**
-     * Get the list of files for a job
-     *
-     * @param jobId The job ID
-     * @return List of files for the job
-     */
     @GetMapping("/job/{jobId}/result/files")
     @Operation(summary = "Get job result files")
     public ResponseEntity<?> getJobFiles(@PathVariable("jobId") String jobId) {
-        // Validate job ownership
+        Optional<ResponseEntity<?>> peerOwned = guardNonOwner(jobId);
+        if (peerOwned.isPresent()) {
+            return peerOwned.get();
+        }
+
         if (!validateJobAccess(jobId)) {
             log.warn("Unauthorized attempt to access job files: {}", jobId);
             return ResponseEntity.status(403)
@@ -252,28 +248,31 @@ public class JobController {
                         "files", files));
     }
 
-    /**
-     * Get metadata for an individual file by its file ID
-     *
-     * @param fileId The file ID
-     * @return The file metadata
-     */
     @GetMapping("/files/{fileId}/metadata")
     @Operation(summary = "Get file metadata")
     public ResponseEntity<?> getFileMetadata(@PathVariable("fileId") String fileId) {
         try {
-            String jobKey = taskManager.findJobKeyByFileId(fileId);
+            String jobKey;
+            try {
+                jobKey = taskManager.findJobKeyByFileId(fileId);
+            } catch (RuntimeException backplaneEx) {
+                return backplaneUnavailable(fileId, backplaneEx);
+            }
             if (jobKey == null) {
                 return ResponseEntity.notFound().build();
             }
 
+            Optional<ResponseEntity<?>> notOwner = guardNonOwner(jobKey);
+            if (notOwner.isPresent()) {
+                return notOwner.get();
+            }
+
             if (!validateJobAccess(jobKey)) {
                 log.warn("Unauthorized attempt to access file metadata: {}", fileId);
                 return ResponseEntity.status(403)
                         .body(Map.of("message", "You are not authorized to access this file"));
             }
 
-            // Find the file metadata from any job that contains this file
             ResultFile resultFile = taskManager.findResultFileByFileId(fileId);
 
             if (resultFile != null) {
@@ -281,12 +280,10 @@ public class JobController {
             }
 
             if (!isSecurityEnabled()) {
-                // Backwards compatibility when ownership service is unavailable
                 if (!fileStorage.fileExists(fileId)) {
                     return ResponseEntity.notFound().build();
                 }
 
-                // File exists but no metadata found, get basic info efficiently
                 long fileSize = fileStorage.getFileSize(fileId);
                 return ResponseEntity.ok(
                         Map.of(
@@ -308,32 +305,31 @@ public class JobController {
         }
     }
 
-    /**
-     * Download an individual file by its file ID
-     *
-     * @param fileId The file ID
-     * @return The file content
-     */
     @GetMapping("/files/{fileId}")
     @Operation(summary = "Download a file")
     public ResponseEntity<?> downloadFile(@PathVariable("fileId") String fileId) {
         try {
-            String jobKey = taskManager.findJobKeyByFileId(fileId);
+            String jobKey;
+            try {
+                jobKey = taskManager.findJobKeyByFileId(fileId);
+            } catch (RuntimeException backplaneEx) {
+                return backplaneUnavailable(fileId, backplaneEx);
+            }
             if (jobKey == null) {
                 return ResponseEntity.notFound().build();
             }
 
+            Optional<ResponseEntity<?>> notOwner = guardNonOwner(jobKey);
+            if (notOwner.isPresent()) {
+                return notOwner.get();
+            }
+
             if (!validateJobAccess(jobKey)) {
                 log.warn("Unauthorized attempt to download file: {}", fileId);
                 return ResponseEntity.status(403)
                         .body(Map.of("message", "You are not authorized to access this file"));
             }
 
-            // Retrieve file content
-            byte[] fileContent = fileStorage.retrieveBytes(fileId);
-
-            // Find the file metadata from any job that contains this file
-            // This is for getting the original filename and content type
             ResultFile resultFile = taskManager.findResultFileByFileId(fileId);
 
             String fileName = resultFile != null ? resultFile.getFileName() : "download";
@@ -342,6 +338,8 @@ public class JobController {
                             ? resultFile.getContentType()
                             : MediaType.APPLICATION_OCTET_STREAM_VALUE;
 
+            byte[] fileContent = fileStorage.retrieveBytes(fileId);
+
             return ResponseEntity.ok()
                     .header("Content-Type", contentType)
                     .header("Content-Disposition", createContentDispositionHeader(fileName))
@@ -357,11 +355,88 @@ public class JobController {
     }
 
     /**
-     * Create Content-Disposition header with UTF-8 filename support
-     *
-     * @param fileName The filename to encode
-     * @return Content-Disposition header value
+     * Returns 410 Gone when the job is owned by a peer node, empty otherwise. Uses a short-TTL
+     * local cache to avoid repeated Valkey lookups on the hot download path. When the backplane is
+     * unreachable, a locally-held job is still served and anything else gets a retryable 503.
      */
+    private Optional<ResponseEntity<?>> guardNonOwner(String jobId) {
+        if (clusterBackplane == null || jobStore == null) {
+            return Optional.empty();
+        }
+        Optional<JobStoreEntry> entry;
+        Optional<Optional<JobStoreEntry>> cached = ownershipCache.get(jobId);
+        if (cached.isPresent()) {
+            entry = cached.get();
+        } else {
+            try {
+                entry = jobStore.get(jobId);
+            } catch (RuntimeException ex) {
+                // Backplane unreachable: if we hold the job locally serve it, otherwise return a
+                // retryable 503 (same contract as the file endpoints) instead of a misleading 404.
+                if (taskManager.getJobResult(jobId) == null) {
+                    return Optional.of(backplaneUnavailable(jobId, ex));
+                }
+                log.warn(
+                        "JobStore lookup failed for jobId={}; serving locally-held job: {}",
+                        jobId,
+                        ex.getMessage());
+                return Optional.empty();
+            }
+            ownershipCache.put(jobId, entry);
+        }
+        if (entry.isEmpty()) {
+            return Optional.empty();
+        }
+        String owner = entry.get().owningNodeId();
+        if (owner == null || owner.isBlank()) {
+            return Optional.empty();
+        }
+        String localId = clusterBackplane.localNodeId();
+        if (owner.equals(localId)) {
+            return Optional.empty();
+        }
+        log.info(
+                "Sticky-session miss for jobId={} (owner={}, local={}); returning 410 so client"
+                        + " retries via LB affinity",
+                jobId,
+                owner,
+                localId);
+        if (stickyMissRecorder != null) {
+            stickyMissRecorder.recordStickyMiss();
+        }
+        return Optional.of(
+                ResponseEntity.status(410)
+                        .header("Retry-After", "0")
+                        .body(
+                                Map.of(
+                                        "message",
+                                        "Result lives on another node. Retry to be routed there"
+                                                + " by the load balancer's sticky-session"
+                                                + " affinity, or re-run the job.",
+                                        "ownedBy",
+                                        owner,
+                                        "currentNode",
+                                        localId == null ? "" : localId)));
+    }
+
+    /**
+     * When the backplane is unreachable we cannot resolve ownership or existence, and serving
+     * without that check would be unsafe - so return a retryable 503 (consistent with the
+     * sticky-410 retry model) rather than a misleading 404 or a generic 500.
+     */
+    private ResponseEntity<?> backplaneUnavailable(String id, RuntimeException ex) {
+        log.warn(
+                "Backplane lookup failed for {}; returning 503 (retryable): {}",
+                id,
+                ex.getMessage());
+        return ResponseEntity.status(503)
+                .header("Retry-After", "1")
+                .body(
+                        Map.of(
+                                "message",
+                                "Cluster backplane temporarily unavailable; retry shortly."));
+    }
+
     private String createContentDispositionHeader(String fileName) {
         try {
             String encodedFileName =
@@ -371,19 +446,11 @@ public class JobController {
                             .replaceAll("%20"); // URLEncoder uses + for spaces, but we want %20
             return "attachment; filename=\"" + fileName + "\"; filename*=UTF-8''" + encodedFileName;
         } catch (Exception e) {
-            // Fallback to basic filename if encoding fails
             return "attachment; filename=\"" + fileName + "\"";
         }
     }
 
-    /**
-     * Validate that the current user has access to the given job.
-     *
-     * @param jobId the job identifier to validate
-     * @return true if user has access, false otherwise
-     */
     private boolean validateJobAccess(String jobId) {
-        // If JobOwnershipService is available (security enabled), use it
         if (jobOwnershipService != null) {
             try {
                 return jobOwnershipService.validateJobAccess(jobId);
@@ -393,8 +460,6 @@ public class JobController {
             }
         }
 
-        // Security disabled - allow all access (backwards compatibility)
-        // When security is not enabled, any user can access any job by jobId
         return true;
     }
 }

app/core/src/main/java/stirling/software/common/controller/JobOwnershipCache.java

@@ -0,0 +1,47 @@
+package stirling.software.common.controller;
+
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+
+import stirling.software.common.cluster.JobStoreEntry;
+
+/**
+ * Process-local TTL cache for {@link JobStoreEntry} lookups to suppress redundant Valkey HGETALL
+ * round-trips on the hot result-download path (sticky-410 ownership check).
+ *
+ * <p>5 second TTL is short enough that a job's lifecycle transitions (RUNNING -> COMPLETE -> TTL
+ * expiry) propagate to all nodes within the LB's sticky-session window, and short enough that a
+ * mistakenly-cached "not found" recovers quickly when an entry actually shows up. Cap the map at
+ * 2048 entries to bound memory; eviction is best-effort (clear-and-restart) since the cache is
+ * advisory.
+ */
+final class JobOwnershipCache {
+
+    private static final long TTL_NANOS = 5L * 1_000_000_000L; // 5 s
+    private static final int MAX_ENTRIES = 2048;
+
+    private final ConcurrentMap<String, Entry> entries = new ConcurrentHashMap<>();
+
+    Optional<Optional<JobStoreEntry>> get(String jobId) {
+        Entry e = entries.get(jobId);
+        if (e == null) {
+            return Optional.empty();
+        }
+        if (System.nanoTime() - e.storedAtNanos > TTL_NANOS) {
+            entries.remove(jobId, e);
+            return Optional.empty();
+        }
+        return Optional.of(e.value);
+    }
+
+    void put(String jobId, Optional<JobStoreEntry> value) {
+        if (entries.size() >= MAX_ENTRIES) {
+            // Best-effort eviction; under burst the cache simply rebuilds.
+            entries.clear();
+        }
+        entries.put(jobId, new Entry(value, System.nanoTime()));
+    }
+
+    private record Entry(Optional<JobStoreEntry> value, long storedAtNanos) {}
+}

app/core/src/main/resources/application.properties

@@ -33,7 +33,7 @@ spring.security.filter.dispatcher-types=REQUEST,ERROR
 # Response compression
 server.compression.enabled=true
 server.compression.min-response-size=1024
-server.compression.mime-types=application/json,application/xml,text/html,text/plain,text/css,application/javascript,image/svg+xml,application/x-font-ttf,font/opentype,application/vnd.ms-fontobject,font/woff,font/woff2,application/font-woff,application/font-woff2
+server.compression.mime-types=application/json,application/xml,text/html,text/plain,text/css,application/javascript,image/svg+xml,application/x-font-ttf,font/opentype,application/vnd.ms-fontobject,font/woff,font/woff2,application/font-woff,application/font-woff2,application/wasm
 
 spring.web.error.path=/error
 spring.web.error.whitelabel.enabled=false
@@ -93,6 +93,11 @@ posthog.host=https://eu.i.posthog.com
 
 spring.main.allow-bean-definition-overriding=true
 
+# spring-data-redis is on the classpath only for the optional Valkey backplane (which wires its own
+# factory); exclude Spring Boot's stock Redis auto-config so a default install doesn't create a dead
+# localhost:6379 factory that flips /actuator/health to DOWN.
+spring.autoconfigure.exclude=org.springframework.boot.data.redis.autoconfigure.DataRedisAutoConfiguration,org.springframework.boot.data.redis.autoconfigure.DataRedisReactiveAutoConfiguration
+
 # Set up a consistent temporary directory location
 java.io.tmpdir=${stirling.tempfiles.directory:${java.io.tmpdir}/stirling-pdf}
 

app/core/src/main/resources/settings.yml.template

@@ -364,6 +364,39 @@ aiEngine:
   url: http://localhost:5001 # URL of the Python AI engine
   timeoutSeconds: 120 # Timeout in seconds for AI engine requests
 
+policies:
+  # Folder automations can read from and write to the directories you allow here, so treat this as a
+  # security boundary. Leave allowedFolderRoots empty (default) to disable folder sources/outputs
+  # entirely; list absolute directories to permit folder access only within them. Stirling's own
+  # config directory is always off-limits, and folder access is always disabled in SaaS mode.
+  allowedFolderRoots: [] # e.g. ["/data/inbox", "/data/outbox"]
+  scheduleSweepSeconds: 60 # How often (seconds) scheduled policies are checked for being due
+  watchReconcileSeconds: 300 # How often (seconds) folder-watch re-syncs watches and re-runs as a safety net for missed events
+  watchQuietPeriodMs: 500 # How long (ms) folder-watch coalesces a burst of file events into a single run
+  streamTimeoutMs: 1800000 # SSE timeout (ms) for live run-progress streams
+  runExpiryMinutes: 30 # How long (minutes) a finished run's in-memory state is kept before eviction
+
+# Model Context Protocol (MCP) server. Exposes Stirling's PDF tools (grouped by namespace)
+# plus the AI agents to MCP clients (Inspector, Claude Desktop, custom). OAuth-protected.
+# Disabled by default - enable explicitly per deployment after configuring mcp.auth.
+mcp:
+  enabled: false # Master switch. 'false' (default) means no /mcp endpoint, no metadata, no beans wired.
+  scopesEnabled: true # Enforce mcp.tools.read / mcp.tools.write scopes derived from operation category
+  allowedOperations: [] # Tool allow-list (operation ids, e.g. ['compress-pdf']). Empty = all. When set, ONLY these are exposed over MCP.
+  blockedOperations: [] # Tool deny-list (operation ids). Always removed from MCP even if otherwise allowed.
+  auth:
+    mode: oauth # 'oauth' (full OAuth2 resource server) or 'apikey' (Stirling per-user API key via X-API-KEY header; no external IdP needed - the low-friction self-host option)
+    issuerUri: "" # OAuth2 issuer URI (e.g. http://localhost:9000). Required when mode=oauth.
+    jwksUri: "" # JWKS URI. Blank -> derived from issuer's /.well-known/openid-configuration.
+    resourceId: "" # RFC 8707 resource identifier of THIS MCP server (e.g. http://localhost:8080/mcp).
+                   # Required: tokens must list this id in `aud` or the request is rejected.
+    acceptedAudiences: [] # Extra `aud` values accepted on top of resourceId. Empty = strict RFC 8707.
+                          # For IdPs that cannot mint resource audiences (Supabase OAuth server always
+                          # issues aud=authenticated) list that audience here, e.g. ['authenticated'].
+    usernameClaim: sub # JWT claim matched against a Stirling username (e.g. 'sub', 'email', 'preferred_username')
+    requireExistingAccount: true # Reject tokens whose subject has no enabled Stirling account (recommended)
+  engineCapabilityRefreshMinutes: 5 # How often to refresh the AI capabilities manifest from the engine
+
 # Cluster configuration. NOT YET ENABLED - scaffolding for later work. Leave at defaults.
 cluster:
   enabled: false # Master switch. 'false' (default) wires the in-process backplane and skips all cluster checks. Single-instance installs do not need to change anything here.

app/core/src/main/resources/static/3rdPartyLicenses.json

@@ -24,7 +24,21 @@
         {
             "moduleName": "com.bucket4j:bucket4j_jdk17-core",
             "moduleUrl": "http://github.com/bucket4j/bucket4j/bucket4j_jdk17-core",
-            "moduleVersion": "8.18.0",
+            "moduleVersion": "8.19.0",
+            "moduleLicense": "The Apache Software License, Version 2.0",
+            "moduleLicenseUrl": "http://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "com.bucket4j:bucket4j_jdk17-lettuce",
+            "moduleUrl": "http://github.com/bucket4j/bucket4j/bucket4j_jdk17-redis/bucket4j_jdk17-lettuce",
+            "moduleVersion": "8.19.0",
+            "moduleLicense": "The Apache Software License, Version 2.0",
+            "moduleLicenseUrl": "http://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "com.bucket4j:bucket4j_jdk17-redis-common",
+            "moduleUrl": "http://github.com/bucket4j/bucket4j/bucket4j_jdk17-redis/bucket4j_jdk17-redis-common",
+            "moduleVersion": "8.19.0",
             "moduleLicense": "The Apache Software License, Version 2.0",
             "moduleLicenseUrl": "http://www.apache.org/licenses/LICENSE-2.0"
         },
@@ -297,6 +311,48 @@
             "moduleLicense": "MIT License",
             "moduleLicenseUrl": "https://opensource.org/licenses/mit-license.php"
         },
+        {
+            "moduleName": "com.stirling:jpdfium",
+            "moduleUrl": "https://github.com/Stirling-Tools/JPDFium",
+            "moduleVersion": "1.0.2",
+            "moduleLicense": "MIT License",
+            "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+        },
+        {
+            "moduleName": "com.stirling:jpdfium-natives-darwin-arm64",
+            "moduleUrl": "https://github.com/Stirling-Tools/JPDFium",
+            "moduleVersion": "1.0.2",
+            "moduleLicense": "MIT License",
+            "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+        },
+        {
+            "moduleName": "com.stirling:jpdfium-natives-darwin-x64",
+            "moduleUrl": "https://github.com/Stirling-Tools/JPDFium",
+            "moduleVersion": "1.0.2",
+            "moduleLicense": "MIT License",
+            "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+        },
+        {
+            "moduleName": "com.stirling:jpdfium-natives-linux-arm64",
+            "moduleUrl": "https://github.com/Stirling-Tools/JPDFium",
+            "moduleVersion": "1.0.2",
+            "moduleLicense": "MIT License",
+            "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+        },
+        {
+            "moduleName": "com.stirling:jpdfium-natives-linux-x64",
+            "moduleUrl": "https://github.com/Stirling-Tools/JPDFium",
+            "moduleVersion": "1.0.2",
+            "moduleLicense": "MIT License",
+            "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+        },
+        {
+            "moduleName": "com.stirling:jpdfium-natives-windows-x64",
+            "moduleUrl": "https://github.com/Stirling-Tools/JPDFium",
+            "moduleVersion": "1.0.2",
+            "moduleLicense": "MIT License",
+            "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+        },
         {
             "moduleName": "com.sun.activation:jakarta.activation",
             "moduleUrl": "https://www.eclipse.org",
@@ -640,6 +696,13 @@
             "moduleLicense": "Apache-2.0",
             "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
         },
+        {
+            "moduleName": "io.lettuce:lettuce-core",
+            "moduleUrl": "https://github.com/redis/lettuce",
+            "moduleVersion": "6.8.2.RELEASE",
+            "moduleLicense": "MIT",
+            "moduleLicenseUrl": "https://github.com/redis/lettuce/blob/main/LICENSE"
+        },
         {
             "moduleName": "io.micrometer:micrometer-commons",
             "moduleUrl": "https://github.com/micrometer-metrics/micrometer",
@@ -675,6 +738,125 @@
             "moduleLicense": "The Apache Software License, Version 2.0",
             "moduleLicenseUrl": "http://www.apache.org/licenses/LICENSE-2.0.txt"
         },
+        {
+            "moduleName": "io.netty:netty-buffer",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec-base",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec-compression",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec-dns",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec-http",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec-http2",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec-marshalling",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-codec-protobuf",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-common",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-handler",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-resolver",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-resolver-dns",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-transport",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-transport-classes-epoll",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.netty:netty-transport-native-unix-common",
+            "moduleUrl": "https://netty.io/",
+            "moduleVersion": "4.2.12.Final",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "io.projectreactor:reactor-core",
+            "moduleUrl": "https://github.com/reactor/reactor-core",
+            "moduleVersion": "3.8.5",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0.txt"
+        },
         {
             "moduleName": "io.prometheus:prometheus-metrics-config",
             "moduleVersion": "1.4.3",
@@ -1017,6 +1199,13 @@
             "moduleLicense": "Apache License, Version 2.0",
             "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0.txt"
         },
+        {
+            "moduleName": "org.apache.httpcomponents:httpclient",
+            "moduleUrl": "http://hc.apache.org/httpcomponents-client",
+            "moduleVersion": "4.5.13",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "http://www.apache.org/licenses/LICENSE-2.0.txt"
+        },
         {
             "moduleName": "org.apache.httpcomponents:httpclient",
             "moduleUrl": "http://hc.apache.org/httpcomponents-client-ga",
@@ -1281,21 +1470,21 @@
         {
             "moduleName": "org.bouncycastle:bcpkix-jdk18on",
             "moduleUrl": "https://www.bouncycastle.org/download/bouncy-castle-java/",
-            "moduleVersion": "1.83",
+            "moduleVersion": "1.84",
             "moduleLicense": "Bouncy Castle Licence",
             "moduleLicenseUrl": "https://www.bouncycastle.org/licence.html"
         },
         {
             "moduleName": "org.bouncycastle:bcprov-jdk18on",
             "moduleUrl": "https://www.bouncycastle.org/download/bouncy-castle-java/",
-            "moduleVersion": "1.83",
+            "moduleVersion": "1.84",
             "moduleLicense": "Bouncy Castle Licence",
             "moduleLicenseUrl": "https://www.bouncycastle.org/licence.html"
         },
         {
             "moduleName": "org.bouncycastle:bcutil-jdk18on",
             "moduleUrl": "https://www.bouncycastle.org/download/bouncy-castle-java/",
-            "moduleVersion": "1.83",
+            "moduleVersion": "1.84",
             "moduleLicense": "Bouncy Castle Licence",
             "moduleLicenseUrl": "https://www.bouncycastle.org/licence.html"
         },
@@ -1787,6 +1976,20 @@
             "moduleLicense": "BSD-2-Clause",
             "moduleLicenseUrl": "https://jdbc.postgresql.org/about/license.html"
         },
+        {
+            "moduleName": "org.postgresql:postgresql",
+            "moduleUrl": "https://jdbc.postgresql.org/",
+            "moduleVersion": "42.7.11",
+            "moduleLicense": "BSD-2-Clause",
+            "moduleLicenseUrl": "https://jdbc.postgresql.org/about/license.html"
+        },
+        {
+            "moduleName": "org.reactivestreams:reactive-streams",
+            "moduleUrl": "http://www.reactive-streams.org/",
+            "moduleVersion": "1.0.4",
+            "moduleLicense": "MIT-0",
+            "moduleLicenseUrl": "https://spdx.org/licenses/MIT-0.html"
+        },
         {
             "moduleName": "org.simplejavamail:core-module",
             "moduleVersion": "8.12.6",
@@ -1900,6 +2103,13 @@
             "moduleLicense": "Apache License, Version 2.0",
             "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
         },
+        {
+            "moduleName": "org.springframework.boot:spring-boot-data-redis",
+            "moduleUrl": "https://spring.io/projects/spring-boot",
+            "moduleVersion": "4.0.6",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
         {
             "moduleName": "org.springframework.boot:spring-boot-devtools",
             "moduleUrl": "https://spring.io/projects/spring-boot",
@@ -1977,6 +2187,13 @@
             "moduleLicense": "Apache License, Version 2.0",
             "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
         },
+        {
+            "moduleName": "org.springframework.boot:spring-boot-netty",
+            "moduleUrl": "https://spring.io/projects/spring-boot",
+            "moduleVersion": "4.0.6",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
         {
             "moduleName": "org.springframework.boot:spring-boot-persistence",
             "moduleUrl": "https://spring.io/projects/spring-boot",
@@ -2047,6 +2264,13 @@
             "moduleLicense": "Apache License, Version 2.0",
             "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
         },
+        {
+            "moduleName": "org.springframework.boot:spring-boot-starter-data-redis",
+            "moduleUrl": "https://spring.io/projects/spring-boot",
+            "moduleVersion": "4.0.6",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
         {
             "moduleName": "org.springframework.boot:spring-boot-starter-jackson",
             "moduleUrl": "https://spring.io/projects/spring-boot",
@@ -2159,6 +2383,19 @@
             "moduleLicense": "Apache License, Version 2.0",
             "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
         },
+        {
+            "moduleName": "org.springframework.data:spring-data-keyvalue",
+            "moduleVersion": "4.0.5",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
+        {
+            "moduleName": "org.springframework.data:spring-data-redis",
+            "moduleUrl": "https://spring.io/projects/spring-data-redis",
+            "moduleVersion": "4.0.5",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
         {
             "moduleName": "org.springframework.security:spring-security-config",
             "moduleUrl": "https://spring.io/projects/spring-security",
@@ -2285,6 +2522,13 @@
             "moduleLicense": "Apache License, Version 2.0",
             "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
         },
+        {
+            "moduleName": "org.springframework:spring-oxm",
+            "moduleUrl": "https://github.com/spring-projects/spring-framework",
+            "moduleVersion": "7.0.7",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+        },
         {
             "moduleName": "org.springframework:spring-tx",
             "moduleUrl": "https://github.com/spring-projects/spring-framework",
@@ -2384,6 +2628,226 @@
             "moduleLicense": "Apache License, Version 2.0",
             "moduleLicenseUrl": "http://www.apache.org/licenses/LICENSE-2.0.txt"
         },
+        {
+            "moduleName": "redis.clients.authentication:redis-authx-core",
+            "moduleUrl": "https://github.com/redis/redis-authx-core",
+            "moduleVersion": "0.1.1-beta2",
+            "moduleLicense": "MIT",
+            "moduleLicenseUrl": "https://github.com/redis/redis-authx-core/blob/master/LICENSE"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:annotations",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:apache-client",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:arns",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:auth",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:aws-core",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:aws-query-protocol",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:aws-xml-protocol",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:checksums",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:checksums-spi",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:crt-core",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:endpoints-spi",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:http-auth",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:http-auth-aws",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:http-auth-aws-eventstream",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:http-auth-spi",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:http-client-spi",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:identity-spi",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:json-utils",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:metrics-spi",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:netty-nio-client",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:profiles",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:protocol-core",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:regions",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:retries",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:retries-spi",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:s3",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:sdk-core",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:third-party-jackson-core",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:url-connection-client",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:utils",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.awssdk:utils-lite",
+            "moduleUrl": "https://aws.amazon.com/sdkforjava",
+            "moduleVersion": "2.44.12",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
+        {
+            "moduleName": "software.amazon.eventstream:eventstream",
+            "moduleUrl": "https://github.com/awslabs/aws-eventstream-java",
+            "moduleVersion": "1.0.1",
+            "moduleLicense": "Apache License, Version 2.0",
+            "moduleLicenseUrl": "https://aws.amazon.com/apache2.0"
+        },
         {
             "moduleName": "technology.tabula:tabula",
             "moduleUrl": "http://github.com/tabulapdf/tabula-java",

app/core/src/test/java/stirling/software/SPDF/controller/api/RearrangePagesPDFControllerTest.java

@@ -4,10 +4,14 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.*;
 
+import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.List;
 
+import org.apache.pdfbox.Loader;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.junit.jupiter.api.BeforeEach;
@@ -56,6 +60,38 @@ class RearrangePagesPDFControllerTest {
                 "fileInput", "test.pdf", MediaType.APPLICATION_PDF_VALUE, new byte[] {1, 2, 3});
     }
 
+    /** Build a real, in-memory PDDocument with the requested number of blank pages. */
+    private PDDocument buildRealPdf(int pageCount) throws IOException {
+        PDDocument doc = new PDDocument();
+        for (int i = 0; i < pageCount; i++) {
+            doc.addPage(new PDPage());
+        }
+        return doc;
+    }
+
+    /**
+     * Returns the underlying {@link org.apache.pdfbox.cos.COSDictionary} for each page in document
+     * order. PDPageTree returns a fresh PDPage wrapper per get(), so comparing wrappers with
+     * assertSame is unreliable - the COSDictionary identity is the stable handle.
+     */
+    private List<Object> snapshotCosPages(PDDocument doc) {
+        List<Object> snapshot = new ArrayList<>();
+        for (PDPage p : doc.getPages()) {
+            snapshot.add(p.getCOSObject());
+        }
+        return snapshot;
+    }
+
+    private List<Object> reloadAndSnapshot(ResponseEntity<Resource> response) throws IOException {
+        try (var in = response.getBody().getInputStream();
+                var baos = new ByteArrayOutputStream()) {
+            in.transferTo(baos);
+            try (PDDocument out = Loader.loadPDF(baos.toByteArray())) {
+                return snapshotCosPages(out);
+            }
+        }
+    }
+
     @Test
     void testDeletePages_Success() throws IOException {
         MockMultipartFile file = createMockPdf();
@@ -83,27 +119,23 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("REVERSE_ORDER");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page0 = mock(PDPage.class);
-        PDPage page1 = mock(PDPage.class);
-        PDPage page2 = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(3)) {
+            List<Object> originals = snapshotCosPages(realDoc);
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(3);
-        when(mockDoc.getPage(0)).thenReturn(page0);
-        when(mockDoc.getPage(1)).thenReturn(page1);
-        when(mockDoc.getPage(2)).thenReturn(page2);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        assertEquals(200, response.getStatusCode().value());
-        verify(mockNewDoc).addPage(page2);
-        verify(mockNewDoc).addPage(page1);
-        verify(mockNewDoc).addPage(page0);
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            List<Object> finalOrder = reloadAndSnapshot(response);
+            assertEquals(3, finalOrder.size());
+            // We can no longer compare references after a save/reload, so compare via
+            // the in-memory snapshot taken *after* the controller mutated the source.
+            List<Object> mutatedSource = snapshotCosPages(realDoc);
+            assertSame(originals.get(2), mutatedSource.get(0));
+            assertSame(originals.get(1), mutatedSource.get(1));
+            assertSame(originals.get(0), mutatedSource.get(2));
+        }
     }
 
     @Test
@@ -114,25 +146,18 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("REMOVE_FIRST");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page0 = mock(PDPage.class);
-        PDPage page1 = mock(PDPage.class);
-        PDPage page2 = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(3)) {
+            List<Object> originals = snapshotCosPages(realDoc);
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(3);
-        when(mockDoc.getPage(1)).thenReturn(page1);
-        when(mockDoc.getPage(2)).thenReturn(page2);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        verify(mockNewDoc).addPage(page1);
-        verify(mockNewDoc).addPage(page2);
-        verify(mockNewDoc, never()).addPage(page0);
+            assertNotNull(response);
+            List<Object> mutated = snapshotCosPages(realDoc);
+            assertEquals(2, mutated.size());
+            assertSame(originals.get(1), mutated.get(0));
+            assertSame(originals.get(2), mutated.get(1));
+        }
     }
 
     @Test
@@ -143,23 +168,18 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("REMOVE_LAST");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page0 = mock(PDPage.class);
-        PDPage page1 = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(3)) {
+            List<Object> originals = snapshotCosPages(realDoc);
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(3);
-        when(mockDoc.getPage(0)).thenReturn(page0);
-        when(mockDoc.getPage(1)).thenReturn(page1);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        verify(mockNewDoc).addPage(page0);
-        verify(mockNewDoc).addPage(page1);
+            assertNotNull(response);
+            List<Object> mutated = snapshotCosPages(realDoc);
+            assertEquals(2, mutated.size());
+            assertSame(originals.get(0), mutated.get(0));
+            assertSame(originals.get(1), mutated.get(1));
+        }
     }
 
     @Test
@@ -170,21 +190,19 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("REMOVE_FIRST_AND_LAST");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page1 = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(4)) {
+            List<Object> originals = snapshotCosPages(realDoc);
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(4);
-        when(mockDoc.getPage(1)).thenReturn(page1);
-        when(mockDoc.getPage(2)).thenReturn(page1);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        assertEquals(200, response.getStatusCode().value());
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            List<Object> mutated = snapshotCosPages(realDoc);
+            assertEquals(2, mutated.size());
+            assertSame(originals.get(1), mutated.get(0));
+            assertSame(originals.get(2), mutated.get(1));
+        }
     }
 
     @Test
@@ -195,23 +213,15 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("DUPLEX_SORT");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page0 = mock(PDPage.class);
-        PDPage page1 = mock(PDPage.class);
-        PDPage page2 = mock(PDPage.class);
-        PDPage page3 = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(4)) {
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(4);
-        when(mockDoc.getPage(anyInt())).thenReturn(page0);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        assertEquals(200, response.getStatusCode().value());
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            assertEquals(4, realDoc.getNumberOfPages());
+        }
     }
 
     @Test
@@ -222,20 +232,15 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("BOOKLET_SORT");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(4)) {
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(4);
-        when(mockDoc.getPage(anyInt())).thenReturn(page);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        assertEquals(200, response.getStatusCode().value());
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            assertEquals(4, realDoc.getNumberOfPages());
+        }
     }
 
     @Test
@@ -246,20 +251,15 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("ODD_EVEN_SPLIT");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(4)) {
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(4);
-        when(mockDoc.getPage(anyInt())).thenReturn(page);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        assertEquals(200, response.getStatusCode().value());
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            assertEquals(4, realDoc.getNumberOfPages());
+        }
     }
 
     @Test
@@ -270,24 +270,20 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("3,1,2");
         request.setCustomMode("custom");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page0 = mock(PDPage.class);
-        PDPage page1 = mock(PDPage.class);
-        PDPage page2 = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(3)) {
+            List<Object> originals = snapshotCosPages(realDoc);
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(3);
-        when(mockDoc.getPage(0)).thenReturn(page0);
-        when(mockDoc.getPage(1)).thenReturn(page1);
-        when(mockDoc.getPage(2)).thenReturn(page2);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        assertEquals(200, response.getStatusCode().value());
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            List<Object> mutated = snapshotCosPages(realDoc);
+            assertEquals(3, mutated.size());
+            assertSame(originals.get(2), mutated.get(0));
+            assertSame(originals.get(0), mutated.get(1));
+            assertSame(originals.get(1), mutated.get(2));
+        }
     }
 
     @Test
@@ -298,21 +294,15 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("3");
         request.setCustomMode("DUPLICATE");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(2)) {
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(2);
-        when(mockDoc.getPage(anyInt())).thenReturn(page);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        // 2 pages * 3 duplicates = 6 addPage calls
-        verify(mockNewDoc, times(6)).addPage(page);
+            assertNotNull(response);
+            // 2 pages * 3 duplicates = 6 final pages
+            assertEquals(6, realDoc.getNumberOfPages());
+        }
     }
 
     @Test
@@ -323,19 +313,14 @@ class RearrangePagesPDFControllerTest {
         request.setPageNumbers("");
         request.setCustomMode("SIDE_STITCH_BOOKLET_SORT");
 
-        PDDocument mockDoc = mock(PDDocument.class);
-        PDDocument mockNewDoc = mock(PDDocument.class);
-        PDPage page = mock(PDPage.class);
+        try (PDDocument realDoc = buildRealPdf(4)) {
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
 
-        when(pdfDocumentFactory.load(file)).thenReturn(mockDoc);
-        when(mockDoc.getNumberOfPages()).thenReturn(4);
-        when(mockDoc.getPage(anyInt())).thenReturn(page);
-        when(pdfDocumentFactory.createNewDocumentBasedOnOldDocument(mockDoc))
-                .thenReturn(mockNewDoc);
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
 
-        ResponseEntity<Resource> response = controller.rearrangePages(request);
-
-        assertNotNull(response);
-        assertEquals(200, response.getStatusCode().value());
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            assertEquals(4, realDoc.getNumberOfPages());
+        }
     }
 }

app/core/src/test/java/stirling/software/SPDF/controller/api/misc/OverlayImageControllerTest.java

@@ -32,6 +32,7 @@ import org.springframework.mock.web.MockMultipartFile;
 
 import stirling.software.SPDF.model.api.misc.OverlayImageRequest;
 import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.SvgSanitizer;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
@@ -52,6 +53,7 @@ class OverlayImageControllerTest {
 
     @Mock private CustomPDFDocumentFactory pdfDocumentFactory;
     @Mock private TempFileManager tempFileManager;
+    @Mock private SvgSanitizer svgSanitizer;
 
     @InjectMocks private OverlayImageController controller;
 
@@ -205,6 +207,52 @@ class OverlayImageControllerTest {
         mockDoc.close();
     }
 
+    @Test
+    void overlayImage_svgInput_sanitizedBeforeOverlay() throws Exception {
+        byte[] maliciousSvg =
+                ("<svg xmlns=\"http://www.w3.org/2000/svg\""
+                                + " xmlns:xlink=\"http://www.w3.org/1999/xlink\""
+                                + " width=\"10\" height=\"10\">"
+                                + "<image x=\"0\" y=\"0\" width=\"10\" height=\"10\""
+                                + " xlink:href=\"file:///etc/passwd\"/>"
+                                + "</svg>")
+                        .getBytes();
+        byte[] sanitized =
+                ("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"10\" height=\"10\">"
+                                + "<image x=\"0\" y=\"0\" width=\"10\" height=\"10\"/>"
+                                + "</svg>")
+                        .getBytes();
+        when(svgSanitizer.sanitize(maliciousSvg)).thenReturn(sanitized);
+
+        MockMultipartFile svgFile =
+                new MockMultipartFile("imageFile", "overlay.svg", "image/svg+xml", maliciousSvg);
+        OverlayImageRequest request = new OverlayImageRequest();
+        request.setFileInput(pdfFile);
+        request.setImageFile(svgFile);
+        request.setX(0);
+        request.setY(0);
+        request.setEveryPage(false);
+
+        PDDocument mockDoc = new PDDocument();
+        mockDoc.addPage(new PDPage(PDRectangle.A4));
+        when(pdfDocumentFactory.load(any(byte[].class))).thenReturn(mockDoc);
+
+        try (MockedStatic<WebResponseUtils> mockedWebResponse =
+                mockStatic(WebResponseUtils.class)) {
+            mockedWebResponse
+                    .when(
+                            () ->
+                                    WebResponseUtils.pdfFileToWebResponse(
+                                            any(TempFile.class), anyString()))
+                    .thenReturn(streamingOk("result".getBytes()));
+
+            controller.overlayImage(request);
+        }
+        mockDoc.close();
+
+        verify(svgSanitizer).sanitize(maliciousSvg);
+    }
+
     @Test
     void overlayImage_withCoordinates_usesXY() throws Exception {
         OverlayImageRequest request = new OverlayImageRequest();

app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerTest.java

@@ -37,7 +37,6 @@ import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
-import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.mockito.junit.jupiter.MockitoSettings;
@@ -77,8 +76,11 @@ class RedactControllerTest {
 
     @Mock private CustomPDFDocumentFactory pdfDocumentFactory;
     @Mock private TempFileManager tempFileManager;
+    @Mock private RedactExecuteService redactExecuteService;
 
-    @InjectMocks private RedactController redactController;
+    private TextRedactionService textRedactionService;
+    private ManualRedactionService manualRedactionService;
+    private RedactController redactController;
 
     private MockMultipartFile mockPdfFile;
     private PDDocument mockDocument;
@@ -201,7 +203,17 @@ class RedactControllerTest {
                 .save(any(File.class));
         doNothing().when(mockDocument).close();
 
-        // Initialize a real document for unit tests
+        // Build real service instances so tests exercise actual logic
+        textRedactionService = new TextRedactionService();
+        manualRedactionService = new ManualRedactionService(tempFileManager);
+        redactController =
+                new RedactController(
+                        pdfDocumentFactory,
+                        tempFileManager,
+                        manualRedactionService,
+                        textRedactionService,
+                        redactExecuteService);
+
         setupRealDocument();
     }
 
@@ -819,9 +831,9 @@ class RedactControllerTest {
             contentStream.newLineAtOffset(50, 750);
 
             contentStream.showText("This is ");
-            contentStream.newLineAtOffset(-10, 0); // Simulate positioning
+            contentStream.newLineAtOffset(-10, 0);
             contentStream.showText("secret");
-            contentStream.newLineAtOffset(10, 0); // Reset positioning
+            contentStream.newLineAtOffset(10, 0);
             contentStream.showText(" information");
             contentStream.endText();
         }
@@ -1005,7 +1017,7 @@ class RedactControllerTest {
             contentStream.showText("Original content");
             contentStream.endText();
         }
-        return redactController.createTokensWithoutTargetText(
+        return textRedactionService.createTokensWithoutTargetText(
                 realDocument, pageForTokenExtraction, Collections.emptySet(), false, false);
     }
 
@@ -1016,28 +1028,28 @@ class RedactControllerTest {
         @Test
         @DisplayName("Should decode valid hex color with hash")
         void decodeValidHexColorWithHash() {
-            Color result = redactController.decodeOrDefault("#FF0000");
+            Color result = ManualRedactionService.decodeOrDefault("#FF0000");
             assertEquals(Color.RED, result);
         }
 
         @Test
         @DisplayName("Should decode valid hex color without hash")
         void decodeValidHexColorWithoutHash() {
-            Color result = redactController.decodeOrDefault("FF0000");
+            Color result = ManualRedactionService.decodeOrDefault("FF0000");
             assertEquals(Color.RED, result);
         }
 
         @Test
         @DisplayName("Should default to black for null color")
         void defaultToBlackForNullColor() {
-            Color result = redactController.decodeOrDefault(null);
+            Color result = ManualRedactionService.decodeOrDefault(null);
             assertEquals(Color.BLACK, result);
         }
 
         @Test
         @DisplayName("Should default to black for invalid color")
         void defaultToBlackForInvalidColor() {
-            Color result = redactController.decodeOrDefault("invalid-color");
+            Color result = ManualRedactionService.decodeOrDefault("invalid-color");
             assertEquals(Color.BLACK, result);
         }
 
@@ -1049,7 +1061,7 @@ class RedactControllerTest {
                 })
         @DisplayName("Should handle various valid color formats")
         void handleVariousValidColorFormats(String colorInput) {
-            Color result = redactController.decodeOrDefault(colorInput);
+            Color result = ManualRedactionService.decodeOrDefault(colorInput);
             assertNotNull(result);
             assertTrue(
                     result.getRed() >= 0 && result.getRed() <= 255,
@@ -1065,8 +1077,8 @@ class RedactControllerTest {
         @Test
         @DisplayName("Should handle short hex codes appropriately")
         void handleShortHexCodes() {
-            Color result1 = redactController.decodeOrDefault("123");
-            Color result2 = redactController.decodeOrDefault("#12");
+            Color result1 = ManualRedactionService.decodeOrDefault("123");
+            Color result2 = ManualRedactionService.decodeOrDefault("#12");
 
             assertNotNull(result1);
             assertNotNull(result2);
@@ -1094,7 +1106,7 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("confidential");
 
             List<Object> tokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, false);
 
             assertNotNull(tokens);
@@ -1115,7 +1127,7 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("secret");
 
             List<Object> tokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, false);
 
             assertNotNull(tokens);
@@ -1148,7 +1160,7 @@ class RedactControllerTest {
 
             List<Object> originalTokens = getOriginalTokens();
             List<Object> filteredTokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, false);
 
             long originalNonTextCount =
@@ -1156,7 +1168,7 @@ class RedactControllerTest {
                             .filter(
                                     token ->
                                             token instanceof Operator op
-                                                    && !redactController.isTextShowingOperator(
+                                                    && !textRedactionService.isTextShowingOperator(
                                                             op.getName()))
                             .count();
 
@@ -1165,7 +1177,7 @@ class RedactControllerTest {
                             .filter(
                                     token ->
                                             token instanceof Operator op
-                                                    && !redactController.isTextShowingOperator(
+                                                    && !textRedactionService.isTextShowingOperator(
                                                             op.getName()))
                             .count();
 
@@ -1184,7 +1196,7 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("\\d{3}-\\d{2}-\\d{4}"); // SSN pattern
 
             List<Object> tokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, true, false);
 
             String reconstructedText = extractTextFromTokens(tokens);
@@ -1200,7 +1212,7 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("test");
 
             List<Object> tokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, true);
 
             String reconstructedText = extractTextFromTokens(tokens);
@@ -1217,7 +1229,7 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("sensitive");
 
             List<Object> tokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, false);
 
             String reconstructedText = extractTextFromTokens(tokens);
@@ -1231,7 +1243,7 @@ class RedactControllerTest {
         void shouldWriteTokensToNewContentStream() throws Exception {
             List<Object> tokens = createSampleTokenList();
 
-            redactController.writeFilteredContentStream(realDocument, realPage, tokens);
+            textRedactionService.writeFilteredContentStream(realDocument, realPage, tokens);
 
             assertNotNull(realPage.getContents(), "Page should have content stream");
 
@@ -1249,7 +1261,7 @@ class RedactControllerTest {
 
             assertDoesNotThrow(
                     () ->
-                            redactController.writeFilteredContentStream(
+                            textRedactionService.writeFilteredContentStream(
                                     realDocument, realPage, emptyTokens));
 
             assertNotNull(realPage.getContents(), "Page should still have content stream");
@@ -1262,7 +1274,7 @@ class RedactControllerTest {
             String originalContent = extractTextFromModifiedPage(realPage);
 
             List<Object> newTokens = createSampleTokenList();
-            redactController.writeFilteredContentStream(realDocument, realPage, newTokens);
+            textRedactionService.writeFilteredContentStream(realDocument, realPage, newTokens);
 
             String newContent = extractTextFromModifiedPage(realPage);
             assertNotEquals(originalContent, newContent, "Content stream should be replaced");
@@ -1273,7 +1285,7 @@ class RedactControllerTest {
         void shouldCreateWidthMatchingPlaceholder() {
             String originalText = "confidential";
             String placeholder =
-                    redactController.createPlaceholderWithFont(
+                    textRedactionService.createPlaceholderWithFont(
                             originalText, new PDType1Font(Standard14Fonts.FontName.HELVETICA));
 
             assertEquals(
@@ -1287,7 +1299,7 @@ class RedactControllerTest {
         void shouldHandleSpecialCharactersInPlaceholder() {
             String originalText = "café naïve";
             String placeholder =
-                    redactController.createPlaceholderWithFont(
+                    textRedactionService.createPlaceholderWithFont(
                             originalText, new PDType1Font(Standard14Fonts.FontName.HELVETICA));
 
             assertEquals(originalText.length(), placeholder.length());
@@ -1303,10 +1315,10 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("secret");
 
             List<Object> filteredTokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, false);
 
-            redactController.writeFilteredContentStream(realDocument, realPage, filteredTokens);
+            textRedactionService.writeFilteredContentStream(realDocument, realPage, filteredTokens);
             assertNotNull(realPage.getContents());
 
             String finalText = extractTextFromModifiedPage(realPage);
@@ -1322,7 +1334,7 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("confidential");
 
             List<Object> filteredTokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, false);
 
             long filteredPositioning =
@@ -1377,7 +1389,7 @@ class RedactControllerTest {
             Set<String> targetWords = Set.of("confidential");
 
             List<Object> tokens =
-                    redactController.createTokensWithoutTargetText(
+                    textRedactionService.createTokensWithoutTargetText(
                             realDocument, realPage, targetWords, false, false);
 
             assertNotNull(tokens);
@@ -1404,14 +1416,12 @@ class RedactControllerTest {
         @Test
         @DisplayName("Should handle documents with multiple text blocks")
         void shouldHandleDocumentsWithMultipleTextBlocks() throws Exception {
-            // Create a document with multiple text blocks
             realPage = new PDPage(PDRectangle.A4);
             while (realDocument.getNumberOfPages() > 0) {
                 realDocument.removePage(0);
             }
             realDocument.addPage(realPage);
 
-            // Create resources
             PDResources resources = new PDResources();
             resources.put(
                     COSName.getPDFName("F1"), new PDType1Font(Standard14Fonts.FontName.HELVETICA));

app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceTest.java

@@ -0,0 +1,430 @@
+package stirling.software.SPDF.controller.api.security;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDPageContentStream;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDType1Font;
+import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+
+import stirling.software.SPDF.model.PDFText;
+import stirling.software.SPDF.pdf.parser.PageColumnLayout;
+
+/**
+ * Integration tests for {@link RedactExecuteService#collectRangeBlocks(PDDocument, String, String,
+ * Map)}. Each test builds a synthetic PDF (single-column or two-column) with text-positioning that
+ * matches what a real document would produce, then asserts that the redaction range produces blocks
+ * confined to the expected X/Y region.
+ */
+class RedactExecuteServiceTest {
+
+    private static final float PAGE_WIDTH = PDRectangle.LETTER.getWidth(); // 612
+    private static final float PAGE_HEIGHT = PDRectangle.LETTER.getHeight(); // 792
+
+    private static final float LEFT_X = 72f;
+    private static final float RIGHT_X = 330f;
+    private static final float COL_WIDTH = 220f;
+    private static final float LINE_HEIGHT = 14f;
+    private static final float TOP_Y = PAGE_HEIGHT - 80f;
+    private static final float FONT_SIZE = 11f;
+
+    private final RedactExecuteService service =
+            new RedactExecuteService(null, null, new TextRedactionService());
+
+    @Nested
+    @DisplayName("Single-column documents")
+    class SingleColumn {
+
+        @Test
+        void redactBetweenMarkers_inclusive() throws IOException {
+            try (PDDocument doc = buildSingleColumnDoc()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks =
+                        service.collectRangeBlocks(doc, "START-HERE", "STOP-HERE", cache);
+
+                assertThat(blocks)
+                        .as("blocks should be produced for single-column range")
+                        .isNotEmpty();
+
+                // Blocks are in screen coords (top-left, Y down). START-HERE is drawn at the top
+                // of the page; STOP-HERE four lines below. Screen Y grows downward, so the
+                // anchors' screen-Y tops sit roughly around screenTop(0) and screenTop(4).
+                // The end anchor is inclusive, so blocks may extend to the bottom of line 4.
+                float screenTopOfStart = screenTopOfLine(0);
+                float screenBottomOfEnd = screenTopOfLine(4) + LINE_HEIGHT;
+                for (PDFText block : blocks) {
+                    assertThat(block.getY1())
+                            .as("block top must be at or below the start anchor's top")
+                            .isGreaterThanOrEqualTo(screenTopOfStart - 1f);
+                    assertThat(block.getY2())
+                            .as(
+                                    "block bottom must not extend past the end anchor's bottom (end is inclusive)")
+                            .isLessThanOrEqualTo(screenBottomOfEnd + 1f);
+                    assertThat(block.getX2())
+                            .as("block should not extend into a hypothetical right column")
+                            .isLessThan(PAGE_WIDTH / 2f + 50f);
+                }
+            }
+        }
+
+        @Test
+        void missingStartString_noBlocks() throws IOException {
+            try (PDDocument doc = buildSingleColumnDoc()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks =
+                        service.collectRangeBlocks(doc, "MISSING-START", "STOP-HERE", cache);
+
+                assertThat(blocks).isEmpty();
+            }
+        }
+
+        @Test
+        void cvStyleHeadingPlusRightAlignedDate_stillTreatedAsSingleColumn() throws IOException {
+            // CV-style page: single-column body, but each section heading shares its row with a
+            // right-aligned date. The X-gap splitter emits the heading and the date as separate
+            // line boxes; this must NOT trip 2-column detection (the date is too narrow to be a
+            // real column), otherwise the cross-page redaction predicate over-includes wrong
+            // regions.
+            try (PDDocument doc = buildCvStyleDoc()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks =
+                        service.collectRangeBlocks(doc, "SECTION-A", "SECTION-C", cache);
+
+                assertThat(blocks)
+                        .as("CV-style redaction between section headings must produce blocks")
+                        .isNotEmpty();
+
+                PageColumnLayout layout = cache.get(0);
+                assertThat(layout.columnCount())
+                        .as("CV-style page with heading+date rows must remain single-column")
+                        .isEqualTo(1);
+            }
+        }
+
+        @Test
+        void punctuationDriftInAnchors_stillMatchesViaTolerantFallback() throws IOException {
+            // Simulates the LLM paraphrasing the heading by inserting a colon that isn't in the
+            // source ("#3 Character substitution" → "#3: Character substitution"). The
+            // punctuation-tolerant regex fallback should still find the line.
+            try (PDDocument doc = buildHeadingPdf()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks =
+                        service.collectRangeBlocks(
+                                doc, "#3: Character substitution", "#6: Image resolution", cache);
+
+                assertThat(blocks)
+                        .as("anchor with extra punctuation should still resolve via fallback")
+                        .isNotEmpty();
+            }
+        }
+    }
+
+    @Nested
+    @DisplayName("Two-column documents")
+    class TwoColumn {
+
+        @Test
+        void rangeInLeftColumn_redactsOnlyLeftColumn() throws IOException {
+            try (PDDocument doc = buildTwoColumnDoc()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks = service.collectRangeBlocks(doc, "L-START", "L-END", cache);
+
+                assertThat(blocks).as("left-only range must produce blocks").isNotEmpty();
+
+                float gutterMid = (LEFT_X + COL_WIDTH + RIGHT_X) / 2f;
+                for (PDFText block : blocks) {
+                    float midX = (block.getX1() + block.getX2()) / 2f;
+                    assertThat(midX)
+                            .as("every block must sit in the left column, never the right")
+                            .isLessThan(gutterMid);
+                }
+            }
+        }
+
+        @Test
+        void rangeInRightColumn_redactsOnlyRightColumn() throws IOException {
+            try (PDDocument doc = buildTwoColumnDoc()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks = service.collectRangeBlocks(doc, "R-START", "R-END", cache);
+
+                assertThat(blocks).as("right-only range must produce blocks").isNotEmpty();
+
+                float gutterMid = (LEFT_X + COL_WIDTH + RIGHT_X) / 2f;
+                for (PDFText block : blocks) {
+                    float midX = (block.getX1() + block.getX2()) / 2f;
+                    assertThat(midX)
+                            .as("every block must sit in the right column, never the left")
+                            .isGreaterThan(gutterMid);
+                }
+            }
+        }
+
+        @Test
+        void twoColumnWithTocAbove_pairsAcrossColumns() throws IOException {
+            // Reproduces magic.pdf-style stacked layout: a multi-line TOC near the top, then a
+            // 2-column body where the start anchor is in left col (lower screen Y) and the end
+            // anchor is in right col (higher screen Y). Original pairing failed here because
+            // end.y < start.y in screen coords.
+            try (PDDocument doc = buildTwoColumnWithTocDoc()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks =
+                        service.collectRangeBlocks(doc, "BODY-L-3", "BODY-R-1", cache);
+
+                assertThat(blocks)
+                        .as("cross-column body redaction must produce blocks despite stacked TOC")
+                        .isNotEmpty();
+            }
+        }
+
+        @Test
+        void crossColumnReadingOrder_leftBottomToRightTop_producesBothSides() throws IOException {
+            // This is the case the original code couldn't handle at all: end Y < start Y.
+            try (PDDocument doc = buildTwoColumnDoc()) {
+                Map<Integer, PageColumnLayout> cache = new HashMap<>();
+                List<PDFText> blocks =
+                        service.collectRangeBlocks(doc, "L-MIDDLE", "R-MIDDLE", cache);
+
+                assertThat(blocks)
+                        .as("cross-column range must produce blocks, not be silently dropped")
+                        .isNotEmpty();
+
+                float gutterMid = (LEFT_X + COL_WIDTH + RIGHT_X) / 2f;
+                boolean sawLeft = false;
+                boolean sawRight = false;
+                for (PDFText block : blocks) {
+                    float midX = (block.getX1() + block.getX2()) / 2f;
+                    if (midX < gutterMid) sawLeft = true;
+                    else sawRight = true;
+                }
+                assertThat(sawLeft).as("left column should contain at least one block").isTrue();
+                assertThat(sawRight).as("right column should contain at least one block").isTrue();
+            }
+        }
+    }
+
+    // ── document fixtures ────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Single-column page laid out as one column starting at LEFT_X. Lines: 0: START-HERE (start
+     * anchor) 1: line one 2: line two 3: line three 4: STOP-HERE (end anchor) 5: line five (must
+     * NOT be redacted)
+     */
+    private PDDocument buildSingleColumnDoc() throws IOException {
+        PDDocument doc = new PDDocument();
+        PDPage page = new PDPage(PDRectangle.LETTER);
+        doc.addPage(page);
+        try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
+            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            String[] lines = {
+                "START-HERE", "line one", "line two", "line three", "STOP-HERE", "line five"
+            };
+            for (int i = 0; i < lines.length; i++) {
+                cs.beginText();
+                cs.newLineAtOffset(LEFT_X, yForLine(i));
+                cs.showText(lines[i]);
+                cs.endText();
+            }
+        }
+        return doc;
+    }
+
+    /**
+     * Two-column page. Lines per column, top to bottom: Left: L-TOP, L-START, L-MIDDLE, L-END,
+     * L-BOTTOM Right: R-TOP, R-MIDDLE, R-START, R-END, R-BOTTOM
+     */
+    private PDDocument buildTwoColumnDoc() throws IOException {
+        PDDocument doc = new PDDocument();
+        PDPage page = new PDPage(PDRectangle.LETTER);
+        doc.addPage(page);
+        try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
+            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            // Body lines are padded to make each column genuinely wide enough that column
+            // detection (which ignores narrow lines) treats both sides as real columns.
+            String fill = " " + "x".repeat(26);
+            String[] left = {
+                "L-TOP" + fill,
+                "L-START" + fill,
+                "L-MIDDLE" + fill,
+                "L-END" + fill,
+                "L-BOTTOM" + fill
+            };
+            String[] right = {
+                "R-TOP" + fill,
+                "R-MIDDLE" + fill,
+                "R-START" + fill,
+                "R-END" + fill,
+                "R-BOTTOM" + fill
+            };
+            for (int i = 0; i < left.length; i++) {
+                cs.beginText();
+                cs.newLineAtOffset(LEFT_X, yForLine(i));
+                cs.showText(left[i]);
+                cs.endText();
+            }
+            // Aligned baselines per row (IEEE template style) — AllTextLineExtractor must split
+            // these at the column gap rather than merge same-row left+right glyphs into a wide
+            // box.
+            for (int i = 0; i < right.length; i++) {
+                cs.beginText();
+                cs.newLineAtOffset(RIGHT_X, yForLine(i));
+                cs.showText(right[i]);
+                cs.endText();
+            }
+        }
+        return doc;
+    }
+
+    /**
+     * Single-column page with feature headings: #1..#7 each followed by body text. The PDF text is
+     * exactly "#3 Character substitution" (no colon) — the test then queries with a colon to
+     * exercise the punctuation-tolerant fallback.
+     */
+    private PDDocument buildHeadingPdf() throws IOException {
+        PDDocument doc = new PDDocument();
+        PDPage page = new PDPage(PDRectangle.LETTER);
+        doc.addPage(page);
+        try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
+            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            String[] lines = {
+                "#1 Auto layout",
+                "Body about auto layout.",
+                "#2 Smart selection",
+                "Body about smart selection.",
+                "#3 Character substitution",
+                "Body about character substitution.",
+                "#4 Rounded borders",
+                "Body about rounded borders.",
+                "#5 Auto contrast",
+                "Body about auto contrast.",
+                "#6 Image resolution",
+                "Body about image resolution.",
+                "#7 Columns",
+                "Body about columns."
+            };
+            for (int i = 0; i < lines.length; i++) {
+                cs.beginText();
+                cs.newLineAtOffset(LEFT_X, yForLine(i));
+                cs.showText(lines[i]);
+                cs.endText();
+            }
+        }
+        return doc;
+    }
+
+    /**
+     * Two-column page like {@code magic.pdf}: a few full-width header lines, a 2-column TOC stacked
+     * on top of the 2-column body, where TOC's right half lives inside what would otherwise be the
+     * body's gutter. Body left column has BODY-L-1..3, right column has BODY-R-1..3.
+     */
+    private PDDocument buildTwoColumnWithTocDoc() throws IOException {
+        PDDocument doc = new PDDocument();
+        PDPage page = new PDPage(PDRectangle.LETTER);
+        doc.addPage(page);
+        try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
+            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            // Header — full width, lines 0..1.
+            for (int i = 0; i < 2; i++) {
+                cs.beginText();
+                cs.newLineAtOffset(LEFT_X, yForLine(i));
+                cs.showText("FULL WIDTH HEADER LINE " + i + " ACROSS BOTH COLUMNS OF THE PAGE");
+                cs.endText();
+            }
+            // TOC, 2 columns of entries. TOC right half sits where the body gutter would be —
+            // exactly the layout that broke the histogram-based detector on magic.pdf.
+            float tocLeftX = 101f;
+            float tocRightX = 230f;
+            for (int i = 0; i < 5; i++) {
+                float y = yForLine(3 + i);
+                cs.beginText();
+                cs.newLineAtOffset(tocLeftX, y);
+                cs.showText("TOC entry left " + i);
+                cs.endText();
+                cs.beginText();
+                cs.newLineAtOffset(tocRightX, y);
+                cs.showText("TOC entry right " + i);
+                cs.endText();
+            }
+            // Body — 2-column with aligned baselines per row (IEEE-style).
+            String fill = " " + "x".repeat(26);
+            String[] bodyLeft = {"BODY-L-1" + fill, "BODY-L-2" + fill, "BODY-L-3" + fill};
+            String[] bodyRight = {"BODY-R-1" + fill, "BODY-R-2" + fill, "BODY-R-3" + fill};
+            for (int i = 0; i < bodyLeft.length; i++) {
+                cs.beginText();
+                cs.newLineAtOffset(LEFT_X, yForLine(10 + i));
+                cs.showText(bodyLeft[i]);
+                cs.endText();
+                cs.beginText();
+                cs.newLineAtOffset(RIGHT_X, yForLine(10 + i));
+                cs.showText(bodyRight[i]);
+                cs.endText();
+            }
+        }
+        return doc;
+    }
+
+    /**
+     * CV-style page: single-column body with a few section headings, each followed on the same
+     * baseline by a right-aligned date string. {@link AllTextLineExtractor} will split each
+     * heading+date row into two line boxes; column detection must reject this as a fake two-column
+     * layout because the dates are too narrow to be a real column body.
+     */
+    private PDDocument buildCvStyleDoc() throws IOException {
+        PDDocument doc = new PDDocument();
+        PDPage page = new PDPage(PDRectangle.LETTER);
+        doc.addPage(page);
+        try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
+            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+
+            float dateX = PAGE_WIDTH - 144f; // right-aligned dates near the right margin
+
+            // Section A: heading + date, then 3 body lines.
+            writeAt(cs, LEFT_X, yForLine(0), "SECTION-A");
+            writeAt(cs, dateX, yForLine(0), "Jan 2020");
+            writeAt(cs, LEFT_X, yForLine(1), "Body line A1 with enough width to look like body");
+            writeAt(cs, LEFT_X, yForLine(2), "Body line A2 with enough width to look like body");
+            writeAt(cs, LEFT_X, yForLine(3), "Body line A3 with enough width to look like body");
+
+            // Section B (in the redact range): heading + date + 3 body lines.
+            writeAt(cs, LEFT_X, yForLine(5), "SECTION-B");
+            writeAt(cs, dateX, yForLine(5), "Feb 2021");
+            writeAt(cs, LEFT_X, yForLine(6), "Body line B1 with enough width to look like body");
+            writeAt(cs, LEFT_X, yForLine(7), "Body line B2 with enough width to look like body");
+            writeAt(cs, LEFT_X, yForLine(8), "Body line B3 with enough width to look like body");
+
+            // Section C (end anchor): heading + date.
+            writeAt(cs, LEFT_X, yForLine(10), "SECTION-C");
+            writeAt(cs, dateX, yForLine(10), "Mar 2022");
+        }
+        return doc;
+    }
+
+    private static void writeAt(PDPageContentStream cs, float x, float y, String text)
+            throws IOException {
+        cs.beginText();
+        cs.newLineAtOffset(x, y);
+        cs.showText(text);
+        cs.endText();
+    }
+
+    /** PDF user-space Y baseline for line index {@code i} (0-based, top to bottom). */
+    private static float yForLine(int lineIndex) {
+        return TOP_Y - lineIndex * LINE_HEIGHT;
+    }
+
+    /** Approximate screen-Y of the top of line {@code i} (top-left origin). */
+    private static float screenTopOfLine(int lineIndex) {
+        // baseline_pdf → baseline_screen flips against page height; glyph top ≈ baseline - font
+        // size.
+        return PAGE_HEIGHT - yForLine(lineIndex) - FONT_SIZE;
+    }
+}

app/core/src/test/java/stirling/software/SPDF/exception/GlobalExceptionHandlerTest.java

@@ -18,6 +18,7 @@ import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.context.MessageSource;
 import org.springframework.core.env.Environment;
+import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ProblemDetail;
 import org.springframework.http.ResponseEntity;
@@ -27,6 +28,7 @@ import org.springframework.web.bind.MissingServletRequestParameterException;
 import org.springframework.web.multipart.MaxUploadSizeExceededException;
 import org.springframework.web.multipart.support.MissingServletRequestPartException;
 import org.springframework.web.servlet.NoHandlerFoundException;
+import org.springframework.web.servlet.resource.NoResourceFoundException;
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
@@ -208,6 +210,19 @@ class GlobalExceptionHandlerTest {
         assertEquals(HttpStatus.NOT_FOUND, resp.getStatusCode());
     }
 
+    // ---- NoResourceFoundException ----
+    // Regression guard: was falling through to the 500 catch-all.
+
+    @Test
+    void handleNoResourceFound_returns_404_not_500() {
+        when(request.getMethod()).thenReturn("GET");
+        NoResourceFoundException ex =
+                new NoResourceFoundException(HttpMethod.GET, "/api/v1/storage/folders", "");
+        ResponseEntity<ProblemDetail> resp = handler.handleNoResourceFound(ex, request);
+        assertEquals(HttpStatus.NOT_FOUND, resp.getStatusCode());
+        assertEquals("GET", resp.getBody().getProperties().get("method"));
+    }
+
     // ---- IllegalArgumentException ----
 
     @Test