stashing for now, this adds the ability to fetch the username if it exists

2026-09-03 21:30:14 +03:00 · 2026-03-25 20:41:37 +00:00
2273 changed files with 121748 additions and 257899 deletions
@@ -1,8 +1,6 @@
 # Version control
 .git/
 .gitignore
-.git-blame-ignore-revs
-.gitattributes

 # Build outputs
 build/
@@ -10,41 +8,20 @@ build/
 **/build/
 out/
 target/
-**/target/
-bin/
-version_builds/

 # Gradle caches (local, not what's in the container)
 .gradle/
 **/.gradle/
-.gradle-home/
-
-# Task (go-task) cache
-.task/

 # Node / frontend
 node_modules/
 **/node_modules/
-frontend/node_modules/
-frontend/dist/
-frontend/playwright-report/
 .npm/
 .yarn/

-# Tauri/desktop builds
-src-tauri/target/
-src-tauri/dist/
-frontend/src-tauri/target/
-frontend/src-tauri/dist/
-
 # IDE and editor
 .idea/
 .vscode/
-.settings/
-.settings.zip
-.classpath
-.project
-.devcontainer/
 *.iml
 *.ipr
 *.iws
@@ -55,7 +32,6 @@ frontend/src-tauri/dist/
 *.pid
 .DS_Store
 Thumbs.db
-logs/

 # Docker itself
 Dockerfile*
@@ -69,42 +45,8 @@ Dockerfile*
 # Test reports
 **/test-results/
 **/jacoco/
-test_*.pdf
-
-# Testing and documentation (not needed in build)
-testing/
-docs/
-devGuide/
-devTools/
-*.md
-README*
-
-# Separate projects not consumed by the Java/frontend build
-commonforms-onnx/
-
-# Runtime mount points used by docker-compose volumes, not build input
-stirling/
-customFiles/
-configs/
-
-# Claude Code workspace
-.claude/
-
-# Python caches
-.pytest_cache/
-.ruff_cache/
-__pycache__/
-**/__pycache__/

 # Local env
 .env
 .env.*
 !.env.example
-!engine/.env
-
-# Misc
-*.swp
-*.swo
-*~
-.DS_Store
-.cache/
@@ -15,7 +15,6 @@ max_line_length = 100

 [*.py]
 indent_size = 4
-max_line_length = 120

 [*.gradle]
 indent_size = 4
@@ -1,29 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-desktop
-pkgver=2.10.0
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
-arch=('x86_64')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
-provides=('stirling-pdf')
-conflicts=('stirling-pdf' 'stirling-pdf-git' 'stirling-pdf-bin')
-options=('!strip')
-
-source_x86_64=("${pkgname}-${pkgver}.deb::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-linux-x86_64.deb")
-sha256sums_x86_64=('PLACEHOLDER_DEB_SHA256')
-
-package() {
-    # Extract the .deb archive
-    bsdtar -xf data.tar* -C "${pkgdir}"
-
-    # Fix permissions
-    find "${pkgdir}" -type d -exec chmod 755 {} \;
-
-    # Install license
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<EOF
-Copyright (c) 2025 Stirling PDF Inc
-All rights reserved. See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}
@@ -1,77 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-server-bin
-pkgver=2.10.0
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
-arch=('any')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('java-runtime>=25')
-provides=('stirling-pdf-server')
-conflicts=('stirling-pdf-server' 'stirling-pdf-server-git')
-backup=('etc/stirling-pdf-server/settings.yml')
-
-source=("Stirling-PDF-with-login-${pkgver}.jar::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-with-login.jar")
-sha256sums=('PLACEHOLDER_JAR_SHA256')
-
-package() {
-    # JAR
-    install -Dm644 "Stirling-PDF-with-login-${pkgver}.jar" \
-        "${pkgdir}/usr/share/stirling-pdf-server/stirling-pdf-server.jar"
-
-    # Wrapper script
-    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/stirling-pdf-server" << 'EOF'
-#!/bin/sh
-exec java $JAVA_OPTS -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar "$@"
-EOF
-
-    # systemd unit
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/systemd/system/stirling-pdf-server.service" << 'EOF'
-[Unit]
-Description=Stirling-PDF Server
-After=network.target
-
-[Service]
-Type=simple
-User=stirling-pdf
-Group=stirling-pdf
-WorkingDirectory=/var/lib/stirling-pdf-server
-ExecStart=/usr/bin/java -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar
-Restart=on-failure
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=stirling-pdf-server
-Environment=JAVA_OPTS=-Xmx512m
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-    # sysusers
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/sysusers.d/stirling-pdf-server.conf" << 'EOF'
-u stirling-pdf - "Stirling-PDF Server" /var/lib/stirling-pdf-server -
-EOF
-
-    # tmpfiles
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/stirling-pdf-server.conf" << 'EOF'
-d /var/lib/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-d /var/log/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-EOF
-
-    # Default config stub
-    install -dm755 "${pkgdir}/etc/stirling-pdf-server"
-    install -Dm644 /dev/stdin "${pkgdir}/etc/stirling-pdf-server/settings.yml" << 'EOF'
-# Stirling-PDF Server configuration
-# See https://github.com/Stirling-Tools/Stirling-PDF for all options
-server:
-  port: 8080
-EOF
-
-    # License
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" << 'EOF'
-MIT License with proprietary carve-outs (open-core).
-SPDX: MIT AND LicenseRef-Stirling-PDF-Proprietary
-See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}
@@ -6,20 +6,14 @@ openapi: &openapi
  - *build
  - app/(common|core|proprietary)/src/main/java/**

-docker-base: &docker-base
-  - docker/base/Dockerfile
-  - ".github/workflows/push-docker-base.yml"
-
 docker: &docker
-  - docker/embedded/Dockerfile
-  - docker/embedded/Dockerfile.fat
-  - docker/embedded/Dockerfile.ultra-lite
+  - Dockerfile
+  - Dockerfile.fat
+  - Dockerfile.ultra-lite
  - ".github/workflows/build.yml"
-  - ".github/workflows/push-docker.yml"
  - scripts/init.sh
  - scripts/init-without-ocr.sh
  - exampleYmlFiles/**
-  - *docker-base

 project: &project
  - app/(common|core|proprietary)/src/(main|test)/java/**
@@ -30,7 +24,6 @@ project: &project
  - libs/**
  - "testing/**/!(requirements*.txt|requirements*.in)*"
  - *docker
-  - *docker-base
  - gradle.properties
  - gradlew
  - gradlew.bat
@@ -46,7 +39,8 @@ frontend: &frontend
  - testing/**
  - docker/**
  - scripts/translations/*.py
-  - .taskfiles/desktop.yml
+  - scripts/build-tauri-jlink.bat
+  - scripts/build-tauri-jlink.sh
  - scripts/convert_cff_to_ttf.py
  - scripts/harvest_type3_fonts.py
  - scripts/ignore_translation.toml
@@ -55,25 +49,6 @@ frontend: &frontend
  - scripts/type3_to_cff.py
  - scripts/update_type3_library.py

-# Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
-# job on changes to any of these.
-tauri: &tauri
-  - frontend/src-tauri/**
-  - frontend/src/desktop/**
-  - frontend/tsconfig.desktop.json
-  - frontend/package.json
-  - frontend/package-lock.json
-  - frontend/vite.config.ts
-  - .github/workflows/tauri-build.yml
-
-# Files that affect the AI engine (Python tool models, fixers, tests). Gate
-# the engine validation job on changes to engine sources or to the Java
-# tool surfaces it generates models from.
-engine: &engine
-  - engine/**
-  - app/(common|core|proprietary)/src/main/java/**
-  - .github/workflows/ai-engine.yml
-
 licenses-frontend: &licenses-frontend
  - ".github/workflows/frontend-backend-licenses-update.yml"
  - "frontend/package.json"
@@ -82,23 +57,4 @@ licenses-frontend: &licenses-frontend

 licenses-backend: &licenses-backend
  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - *build
-
-# Files that can affect premium / enterprise behaviour. Gate the enterprise
-# Playwright job on changes to any of these on PRs.
-proprietary: &proprietary
-  - app/proprietary/**
-  - frontend/src/proprietary/**
-  - frontend/src/core/tests/enterprise/**
-  - testing/compose/docker-compose-keycloak-oauth.yml
-  - testing/compose/docker-compose-keycloak-saml.yml
-  - testing/compose/keycloak-realm-oauth.json
-  - testing/compose/keycloak-realm-saml.json
-  - testing/compose/start-oauth-test.sh
-  - testing/compose/start-saml-test.sh
-  - testing/compose/validate-oauth-test.sh
-  - testing/compose/validate-saml-test.sh
-  - configs/settings.yml.template
-  - build.gradle
-  - app/proprietary/build.gradle
-  - .github/workflows/build-enterprise.yml
+  - *build
@@ -13,57 +13,63 @@ updates:
      - "/app/proprietary"
    schedule:
      interval: "weekly"
-    cooldown:
-      default-days: 7
    rebase-strategy: "auto"

  - package-ecosystem: "docker"
-    directories:
-      - "/" # Location of Dockerfile
-      - "/docker/backend"
-      - "/docker/embedded"
-      - "/docker/frontend"
-      - "/docker/base"
-      - "/docker/engine"
+    directory: "/" # Location of Dockerfile
    schedule:
      interval: "weekly"
-    cooldown:
-      default-days: 7
    rebase-strategy: "auto"

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
-    cooldown:
-      default-days: 7
    rebase-strategy: "auto"

  - package-ecosystem: npm
-    directories:
-      - /devTools
-      - /frontend
+    directory: /devTools
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/backend
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/embedded
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/frontend
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: npm
+    directory: /frontend
    schedule:
      interval: "weekly"
-    cooldown:
-      default-days: 7
    rebase-strategy: "auto"

  - package-ecosystem: cargo
-    directories:
-      - /frontend/src-tauri
-      - /frontend/src-tauri/thumbnail-handler
-      - /frontend/src-tauri/provisioner
+    directory: /frontend/src-tauri
    schedule:
      interval: "weekly"
-    cooldown:
-      default-days: 7
    rebase-strategy: "auto"

  - package-ecosystem: pip
    directory: /testing/cucumber
    schedule:
      interval: "weekly"
-    cooldown:
-      default-days: 7
    rebase-strategy: "auto"
+
+  - package-ecosystem: cargo
+    directory: /frontend/src-tauri/provisioner
+    schedule:
+      interval: daily
@@ -72,12 +72,6 @@ labels:
      - 'frontend/src-tauri/**'
      - 'frontend/src-tauri/.*'

-  - label: 'engine'
-    files:
-      - 'engine/**'
-      - 'engine/.*'
-      - 'engine/**/.*'
-
  - label: 'Java'
    files:
      - 'app/common/src/main/java/.*.java'
@@ -17,7 +17,7 @@ Closes #(issue_number)
 ### General

 - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable)
+- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable)
 - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable)
 - [ ] I have performed a self-review of my own code
 - [ ] My changes generate no new warnings
@@ -37,5 +37,4 @@ Closes #(issue_number)

 ### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests pass
- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details.
+- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details.
@@ -1,11 +1,4 @@
 changelog:
-  exclude:
-    labels:
-      - ignore-for-release
-      # engine: Python AI engine - not currently live / not yet shipped to users.
-      # Remove this entry once the engine is released.
-      - engine
-
  categories:
    - title: Breaking Changes
      labels:
@@ -13,22 +6,16 @@ changelog:

    - title: Bug Fixes
      labels:
-        - Bugfix
        - Bug

    - title: Enhancements
      labels:
        - enhancement
-        - Java
-        - Front End
-        - Back End
-        - Tauri

    - title: Minor Enhancements
      labels:
-        - chore
-        - style
-        - refactor
+        - Java
+        - Front End

    - title: Docker Updates
      labels:
@@ -9,7 +9,7 @@
 # CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
    # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
    #   fonttools
 cffi==2.0.0 \
    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@@ -101,274 +101,270 @@ cfgv==3.5.0 \
    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
    # via pre-commit
-cssselect2==0.9.0 \
-    --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
-    --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
+cssselect2==0.8.0 \
+    --hash=sha256:46fc70ebc41ced7a32cd42d58b1884d72ade23d21e5a4eaaf022401c13f0e76e \
+    --hash=sha256:7674ffb954a3b46162392aee2a3a0aedb2e14ecf99fcc28644900f4e6e3e9d3a
    # via weasyprint
 distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.29.0 \
-    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
-    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
-    # via
-    #   python-discovery
-    #   virtualenv
-fonttools==4.62.1 \
-    --hash=sha256:0aa72c43a601cfa9273bb1ae0518f1acadc01ee181a6fc60cd758d7fdadffc04 \
-    --hash=sha256:0b3ae47e8636156a9accff64c02c0924cbebad62854c4a6dbdc110cd5b4b341a \
-    --hash=sha256:12859ff0b47dd20f110804c3e0d0970f7b832f561630cd879969011541a464a9 \
-    --hash=sha256:149f7d84afca659d1a97e39a4778794a2f83bf344c5ee5134e09995086cc2392 \
-    --hash=sha256:1596aeaddf7f78e21e68293c011316a25267b3effdaccaf4d59bc9159d681b82 \
-    --hash=sha256:19177c8d96c7c36359266e571c5173bcee9157b59cfc8cb0153c5673dc5a3a7d \
-    --hash=sha256:1c5c25671ce8805e0d080e2ffdeca7f1e86778c5cbfbeae86d7f866d8830517b \
-    --hash=sha256:1eecc128c86c552fb963fe846ca4e011b1be053728f798185a1687502f6d398e \
-    --hash=sha256:268abb1cb221e66c014acc234e872b7870d8b5d4657a83a8f4205094c32d2416 \
-    --hash=sha256:2d850f66830a27b0d498ee05adb13a3781637b1826982cd7e2b3789ef0cc71ae \
-    --hash=sha256:2e7abd2b1e11736f58c1de27819e1955a53267c21732e78243fa2fa2e5c1e069 \
-    --hash=sha256:403d28ce06ebfc547fbcb0cb8b7f7cc2f7a2d3e1a67ba9a34b14632df9e080f9 \
-    --hash=sha256:40975849bac44fb0b9253d77420c6d8b523ac4dcdcefeff6e4d706838a5b80f7 \
-    --hash=sha256:486f32c8047ccd05652aba17e4a8819a3a9d78570eb8a0e3b4503142947880ed \
-    --hash=sha256:49a445d2f544ce4a69338694cad575ba97b9a75fff02720da0882d1a73f12800 \
-    --hash=sha256:59b372b4f0e113d3746b88985f1c796e7bf830dd54b28374cd85c2b8acd7583e \
-    --hash=sha256:5a648bde915fba9da05ae98856987ca91ba832949a9e2888b48c47ef8b96c5a9 \
-    --hash=sha256:5f37df1cac61d906e7b836abe356bc2f34c99d4477467755c216b72aa3dc748b \
-    --hash=sha256:6706d1cb1d5e6251a97ad3c1b9347505c5615c112e66047abbef0f8545fa30d1 \
-    --hash=sha256:68959f5fc58ed4599b44aad161c2837477d7f35f5f79402d97439974faebfebe \
-    --hash=sha256:6acb4109f8bee00fec985c8c7afb02299e35e9c94b57287f3ea542f28bd0b0a7 \
-    --hash=sha256:7487782e2113861f4ddcc07c3436450659e3caa5e470b27dc2177cade2d8e7fd \
-    --hash=sha256:7aa21ff53e28a9c2157acbc44e5b401149d3c9178107130e82d74ceb500e5056 \
-    --hash=sha256:7bca7a1c1faf235ffe25d4f2e555246b4750220b38de8261d94ebc5ce8a23c23 \
-    --hash=sha256:8d337fdd49a79b0d51c4da87bc38169d21c3abbf0c1aa9367eff5c6656fb6dae \
-    --hash=sha256:8f8fca95d3bb3208f59626a4b0ea6e526ee51f5a8ad5d91821c165903e8d9260 \
-    --hash=sha256:90365821debbd7db678809c7491ca4acd1e0779b9624cdc6ddaf1f31992bf974 \
-    --hash=sha256:92bb00a947e666169c99b43753c4305fc95a890a60ef3aeb2a6963e07902cc87 \
-    --hash=sha256:93c316e0f5301b2adbe6a5f658634307c096fd5aae60a5b3412e4f3e1728ab24 \
-    --hash=sha256:942b03094d7edbb99bdf1ae7e9090898cad7bf9030b3d21f33d7072dbcb51a53 \
-    --hash=sha256:9c125ffa00c3d9003cdaaf7f2c79e6e535628093e14b5de1dccb08859b680936 \
-    --hash=sha256:9dde91633f77fa576879a0c76b1d89de373cae751a98ddf0109d54e173b40f14 \
-    --hash=sha256:9e7863e10b3de72376280b515d35b14f5eeed639d1aa7824f4cf06779ec65e42 \
-    --hash=sha256:a24decd24d60744ee8b4679d38e88b8303d86772053afc29b19d23bb8207803c \
-    --hash=sha256:a5d8825e1140f04e6c99bb7d37a9e31c172f3bc208afbe02175339e699c710e1 \
-    --hash=sha256:aa69d10ed420d8121118e628ad47d86e4caa79ba37f968597b958f6cceab7eca \
-    --hash=sha256:ad5cca75776cd453b1b035b530e943334957ae152a36a88a320e779d61fc980c \
-    --hash=sha256:b4e0fcf265ad26e487c56cb12a42dffe7162de708762db951e1b3f755319507d \
-    --hash=sha256:b820fcb92d4655513d8402d5b219f94481c4443d825b4372c75a2072aa4b357a \
-    --hash=sha256:bd13b7999d59c5eb1c2b442eb2d0c427cb517a0b7a1f5798fc5c9e003f5ff782 \
-    --hash=sha256:bdfe592802ef939a0e33106ea4a318eeb17822c7ee168c290273cbd5fabd746c \
-    --hash=sha256:c05557a78f8fa514da0f869556eeda40887a8abc77c76ee3f74cf241778afd5a \
-    --hash=sha256:c22b1014017111c401469e3acc5433e6acf6ebcc6aa9efb538a533c800971c79 \
-    --hash=sha256:c9b9e288b4da2f64fd6180644221749de651703e8d0c16bd4b719533a3a7d6e3 \
-    --hash=sha256:d241cdc4a67b5431c6d7f115fdf63335222414995e3a1df1a41e1182acd4bcc7 \
-    --hash=sha256:e54c75fd6041f1122476776880f7c3c3295ffa31962dc6ebe2543c00dca58b5d \
-    --hash=sha256:e8514f4924375f77084e81467e63238b095abda5107620f49421c368a6017ed2 \
-    --hash=sha256:ee91628c08e76f77b533d65feb3fbe6d9dad699f95be51cf0d022db94089cdc4 \
-    --hash=sha256:ef46db46c9447103b8f3ff91e8ba009d5fe181b1920a83757a5762551e32bb68 \
-    --hash=sha256:fa1d16210b6b10a826d71bed68dd9ec24a9e218d5a5e2797f37c573e7ec215ca
+filelock==3.20.3 \
+    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
+    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
+    # via virtualenv
+fonttools==4.61.1 \
+    --hash=sha256:0de30bfe7745c0d1ffa2b0b7048fb7123ad0d71107e10ee090fa0b16b9452e87 \
+    --hash=sha256:10d88e55330e092940584774ee5e8a6971b01fc2f4d3466a1d6c158230880796 \
+    --hash=sha256:11f35ad7805edba3aac1a3710d104592df59f4b957e30108ae0ba6c10b11dd75 \
+    --hash=sha256:15acc09befd16a0fb8a8f62bc147e1a82817542d72184acca9ce6e0aeda9fa6d \
+    --hash=sha256:17d2bf5d541add43822bcf0c43d7d847b160c9bb01d15d5007d84e2217aaa371 \
+    --hash=sha256:2180f14c141d2f0f3da43f3a81bc8aa4684860f6b0e6f9e165a4831f24e6a23b \
+    --hash=sha256:21e7c8d76f62ab13c9472ccf74515ca5b9a761d1bde3265152a6dc58700d895b \
+    --hash=sha256:41a7170d042e8c0024703ed13b71893519a1a6d6e18e933e3ec7507a2c26a4b2 \
+    --hash=sha256:41ed4b5ec103bd306bb68f81dc166e77409e5209443e5773cb4ed837bcc9b0d3 \
+    --hash=sha256:497c31ce314219888c0e2fce5ad9178ca83fe5230b01a5006726cdf3ac9f24d9 \
+    --hash=sha256:4c1b526c8d3f615a7b1867f38a9410849c8f4aef078535742198e942fba0e9bd \
+    --hash=sha256:4d7092bb38c53bbc78e9255a59158b150bcdc115a1e3b3ce0b5f267dc35dd63c \
+    --hash=sha256:4f5686e1fe5fce75d82d93c47a438a25bf0d1319d2843a926f741140b2b16e0c \
+    --hash=sha256:58b0ee0ab5b1fc9921eccfe11d1435added19d6494dde14e323f25ad2bc30c56 \
+    --hash=sha256:5ce02f38a754f207f2f06557523cd39a06438ba3aafc0639c477ac409fc64e37 \
+    --hash=sha256:5fade934607a523614726119164ff621e8c30e8fa1ffffbbd358662056ba69f0 \
+    --hash=sha256:5fe9fd43882620017add5eabb781ebfbc6998ee49b35bd7f8f79af1f9f99a958 \
+    --hash=sha256:64102ca87e84261419c3747a0d20f396eb024bdbeb04c2bfb37e2891f5fadcb5 \
+    --hash=sha256:664c5a68ec406f6b1547946683008576ef8b38275608e1cee6c061828171c118 \
+    --hash=sha256:6675329885c44657f826ef01d9e4fb33b9158e9d93c537d84ad8399539bc6f69 \
+    --hash=sha256:75c1a6dfac6abd407634420c93864a1e274ebc1c7531346d9254c0d8f6ca00f9 \
+    --hash=sha256:75da8f28eff26defba42c52986de97b22106cb8f26515b7c22443ebc9c2d3261 \
+    --hash=sha256:77efb033d8d7ff233385f30c62c7c79271c8885d5c9657d967ede124671bbdfb \
+    --hash=sha256:78a7d3ab09dc47ac1a363a493e6112d8cabed7ba7caad5f54dbe2f08676d1b47 \
+    --hash=sha256:7c7db70d57e5e1089a274cbb2b1fd635c9a24de809a231b154965d415d6c6d24 \
+    --hash=sha256:8c56c488ab471628ff3bfa80964372fc13504ece601e0d97a78ee74126b2045c \
+    --hash=sha256:91669ccac46bbc1d09e9273546181919064e8df73488ea087dcac3e2968df9ba \
+    --hash=sha256:9b666a475a65f4e839d3d10473fad6d47e0a9db14a2f4a224029c5bfde58ad2c \
+    --hash=sha256:9cfef3ab326780c04d6646f68d4b4742aae222e8b8ea1d627c74e38afcbc9d91 \
+    --hash=sha256:a13fc8aeb24bad755eea8f7f9d409438eb94e82cf86b08fe77a03fbc8f6a96b1 \
+    --hash=sha256:a75c301f96db737e1c5ed5fd7d77d9c34466de16095a266509e13da09751bd19 \
+    --hash=sha256:a76d4cb80f41ba94a6691264be76435e5f72f2cb3cab0b092a6212855f71c2f6 \
+    --hash=sha256:aed04cabe26f30c1647ef0e8fbb207516fd40fe9472e9439695f5c6998e60ac5 \
+    --hash=sha256:b148b56f5de675ee16d45e769e69f87623a4944f7443850bf9a9376e628a89d2 \
+    --hash=sha256:b501c862d4901792adaec7c25b1ecc749e2662543f68bb194c42ba18d6eec98d \
+    --hash=sha256:b846a1fcf8beadeb9ea4f44ec5bdde393e2f1569e17d700bfc49cd69bde75881 \
+    --hash=sha256:b931ae8f62db78861b0ff1ac017851764602288575d65b8e8ff1963fed419063 \
+    --hash=sha256:c33ab3ca9d3ccd581d58e989d67554e42d8d4ded94ab3ade3508455fe70e65f7 \
+    --hash=sha256:c6604b735bb12fef8e0efd5578c9fb5d3d8532d5001ea13a19cddf295673ee09 \
+    --hash=sha256:d8db08051fc9e7d8bc622f2112511b8107d8f27cd89e2f64ec45e9825e8288da \
+    --hash=sha256:d9203500f7c63545b4ce3799319fe4d9feb1a1b89b28d3cb5abd11b9dd64147e \
+    --hash=sha256:dc492779501fa723b04d0ab1f5be046797fee17d27700476edc7ee9ae535a61e \
+    --hash=sha256:e6bcdf33aec38d16508ce61fd81838f24c83c90a1d1b8c68982857038673d6b8 \
+    --hash=sha256:e76ce097e3c57c4bcb67c5aa24a0ecdbd9f74ea9219997a707a4061fbe2707aa \
+    --hash=sha256:eff1ac3cc66c2ac7cda1e64b4e2f3ffef474b7335f92fc3833fc632d595fcee6 \
+    --hash=sha256:f3cb4a569029b9f291f88aafc927dd53683757e640081ca8c412781ea144565e \
+    --hash=sha256:f79b168428351d11e10c5aeb61a74e1851ec221081299f4cf56036a95431c43a \
+    --hash=sha256:fa646ecec9528bef693415c79a86e733c70a4965dd938e9a226b0fc64c9d2e6c \
+    --hash=sha256:fe2efccb324948a11dd09d22136fe2ac8a97d6c1347cf0b58a911dcd529f66b7 \
+    --hash=sha256:fff4f534200a04b4a36e7ae3cb74493afe807b517a09e99cb4faa89a34ed6ecd
    # via weasyprint
-identify==2.6.19 \
-    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
-    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+identify==2.6.16 \
+    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
+    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
    # via pre-commit
 nodeenv==1.10.0 \
    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
    # via pre-commit
-numpy==2.4.4 \
-    --hash=sha256:07077278157d02f65c43b1b26a3886bce886f95d20aabd11f87932750dfb14ed \
-    --hash=sha256:08f2e31ed5e6f04b118e49821397f12767934cfdd12a1ce86a058f91e004ee50 \
-    --hash=sha256:0aec54fd785890ecca25a6003fd9a5aed47ad607bbac5cd64f836ad8666f4959 \
-    --hash=sha256:0d35aea54ad1d420c812bfa0385c71cd7cc5bcf7c65fed95fc2cd02fe8c79827 \
-    --hash=sha256:0d4e437e295f18ec29bc79daf55e8a47a9113df44d66f702f02a293d93a2d6dd \
-    --hash=sha256:0dfd3f9d3adbe2920b68b5cd3d51444e13a10792ec7154cd0a2f6e74d4ab3233 \
-    --hash=sha256:1378871da56ca8943c2ba674530924bb8ca40cd228358a3b5f302ad60cf875fc \
-    --hash=sha256:15716cfef24d3a9762e3acdf87e27f58dc823d1348f765bbea6bef8c639bfa1b \
-    --hash=sha256:19710a9ca9992d7174e9c52f643d4272dcd1558c5f7af7f6f8190f633bd651a7 \
-    --hash=sha256:23cbfd4c17357c81021f21540da84ee282b9c8fba38a03b7b9d09ba6b951421e \
-    --hash=sha256:2483e4584a1cb3092da4470b38866634bafb223cbcd551ee047633fd2584599a \
-    --hash=sha256:27a8d92cd10f1382a67d7cf4db7ce18341b66438bdd9f691d7b0e48d104c2a9d \
-    --hash=sha256:28a650663f7314afc3e6ec620f44f333c386aad9f6fc472030865dc0ebb26ee3 \
-    --hash=sha256:2aa0613a5177c264ff5921051a5719d20095ea586ca88cc802c5c218d1c67d3e \
-    --hash=sha256:2c194dd721e54ecad9ad387c1d35e63dce5c4450c6dc7dd5611283dda239aabb \
-    --hash=sha256:2d19e6e2095506d1736b7d80595e0f252d76b89f5e715c35e06e937679ea7d7a \
-    --hash=sha256:2d390634c5182175533585cc89f3608a4682ccb173cc9bb940b2881c8d6f8fa0 \
-    --hash=sha256:30caa73029a225b2d40d9fae193e008e24b2026b7ee1a867b7ee8d96ca1a448e \
-    --hash=sha256:42c16925aa5a02362f986765f9ebabf20de75cdefdca827d14315c568dcab113 \
-    --hash=sha256:45dbed2ab436a9e826e302fcdcbe9133f9b0006e5af7168afb8963a6520da103 \
-    --hash=sha256:4636de7fd195197b7535f231b5de9e4b36d2c440b6e566d2e4e4746e6af0ca93 \
-    --hash=sha256:4a19d9dba1a76618dd86b164d608566f393f8ec6ac7c44f0cc879011c45e65af \
-    --hash=sha256:4bbc7f303d125971f60ec0aaad5e12c62d0d2c925f0ab1273debd0e4ba37aba5 \
-    --hash=sha256:4d6d57903571f86180eb98f8f0c839fa9ebbfb031356d87f1361be91e433f5b7 \
-    --hash=sha256:4e874c976154687c1f71715b034739b45c7711bec81db01914770373d125e392 \
-    --hash=sha256:51fc224f7ca4d92656d5a5eb315f12eb5fe2c97a66249aa7b5f562528a3be38c \
-    --hash=sha256:58c8b5929fcb8287cbd6f0a3fae19c6e03a5c48402ae792962ac465224a629a4 \
-    --hash=sha256:5a285b3b96f951841799528cd1f4f01cd70e7e0204b4abebac9463eecfcf2a40 \
-    --hash=sha256:5c70f1cc1c4efbe316a572e2d8b9b9cc44e89b95f79ca3331553fbb63716e2bf \
-    --hash=sha256:62d6b0f03b694173f9fcb1fb317f7222fd0b0b103e784c6549f5e53a27718c44 \
-    --hash=sha256:6a246d5914aa1c820c9443ddcee9c02bec3e203b0c080349533fae17727dfd1b \
-    --hash=sha256:6aa3236c78803afbcb255045fbef97a9e25a1f6c9888357d205ddc42f4d6eba5 \
-    --hash=sha256:6bbe4eb67390b0a0265a2c25458f6b90a409d5d069f1041e6aff1e27e3d9a79e \
-    --hash=sha256:715d1c092715954784bc79e1174fc2a90093dc4dc84ea15eb14dad8abdcdeb74 \
-    --hash=sha256:72944b19f2324114e9dc86a159787333b77874143efcf89a5167ef83cfee8af0 \
-    --hash=sha256:81f4a14bee47aec54f883e0cad2d73986640c1590eb9bfaaba7ad17394481e6e \
-    --hash=sha256:846300f379b5b12cc769334464656bc882e0735d27d9726568bc932fdc49d5ec \
-    --hash=sha256:86b6f55f5a352b48d7fbfd2dbc3d5b780b2d79f4d3c121f33eb6efb22e9a2015 \
-    --hash=sha256:874f200b2a981c647340f841730fc3a2b54c9d940566a3c4149099591e2c4c3d \
-    --hash=sha256:8a87ec22c87be071b6bdbd27920b129b94f2fc964358ce38f3822635a3e2e03d \
-    --hash=sha256:8b3b60bb7cba2c8c81837661c488637eee696f59a877788a396d33150c35d842 \
-    --hash=sha256:8e3ed142f2728df44263aaf5fb1f5b0b99f4070c553a0d7f033be65338329150 \
-    --hash=sha256:93e15038125dc1e5345d9b5b68aa7f996ec33b98118d18c6ca0d0b7d6198b7e8 \
-    --hash=sha256:989824e9faf85f96ec9c7761cd8d29c531ad857bfa1daa930cba85baaecf1a9a \
-    --hash=sha256:99d838547ace2c4aace6c4f76e879ddfe02bb58a80c1549928477862b7a6d6ed \
-    --hash=sha256:9b2aec6af35c113b05695ebb5749a787acd63cafc83086a05771d1e1cd1e555f \
-    --hash=sha256:9c585a1790d5436a5374bac930dad6ed244c046ed91b2b2a3634eb2971d21008 \
-    --hash=sha256:a7164afb23be6e37ad90b2f10426149fd75aee07ca55653d2aa41e66c4ef697e \
-    --hash=sha256:ac6b31e35612a26483e20750126d30d0941f949426974cace8e6b5c58a3657b0 \
-    --hash=sha256:ad2e2ef14e0b04e544ea2fa0a36463f847f113d314aa02e5b402fdf910ef309e \
-    --hash=sha256:b268594bccac7d7cf5844c7732e3f20c50921d94e36d7ec9b79e9857694b1b2f \
-    --hash=sha256:b5f0362dc928a6ecd9db58868fca5e48485205e3855957bdedea308f8672ea4a \
-    --hash=sha256:ba1f4fc670ed79f876f70082eff4f9583c15fb9a4b89d6188412de4d18ae2f40 \
-    --hash=sha256:ba203255017337d39f89bdd58417f03c4426f12beed0440cfd933cb15f8669c7 \
-    --hash=sha256:c901b15172510173f5cb310eae652908340f8dede90fff9e3bf6c0d8dfd92f83 \
-    --hash=sha256:c9b39d38a9bd2ae1becd7eac1303d031c5c110ad31f2b319c6e7d98b135c934d \
-    --hash=sha256:d2a8490669bfe99a233298348acc2d824d496dee0e66e31b66a6022c2ad74a5c \
-    --hash=sha256:dddbbd259598d7240b18c9d87c56a9d2fb3b02fe266f49a7c101532e78c1d871 \
-    --hash=sha256:df3775294accfdd75f32c74ae39fcba920c9a378a2fc18a12b6820aa8c1fb502 \
-    --hash=sha256:e44319a2953c738205bf3354537979eaa3998ed673395b964c1176083dd46252 \
-    --hash=sha256:e4a010c27ff6f210ff4c6ef34394cd61470d01014439b192ec22552ee867f2a8 \
-    --hash=sha256:e823b8b6edc81e747526f70f71a9c0a07ac4e7ad13020aa736bb7c9d67196115 \
-    --hash=sha256:e892aff75639bbef0d2a2cfd55535510df26ff92f63c92cd84ef8d4ba5a5557f \
-    --hash=sha256:eea7ac5d2dce4189771cedb559c738a71512768210dc4e4753b107a2048b3d0e \
-    --hash=sha256:ef4059d6e5152fa1a39f888e344c73fdc926e1b2dd58c771d67b0acfbf2aa67d \
-    --hash=sha256:f169b9a863d34f5d11b8698ead99febeaa17a13ca044961aa8e2662a6c7766a0 \
-    --hash=sha256:f2cf083b324a467e1ab358c105f6cad5ea950f50524668a80c486ff1db24e119 \
-    --hash=sha256:f8474c4241bc18b750be2abea9d7a9ec84f46ef861dbacf86a4f6e043401f79e \
-    --hash=sha256:f983334aea213c99992053ede6168500e5f086ce74fbc4acc3f2b00f5762e9db \
-    --hash=sha256:f9e75681b59ddaa5e659898085ae0eaea229d054f2ac0c7e563a62205a700121 \
-    --hash=sha256:fbc356aae7adf9e6336d336b9c8111d390a05df88f1805573ebb0807bd06fd1d \
-    --hash=sha256:fcfe2045fd2e8f3cb0ce9d4ba6dba6333b8fa05bb8a4939c908cd43322d14c7e
+numpy==2.4.1 \
+    --hash=sha256:0093e85df2960d7e4049664b26afc58b03236e967fb942354deef3208857a04c \
+    --hash=sha256:09aa8a87e45b55a1c2c205d42e2808849ece5c484b2aab11fecabec3841cafba \
+    --hash=sha256:0cce2a669e3c8ba02ee563c7835f92c153cf02edff1ae05e1823f1dde21b16a5 \
+    --hash=sha256:0e6e8f9d9ecf95399982019c01223dc130542960a12edfa8edd1122dfa66a8a8 \
+    --hash=sha256:0f118ce6b972080ba0758c6087c3617b5ba243d806268623dc34216d69099ba0 \
+    --hash=sha256:178de8f87948163d98a4c9ab5bee4ce6519ca918926ec8df195af582de28544d \
+    --hash=sha256:18e14c4d09d55eef39a6ab5b08406e84bc6869c1e34eef45564804f90b7e0574 \
+    --hash=sha256:2023ef86243690c2791fd6353e5b4848eedaa88ca8a2d129f462049f6d484696 \
+    --hash=sha256:20d4649c773f66cc2fc36f663e091f57c3b7655f936a4c681b4250855d1da8f5 \
+    --hash=sha256:2302dc0224c1cbc49bb94f7064f3f923a971bfae45c33870dcbff63a2a550505 \
+    --hash=sha256:26f0bcd9c79a00e339565b303badc74d3ea2bd6d52191eeca5f95936cad107d0 \
+    --hash=sha256:297c72b1b98100c2e8f873d5d35fb551fce7040ade83d67dd51d38c8d42a2162 \
+    --hash=sha256:2f44de05659b67d20499cbc96d49f2650769afcb398b79b324bb6e297bfe3844 \
+    --hash=sha256:2ffd257026eb1b34352e749d7cc1678b5eeec3e329ad8c9965a797e08ccba205 \
+    --hash=sha256:382ad67d99ef49024f11d1ce5dcb5ad8432446e4246a4b014418ba3a1175a1f4 \
+    --hash=sha256:3869ea1ee1a1edc16c29bbe3a2f2a4e515cc3a44d43903ad41e0cacdbaf733dc \
+    --hash=sha256:3d1a100e48cb266090a031397863ff8a30050ceefd798f686ff92c67a486753d \
+    --hash=sha256:423797bdab2eeefbe608d7c1ec7b2b4fd3c58d51460f1ee26c7500a1d9c9ee93 \
+    --hash=sha256:42d7dd5fa36d16d52a84f821eb96031836fd405ee6955dd732f2023724d0aa01 \
+    --hash=sha256:49e792ec351315e16da54b543db06ca8a86985ab682602d90c60ef4ff4db2a9c \
+    --hash=sha256:4e53170557d37ae404bf8d542ca5b7c629d6efa1117dac6a83e394142ea0a43f \
+    --hash=sha256:4f1b68ff47680c2925f8063402a693ede215f0257f02596b1318ecdfb1d79e33 \
+    --hash=sha256:4f9c360ecef085e5841c539a9a12b883dff005fbd7ce46722f5e9cef52634d82 \
+    --hash=sha256:529050522e983e00a6c1c6b67411083630de8b57f65e853d7b03d9281b8694d2 \
+    --hash=sha256:52b5f61bdb323b566b528899cc7db2ba5d1015bda7ea811a8bcf3c89c331fa42 \
+    --hash=sha256:538bf4ec353709c765ff75ae616c34d3c3dca1a68312727e8f2676ea644f8509 \
+    --hash=sha256:5adf01965456a664fc727ed69cc71848f28d063217c63e1a0e200a118d5eec9a \
+    --hash=sha256:5b55aa56165b17aaf15520beb9cbd33c9039810e0d9643dd4379e44294c7303e \
+    --hash=sha256:5d558123217a83b2d1ba316b986e9248a1ed1971ad495963d555ccd75dcb1556 \
+    --hash=sha256:5de60946f14ebe15e713a6f22850c2372fa72f4ff9a432ab44aa90edcadaa65a \
+    --hash=sha256:62fea415f83ad8fdb6c20840578e5fbaf5ddd65e0ec6c3c47eda0f69da172510 \
+    --hash=sha256:6436cffb4f2bf26c974344439439c95e152c9a527013f26b3577be6c2ca64295 \
+    --hash=sha256:6461de5113088b399d655d45c3897fa188766415d0f568f175ab071c8873bd73 \
+    --hash=sha256:69e7419c9012c4aaf695109564e3387f1259f001b4326dfa55907b098af082d3 \
+    --hash=sha256:71abbea030f2cfc3092a0ff9f8c8fdefdc5e0bf7d9d9c99663538bb0ecdac0b9 \
+    --hash=sha256:7211b95ca365519d3596a1d8688a95874cc94219d417504d9ecb2df99fa7bfa8 \
+    --hash=sha256:727c6c3275ddefa0dc078524a85e064c057b4f4e71ca5ca29a19163c607be745 \
+    --hash=sha256:79e9e06c4c2379db47f3f6fc7a8652e7498251789bf8ff5bd43bf478ef314ca2 \
+    --hash=sha256:7ad270f438cbdd402c364980317fb6b117d9ec5e226fff5b4148dd9aa9fc6e02 \
+    --hash=sha256:7d5d7999df434a038d75a748275cd6c0094b0ecdb0837342b332a82defc4dc4d \
+    --hash=sha256:8097529164c0f3e32bb89412a0905d9100bf434d9692d9fc275e18dcf53c9344 \
+    --hash=sha256:82c55962006156aeef1629b953fd359064aa47e4d82cfc8e67f0918f7da3344f \
+    --hash=sha256:8361ea4220d763e54cff2fbe7d8c93526b744f7cd9ddab47afeff7e14e8503be \
+    --hash=sha256:899d2c18024984814ac7e83f8f49d8e8180e2fbe1b2e252f2e7f1d06bea92425 \
+    --hash=sha256:8ad35f20be147a204e28b6a0575fbf3540c5e5f802634d4258d55b1ff5facce1 \
+    --hash=sha256:8f085da926c0d491ffff3096f91078cc97ea67e7e6b65e490bc8dcda65663be2 \
+    --hash=sha256:9171a42fcad32dcf3fa86f0a4faa5e9f8facefdb276f54b8b390d90447cff4e2 \
+    --hash=sha256:92a0e65272fd60bfa0d9278e0484c2f52fe03b97aedc02b357f33fe752c52ffb \
+    --hash=sha256:941c2a93313d030f219f3a71fd3d91a728b82979a5e8034eb2e60d394a2b83f9 \
+    --hash=sha256:98b35775e03ab7f868908b524fc0a84d38932d8daf7b7e1c3c3a1b6c7a2c9f15 \
+    --hash=sha256:a1ceafc5042451a858231588a104093474c6a5c57dcc724841f5c888d237d690 \
+    --hash=sha256:a73044b752f5d34d4232f25f18160a1cc418ea4507f5f11e299d8ac36875f8a0 \
+    --hash=sha256:a7870e8c5fc11aef57d6fea4b4085e537a3a60ad2cdd14322ed531fdca68d261 \
+    --hash=sha256:a92f227dbcdc9e4c3e193add1a189a9909947d4f8504c576f4a732fd0b54240a \
+    --hash=sha256:ac08c63cb7779b85e9d5318e6c3518b424bc1f364ac4cb2c6136f12e5ff2dccc \
+    --hash=sha256:b6bcf39112e956594b3331316d90c90c90fb961e39696bda97b89462f5f3943f \
+    --hash=sha256:c0faba4a331195bfa96f93dd9dfaa10b2c7aa8cda3a02b7fd635e588fe821bf5 \
+    --hash=sha256:ce9ce141a505053b3c7bce3216071f3bf5c182b8b28930f14cd24d43932cd2df \
+    --hash=sha256:cf6470d91d34bf669f61d515499859fa7a4c2f7c36434afb70e82df7217933f9 \
+    --hash=sha256:d3703409aac693fa82c0aee023a1ae06a6e9d065dba10f5e8e80f642f1e9d0a2 \
+    --hash=sha256:d3e3087f53e2b4428766b54932644d148613c5a595150533ae7f00dab2f319a8 \
+    --hash=sha256:d3f8f0df9f4b8be57b3bf74a1d087fec68f927a2fab68231fdb442bf2c12e426 \
+    --hash=sha256:d797454e37570cfd61143b73b8debd623c3c0952959adb817dd310a483d58a1b \
+    --hash=sha256:e1a27bb1b2dee45a2a53f5ca6ff2d1a7f135287883a1689e930d44d1ff296c87 \
+    --hash=sha256:e3bd2cb07841166420d2fa7146c96ce00cb3410664cbc1a6be028e456c4ee220 \
+    --hash=sha256:e7b6b5e28bbd47b7532698e5db2fe1db693d84b58c254e4389d99a27bb9b8f6b \
+    --hash=sha256:e867df947d427cdd7a60e3e271729090b0f0df80f5f10ab7dd436f40811699c3 \
+    --hash=sha256:ea66d2b41ca4a1630aae5507ee0a71647d3124d1741980138aa8f28f44dac36e \
+    --hash=sha256:edee228f76ee2dab4579fad6f51f6a305de09d444280109e0f75df247ff21501 \
+    --hash=sha256:f0a90aba7d521e6954670550e561a4cb925713bd944445dbe9e729b71f6cabee \
+    --hash=sha256:f93bc6892fe7b0663e5ffa83b61aab510aacffd58c16e012bb9352d489d90cb7 \
+    --hash=sha256:fb1461c99de4d040666ca0444057b06541e5642f800b71c56e6ea92d6a853a0c
    # via opencv-python-headless
-opencv-python-headless==4.13.0.92 \
-    --hash=sha256:0525a3d2c0b46c611e2130b5fdebc94cf404845d8fa64d2f3a3b679572a5bd22 \
-    --hash=sha256:0bd48544f77c68b2941392fcdf9bcd2b9cdf00e98cb8c29b2455d194763cf99e \
-    --hash=sha256:1a7d040ac656c11b8c38677cc8cccdc149f98535089dbe5b081e80a4e5903209 \
-    --hash=sha256:3e0a6f0a37994ec6ce5f59e936be21d5d6384a4556f2d2da9c2f9c5dc948394c \
-    --hash=sha256:5c8cfc8e87ed452b5cecb9419473ee5560a989859fe1d10d1ce11ae87b09a2cb \
-    --hash=sha256:77a82fe35ddcec0f62c15f2ba8a12ecc2ed4207c17b0902c7a3151ae29f37fb6 \
-    --hash=sha256:a7cf08e5b191f4ebb530791acc0825a7986e0d0dee2a3c491184bd8599848a4b \
-    --hash=sha256:eb60e36b237b1ebd40a912da5384b348df8ed534f6f644d8e0b4f103e272ba7d
-    # via -r .github/scripts/requirements_dev.in
+opencv-python-headless==4.13.0.90 \
+    --hash=sha256:0e0c8c9f620802fddc4fa7f471a1d263c7b0dca16cd9e7e2f996bb8bd2128c0c \
+    --hash=sha256:12a28674f215542c9bf93338de1b5bffd76996d32da9acb9e739fdb9c8bbd738 \
+    --hash=sha256:32255203040dc98803be96362e13f9e4bce20146898222d2e5c242f80de50da5 \
+    --hash=sha256:96060fc57a1abb1144b0b8129e2ff3bfcdd0ccd8e8bd05bd85256ff4ed587d3b \
+    --hash=sha256:dbc1f4625e5af3a80ebdbd84380227c0f445228588f2521b11af47710caca1ba \
+    --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
+    --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
+    --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
+    # via -r requirements_dev.in
 pdf2image==1.17.0 \
    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r .github/scripts/requirements_dev.in
-pillow==12.2.0 \
-    --hash=sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9 \
-    --hash=sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5 \
-    --hash=sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987 \
-    --hash=sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9 \
-    --hash=sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b \
-    --hash=sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f \
-    --hash=sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd \
-    --hash=sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e \
-    --hash=sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e \
-    --hash=sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe \
-    --hash=sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795 \
-    --hash=sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601 \
-    --hash=sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1 \
-    --hash=sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed \
-    --hash=sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea \
-    --hash=sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5 \
-    --hash=sha256:2e589959f10d9824d39b350472b92f0ce3b443c0a3442ebf41c40cb8361c5b97 \
-    --hash=sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453 \
-    --hash=sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98 \
-    --hash=sha256:34c0d99ecccea270c04882cb3b86e7b57296079c9a4aff88cb3b33563d95afaa \
-    --hash=sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b \
-    --hash=sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d \
-    --hash=sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705 \
-    --hash=sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8 \
-    --hash=sha256:3e080565d8d7c671db5802eedfb438e5565ffa40115216eabb8cd52d0ecce024 \
-    --hash=sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0 \
-    --hash=sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286 \
-    --hash=sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150 \
-    --hash=sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2 \
-    --hash=sha256:51c4167c34b0d8ba05b547a3bb23578d0ba17b80a5593f93bd8ecb123dd336a3 \
-    --hash=sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b \
-    --hash=sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f \
-    --hash=sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463 \
-    --hash=sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940 \
-    --hash=sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166 \
-    --hash=sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed \
-    --hash=sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f \
-    --hash=sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795 \
-    --hash=sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780 \
-    --hash=sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7 \
-    --hash=sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1 \
-    --hash=sha256:673aa32138f3e7531ccdbca7b3901dba9b70940a19ccecc6a37c77d5fdeb05b5 \
-    --hash=sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295 \
-    --hash=sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b \
-    --hash=sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354 \
-    --hash=sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60 \
-    --hash=sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65 \
-    --hash=sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005 \
-    --hash=sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c \
-    --hash=sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be \
-    --hash=sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5 \
-    --hash=sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06 \
-    --hash=sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae \
-    --hash=sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c \
-    --hash=sha256:88d387ff40b3ff7c274947ed3125dedf5262ec6919d83946753b5f3d7c67ea4c \
-    --hash=sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612 \
-    --hash=sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e \
-    --hash=sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab \
-    --hash=sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808 \
-    --hash=sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f \
-    --hash=sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e \
-    --hash=sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909 \
-    --hash=sha256:975385f4776fafde056abb318f612ef6285b10a1f12b8570f3647ad0d74b48ec \
-    --hash=sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe \
-    --hash=sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50 \
-    --hash=sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4 \
-    --hash=sha256:a4e8f36e677d3336f35089648c8955c51c6d386a13cf6ee9c189c5f5bd713a9f \
-    --hash=sha256:a52edc8bfff4429aaabdf4d9ee0daadbbf8562364f940937b941f87a4290f5ff \
-    --hash=sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5 \
-    --hash=sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb \
-    --hash=sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414 \
-    --hash=sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1 \
-    --hash=sha256:b85f66ae9eb53e860a873b858b789217ba505e5e405a24b85c0464822fe88032 \
-    --hash=sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76 \
-    --hash=sha256:bd9c0c7a0c681a347b3194c500cb1e6ca9cab053ea4d82a5cf45b6b754560136 \
-    --hash=sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e \
-    --hash=sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c \
-    --hash=sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3 \
-    --hash=sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea \
-    --hash=sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f \
-    --hash=sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104 \
-    --hash=sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176 \
-    --hash=sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24 \
-    --hash=sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3 \
-    --hash=sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4 \
-    --hash=sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed \
-    --hash=sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43 \
-    --hash=sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421 \
-    --hash=sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7 \
-    --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
-    --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
+    # via -r requirements_dev.in
+pillow==12.1.1 \
+    --hash=sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9 \
+    --hash=sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da \
+    --hash=sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f \
+    --hash=sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642 \
+    --hash=sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713 \
+    --hash=sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850 \
+    --hash=sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9 \
+    --hash=sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0 \
+    --hash=sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9 \
+    --hash=sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8 \
+    --hash=sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6 \
+    --hash=sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd \
+    --hash=sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5 \
+    --hash=sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c \
+    --hash=sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35 \
+    --hash=sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1 \
+    --hash=sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff \
+    --hash=sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38 \
+    --hash=sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4 \
+    --hash=sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af \
+    --hash=sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60 \
+    --hash=sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986 \
+    --hash=sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13 \
+    --hash=sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717 \
+    --hash=sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e \
+    --hash=sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b \
+    --hash=sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15 \
+    --hash=sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a \
+    --hash=sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb \
+    --hash=sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d \
+    --hash=sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b \
+    --hash=sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e \
+    --hash=sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a \
+    --hash=sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f \
+    --hash=sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a \
+    --hash=sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce \
+    --hash=sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc \
+    --hash=sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f \
+    --hash=sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586 \
+    --hash=sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f \
+    --hash=sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9 \
+    --hash=sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8 \
+    --hash=sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40 \
+    --hash=sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60 \
+    --hash=sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c \
+    --hash=sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0 \
+    --hash=sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334 \
+    --hash=sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af \
+    --hash=sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735 \
+    --hash=sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524 \
+    --hash=sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf \
+    --hash=sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b \
+    --hash=sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2 \
+    --hash=sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9 \
+    --hash=sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7 \
+    --hash=sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e \
+    --hash=sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4 \
+    --hash=sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4 \
+    --hash=sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b \
+    --hash=sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397 \
+    --hash=sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c \
+    --hash=sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e \
+    --hash=sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029 \
+    --hash=sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3 \
+    --hash=sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052 \
+    --hash=sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984 \
+    --hash=sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293 \
+    --hash=sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523 \
+    --hash=sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f \
+    --hash=sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b \
+    --hash=sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80 \
+    --hash=sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f \
+    --hash=sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79 \
+    --hash=sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23 \
+    --hash=sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8 \
+    --hash=sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e \
+    --hash=sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3 \
+    --hash=sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e \
+    --hash=sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36 \
+    --hash=sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f \
+    --hash=sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5 \
+    --hash=sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f \
+    --hash=sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6 \
+    --hash=sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32 \
+    --hash=sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20 \
+    --hash=sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202 \
+    --hash=sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0 \
+    --hash=sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3 \
+    --hash=sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563 \
+    --hash=sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090 \
+    --hash=sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289
    # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
    #   pdf2image
    #   weasyprint
-platformdirs==4.9.6 \
-    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
-    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
-    # via
-    #   python-discovery
-    #   virtualenv
-pre-commit==4.6.0 \
-    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
-    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
-    # via -r .github/scripts/requirements_dev.in
+platformdirs==4.5.1 \
+    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
+    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
+    # via virtualenv
+pre-commit==4.5.1 \
+    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
+    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
+    # via -r requirements_dev.in
 pycparser==3.0 \
    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
@@ -381,10 +377,6 @@ pyphen==0.17.2 \
    --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
    --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
    # via weasyprint
-python-discovery==1.2.2 \
-    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
-    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
-    # via virtualenv
 pyyaml==6.0.3 \
    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -466,22 +458,22 @@ tinycss2==1.5.1 \
    # via
    #   cssselect2
    #   weasyprint
-tinyhtml5==2.1.0 \
-    --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
-    --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
+tinyhtml5==2.0.0 \
+    --hash=sha256:086f998833da24c300c414d9fe81d9b368fd04cb9d2596a008421cbc705fcfcc \
+    --hash=sha256:13683277c5b176d070f82d099d977194b7a1e26815b016114f581a74bbfbf47e
    # via weasyprint
 unoserver==3.6 \
    --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
    --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r .github/scripts/requirements_dev.in
-virtualenv==21.2.4 \
-    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
-    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+    # via -r requirements_dev.in
+virtualenv==20.36.1 \
+    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
+    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
    # via pre-commit
-weasyprint==68.1 \
-    --hash=sha256:4dc3ba63c68bbbce3e9617cb2226251c372f5ee90a8a484503b1c099da9cf5be \
-    --hash=sha256:d3b752049b453a5c95edb27ce78d69e9319af5a34f257fa0f4c738c701b4184e
-    # via -r .github/scripts/requirements_dev.in
+weasyprint==68.0 \
+    --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
+    --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
+    # via -r requirements_dev.in
 webencodings==0.5.1 \
    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
@@ -489,27 +481,27 @@ webencodings==0.5.1 \
    #   cssselect2
    #   tinycss2
    #   tinyhtml5
-zopfli==0.4.1 \
-    --hash=sha256:02086247dd12fda929f9bfe8b3962b6bcdbfc8c82e99255aebcf367867cf0760 \
-    --hash=sha256:07a5cdc5d1aaa6c288c5d9f5a5383042ba743641abf8e2fd898dcad622d8a38e \
-    --hash=sha256:27823dc1161a4031d1c25925fd45d9868ec0cbc7692341830a7dcfa25063662c \
-    --hash=sha256:2f992ac7d83cbddd889e1813ace576cbc91a05d5d7a0a21b366e2e5f492e7707 \
-    --hash=sha256:4238d4d746d1095e29c9125490985e0c12ffd3654f54a24af551e2391e936d54 \
-    --hash=sha256:5a4c22b6161f47f5bd34637dbaee6735abd287cd64e0d1ce28ef1871bf625f4b \
-    --hash=sha256:84a31ba9edc921b1d3a4449929394a993888f32d70de3a3617800c428a947b9b \
-    --hash=sha256:a899eca405662a23ae75054affa3517a060362eae1185d3d791c86a50153c4dd \
-    --hash=sha256:a93c2ecafff372de6c0aa2212eff18a75f6c71a100372fee7b4b129cc0b6f9a7 \
-    --hash=sha256:cb136a74d14a4ecfae29cb0fdecece58a6c115abc9a74c12bc6ac62e80f229d7 \
-    --hash=sha256:d7bcee1b189d64ec33d1e05cfa1b6a1268c29329c382f6ca1bd6245b04925c57 \
-    --hash=sha256:fdfb7ce9f5de37a5b2f75dd2642fd7717956ef2a72e0387302a36d382440db07
+zopfli==0.4.0 \
+    --hash=sha256:03181d48e719fcb6cf8340189c61e8f9883d8bbbdf76bf5212a74457f7d083c1 \
+    --hash=sha256:18b5f1570f64d4988482e4466f10ef5f2a30f687c19ad62a64560f2152dc89eb \
+    --hash=sha256:25e4863b8dc30e5d5309f87c106b0b7d3da4ed0e340b8a52b36d4471e797589f \
+    --hash=sha256:7d66337be6d5613dec55213e9ac28f378c41e2cc04fbad4a10748e4df774ca85 \
+    --hash=sha256:9097e8e1dfdb7f5aea5464e469946857e80502b6d29ba1b232450916bd4a74d1 \
+    --hash=sha256:a8ee992b2549e090cd3f0178bf606dd41a29e0613a04cdf5054224662c72dce6 \
+    --hash=sha256:b72a010d205d00b2855acc2302772067362f9ab5a012e3550662aec60d28e6b3 \
+    --hash=sha256:b8bdb41fbfdc4738b7bdc09ed7c1e951579fae192391a5e694d59bb186cdbec7 \
+    --hash=sha256:c3ba02a9a6ca90481d2b2f68bab038b310d63a1e3b5ae305e95a6599787ed941 \
+    --hash=sha256:d1b98ad47c434ef213444a03ef2f826eeec100144d64f6a57504b9893d3931ce \
+    --hash=sha256:f67d04280065e24cb9a4174cb6b3d1f763687f8cb2963aa135ad8f57c6995f5a \
+    --hash=sha256:f94e4dd7d76b4fe9f5d9229372be20d7f786164eea5152d1af1c34298c3d5975
    # via fonttools

 # The following packages are considered to be unsafe in a requirements file:
-pip==26.0.1 \
-    --hash=sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b \
-    --hash=sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8
-    # via -r .github/scripts/requirements_dev.in
-setuptools==82.0.1 \
-    --hash=sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9 \
-    --hash=sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb
-    # via -r .github/scripts/requirements_dev.in
+pip==26.0 \
+    --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
+    --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
+    # via -r requirements_dev.in
+setuptools==80.10.2 \
+    --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
+    --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
+    # via -r requirements_dev.in
@@ -12,34 +12,26 @@ distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.29.0 \
-    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
-    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
-    # via
-    #   python-discovery
-    #   virtualenv
-identify==2.6.19 \
-    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
-    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+filelock==3.20.3 \
+    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
+    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
+    # via virtualenv
+identify==2.6.16 \
+    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
+    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
    # via pre-commit
 nodeenv==1.10.0 \
    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
    # via pre-commit
-platformdirs==4.9.6 \
-    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
-    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
-    # via
-    #   python-discovery
-    #   virtualenv
-pre-commit==4.6.0 \
-    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
-    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
-    # via -r .github/scripts/requirements_pre_commit.in
-python-discovery==1.2.2 \
-    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
-    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+platformdirs==4.5.1 \
+    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
+    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
    # via virtualenv
+pre-commit==4.5.1 \
+    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
+    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
+    # via -r .github/scripts/requirements_pre_commit.in
 pyyaml==6.0.3 \
    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -115,7 +107,7 @@ pyyaml==6.0.3 \
    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
    # via pre-commit
-virtualenv==21.2.4 \
-    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
-    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+virtualenv==20.36.1 \
+    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
+    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
    # via pre-commit
@@ -180,7 +180,7 @@ jobs:
          fetch-depth: 0 # Fetch full history for commit hash detection

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Get version number
        id: versionNumber
@@ -189,7 +189,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -226,7 +226,7 @@ jobs:

      - name: Build and push V2 image
        if: steps.check-image.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: ./docker/embedded/Dockerfile
@@ -3,31 +3,6 @@ name: PR Deployment via Comment
 on:
  issue_comment:
    types: [created]
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: "PR number to deploy"
-        required: true
-      enable_prototypes:
-        description: "Build with prototypes frontend"
-        required: false
-        type: boolean
-        default: false
-      enable_pro:
-        description: "Enable pro features"
-        required: false
-        type: boolean
-        default: false
-      enable_enterprise:
-        description: "Enable enterprise features"
-        required: false
-        type: boolean
-        default: false
-      disable_security:
-        description: "Disable security/login"
-        required: false
-        type: boolean
-        default: true

 permissions:
  contents: read
@@ -39,27 +14,23 @@ jobs:
    permissions:
      issues: write
    if: |
-      vars.CI_PROFILE != 'lite' && (
-        github.event_name == 'workflow_dispatch' ||
-        (
-          github.event.issue.pull_request &&
-          (
-            contains(github.event.comment.body, 'prdeploy') ||
-            contains(github.event.comment.body, 'deploypr')
-          )
-          &&
-          (
-            github.event.comment.user.login == 'frooodle' ||
-            github.event.comment.user.login == 'sf298' ||
-            github.event.comment.user.login == 'Ludy87' ||
-            github.event.comment.user.login == 'balazs-szucs' ||
-            github.event.comment.user.login == 'reecebrowne' ||
-            github.event.comment.user.login == 'DarioGii' ||
-            github.event.comment.user.login == 'EthanHealy01' ||
-            github.event.comment.user.login == 'jbrunton96' ||
-            github.event.comment.user.login == 'ConnorYoh'
-          )
-        )
+      vars.CI_PROFILE != 'lite' &&
+      github.event.issue.pull_request &&
+      (
+        contains(github.event.comment.body, 'prdeploy') ||
+        contains(github.event.comment.body, 'deploypr')
+      )
+      &&
+      (
+        github.event.comment.user.login == 'frooodle' ||
+        github.event.comment.user.login == 'sf298' ||
+        github.event.comment.user.login == 'Ludy87' ||
+        github.event.comment.user.login == 'balazs-szucs' ||
+        github.event.comment.user.login == 'reecebrowne' ||
+        github.event.comment.user.login == 'DarioGii' ||
+        github.event.comment.user.login == 'EthanHealy01' ||
+        github.event.comment.user.login == 'jbrunton96' ||
+        github.event.comment.user.login == 'ConnorYoh'
      )
    outputs:
      pr_number: ${{ steps.get-pr.outputs.pr_number }}
@@ -67,7 +38,6 @@ jobs:
      disable_security: ${{ steps.check-security-flag.outputs.disable_security }}
      enable_pro: ${{ steps.check-pro-flag.outputs.enable_pro }}
      enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }}
-      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
@@ -91,9 +61,7 @@ jobs:
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
-            const prNumber = context.eventName === 'workflow_dispatch'
-              ? context.payload.inputs.pr_number
-              : context.payload.issue.number;
+            const prNumber = context.payload.issue.number;
            console.log(`PR Number: ${prNumber}`);
            core.setOutput('pr_number', prNumber);

@@ -101,14 +69,12 @@ jobs:
        id: check-security-flag
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_DISABLE_SECURITY: ${{ inputs.disable_security }}
        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "disable_security=$DISPATCH_DISABLE_SECURITY" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+          if [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+            echo "Security flags detected in comment"
            echo "disable_security=false" >> $GITHUB_OUTPUT
          else
+            echo "No security flags detected in comment"
            echo "disable_security=true" >> $GITHUB_OUTPUT
          fi

@@ -116,43 +82,22 @@ jobs:
        id: check-pro-flag
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PRO: ${{ inputs.enable_pro }}
-          DISPATCH_ENTERPRISE: ${{ inputs.enable_enterprise }}
        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_pro=$DISPATCH_PRO" >> $GITHUB_OUTPUT
-            echo "enable_enterprise=$DISPATCH_ENTERPRISE" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+          if [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+            echo "pro flags detected in comment"
            echo "enable_pro=true" >> $GITHUB_OUTPUT
            echo "enable_enterprise=false" >> $GITHUB_OUTPUT
          elif [[ "$COMMENT_BODY" == *"enterprise"* ]]; then
+            echo "enterprise flags detected in comment"
            echo "enable_enterprise=true" >> $GITHUB_OUTPUT
            echo "enable_pro=true" >> $GITHUB_OUTPUT
          else
+            echo "No pro or enterprise flags detected in comment"
            echo "enable_pro=false" >> $GITHUB_OUTPUT
            echo "enable_enterprise=false" >> $GITHUB_OUTPUT
          fi

-      - name: Check for prototypes flag
-        id: check-prototypes-flag
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PROTOTYPES: ${{ inputs.enable_prototypes }}
-        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_prototypes=$DISPATCH_PROTOTYPES" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"prototypes"* ]]; then
-            echo "Prototypes flag detected in comment"
-            echo "enable_prototypes=true" >> $GITHUB_OUTPUT
-          else
-            echo "No prototypes flag detected in comment"
-            echo "enable_prototypes=false" >> $GITHUB_OUTPUT
-          fi
-
      - name: Add 'in_progress' reaction to comment
-        if: github.event_name == 'issue_comment'
        id: add-eyes-reaction
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
@@ -216,8 +161,6 @@ jobs:
        with:
          gradle-version: 9.3.1

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Run Gradle Command
        run: |
          if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -225,7 +168,7 @@ jobs:
          else
            export DISABLE_ADDITIONAL_FEATURES=false
          fi
-          task backend:build
+          ./gradlew build
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -233,16 +176,16 @@ jobs:
          STIRLING_PDF_DESKTOP_UI: false

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Build and push PR-specific image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: ./docker/embedded/Dockerfile
@@ -250,21 +193,7 @@ jobs:
          cache-from: type=gha,scope=stirling-pdf-latest
          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image
-        if: needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-engine
-          cache-to: type=gha,mode=max,scope=stirling-pdf-engine
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          build-args: VERSION_TAG=alpha
          platforms: linux/amd64

      - name: Set up SSH
@@ -302,64 +231,33 @@ jobs:
            PREMIUM_PROFEATURES_AUDIT_ENABLED="false"
          fi

-          ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
-          PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
-          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"
-
-          # Build engine env vars for backend (only set when prototypes enabled)
-          if [ "$ENABLE_PROTOTYPES" == "true" ]; then
-            AI_ENGINE_VARS="
-                SYSTEM_AIENGINE_ENABLED: \"true\"
-                SYSTEM_AIENGINE_URL: \"http://stirling-pdf-engine-pr-${PR_NUMBER}:5001\""
-            ENGINE_SERVICE="
-            stirling-pdf-engine:
-              container_name: stirling-pdf-engine-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
-              environment:
-                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
-              networks:
-                - pr-network
-              restart: on-failure:5"
-            NETWORK_SECTION="
-          networks:
-            pr-network:"
-            BACKEND_NETWORK="
-              networks:
-                - pr-network"
-          else
-            AI_ENGINE_VARS=""
-            ENGINE_SERVICE=""
-            NETWORK_SECTION=""
-            BACKEND_NETWORK=""
-          fi
-
          # First create the docker-compose content locally
          cat > docker-compose.yml << EOF
          version: '3.3'
          services:
            stirling-pdf:
-              container_name: stirling-pdf-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
+              container_name: stirling-pdf-pr-${{ needs.check-comment.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
              ports:
-                - "${PR_NUMBER}:8080"
+                - "${{ needs.check-comment.outputs.pr_number }}:8080"
              volumes:
-                - /stirling/PR-${PR_NUMBER}/data:/usr/share/tessdata:rw
-                - /stirling/PR-${PR_NUMBER}/config:/configs:rw
-                - /stirling/PR-${PR_NUMBER}/logs:/logs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/data:/usr/share/tessdata:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/config:/configs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/logs:/logs:rw
              environment:
                DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
                SYSTEM_DEFAULTLOCALE: en-GB
-                UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
-                UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
-                UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"
+                UI_APPNAME: "Stirling-PDF PR#${{ needs.check-comment.outputs.pr_number }}"
+                UI_HOMEDESCRIPTION: "PR#${{ needs.check-comment.outputs.pr_number }} for Stirling-PDF Latest"
+                UI_APPNAMENAVBAR: "PR#${{ needs.check-comment.outputs.pr_number }}"
                SYSTEM_MAXFILESIZE: "100"
                METRICS_ENABLED: "true"
                SYSTEM_GOOGLEVISIBILITY: "false"
                PREMIUM_KEY:                         "${PREMIUM_KEY}"
                PREMIUM_ENABLED:                     "${PREMIUM_ENABLED}"
-                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"${AI_ENGINE_VARS}
-              restart: on-failure:5${BACKEND_NETWORK}${ENGINE_SERVICE}${NETWORK_SECTION}
+                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"
+              restart: on-failure:5
          EOF

          # Then copy the file and execute commands
@@ -367,13 +265,13 @@ jobs:

          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create PR-specific directories
-            mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}
+            mkdir -p /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/{data,config,logs}

            # Move docker-compose file to correct location
-            mv /tmp/docker-compose.yml /stirling/PR-${PR_NUMBER}/docker-compose.yml
+            mv /tmp/docker-compose.yml /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/docker-compose.yml

            # Start or restart the container
-            cd /stirling/PR-${PR_NUMBER}
+            cd /stirling/PR-${{ needs.check-comment.outputs.pr_number }}
            docker-compose pull
            docker-compose up -d
          ENDSSH
@@ -382,7 +280,7 @@ jobs:
          echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV

      - name: Add success reaction to comment
-        if: success() && github.event_name == 'issue_comment'
+        if: success()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
@@ -417,7 +315,7 @@ jobs:
            }

      - name: Add failure reaction to comment
-        if: failure() && github.event_name == 'issue_comment'
+        if: failure()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
@@ -121,9 +121,8 @@ jobs:
              # Remove PR-specific directories
              rm -rf /stirling/PR-${{ github.event.pull_request.number }}

-              # Remove the Docker images
+              # Remove the Docker image
              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
-              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true

              echo "PERFORMED_CLEANUP"
            else
@@ -1,15 +1,9 @@
 name: AI Engine CI

-# Validates the Python AI engine: regenerates tool models, runs fixers,
-# lint, type-check, and tests. Called from build.yml on PRs and merge_group;
-# also runs directly on push to main as a post-merge safety net.
 on:
-  workflow_call:
  push:
    branches: [main]
-
-permissions:
-  contents: read
+  pull_request:

 jobs:
  engine:
@@ -17,99 +11,73 @@ jobs:
    permissions:
      contents: read
      pull-requests: write
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-        with:
-          egress-policy: audit
+    defaults:
+      run:
+        working-directory: engine

+    steps:
      - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4

      - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-
-      - name: Regenerate tool models
-        run: task engine:tool-models
-
-      - name: Verify tool models are up to date
-        run: |
-          if ! git diff --exit-code engine/src/stirling/models/tool_models.py; then
-            echo "tool_models.py is out of date."
-            echo "Run 'task engine:tool-models' locally and commit the updated file."
-            exit 1
-          fi
+      - name: Install dependencies
+        run: make install

      - name: Run fixers
-        run: task engine:fix
+        # Ignore errors here because we're going to add comments for them in the following steps before actually failing
+        run: make fix || true

-      - name: Verify fixes are committed
+      - name: Check for fixer changes
        id: fixer_changes
        run: |
-          if ! git diff --quiet; then
-            git --no-pager diff --stat
-            echo "::error::There are issues with your Python code that will need to be fixed before they can be merged in. Run 'task engine:fix' to auto-fix what can be fixed automatically, then run 'task engine:check' to see what still needs fixing manually."
-            exit 1
+          if git diff --quiet; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

-      - name: Comment on fixer failures
-        if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
+      - name: Post fixer suggestions
+        if: steps.fixer_changes.outputs.changed == 'true' && github.event_name == 'pull_request'
+        uses: reviewdog/action-suggester@v1
        continue-on-error: true
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          tool_name: engine-make-fix
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          filter_mode: file
+          fail_level: any
+          level: info
+
+      - name: Comment on fixer suggestions
+        if: steps.fixer_changes.outputs.changed == 'true' && github.event_name == 'pull_request'
+        uses: actions/github-script@v7
        with:
          script: |
-            const marker = '<!-- engine-check -->';
-            const body = [
-              marker,
-              '### Engine Check Failed',
-              '',
-              'There are issues with your Python code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task engine:fix` to auto-fix what can be fixed automatically, then run `task engine:check` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
+            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
+              body: "The Python code in your PR has formatting/linting issues. Consider running `make fix` locally or setting up your editor's Ruff integration to auto-format and lint your files as you go, or commit the suggested changes on this PR.",
            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
+
+      - name: Verify fixer changes are committed
+        if: steps.fixer_changes.outputs.changed == 'true'
+        run: |
+          if ! git diff --exit-code; then
+            echo "Fixes are out of date."
+            echo "Apply the reviewdog suggestions or run 'make fix' from engine/ and commit the updated files."
+            git --no-pager diff --stat
+            exit 1
+          fi

      - name: Run linting
-        run: task engine:lint
+        run: make lint

      - name: Run type checking
-        run: task engine:typecheck
+        run: make typecheck

      - name: Run tests
-        run: task engine:test
+        run: make test
@@ -1,128 +0,0 @@
-name: Publish to AUR
-
-on:
-  release:
-    types: [released]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the AUR push (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
-
-  publish-aur:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Update stirling-pdf-desktop PKGBUILD
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          DEB_SHA: ${{ needs.get-release-info.outputs.deb_sha256 }}
-        run: |
-          PKGBUILD=".github/aur/stirling-pdf-desktop/PKGBUILD"
-          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-          sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-          sed -i "s/'PLACEHOLDER_DEB_SHA256'/'${DEB_SHA}'/" "$PKGBUILD"
-
-      # Disabled until we sort out the server packaging story.
-      # The third-party stirling-pdf-bin on AUR currently covers a similar use case.
-      # - name: Update stirling-pdf-server-bin PKGBUILD
-      #   env:
-      #     VERSION: ${{ needs.get-release-info.outputs.version }}
-      #     JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-      #   run: |
-      #     PKGBUILD=".github/aur/stirling-pdf-server-bin/PKGBUILD"
-      #     sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-      #     sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-      #     sed -i "s/'PLACEHOLDER_JAR_SHA256'/'${JAR_SHA}'/" "$PKGBUILD"
-
-      - name: Show updated PKGBUILD (for dry-run visibility)
-        run: |
-          echo "--- stirling-pdf-desktop PKGBUILD ---"
-          cat .github/aur/stirling-pdf-desktop/PKGBUILD
-
-      - name: Publish stirling-pdf-desktop to AUR
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
-        with:
-          pkgname: stirling-pdf-desktop
-          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
-          commit_username: Stirling PDF Inc
-          commit_email: contact@stirlingpdf.com
-          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-          commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
-
-      # Disabled until we sort out the server packaging story.
-      # - name: Publish stirling-pdf-server-bin to AUR
-      #   if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-      #   uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
-      #   with:
-      #     pkgname: stirling-pdf-server-bin
-      #     pkgbuild: .github/aur/stirling-pdf-server-bin/PKGBUILD
-      #     commit_username: Stirling PDF Inc
-      #     commit_email: contact@stirlingpdf.com
-      #     ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-      #     commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
@@ -1,175 +0,0 @@
-name: Backend build, format check, and coverage
-
-# Reusable workflow called from build.yml. Runs the full backend build matrix
-# (JDK 21/25 × spring-security on/off), Spotless formatting check, JUnit, and
-# posts Jacoco coverage to PRs.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  actions: read
-  security-events: write
-  pull-requests: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        jdk-version: [21, 25]
-        spring-security: [true, false]
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: ${{ matrix.jdk-version }}
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Check Java formatting (Spotless)
-        if: matrix.jdk-version == 25 && matrix.spring-security == false
-        id: spotless-check
-        run: task backend:format:check
-        continue-on-error: true
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Comment on Java formatting failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const body = [
-              marker,
-              '### Java Formatting Check Failed',
-              '',
-              'Your code has formatting issues. Run the following command to fix them:',
-              '',
-              '```bash',
-              'task backend:format',
-              '```',
-              '',
-              'Then commit and push the changes.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if Java formatting issues found
-        if: steps.spotless-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Java Formatting Check Failed"
-          echo "============================================"
-          echo ""
-          echo "Your code has formatting issues."
-          echo "Run the following command to fix them:"
-          echo ""
-          echo "  task backend:format"
-          echo ""
-          echo "Then commit and push the changes."
-          echo "============================================"
-          exit 1
-
-      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
-        run: task backend:build:ci
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
-
-      - name: Check Test Reports Exist
-        if: always()
-        run: |
-          declare -a dirs=(
-            "app/core/build/reports/tests/"
-            "app/core/build/test-results/"
-            "app/common/build/reports/tests/"
-            "app/common/build/test-results/"
-            "app/proprietary/build/reports/tests/"
-            "app/proprietary/build/test-results/"
-          )
-          for dir in "${dirs[@]}"; do
-            if [ ! -d "$dir" ]; then
-              echo "Missing $dir"
-              exit 1
-            fi
-          done
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
-          path: |
-            app/**/build/reports/jacoco/test
-            app/**/build/reports/tests/
-            app/**/build/test-results/
-            app/**/build/reports/problems/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
-
-      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
-        # The action only supports the pull_request event (it posts a PR comment),
-        # so skip it for merge_group runs and workflow_dispatch.
-        if: github.event_name == 'pull_request'
-        id: jacoco
-        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
-        with:
-          paths: |
-            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
-          token: ${{ secrets.GITHUB_TOKEN }}
-          min-coverage-overall: 10
-          min-coverage-changed-files: 0
-          comment-type: summary
@@ -1,264 +0,0 @@
-name: Enterprise E2E (Playwright)
-
-# Enterprise Playwright suite — exercises premium-key gated features (audit,
-# teams, analytics) plus full OAuth + SAML logins via the Keycloak compose
-# stacks under testing/compose. Slow and secret-gated, so it runs in three
-# situations:
-#
-#   - PRs that touch proprietary / premium / SSO compose / enterprise tests
-#     (driven by build.yml via workflow_call, path-filtered against
-#     .github/config/.files.yaml `proprietary`),
-#   - every push to main (post-merge safety net),
-#   - on a nightly cron schedule (catches Keycloak image drift, license
-#     expiry, upstream proprietary changes),
-#   - manual workflow_dispatch.
-#
-# Auto-skipped when secrets.PREMIUM_KEY_ENTERPRISE is missing (forks, dependabot).
-
-on:
-  workflow_call:
-  push:
-    branches: ["main"]
-  schedule:
-    - cron: "0 4 * * *"
-  workflow_dispatch:
-
-# No `concurrency:` block here on purpose. When this workflow is called via
-# workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
-# resolve to the *caller's* values, producing the same group key as build.yml
-# and causing the workflow_call instantiation to self-cancel — the job
-# silently fails to spawn while `${{ needs.X.result }}` still reports
-# `failure`. Standalone runs (push-to-main, nightly cron, dispatch) don't
-# overlap often enough to need explicit concurrency control.
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e-enterprise:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
-      PREMIUM_ENABLED: "true"
-      SYSTEM_ENABLEANALYTICS: "false"
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install Playwright (chromium only)
-        run: task frontend:test:e2e:install -- chromium
-
-      - name: Resolve kubernetes.docker.internal to localhost
-        # The compose stacks set KC_HOSTNAME=kubernetes.docker.internal so
-        # Keycloak issues redirect URIs against that host. Docker Desktop
-        # auto-resolves it; GHA runners don't. Map it to 127.0.0.1 so the
-        # browser-driven OAuth flow lands back on Stirling-PDF correctly.
-        run: |
-          echo "127.0.0.1 kubernetes.docker.internal" | sudo tee -a /etc/hosts
-
-      # Helper function used by all phases — boots `:stirling-pdf:bootRun`
-      # with the React frontend baked in (-PbuildWithFrontend=true) so the
-      # SPA serves on :8080 and OAuth/SAML callbacks land on the same host
-      # that the browser is interacting with.
-      - name: Define helpers
-        run: |
-          {
-            echo 'wait_for_backend() {'
-            echo '  start=$SECONDS'
-            echo '  for i in $(seq 1 300); do'
-            echo '    if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then'
-            echo '      echo "Backend up after $((SECONDS - start))s"; return 0'
-            echo '    fi; sleep 2'
-            echo '  done'
-            echo '  tail -200 /tmp/backend.log || true; return 1'
-            echo '}'
-            echo 'stop_backend() {'
-            echo '  if [ -f /tmp/backend.pid ]; then'
-            echo '    kill "$(cat /tmp/backend.pid)" 2>/dev/null || true'
-            echo '    rm -f /tmp/backend.pid'
-            echo '  fi'
-            echo '  pkill -f "gradlew :stirling-pdf:bootRun" 2>/dev/null || true'
-            echo '  for i in $(seq 1 30); do'
-            echo '    curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1 || return 0'
-            echo '    sleep 1'
-            echo '  done'
-            echo '}'
-          } > /tmp/helpers.sh
-          chmod +x /tmp/helpers.sh
-
-      # ───────── OAuth round-trip ─────────
-      - name: Bring up Keycloak (OAuth realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-oauth.yml up -d --no-deps keycloak-oauth-db keycloak-oauth
-      - name: Wait for Keycloak (OAuth) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            bash validate-oauth-test.sh 2>/dev/null && exit 0 || true
-            # validate script also pings stirling on :8080 — accept just the
-            # keycloak realm as our gate here, stirling boots in the next step
-            curl -fsS http://localhost:9080/realms/stirling-oauth >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-oauth.yml logs --tail=200 keycloak-oauth
-          exit 1
-      - name: Boot Stirling-PDF (frontend baked in, OAuth env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_OAUTH2_ENABLED: "true"
-          SECURITY_OAUTH2_AUTOCREATEUSER: "true"
-          # Keycloak issues redirect URIs against KC_HOSTNAME, which the
-          # compose default sets to kubernetes.docker.internal. Match here
-          # (resolves to localhost via /etc/hosts mapping above).
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_ISSUER: "http://kubernetes.docker.internal:9080/realms/stirling-oauth"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTID: "stirling-pdf-client"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTSECRET: "test-client-secret-change-in-production"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_USEASUSERNAME: "email"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_SCOPES: "openid,profile,email"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise OAuth Playwright tests
-        id: oauth-tests
-        run: task frontend:test:e2e -- --project=enterprise --grep "OAuth"
-      - name: Stop backend + tear down OAuth Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-oauth.yml down -v)
-
-      # ───────── SAML round-trip ─────────
-      - name: Bring up Keycloak (SAML realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-saml.yml up -d --no-deps keycloak-saml-db keycloak-saml
-      - name: Wait for Keycloak (SAML) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            curl -fsS http://localhost:9080/realms/stirling-saml >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-saml.yml logs --tail=200 keycloak-saml
-          exit 1
-      - name: Generate SAML SP certs + fetch Keycloak IdP cert
-        # The .pem/.crt/.key files are gitignored (test-only certs); the
-        # docker-based start-saml-test.sh generates them at runtime, so do
-        # the same in CI before bootRun reads them.
-        working-directory: testing/compose
-        run: |
-          openssl req -x509 -newkey rsa:2048 \
-            -keyout saml-private-key.key \
-            -out saml-public-cert.crt \
-            -days 3650 -nodes \
-            -subj "/CN=stirling-pdf-saml-sp" >/dev/null 2>&1
-          # Fetch Keycloak's SAML signing cert from the realm descriptor
-          CERT_BODY=$(curl -sf http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor \
-            | awk 'BEGIN{RS="<[^>]*X509Certificate>|</[^>]*X509Certificate>"} NR==2{gsub(/[[:space:]]+/,""); print; exit}')
-          {
-            echo "-----BEGIN CERTIFICATE-----"
-            echo "$CERT_BODY"
-            echo "-----END CERTIFICATE-----"
-          } > keycloak-saml-cert.pem
-          test -s saml-private-key.key
-          test -s saml-public-cert.crt
-          test -s keycloak-saml-cert.pem
-          echo "✓ SAML certs prepared"
-      - name: Boot Stirling-PDF (frontend baked in, SAML env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_SAML2_ENABLED: "true"
-          SECURITY_SAML2_AUTOCREATEUSER: "true"
-          SECURITY_SAML2_PROVIDER: "keycloak"
-          SECURITY_SAML2_REGISTRATIONID: "keycloak"
-          SECURITY_SAML2_IDP_ISSUER: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_ENTITYID: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_METADATAURI: "http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor"
-          SECURITY_SAML2_IDPSINGLELOGINURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDPSINGLELOGOUTURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDP_CERT: "${{ github.workspace }}/testing/compose/keycloak-saml-cert.pem"
-          SECURITY_SAML2_PRIVATEKEY: "${{ github.workspace }}/testing/compose/saml-private-key.key"
-          SECURITY_SAML2_SP_CERT: "${{ github.workspace }}/testing/compose/saml-public-cert.crt"
-          # Realm registers the SP entity as the metadata URL — see
-          # keycloak-realm-saml.json `clientId`. Match it here so Keycloak
-          # accepts the AuthnRequest issuer.
-          SECURITY_SAML2_SP_ENTITYID: "http://localhost:8080/saml2/service-provider-metadata/keycloak"
-          SECURITY_SAML2_SP_ACS: "http://localhost:8080/login/saml2/sso/keycloak"
-          SECURITY_SAML2_SP_SLS: "http://localhost:8080/logout/saml2/slo"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise SAML Playwright tests
-        id: saml-tests
-        run: task frontend:test:e2e -- --project=enterprise --grep "SAML"
-      - name: Stop backend + tear down SAML Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-saml.yml down -v)
-
-      # ───────── License-gated feature tests (no IdP needed) ─────────
-      - name: Wipe DB so InitialSecuritySetup re-runs with admin/adminadmin
-        # Earlier phases (OAuth, SAML) create the default admin/stirling user.
-        # InitialSecuritySetup only honours SECURITY_INITIALLOGIN_* when the
-        # admin user doesn't already exist, so the persisted DB has to be
-        # cleared between phases for the feature env vars to take effect.
-        run: |
-          rm -f app/core/configs/stirling-pdf-DB*.mv.db
-          rm -rf app/core/configs/backup
-      - name: Boot Stirling-PDF (frontend baked in, premium only)
-        env:
-          SECURITY_INITIALLOGIN_USERNAME: admin
-          SECURITY_INITIALLOGIN_PASSWORD: adminadmin
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise feature Playwright tests
-        id: feature-tests
-        run: task frontend:test:e2e -- --project=enterprise --grep "Enterprise license"
-      - name: Print backend log on failure
-        if: failure()
-        run: |
-          echo "::group::Enterprise backend log"
-          tail -500 /tmp/backend.log || true
-          echo "::endgroup::"
-      - name: Stop backend (final)
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7
@@ -1,18 +1,8 @@
 name: Build and Test Workflow

-# Top-level PR / merge-queue gate. Detects which paths changed and dispatches
-# to the dedicated reusable workflows under .github/workflows/. Each child
-# workflow keeps its own setup/teardown so this file stays a routing layer.
-#
-# The final `all-checks-passed` job is the single status check that branch
-# protection should require — it succeeds only if every required upstream
-# job either succeeded or was legitimately skipped by its path filter.
-
 on:
  pull_request:
    branches: ["main"]
-  merge_group:
-    branches: ["main"]
  workflow_dispatch:

 # cancel in-progress jobs if a new job is triggered
@@ -40,10 +30,6 @@ jobs:
      project: ${{ steps.changes.outputs.project }}
      openapi: ${{ steps.changes.outputs.openapi }}
      frontend: ${{ steps.changes.outputs.frontend }}
-      docker-base: ${{ steps.changes.outputs.docker-base }}
-      tauri: ${{ steps.changes.outputs.tauri }}
-      engine: ${{ steps.changes.outputs.engine }}
-      proprietary: ${{ steps.changes.outputs.proprietary }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
@@ -59,174 +45,428 @@ jobs:
          filters: .github/config/.files.yaml

  build:
-    needs: [files-changed]
+    runs-on: ubuntu-latest
    permissions:
      actions: read
-      contents: read
      security-events: write
-      pull-requests: write
-    uses: ./.github/workflows/backend-build.yml
-    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        jdk-version: [21, 25]
+        spring-security: [true, false]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK ${{ matrix.jdk-version }}
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: ${{ matrix.jdk-version }}
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
+        run: ./gradlew build -PnoSpotless
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
+
+      - name: Check Test Reports Exist
+        if: always()
+        run: |
+          declare -a dirs=(
+            "app/core/build/reports/tests/"
+            "app/core/build/test-results/"
+            "app/common/build/reports/tests/"
+            "app/common/build/test-results/"
+            "app/proprietary/build/reports/tests/"
+            "app/proprietary/build/test-results/"
+          )
+          for dir in "${dirs[@]}"; do
+            if [ ! -d "$dir" ]; then
+              echo "Missing $dir"
+              exit 1
+            fi
+          done
+
+      - name: Upload Test Reports
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
+          path: |
+            app/**/build/reports/jacoco/test
+            app/**/build/reports/tests/
+            app/**/build/test-results/
+            app/**/build/reports/problems/
+            build/reports/problems/
+          retention-days: 3
+          if-no-files-found: warn
+
+      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
+        id: jacoco
+        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
+        with:
+          paths: |
+            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
+          token: ${{ secrets.GITHUB_TOKEN }}
+          min-coverage-overall: 10
+          min-coverage-changed-files: 0
+          comment-type: summary

  check-generateOpenApiDocs:
    if: needs.files-changed.outputs.openapi == 'true'
    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-openapi.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Generate OpenAPI documentation
+        run: ./gradlew :stirling-pdf:generateOpenApiDocs
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Upload OpenAPI Documentation
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: openapi-docs
+          path: ./SwaggerDoc.json

  frontend-validation:
    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/frontend-validation.yml
-    secrets: inherit
-
-  playwright-e2e:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-stubbed.yml
-    secrets: inherit
-
-  playwright-e2e-live:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-live.yml
-    secrets: inherit
-
-  playwright-e2e-enterprise:
-    if: needs.files-changed.outputs.proprietary == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/build-enterprise.yml
-    secrets: inherit
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install frontend dependencies
+        run: cd frontend && npm ci
+      - name: Type-check frontend
+        run: cd frontend && npm run prep && npm run typecheck:all
+      - name: Lint frontend
+        run: cd frontend && npm run lint
+      - name: Build frontend
+        run: cd frontend && npm run build
+      - name: Run frontend tests
+        run: cd frontend && npm run test -- --run
+      - name: Upload frontend build artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: frontend-build
+          path: frontend/dist/
+          retention-days: 3

  check-licence:
    if: needs.files-changed.outputs.build == 'true'
    needs: [files-changed, build]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-licence.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: check the licenses for compatibility
+        # NOTE: --no-parallel is intentional here. Running the checkLicense task in parallel with other
+        # Gradle tasks has been observed to cause intermittent failures with the dependency license
+        # checking plugin on this Gradle version. Disabling parallel execution trades some build speed
+        # for more reliable, deterministic license checks. If upgrading Gradle or the plugin, consider
+        # re-evaluating whether this flag is still required before removing it.
+        run: ./gradlew checkLicense --no-parallel
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: FAILED - check the licenses for compatibility
+        if: failure()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3

  docker-compose-tests:
    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
+    needs: files-changed
+    # if: github.event_name == 'push' && github.ref == 'refs/heads/main' ||
+    #     (github.event_name == 'pull_request' &&
+    #     contains(github.event.pull_request.labels.*.name, 'licenses') == false &&
+    #     (
+    #       contains(github.event.pull_request.labels.*.name, 'Front End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Java') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Back End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Security') ||
+    #       contains(github.event.pull_request.labels.*.name, 'API') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Docker') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Test')
+    #     )
+    #     )
+
+    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
      checks: write
-    uses: ./.github/workflows/docker-compose-tests.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
+      - name: Expose GitHub runtime for Buildx cache
+        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
+
+      - name: Install Docker Compose
+        run: |
+          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo chmod +x /usr/local/bin/docker-compose
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+          cache-dependency-path: ./testing/cucumber/requirements.txt
+
+      - name: Pip requirements
+        run: |
+          pip install --require-hashes -r ./testing/cucumber/requirements.txt
+          pip install behave-html-formatter
+
+      - name: Run Docker Compose Tests
+        run: |
+          chmod +x ./testing/test_webpages.sh
+          chmod +x ./testing/test.sh
+          chmod +x ./testing/test_disabledEndpoints.sh
+          ./testing/test.sh
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: Upload Cucumber Report
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: cucumber-report
+          path: testing/cucumber/report.html
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: Cucumber Test Report
+        if: always()
+        uses: dorny/test-reporter@b082adf0eced0765477756c2a610396589b8c637 # v2.5.0
+        with:
+          name: Cucumber Tests
+          path: testing/cucumber/junit/*.xml
+          reporter: java-junit
+          fail-on-error: false

  test-build-docker-images:
    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
    needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
-    permissions:
-      contents: read
-      packages: read
-    uses: ./.github/workflows/test-build-docker.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
-
-  tauri-build:
-    if: needs.files-changed.outputs.tauri == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/tauri-build.yml
-    secrets: inherit
-
-  ai-engine:
-    if: needs.files-changed.outputs.engine == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/ai-engine.yml
-    secrets: inherit
-
-  pre-commit:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/pre_commit.yml
-    secrets: inherit
-
-  dependency-review:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/dependency-review.yml
-    secrets: inherit
-
-  # Single status check that branch protection should mark as required.
-  # Succeeds when every upstream job is either `success` or `skipped` (path-
-  # gated jobs that didn't apply this run). Any `failure` or `cancelled`
-  # result fails the gate. `if: always()` ensures the gate evaluates even
-  # when an upstream job fails.
-  all-checks-passed:
-    name: All checks passed
-    if: always()
-    needs:
-      - files-changed
-      - build
-      - check-generateOpenApiDocs
-      - frontend-validation
-      - playwright-e2e
-      - playwright-e2e-live
-      - playwright-e2e-enterprise
-      - check-licence
-      - docker-compose-tests
-      - test-build-docker-images
-      - tauri-build
-      - ai-engine
-      - pre-commit
-      - dependency-review
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - docker-rev: docker/embedded/Dockerfile
+            artifact-suffix: Dockerfile
+            cache-scope: stirling-pdf-latest
+          - docker-rev: docker/embedded/Dockerfile.ultra-lite
+            artifact-suffix: Dockerfile.ultra-lite
+            cache-scope: stirling-pdf-ultra-lite
+          - docker-rev: docker/embedded/Dockerfile.fat
+            artifact-suffix: Dockerfile.fat
+            cache-scope: stirling-pdf-fat
    steps:
-      - name: Verify every required job passed (or was legitimately skipped)
-        env:
-          RESULTS: |
-            files-changed=${{ needs.files-changed.result }}
-            build=${{ needs.build.result }}
-            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
-            frontend-validation=${{ needs.frontend-validation.result }}
-            playwright-e2e=${{ needs.playwright-e2e.result }}
-            playwright-e2e-live=${{ needs.playwright-e2e-live.result }}
-            playwright-e2e-enterprise=${{ needs.playwright-e2e-enterprise.result }}
-            check-licence=${{ needs.check-licence.result }}
-            docker-compose-tests=${{ needs.docker-compose-tests.result }}
-            test-build-docker-images=${{ needs.test-build-docker-images.result }}
-            tauri-build=${{ needs.tauri-build.result }}
-            ai-engine=${{ needs.ai-engine.result }}
-            pre-commit=${{ needs.pre-commit.result }}
-            dependency-review=${{ needs.dependency-review.result }}
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Free disk space on runner
        run: |
-          ok=true
-          while IFS='=' read -r name result; do
-            [ -z "$name" ] && continue
-            case "$result" in
-              success|skipped) printf '  %-30s %s\n' "$name" "$result" ;;
-              *)               printf '✗ %-30s %s\n' "$name" "$result"; ok=false ;;
-            esac
-          done <<< "$RESULTS"
-          if [ "$ok" != "true" ]; then
-            echo ""
-            echo "One or more required checks failed or were cancelled."
-            exit 1
-          fi
-          echo ""
-          echo "All required checks passed."
+          echo "Disk space before cleanup:" && df -h
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
+          docker system prune -af || true
+          echo "Disk space after cleanup:" && df -h
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Build application
+        run: ./gradlew build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Build ${{ matrix.docker-rev }}
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./${{ matrix.docker-rev }}
+          push: false
+          cache-from: type=gha,scope=${{ matrix.cache-scope }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Upload Reports
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: reports-docker-${{ matrix.artifact-suffix }}
+          path: |
+            build/reports/tests/
+            build/test-results/
+            build/reports/problems/
+          retention-days: 3
+          if-no-files-found: warn
@@ -1,59 +0,0 @@
-name: License compatibility check
-
-# Reusable workflow called from build.yml when build.gradle / module gradle
-# files change. Verifies all transitive dependencies use a permitted license.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  check-licence:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Check licenses for compatibility
-        run: task backend:licenses:check
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: FAILED - check the licenses for compatibility
-        if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-          retention-days: 3
@@ -1,59 +0,0 @@
-name: Generate OpenAPI documentation
-
-# Reusable workflow called from build.yml when backend Java sources change.
-# Generates SwaggerDoc.json so we know the doc still builds against the
-# current code.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  check-generate-openapi-docs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Generate OpenAPI documentation
-        run: task backend:swagger
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: openapi-docs
-          path: ./SwaggerDoc.json
@@ -201,8 +201,7 @@ jobs:
          python-version: "3.12"

      - name: Install Python dependencies
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt

      - name: Run Python script to check files
        id: run-check
@@ -1,10 +1,13 @@
-name: Dependency Review
-
-# Reusable workflow called from build.yml. Scans dependency manifest files
-# changing in a PR for known-vulnerable packages, using the rules in
-# .github/config/dependency-review-config.yml.
-on:
-  workflow_call:
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: "Dependency Review"
+on: [pull_request]

 permissions:
  contents: read
@@ -21,6 +24,6 @@ jobs:
      - name: "Checkout Repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Dependency Review"
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
        with:
          config-file: "./.github/config/dependency-review-config.yml"
@@ -26,7 +26,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Get commit hashes for frontend and backend
        id: commit-hashes
@@ -85,14 +85,14 @@ jobs:
          fi

      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Build and push frontend image
        if: steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: ./docker/frontend/Dockerfile
@@ -107,7 +107,7 @@ jobs:

      - name: Build and push backend image
        if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: ./docker/backend/Dockerfile
@@ -1,116 +0,0 @@
-name: Docker Compose Cucumber tests
-
-# Reusable workflow called from build.yml when project / docker / testing
-# sources change. Boots the docker-compose stack and runs the cucumber
-# scenarios in testing/cucumber.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-
-permissions:
-  contents: read
-
-jobs:
-  docker-compose-tests:
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: read
-      checks: write
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
-      - name: Expose GitHub runtime for Buildx cache
-        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
-
-      - name: Install Docker Compose
-        run: |
-          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-          sudo chmod +x /usr/local/bin/docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
-          cache-dependency-path: ./testing/cucumber/requirements.txt
-
-      - name: Pip requirements
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
-
-      - name: Run Docker Compose Tests
-        run: |
-          chmod +x ./testing/test_webpages.sh
-          chmod +x ./testing/test.sh
-          chmod +x ./testing/test_disabledEndpoints.sh
-          ./testing/test.sh
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-
-      - name: Upload Cucumber Report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: cucumber-report
-          path: testing/cucumber/report.html
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: docker-compose-test-reports
-          path: testing/reports/
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Cucumber Test Report
-        if: always()
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        with:
-          name: Cucumber Tests
-          path: testing/cucumber/junit/*.xml
-          reporter: java-junit
-          fail-on-error: false
@@ -1,96 +0,0 @@
-name: Playwright E2E (live backend)
-
-# Reusable workflow called from build.yml. Live-backend Playwright suite —
-# boots Spring Boot and runs auth + real tool round-trips against the live
-# server.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e-live:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install Playwright (chromium only)
-        run: task frontend:test:e2e:install -- chromium
-      - name: Start Spring Boot backend (background)
-        env:
-          # Suppress the analytics opt-in modal that fires on first admin login when
-          # enableAnalytics is null (see Onboarding.tsx). The modal renders a Mantine
-          # overlay that intercepts pointer events on every tool page until dismissed,
-          # which causes every "click run button" assertion in the live suite to fail.
-          SYSTEM_ENABLEANALYTICS: "false"
-        # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
-        # The live-setup project's bootstrap spec performs the real first-login
-        # flow against the backend's default admin/stirling user, exercising the
-        # forced-password-change UI and leaving the DB at admin/adminadmin for
-        # the rest of the live suite. This is both real coverage of the first-
-        # login flow and a stronger seed than env-var-driven user creation.
-        run: |
-          nohup ./gradlew :stirling-pdf:bootRun > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-      - name: Wait for backend to become ready
-        run: |
-          start=$SECONDS
-          # 300 iterations × 2s = 10 minute ceiling
-          for i in $(seq 1 300); do
-            if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then
-              echo "Backend up after $((SECONDS - start))s"
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "Backend did not become ready in $((SECONDS - start))s"
-          tail -200 /tmp/backend.log || true
-          exit 1
-      - name: Run live E2E tests (chromium)
-        id: live-tests
-        run: task frontend:test:e2e -- --project=live
-      - name: Print backend log on failure
-        if: failure() && steps.live-tests.conclusion == 'failure'
-        run: |
-          echo "::group::Spring Boot backend log (last 500 lines)"
-          tail -500 /tmp/backend.log || echo "no backend log found"
-          echo "::endgroup::"
-      - name: Stop backend
-        if: always()
-        run: |
-          if [ -f /tmp/backend.pid ]; then
-            kill "$(cat /tmp/backend.pid)" 2>/dev/null || true
-          fi
-      - name: Upload backend log
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: backend-log-live-${{ github.run_id }}
-          path: /tmp/backend.log
-          retention-days: 7
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: playwright-report-live-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7
@@ -1,40 +0,0 @@
-name: Playwright E2E (stubbed)
-
-# Reusable workflow called from build.yml. Backend-free Playwright suite —
-# fast, no Spring Boot required. Runs against the `stubbed` project which
-# mocks API responses in the browser.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install Playwright (chromium only)
-        run: task frontend:test:e2e:install -- chromium
-      - name: Run stubbed E2E tests (chromium)
-        run: task frontend:test:e2e -- --project=stubbed --workers=3
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7
@@ -7,9 +7,6 @@ on:
  pull_request:
    branches:
      - main
-  merge_group:
-    branches:
-      - main

 concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
@@ -92,13 +89,12 @@ jobs:
          NPM_CONFIG_IGNORE_SCRIPTS: "true"
        run: npm ci --ignore-scripts --audit=false --fund=false

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Generate frontend license report (internal PR)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        working-directory: frontend
        env:
          PR_IS_FORK: "false"
-        run: task frontend:licenses:generate
+        run: npm run generate-licenses

      - name: Generate frontend license report (fork PRs, pinned)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
@@ -277,7 +273,7 @@ jobs:
      - name: Create Pull Request (Push only)
        id: cpr
        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: "Update Frontend 3rd Party Licenses"
@@ -345,11 +341,15 @@ jobs:
        with:
          gradle-version: 9.3.1

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check licenses and generate report
        id: license-check
-        run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
+        run: |
+          # NOTE: --no-parallel is intentional here. Running the license-checking tasks in parallel has
+          # previously caused intermittent concurrency issues in CI (e.g. flaky failures in the license
+          # plugin/Gradle when multiple projects are evaluated concurrently). Disabling parallelism trades
+          # some build speed for more reliable license reports. If the underlying issues are resolved in
+          # future Gradle or plugin versions, this flag can be reconsidered.
+          ./gradlew checkLicense generateLicenseReport --no-parallel || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -495,7 +495,7 @@ jobs:
      - name: Create Pull Request (push only)
        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
        id: cpr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: "Update Backend 3rd Party Licenses"
@@ -1,93 +0,0 @@
-name: Frontend lint, type-check, and build
-
-# Reusable workflow called from build.yml when frontend / testing sources
-# change. Runs the consolidated `task frontend:check:all` (lint, types,
-# unit tests, build) and uploads the dist artifact for downstream jobs.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  frontend-validation:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Quality-check frontend
-        id: frontend-check
-        run: task frontend:check:all
-        continue-on-error: true
-      - name: Comment on frontend check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.frontend-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const body = [
-              marker,
-              '### Frontend Check Failed',
-              '',
-              'There are issues with your frontend code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-      - name: Fail if frontend check failed
-        if: steps.frontend-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Frontend Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your frontend code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task frontend:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task frontend:check:all'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
-      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: frontend-build
-          path: frontend/dist/
-          retention-days: 3
@@ -23,7 +23,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
+        uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          yaml-file: .github/labels.yml
@@ -21,14 +21,6 @@ on:
          - windows
          - macos
          - linux
-      sign:
-        description: "Code sign the binaries (requires signing secrets)"
-        required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
  release:
    types: [created]

@@ -57,7 +49,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: |
            ~/.gradle/caches
@@ -71,11 +63,11 @@ jobs:
        with:
          gradle-version: 9.3.1

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: |
+          echo "Running gradlew printVersion..."
+          ./gradlew printVersion --quiet
          VERSION=$(./gradlew printVersion --quiet | tail -1)
          echo "Extracted version: $VERSION"
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
@@ -152,9 +144,6 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-
      - name: Build JAR
        run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
        env:
@@ -188,15 +177,11 @@ jobs:
    env:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit
-          allowed-endpoints: >
-            one.digicert.com:443
-            clientauth.one.digicert.com:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -231,21 +216,89 @@ jobs:
        with:
          gradle-version: 9.3.1

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube

-      - name: Prepare desktop build
-        run: task desktop:prepare
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm ci
+
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -255,7 +308,7 @@ jobs:
          SM_HOST: ${{ secrets.SM_HOST }}

      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        run: |
          Write-Host "Setting up DigiCert KeyLocker environment..."
@@ -290,7 +343,7 @@ jobs:

      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
@@ -321,7 +374,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -342,7 +395,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -353,82 +406,8 @@ jobs:
          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported successfully."

-      # Pre-flight: verify smctl can talk to DigiCert and sync cert before we sign.
-      # Mirrors the setup from working public Tauri+KeyLocker repos (Labric, Meetily).
-      # Without this, signCommand failures are opaque (Tauri captures but drops
-      # smctl's stderr) - running these loudly surfaces auth/env/keypair issues.
-      - name: Preflight smctl
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          & smctl healthcheck
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl healthcheck failed"; exit 1 }
-          & smctl keypair ls
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl keypair ls failed"; exit 1 }
-          & smctl windows certsync --keypair-alias "$env:KEYPAIR_ALIAS"
-          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
-          Write-Host "[SUCCESS] smctl preflight passed"
-
-      # Write platform-specific Tauri config that adds signCommand for Windows.
-      # Tauri auto-merges tauri.windows.conf.json with tauri.conf.json (RFC 7396).
-      # Tauri calls this command on every binary BEFORE bundling into the MSI,
-      # substituting %1 with the file path.
-      #
-      # Why OBJECT form (cmd + args) instead of string:
-      # Tauri's string-form parser does a naive split(' ') with no shell/quote handling.
-      # Args with spaces or quote characters get mangled. The object form passes each
-      # arg directly to Rust's Command::arg which handles Windows CreateProcess quoting.
-      #
-      # Why --keypair-alias instead of --fingerprint:
-      # --fingerprint requires smctl windows certsync to have synced the cert to the
-      # Windows cert store first. --keypair-alias goes direct through PKCS11 and works
-      # without certsync. All real-world working Tauri+smctl examples use this flag.
-      #
-      # smctl reads SM_HOST, SM_API_KEY, SM_CLIENT_CERT_FILE, SM_CLIENT_CERT_PASSWORD
-      # from env (set by prior DigiCert setup step). No --config-file needed.
-      - name: Configure Windows code signing
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
-        shell: bash
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
-          {
-            "bundle": {
-              "windows": {
-                "signCommand": {
-                  "cmd": "smctl",
-                  "args": ["sign", "--keypair-alias", "${KEYPAIR_ALIAS}", "--input", "%1", "--verbose"]
-                }
-              }
-            }
-          }
-          EOF
-          echo "Generated tauri.windows.conf.json (alias masked):"
-          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json
-
-      - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
-        run: |
-          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
-          gpg --list-secret-keys --keyid-format=long
-
-      - name: Make libjvm discoverable for linuxdeploy (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
-          if [ -f "$JAVA_LIBJVM" ]; then
-            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
-            echo "Linked libjvm from $JAVA_LIBJVM -> /usr/lib/libjvm.so"
-          else
-            echo "libjvm not found at $JAVA_LIBJVM"
-            exit 1
-          fi
-
      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
+        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -437,116 +416,114 @@ jobs:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          # AppImage signing — three env vars work together:
-          #   SIGN=1                        tells linuxdeploy-plugin-appimage to forward --sign to appimagetool
-          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
-          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
-          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or V2-master, when secret is present.
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')) && '1' || '0' }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          # DigiCert KeyLocker env vars consumed by smctl during signCommand
-          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
+          # Only enable Windows signing in Tauri when on release or V2-master
+          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

-      - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
-        env:
-          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-        run: |
-          if [ -n "$RELEASE_GPG_FINGERPRINT" ]; then
-            gpg --batch --yes --delete-secret-keys "$RELEASE_GPG_FINGERPRINT" || true
-            gpg --batch --yes --delete-keys "$RELEASE_GPG_FINGERPRINT" || true
-          fi
-
-      # Verify the MSI (outer wrapper users download) AND the inner exe extracted
-      # from it (what actually gets installed and what AV scans). We don't check
-      # target/.../release/stirling-pdf.exe - that's Tauri's intermediate build
-      # artifact. Tauri signs a COPY when bundling into the MSI and leaves the raw
-      # cargo output unsigned, so checking it produces false negatives.
-      - name: Verify Windows Code Signature
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        run: |
-          $allSigned = $true
+          Write-Host "=== DigiCert KeyLocker Signing ==="

-          # Check MSI installer (outer wrapper - what users download)
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          if ($msiFiles.Count -eq 0) {
-            Write-Host "[ERROR] No MSI found under target/"
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
            exit 1
          }
-          foreach ($msi in $msiFiles) {
-            $sig = Get-AuthenticodeSignature -FilePath $msi.FullName
-            Write-Host "MSI: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-            if ($sig.Status -ne "Valid") {
-              Write-Host "[ERROR] MSI is not signed"
-              $allSigned = $false
-            }
-          }

-          # Extract MSI and verify the inner exe (the file that actually gets installed).
-          # This is the critical check - AV flags the installed exe at runtime.
-          $msi = $msiFiles[0].FullName
-          $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
-          if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
-          $proc = Start-Process msiexec.exe -ArgumentList '/a', $msi, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
-          if ($proc.ExitCode -eq 0) {
-            $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
-            if ($innerExe) {
-              $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
-              Write-Host "Inner EXE (from MSI): Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-              if ($sig.Status -ne "Valid") {
-                Write-Host "[ERROR] Inner exe extracted from MSI is NOT signed - AV will flag this at runtime"
-                $allSigned = $false
-              }
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
            } else {
-              Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
-              $allSigned = $false
+              Write-Host "No fingerprint provided, using keypair alias..."
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
            }
-          } else {
-            Write-Host "[ERROR] Failed to extract MSI for verification (exit code: $($proc.ExitCode))"
-            $allSigned = $false
-          }

-          if (-not $allSigned) {
-            Write-Host "[ERROR] Signature verification failed"
-            exit 1
-          }
-          Write-Host "[SUCCESS] MSI and installed exe are properly signed"
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"

-      # Dump smctl log files on failure. Tauri's signCommand captures smctl output
-      # but drops stderr when the command exits non-zero, making failures opaque.
-      # The real errors live in smctl's log files - surface them here for debugging.
-      - name: Dump smctl logs on failure
-        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
-        shell: pwsh
-        run: |
-          $logDir = "$env:USERPROFILE\.signingmanager\logs"
-          if (Test-Path $logDir) {
-            Get-ChildItem $logDir | ForEach-Object {
-              Write-Host "=== $($_.FullName) ==="
-              Get-Content $_.FullName -Tail 200
-              Write-Host ""
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              exit 1
            }
-          } else {
-            Write-Host "smctl log directory not found at $logDir"
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
          }

-      # Rename + Upload: use always() so artifacts are still collected when verify
-      # fails - we need them to manually inspect what actually came out of the build.
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
      - name: Rename artifacts
-        if: always() && steps.digicert-setup.conclusion != 'failure'
        shell: bash
        run: |
          mkdir -p ./dist
@@ -554,20 +531,17 @@ jobs:

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
-            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Upload build artifacts
-        if: always() && steps.digicert-setup.conclusion != 'failure'
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: Stirling-PDF-${{ matrix.name }}
@@ -614,7 +588,7 @@ jobs:
        run: ls -R ./artifacts

      - name: Upload binaries to Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
        with:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
          generate_release_notes: true
@@ -623,7 +597,6 @@ jobs:
            ./artifacts/**/*.msi
            ./artifacts/**/*.dmg
            ./artifacts/**/*.deb
-            ./artifacts/**/*.rpm
            ./artifacts/**/*.AppImage
          draft: false
          prerelease: false
@@ -1,49 +0,0 @@
-name: Nightly E2E Tests
-
-on:
-  schedule:
-    - cron: "0 2 * * *" # 2 AM UTC every night
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-all-browsers:
-    name: Playwright (chromium + firefox + webkit)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install all Playwright browsers
-        run: task frontend:test:e2e:install
-
-      - name: Run E2E tests (all browsers)
-        run: task frontend:test:e2e
-
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: playwright-nightly-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 14
@@ -1,159 +0,0 @@
-name: Update Package Manager Manifests
-
-on:
-  release:
-    types: [ released ]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to test (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the git push at the end (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      dmg_arm64_sha256: ${{ steps.hashes.outputs.dmg_arm64_sha256 }}
-      dmg_x86_64_sha256: ${{ steps.hashes.outputs.dmg_x86_64_sha256 }}
-      msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DMG_ARM64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-aarch64.dmg")
-          DMG_X64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-x86_64.dmg")
-          MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "dmg_arm64_sha256=$DMG_ARM64_SHA" >> "$GITHUB_OUTPUT"
-          echo "dmg_x86_64_sha256=$DMG_X64_SHA"  >> "$GITHUB_OUTPUT"
-          echo "msi_sha256=$MSI_SHA"              >> "$GITHUB_OUTPUT"
-          echo "deb_sha256=$DEB_SHA"              >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA"              >> "$GITHUB_OUTPUT"
-
-  update-homebrew-and-scoop:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-        with:
-          repository: Stirling-Tools/homebrew-stirling-pdf
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          path: tap
-
-      - name: Update Homebrew cask (Casks/stirling-pdf.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          ARM64_SHA: ${{ needs.get-release-info.outputs.dmg_arm64_sha256 }}
-          X64_SHA: ${{ needs.get-release-info.outputs.dmg_x86_64_sha256 }}
-        run: |
-          CASK="tap/Casks/stirling-pdf.rb"
-          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$CASK"
-          awk -v arm="$ARM64_SHA" -v x64="$X64_SHA" '
-            /on_arm/     { in_arm=1 }
-            /on_intel/   { in_arm=0; in_intel=1 }
-            /end/        { in_arm=0; in_intel=0 }
-            in_arm  && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" arm "\"") }
-            in_intel && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" x64 "\"") }
-            { print }
-          ' "$CASK" > tmp && mv tmp "$CASK"
-
-      - name: Update Homebrew formula (Formula/stirling-pdf-server.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          FORMULA="tap/Formula/stirling-pdf-server.rb"
-          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$FORMULA"
-          sed -i "s/sha256 \".*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
-
-      - name: Update Scoop stirling-pdf.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          MSI_SHA: ${{ needs.get-release-info.outputs.msi_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf.json"
-          jq --arg v "$VERSION" --arg h "$MSI_SHA" \
-            '.version = $v | .architecture["64bit"].url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-windows-x86_64.msi" | .architecture["64bit"].hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Update Scoop stirling-pdf-server.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf-server.json"
-          jq --arg v "$VERSION" --arg h "$JAR_SHA" \
-            '.version = $v | .url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-with-login.jar" | .hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Show tap diff (for dry-run visibility)
-        working-directory: tap
-        run: |
-          echo "--- diff --stat ---"
-          git diff --stat
-          echo "--- full diff ---"
-          git diff
-
-      - name: Commit and push all tap updates
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        working-directory: tap
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Casks/stirling-pdf.rb Formula/stirling-pdf-server.rb scoop/stirling-pdf.json scoop/stirling-pdf-server.json
-          git diff --cached --quiet && echo "No changes" && exit 0
-          git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
-          git push
@@ -1,11 +1,10 @@
 name: Pre-commit

-# Runs `pre-commit run` for ruff / codespell / gitleaks / EOF / trailing-ws.
-# Called from build.yml on PRs and merge_group; also runnable on demand via
-# workflow_dispatch for manual local-equivalent linting.
 on:
-  workflow_call:
  workflow_dispatch:
+  push:
+    branches:
+      - main

 permissions:
  contents: read
@@ -17,6 +16,9 @@ jobs:
      # Prevents sdist builds → no tar extraction
      PIP_ONLY_BINARY: ":all:"
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
+    permissions:
+      contents: write
+      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
@@ -29,6 +31,13 @@ jobs:
          fetch-depth: 0
          persist-credentials: false

+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
@@ -48,4 +57,47 @@ jobs:
          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
-          git diff --exit-code
+        continue-on-error: true
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+
+      - name: Build with Gradle
+        run: ./gradlew build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: git add
+        run: |
+          git add .
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: ":file_folder: pre-commit"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: pre-commit
+          title: "🤖 format everything with pre-commit by ${{ steps.setup-bot.outputs.app-slug }}"
+          body: |
+            Auto-generated by [create-pull-request][1] with **${{ steps.setup-bot.outputs.app-slug }}**
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true
@@ -1,122 +0,0 @@
-name: Push Docker Base Image
-
-on:
-  push:
-    branches:
-      - baseDockerImage
-      - accessIssueFix
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Base image version (e.g., 1.0.0, 1.0.1)'
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  push-base:
-    if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Verify authorized user
-        run: |
-          if [ "${{ github.actor }}" != "Frooodle" ]; then
-            echo "Error: Only Frooodle is authorized to run this workflow"
-            exit 1
-          fi
-
-      - name: Set version
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${{ github.event.inputs.version }}"
-          elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
-            VERSION="1.0.3"
-          else
-            VERSION="1.0.0"
-          fi
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for base image
-        id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-base
-          tags: |
-            type=raw,value=${{ steps.version.outputs.version }}
-
-      - name: Build and push base image
-        id: build-push-base
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: docker/base
-          file: ./docker/base/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-base
-          cache-to: type=gha,mode=max,scope=stirling-pdf-base
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Install cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Sign base images
-        env:
-          DIGEST: ${{ steps.build-push-base.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --yes \
-                --key env://COSIGN_PRIVATE_KEY \
-                "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping image signing"
-          fi
@@ -46,7 +46,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: |
            ~/.gradle/caches
@@ -62,10 +62,8 @@ jobs:

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -76,31 +74,31 @@ jobs:

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: "v2.4.1"

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: "v2.4.1"

      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Convert repository owner to lowercase
        id: repoowner
@@ -122,7 +120,7 @@ jobs:

      - name: Build and push Unified Dockerfile (latest variant)
        id: build-push-latest
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -132,9 +130,7 @@ jobs:
          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-            BASE_VERSION=1.0.0
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true
@@ -169,7 +165,7 @@ jobs:

      - name: Build and push Unified Dockerfile (fat variant)
        id: build-push-fat
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -213,7 +209,7 @@ jobs:

      - name: Build and push Unified Dockerfile (ultra-lite variant)
        id: build-push-lite
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -1,93 +0,0 @@
-name: Rollback Latest Tags to Version
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to rollback to (e.g. 2.8.0)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  rollback:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Install crane
-        uses: imjasonh/setup-crane@31b88afe9de28ae0ffa220711af4b60be9435f6e # v0.4
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Rollback all latest tags to v${{ inputs.version }}
-        env:
-          VERSION: ${{ inputs.version }}
-          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
-          DOCKER_HUB_ORG_USERNAME: ${{ secrets.DOCKER_HUB_ORG_USERNAME }}
-          REPO_OWNER: ${{ steps.repoowner.outputs.lowercase }}
-        run: |
-          set -euo pipefail
-
-          IMAGES=(
-            "${DOCKER_HUB_USERNAME}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/stirling-pdf"
-            "${DOCKER_HUB_ORG_USERNAME}/stirling-pdf"
-          )
-
-          VARIANTS=(
-            "${VERSION}:latest"
-            "${VERSION}-fat:latest-fat"
-            "${VERSION}-ultra-lite:latest-ultra-lite"
-          )
-
-          FAILED=0
-
-          for image in "${IMAGES[@]}"; do
-            for variant in "${VARIANTS[@]}"; do
-              SOURCE_TAG="${variant%%:*}"
-              TARGET_TAG="${variant##*:}"
-
-              echo "::group::${image} — ${SOURCE_TAG} → ${TARGET_TAG}"
-
-              if crane manifest "${image}:${SOURCE_TAG}" > /dev/null 2>&1; then
-                crane cp "${image}:${SOURCE_TAG}" "${image}:${TARGET_TAG}"
-                echo "✅ ${image}:${TARGET_TAG} now points to ${SOURCE_TAG}"
-              else
-                echo "::warning::⚠️ ${image}:${SOURCE_TAG} not found, skipping"
-                FAILED=1
-              fi
-
-              echo "::endgroup::"
-            done
-          done
-
-          if [ "$FAILED" -ne 0 ]; then
-            echo "::warning::Some source tags were not found. This is expected if not all variants exist for this version."
-          fi
-
-          echo ""
-          echo "🎉 Rollback to ${VERSION} complete!"
@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.29.5
+        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
        with:
          sarif_file: results.sarif
@@ -22,7 +22,7 @@ jobs:
          egress-policy: audit

      - name: 30 days stale issues
-        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-stale: 30
@@ -56,8 +56,6 @@ jobs:
          SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }}
          SWAGGERHUB_USER: "Frooodle"

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -57,8 +57,7 @@ jobs:
          cache: "pip" # caching pip dependencies

      - name: Install Python dependencies
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt

      - name: Sync translation TOML files
        run: |
@@ -84,7 +83,7 @@ jobs:

      - name: Create Pull Request
        if: always()
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: Update files
@@ -1,17 +1,6 @@
 name: Build Tauri Applications

-# Multi-OS Tauri desktop bundle build matrix (Windows / macOS arm+intel /
-# Linux). Called from build.yml on PRs that touch desktop sources (gated
-# via the `tauri` filter in .github/config/.files.yaml). Also runnable
-# on demand via workflow_dispatch with a per-platform selector.
 on:
-  workflow_call:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)."
-        required: false
-        type: string
-        default: "all"
  workflow_dispatch:
    inputs:
      platform:
@@ -24,6 +13,17 @@ on:
          - windows
          - macos
          - linux
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize, ready_for_review]
+    paths:
+      - "frontend/src-tauri/**"
+      - "frontend/src/desktop/**"
+      - "frontend/tsconfig.desktop.json"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/vite.config.ts"
+      - ".github/workflows/tauri-build.yml"

 permissions:
  contents: read
@@ -45,15 +45,20 @@ jobs:
        id: set-matrix
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          PLATFORM: ${{ inputs.platform }}
        run: |
          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
          MACOS_ARM='{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"}'
          MACOS_INTEL='{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}'
          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'

-          # Resolve requested platform — populated by either workflow_dispatch
-          # or workflow_call inputs; both paths default to "all".
+          # Resolve requested platform (non-dispatch events always build all)
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            PLATFORM="${{ github.event.inputs.platform }}"
+          else
+            PLATFORM="all"
+          fi
+
+          # Build candidate list
          case "$PLATFORM" in
            windows) ENTRIES=("$WINDOWS") ;;
            macos)   ENTRIES=("$MACOS_ARM" "$MACOS_INTEL") ;;
@@ -84,7 +89,6 @@ jobs:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
@@ -124,16 +128,86 @@ jobs:
        with:
          gradle-version: 9.3.1

-      - name: Setup Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Prepare desktop build
-        run: task desktop:prepare
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          # STIRLING_PDF_DESKTOP_UI=false ./gradlew bootJar --no-daemon
+          ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink (always rebuild)
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm ci
+
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
@@ -256,58 +330,8 @@ jobs:
          echo "Available tools:"
          ls -la /usr/bin/hd* || echo "No hd* tools found"

-      - name: Preflight smctl
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          & smctl healthcheck
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl healthcheck failed"; exit 1 }
-          & smctl keypair ls
-          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl keypair ls failed"; exit 1 }
-          & smctl windows certsync --keypair-alias "$env:KEYPAIR_ALIAS"
-          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
-
-      - name: Configure Windows code signing
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: bash
-        env:
-          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-        run: |
-          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
-          {
-            "bundle": {
-              "windows": {
-                "signCommand": {
-                  "cmd": "smctl",
-                  "args": ["sign", "--keypair-alias", "${KEYPAIR_ALIAS}", "--input", "%1", "--verbose"]
-                }
-              }
-            }
-          }
-          EOF
-
-      - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
-        run: |
-          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
-          gpg --list-secret-keys --keyid-format=long
-
-      - name: Make libjvm discoverable for linuxdeploy (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
-          if [ -f "$JAVA_LIBJVM" ]; then
-            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
-            echo "Linked libjvm from $JAVA_LIBJVM -> /usr/lib/libjvm.so"
-          else
-            echo "libjvm not found at $JAVA_LIBJVM"
-            exit 1
-          fi
-
      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
+        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -316,61 +340,178 @@ jobs:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          # AppImage signing — three env vars work together:
-          #   SIGN=1                        tells linuxdeploy-plugin-appimage to forward --sign to appimagetool
-          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
-          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
-          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign when secret is present AND ref is main (skips PRs from forks/Dependabot).
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
-          # Linux: build deb+rpm only here. AppImage runs in its own
-          # continue-on-error step below so its persistent linuxdeploy
-          # failure (#6127 onwards) does not tank deb/rpm uploads.
-          args: ${{ matrix.platform == 'ubuntu-22.04' && '--bundles deb,rpm' || matrix.args }}
+          args: ${{ matrix.args }}

-      # AppImage is decoupled so its linuxdeploy run gets a fresh process
-      # (rpm scratch state torn down) and its failure can't tank deb/rpm.
-      - name: Build Tauri app (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        continue-on-error: true
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }} # gitleaks:allow
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: --bundles appimage
-
-      - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
-        env:
-          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
        run: |
-          if [ -n "$RELEASE_GPG_FINGERPRINT" ]; then
-            gpg --batch --yes --delete-secret-keys "$RELEASE_GPG_FINGERPRINT" || true
-            gpg --batch --yes --delete-keys "$RELEASE_GPG_FINGERPRINT" || true
-          fi
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # List available certificates and check if they have certificates attached
+          Write-Host "Checking for available certificates..."
+          $certList = & smctl keypair ls 2>&1
+          Write-Host "Keypair list output:"
+          Write-Host $certList
+          Write-Host ""
+
+          # Parse the output to check certificate status
+          $lines = $certList -split "`n"
+          $foundKeypair = $false
+          $hasCertificate = $false
+
+          foreach ($line in $lines) {
+            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
+              $foundKeypair = $true
+              Write-Host "[SUCCESS] Found keypair in list"
+
+              # Check if this line has certificate info (not just empty spaces after alias)
+              $parts = $line -split "\s+"
+              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
+                $hasCertificate = $true
+                Write-Host "[SUCCESS] Certificate is associated with keypair"
+              }
+            }
+          }
+
+          if (-not $foundKeypair) {
+            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
+            Write-Host "Available keypairs are listed above"
+            Write-Host ""
+            Write-Host "Please verify:"
+            Write-Host "  1. Keypair alias is correct in GitHub secret"
+            Write-Host "  2. API key has access to this keypair"
+            exit 1
+          }
+
+          if (-not $hasCertificate) {
+            Write-Host "[ERROR] No certificate associated with keypair"
+            Write-Host "This usually means:"
+            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
+            Write-Host "  2. Certificate is pending approval"
+            Write-Host "  3. Certificate needs to be attached to the keypair"
+            Write-Host ""
+            Write-Host "Try running in DigiCert ONE portal:"
+            Write-Host "  smctl keypair sync"
+            exit 1
+          }
+
+          Write-Host "[SUCCESS] Certificate check passed"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              Write-Host ""
+              Write-Host "Possible issues:"
+              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
+              Write-Host "  2. Incorrect keypair alias"
+              Write-Host "  3. API key lacks signing permissions"
+              Write-Host ""
+              Write-Host "Please verify in DigiCert ONE portal:"
+              Write-Host "  - Certificate status is 'Issued' (not Pending)"
+              Write-Host "  - Keypair status is 'Online'"
+              Write-Host "  - 'Can sign' is set to 'Yes'"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"

      - name: Verify notarization (macOS only)
        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
@@ -395,80 +536,73 @@ jobs:

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            # Only ship the MSI installer. The loose exe and WiX toolset exes
-            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

-      # Verify the MSI AND the inner exe extracted from it are signed.
-      # The inner exe is what gets installed on users' machines and what AV scans.
      - name: Verify Windows Code Signature
-        if: matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
        shell: pwsh
        run: |
-          $allSigned = $true
+          Write-Host "Verifying Windows code signatures..."
+
+          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"

-          # Check MSI (outer wrapper)
-          if (Test-Path $msiPath) {
-            $sig = Get-AuthenticodeSignature -FilePath $msiPath
-            Write-Host "MSI: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-            if ($sig.Status -ne "Valid") {
-              Write-Host "[ERROR] MSI is not signed"
-              $allSigned = $false
-            }
+          $allSigned = $true
+          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
+          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""

-            # Extract MSI and verify inner exe
-            $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
-            if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
-            $proc = Start-Process msiexec.exe -ArgumentList '/a', $msiPath, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
-            if ($proc.ExitCode -eq 0) {
-              $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
-              if ($innerExe) {
-                $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
-                Write-Host "Inner EXE: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-                if ($sig.Status -ne "Valid") {
-                  Write-Host "[ERROR] Inner exe is NOT signed - AV will flag this at runtime"
-                  $allSigned = $false
-                }
-              } else {
-                Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
+          # Check EXE signature
+          if (Test-Path $exePath) {
+            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
+            Write-Host "EXE Signature Status: $($exeSig.Status)"
+            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
+            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
+
+            if ($exeSig.Status -ne "Valid") {
+              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
              }
            } else {
-              Write-Host "[ERROR] MSI extraction failed (exit code: $($proc.ExitCode))"
-              $allSigned = $false
+              Write-Host "[SUCCESS] EXE is properly signed"
            }
-          } else {
-            Write-Host "[ERROR] MSI not found at $msiPath"
-            $allSigned = $false
          }

-          if (-not $allSigned) {
-            Write-Host "[ERROR] Signature verification failed"
+          # Check MSI signature
+          if (Test-Path $msiPath) {
+            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI Signature Status: $($msiSig.Status)"
+            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
+            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+
+            if ($msiSig.Status -ne "Valid") {
+              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] MSI is properly signed"
+            }
+          }
+
+          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
+            Write-Host "[ERROR] Code signing verification failed"
            exit 1
-          }
-          Write-Host "[SUCCESS] MSI and inner exe are properly signed"
-
-      - name: Dump smctl logs on failure
-        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
-        shell: pwsh
-        run: |
-          $logDir = "$env:USERPROFILE\.signingmanager\logs"
-          if (Test-Path $logDir) {
-            Get-ChildItem $logDir | ForEach-Object {
-              Write-Host "=== $($_.FullName) ==="
-              Get-Content $_.FullName -Tail 200
-              Write-Host ""
-            }
          } else {
-            Write-Host "smctl log directory not found at $logDir"
+            Write-Host "[SUCCESS] Code signature verification completed"
          }

      - name: Upload artifacts
@@ -500,8 +634,8 @@ jobs:
            fi
          else
            echo "Checking for Linux artifacts..."
-            find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | head -5
-            if [ $(find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
+            find . -name "*.deb" -o -name "*.AppImage" | head -5
+            if [ $(find . -name "*.deb" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
              echo "❌ No Linux artifacts found"
              exit 1
            fi
@@ -514,7 +648,7 @@ jobs:
        run: |
          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
-          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
+          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
              size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
              echo "$file: $size bytes"
@@ -558,7 +692,7 @@ jobs:
              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
-              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
+              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .AppImage' }
            };

            let commentBody = `## 📦 Tauri Desktop Builds Ready!\n\n`;
@@ -1,162 +0,0 @@
-name: Build Docker images (PR test)
-
-# Reusable workflow called from build.yml on PRs to verify the three
-# embedded Dockerfiles (default, ultra-lite, fat) still build cleanly,
-# optionally against a freshly-built base image when the PR touches the
-# base Dockerfile.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-
-permissions:
-  contents: read
-
-jobs:
-  # TODO: extract a pre-matrix `prepare` job that runs once and produces
-  # shared artifacts for the three matrix entries below to consume:
-  #   1. `task backend:build` — currently runs 3× in parallel with
-  #      identical env (DISABLE_ADDITIONAL_FEATURES=true,
-  #      STIRLING_PDF_DESKTOP_UI=false). Build once, upload the JAR as an
-  #      artifact, matrix entries download.
-  #   2. The base-image `docker build` (gated on docker-base-changed) —
-  #      currently runs 3× in parallel against the same Dockerfile and
-  #      context. Build once, `docker save` to an artifact, matrix entries
-  #      `docker load` before the embedded build.
-  # Saves ~2 full backend builds + 2 base-image builds per PR that touches
-  # docker. May also be reusable from backend-build.yml's jdk-25 +
-  # spring-security=true matrix entry if `task backend:build` and
-  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
-  test-build-docker-images:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-            cache-scope: stirling-pdf-latest
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-            cache-scope: stirling-pdf-ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
-            cache-scope: stirling-pdf-fat
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Build application
-        run: task backend:build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Build base image locally (PR base change only)
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: |
-          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
-
-      - name: Set base image and platform for this build
-        id: build-params
-        # Pass workflow inputs through env vars rather than expanding `${{ }}`
-        # directly into the shell — defense-in-depth against template injection
-        # if any upstream provider of these values ever becomes less trusted.
-        # GITHUB_EVENT_NAME is already provided by the runner.
-        env:
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-        run: |
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$DOCKER_BASE_CHANGED" = "true" ]; then
-            echo "base_image=stirling-pdf-base:pr-test" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
-          else
-            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Build ${{ matrix.docker-rev }}
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          cache-from: type=gha,scope=${{ matrix.cache-scope }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      - name: Upload Reports
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
-          path: |
-            build/reports/tests/
-            build/test-results/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
@@ -52,7 +52,7 @@ jobs:
          DISABLE_ADDITIONAL_FEATURES: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Get version number
        id: versionNumber
@@ -61,13 +61,13 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Build and push test image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: ./docker/embedded/Dockerfile
@@ -167,9 +167,9 @@ jobs:
        with:
          key: ${{secrets.TESTDRIVER_API_KEY}}
          prerun: |
-            choco install go-task -y
-            task frontend:build
            cd frontend
+            npm install
+            npm run build
            npm install dashcam-chrome --save
            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
            Start-Sleep -Seconds 20
@@ -29,14 +29,8 @@ clientWebUI/
 exampleYmlFiles/stirling/
 /stirling/
 /testing/file_snapshots
-/testing/cucumber/junit/
-/testing/cucumber/report.html
-/testing/.failed_tests
 SwaggerDoc.json

-# Runtime storage for uploaded files and user data (not Java source code)
-app/core/storage/
-
 # Frontend build artifacts copied to backend static resources
 # These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
@@ -50,7 +44,6 @@ app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
 app/core/src/main/resources/static/robots.txt
 app/core/src/main/resources/static/pdfium/
-app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.

@@ -164,6 +157,8 @@ __pycache__/
 *.pyo

 # Virtual environments
+.env*
+!.env*.example
 .venv*
 env*/
 venv*/
@@ -171,9 +166,6 @@ ENV/
 env.bak/
 venv.bak/

-# Env files (secrets / local overrides). Subproject .gitignore files whitelist any committed defaults.
-.env*
-
 # VS Code
 /.vscode/**/*
 !/.vscode/settings.json
@@ -183,7 +175,6 @@ venv.bak/
 .idea/
 *.iml
 out/
-.junie/

 # Ignore Mac DS_Store files
 .DS_Store
@@ -206,9 +197,6 @@ out/
 *.jks
 *.asc

-# Allow test fixture certificates (synthetic, no real credentials)
-!frontend/src/core/tests/test-fixtures/certs/**
-
 # SSH Keys
 *.pub
 *.priv
@@ -219,14 +207,8 @@ id_ecdsa.pub
 id_ed25519
 id_ed25519.pub
 .ssh/
-
-# Allow the published GPG release signing public key (safe to share)
-!docs/security/signing-key.pub
 *ssh

-# Taskfile checksum cache
-.task/
-
 # cache
 .cache
 .ruff_cache
@@ -263,6 +245,3 @@ docs/type3/signatures/

 # Type3 sample PDFs (development only)
 **/type3/samples/
-
-# Claude
-.claude/
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.11
+    rev: v0.14.14
    hooks:
      - id: ruff
        args:
@@ -12,11 +12,11 @@ repos:
        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
        exclude: (split_photos.py)
  - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.1
    hooks:
      - id: codespell
        args:
-          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment
+          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
@@ -35,7 +35,7 @@ repos:
        files: ^.*(\.js|\.java|\.py|\.yml)$
        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
  - repo: https://github.com/pappasam/toml-sort
-    rev: v0.24.4
+    rev: v0.24.3
    hooks:
      - id: toml-sort-fix
        files: frontend/public/locales/.*\.toml$
@@ -1,122 +0,0 @@
-version: '3'
-
-tasks:
-  dev:
-    desc: "Start backend dev server"
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-    cmds:
-      - cmd: '{{if .AIENGINE_URL}}set "AIENGINE_URL={{.AIENGINE_URL}}" && set "AIENGINE_ENABLED=true" && {{end}}cmd /c gradlew.bat :stirling-pdf:bootRun'
-        platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}./gradlew :stirling-pdf:bootRun'
-        platforms: [linux, darwin]
-
-  build:
-    desc: "Full backend build"
-    cmds:
-      - cmd: cmd /c gradlew.bat clean build
-        platforms: [windows]
-      - cmd: ./gradlew clean build
-        platforms: [linux, darwin]
-
-  build:fast:
-    desc: "Build without tests"
-    cmds:
-      - cmd: cmd /c gradlew.bat clean build -x test
-        platforms: [windows]
-      - cmd: ./gradlew clean build -x test
-        platforms: [linux, darwin]
-
-  build:ci:
-    desc: "Build for CI (formatting checked separately)"
-    cmds:
-      - cmd: cmd /c gradlew.bat build -PnoSpotless
-        platforms: [windows]
-      - cmd: ./gradlew build -PnoSpotless
-        platforms: [linux, darwin]
-
-  test:
-    desc: "Run backend tests"
-    cmds:
-      - cmd: cmd /c gradlew.bat test
-        platforms: [windows]
-      - cmd: ./gradlew test
-        platforms: [linux, darwin]
-
-  format:
-    desc: "Auto-fix code formatting"
-    cmds:
-      - cmd: cmd /c gradlew.bat spotlessApply
-        platforms: [windows]
-      - cmd: ./gradlew spotlessApply
-        platforms: [linux, darwin]
-
-  format:check:
-    desc: "Check code formatting"
-    cmds:
-      - cmd: cmd /c gradlew.bat spotlessCheck
-        platforms: [windows]
-      - cmd: ./gradlew spotlessCheck
-        platforms: [linux, darwin]
-
-  fix:
-    desc: "Auto-fix backend"
-    cmds:
-      - task: format
-
-  swagger:
-    desc: "Generate OpenAPI docs"
-    cmds:
-      - cmd: cmd /c gradlew.bat :stirling-pdf:copySwaggerDoc
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
-        platforms: [linux, darwin]
-    sources:
-      - app/core/src/main/java/**/*.java
-      - app/proprietary/src/main/java/**/*.java
-      - app/common/src/main/java/**/*.java
-    generates:
-      - SwaggerDoc.json
-
-  check:
-    desc: "Backend quality gate"
-    cmds:
-      - task: format:check
-      - task: test
-
-  version:
-    desc: "Print project version"
-    silent: true
-    cmds:
-      - cmd: cmd /c gradlew.bat printVersion --quiet | tail -1
-        platforms: [windows]
-      - cmd: ./gradlew printVersion --quiet | tail -1
-        platforms: [linux, darwin]
-
-  licenses:check:
-    desc: "Check dependency licenses"
-    cmds:
-      - cmd: cmd /c gradlew.bat checkLicense --no-parallel
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense --no-parallel
-        platforms: [linux, darwin]
-
-  licenses:generate:
-    desc: "Check and generate dependency license report"
-    cmds:
-      - cmd: cmd /c gradlew.bat checkLicense generateLicenseReport --no-parallel
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
-        platforms: [linux, darwin]
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - cmd: cmd /c gradlew.bat clean
-        platforms: [windows]
-      - cmd: ./gradlew clean
-        platforms: [linux, darwin]
@@ -1,109 +0,0 @@
-version: '3'
-
-vars:
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-
-tasks:
-  prepare:
-    desc: "Prepare desktop build dependencies"
-    deps:
-      - jlink
-      - task: ":frontend:prepare"
-        vars: { MODE: desktop }
-      - provisioner
-
-  provisioner:
-    desc: "Build installer provisioner"
-    platforms: [windows]
-    cmds:
-      - node scripts/build-provisioner.mjs
-
-  dev:
-    desc: "Start Tauri desktop dev mode"
-    deps: [prepare]
-    ignore_error: true
-    cmds:
-      - npx tauri dev --no-watch
-
-  build:
-    desc: "Build Tauri desktop app (production)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build
-
-  build:dev:
-    desc: "Build Tauri desktop app (dev, no bundling)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --no-bundle
-
-  build:dev:mac:
-    desc: "Build Tauri desktop .app bundle (macOS)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles app
-
-  build:dev:windows:
-    desc: "Build Tauri desktop NSIS installer (Windows)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles nsis
-
-  build:dev:linux:
-    desc: "Build Tauri desktop AppImage (Linux)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles appimage
-
-  clean:
-    desc: "Clean Tauri/Cargo build artifacts"
-    cmds:
-      - task: jlink:clean
-      - cd src-tauri && cargo clean
-      - rm -rf dist build
-
-  # ============================================================
-  # JLink — Build bundled Java runtime for Tauri
-  # ============================================================
-
-  jlink:
-    desc: "Build backend JAR and create JLink runtime for Tauri"
-    deps: [jlink:jar, jlink:runtime]
-
-  jlink:jar:
-    desc: "Build backend JAR for Tauri bundling"
-    run: once
-    dir: ..
-    env:
-      DISABLE_ADDITIONAL_FEATURES: "true"
-    cmds:
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon
-        platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon
-        platforms: [linux, darwin]
-      - mkdir -p frontend/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
-    status:
-      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar
-
-  jlink:runtime:
-    desc: "Create custom JRE with jlink"
-    deps: [jlink:jar]
-    cmds:
-      - rm -rf src-tauri/runtime/jre
-      - mkdir -p src-tauri/runtime
-      - >-
-        jlink
-        --add-modules {{.JLINK_MODULES}}
-        --strip-debug
-        --compress=2
-        --no-header-files
-        --no-man-pages
-        --output src-tauri/runtime/jre
-    status:
-      - test -d src-tauri/runtime/jre
-
-  jlink:clean:
-    desc: "Remove JLink runtime and bundled JARs"
-    cmds:
-      - rm -rf src-tauri/libs src-tauri/runtime
@@ -1,57 +0,0 @@
-version: '3'
-
-vars:
-  COMPOSE_DIR: docker/compose
-  EMBEDDED_DIR: docker/embedded
-
-tasks:
-  build:
-    desc: "Build standard Docker image"
-    cmds:
-      - docker build -t stirling-pdf -f {{.EMBEDDED_DIR}}/Dockerfile .
-
-  build:fat:
-    desc: "Build fat Docker image (all features)"
-    cmds:
-      - docker build -t stirling-pdf-fat -f {{.EMBEDDED_DIR}}/Dockerfile.fat .
-
-  build:ultra-lite:
-    desc: "Build ultra-lite Docker image"
-    cmds:
-      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
-
-  build:frontend:
-    desc: "Build frontend-only Docker image"
-    cmds:
-      - docker build -t stirling-pdf-frontend -f docker/frontend/Dockerfile .
-
-  build:engine:
-    desc: "Build engine Docker image"
-    dir: engine
-    cmds:
-      - docker build -t stirling-pdf-engine .
-
-  up:
-    desc: "Start standard docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml up -d
-
-  up:fat:
-    desc: "Start fat docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.fat.yml up -d
-
-  up:ultra-lite:
-    desc: "Start ultra-lite docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.ultra-lite.yml up -d
-
-  down:
-    desc: "Stop all running docker compose stacks"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml down
-
-  logs:
-    desc: "Tail docker compose logs"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
@@ -1,131 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install engine dependencies"
-    run: once
-    cmds:
-      - uv python install 3.13.8
-      - uv sync
-    sources:
-      - uv.lock
-      - pyproject.toml
-    status:
-      - test -d .venv
-
-  prepare:
-    desc: "Set up engine .env from template"
-    deps: [install]
-    cmds:
-      - uv run scripts/setup_env.py
-    sources:
-      - scripts/setup_env.py
-    generates:
-      - .env.local
-
-  run:
-    desc: "Run engine server"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}}
-
-  dev:
-    desc: "Start engine dev server with hot reload"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - uv run ruff check .
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - uv run ruff check . --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format . --diff
-
-  typecheck:
-    desc: "Run type checking"
-    deps: [install]
-    cmds:
-      - uv run pyright . --warnings
-
-  test:
-    desc: "Run tests"
-    deps: [prepare]
-    cmds:
-      - uv run pytest tests
-
-  fix:
-    desc: "Auto-fix lint + format"
-    cmds:
-      - task: lint:fix
-      - task: format
-
-  check:
-    desc: "Full engine quality gate"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  tool-models:
-    desc: "Generate tool_models.py from Java OpenAPI spec (SwaggerDoc.json)"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py
-    sources:
-      - ../SwaggerDoc.json
-      - scripts/generate_tool_models.py
-    generates:
-      - src/stirling/models/tool_models.py
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - task: '{{if eq .OS "Windows_NT"}}clean-windows{{else}}clean-unix{{end}}'
-
-  clean-unix:
-    internal: true
-    desc: "Clean build artifacts"
-    cmds:
-      - rm -rf .venv data logs output
-
-  # On Windows, use PowerShell as bash failed to delete some dependencies
-  clean-windows:
-    internal: true
-    desc: "Clean build artifacts"
-    ignore_error: true
-    cmds:
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue .venv
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue data
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue logs
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue output
@@ -1,306 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install dependencies"
-    run: once
-    cmds:
-      - '{{ if eq .CI "true" }}npm ci{{ else }}npm install{{ end }}'
-    sources:
-      - package-lock.json
-      - package.json
-    status:
-      - test -d node_modules
-    env:
-      CI: '{{ .CI | default "false" }}'
-
-  prepare:env:
-    internal: true
-    run: when_changed
-    deps: [install]
-    vars:
-      MODE: '{{.MODE | default ""}}'
-    cmds:
-      - npx tsx scripts/setup-env.ts{{if .MODE}} --{{.MODE}}{{end}}
-    sources:
-      - scripts/setup-env.ts
-    generates:
-      - .env.local
-      - .env{{if .MODE}}.{{.MODE}}{{end}}.local
-
-  prepare:icons:
-    internal: true
-    run: once
-    deps: [install]
-    cmds:
-      - node scripts/generate-icons.js
-
-  prepare:
-    desc: "Set up dev environment"
-    run: when_changed
-    vars:
-      MODE: '{{.MODE | default ""}}'
-    deps:
-      - task: prepare:env
-        vars: { MODE: '{{.MODE}}' }
-      - prepare:icons
-
-  # ============================================================
-  # Development
-  # ============================================================
-
-  dev:_run:
-    internal: true
-    ignore_error: true
-    vars:
-      MODE: '{{.MODE}}'
-      PORT: '{{.PORT | default "5173"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      OPEN: '{{.OPEN | default ""}}'
-    env:
-      BACKEND_URL: '{{.BACKEND_URL}}'
-    cmds:
-      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
-
-  dev:
-    desc: "Start frontend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars: { PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:core:
-    desc: "Start frontend dev server in core mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: core, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:proprietary:
-    desc: "Start frontend dev server in proprietary mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: proprietary, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:saas:
-    desc: "Start frontend dev server in SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - task: dev:_run
-        vars: { MODE: saas, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:desktop:
-    desc: "Start frontend dev server in desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - task: dev:_run
-        vars: { MODE: desktop, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:prototypes:
-    desc: "Start frontend dev server in prototypes mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  # ============================================================
-  # Build
-  # ============================================================
-
-  build:
-    desc: "Production build (default mode)"
-    deps: [prepare]
-    cmds:
-      - npx vite build
-
-  build:core:
-    desc: "Build for core mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode core
-
-  build:proprietary:
-    desc: "Build for proprietary mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode proprietary
-
-  build:saas:
-    desc: "Build for SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - npx vite build --mode saas
-
-  build:desktop:
-    desc: "Build for desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - npx vite build --mode desktop
-
-  build:prototypes:
-    desc: "Build for prototypes mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode prototypes
-
-  # ============================================================
-  # Code quality
-  # ============================================================
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - npx eslint --max-warnings=0
-      - npx dpdm src --circular --no-warning --no-tree --exit-code circular:1
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - npx eslint --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --write .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --check .
-
-  fix:
-    desc: "Auto-fix lint and format"
-    cmds:
-      - task: format
-      - task: lint:fix
-
-  typecheck:
-    desc: "Typecheck default build of the app"
-    cmds:
-      - task: typecheck:proprietary
-
-  typecheck:core:
-    desc: "Typecheck core build variant"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project src/core/tsconfig.json
-
-  typecheck:proprietary:
-    desc: "Typecheck proprietary build variant"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project src/proprietary/tsconfig.json
-
-  typecheck:saas:
-    desc: "Typecheck SaaS build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - npx tsc --noEmit --project src/saas/tsconfig.json
-
-  typecheck:desktop:
-    desc: "Typecheck desktop build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - npx tsc --noEmit --project src/desktop/tsconfig.json
-
-  typecheck:scripts:
-    desc: "Typecheck scripts"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project scripts/tsconfig.json
-
-  typecheck:prototypes:
-    desc: "Typecheck prototypes build variant"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project src/prototypes/tsconfig.json
-
-  typecheck:all:
-    desc: "Typecheck all build variants"
-    cmds:
-      - task: typecheck:core
-      - task: typecheck:proprietary
-      - task: typecheck:saas
-      - task: typecheck:desktop
-      - task: typecheck:scripts
-
-  # ============================================================
-  # Quality Gate
-  # ============================================================
-
-  check:
-    desc: "Quick quality gate for local development"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  check:all:
-    desc: "Full CI quality gate"
-    cmds:
-      - task: typecheck:all
-      - task: lint
-      - task: format:check
-      - task: build
-      - task: test
-
-  # ============================================================
-  # Test
-  # ============================================================
-
-  test:
-    desc: "Run tests"
-    deps: [install]
-    cmds:
-      - npx vitest run
-
-  test:watch:
-    desc: "Run tests in watch mode"
-    deps: [install]
-    cmds:
-      - npx vitest --watch
-
-  test:coverage:
-    desc: "Run tests with coverage"
-    deps: [install]
-    cmds:
-      - npx vitest --coverage
-
-  test:e2e:
-    desc: "Run E2E tests"
-    deps: [prepare]
-    cmds:
-      - npx playwright test {{.CLI_ARGS}}
-
-  test:e2e:install:
-    desc: "Install E2E test browsers"
-    deps: [install]
-    cmds:
-      - npx playwright install {{.CLI_ARGS}} --with-deps
-
-  # ============================================================
-  # Code Generation
-  # ============================================================
-
-  licenses:generate:
-    desc: "Generate frontend license report"
-    deps: [install]
-    cmds:
-      - node scripts/generate-licenses.js
@@ -2,151 +2,54 @@

 This file provides guidance to AI Agents when working with code in this repository.

-## Taskfile (Recommended)
-
-This project uses [Task](https://taskfile.dev/) as a unified command runner. All build, dev, test, lint, and docker commands can be run from the repo root via `task <command>`. Run `task --list` to see all available commands.
-
-Task `desc:` fields should describe **what** the task does, not **how** it does it. Keep them generic and stable: don't reference implementation details like aliases, internal helpers, mode flags, or which other task delegates to which. The description is for users picking a command from `task --list`, not a changelog of refactors.
-
-### Quick Reference
- `task install` — install all dependencies
- `task dev` — start backend + frontend concurrently
- `task dev:all` — start backend + frontend + engine concurrently
- `task build` — build all components
- `task test` — run all tests (backend + frontend + engine)
- `task lint` — run all linters
- `task format` — auto-fix formatting across all components
- `task check` — full quality gate (lint + typecheck + test)
- `task clean` — clean all build artifacts
- `task docker:build` — build standard Docker image
- `task docker:up` — start Docker compose stack
-
 ## Common Development Commands

 ### Build and Test
- **Build project**: `task build`
- **Run backend locally**: `task backend:dev`
- **Run all tests**: `task test` (or individually: `task backend:test`, `task frontend:test`, `task engine:test`)
- **Docker integration tests**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
- **Code formatting**: `task format` (or `task backend:format` for Java only)
- **Full quality gate**: `task check` (runs lint + typecheck + test across all components)
-
-After modifying any files in the project, you must run the relevant `task check` command that covers that area of the code. For example, when editing frontend files run `task frontend:check`; for Python engine files run `task engine:check`; for Java backend files run `task backend:check`.
+- **Build project**: `./gradlew clean build`
+- **Run locally**: `./gradlew bootRun`
+- **Full test suite**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
+- **Code formatting**: `./gradlew spotlessApply` (runs automatically before compilation)

 ### Docker Development
- **Build standard**: `task docker:build` (or `docker build -t stirling-pdf -f docker/embedded/Dockerfile .`)
- **Build fat version**: `task docker:build:fat`
- **Build ultra-lite**: `task docker:build:ultra-lite`
- **Start compose stack**: `task docker:up` (or `task docker:up:fat`, `task docker:up:ultra-lite`)
- **Stop compose stack**: `task docker:down`
- **View logs**: `task docker:logs`
+- **Build ultra-lite**: `docker build -t stirlingtools/stirling-pdf:latest-ultra-lite -f ./Dockerfile.ultra-lite .`
+- **Build standard**: `docker build -t stirlingtools/stirling-pdf:latest -f ./Dockerfile .`
+- **Build fat version**: `docker build -t stirlingtools/stirling-pdf:latest-fat -f ./Dockerfile.fat .`
 - **Example compose files**: Located in `exampleYmlFiles/` directory

 ### Security Mode Development
 Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.

-### Python Development (AI Engine)
+### Python Development
+Development for the AI engine happens in the `engine/` folder. It's built with Langchain and Pydantic and allows for the creation and editing of PDF documents. The frontend calls the Python via Java as a proxy.

-The engine is a Python reasoning service for Stirling: it plans and interprets work, but it does not own durable state, and it does not execute Stirling PDF operations directly. Keep the service narrow: typed contracts in, typed contracts out, with AI only where it adds reasoning value. The frontend calls the Python engine via Java as a proxy.
-
-#### Python Commands
-All engine commands run from the repo root using Task:
- `task engine:check` — run all checks (typecheck + lint + format-check + test)
- `task engine:fix` — auto-fix lint + formatting
- `task engine:install` — install Python dependencies via uv
- `task engine:dev` — start FastAPI with hot reload (localhost:5001)
- `task engine:test` — run pytest
- `task engine:lint` — run ruff linting
- `task engine:typecheck` — run pyright
- `task engine:format` — format code with ruff
- `task engine:tool-models` — generate `tool_models.py` from the Java OpenAPI spec
-
-The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `task engine:install`.
-
-#### Python Code Style
- Keep `task engine:check` passing.
- Use modern Python when it improves clarity.
- Prefer explicit names to cleverness.
- Avoid nested functions and nested classes unless the language construct requires them.
- Prefer composition to inheritance when combining concepts.
- Avoid speculative abstractions. Add a layer only when it removes real duplication or clarifies lifecycle.
- Add comments sparingly and only when they explain non-obvious intent.
-
-#### Python Typing and Models
- Deserialize into Pydantic models as early as possible.
- Serialize from Pydantic models as late as possible.
- Do not pass raw `dict[str, Any]` or `dict[str, object]` across important boundaries when a typed model can exist instead.
- Avoid `Any` wherever possible.
- Avoid `cast()` wherever possible (reconsider the structure first).
- All shared models should subclass `stirling.models.ApiModel` so the service behaves consistently.
- Do not use string literals for any type annotations, including `cast()`.
-
-#### Python Configuration
- Keep application-owned configuration in `stirling.config`.
- Only add `STIRLING_*` environment variables that the engine itself truly owns.
- Do not mirror third-party provider environment variables unless the engine is actually interpreting them.
- Let `pydantic-ai` own provider authentication configuration when possible.
-
-#### Python Architecture
-
-**Package roles:**
- `stirling.contracts`: request/response models and shared typed workflow contracts. If a shape crosses a module or service boundary, it probably belongs here.
- `stirling.models`: shared model primitives and generated tool models.
- `stirling.agents`: reasoning modules for individual capabilities.
- `stirling.api`: HTTP layer, dependency access, and app startup wiring.
- `stirling.services`: shared runtime and non-AI infrastructure.
- `stirling.config`: application-owned settings.
-
-**Source of truth:**
- `stirling.models.tool_models` is the source of truth for operation IDs and parameter models.
- Do not duplicate operation lists if they can be derived from `tool_models.OPERATIONS`.
- Do not hand-maintain parallel parameter schemas when the generated tool models already define them.
- If a tool ID must match a parameter model, validate that relationship explicitly in code.
-
-**Boundaries:**
- Keep the API layer thin. Route modules should bind requests, resolve dependencies, and call agents or services. They should not contain business logic.
- Keep agents focused on one reasoning domain. They should not own FastAPI routing, persistence, or execution of Stirling operations.
- Build long-lived runtime objects centrally at startup when possible rather than reconstructing heavy AI objects per request.
- If an agent delegates to another agent, the delegated agent should remain the source of truth for its own domain output.
-
-#### Python AI Usage
- The system must work with any AI, including self-hosted models. We require that the models support structured outputs, but should minimise model-specific code beyond that.
- Use AI for reasoning-heavy outputs, not deterministic glue.
- Do not ask the model to invent data that Python can derive safely.
- Do not fabricate fallback user-facing copy in code to hide incomplete model output.
- AI output schemas should be impossible to instantiate incorrectly.
-  - Do not require the model to keep separate structures in sync. For example, instead of generating two lists which must be the same length, generate one list of a model containing the same data.
-  - Prefer Python to derive deterministic follow-up structure from a valid AI result.
- Use `NativeOutput(...)` for structured model outputs.
- Use `ToolOutput(...)` when the model should select and call delegate functions.
-
-#### Python Testing
- Test contracts directly.
- Test agents directly where behaviour matters.
- Test API routes as thin integration points.
- Prefer dependency overrides or startup-state seams to monkeypatching random globals.
+- Python version is 3.13; use modern Python features (type aliases, pattern matching, dataclasses, etc.) where they help clarity.
+- Write fully type-correct code; keep pyright clean and avoid `Any` unless strictly necessary.
+- JSON handling: deserialize into fully typed Pydantic models as early as possible, and serialize back from Pydantic models as late as possible.
+- Use Makefile commands for Python work:
+  - From `engine/`: `make check` to lint, type-check, test, etc. and `make fix` to fix easily fixable linting & formatting issues.
+- The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed appropriately there, followed by running `make install`.
+- Prefer using classes to nesting functions, and make other similar architectural decisions to improve testability. Do not nest classes or functions unless specifically required to for the code construct (like a decorator).
+- All environment variables used within the code must begin with the `STIRLING_` prefix in order to keep them unique and easier to find.

 ### Frontend Development
- **Frontend dev server**: `task frontend:dev` — requires backend on localhost:8080
+- **Frontend dev server**: `cd frontend && npm run dev` (requires backend on localhost:8080)
 - **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
 - **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
 - **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
- **Package Installation**: `task frontend:install`
+- **Package Installation**: DO NOT run npm install commands - package management handled separately
 - **Deployment Options**:
-  - **Desktop App**: `task desktop:build`
-  - **Web Server**: `task frontend:build` then serve dist/ folder
-  - **Development**: `task desktop:dev` for desktop dev mode
+  - **Desktop App**: `npm run tauri-build` (native desktop application)
+  - **Web Server**: `npm run build` then serve dist/ folder
+  - **Development**: `npm run tauri-dev` for desktop dev mode

 #### Environment Variables
- All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/.env` — core, proprietary, and shared vars
-  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
- These files are committed to Git and must not contain private keys
- Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
- Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
- `task frontend:prepare` creates empty `.local` override files on first run; pass `MODE=saas` or `MODE=desktop` to also create the mode-specific `.local` file
- Prepare runs automatically as a dependency of all `dev*`, `build*`, and `desktop*` tasks
+- All `VITE_*` variables must be declared in the appropriate example file:
+  - `frontend/config/.env.example` — core, proprietary, and shared vars
+  - `frontend/config/.env.saas.example` — SaaS-only vars
+  - `frontend/config/.env.desktop.example` — desktop (Tauri)-only vars
+- Never use `|| 'hardcoded-fallback'` inline — put defaults in the example files
+- `npm run prep` / `prep:saas` / `prep:desktop` auto-create the env files from examples on first run, and error if any required keys are missing
+- These prep scripts run automatically at the start of all `dev*`, `build*`, and `tauri*` commands
 - See `frontend/README.md#environment-variables` for full documentation

 #### Import Paths - CRITICAL
@@ -400,17 +303,15 @@ The frontend is organized with a clear separation of concerns:

 ## Development Workflow

-1. **Local Development** (using Taskfile):
-   - Backend + frontend: `task dev`
-   - All services (including AI engine): `task dev:all`
-   - Or individually: `task backend:dev` (localhost:8080), `task frontend:dev` (localhost:5173), `task engine:dev` (localhost:5001)
-2. **Quality Gate**: Run `task check` before submitting PRs
-3. **Docker Testing**: Use `./test.sh` for full Docker integration tests
-4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
-5. **Translations**:
+1. **Local Development**:
+   - Backend: `./gradlew bootRun` (runs on localhost:8080)
+   - Frontend: `cd frontend && npm run dev` (runs on localhost:5173, proxies to backend)
+2. **Docker Testing**: Use `./test.sh` before submitting PRs
+3. **Code Style**: Spotless enforces Google Java Format automatically
+4. **Translations**:
   - Backend: Use helper scripts in `/scripts` for multi-language updates
   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
-6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
+5. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`

 ## Frontend Architecture Status

@@ -15,19 +15,6 @@ Before you start working on an issue, please comment on (or create) the issue an
 Once you have been assigned an issue, you can start working on it. When you are ready to submit your changes, open a pull request.
 For a detailed pull request tutorial, see [this guide](https://www.digitalocean.com/community/tutorials/how-to-create-a-pull-request-on-github).

-## Development Quick Start
-
-This project uses [Task](https://taskfile.dev/) as a unified command runner. After cloning:
-
-1. Install the `task` CLI: https://taskfile.dev/installation/
-2. Run `task install` to install all dependencies
-3. Run `task dev` to start backend + frontend
-4. Run `task check` before submitting a PR
-
-Run `task --list` to see all available commands.
-
-## Pull Request Guidelines
-
 Please make sure your Pull Request adheres to the following guidelines:

 - Use the PR template provided.
@@ -52,10 +39,9 @@ If, at any point in time, you have a question, please feel free to ask in the sa

 ## Developer Documentation

-For technical guides, setup instructions, and development resources:
+For technical guides, setup instructions, and development resources, please see our [Developer Documentation](devGuide/) which includes:

- [Developer Guide](DeveloperGuide.md) - Main setup and architecture guide
- [Taskfile.yml](Taskfile.yml) - Unified task runner for all build/dev/test/lint commands
+- [Developer Guide](devGuide/DeveloperGuide.md) - Main setup and architecture guide
 - [Exception Handling Guide](devGuide/EXCEPTION_HANDLING_GUIDE.md) - Error handling patterns and i18n
 - [Translation Guide](devGuide/HowToAddNewLanguage.md) - Adding new languages
 - And more in the [devGuide folder](devGuide/)
@@ -42,13 +42,11 @@ This guide focuses on developing for Stirling 2.0, including both the React fron

 ### Prerequisites

- [Task](https://taskfile.dev/installation/) — unified command runner (recommended)
 - Docker
 - Git
 - Java JDK 21 or later (JDK 25 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
- [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)

@@ -84,29 +82,13 @@ For local testing, you should generally be testing the full 'Security' version o
 5. **Frontend Setup (Required for Stirling 2.0)**
   Navigate to the frontend directory and install dependencies using npm.

-### Verify Setup
-
-Run `task install` to install all project dependencies (frontend npm packages, engine Python packages). Gradle manages its own dependencies automatically. Then run `task check` to verify everything builds and passes.
-
 ## 4. Stirling 2.0 Development Workflow

-### Using Taskfile (Recommended)
-
-The fastest way to start developing:
-
-1. **Start developing**: `task dev` (runs backend + frontend concurrently — Ctrl+C to stop)
-2. **Or start services individually** in separate terminals:
-   - `task backend:dev` — Spring Boot on localhost:8080
-   - `task frontend:dev` — Vite on localhost:5173
-   - `task engine:dev` — FastAPI on localhost:5001
-
-Run `task --list` to see all available commands.
-
 ### Frontend Development (React)
 The frontend is a React SPA that runs independently during development:

-1. **Start the backend**: `task backend:dev` (serves API endpoints on localhost:8080)
-2. **Start the frontend dev server**: `task frontend:dev` (serves UI on localhost:5173)
+1. **Start the backend**: Run the Spring Boot application (serves API endpoints on localhost:8080)
+2. **Start the frontend dev server**: Navigate to the frontend directory and run the development server (serves UI on localhost:5173)
 3. **Development flow**: The Vite dev server automatically proxies API calls to the backend

 ### File Storage Architecture
@@ -117,10 +99,7 @@ Stirling 2.0 uses client-side file storage:

 ### Tauri Desktop App Development
 Stirling-PDF can be packaged as a cross-platform desktop application using Tauri with PDF file association support and bundled JRE.
-
-Using Taskfile: `task desktop:dev` (development) or `task desktop:build` (production build).
-
-See [the frontend README](frontend/README.md#tauri) for detailed build instructions.
+See [the frontend README](frontend/README.md#tauri) for build instructions.

 ## 5. Project Structure

@@ -208,7 +187,7 @@ services:
        limits:
          memory: 4G
    healthcheck:
-      test: ["CMD-SHELL", "curl -f http://localhost:8080$${SYSTEM_ROOTURIPATH:-''}/api/v1/info/status | grep -q 'UP' && curl -fL http://localhost:8080/ | grep -q 'Please sign in'"]
+      test: ["CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP' && curl -fL http://localhost:8080/ | grep -q 'Please sign in'"]
      interval: 5s
      timeout: 10s
      retries: 16
@@ -243,20 +222,6 @@ docker-compose -f exampleYmlFiles/docker-compose-latest-security.yml up

 ### Building Docker Images

-#### Using Taskfile (Recommended)
-
-```bash
-task docker:build            # standard image
-task docker:build:fat        # fat image (all features)
-task docker:build:ultra-lite # ultra-lite image
-task docker:up               # start standard compose stack
-task docker:up:fat           # start fat compose stack
-task docker:down             # stop all stacks
-task docker:logs             # tail logs
-```
-
-#### Manual Docker Builds
-
 Stirling-PDF uses different Docker images for various configurations. The build process is controlled by environment variables and uses specific Dockerfile variants. Here's how to build the Docker images:

 1. Set the security environment variable:
@@ -265,10 +230,10 @@ Stirling-PDF uses different Docker images for various configurations. The build
   export DISABLE_ADDITIONAL_FEATURES=true  # or false for to enable login and security features for builds
   ```

-2. Build the project:
+2. Build the project with Gradle:

   ```bash
-   task backend:build
+   ./gradlew clean build
   ```

 3. Build the Docker images:
@@ -296,18 +261,9 @@ Note: The `--no-cache` and `--pull` flags ensure that the build process uses the

 ## 7. Testing

-### Quick Testing with Taskfile
-
-Run all unit/integration tests across all components:
-
-```bash
-task test    # run all tests (backend + frontend + engine)
-task check   # full quality gate: lint + typecheck + test
-```
-
 ### Comprehensive Testing Script

-Stirling-PDF also provides a `test.sh` script in the root directory for Docker integration tests. This script builds all versions of Stirling-PDF, checks that each version works, and runs Cucumber tests. It's recommended to run this script before submitting a final pull request.
+Stirling-PDF provides a `test.sh` script in the root directory. This script builds all versions of Stirling-PDF, checks that each version works, and runs Cucumber tests. It's recommended to run this script before submitting a final pull request.

 To run the test script:

@@ -333,11 +289,10 @@ Note: The `test.sh` script will run automatically when you raise a PR. However,

 For React frontend development:

-1. Start the backend: `task backend:dev` (serves API endpoints on localhost:8080)
-2. Start the frontend dev server: `task frontend:dev` (serves UI on localhost:5173)
+1. Start the backend: Run the Spring Boot application to serve API endpoints on localhost:8080
+2. Start the frontend dev server: Navigate to the frontend directory and run the development server on localhost:5173
 3. The Vite dev server automatically proxies API calls to the backend
-4. Run frontend tests: `task frontend:test` (or `task frontend:test:watch` for watch mode)
-5. Test React components, UI interactions, and IndexedDB file operations using browser developer tools
+4. Test React components, UI interactions, and IndexedDB file operations using browser developer tools

 ### Local Testing (Java and UI Components)

@@ -353,7 +308,7 @@ To run Stirling-PDF locally:
 1. Compile and run the project using built-in IDE methods or by running:

   ```bash
-   task backend:dev
+   ./gradlew bootRun
   ```

 2. Access the application at `http://localhost:8080` in your web browser.
@@ -374,11 +329,10 @@ Important notes:
 2. Create a new branch for your feature or bug fix.
 3. Make your changes and commit them with clear, descriptive messages and ensure any documentation is updated related to your changes.
 4. Test your changes thoroughly in the Docker environment.
-5. Run the quality gate and integration tests:
+5. Run the `test.sh` script to ensure all versions build correctly and pass the Cucumber tests:

   ```bash
-   task check   # lint + typecheck + test across all components
-   ./test.sh    # Docker integration tests (builds all variants + Cucumber)
+   ./test.sh
   ```

 6. Push your changes to your fork.
@@ -1,444 +0,0 @@
-# File Sharing Feature - Architecture & Workflow
-
-## Overview
-
-The File Sharing feature enables users to store files server-side and share them with other registered users or via token-based share links. Files are stored using a pluggable storage provider (local filesystem or database) with optional quota enforcement.
-
-**Key Capabilities:**
- Server-side file storage (upload, update, download, delete)
- Optional history bundle and audit log attachments per file
- Direct user-to-user sharing with access roles
- Token-based share links (requires `system.frontendUrl`)
- Optional email notifications for shares (requires `mail.enabled`)
- Access audit trail (tracks who accessed a share link and how)
- Automatic share link expiration
- Storage quotas (per-user and total)
- Pluggable storage backend (local filesystem or database BLOB)
- Integration with the Shared Signing workflow
-
-## Architecture
-
-### Database Schema
-
-**`stored_files`**
- One record per uploaded file
- Stores file metadata (name, content type, size, storage key)
- Optionally links to a history bundle and audit log as separate stored objects
- `workflow_session_id` — nullable link to a `WorkflowSession` (signing feature)
- `file_purpose` — enum classifying the file's role: `GENERIC`, `SIGNING_ORIGINAL`, `SIGNING_SIGNED`, `SIGNING_HISTORY`
-
-**`file_shares`**
- One record per sharing relationship
- Two share types, distinguished by which fields are set:
-  - **User share**: `shared_with_user_id` is set, `share_token` is null
-  - **Link share**: `share_token` is set (UUID), `shared_with_user_id` is null
- `access_role` — `EDITOR`, `COMMENTER`, or `VIEWER`
- `expires_at` — nullable expiration for link shares
- `workflow_participant_id` — when set, marks this as a **workflow share** (hidden from the file manager, accessible only via workflow endpoints)
-
-**`file_share_accesses`**
- One record per access event on a share link
- Tracks: user, share link, access type (`VIEW` or `DOWNLOAD`), timestamp
-
-**`storage_cleanup_entries`**
- Queue of storage keys to be deleted asynchronously
- Used when a file is deleted but the physical storage object cleanup is deferred
-
-### Access Roles
-
-| Role | Can Read | Can Write |
-|------|----------|-----------|
-| `EDITOR` | ✅ | ✅ |
-| `COMMENTER` | ✅ | ❌ |
-| `VIEWER` | ✅ | ❌ |
-
-Default role when none is specified: `EDITOR`.
-
-Owners always have full access regardless of role.
-
-#### Role Semantics: COMMENTER vs VIEWER
-
-In the file storage layer, `COMMENTER` and `VIEWER` are equivalent — both grant read-only access and neither can replace file content. The distinction is meaningful in the **signing workflow** context:
-
-| Context | COMMENTER | VIEWER |
-|---------|-----------|--------|
-| File storage | Read only (same as VIEWER) | Read only |
-| Signing workflow | Can submit a signing action | Read only |
-
-`WorkflowParticipant.canEdit()` returns `true` for `COMMENTER` (and `EDITOR`) roles, which the signing workflow uses to determine if a participant can still submit a signature. Once a participant has signed or declined, their effective role is automatically downgraded to `VIEWER` regardless of their configured role.
-
-The rationale: "annotating" a document (submitting a signature) is not the same as "replacing" it. COMMENTER grants annotation rights without file-replacement rights.
-
-### Backend Architecture
-
-#### Service Layer
-
-**FileStorageService** (`1137 lines`)
- Core file management service
- Upload, update, download, and delete operations
- User share management (share, revoke, leave)
- Link share management (create, revoke, access)
- Access recording and listing
- Storage quota enforcement
- Configuration feature gate checks
-
-**StorageCleanupService**
- Scheduled daily: deletes orphaned storage keys from `storage_cleanup_entries`
- Scheduled daily: purges expired share links from `file_shares`
- Processes cleanup in batches of 50 entries
-
-#### Storage Providers
-
-**LocalStorageProvider**
- Files stored on the filesystem under `storage.local.basePath` (default: `./storage`)
- Storage key is a path relative to the base directory
-
-**DatabaseStorageProvider**
- Files stored as BLOBs in `stored_file_blobs` table
- No filesystem dependency
-
-Provider is selected at startup via `storage.provider: local | database`.
-
-#### Controller Layer
-
-**FileStorageController** (`/api/v1/storage`)
- All endpoints require authentication
- File CRUD and sharing operations
-
-### Data Flow
-
-```
-User uploads file → StorageProvider stores bytes → StoredFile record created
-       ↓
-Owner shares file → FileShare record created (user or link)
-       ↓
-Recipient accesses file → Access recorded → File bytes streamed
-```
-
-## File Operations
-
-### Upload File
-
-```bash
-POST /api/v1/storage/files
-Content-Type: multipart/form-data
-
-file: document.pdf                # Required — main file
-historyBundle: history.json       # Optional — version history
-auditLog: audit.json              # Optional — audit trail
-```
-
-**Response:**
-```json
-{
-  "id": 42,
-  "fileName": "document.pdf",
-  "contentType": "application/pdf",
-  "sizeBytes": 102400,
-  "owner": "alice",
-  "ownedByCurrentUser": true,
-  "accessRole": "editor",
-  "createdAt": "2025-01-01T12:00:00",
-  "updatedAt": "2025-01-01T12:00:00",
-  "sharedWithUsers": [],
-  "sharedUsers": [],
-  "shareLinks": []
-}
-```
-
-### Update File
-
-Replaces the file content. Only the owner can update.
-
-```bash
-PUT /api/v1/storage/files/{fileId}
-Content-Type: multipart/form-data
-
-file: document_v2.pdf
-historyBundle: history.json       # Optional
-auditLog: audit.json              # Optional
-```
-
-### List Files
-
-Returns all files owned by or shared with the current user. Workflow-shared files (signing participants) are excluded — those are accessible via signing endpoints only.
-
-```bash
-GET /api/v1/storage/files
-```
-
-Response is sorted by `createdAt` descending.
-
-### Download File
-
-```bash
-GET /api/v1/storage/files/{fileId}/download?inline=false
-```
-
- `inline=false` (default) — `Content-Disposition: attachment`
- `inline=true` — `Content-Disposition: inline` (for browser preview)
-
-### Delete File
-
-Only the owner can delete. All associated share links and their access records are deleted first, then the database record, then the physical storage object.
-
-```bash
-DELETE /api/v1/storage/files/{fileId}
-```
-
-## Sharing Operations
-
-### Share with User
-
-```bash
-POST /api/v1/storage/files/{fileId}/shares/users
-Content-Type: application/json
-
-{
-  "username": "bob",          # Username or email address
-  "accessRole": "editor"      # "editor", "commenter", or "viewer" (default: "editor")
-}
-```
-
-**Behaviour:**
- If the target user exists: creates/updates a `FileShare` with `sharedWithUser` set
- If `username` is an email address and the user doesn't exist: creates a share link and sends a notification email (requires `sharing.emailEnabled` and `sharing.linkEnabled`)
- If the target user is the owner: returns 400
- If sharing is disabled: returns 403
-
-### Revoke User Share
-
-Only the owner can revoke.
-
-```bash
-DELETE /api/v1/storage/files/{fileId}/shares/users/{username}
-```
-
-### Leave Shared File
-
-The recipient removes themselves from a shared file.
-
-```bash
-DELETE /api/v1/storage/files/{fileId}/shares/self
-```
-
-### Create Share Link
-
-Creates a token-based link for anonymous/authenticated access. Requires `sharing.linkEnabled` and `system.frontendUrl` to be configured.
-
-```bash
-POST /api/v1/storage/files/{fileId}/shares/links
-Content-Type: application/json
-
-{
-  "accessRole": "viewer"      # Optional (default: "editor")
-}
-```
-
-**Response:**
-```json
-{
-  "token": "550e8400-e29b-41d4-a716-446655440000",
-  "accessRole": "viewer",
-  "createdAt": "2025-01-01T12:00:00",
-  "expiresAt": "2025-01-04T12:00:00"
-}
-```
-
-Expiration is set to `now + sharing.linkExpirationDays` (default: 3 days).
-
-### Revoke Share Link
-
-```bash
-DELETE /api/v1/storage/files/{fileId}/shares/links/{token}
-```
-
-Also deletes all access records for that token.
-
-## Share Link Access
-
-### Download via Share Link
-
-Authentication is required (even for share links). Anonymous access is not permitted.
-
-```bash
-GET /api/v1/storage/share-links/{token}?inline=false
-```
-
- Returns 401 if unauthenticated
- Returns 403 if authenticated but link doesn't permit access
- Returns 410 if the link has expired
- Records a `FileShareAccess` entry on success
-
-> **Token-as-credential semantics:** Any authenticated user who holds the token can access the file — the token is the credential. If you need per-user access control (only a specific person can open it), use "Share with User" instead. Share links are appropriate for broader distribution where possession of the token implies authorization.
-
-### Get Share Link Metadata
-
-```bash
-GET /api/v1/storage/share-links/{token}/metadata
-```
-
-Returns file name, owner, access role, creation/expiry timestamps, and whether the current user owns the file.
-
-### List Accessed Share Links
-
-Returns the most recent access for each non-expired share link the current user has accessed.
-
-```bash
-GET /api/v1/storage/share-links/accessed
-```
-
-### List Accesses for a Link (Owner Only)
-
-```bash
-GET /api/v1/storage/files/{fileId}/shares/links/{token}/accesses
-```
-
-Returns per-user access history (username, VIEW/DOWNLOAD, timestamp), sorted descending by time.
-
-## Workflow Share Integration
-
-Signing workflow participants access documents via their own `WorkflowParticipant.shareToken`. No `FileShare` record is created for participants; access control is self-contained in the `WorkflowParticipant` entity.
-
-The `FileShare.workflow_participant_id` column and the `FileShare.isWorkflowShare()` method are **deprecated**. Legacy data (sessions created before this change) may still have `FileShare` records with `workflow_participant_id` set, which continue to work via the existing token lookup path in `UnifiedAccessControlService`. No new records are created.
-
-`GET /api/v1/storage/files` returns all files owned by or shared with the current user (via `FileShare`). Signing-session PDFs use the `file_purpose` field (`SIGNING_ORIGINAL`, `SIGNING_SIGNED`, etc.) to distinguish them from generic files. The file manager UI can filter on this field if needed.
-
-## API Reference
-
-| Method | Endpoint | Description | Auth |
-|--------|----------|-------------|------|
-| POST | `/api/v1/storage/files` | Upload file | Required |
-| PUT | `/api/v1/storage/files/{id}` | Update file | Required (owner) |
-| GET | `/api/v1/storage/files` | List accessible files | Required |
-| GET | `/api/v1/storage/files/{id}` | Get file metadata | Required |
-| GET | `/api/v1/storage/files/{id}/download` | Download file | Required |
-| DELETE | `/api/v1/storage/files/{id}` | Delete file | Required (owner) |
-| POST | `/api/v1/storage/files/{id}/shares/users` | Share with user | Required (owner) |
-| DELETE | `/api/v1/storage/files/{id}/shares/users/{username}` | Revoke user share | Required (owner) |
-| DELETE | `/api/v1/storage/files/{id}/shares/self` | Leave shared file | Required |
-| POST | `/api/v1/storage/files/{id}/shares/links` | Create share link | Required (owner) |
-| DELETE | `/api/v1/storage/files/{id}/shares/links/{token}` | Revoke share link | Required (owner) |
-| GET | `/api/v1/storage/share-links/{token}` | Download via share link | Required |
-| GET | `/api/v1/storage/share-links/{token}/metadata` | Get share link metadata | Required |
-| GET | `/api/v1/storage/share-links/accessed` | List accessed share links | Required |
-| GET | `/api/v1/storage/files/{id}/shares/links/{token}/accesses` | List share accesses | Required (owner) |
-
-## Configuration
-
-All storage settings live under the `storage:` key in `settings.yml`:
-
-```yaml
-storage:
-  enabled: true                  # Requires security.enableLogin = true
-  provider: local                # 'local' or 'database'
-  local:
-    basePath: './storage'        # Filesystem base directory (local provider only)
-  quotas:
-    maxStorageMbPerUser: -1      # Per-user storage cap in MB; -1 = unlimited
-    maxStorageMbTotal: -1        # Total storage cap in MB; -1 = unlimited
-    maxFileMb: -1                # Max size per upload (main + history + audit) in MB; -1 = unlimited
-  sharing:
-    enabled: false               # Master switch for all sharing (opt-in)
-    linkEnabled: false           # Enable token-based share links (requires system.frontendUrl)
-    emailEnabled: false          # Enable email notifications (requires mail.enabled)
-    linkExpirationDays: 3        # Days until share links expire
-```
-
-**Prerequisites:**
- `storage.enabled` requires `security.enableLogin = true`
- `sharing.linkEnabled` requires `system.frontendUrl` to be set (used to build share link URLs)
- `sharing.emailEnabled` requires `mail.enabled = true`
-
-## Security Considerations
-
-### Access Control
- All endpoints require authentication — there is no anonymous access
- Owner-only operations enforced in service layer (not just controller)
- `requireReadAccess` / `requireEditorAccess` checked on every download
-
-### Share Link Security
- Tokens are UUIDs (random, not guessable)
- Expiration enforced on every access
- Expired links return HTTP 410 Gone
- Revoked links delete all access records
-
-### Quota Enforcement
- Checked before storing (not after)
- Accounts for existing file size when replacing (only the delta counts)
- Covers main file + history bundle + audit log in a single check
-
-## Automatic Cleanup
-
-`StorageCleanupService` runs two scheduled jobs daily:
-
-1. **Orphaned storage cleanup** — processes up to 50 `StorageCleanupEntry` records, deletes the physical storage object, then removes the entry. Failed attempts increment `attemptCount` for retry.
-
-2. **Expired share link cleanup** — deletes all `FileShare` records where `expiresAt` is in the past and `shareToken` is set.
-
-## Troubleshooting
-
-**"Storage is disabled":**
- Check `storage.enabled: true` in settings
- Verify `security.enableLogin: true`
-
-**"Share links are disabled":**
- Check `sharing.linkEnabled: true`
- Verify `system.frontendUrl` is set and non-empty
-
-**"Email sharing is disabled":**
- Check `sharing.emailEnabled: true`
- Verify `mail.enabled: true` and mail configuration
-
-**Signing-session PDF appearing in the general file list:**
- This is expected — signing PDFs are accessible to owners and shared users
- Filter by `file_purpose` (`SIGNING_ORIGINAL`, `SIGNING_SIGNED`) in the UI to distinguish them
-
-**Share link returns 410:**
- Link has expired — check `expires_at` in `file_shares` table
- Owner must create a new link
-
-### Debug Queries
-
-```sql
-- List files and their share counts
-SELECT sf.stored_file_id, sf.original_filename, u.username as owner,
-       COUNT(DISTINCT fs.file_share_id) FILTER (WHERE fs.shared_with_user_id IS NOT NULL) as user_shares,
-       COUNT(DISTINCT fs.file_share_id) FILTER (WHERE fs.share_token IS NOT NULL) as link_shares
-FROM stored_files sf
-LEFT JOIN users u ON sf.owner_id = u.user_id
-LEFT JOIN file_shares fs ON fs.stored_file_id = sf.stored_file_id
-GROUP BY sf.stored_file_id, u.username;
-
-- Check share link expiration
-SELECT share_token, access_role, created_at, expires_at,
-       expires_at < NOW() as is_expired
-FROM file_shares
-WHERE share_token IS NOT NULL;
-
-- Check access history for a share link
-SELECT u.username, fsa.access_type, fsa.accessed_at
-FROM file_share_accesses fsa
-JOIN file_shares fs ON fsa.file_share_id = fs.file_share_id
-JOIN users u ON fsa.user_id = u.user_id
-WHERE fs.share_token = '{token}'
-ORDER BY fsa.accessed_at DESC;
-
-- Pending cleanup entries
-SELECT storage_key, attempt_count, updated_at
-FROM storage_cleanup_entries
-ORDER BY updated_at ASC;
-```
-
-## Summary
-
-The File Sharing feature provides:
- ✅ Server-side file storage with pluggable backend (local/database)
- ✅ History bundle and audit log attachments per file
- ✅ Direct user-to-user sharing with EDITOR/COMMENTER/VIEWER roles
- ✅ Token-based share links with expiration
- ✅ Optional email notifications for shares
- ✅ Per-access audit trail for share links
- ✅ Storage quotas (per-user, total, per-file)
- ✅ Automatic cleanup of expired links and orphaned storage
- ✅ Workflow integration (signing-session PDFs stored via same infrastructure; participant access via `WorkflowParticipant.shareToken`)
@@ -14,8 +14,6 @@ if that directory exists, is licensed under the license defined in "frontend/src
 if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * All content that resides under the "frontend/src/saas/" directory of this repository,
 if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
-* All content that resides under the "frontend/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.

@@ -60,7 +60,7 @@ For full installation options (including desktop and Kubernetes), see our [Docum

 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

-This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task install` to get started, or see the [Developer Guide](DeveloperGuide.md) for full details.
+For development setup, see the [Developer Guide](DeveloperGuide.md).

 For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).

@@ -1,691 +0,0 @@
-# Shared Signing Feature - Architecture & Workflow
-
-## Overview
-
-The Shared Signing feature enables collaborative document signing workflows where a document owner can request signatures from multiple participants. Each participant receives a secure token to access the document, submit their digital signature (with optional wet signature overlay), and track the signing progress.
-
-**Key Capabilities:**
- Multi-participant signing sessions
- Digital certificate signatures (P12/PKCS12, JKS, SERVER, USER_CERT, PEM/UPLOAD)
- Visual wet signature overlays (drawn, typed, or uploaded) — multiple per participant
- Token-based participant access (no authentication required for participants)
- Authenticated participant access for registered users via sign-requests API
- Progress tracking for session owners
- Optional signature summary page appended to finalized PDF
- Automatic role downgrade after signing (security)
- GDPR-compliant wet signature metadata cleanup
-
-## Architecture
-
-### Database Schema
-
-#### Core Tables
-
-**`workflow_sessions`**
- Tracks signing sessions created by document owners
- Links to original and processed (signed) PDF files
- Stores session metadata (message, due date, status)
-
-**`workflow_participants`**
- One record per participant per session
- Tracks participant status: PENDING → VIEWED → SIGNED/DECLINED
-  - `NOTIFIED` status is reserved for a future email notification feature; no current code path sets it
- Stores participant-specific metadata (certificates, wet signatures) as JSONB
- Each participant holds their own `shareToken` (UUID) for token-based access — no separate `FileShare` record is created
- `accessRole` controls what actions the participant can perform. `COMMENTER` (and `EDITOR`) allow submitting a signature; `VIEWER` does not. After signing/declining, effective role is automatically downgraded to `VIEWER`
-
-**`user_server_certificates`**
- Stores auto-generated certificates per user
- Enables "Use My Personal Certificate" option
-
-#### Extended Tables
-
-**`stored_files`**
- Added `workflow_session_id` to link files to signing sessions
- Added `file_purpose` enum (SIGNING_ORIGINAL, SIGNING_SIGNED, etc.)
-
-**`file_shares`**
- Regular file shares are created when the session owner shares the document with other users via the file manager
- The `workflow_participant_id` column is deprecated; participant access is self-contained in `WorkflowParticipant.shareToken`
-
-### Backend Architecture
-
-#### Service Layer
-
-**WorkflowSessionService** (`816 lines`)
- Core workflow management service
- Creates sessions with participants
- Handles participant status updates
- Stores signature metadata (certificates and wet signatures)
- Finalizes sessions by coordinating signing process
-
-Key responsibilities:
- Session lifecycle management (create, list, get details, delete)
- Participant management (add, remove, notify)
- Certificate submission storage
- Wet signature metadata storage
- Session finalization orchestration
-
-**UnifiedAccessControlService**
- Validates participant tokens
- Checks session status and expiration
- Maps participant status to effective access role
- Automatic role downgrade after signing: SIGNED/DECLINED → VIEWER role
-
-**UserServerCertificateService**
- Auto-generates personal certificates for users
- Manages certificate storage and retrieval
- Enables "Use My Personal Certificate" signing option
-
-#### Controller Layer
-
-**SigningSessionController** (Owner-facing + Authenticated participant endpoints)
- `POST /api/v1/security/cert-sign/sessions` - Create signing session
- `GET /api/v1/security/cert-sign/sessions` - List user's sessions
- `GET /api/v1/security/cert-sign/sessions/{id}` - Get session details
- `GET /api/v1/security/cert-sign/sessions/{id}/pdf` - Download original PDF
- `POST /api/v1/security/cert-sign/sessions/{id}/finalize` - Finalize and apply signatures
- `GET /api/v1/security/cert-sign/sessions/{id}/signed-pdf` - Download signed PDF
- `DELETE /api/v1/security/cert-sign/sessions/{id}` - Delete session
- `POST /api/v1/security/cert-sign/sessions/{id}/participants` - Add participants
- `DELETE /api/v1/security/cert-sign/sessions/{id}/participants/{participantId}` - Remove participant
- `GET /api/v1/security/cert-sign/sign-requests` - List sign requests for authenticated user
- `GET /api/v1/security/cert-sign/sign-requests/{id}` - Get sign request details
- `GET /api/v1/security/cert-sign/sign-requests/{id}/document` - Download document for signing
- `POST /api/v1/security/cert-sign/sign-requests/{id}/sign` - Sign document (authenticated)
- `POST /api/v1/security/cert-sign/sign-requests/{id}/decline` - Decline sign request (authenticated)
-
-**WorkflowParticipantController** (Participant-facing, token-based)
- `GET /api/v1/workflow/participant/session?token={token}` - View session details
- `GET /api/v1/workflow/participant/details?token={token}` - Get participant details
- `GET /api/v1/workflow/participant/document?token={token}` - Download PDF
- `POST /api/v1/workflow/participant/submit-signature` - Submit signature
- `POST /api/v1/workflow/participant/decline?token={token}` - Decline to sign
-
-#### Data Flow
-
-```
-Owner creates session → Participants receive tokens →
-Participants access via token (or authenticated) → Participants submit signatures →
-Owner finalizes → System applies signatures → [Optional: append summary page] → Signed PDF generated
-```
-
-### Frontend Architecture
-
-#### Quick Access Integration
-
-**SignPopout Component**
- Displays in Quick Access Bar (top navigation)
- Shows active and completed signing sessions
- Auto-refreshes every 15 seconds to show signature progress
- Badge indicator shows count of pending sessions
-
-**ActiveSessionsPanel**
- Lists sessions where user is owner or participant
- Shows signature progress: "X/Y signatures" (e.g., "2/5 signatures")
- Color-coded badges:
-  - Blue: No signatures yet (0/X)
-  - Yellow: Partial signatures (X/Y)
-  - Green: Ready to finalize (X/X)
-
-**CompletedSessionsPanel**
- Lists finalized sessions and declined sign requests
- Allows viewing/downloading signed PDFs
-
-#### Workbench Views
-
-**SignRequestWorkbenchView**
- Full-screen view for participants to sign documents
- Integrated PDF viewer with annotation support
- Certificate selection (Personal/Organization/Custom P12)
- Wet signature input (draw, type, or upload)
- Signature placement on PDF pages
-
-**SessionDetailWorkbenchView**
- Owner's view of session details
- Participant list with status indicators
- Ability to add/remove participants
- Finalize button when all signatures collected
- Download original/signed PDF
-
-#### State Management
-
-**FileContext Integration**
- Signing sessions operate within FileContext workflow
- PDFs loaded once, persist across tool switches
- Memory management for large files (up to 100GB+)
-
-**ToolWorkflowContext**
- Registers custom workbench views
- Manages navigation between viewer and signing tools
- Preserves file state during signing operations
-
-#### Services & Hooks
-
-**workflowService.ts**
- API client for all signing endpoints
- Handles session creation, listing, and management
- Participant operations (submit, decline)
-
-**useWorkflowSession.ts**
- React hook for owner session management
- State management for session list and details
-
-**useParticipantSession.ts**
- React hook for participant signing workflow
- Manages signature submission state
-
-## Signing Workflow Process
-
-### 1. Session Creation (Owner)
-
-```
-Owner → Uploads PDF → Selects participants → Creates session
-        ↓
-System creates:
-  - WorkflowSession record
-  - WorkflowParticipant records (one per participant, each with a unique shareToken)
-        ↓
-Participants receive token (via email or share link)
-```
-
-**API Call:**
-```bash
-POST /api/v1/security/cert-sign/sessions
-Content-Type: multipart/form-data
-
-file: document.pdf
-workflowType: SIGNING
-documentName: "contract.pdf"           # Optional display name
-participantUserIds: [1, 2, 3]          # Registered user IDs
-participantEmails: ["a@b.com"]         # External/unregistered users
-participants: [...]                    # Detailed participant configs (optional)
-message: "Please sign this contract"
-dueDate: "2025-12-31"
-ownerEmail: "owner@example.com"        # Optional, for notifications
-workflowMetadata: '{"showSignature": false, "showLogo": false, "includeSummaryPage": true}'
-```
-
-**Session-level `workflowMetadata` fields:**
-| Field | Type | Description |
-|-------|------|-------------|
-| `showSignature` | boolean | Show visible digital signature block on PDF |
-| `pageNumber` | integer | Page to place digital signature on |
-| `showLogo` | boolean | Show logo in digital signature block |
-| `includeSummaryPage` | boolean | Append a signature summary page before digital signing |
-
-**Response:**
-```json
-{
-  "sessionId": "uuid",
-  "documentName": "contract.pdf",
-  "participants": [
-    {
-      "userId": 1,
-      "email": "user1@example.com",
-      "shareToken": "token1",
-      "status": "PENDING"
-    }
-  ],
-  "participantCount": 3,
-  "signedCount": 0
-}
-```
-
-### 2. Participant Access
-
-```
-Participant → Clicks token link → Views session details
-        ↓
-Status changes: PENDING/NOTIFIED → VIEWED
-        ↓
-Participant downloads PDF to review
-```
-
-**Access URL (unauthenticated):**
-```
-https://app.example.com/sign?token={participant_token}
-```
-
-**Authenticated participants** can also use:
-```
-GET /api/v1/security/cert-sign/sign-requests
-GET /api/v1/security/cert-sign/sign-requests/{sessionId}
-GET /api/v1/security/cert-sign/sign-requests/{sessionId}/document
-```
-
-**Automatic Status Update:**
- First access: PENDING/NOTIFIED → VIEWED
- Downloads tracked but don't change status
-
-### 3. Signature Submission
-
-```
-Participant → Selects certificate type → Uploads certificate (if needed)
-           → Draws/uploads wet signatures (optional, multiple supported)
-           → Submits signature
-        ↓
-System stores:
-  - Certificate data (P12/JKS keystore as base64)
-  - Certificate password
-  - Wet signatures metadata (JSON array: base64 image + coordinates per signature)
-        ↓
-Status changes: VIEWED → SIGNED
-Access role: EDITOR → VIEWER (automatic downgrade)
-```
-
-**API Call (token-based, unauthenticated):**
-```bash
-POST /api/v1/workflow/participant/submit-signature
-Content-Type: multipart/form-data
-
-participantToken: {token}
-certType: P12 | JKS | SERVER | USER_CERT
-p12File: certificate.p12 (if certType=P12)
-jksFile: keystore.jks (if certType=JKS)
-password: cert_password
-showSignature: false
-pageNumber: 1
-location: "New York"
-reason: "I approve this contract"
-showLogo: false
-wetSignaturesData: '[{"page":0,"x":100,"y":200,"width":150,"height":50,"type":"IMAGE","data":"base64..."}]'
-```
-
-**API Call (authenticated users):**
-```bash
-POST /api/v1/security/cert-sign/sign-requests/{sessionId}/sign
-Content-Type: multipart/form-data
-
-certType: SERVER | USER_CERT | UPLOAD | PEM | PKCS12 | PFX | JKS
-p12File: certificate.p12 (if applicable)
-password: cert_password
-reason: "I approve this contract"
-location: "New York"
-wetSignaturesData: '[...]'
-```
-
-**Metadata Storage (JSONB):**
-```json
-{
-  "certificateSubmission": {
-    "certType": "P12",
-    "password": "cert_password",
-    "p12Keystore": "base64_encoded_keystore",
-    "showSignature": false,
-    "pageNumber": 1,
-    "location": "New York",
-    "reason": "I approve this contract",
-    "showLogo": false
-  },
-  "wetSignatures": [
-    {
-      "type": "IMAGE",
-      "data": "base64_image",
-      "page": 0,
-      "x": 100,
-      "y": 200,
-      "width": 150,
-      "height": 50
-    }
-  ]
-}
-```
-
-Note: Multiple wet signatures are supported per participant (array).
-
-### 4. Progress Tracking (Owner)
-
-```
-Owner → Views session list → Sees "2/5 signatures"
-      → Clicks session → Views participant status
-        ↓
-Participant list shows:
-  - user1@example.com: SIGNED ✓
-  - user2@example.com: SIGNED ✓
-  - user3@example.com: VIEWED (pending)
-  - user4@example.com: PENDING
-  - user5@example.com: DECLINED ✗
-        ↓
-Auto-refresh every 15 seconds
-```
-
-**Badge Colors:**
- 🔵 Blue: 0/5 signatures (awaiting)
- 🟡 Yellow: 2/5 signatures (partial)
- 🟢 Green: 5/5 signatures (ready to finalize)
-
-### 5. Session Finalization
-
-```
-Owner → Clicks "Finalize" → System processes signatures
-        ↓
-Processing steps:
-  1. Apply wet signatures to PDF (visual overlays)
-  1.5. Append signature summary page (if includeSummaryPage=true)
-  2. Apply digital certificates in participant order
-     - Visual signature block suppressed when summary page is enabled
-  3. Store signed PDF
-  4. Clear wet signature metadata (GDPR compliance)
-        ↓
-Owner downloads signed PDF
-```
-
-**Finalization Process:**
-
-1. **Apply Wet Signatures First**
-   ```java
-   for (WetSignature sig : wetSignatures) {
-     PDPage page = document.getPage(sig.getPage());
-     byte[] imageBytes = Base64.decode(sig.getData());
-     // Convert Y from top-left (UI) to bottom-left (PDF) coordinate system
-     float pdfY = page.getMediaBox().getHeight() - sig.getY() - sig.getHeight();
-     PDImageXObject image = PDImageXObject.createFromByteArray(document, imageBytes, "signature");
-     contentStream.drawImage(image, sig.getX(), pdfY, sig.getWidth(), sig.getHeight());
-   }
-   ```
-
-2. **Append Summary Page (optional, before digital signing)**
-
-   If `includeSummaryPage=true`, a new A4 page is appended showing:
-   - Stirling logo and "Signature Summary" title
-   - Document name and session owner
-   - Finalization timestamp
-   - Per-participant: name, email, status, signed timestamp, reason, location, certificate type
-   - Supports overflow to additional pages
-
-   This step occurs **before** digital certificate signing so signatures are not invalidated.
-   When a summary page is added, the visual digital signature block (`showSignature`) is suppressed — wet signatures (hand-drawn overlays) are unaffected.
-
-3. **Apply Digital Certificates (in participant order)**
-   ```java
-   for (Participant p : participants) {
-     if (p.status == SIGNED) {
-       KeyStore keystore = buildKeystore(p.certificate);
-       // Reason: participant override > owner default > "Document Signing"
-       // Location: participant-provided only (no default)
-       CertSignController.sign(pdfBytes, keystore, password, settings);
-     }
-   }
-   ```
-
-4. **Store and Cleanup**
-   ```java
-   StoredFile signedFile = storeFile(signedPdfBytes, SIGNING_SIGNED);
-   session.setProcessedFile(signedFile);
-   session.setFinalized(true);
-
-   // GDPR: Clear sensitive metadata after finalization
-   for (Participant p : participants) {
-     p.metadata.remove("wetSignatures");         // Clears wet signature image data
-     p.metadata.remove("certificateSubmission"); // Clears keystore bytes + password
-   }
-   ```
-
-**API Call:**
-```bash
-POST /api/v1/security/cert-sign/sessions/{sessionId}/finalize
-Authorization: Bearer {owner_token}
-```
-
-**Response:** Binary PDF file with Content-Disposition header
-
-## Key Technical Features
-
-### 1. Double JSON Encoding Fix (Recent)
-
-**Problem:** JSONB columns were storing JSON strings instead of JSON objects, requiring double-parsing.
-
-**Solution:** Created `JsonMapConverter` JPA AttributeConverter:
-```java
-@Convert(converter = JsonMapConverter.class)
-@Column(name = "participant_metadata", columnDefinition = "jsonb")
-private Map<String, Object> participantMetadata;
-```
-
-**Benefits:**
- Single parse on read
- Proper JSON storage in PostgreSQL
- Type-safe Map access
- Backward compatible with legacy data
-
-### 2. Signature Progress Display (Recent)
-
-**Implementation:**
- `WorkflowSessionResponse` includes `participantCount` and `signedCount`
- `WorkflowMapper` calculates counts when converting to DTO
- Frontend displays "X/Y signatures" in session list
- Auto-refresh every 15 seconds keeps counts updated
-
-### 3. Token-Based Security
-
-**No Authentication Required for Participants:**
- Participants access via secure token (UUID)
- Token linked to specific participant and session
- Automatic expiration support
- One-time signing (cannot sign twice)
-
-**Authenticated Participant Access:**
- Registered users can also access sign requests via `/api/v1/security/cert-sign/sign-requests`
- Standard Spring Security authentication required
- Supports additional cert types: UPLOAD, PEM, PKCS12, PFX
-
-**Automatic Role Downgrade:**
- After signing: EDITOR → VIEWER
- After declining: EDITOR → VIEWER
- Prevents modification after action taken
-
-### 4. Storage Integration
-
-**Unified with File Sharing:**
- All PDFs stored via `StorageProvider` (Database or Local)
- Respects storage quotas
- Supports files up to 100GB+ (with Local storage)
- Consistent with existing file sharing infrastructure
-
-### 5. Certificate Types
-
-**P12/PKCS12/PFX:** User uploads PKCS#12 file + password
-**JKS:** User uploads Java KeyStore + password
-**PEM/UPLOAD:** User uploads PEM certificate + private key
-**SERVER:** Uses organization's server certificate (no upload needed)
-**USER_CERT:** Uses user's auto-generated personal certificate (one-click)
-
-Note: UPLOAD, PEM, PKCS12, PFX are available on the authenticated (`sign-requests`) path. The token-based path uses P12, JKS, SERVER, USER_CERT.
-
-## Frontend Components Overview
-
-### Owner Workflow Components
-
-1. **CreateSessionPanel** - Form to create new signing session
-2. **ActiveSessionsPanel** - List of pending sessions with progress
-3. **SessionDetailWorkbenchView** - Full session management interface
-4. **CompletedSessionsPanel** - History of finalized sessions
-
-### Participant Workflow Components
-
-1. **SignRequestWorkbenchView** - Main signing interface
-2. **SignatureSettingsInput** - Certificate selection and configuration
-3. **WetSignatureInput** - Draw/type/upload signature overlay
-4. **SignatureSettingsDisplay** - Preview of signature settings
-
-### Shared Components
-
-1. **UserSelector** - Multi-select user picker for participants
-2. **LocalEmbedPDFWithAnnotations** - PDF viewer with signature placement
-
-## Configuration
-
-### Backend Configuration
-
-**application.properties:**
-```properties
-# Database (H2 or PostgreSQL)
-spring.jpa.hibernate.ddl-auto=update
-
-# Security
-DOCKER_ENABLE_SECURITY=true
-
-# Storage Provider (DATABASE or LOCAL)
-storage.provider=LOCAL
-storage.maxFileSize=100GB
-```
-
-### Frontend Configuration
-
-**Quick Access Bar:**
- Signing popout accessible from top navigation
- Auto-refresh interval: 15 seconds
- Badge shows pending session count
-
-## API Reference Summary
-
-### Owner Endpoints (Authenticated)
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| POST | `/api/v1/security/cert-sign/sessions` | Create session |
-| GET | `/api/v1/security/cert-sign/sessions` | List sessions |
-| GET | `/api/v1/security/cert-sign/sessions/{id}` | Get details |
-| POST | `/api/v1/security/cert-sign/sessions/{id}/finalize` | Finalize session |
-| GET | `/api/v1/security/cert-sign/sessions/{id}/pdf` | Download original |
-| GET | `/api/v1/security/cert-sign/sessions/{id}/signed-pdf` | Download signed |
-| DELETE | `/api/v1/security/cert-sign/sessions/{id}` | Delete session |
-| POST | `/api/v1/security/cert-sign/sessions/{id}/participants` | Add participants |
-| DELETE | `/api/v1/security/cert-sign/sessions/{id}/participants/{pid}` | Remove participant |
-
-### Authenticated Participant Endpoints
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| GET | `/api/v1/security/cert-sign/sign-requests` | List sign requests |
-| GET | `/api/v1/security/cert-sign/sign-requests/{id}` | Get sign request details |
-| GET | `/api/v1/security/cert-sign/sign-requests/{id}/document` | Download document |
-| POST | `/api/v1/security/cert-sign/sign-requests/{id}/sign` | Sign document |
-| POST | `/api/v1/security/cert-sign/sign-requests/{id}/decline` | Decline signing |
-
-### Token-Based Participant Endpoints (No Auth Required)
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| GET | `/api/v1/workflow/participant/session?token={token}` | View session |
-| GET | `/api/v1/workflow/participant/details?token={token}` | Get participant details |
-| GET | `/api/v1/workflow/participant/document?token={token}` | Download PDF |
-| POST | `/api/v1/workflow/participant/submit-signature` | Submit signature |
-| POST | `/api/v1/workflow/participant/decline?token={token}` | Decline signing |
-
-## Security Considerations
-
-### Data Protection
- Wet signature image data cleared after finalization (GDPR compliance)
- Certificate submission data (keystore bytes + password) cleared after finalization (GDPR compliance)
- Certificate passwords are not encrypted at rest while stored (TODO: encrypt at rest)
- Token expiration support
-
-### Access Control
- Owner authentication required for session management
- Participant access via secure UUID tokens (no auth) or standard auth (sign-requests)
- Automatic role downgrade prevents re-signing
- Session status checks prevent unauthorized actions
-
-### Audit Trail
- All participant actions tracked
- FileShare access logged
- Status transitions recorded
- Notification history maintained
-
-## Performance Characteristics
-
-### Scalability
- Supports PDFs up to 100GB+ (with Local storage provider)
- Memory-efficient streaming for large files
- IndexedDB caching on frontend
- Database indexes on session_id, share_token, workflow_session_id
-
-### Response Times
- Session creation: ~500ms (10MB file)
- Session listing: ~100ms
- Token validation: ~50ms
- Finalization: ~2s per MB of PDF (varies by certificate operations)
-
-## Future Enhancements
-
-### Planned Features
- Email notifications for participants
- Reminder system for pending signatures
- Bulk signing operations
- Template-based signing workflows
- Signature validation/verification UI
- Certificate password encryption at rest
- Certificate keystore cleanup after finalization (GDPR)
- Webhook support for external integrations
- Analytics dashboard for signing metrics
-
-### Additional Workflow Types
- **REVIEW** - Document review with comments
- **APPROVAL** - Multi-level approval chains
- **COLLABORATION** - Real-time collaborative editing
-
-## Troubleshooting
-
-### Common Issues
-
-**"Token invalid" error:**
- Check token exists in workflow_participants table
- Verify session is not finalized
- Check expiration date (expires_at)
-
-**Signature not appearing on PDF:**
- Verify certificate type is correct
- Check certificate password
- Review logs for signing errors
- Ensure PDFDocumentFactory is available
-
-**"Awaiting signatures" not updating:**
- Backend should return participantCount and signedCount
- Frontend auto-refresh every 15 seconds
- Check network tab for API errors
-
-**Wet signatures not visible after finalization:**
- Wet signatures are applied first as image overlays (Step 1)
- Check `wetSignaturesData` was sent as valid JSON array
- Verify page index is within document bounds
- Note: wet signatures survive regardless of `includeSummaryPage` setting
-
-### Debug Queries
-
-```sql
-- Check session status
-SELECT session_id, status, finalized,
-       (SELECT COUNT(*) FROM workflow_participants WHERE workflow_session_id = ws.id) as participant_count,
-       (SELECT COUNT(*) FROM workflow_participants WHERE workflow_session_id = ws.id AND status = 'SIGNED') as signed_count
-FROM workflow_sessions ws;
-
-- Check participant tokens
-SELECT email, status, share_token, expires_at
-FROM workflow_participants
-WHERE workflow_session_id = (SELECT id FROM workflow_sessions WHERE session_id = '{session_id}');
-
-- Check metadata storage
-SELECT email,
-       participant_metadata->'certificateSubmission'->>'certType' as cert_type,
-       jsonb_array_length(participant_metadata->'wetSignatures') as wet_sig_count
-FROM workflow_participants;
-```
-
-## Summary
-
-The Shared Signing feature provides a complete collaborative signing workflow with:
- ✅ Multi-participant support with progress tracking
- ✅ Multiple certificate types (P12/PKCS12/PFX, JKS, PEM, SERVER, USER_CERT)
- ✅ Visual wet signature overlays (multiple per participant)
- ✅ Token-based security for unauthenticated participants
- ✅ Authenticated participant access via sign-requests API
- ✅ Automatic role management
- ✅ Large file support (100GB+)
- ✅ GDPR-compliant wet signature metadata cleanup
- ✅ Real-time progress updates
- ✅ Full frontend integration with Quick Access Bar
- ✅ Optional signature summary page with logo and participant details
-
-The architecture leverages existing file sharing infrastructure while adding workflow-specific features, ensuring consistency and maintainability across the application.
@@ -1,158 +0,0 @@
-version: '3'
-
-output: prefixed
-
-vars:
-  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts\find-free-port.ps1 -Preferred
-  FIND_FREE_PORT_SH: bash scripts/find-free-port.sh
-
-includes:
-  backend:
-    taskfile: .taskfiles/backend.yml
-    dir: .
-  frontend:
-    taskfile: .taskfiles/frontend.yml
-    dir: frontend
-  engine:
-    taskfile: .taskfiles/engine.yml
-    dir: engine
-  docker:
-    taskfile: .taskfiles/docker.yml
-    dir: .
-  desktop:
-    taskfile: .taskfiles/desktop.yml
-    dir: frontend
-
-tasks:
-  # ============================================================
-  # Setup & Prerequisites
-  # ============================================================
-
-  install:
-    desc: "Install all project dependencies"
-    cmds:
-      - task: frontend:install
-      - task: engine:install
-
-  # ============================================================
-  # Development
-  # ============================================================
-
-  dev:
-    desc: "Start backend + frontend concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-    deps:
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-      - task: frontend:dev
-        vars:
-          PORT: '{{.FRONTEND_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          OPEN: "true"
-
-  dev:all:
-    desc: "Start backend + frontend + engine concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173,5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-      ENGINE_PORT: '{{index (splitList "\n" .PORTS) 2}}'
-    deps:
-      - task: engine:dev
-        vars:
-          PORT: '{{.ENGINE_PORT}}'
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-          AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-      - task: frontend:dev:prototypes
-        vars:
-          PORT: '{{.FRONTEND_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          OPEN: "true"
-
-  # ============================================================
-  # Build
-  # ============================================================
-
-  build:
-    desc: "Build all components"
-    cmds:
-      - task: backend:build
-      - task: frontend:build
-
-  # ============================================================
-  # Test
-  # ============================================================
-
-  test:
-    desc: "Run ALL tests (backend + frontend + engine)"
-    cmds:
-      - task: backend:test
-      - task: frontend:test
-      - task: engine:test
-
-  # ============================================================
-  # Lint & Format
-  # ============================================================
-
-  lint:
-    desc: "Run all linters"
-    cmds:
-      - task: frontend:lint
-      - task: engine:lint
-
-  fix:
-    desc: "Auto-fix all components"
-    cmds:
-      - task: backend:fix
-      - task: frontend:fix
-      - task: engine:fix
-
-  format:
-    desc: "Auto-fix formatting across all components"
-    cmds:
-      - task: backend:format
-      - task: frontend:format
-      - task: engine:format
-
-  format:check:
-    desc: "Check formatting across all components"
-    cmds:
-      - task: backend:format:check
-      - task: frontend:format:check
-      - task: engine:format:check
-
-  # ============================================================
-  # Quality Gate
-  # ============================================================
-
-  check:
-    desc: "Quick quality gate for local development"
-    cmds:
-      - task: backend:check
-      - task: frontend:check
-      - task: engine:check
-
-  check:all:
-    desc: "Full CI quality gate"
-    cmds:
-      - task: backend:check
-      - task: frontend:check:all
-      - task: engine:check
-
-  # ============================================================
-  # Clean
-  # ============================================================
-
-  clean:
-    desc: "Clean all build artifacts"
-    cmds:
-      - task: backend:clean
-      - task: engine:clean
@@ -7,8 +7,6 @@ spotless {
        target 'src/**/java/**/*.java'
        targetExclude 'src/main/java/org/apache/**'
        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
-        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
-        suppressLintsFor { setStep('google-java-format') }

        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
        trimTrailingWhitespace()
@@ -29,23 +27,23 @@ spotless {
    }
 }
 dependencies {
-    api 'com.google.guava:guava:33.6.0-jre'
+    api 'com.google.guava:guava:33.4.8-jre'
    api 'org.springframework.boot:spring-boot-starter-webmvc'
    api 'org.springframework.boot:spring-boot-starter-aspectj'
-    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
+    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260102.1'
    api 'com.fathzer:javaluator:3.0.6'
    api 'com.posthog.java:posthog:1.2.0'
    api 'org.apache.commons:commons-lang3:3.20.0'
-    api 'com.drewnoakes:metadata-extractor:2.20.0' // Image metadata extractor
+    api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
    api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
    api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
    api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
    api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.8' // RAR archive support for CBR files
    api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.2"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.1"
    // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
    api 'org.simplejavamail:simple-java-mail:8.12.6'
    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
@@ -356,7 +356,6 @@ public class EndpointConfiguration {
        addEndpointToGroup("Security", "cert-sign");
        addEndpointToGroup("Security", "remove-cert-sign");
        addEndpointToGroup("Security", "sanitize-pdf");
-        addEndpointToGroup("Security", "timestamp-pdf");
        addEndpointToGroup("Security", "auto-redact");
        addEndpointToGroup("Security", "validate-signature");
        addEndpointToGroup("Security", "add-stamp");
@@ -473,7 +472,6 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "auto-rename");
        addEndpointToGroup("Java", "auto-split-pdf");
        addEndpointToGroup("Java", "sanitize-pdf");
-        addEndpointToGroup("Java", "timestamp-pdf");
        addEndpointToGroup("Java", "crop");
        addEndpointToGroup("Java", "get-info-on-pdf");
        addEndpointToGroup("Java", "pdf-to-single-page");
@@ -58,7 +58,6 @@ public class ApplicationProperties {
    private Legal legal = new Legal();
    private Security security = new Security();
    private System system = new System();
-    private Storage storage = new Storage();
    private Ui ui = new Ui();
    private Endpoints endpoints = new Endpoints();
    private Metrics metrics = new Metrics();
@@ -75,7 +74,6 @@ public class ApplicationProperties {
    private AutoPipeline autoPipeline = new AutoPipeline();
    private ProcessExecutor processExecutor = new ProcessExecutor();
    private PdfEditor pdfEditor = new PdfEditor();
-    private AiEngine aiEngine = new AiEngine();

    @Bean
    public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -152,44 +150,6 @@ public class ApplicationProperties {
    @Data
    public static class AutoPipeline {
        private String outputFolder;
-        private FileReadiness fileReadiness = new FileReadiness();
-
-        /**
-         * Configuration for the {@link stirling.software.common.util.FileReadinessChecker}.
-         * Controls how the pipeline determines whether a file is fully written and stable before
-         * processing begins.
-         */
-        @Data
-        public static class FileReadiness {
-            /**
-             * Master toggle. When {@code false} every readiness check is skipped and all files are
-             * considered immediately ready (preserves legacy behaviour).
-             */
-            private boolean enabled = true;
-
-            /**
-             * How long (in milliseconds) a file must remain unmodified before it is considered
-             * stable. Files modified more recently than this threshold are skipped and retried on
-             * the next scan cycle. Default: 5 000 ms (5 seconds).
-             */
-            private long settleTimeMillis = 5000;
-
-            /**
-             * How long (in milliseconds) to pause between two consecutive file-size reads when
-             * checking whether a file is still being written. If the size differs between the two
-             * reads the file is considered unstable. This catches active copies on Linux/macOS
-             * where advisory locking alone cannot detect a mid-copy file. Default: 500 ms.
-             */
-            private long sizeCheckDelayMillis = 500;
-
-            /**
-             * Optional list of file extensions (without the leading dot, case-insensitive) that are
-             * allowed through the readiness check. An empty list means all extensions are accepted.
-             * Example: {@code ["pdf", "tiff"]} will skip any file whose extension is not {@code
-             * pdf} or {@code tiff}.
-             */
-            private List<String> allowedExtensions = new java.util.ArrayList<>();
-        }
    }

    @Data
@@ -232,13 +192,6 @@ public class ApplicationProperties {
        }
    }

-    @Data
-    public static class AiEngine {
-        private boolean enabled = false;
-        private String url = "http://localhost:5001";
-        private int timeoutSeconds = 120;
-    }
-
    @Data
    public static class Legal {
        private String termsAndConditions;
@@ -260,7 +213,6 @@ public class ApplicationProperties {
        private String customGlobalAPIKey;
        private Jwt jwt = new Jwt();
        private Validation validation = new Validation();
-        private Timestamp timestamp = new Timestamp();
        private String xFrameOptions = "DENY";

        public Boolean isAltLogin() {
@@ -579,12 +531,6 @@ public class ApplicationProperties {
                private boolean hardFail = false;
            }
        }
-
-        @Data
-        public static class Timestamp {
-            private String defaultTsaUrl = "http://timestamp.digicert.com";
-            private List<String> customTsaUrls = new ArrayList<>();
-        }
    }

    @Data
@@ -643,41 +589,6 @@ public class ApplicationProperties {
        }
    }

-    @Data
-    public static class Storage {
-        private boolean enabled = false;
-        private String provider = "local";
-        private Local local = new Local();
-        private Quotas quotas = new Quotas();
-        private Sharing sharing = new Sharing();
-        private Signing signing = new Signing();
-
-        @Data
-        public static class Local {
-            private String basePath = InstallationPathConfig.getPath() + "storage";
-        }
-
-        @Data
-        public static class Sharing {
-            private boolean enabled = false;
-            private boolean linkEnabled = false;
-            private boolean emailEnabled = false;
-            private int linkExpirationDays = 3;
-        }
-
-        @Data
-        public static class Quotas {
-            private long maxStorageMbPerUser = -1;
-            private long maxStorageMbTotal = -1;
-            private long maxFileMb = -1;
-        }
-
-        @Data
-        public static class Signing {
-            private boolean enabled = false;
-        }
-    }
-
    @Data
    public static class DatabaseBackup {
        private String cron = "0 0 0 * * ?"; // daily at midnight
@@ -785,7 +696,8 @@ public class ApplicationProperties {

        @Override
        public String toString() {
-            return """
+            return
+                    """
            Driver {
              driverName='%s'
            }
@@ -1,16 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class UserSummaryDTO {
-    private Long userId;
-    private String username;
-    private String displayName;
-    private String teamName;
-    private boolean enabled;
-}
@@ -1,19 +1,15 @@
 package stirling.software.common.service;

 import java.io.BufferedInputStream;
-import java.io.BufferedOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.OutputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;

 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.Resource;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -147,59 +143,6 @@ public class FileStorage {
        return new StoredFile(fileId, size);
    }

-    public String storeFromStreamingBody(StreamingResponseBody body, String originalName)
-            throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        boolean success = false;
-        try (OutputStream os = new BufferedOutputStream(Files.newOutputStream(filePath))) {
-            body.writeTo(os);
-            success = true;
-        } finally {
-            if (!success) {
-                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
-                }
-            }
-        }
-        log.debug("Stored StreamingResponseBody with ID: {}", fileId);
-        return fileId;
-    }
-
-    /**
-     * Persist a {@link Resource} body to disk, returning the generated file ID. Used by the async
-     * job pipeline to capture {@code ResponseEntity<Resource>} results produced by controllers.
-     */
-    public String storeFromResource(Resource resource, String originalName) throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        boolean success = false;
-        try (InputStream in = resource.getInputStream()) {
-            Files.copy(in, filePath);
-            success = true;
-        } finally {
-            if (!success) {
-                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
-                }
-            }
-        }
-        log.debug("Stored Resource with ID: {}", fileId);
-        return fileId;
-    }
-
    /**
     * Delete a file by its ID
     *
@@ -1,184 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-import java.io.UncheckedIOException;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.util.regex.Pattern;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.env.Environment;
-import org.springframework.core.io.FileSystemResource;
-import org.springframework.core.io.Resource;
-import org.springframework.http.*;
-import org.springframework.stereotype.Service;
-import org.springframework.util.MultiValueMap;
-import org.springframework.web.client.RequestCallback;
-import org.springframework.web.client.RestTemplate;
-
-import jakarta.servlet.ServletContext;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.enumeration.Role;
-import stirling.software.common.util.TempFile;
-import stirling.software.common.util.TempFileManager;
-
-/**
- * Dispatches HTTP POST requests to internal Stirling API endpoints via loopback. Used by
- * PipelineProcessor and AiWorkflowService to execute tool operations programmatically without
- * leaving the JVM network stack.
- */
-@Service
-@Slf4j
-public class InternalApiClient {
-
-    // Allowlist for internal dispatch. Matches a fixed namespace prefix,
-    // but rejects traversal (..), URL-encoding (%), query/fragment, backslashes, and any other
-    // character that could alter the resolved endpoint on the local Spring server.
-    private static final Pattern ALLOWED_ENDPOINT_PATH =
-            Pattern.compile("^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$");
-
-    private final ServletContext servletContext;
-    private final UserServiceInterface userService;
-    private final TempFileManager tempFileManager;
-    private final Environment environment;
-
-    public InternalApiClient(
-            ServletContext servletContext,
-            @Autowired(required = false) UserServiceInterface userService,
-            TempFileManager tempFileManager,
-            Environment environment) {
-        this.servletContext = servletContext;
-        this.userService = userService;
-        this.tempFileManager = tempFileManager;
-        this.environment = environment;
-    }
-
-    /**
-     * POST to an internal API endpoint. The endpointPath must start with one of the allowed
-     * prefixes (e.g. {@code /api/v1/misc/compress-pdf}).
-     *
-     * @param endpointPath API path (e.g. {@code /api/v1/general/rotate-pdf})
-     * @param body multipart form body (fileInput + parameters)
-     * @return response with the result file as a {@link TempFileResource} body
-     */
-    public ResponseEntity<Resource> post(String endpointPath, MultiValueMap<String, Object> body) {
-        validateUrl(endpointPath);
-        String url = getBaseUrl() + endpointPath;
-
-        RestTemplate restTemplate = new RestTemplate();
-        HttpHeaders headers = new HttpHeaders();
-        String apiKey = getApiKeyForUser();
-        if (apiKey != null && !apiKey.isEmpty()) {
-            headers.add("X-API-KEY", apiKey);
-        }
-
-        HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
-        RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);
-
-        return restTemplate.execute(
-                url,
-                HttpMethod.POST,
-                requestCallback,
-                response -> {
-                    try {
-                        TempFile tempFile = tempFileManager.createManagedTempFile("internal-api");
-                        Files.copy(
-                                response.getBody(),
-                                tempFile.getPath(),
-                                java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-                        String filename = extractFilename(response.getHeaders());
-                        TempFileResource resource = new TempFileResource(tempFile, filename);
-                        return ResponseEntity.status(response.getStatusCode())
-                                .headers(response.getHeaders())
-                                .body(resource);
-                    } catch (IOException e) {
-                        throw new UncheckedIOException(e);
-                    }
-                });
-    }
-
-    /**
-     * Extract the filename from a response's {@code Content-Disposition} header. Returns {@code
-     * null} if the header is missing or has no filename.
-     */
-    private static String extractFilename(HttpHeaders headers) {
-        String contentDisposition = headers.getFirst(HttpHeaders.CONTENT_DISPOSITION);
-        if (contentDisposition == null || contentDisposition.isBlank()) {
-            return null;
-        }
-        for (String part : contentDisposition.split(";")) {
-            String trimmed = part.trim();
-            if (trimmed.startsWith("filename")) {
-                String[] kv = trimmed.split("=", 2);
-                if (kv.length != 2) {
-                    continue;
-                }
-                String value = kv[1].trim().replace("\"", "");
-                return URLDecoder.decode(value, StandardCharsets.UTF_8);
-            }
-        }
-        return null;
-    }
-
-    private String getBaseUrl() {
-        // Resolve the port lazily so desktop mode (server.port=0, OS-assigned) dispatches to the
-        // actual bound port. Spring publishes local.server.port once the web server is up; fall
-        // back to the configured server.port for early calls (tests, non-web contexts).
-        String port = environment.getProperty("local.server.port");
-        if (port == null) {
-            port = environment.getProperty("server.port", "8080");
-        }
-        return "http://localhost:" + port + servletContext.getContextPath();
-    }
-
-    private String getApiKeyForUser() {
-        if (userService == null) return "";
-        String username = userService.getCurrentUsername();
-        if (username != null && !username.equals("anonymousUser")) {
-            return userService.getApiKeyForUser(username);
-        }
-        return userService.getApiKeyForUser(Role.INTERNAL_API_USER.getRoleId());
-    }
-
-    private void validateUrl(String endpointPath) {
-        if (endpointPath == null || !ALLOWED_ENDPOINT_PATH.matcher(endpointPath).matches()) {
-            log.warn("Blocked internal API request to disallowed path: {}", endpointPath);
-            throw new SecurityException(
-                    "Internal API dispatch not permitted for endpoint: " + endpointPath);
-        }
-    }
-
-    /**
-     * A {@link FileSystemResource} that holds a reference to its backing {@link TempFile}.
-     *
-     * <p>If a display filename is supplied (typically parsed from the upstream response's {@code
-     * Content-Disposition} header), it is returned from {@link #getFilename()} instead of the
-     * underlying temp file's path-based name.
-     */
-    public static class TempFileResource extends FileSystemResource {
-        private final TempFile tempFile;
-        private final String displayFilename;
-
-        public TempFileResource(TempFile tempFile) {
-            this(tempFile, null);
-        }
-
-        public TempFileResource(TempFile tempFile, String displayFilename) {
-            super(tempFile.getFile());
-            this.tempFile = tempFile;
-            this.displayFilename = displayFilename;
-        }
-
-        public TempFile getTempFile() {
-            return tempFile;
-        }
-
-        @Override
-        public String getFilename() {
-            return displayFilename != null ? displayFilename : super.getFilename();
-        }
-    }
-}
@@ -11,13 +11,11 @@ import java.util.function.Supplier;

 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.Resource;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import jakarta.servlet.http.HttpServletRequest;

@@ -307,28 +305,33 @@ public class JobExecutorService {
                Object body = response.getBody();

                if (body instanceof byte[]) {
-                    String filename = extractResponseFilename(response);
-                    String contentType = extractResponseContentType(response);
+                    // Extract filename from content-disposition header if available
+                    String filename = "result.pdf";
+                    String contentType = MediaType.APPLICATION_PDF_VALUE;

+                    if (response.getHeaders().getContentDisposition() != null) {
+                        String disposition =
+                                response.getHeaders().getContentDisposition().toString();
+                        if (disposition.contains("filename=")) {
+                            filename =
+                                    disposition.substring(
+                                            disposition.indexOf("filename=") + 9,
+                                            disposition.lastIndexOf('"'));
+                        }
+                    }
+
+                    MediaType mediaType = response.getHeaders().getContentType();
+
+                    if (mediaType != null) {
+                        contentType = mediaType.toString();
+                    }
+
+                    // Store byte array directly to disk
                    String fileId = fileStorage.storeBytes((byte[]) body, filename);
                    taskManager.setFileResult(jobId, fileId, filename, contentType);
                    log.debug("Stored ResponseEntity<byte[]> result with fileId: {}", fileId);
-                } else if (body instanceof StreamingResponseBody streamingBody) {
-                    String filename = extractResponseFilename(response);
-                    String contentType = extractResponseContentType(response);

-                    String fileId = fileStorage.storeFromStreamingBody(streamingBody, filename);
-                    taskManager.setFileResult(jobId, fileId, filename, contentType);
-                    log.debug(
-                            "Stored ResponseEntity<StreamingResponseBody> result with fileId: {}",
-                            fileId);
-                } else if (body instanceof Resource resource) {
-                    String filename = extractResponseFilename(response);
-                    String contentType = extractResponseContentType(response);
-
-                    String fileId = fileStorage.storeFromResource(resource, filename);
-                    taskManager.setFileResult(jobId, fileId, filename, contentType);
-                    log.debug("Stored ResponseEntity<Resource> result with fileId: {}", fileId);
+                    // Let the GC handle the memory naturally
                } else {
                    // Check if the response body contains a fileId
                    if (body != null && body.toString().contains("fileId")) {
@@ -478,21 +481,6 @@ public class JobExecutorService {
        }
    }

-    private static String extractResponseFilename(ResponseEntity<?> response) {
-        if (response.getHeaders().getContentDisposition() != null) {
-            String filename = response.getHeaders().getContentDisposition().getFilename();
-            if (filename != null && !filename.isEmpty()) {
-                return filename;
-            }
-        }
-        return "result.pdf";
-    }
-
-    private static String extractResponseContentType(ResponseEntity<?> response) {
-        MediaType mediaType = response.getHeaders().getContentType();
-        return mediaType != null ? mediaType.toString() : MediaType.APPLICATION_PDF_VALUE;
-    }
-
    /**
     * Parse session timeout string (e.g., "30m", "1h") to milliseconds
     *
@@ -401,7 +401,7 @@ public class JobQueue implements SmartLifecycle {
     * @throws Exception If there is an execution error
     */
    private <T> T executeWithTimeout(Supplier<T> supplier, long timeoutMs) throws Exception {
-        CompletableFuture<T> future = CompletableFuture.supplyAsync(supplier, jobExecutor);
+        CompletableFuture<T> future = CompletableFuture.supplyAsync(supplier);

        try {
            if (timeoutMs <= 0) {
@@ -1,37 +0,0 @@
-package stirling.software.common.service;
-
-import java.security.KeyStore;
-
-/**
- * Abstraction for PDF digital signature operations. Defined in common so that proprietary services
- * can use it without creating a circular dependency on core.
- */
-public interface PdfSigningService {
-
-    /**
-     * Signs a PDF document using the provided KeyStore.
-     *
-     * @param pdfBytes raw PDF bytes to sign
-     * @param keystore the KeyStore containing the signing key and certificate chain
-     * @param password keystore password
-     * @param showSignature whether to render a visible signature block
-     * @param pageNumber 0-indexed page on which to render the visible signature (may be null)
-     * @param name signer name embedded in the signature
-     * @param location location string embedded in the signature
-     * @param reason reason string embedded in the signature
-     * @param showLogo whether to include the Stirling-PDF logo in the visible signature
-     * @return signed PDF bytes
-     * @throws Exception on any signing failure
-     */
-    byte[] signWithKeystore(
-            byte[] pdfBytes,
-            KeyStore keystore,
-            char[] password,
-            boolean showSignature,
-            Integer pageNumber,
-            String name,
-            String location,
-            String reason,
-            boolean showLogo)
-            throws Exception;
-}
@@ -7,8 +7,11 @@ import java.lang.management.MemoryMXBean;
 import java.lang.management.OperatingSystemMXBean;
 import java.lang.management.RuntimeMXBean;
 import java.lang.management.ThreadMXBean;
+import java.net.InetAddress;
+import java.net.NetworkInterface;
 import java.nio.file.Files;
 import java.nio.file.Paths;
+import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
@@ -91,12 +94,21 @@ public class PostHogService {
            metrics.put("os_name", System.getProperty("os.name"));
            metrics.put("os_version", System.getProperty("os.version"));
            metrics.put("java_version", System.getProperty("java.version"));
+            metrics.put("user_name", System.getProperty("user.name"));
+            metrics.put("user_home", System.getProperty("user.home"));
+            metrics.put("user_dir", System.getProperty("user.dir"));

            // CPU and Memory
            metrics.put("cpu_cores", Runtime.getRuntime().availableProcessors());
            metrics.put("total_memory", Runtime.getRuntime().totalMemory());
            metrics.put("free_memory", Runtime.getRuntime().freeMemory());

+            // Network and Server Identity
+            InetAddress localHost = InetAddress.getLocalHost();
+            metrics.put("ip_address", localHost.getHostAddress());
+            metrics.put("hostname", localHost.getHostName());
+            metrics.put("mac_address", getMacAddress());
+
            // JVM info
            metrics.put("jvm_vendor", System.getProperty("java.vendor"));
            metrics.put("jvm_version", System.getProperty("java.vm.version"));
@@ -141,6 +153,9 @@ public class PostHogService {
                metrics.put("gc_" + gcBean.getName() + "_time", gcBean.getCollectionTime());
            }

+            // Network interfaces
+            metrics.put("network_interfaces", getNetworkInterfacesInfo());
+
            // Docker detection and stats
            boolean isDocker = isRunningInDocker();
            if (isDocker) {
@@ -338,6 +353,30 @@ public class PostHogService {
                            .getProFeatures()
                            .getCustomMetadata()
                            .isAutoUpdateMetadata());
+            addIfNotEmpty(
+                    properties,
+                    "enterpriseEdition_customMetadata_author",
+                    applicationProperties
+                            .getPremium()
+                            .getProFeatures()
+                            .getCustomMetadata()
+                            .getAuthor());
+            addIfNotEmpty(
+                    properties,
+                    "enterpriseEdition_customMetadata_creator",
+                    applicationProperties
+                            .getPremium()
+                            .getProFeatures()
+                            .getCustomMetadata()
+                            .getCreator());
+            addIfNotEmpty(
+                    properties,
+                    "enterpriseEdition_customMetadata_producer",
+                    applicationProperties
+                            .getPremium()
+                            .getProFeatures()
+                            .getCustomMetadata()
+                            .getProducer());
        }
        // Capture AutoPipeline properties
        addIfNotEmpty(
@@ -347,4 +386,39 @@ public class PostHogService {

        return properties;
    }
+
+    private String getMacAddress() {
+        try {
+            Enumeration<NetworkInterface> networkInterfaces =
+                    NetworkInterface.getNetworkInterfaces();
+            while (networkInterfaces.hasMoreElements()) {
+                NetworkInterface ni = networkInterfaces.nextElement();
+                byte[] hardwareAddress = ni.getHardwareAddress();
+                if (hardwareAddress != null) {
+                    String[] hexadecimal = new String[hardwareAddress.length];
+                    for (int i = 0; i < hardwareAddress.length; i++) {
+                        hexadecimal[i] = String.format("%02X", hardwareAddress[i]);
+                    }
+                    return String.join("-", hexadecimal);
+                }
+            }
+        } catch (Exception e) {
+            // Handle exception
+        }
+        return "Unknown";
+    }
+
+    private Map<String, String> getNetworkInterfacesInfo() {
+        Map<String, String> interfacesInfo = new HashMap<>();
+        try {
+            Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
+            while (nets.hasMoreElements()) {
+                NetworkInterface netint = nets.nextElement();
+                interfacesInfo.put(netint.getName(), netint.getDisplayName());
+            }
+        } catch (Exception e) {
+            interfacesInfo.put("error", e.getMessage());
+        }
+        return interfacesInfo;
+    }
 }
@@ -1,18 +0,0 @@
-package stirling.software.common.service;
-
-/** Provides metadata about tool endpoints for internal dispatch. */
-public interface ToolMetadataService {
-
-    /** Returns true if the given operation path accepts multiple input files. */
-    boolean isMultiInput(String operationPath);
-
-    /**
-     * Returns true when the endpoint's ZIP response is a transport for multiple typed results and
-     * should be unpacked: multi-output endpoints (Type:SIMO / Type:MIMO) and wrapper declarations
-     * such as {@code Output:ZIP-PDF} or {@code Output:IMAGE/ZIP}.
-     *
-     * <p>Returns false for a bare {@code Output:ZIP} (e.g. {@code get-attachments}), where the
-     * archive itself is the deliverable and should be kept packed.
-     */
-    boolean shouldUnpackZipResponse(String operationPath);
-}
@@ -5,8 +5,6 @@ public interface UserServiceInterface {

    String getCurrentUsername();

-    String getCurrentUserApiKey();
-
    long getTotalUsersCount();

    boolean isCurrentUserAdmin();
@@ -341,7 +341,8 @@ public class EmlProcessingUtils {
    }

    private String getFallbackStyles() {
-        return """
+        return
+        """
            /* Minimal fallback - main CSS resource failed to load */
            body {
                font-family: var(--font-family, Helvetica, sans-serif);
@@ -23,8 +23,7 @@ public class EmlToPdf {

        EmlParser.EmailContent emailContent =
                EmlParser.extractEmailContent(emlBytes, request, customHtmlSanitizer);
-        return EmlProcessingUtils.generateEnhancedEmailHtml(
-                emailContent, request, customHtmlSanitizer);
+        return EmlProcessingUtils.generateEnhancedEmailHtml(emailContent, request, customHtmlSanitizer);
    }

    public static byte[] convertEmlToPdf(
@@ -112,6 +112,8 @@ public class FileMonitor {
         All files observed changes in the last iteration will be considered as staging files.
         If those files are not modified in current iteration, they will be considered as ready for processing.
        */
+        stagingFiles = new HashSet<>(newlyDiscoveredFiles);
+        readyForProcessingFiles.clear();

        if (path2KeyMapping.isEmpty()) {
            log.warn("Not monitoring any directories; attempting to re-register root paths.");
@@ -127,19 +129,8 @@ public class FileMonitor {
            }
        }

-        // Skip expensive collection work when there is nothing to track
-        WatchKey firstKey = watchService.poll();
-        if (firstKey == null
-                && newlyDiscoveredFiles.isEmpty()
-                && readyForProcessingFiles.isEmpty()) {
-            return;
-        }
-
-        stagingFiles = new HashSet<>(newlyDiscoveredFiles);
-        readyForProcessingFiles.clear();
-
-        WatchKey key = firstKey;
-        while (key != null) {
+        WatchKey key;
+        while ((key = watchService.poll()) != null) {
            final Path watchingDir = (Path) key.watchable();
            key.pollEvents()
                    .forEach(
@@ -176,7 +167,6 @@ public class FileMonitor {
            if (!isKeyValid) { // key is invalid when the directory itself is no longer exists
                path2KeyMapping.remove((Path) key.watchable());
            }
-            key = watchService.poll();
        }
        readyForProcessingFiles.addAll(stagingFiles);
    }
@@ -1,217 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.IOException;
-import java.io.RandomAccessFile;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
-import java.nio.channels.OverlappingFileLockException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Locale;
-
-import org.springframework.stereotype.Component;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.AutoPipeline.FileReadiness;
-
-/**
- * Stateless safety checker that decides whether a file is stable and ready for pipeline processing.
- * Call {@link #isReady(Path)} before moving or processing any file picked up from a watched folder.
- *
- * <p>A file is considered ready when ALL of the following hold:
- *
- * <ol>
- *   <li>The file exists on disk.
- *   <li>The path refers to a regular file, not a directory.
- *   <li>The file's extension matches the configured allow-list (if one is set).
- *   <li>The file has not been modified within the configured settle window ({@code
- *       settleTimeMillis}), meaning it is no longer being written.
- *   <li>The file size is stable: two reads separated by {@code sizeCheckDelayMillis} return the
- *       same value. This catches active copies on Linux/macOS where advisory file locking alone
- *       cannot detect a mid-copy file.
- *   <li>An exclusive file-system lock can be acquired, confirming no other process holds it.
- * </ol>
- *
- * <p>All behaviour is controlled through {@link FileReadiness} inside {@link
- * ApplicationProperties.AutoPipeline}. Setting {@code enabled: false} makes every call return
- * {@code true} so the checker is a no-op drop-in.
- */
-@Component
-@RequiredArgsConstructor
-@Slf4j
-public class FileReadinessChecker {
-
-    private final ApplicationProperties applicationProperties;
-
-    /**
-     * Returns {@code true} when the file at {@code path} passes every readiness check and is safe
-     * to hand off to the pipeline for processing. Returns {@code false} when any check fails; the
-     * caller should skip the file and retry on the next scan cycle.
-     */
-    public boolean isReady(Path path) {
-        FileReadiness config = applicationProperties.getAutoPipeline().getFileReadiness();
-
-        if (!config.isEnabled()) {
-            return true;
-        }
-
-        if (!existsAsRegularFile(path)) {
-            return false;
-        }
-
-        if (!isExtensionAllowed(path, config.getAllowedExtensions())) {
-            return false;
-        }
-
-        if (!hasSettled(path, config.getSettleTimeMillis())) {
-            return false;
-        }
-
-        if (!hasSizeStabilized(path, config.getSizeCheckDelayMillis())) {
-            return false;
-        }
-
-        if (isLocked(path)) {
-            return false;
-        }
-
-        return true;
-    }
-
-    // -------------------------------------------------------------------------
-    // Individual checks
-    // -------------------------------------------------------------------------
-
-    private boolean existsAsRegularFile(Path path) {
-        if (!Files.exists(path)) {
-            log.debug("File does not exist, skipping: {}", path);
-            return false;
-        }
-        if (!Files.isRegularFile(path)) {
-            log.debug("Path is not a regular file (directory or symlink?), skipping: {}", path);
-            return false;
-        }
-        return true;
-    }
-
-    /**
-     * Returns {@code true} when {@code allowedExtensions} is empty (no filter) or when the file's
-     * extension (case-insensitive) appears in the list.
-     */
-    private boolean isExtensionAllowed(Path path, List<String> allowedExtensions) {
-        if (allowedExtensions == null || allowedExtensions.isEmpty()) {
-            return true;
-        }
-        String filename = path.getFileName().toString();
-        String extension =
-                filename.contains(".")
-                        ? filename.substring(filename.lastIndexOf('.') + 1).toLowerCase(Locale.ROOT)
-                        : "";
-        boolean allowed =
-                allowedExtensions.stream().anyMatch(ext -> ext.equalsIgnoreCase(extension));
-        if (!allowed) {
-            log.debug(
-                    "File '{}' has extension '{}' which is not in the allowed list {}, skipping",
-                    filename,
-                    extension,
-                    allowedExtensions);
-        }
-        return allowed;
-    }
-
-    /**
-     * Returns {@code true} when the file's last-modified timestamp is at least {@code
-     * settleTimeMillis} milliseconds in the past, indicating the write has completed and the file
-     * has "settled".
-     */
-    private boolean hasSettled(Path path, long settleTimeMillis) {
-        try {
-            long lastModified = Files.getLastModifiedTime(path).toMillis();
-            long ageMillis = System.currentTimeMillis() - lastModified;
-            boolean settled = ageMillis >= settleTimeMillis;
-            if (!settled) {
-                log.debug(
-                        "File '{}' was modified {}ms ago (settle threshold: {}ms), not yet ready",
-                        path.getFileName(),
-                        ageMillis,
-                        settleTimeMillis);
-            }
-            return settled;
-        } catch (IOException e) {
-            log.warn(
-                    "Could not read last-modified time for '{}', treating as not settled: {}",
-                    path,
-                    e.getMessage());
-            return false;
-        }
-    }
-
-    /**
-     * Returns {@code true} when the file size is the same before and after a short pause of {@code
-     * sizeCheckDelayMillis} milliseconds. A size change indicates another process is still
-     * appending to the file. This is the primary write-detection mechanism on Linux/macOS, where
-     * mandatory file locking is not enforced by the OS.
-     */
-    private boolean hasSizeStabilized(Path path, long sizeCheckDelayMillis) {
-        try {
-            long sizeBefore = Files.size(path);
-            Thread.sleep(sizeCheckDelayMillis);
-            long sizeAfter = Files.size(path);
-            boolean stable = sizeBefore == sizeAfter;
-            if (!stable) {
-                log.debug(
-                        "File '{}' size changed from {} to {} bytes during stability check,"
-                                + " not yet ready",
-                        path.getFileName(),
-                        sizeBefore,
-                        sizeAfter);
-            }
-            return stable;
-        } catch (IOException e) {
-            log.warn(
-                    "Could not read file size for '{}', treating as unstable: {}",
-                    path,
-                    e.getMessage());
-            return false;
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            log.warn(
-                    "Size stability check interrupted for '{}', treating as unstable",
-                    path.getFileName());
-            return false;
-        }
-    }
-
-    /**
-     * Returns {@code true} when an exclusive file-system lock cannot be acquired, which indicates
-     * another process still holds the file open for writing.
-     *
-     * <p>{@link OverlappingFileLockException} is also treated as locked: the JVM already holds a
-     * lock on this file (e.g. from another thread), so it is unsafe to process.
-     */
-    private boolean isLocked(Path path) {
-        try (RandomAccessFile raf = new RandomAccessFile(path.toFile(), "rw");
-                FileChannel channel = raf.getChannel()) {
-            FileLock lock = channel.tryLock();
-            if (lock == null) {
-                log.debug("File '{}' is locked by another process", path.getFileName());
-                return true;
-            }
-            lock.release();
-            return false;
-        } catch (OverlappingFileLockException e) {
-            log.debug("File '{}' is already locked by this JVM", path.getFileName());
-            return true;
-        } catch (IOException e) {
-            log.debug(
-                    "Could not acquire lock on '{}', treating as locked: {}",
-                    path.getFileName(),
-                    e.getMessage());
-            return true;
-        }
-    }
-}
@@ -1,5 +1,6 @@
 package stirling.software.common.util;

+import java.io.ByteArrayInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.UncheckedIOException;
@@ -65,7 +66,16 @@ public class FileToPdf {
                        ProcessExecutor.getInstance(ProcessExecutor.Processes.WEASYPRINT)
                                .runCommandWithOutputHandling(command);

-                return Files.readAllBytes(tempOutputFile.getPath());
+                byte[] pdfBytes = Files.readAllBytes(tempOutputFile.getPath());
+                try {
+                    return pdfBytes;
+                } catch (Exception e) {
+                    pdfBytes = Files.readAllBytes(tempOutputFile.getPath());
+                    if (pdfBytes.length < 1) {
+                        throw e;
+                    }
+                    return pdfBytes;
+                }
            } // tempInputFile auto-closed
        } // tempOutputFile auto-closed
    }
@@ -82,7 +92,8 @@ public class FileToPdf {
            throws IOException {
        try (TempDirectory tempUnzippedDir = new TempDirectory(tempFileManager)) {
            try (ZipInputStream zipIn =
-                    ZipSecurity.createHardenedInputStream(Files.newInputStream(zipFilePath))) {
+                    ZipSecurity.createHardenedInputStream(
+                            new ByteArrayInputStream(Files.readAllBytes(zipFilePath)))) {
                ZipEntry entry = zipIn.getNextEntry();
                while (entry != null) {
                    Path filePath =
@@ -629,13 +629,11 @@ public class FormUtils {
            }
            log.debug("Skipping form fill because document has no AcroForm");
            if (flatten) {
-                flattenEntireDocument(document, null, false, false);
+                flattenEntireDocument(document, null);
            }
            return;
        }

-        boolean valuesProvided = values != null && !values.isEmpty();
-        boolean valuesApplied = false;
        if (values != null && !values.isEmpty()) {
            acroForm.setCacheFields(true);

@@ -669,26 +667,18 @@ public class FormUtils {
                Object rawValue = entry.getValue();
                String value = rawValue == null ? null : Objects.toString(rawValue, null);
                applyValueToField(field, value, strict);
-                valuesApplied = true;
            }

-            if (valuesApplied) {
-                ensureAppearances(acroForm);
-            }
+            ensureAppearances(acroForm);
        }

        repairWidgetGeometry(document, acroForm);

        if (flatten) {
-            flattenEntireDocument(document, acroForm, valuesApplied, valuesProvided);
+            flattenEntireDocument(document, acroForm);
        }
    }

-    // Cap the fallback rendering DPI. This path only runs when acroForm.flatten()
-    // throws, and the goal is a readable flattened document — not print quality —
-    // so clamping avoids runaway memory/CPU on pathological inputs.
-    private static final int FLATTEN_FALLBACK_MAX_DPI = 200;
-
    private void flattenViaRendering(PDDocument document, PDAcroForm acroForm) throws IOException {
        if (document == null) {
            return;
@@ -714,35 +704,28 @@ public class FormUtils {
                properties != null && properties.getSystem() != null
                        ? properties.getSystem().getMaxDPI()
                        : 300;
-        int effectiveDpi = Math.min(requestedDpi, FLATTEN_FALLBACK_MAX_DPI);

-        rebuildDocumentFromImages(document, renderer, effectiveDpi);
+        rebuildDocumentFromImages(document, renderer, requestedDpi);
    }

-    // Use PDFBox's built-in field flattening which bakes form field values
-    // into the page content stream as static text/graphics, removing the
-    // interactive form structure but preserving all other document content
-    // (images, text, annotations, etc.) at full quality.
-    //
-    // Forcing appearance regeneration via setNeedAppearances(true) drives
-    // PDFBox into refreshAppearances inside flatten(), where it can hang on
-    // certain documents (PDFBOX-5962). We therefore only regenerate when we
-    // actually wrote new values, or when the request included values and the
-    // document has widgets without appearance streams.
-    private void flattenEntireDocument(
-            PDDocument document, PDAcroForm acroForm, boolean valuesWritten, boolean valuesProvided)
+    // note: this implementation suffers from:
+    // https://issues.apache.org/jira/browse/PDFBOX-5962
+    private void flattenEntireDocument(PDDocument document, PDAcroForm acroForm)
            throws IOException {
-        if (document == null || acroForm == null) {
+        if (document == null) {
            return;
        }

-        if (valuesWritten || (valuesProvided && hasWidgetWithoutAppearance(acroForm))) {
-            ensureAppearances(acroForm);
-        } else {
-            acroForm.setNeedAppearances(false);
+        if (acroForm == null) {
+            return;
        }

+        // Use PDFBox's built-in field flattening which bakes form field values
+        // into the page content stream as static text/graphics, removing the
+        // interactive form structure but preserving all other document content
+        // (images, text, annotations, etc.) at full quality.
        try {
+            ensureAppearances(acroForm);
            acroForm.flatten();
        } catch (Exception e) {
            log.warn(
@@ -753,28 +736,6 @@ public class FormUtils {
        }
    }

-    private boolean hasWidgetWithoutAppearance(PDAcroForm acroForm) {
-        for (PDField field : acroForm.getFieldTree()) {
-            if (!(field instanceof PDTerminalField terminalField)) {
-                continue;
-            }
-            List<PDAnnotationWidget> widgets = terminalField.getWidgets();
-            if (widgets == null) {
-                continue;
-            }
-            for (PDAnnotationWidget widget : widgets) {
-                if (widget == null) {
-                    continue;
-                }
-                PDAppearanceDictionary appearance = widget.getAppearance();
-                if (appearance == null || appearance.getNormalAppearance() == null) {
-                    return true;
-                }
-            }
-        }
-        return false;
-    }
-
    private void rebuildDocumentFromImages(PDDocument document, PDFRenderer renderer, int dpi)
            throws IOException {
        int pageCount = document.getNumberOfPages();
@@ -1183,25 +1183,4 @@ public class GeneralUtils {
            }
        }
    }
-
-    public String getLocalNetworkIp() {
-        try {
-            Enumeration<NetworkInterface> interfaces = NetworkInterface.getNetworkInterfaces();
-            if (interfaces == null) return null;
-            while (interfaces.hasMoreElements()) {
-                NetworkInterface iface = interfaces.nextElement();
-                if (!iface.isUp() || iface.isLoopback() || iface.isVirtual()) continue;
-                Enumeration<InetAddress> addresses = iface.getInetAddresses();
-                while (addresses.hasMoreElements()) {
-                    InetAddress addr = addresses.nextElement();
-                    if (addr instanceof Inet4Address && addr.isSiteLocalAddress()) {
-                        return addr.getHostAddress();
-                    }
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Failed to detect local network IP", e);
-        }
-        return null;
-    }
 }
@@ -1,9 +1,9 @@
 package stirling.software.common.util;

+import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
-import java.io.OutputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
@@ -16,7 +16,6 @@ import java.util.zip.ZipOutputStream;

 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.IOUtils;
-import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -49,7 +48,7 @@ public class PDFToFile {
        this.runtimePathConfig = runtimePathConfig;
    }

-    public ResponseEntity<Resource> processPdfToMarkdown(MultipartFile inputFile)
+    public ResponseEntity<byte[]> processPdfToMarkdown(MultipartFile inputFile)
            throws IOException, InterruptedException {
        if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -86,77 +85,78 @@ public class PDFToFile {
            pdfBaseName = originalPdfFileName.substring(0, originalPdfFileName.lastIndexOf('.'));
        }

-        String fileName = pdfBaseName + "ToMarkdown.zip";
-        TempFile finalOut = tempFileManager.createManagedTempFile(".zip");
-        try {
-            try (TempFile tempInputFile = new TempFile(tempFileManager, ".pdf");
-                    TempDirectory tempOutputDir = new TempDirectory(tempFileManager)) {
-                inputFile.transferTo(tempInputFile.getFile());
+        byte[] fileBytes;
+        String fileName;

-                List<String> command =
-                        new ArrayList<>(
-                                Arrays.asList(
-                                        "pdftohtml",
-                                        "-s",
-                                        "-noframes",
-                                        "-c",
-                                        tempInputFile.getAbsolutePath(),
-                                        pdfBaseName));
+        try (TempFile tempInputFile = new TempFile(tempFileManager, ".pdf");
+                TempDirectory tempOutputDir = new TempDirectory(tempFileManager)) {
+            inputFile.transferTo(tempInputFile.getFile());

-                ProcessExecutorResult returnCode =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
-                                .runCommandWithOutputHandling(
-                                        command, tempOutputDir.getPath().toFile());
-                // Process HTML files to Markdown
-                File[] outputFiles =
-                        Objects.requireNonNull(tempOutputDir.getPath().toFile().listFiles());
-                List<File> markdownFiles = new ArrayList<>();
-                List<File> imageFiles = new ArrayList<>();
+            List<String> command =
+                    new ArrayList<>(
+                            Arrays.asList(
+                                    "pdftohtml",
+                                    "-s",
+                                    "-noframes",
+                                    "-c",
+                                    tempInputFile.getAbsolutePath(),
+                                    pdfBaseName));

-                // Convert HTML files to Markdown and collect image files
-                for (File outputFile : outputFiles) {
-                    if (outputFile.getName().endsWith(".html")) {
-                        String html = Files.readString(outputFile.toPath());
-                        String markdown = htmlToMarkdownConverter.convert(html);
+            ProcessExecutorResult returnCode =
+                    ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
+                            .runCommandWithOutputHandling(
+                                    command, tempOutputDir.getPath().toFile());
+            // Process HTML files to Markdown
+            File[] outputFiles =
+                    Objects.requireNonNull(tempOutputDir.getPath().toFile().listFiles());
+            List<File> markdownFiles = new ArrayList<>();
+            List<File> imageFiles = new ArrayList<>();

-                        // Update image references to point to images/ folder
-                        markdown = updateImageReferences(markdown);
+            // Convert HTML files to Markdown and collect image files
+            for (File outputFile : outputFiles) {
+                if (outputFile.getName().endsWith(".html")) {
+                    String html = Files.readString(outputFile.toPath());
+                    String markdown = htmlToMarkdownConverter.convert(html);

-                        String mdFileName = outputFile.getName().replace(".html", ".md");
-                        File mdFile = new File(tempOutputDir.getPath().toFile(), mdFileName);
-                        Files.writeString(mdFile.toPath(), markdown);
-                        markdownFiles.add(mdFile);
-                    } else if (!outputFile.getName().endsWith(".md")) {
-                        // Collect non-HTML, non-MD files as images/assets
-                        imageFiles.add(outputFile);
-                    }
-                }
+                    // Update image references to point to images/ folder
+                    markdown = updateImageReferences(markdown);

-                try (OutputStream fos = Files.newOutputStream(finalOut.getPath());
-                        ZipOutputStream zipOutputStream = new ZipOutputStream(fos)) {
-                    // Add markdown files to root of ZIP
-                    for (File mdFile : markdownFiles) {
-                        ZipEntry mdEntry = new ZipEntry(mdFile.getName());
-                        zipOutputStream.putNextEntry(mdEntry);
-                        Files.copy(mdFile.toPath(), zipOutputStream);
-                        zipOutputStream.closeEntry();
-                    }
-
-                    // Add images and other assets to images/ folder
-                    for (File imageFile : imageFiles) {
-                        ZipEntry assetEntry = new ZipEntry("images/" + imageFile.getName());
-                        zipOutputStream.putNextEntry(assetEntry);
-                        Files.copy(imageFile.toPath(), zipOutputStream);
-                        zipOutputStream.closeEntry();
-                    }
+                    String mdFileName = outputFile.getName().replace(".html", ".md");
+                    File mdFile = new File(tempOutputDir.getPath().toFile(), mdFileName);
+                    Files.writeString(mdFile.toPath(), markdown);
+                    markdownFiles.add(mdFile);
+                } else if (!outputFile.getName().endsWith(".md")) {
+                    // Collect non-HTML, non-MD files as images/assets
+                    imageFiles.add(outputFile);
                }
            }
-        } catch (Exception e) {
-            finalOut.close();
-            throw e;
+
+            // Always create a ZIP file
+            fileName = pdfBaseName + "ToMarkdown.zip";
+            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+
+            try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
+                // Add markdown files to root of ZIP
+                for (File mdFile : markdownFiles) {
+                    ZipEntry mdEntry = new ZipEntry(mdFile.getName());
+                    zipOutputStream.putNextEntry(mdEntry);
+                    Files.copy(mdFile.toPath(), zipOutputStream);
+                    zipOutputStream.closeEntry();
+                }
+
+                // Add images and other assets to images/ folder
+                for (File imageFile : imageFiles) {
+                    ZipEntry assetEntry = new ZipEntry("images/" + imageFile.getName());
+                    zipOutputStream.putNextEntry(assetEntry);
+                    Files.copy(imageFile.toPath(), zipOutputStream);
+                    zipOutputStream.closeEntry();
+                }
+            }
+
+            fileBytes = byteArrayOutputStream.toByteArray();
        }
-        return WebResponseUtils.fileToWebResponse(
-                finalOut, fileName, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.bytesToWebResponse(
+                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

    /**
@@ -169,7 +169,7 @@ public class PDFToFile {
        return PATTERN.matcher(markdown).replaceAll("$1(images/$2)");
    }

-    public ResponseEntity<Resource> processPdfToHtml(MultipartFile inputFile)
+    public ResponseEntity<byte[]> processPdfToHtml(MultipartFile inputFile)
            throws IOException, InterruptedException {
        if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -182,57 +182,56 @@ public class PDFToFile {
            pdfBaseName = originalPdfFileName.substring(0, originalPdfFileName.lastIndexOf('.'));
        }

-        String fileName = pdfBaseName + "ToHtml.zip";
-        TempFile finalOut = tempFileManager.createManagedTempFile(".zip");
-        try {
-            try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
-                    TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {
+        byte[] fileBytes;
+        String fileName;

-                Path tempInputFile = inputFileTemp.getPath();
-                Path tempOutputDir = outputDirTemp.getPath();
+        try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
+                TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {

-                // Save the uploaded file to a temporary location
-                inputFile.transferTo(tempInputFile);
+            Path tempInputFile = inputFileTemp.getPath();
+            Path tempOutputDir = outputDirTemp.getPath();

-                // Run the pdftohtml command with complex output
-                List<String> command =
-                        new ArrayList<>(
-                                Arrays.asList(
-                                        "pdftohtml", "-c", tempInputFile.toString(), pdfBaseName));
+            // Save the uploaded file to a temporary location
+            inputFile.transferTo(tempInputFile);

-                ProcessExecutorResult returnCode =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
-                                .runCommandWithOutputHandling(command, tempOutputDir.toFile());
+            // Run the pdftohtml command with complex output
+            List<String> command =
+                    new ArrayList<>(
+                            Arrays.asList(
+                                    "pdftohtml", "-c", tempInputFile.toString(), pdfBaseName));

-                // Get output files
-                File[] outputFiles = Objects.requireNonNull(tempOutputDir.toFile().listFiles());
+            ProcessExecutorResult returnCode =
+                    ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
+                            .runCommandWithOutputHandling(command, tempOutputDir.toFile());

-                try (OutputStream fos = Files.newOutputStream(finalOut.getPath());
-                        ZipOutputStream zipOutputStream = new ZipOutputStream(fos)) {
-                    for (File outputFile : outputFiles) {
-                        ZipEntry entry = new ZipEntry(outputFile.getName());
-                        zipOutputStream.putNextEntry(entry);
-                        try (FileInputStream fis = new FileInputStream(outputFile)) {
-                            IOUtils.copy(fis, zipOutputStream);
-                        } catch (IOException e) {
-                            log.error("Exception writing zip entry", e);
-                        }
-                        zipOutputStream.closeEntry();
+            // Get output files
+            File[] outputFiles = Objects.requireNonNull(tempOutputDir.toFile().listFiles());
+
+            // Return output files in a ZIP archive
+            fileName = pdfBaseName + "ToHtml.zip";
+            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+            try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
+                for (File outputFile : outputFiles) {
+                    ZipEntry entry = new ZipEntry(outputFile.getName());
+                    zipOutputStream.putNextEntry(entry);
+                    try (FileInputStream fis = new FileInputStream(outputFile)) {
+                        IOUtils.copy(fis, zipOutputStream);
+                    } catch (IOException e) {
+                        log.error("Exception writing zip entry", e);
                    }
-                } catch (IOException e) {
-                    log.error("Exception writing zip", e);
+                    zipOutputStream.closeEntry();
                }
+            } catch (IOException e) {
+                log.error("Exception writing zip", e);
            }
-        } catch (Exception e) {
-            finalOut.close();
-            throw e;
+            fileBytes = byteArrayOutputStream.toByteArray();
        }

-        return WebResponseUtils.fileToWebResponse(
-                finalOut, fileName, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.bytesToWebResponse(
+                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

-    public ResponseEntity<Resource> processPdfToOfficeFormat(
+    public ResponseEntity<byte[]> processPdfToOfficeFormat(
            MultipartFile inputFile, String outputFormat, String libreOfficeFilter)
            throws IOException, InterruptedException {

@@ -258,115 +257,109 @@ public class PDFToFile {
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
        }

+        byte[] fileBytes;
        String fileName;
-        TempFile finalOut =
-                tempFileManager.createManagedTempFile("." + resolvePrimaryExtension(outputFormat));
+
        Path libreOfficeProfile = null;
-        try {
-            try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
-                    TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {
+        try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
+                TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {

-                Path tempInputFile = inputFileTemp.getPath();
-                Path tempOutputDir = outputDirTemp.getPath();
-                Path unoOutputFile =
-                        tempOutputDir.resolve(
-                                pdfBaseName + "." + resolvePrimaryExtension(outputFormat));
+            Path tempInputFile = inputFileTemp.getPath();
+            Path tempOutputDir = outputDirTemp.getPath();
+            Path unoOutputFile =
+                    tempOutputDir.resolve(
+                            pdfBaseName + "." + resolvePrimaryExtension(outputFormat));

-                // Save the uploaded file to a temporary location
-                inputFile.transferTo(tempInputFile);
+            // Save the uploaded file to a temporary location
+            inputFile.transferTo(tempInputFile);

-                // Run the LibreOffice command
-                ProcessExecutorResult returnCode = null;
-                IOException unoconvertException = null;
+            // Run the LibreOffice command
+            ProcessExecutorResult returnCode = null;
+            IOException unoconvertException = null;

-                if (isUnoConvertEnabled()) {
-                    try {
-                        List<String> unoCommand =
-                                buildUnoConvertCommand(
-                                        tempInputFile,
-                                        unoOutputFile,
-                                        outputFormat,
-                                        libreOfficeFilter);
-                        returnCode =
-                                ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                        .runCommandWithOutputHandling(unoCommand);
-                    } catch (IOException e) {
-                        unoconvertException = e;
-                        log.warn(
-                                "Unoconvert command failed ({}). Falling back to soffice command.",
-                                e.getMessage());
-                    }
-                }
-
-                if (returnCode == null) {
-                    // Run the LibreOffice command as a fallback
-                    libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
-                    List<String> command = new ArrayList<>();
-                    command.add(runtimePathConfig.getSOfficePath());
-                    command.add("-env:UserInstallation=" + libreOfficeProfile.toUri().toString());
-                    command.add("--headless");
-                    command.add("--nologo");
-                    command.add("--infilter=" + libreOfficeFilter);
-                    command.add("--convert-to");
-                    command.add(outputFormat);
-                    command.add("--outdir");
-                    command.add(tempOutputDir.toString());
-                    command.add(tempInputFile.toString());
-
-                    try {
-                        returnCode =
-                                ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                        .runCommandWithOutputHandling(command);
-                    } catch (IOException e) {
-                        if (unoconvertException != null) {
-                            e.addSuppressed(unoconvertException);
-                        }
-                        throw e;
-                    }
-                }
-
-                // Get output files
-                List<File> outputFiles = Arrays.asList(tempOutputDir.toFile().listFiles());
-
-                if (outputFiles.size() == 1) {
-                    // Return single output file
-                    File outputFile = outputFiles.get(0);
-                    if ("txt:Text".equals(outputFormat)) {
-                        outputFormat = "txt";
-                    }
-                    fileName = pdfBaseName + "." + outputFormat;
-                    FileUtils.copyFile(outputFile, finalOut.getFile());
-                } else {
-                    // Return output files in a ZIP archive
-                    fileName = pdfBaseName + "To" + outputFormat + ".zip";
-                    try (OutputStream fos = Files.newOutputStream(finalOut.getPath());
-                            ZipOutputStream zipOutputStream = new ZipOutputStream(fos)) {
-                        for (File outputFile : outputFiles) {
-                            ZipEntry entry = new ZipEntry(outputFile.getName());
-                            zipOutputStream.putNextEntry(entry);
-                            try (FileInputStream fis = new FileInputStream(outputFile)) {
-                                IOUtils.copy(fis, zipOutputStream);
-                            } catch (IOException e) {
-                                log.error("Exception writing zip entry", e);
-                            }
-
-                            zipOutputStream.closeEntry();
-                        }
-                    } catch (IOException e) {
-                        log.error("Exception writing zip", e);
-                    }
+            if (isUnoConvertEnabled()) {
+                try {
+                    List<String> unoCommand =
+                            buildUnoConvertCommand(
+                                    tempInputFile, unoOutputFile, outputFormat, libreOfficeFilter);
+                    returnCode =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(unoCommand);
+                } catch (IOException e) {
+                    unoconvertException = e;
+                    log.warn(
+                            "Unoconvert command failed ({}). Falling back to soffice command.",
+                            e.getMessage());
                }
            }
-        } catch (Exception e) {
-            finalOut.close();
-            throw e;
+
+            if (returnCode == null) {
+                // Run the LibreOffice command as a fallback
+                libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
+                List<String> command = new ArrayList<>();
+                command.add(runtimePathConfig.getSOfficePath());
+                command.add("-env:UserInstallation=" + libreOfficeProfile.toUri().toString());
+                command.add("--headless");
+                command.add("--nologo");
+                command.add("--infilter=" + libreOfficeFilter);
+                command.add("--convert-to");
+                command.add(outputFormat);
+                command.add("--outdir");
+                command.add(tempOutputDir.toString());
+                command.add(tempInputFile.toString());
+
+                try {
+                    returnCode =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(command);
+                } catch (IOException e) {
+                    if (unoconvertException != null) {
+                        e.addSuppressed(unoconvertException);
+                    }
+                    throw e;
+                }
+            }
+
+            // Get output files
+            List<File> outputFiles = Arrays.asList(tempOutputDir.toFile().listFiles());
+
+            if (outputFiles.size() == 1) {
+                // Return single output file
+                File outputFile = outputFiles.get(0);
+                if ("txt:Text".equals(outputFormat)) {
+                    outputFormat = "txt";
+                }
+                fileName = pdfBaseName + "." + outputFormat;
+                fileBytes = FileUtils.readFileToByteArray(outputFile);
+            } else {
+                // Return output files in a ZIP archive
+                fileName = pdfBaseName + "To" + outputFormat + ".zip";
+                ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+                try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
+                    for (File outputFile : outputFiles) {
+                        ZipEntry entry = new ZipEntry(outputFile.getName());
+                        zipOutputStream.putNextEntry(entry);
+                        try (FileInputStream fis = new FileInputStream(outputFile)) {
+                            IOUtils.copy(fis, zipOutputStream);
+                        } catch (IOException e) {
+                            log.error("Exception writing zip entry", e);
+                        }
+
+                        zipOutputStream.closeEntry();
+                    }
+                } catch (IOException e) {
+                    log.error("Exception writing zip", e);
+                }
+
+                fileBytes = byteArrayOutputStream.toByteArray();
+            }
        } finally {
            if (libreOfficeProfile != null) {
                FileUtils.deleteQuietly(libreOfficeProfile.toFile());
            }
        }
-        return WebResponseUtils.fileToWebResponse(
-                finalOut, fileName, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.bytesToWebResponse(
+                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

    private boolean isUnoConvertEnabled() {
@@ -282,9 +282,8 @@ public class ProcessExecutor {
            boolean finished = process.waitFor(timeoutDuration, TimeUnit.MINUTES);

            if (!finished) {
-                // Kill the entire process tree (descendants first, then the process itself)
-                process.descendants().forEach(ProcessHandle::destroyForcibly);
-                process.destroyForcibly();
+                // Terminate the process
+                process.destroy();
                // Interrupt the reader threads
                errorReaderThread.interrupt();
                outputReaderThread.interrupt();
@@ -538,9 +538,9 @@ public final class RegexPatternUtils {
        getPattern("[^a-zA-Z0-9 ]"); // Input sanitization
        getPattern("[^a-zA-Z0-9]"); // Filename sanitization
        // API doc patterns
-        getPattern("Output:\\s*(\\w+)");
-        getPattern("Input:\\s*(\\w+)");
-        getPattern("Type:\\s*(\\w+)");
+        getPattern("Output:(\\w+)"); // precompiled single-escaped for runtime regex \w
+        getPattern("Input:(\\w+)");
+        getPattern("Type:(\\w+)");
        log.debug("Pre-compiled {} common regex patterns", patternCache.size());
    }

@@ -552,19 +552,19 @@ public final class RegexPatternUtils {

    /* Pattern for matching Output:<TYPE> in API descriptions */
    public Pattern getApiDocOutputTypePattern() {
-        return getPattern("Output:\\s*(\\w+)");
+        return getPattern("Output:(\\w+)");
    }

    /* Pattern for matching Input:<TYPE> in API descriptions */
    public Pattern getApiDocInputTypePattern() {
-        return getPattern("Input:\\s*(\\w+)");
+        return getPattern("Input:(\\w+)");
    }

    /**
     * Pattern for matching Type:<CODE> in API descriptions
     */
    public Pattern getApiDocTypePattern() {
-        return getPattern("Type:\\s*(\\w+)");
+        return getPattern("Type:(\\w+)");
    }

    /* Pattern for validating file extensions (2-4 alphanumeric, case-insensitive) */
@@ -86,6 +86,7 @@ public class RequestUriUtils {
        // Blocklist of backend/non-frontend paths that should still go through filters
        String[] backendOnlyPrefixes = {
            "/register",
+            "/invite",
            "/pipeline",
            "/pdfjs",
            "/pdfjs-legacy",
@@ -180,11 +181,7 @@ public class RequestUriUtils {
                || trimmedUri.startsWith("/readiness")
                || trimmedUri.startsWith(
                        "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
-                || trimmedUri.startsWith("/v1/api-docs")
-                // Workflow participant endpoints — access controlled by share tokens, not login
-                || trimmedUri.startsWith("/api/v1/workflow/participant/")
-                // Share-link SPA bootstrap; data APIs remain protected
-                || trimmedUri.matches("^/share/[^/]+/?$");
+                || trimmedUri.startsWith("/v1/api-docs");
    }

    private static String stripContextPath(String contextPath, String requestURI) {
@@ -1,22 +1,19 @@
 package stirling.software.common.util;

 import java.io.ByteArrayOutputStream;
-import java.io.FilterInputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;

 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.core.io.FileSystemResource;
-import org.springframework.core.io.Resource;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.github.pixee.security.Filenames;

@@ -52,7 +49,12 @@ public class WebResponseUtils {
        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(mediaType);
        headers.setContentLength(bytes.length);
-        headers.setContentDispositionFormData("attachment", encodeAttachmentName(docName));
+        String encodedDocName =
+                RegexPatternUtils.getInstance()
+                        .getPlusSignPattern()
+                        .matcher(URLEncoder.encode(docName, StandardCharsets.UTF_8))
+                        .replaceAll("%20");
+        headers.setContentDispositionFormData("attachment", encodedDocName);
        return new ResponseEntity<>(bytes, headers, HttpStatus.OK);
    }

@@ -72,202 +74,57 @@ public class WebResponseUtils {
    }

    /**
-     * Save a {@link PDDocument} to a managed temp file and return it as a file-backed {@code
-     * ResponseEntity<Resource>}.
-     *
-     * <p>The returned {@link Resource} owns the supplied {@link TempFile} — the file is deleted
-     * when Spring closes the response {@link InputStream} after writing the body. This is a
-     * synchronous equivalent of the previous {@code StreamingResponseBody} pattern and avoids the
-     * async-dispatch hazards (response-committed races, filter incompatibility, silent write
-     * failures) that {@code StreamingResponseBody} introduced.
-     */
-    public static ResponseEntity<Resource> pdfDocToWebResponse(
-            PDDocument document, String docName, TempFileManager tempFileManager)
-            throws IOException {
-        TempFile tempFile = tempFileManager.createManagedTempFile(".pdf");
-        try {
-            document.save(tempFile.getFile());
-        } catch (IOException e) {
-            tempFile.close();
-            throw e;
-        }
-        return pdfFileToWebResponse(tempFile, docName);
-    }
-
-    /**
-     * Convert a {@link TempFile} holding a PDF into a web response.
-     *
-     * <p>The temp file is deleted when Spring closes the response body stream.
+     * Convert a File to a web response (PDF default).
     *
     * @param outputTempFile The temporary file to be sent as a response.
     * @param docName The name of the document.
-     * @return A ResponseEntity whose body streams the file, deleting it on close.
+     * @return A ResponseEntity containing the file as a resource.
     */
-    public static ResponseEntity<Resource> pdfFileToWebResponse(
+    public static ResponseEntity<StreamingResponseBody> pdfFileToWebResponse(
            TempFile outputTempFile, String docName) throws IOException {
        return fileToWebResponse(outputTempFile, docName, MediaType.APPLICATION_PDF);
    }

    /**
-     * Convert a {@link TempFile} holding a ZIP archive into a web response.
-     *
-     * <p>The temp file is deleted when Spring closes the response body stream.
+     * Convert a File to a web response (ZIP default).
     *
     * @param outputTempFile The temporary file to be sent as a response.
     * @param docName The name of the document.
-     * @return A ResponseEntity whose body streams the file, deleting it on close.
+     * @return A ResponseEntity containing the file as a resource.
     */
-    public static ResponseEntity<Resource> zipFileToWebResponse(
+    public static ResponseEntity<StreamingResponseBody> zipFileToWebResponse(
            TempFile outputTempFile, String docName) throws IOException {
        return fileToWebResponse(outputTempFile, docName, MediaType.APPLICATION_OCTET_STREAM);
    }

    /**
-     * Convert a {@link TempFile} into a web response with an explicit media type.
-     *
-     * <p>The returned {@link ResponseEntity} carries a {@link ManagedTempFileResource} as its body.
-     * Spring's {@code ResourceHttpMessageConverter} calls {@link Resource#getInputStream()} once
-     * and closes the returned stream after writing — at which point the underlying {@link TempFile}
-     * is deleted. Everything runs synchronously on the request thread, so write failures propagate
-     * through normal Spring error handling and are logged, rather than silently truncating the
-     * response.
+     * Convert a File to a web response with explicit media type (e.g., ZIP).
     *
     * @param outputTempFile The temporary file to be sent as a response.
     * @param docName The name of the document.
     * @param mediaType The content type to set on the response.
-     * @return A ResponseEntity whose body streams the file, deleting it on close.
+     * @return A ResponseEntity containing the file as a resource.
     */
-    public static ResponseEntity<Resource> fileToWebResponse(
+    public static ResponseEntity<StreamingResponseBody> fileToWebResponse(
            TempFile outputTempFile, String docName, MediaType mediaType) throws IOException {

-        try {
-            Path path = outputTempFile.getFile().toPath().normalize();
-            long len = Files.size(path);
-            HttpHeaders headers = new HttpHeaders();
-            headers.setContentType(mediaType);
-            headers.setContentLength(len);
-            headers.setContentDispositionFormData("attachment", encodeAttachmentName(docName));
+        Path path = outputTempFile.getFile().toPath().normalize();
+        long len = Files.size(path);
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(mediaType);
+        headers.setContentLength(len);
+        headers.add(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + docName + "\"");

-            Resource body = new ManagedTempFileResource(outputTempFile);
-            return new ResponseEntity<>(body, headers, HttpStatus.OK);
-        } catch (IOException | RuntimeException e) {
-            try {
-                outputTempFile.close();
-            } catch (Exception closeEx) {
-                e.addSuppressed(closeEx);
-            }
-            throw e;
-        }
-    }
+        StreamingResponseBody body =
+                os -> {
+                    try (os) {
+                        Files.copy(path, os);
+                        os.flush();
+                    } finally {
+                        outputTempFile.close();
+                    }
+                };

-    private static String encodeAttachmentName(String docName) {
-        return RegexPatternUtils.getInstance()
-                .getPlusSignPattern()
-                .matcher(URLEncoder.encode(docName, StandardCharsets.UTF_8))
-                .replaceAll("%20");
-    }
-
-    /**
-     * {@link Resource} backed by a {@link TempFile}. The underlying temp file is deleted when the
-     * response {@code InputStream} is closed — i.e. after Spring has finished writing the body. Any
-     * {@link IOException} during the copy is logged via {@link ClosingInputStream} and propagates
-     * through Spring's normal error path. Since response headers are committed before the body
-     * transfer begins, a mid-body failure manifests as a server-side log entry plus an aborted
-     * connection rather than a silently-truncated success — which is the behaviour this class was
-     * added to restore.
-     *
-     * <p><b>Single-use contract:</b> {@link #getInputStream()} is intended to be called once by
-     * Spring's {@code ResourceHttpMessageConverter} on the normal write path. After the returned
-     * stream is closed the backing temp file is deleted, so subsequent {@code getInputStream()}
-     * calls will either see a deleted file (tests that mock {@link TempFile#close()} are an
-     * exception) or fail at read time. Callers that need to re-read the body must copy it first.
-     */
-    public static final class ManagedTempFileResource extends FileSystemResource {
-
-        private final TempFile tempFile;
-
-        public ManagedTempFileResource(TempFile tempFile) {
-            super(tempFile.getFile());
-            this.tempFile = tempFile;
-        }
-
-        @Override
-        public InputStream getInputStream() throws IOException {
-            InputStream source;
-            try {
-                source = super.getInputStream();
-            } catch (IOException e) {
-                // Opening the input stream already failed; make sure we don't leak the temp file.
-                try {
-                    tempFile.close();
-                } catch (Exception closeEx) {
-                    e.addSuppressed(closeEx);
-                }
-                throw e;
-            }
-            return new ClosingInputStream(source, tempFile);
-        }
-    }
-
-    /**
-     * Stream wrapper that deletes its backing {@link TempFile} on close. Logs — but does not
-     * swallow — any IOException that happens while reading the body, so upstream handlers can
-     * surface the failure to the client.
-     */
-    private static final class ClosingInputStream extends FilterInputStream {
-
-        private final TempFile tempFile;
-        private boolean closed;
-
-        ClosingInputStream(InputStream delegate, TempFile tempFile) {
-            super(delegate);
-            this.tempFile = tempFile;
-        }
-
-        @Override
-        public int read() throws IOException {
-            try {
-                return super.read();
-            } catch (IOException e) {
-                log.error(
-                        "Failed to read temp response body {} while streaming to client",
-                        tempFile.getAbsolutePath(),
-                        e);
-                throw e;
-            }
-        }
-
-        @Override
-        public int read(byte[] b, int off, int len) throws IOException {
-            try {
-                return super.read(b, off, len);
-            } catch (IOException e) {
-                log.error(
-                        "Failed to read temp response body {} while streaming to client",
-                        tempFile.getAbsolutePath(),
-                        e);
-                throw e;
-            }
-        }
-
-        @Override
-        public void close() throws IOException {
-            if (closed) {
-                return;
-            }
-            closed = true;
-            try {
-                super.close();
-            } finally {
-                try {
-                    tempFile.close();
-                } catch (Exception closeEx) {
-                    log.warn(
-                            "Failed to clean up temp file {} after streaming response",
-                            tempFile.getAbsolutePath(),
-                            closeEx);
-                }
-            }
-        }
+        return new ResponseEntity<>(body, headers, HttpStatus.OK);
    }
 }
@@ -1,142 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.nio.file.Files;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.Consumer;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-
-import org.springframework.core.io.FileSystemResource;
-import org.springframework.core.io.Resource;
-
-import io.github.pixee.security.ZipSecurity;
-
-import lombok.experimental.UtilityClass;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Helpers for detecting and extracting ZIP-formatted responses returned from Stirling API
- * endpoints. Shared between {@code PipelineProcessor} and {@code AiWorkflowService} so both callers
- * unpack ZIPs consistently (hardened against zip-slip, depth-limited, backed by managed temp
- * files).
- */
-@Slf4j
-@UtilityClass
-public class ZipExtractionUtils {
-
-    private static final int MAX_UNZIP_DEPTH = 10;
-    private static final byte[] ZIP_MAGIC = {0x50, 0x4B, 0x03, 0x04};
-
-    /**
-     * Returns true if the resource starts with the standard ZIP magic bytes. CBZ files are
-     * explicitly treated as non-ZIP.
-     */
-    public static boolean isZip(Resource data) throws IOException {
-        return isZip(data, null);
-    }
-
-    /**
-     * Returns true if the resource starts with the standard ZIP magic bytes. Files named with the
-     * {@code .cbz} extension are excluded (handled separately by the comic viewer).
-     */
-    public static boolean isZip(Resource data, String filename) throws IOException {
-        if (data == null || data.contentLength() < ZIP_MAGIC.length) {
-            return false;
-        }
-        if (filename != null && filename.toLowerCase().endsWith(".cbz")) {
-            return false;
-        }
-        try (InputStream is = data.getInputStream()) {
-            byte[] header = new byte[ZIP_MAGIC.length];
-            if (is.read(header) < ZIP_MAGIC.length) {
-                return false;
-            }
-            for (int i = 0; i < ZIP_MAGIC.length; i++) {
-                if (header[i] != ZIP_MAGIC[i]) {
-                    return false;
-                }
-            }
-            return true;
-        }
-    }
-
-    /**
-     * Extract a ZIP resource into a flat list of resources, one per file entry. Nested ZIPs are
-     * recursively extracted up to {@link #MAX_UNZIP_DEPTH}. Each entry is materialized as a
-     * hardened-extracted managed temp file so downstream consumers can stream the bytes.
-     */
-    public static List<Resource> extractZip(Resource zip, TempFileManager tempFileManager)
-            throws IOException {
-        return extractZip(zip, tempFileManager, null);
-    }
-
-    /**
-     * Extract a ZIP resource into a flat list of resources. Each created {@link TempFile} is also
-     * passed to {@code tempFileConsumer} when non-null, giving callers the option to register the
-     * temp files with an auxiliary lifecycle (e.g. {@code PipelineResult}).
-     */
-    public static List<Resource> extractZip(
-            Resource zip, TempFileManager tempFileManager, Consumer<TempFile> tempFileConsumer)
-            throws IOException {
-        return extractZipInternal(zip, tempFileManager, tempFileConsumer, 0);
-    }
-
-    private static List<Resource> extractZipInternal(
-            Resource zip,
-            TempFileManager tempFileManager,
-            Consumer<TempFile> tempFileConsumer,
-            int depth)
-            throws IOException {
-        if (depth > MAX_UNZIP_DEPTH) {
-            log.warn(
-                    "ZIP nesting depth {} exceeds limit {}, treating as file",
-                    depth,
-                    MAX_UNZIP_DEPTH);
-            return List.of(zip);
-        }
-        log.debug("Unzipping data of length: {}", zip.contentLength());
-        List<Resource> extracted = new ArrayList<>();
-        try (InputStream bais = zip.getInputStream();
-                ZipInputStream zis = ZipSecurity.createHardenedInputStream(bais)) {
-            ZipEntry entry;
-            while ((entry = zis.getNextEntry()) != null) {
-                if (entry.isDirectory()) {
-                    continue;
-                }
-                TempFile tempFile = tempFileManager.createManagedTempFile("unzip");
-                if (tempFileConsumer != null) {
-                    tempFileConsumer.accept(tempFile);
-                }
-                try (OutputStream os = Files.newOutputStream(tempFile.getPath())) {
-                    byte[] buffer = new byte[4096];
-                    int count;
-                    while ((count = zis.read(buffer)) != -1) {
-                        os.write(buffer, 0, count);
-                    }
-                }
-                final String filename = entry.getName();
-                Resource fileResource =
-                        new FileSystemResource(tempFile.getFile()) {
-                            @Override
-                            public String getFilename() {
-                                return filename;
-                            }
-                        };
-                if (isZip(fileResource, filename)) {
-                    log.debug("Nested ZIP entry {} — recursing", filename);
-                    extracted.addAll(
-                            extractZipInternal(
-                                    fileResource, tempFileManager, tempFileConsumer, depth + 1));
-                } else {
-                    extracted.add(fileResource);
-                }
-            }
-        }
-        log.debug("Unzipping completed. {} files extracted.", extracted.size());
-        return extracted;
-    }
-}
@@ -4,11 +4,8 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;

 import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.stream.Stream;

 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -16,8 +13,6 @@ import org.junit.jupiter.api.io.TempDir;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
-import org.springframework.core.io.ByteArrayResource;
-import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.web.multipart.MultipartFile;
@@ -190,76 +185,4 @@ class FileStorageTest {
        // Assert
        assertFalse(result);
    }
-
-    @Test
-    void storeFromResource_happyPath_persistsContent() throws IOException {
-        // Arrange
-        byte[] payload = "resource-body-bytes".getBytes(StandardCharsets.UTF_8);
-        Resource resource = new ByteArrayResource(payload);
-
-        // Act
-        String fileId = fileStorage.storeFromResource(resource, "whatever.pdf");
-
-        // Assert
-        assertNotNull(fileId);
-        assertTrue(Files.exists(tempDir.resolve(fileId)));
-        assertArrayEquals(payload, fileStorage.retrieveBytes(fileId));
-    }
-
-    @Test
-    void storeFromResource_failureCleansUpPartialFile() throws IOException {
-        // Arrange: a Resource whose getInputStream returns a stream that throws after
-        // emitting a few bytes. The finally block in storeFromResource should remove
-        // the partial file on disk.
-        byte[] head = "partial".getBytes(StandardCharsets.UTF_8);
-        Resource flakyResource =
-                new ByteArrayResource(head) {
-                    @Override
-                    public InputStream getInputStream() {
-                        return new InputStream() {
-                            private int position = 0;
-
-                            @Override
-                            public int read() throws IOException {
-                                if (position < head.length) {
-                                    return head[position++] & 0xFF;
-                                }
-                                throw new IOException("simulated mid-copy read failure");
-                            }
-
-                            @Override
-                            public int read(byte[] b, int off, int len) throws IOException {
-                                if (position >= head.length) {
-                                    throw new IOException("simulated mid-copy read failure");
-                                }
-                                int toCopy = Math.min(len, head.length - position);
-                                System.arraycopy(head, position, b, off, toCopy);
-                                position += toCopy;
-                                return toCopy;
-                            }
-                        };
-                    }
-                };
-
-        // Snapshot dir contents before the call so we can detect any lingering file.
-        long filesBefore;
-        try (Stream<Path> s = Files.list(tempDir)) {
-            filesBefore = s.count();
-        }
-
-        // Act + Assert: IOException must propagate out — not be swallowed.
-        assertThrows(
-                IOException.class, () -> fileStorage.storeFromResource(flakyResource, "n.pdf"));
-
-        // Assert: no partial file lingers under the storage directory — the finally
-        // branch's deleteIfExists must have cleaned it up.
-        long filesAfter;
-        try (Stream<Path> s = Files.list(tempDir)) {
-            filesAfter = s.count();
-        }
-        assertEquals(
-                filesBefore,
-                filesAfter,
-                "partial file must be cleaned up by storeFromResource finally block");
-    }
 }
@@ -1,159 +0,0 @@
-package stirling.software.common.service;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.ArgumentMatchers.*;
-import static org.mockito.Mockito.*;
-
-import java.io.ByteArrayInputStream;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.core.io.ByteArrayResource;
-import org.springframework.core.io.Resource;
-import org.springframework.http.*;
-import org.springframework.http.client.ClientHttpResponse;
-import org.springframework.mock.env.MockEnvironment;
-import org.springframework.util.LinkedMultiValueMap;
-import org.springframework.util.MultiValueMap;
-import org.springframework.web.client.RequestCallback;
-import org.springframework.web.client.ResponseExtractor;
-import org.springframework.web.client.RestTemplate;
-
-import jakarta.servlet.ServletContext;
-
-import stirling.software.common.util.TempFile;
-import stirling.software.common.util.TempFileManager;
-
-@ExtendWith(MockitoExtension.class)
-class InternalApiClientTest {
-
-    @Mock ServletContext servletContext;
-    @Mock UserServiceInterface userService;
-    @Mock TempFileManager tempFileManager;
-
-    InternalApiClient client;
-
-    @BeforeEach
-    void setUp() {
-        lenient().when(servletContext.getContextPath()).thenReturn("");
-        MockEnvironment environment = new MockEnvironment().withProperty("server.port", "8080");
-        client = new InternalApiClient(servletContext, userService, tempFileManager, environment);
-    }
-
-    @Test
-    void postDoesNotForceContentType() throws Exception {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        body.add("fileInput", namedResource("input.pdf", "data"));
-
-        Path tempPath = Files.createTempFile("internal-api-test", ".tmp");
-        TempFile tempFile = mock(TempFile.class);
-        when(tempFile.getPath()).thenReturn(tempPath);
-        when(tempFile.getFile()).thenReturn(tempPath.toFile());
-        when(tempFileManager.createManagedTempFile("internal-api")).thenReturn(tempFile);
-
-        HttpHeaders[] captured = {null};
-
-        try (var ignored =
-                mockConstruction(
-                        RestTemplate.class,
-                        (rt, ctx) -> {
-                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
-                                    .thenAnswer(
-                                            inv -> {
-                                                HttpEntity<?> entity = inv.getArgument(0);
-                                                captured[0] = entity.getHeaders();
-                                                return (RequestCallback) req -> {};
-                                            });
-
-                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
-                                    .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
-                        })) {
-
-            ResponseEntity<Resource> response = client.post("/api/v1/general/merge-pdfs", body);
-
-            assertNotNull(response);
-            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertNull(captured[0].getContentType(), "Content-Type should not be forced");
-        } finally {
-            Files.deleteIfExists(tempPath);
-        }
-    }
-
-    @Test
-    void postRejectsDisallowedPath() {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(SecurityException.class, () -> client.post("/api/v1/admin/settings", body));
-    }
-
-    @Test
-    void postRejectsPathTraversal() {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(
-                SecurityException.class,
-                () -> client.post("/api/v1/misc/../../actuator/env", body));
-    }
-
-    @Test
-    void postRejectsUrlEncodedCharacters() {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(
-                SecurityException.class, () -> client.post("/api/v1/misc/%2e%2e/actuator", body));
-    }
-
-    @Test
-    void postRejectsQueryString() {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(
-                SecurityException.class,
-                () -> client.post("/api/v1/misc/compress-pdf?redirect=evil", body));
-    }
-
-    @Test
-    void postRejectsEmptySegment() {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(SecurityException.class, () -> client.post("/api/v1/misc//foo", body));
-    }
-
-    @Test
-    void postRejectsTrailingSlash() {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(SecurityException.class, () -> client.post("/api/v1/misc/foo/", body));
-    }
-
-    @Test
-    void postRejectsNullPath() {
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(SecurityException.class, () -> client.post(null, body));
-    }
-
-    /** Create a ByteArrayResource with a filename (required for multipart). */
-    private static Resource namedResource(String filename, String content) {
-        return new ByteArrayResource(content.getBytes(StandardCharsets.UTF_8)) {
-            @Override
-            public String getFilename() {
-                return filename;
-            }
-        };
-    }
-
-    /** Simulate a successful HTTP response through a RestTemplate ResponseExtractor. */
-    @SuppressWarnings("unchecked")
-    private static ResponseEntity<Resource> fakeOkResponse(Object extractorArg) throws Exception {
-        var extractor = (ResponseExtractor<ResponseEntity<Resource>>) extractorArg;
-        ClientHttpResponse response = mock(ClientHttpResponse.class);
-        when(response.getBody())
-                .thenReturn(new ByteArrayInputStream("ok".getBytes(StandardCharsets.UTF_8)));
-        HttpHeaders headers = new HttpHeaders();
-        headers.add(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"out.pdf\"");
-        when(response.getHeaders()).thenReturn(headers);
-        lenient().when(response.getStatusCode()).thenReturn(HttpStatus.OK);
-        return extractor.extractData(response);
-    }
-}
@@ -8,11 +8,9 @@ import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.timeout;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;

-import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeoutException;
@@ -26,12 +24,7 @@ import org.mockito.Captor;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.core.io.ByteArrayResource;
-import org.springframework.core.io.Resource;
-import org.springframework.http.ContentDisposition;
-import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;

 import jakarta.servlet.http.HttpServletRequest;
@@ -187,46 +180,6 @@ class JobExecutorServiceTest {
        verify(spy).runJobGeneric(eq(false), any(Supplier.class), eq(customTimeout));
    }

-    @Test
-    void shouldPersistResponseEntityResourceBodyViaFileStorage() throws Exception {
-        // Given: an async job whose result is a ResponseEntity<Resource> — the new
-        // branch added by the stream-to-Resource migration. The executor must route
-        // the body through FileStorage.storeFromResource and then record the result
-        // via TaskManager.setFileResult with the filename/content-type extracted
-        // from the response headers.
-        byte[] payload = "resource-bytes".getBytes(StandardCharsets.UTF_8);
-        Resource resource = new ByteArrayResource(payload);
-
-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentType(MediaType.APPLICATION_PDF);
-        headers.setContentDisposition(
-                ContentDisposition.formData().name("attachment").filename("result.pdf").build());
-
-        Supplier<Object> work = () -> new ResponseEntity<>(resource, headers, HttpStatus.OK);
-
-        when(fileStorage.storeFromResource(any(Resource.class), anyString()))
-                .thenReturn("stored-file-id");
-
-        // When: run the job asynchronously — processJobResult runs on the executor.
-        ResponseEntity<?> response = jobExecutorService.runJobGeneric(true, work);
-
-        // Then: the immediate return must be the JobResponse envelope.
-        assertEquals(HttpStatus.OK, response.getStatusCode());
-        assertInstanceOf(JobResponse.class, response.getBody());
-
-        // Wait for async processing and verify the Resource branch was taken —
-        // FileStorage.storeFromResource was invoked with the same Resource instance,
-        // and TaskManager.setFileResult recorded the extracted filename + content-type.
-        verify(fileStorage, timeout(5000)).storeFromResource(eq(resource), eq("result.pdf"));
-        verify(taskManager, timeout(5000))
-                .setFileResult(
-                        anyString(),
-                        eq("stored-file-id"),
-                        eq("result.pdf"),
-                        eq(MediaType.APPLICATION_PDF_VALUE));
-        verify(taskManager, timeout(5000)).setComplete(anyString());
-    }
-
    @Test
    void shouldHandleTimeout() throws Exception {
        // Given
@@ -1,56 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-
-import java.util.List;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.boot.ApplicationArguments;
-
-class AppArgsCaptureTest {
-
-    private AppArgsCapture capture;
-
-    @BeforeEach
-    void setUp() {
-        capture = new AppArgsCapture();
-        AppArgsCapture.APP_ARGS.set(List.of());
-    }
-
-    @Test
-    void run_withArgs_capturesArgs() {
-        ApplicationArguments args = mock(ApplicationArguments.class);
-        when(args.getSourceArgs()).thenReturn(new String[] {"--server.port=8080", "--debug"});
-        capture.run(args);
-        assertEquals(List.of("--server.port=8080", "--debug"), AppArgsCapture.APP_ARGS.get());
-    }
-
-    @Test
-    void run_withNoArgs_capturesEmptyList() {
-        ApplicationArguments args = mock(ApplicationArguments.class);
-        when(args.getSourceArgs()).thenReturn(new String[] {});
-        capture.run(args);
-        assertEquals(List.of(), AppArgsCapture.APP_ARGS.get());
-    }
-
-    @Test
-    void run_calledTwice_overwritesPreviousArgs() {
-        ApplicationArguments args1 = mock(ApplicationArguments.class);
-        when(args1.getSourceArgs()).thenReturn(new String[] {"--first"});
-        capture.run(args1);
-        assertEquals(List.of("--first"), AppArgsCapture.APP_ARGS.get());
-
-        ApplicationArguments args2 = mock(ApplicationArguments.class);
-        when(args2.getSourceArgs()).thenReturn(new String[] {"--second", "--third"});
-        capture.run(args2);
-        assertEquals(List.of("--second", "--third"), AppArgsCapture.APP_ARGS.get());
-    }
-
-    @Test
-    void appArgs_defaultValue_isEmptyList() {
-        // After setUp resets it
-        assertTrue(AppArgsCapture.APP_ARGS.get().isEmpty());
-    }
-}
@@ -1,108 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.NoSuchBeanDefinitionException;
-import org.springframework.context.ApplicationContext;
-
-class ApplicationContextProviderTest {
-
-    private ApplicationContextProvider provider;
-
-    @BeforeEach
-    void setUp() {
-        provider = new ApplicationContextProvider();
-        // Reset to null state
-        provider.setApplicationContext(null);
-    }
-
-    @AfterEach
-    void tearDown() {
-        // Clean up static state
-        provider.setApplicationContext(null);
-    }
-
-    @Test
-    void getBean_byClass_whenNoContext_returnsNull() {
-        provider.setApplicationContext(null);
-        assertNull(ApplicationContextProvider.getBean(String.class));
-    }
-
-    @Test
-    void getBean_byClass_whenBeanExists_returnsBean() {
-        ApplicationContext ctx = mock(ApplicationContext.class);
-        when(ctx.getBean(String.class)).thenReturn("hello");
-        provider.setApplicationContext(ctx);
-        assertEquals("hello", ApplicationContextProvider.getBean(String.class));
-    }
-
-    @Test
-    void getBean_byClass_whenBeanNotFound_returnsNull() {
-        ApplicationContext ctx = mock(ApplicationContext.class);
-        when(ctx.getBean(String.class)).thenThrow(new NoSuchBeanDefinitionException(""));
-        provider.setApplicationContext(ctx);
-        assertNull(ApplicationContextProvider.getBean(String.class));
-    }
-
-    @Test
-    void getBean_byNameAndClass_whenNoContext_returnsNull() {
-        provider.setApplicationContext(null);
-        assertNull(ApplicationContextProvider.getBean("myBean", String.class));
-    }
-
-    @Test
-    void getBean_byNameAndClass_whenBeanExists_returnsBean() {
-        ApplicationContext ctx = mock(ApplicationContext.class);
-        when(ctx.getBean("myBean", String.class)).thenReturn("world");
-        provider.setApplicationContext(ctx);
-        assertEquals("world", ApplicationContextProvider.getBean("myBean", String.class));
-    }
-
-    @Test
-    void getBean_byNameAndClass_whenBeanNotFound_returnsNull() {
-        ApplicationContext ctx = mock(ApplicationContext.class);
-        when(ctx.getBean("missing", String.class)).thenThrow(new NoSuchBeanDefinitionException(""));
-        provider.setApplicationContext(ctx);
-        assertNull(ApplicationContextProvider.getBean("missing", String.class));
-    }
-
-    @Test
-    void containsBean_whenNoContext_returnsFalse() {
-        provider.setApplicationContext(null);
-        assertFalse(ApplicationContextProvider.containsBean(String.class));
-    }
-
-    @Test
-    void containsBean_whenBeanExists_returnsTrue() {
-        ApplicationContext ctx = mock(ApplicationContext.class);
-        when(ctx.getBean(String.class)).thenReturn("exists");
-        provider.setApplicationContext(ctx);
-        assertTrue(ApplicationContextProvider.containsBean(String.class));
-    }
-
-    @Test
-    void containsBean_whenBeanNotFound_returnsFalse() {
-        ApplicationContext ctx = mock(ApplicationContext.class);
-        when(ctx.getBean(Integer.class)).thenThrow(new NoSuchBeanDefinitionException(""));
-        provider.setApplicationContext(ctx);
-        assertFalse(ApplicationContextProvider.containsBean(Integer.class));
-    }
-
-    @Test
-    void setApplicationContext_updatesStaticContext() {
-        ApplicationContext ctx = mock(ApplicationContext.class);
-        when(ctx.getBean(String.class)).thenReturn("test");
-        provider.setApplicationContext(ctx);
-        assertEquals("test", ApplicationContextProvider.getBean(String.class));
-
-        // Now set a different context
-        ApplicationContext ctx2 = mock(ApplicationContext.class);
-        when(ctx2.getBean(String.class)).thenReturn("updated");
-        provider.setApplicationContext(ctx2);
-        assertEquals("updated", ApplicationContextProvider.getBean(String.class));
-    }
-}
@@ -1,70 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-
-import org.apache.pdfbox.cos.COSDictionary;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
-import org.apache.pdfbox.pdmodel.PageMode;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-class AttachmentUtilsTest {
-
-    @Test
-    @DisplayName("should set page mode on catalog")
-    void setsPageMode() {
-        try (PDDocument document = new PDDocument()) {
-            AttachmentUtils.setCatalogViewerPreferences(document, PageMode.USE_ATTACHMENTS);
-
-            PDDocumentCatalog catalog = document.getDocumentCatalog();
-            assertEquals(PageMode.USE_ATTACHMENTS, catalog.getPageMode());
-        } catch (Exception e) {
-            fail("Should not throw: " + e.getMessage());
-        }
-    }
-
-    @Test
-    @DisplayName("should create viewer preferences dictionary if absent")
-    void createsViewerPreferences() {
-        try (PDDocument document = new PDDocument()) {
-            AttachmentUtils.setCatalogViewerPreferences(document, PageMode.USE_ATTACHMENTS);
-
-            COSDictionary catalogDict = document.getDocumentCatalog().getCOSObject();
-            COSDictionary viewerPrefs =
-                    (COSDictionary) catalogDict.getDictionaryObject(COSName.VIEWER_PREFERENCES);
-            assertNotNull(viewerPrefs);
-        } catch (Exception e) {
-            fail("Should not throw: " + e.getMessage());
-        }
-    }
-
-    @Test
-    @DisplayName("should set DisplayDocTitle to true in viewer preferences")
-    void setsDisplayDocTitle() {
-        try (PDDocument document = new PDDocument()) {
-            AttachmentUtils.setCatalogViewerPreferences(document, PageMode.USE_ATTACHMENTS);
-
-            COSDictionary catalogDict = document.getDocumentCatalog().getCOSObject();
-            COSDictionary viewerPrefs =
-                    (COSDictionary) catalogDict.getDictionaryObject(COSName.VIEWER_PREFERENCES);
-            assertTrue(viewerPrefs.getBoolean(COSName.getPDFName("DisplayDocTitle"), false));
-        } catch (Exception e) {
-            fail("Should not throw: " + e.getMessage());
-        }
-    }
-
-    @Test
-    @DisplayName("should not throw when catalog returns null from mocked document")
-    void handlesNullCatalogGracefully() {
-        PDDocument document = mock(PDDocument.class);
-        when(document.getDocumentCatalog()).thenReturn(null);
-
-        assertDoesNotThrow(
-                () ->
-                        AttachmentUtils.setCatalogViewerPreferences(
-                                document, PageMode.USE_ATTACHMENTS));
-    }
-}
@@ -1,98 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.web.multipart.MultipartFile;
-
-class CbrUtilsTest {
-
-    // --- isCbrFile tests ---
-
-    @Test
-    void isCbrFile_withCbrExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.cbr");
-        assertTrue(CbrUtils.isCbrFile(file));
-    }
-
-    @Test
-    void isCbrFile_withRarExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("archive.rar");
-        assertTrue(CbrUtils.isCbrFile(file));
-    }
-
-    @Test
-    void isCbrFile_withUpperCaseExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.CBR");
-        assertTrue(CbrUtils.isCbrFile(file));
-    }
-
-    @Test
-    void isCbrFile_withPdfExtension_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("document.pdf");
-        assertFalse(CbrUtils.isCbrFile(file));
-    }
-
-    @Test
-    void isCbrFile_withNullFilename_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn(null);
-        assertFalse(CbrUtils.isCbrFile(file));
-    }
-
-    @Test
-    void isCbrFile_withCbzExtension_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.cbz");
-        assertFalse(CbrUtils.isCbrFile(file));
-    }
-
-    @Test
-    void isCbrFile_withNoExtension_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("noextension");
-        assertFalse(CbrUtils.isCbrFile(file));
-    }
-
-    @Test
-    void isCbrFile_withMixedCaseRar_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("file.RaR");
-        assertTrue(CbrUtils.isCbrFile(file));
-    }
-
-    // --- convertCbrToPdf validation tests ---
-
-    @Test
-    void convertCbrToPdf_withNullFile_throwsException() {
-        assertThrows(Exception.class, () -> CbrUtils.convertCbrToPdf(null, null, null));
-    }
-
-    @Test
-    void convertCbrToPdf_withEmptyFile_throwsException() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.isEmpty()).thenReturn(true);
-        assertThrows(Exception.class, () -> CbrUtils.convertCbrToPdf(file, null, null));
-    }
-
-    @Test
-    void convertCbrToPdf_withNullFilename_throwsException() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.isEmpty()).thenReturn(false);
-        when(file.getOriginalFilename()).thenReturn(null);
-        assertThrows(Exception.class, () -> CbrUtils.convertCbrToPdf(file, null, null));
-    }
-
-    @Test
-    void convertCbrToPdf_withWrongExtension_throwsException() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.isEmpty()).thenReturn(false);
-        when(file.getOriginalFilename()).thenReturn("file.pdf");
-        assertThrows(Exception.class, () -> CbrUtils.convertCbrToPdf(file, null, null));
-    }
-}
@@ -1,142 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.web.multipart.MultipartFile;
-
-class CbzUtilsTest {
-
-    // --- isCbzFile tests ---
-
-    @Test
-    void isCbzFile_withCbzExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.cbz");
-        assertTrue(CbzUtils.isCbzFile(file));
-    }
-
-    @Test
-    void isCbzFile_withZipExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("archive.zip");
-        assertTrue(CbzUtils.isCbzFile(file));
-    }
-
-    @Test
-    void isCbzFile_withUpperCaseExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.CBZ");
-        assertTrue(CbzUtils.isCbzFile(file));
-    }
-
-    @Test
-    void isCbzFile_withPdfExtension_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("document.pdf");
-        assertFalse(CbzUtils.isCbzFile(file));
-    }
-
-    @Test
-    void isCbzFile_withNullFilename_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn(null);
-        assertFalse(CbzUtils.isCbzFile(file));
-    }
-
-    @Test
-    void isCbzFile_withCbrExtension_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.cbr");
-        assertFalse(CbzUtils.isCbzFile(file));
-    }
-
-    // --- isComicBookFile tests ---
-
-    @Test
-    void isComicBookFile_withCbzExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.cbz");
-        assertTrue(CbzUtils.isComicBookFile(file));
-    }
-
-    @Test
-    void isComicBookFile_withZipExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("archive.zip");
-        assertTrue(CbzUtils.isComicBookFile(file));
-    }
-
-    @Test
-    void isComicBookFile_withCbrExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.cbr");
-        assertTrue(CbzUtils.isComicBookFile(file));
-    }
-
-    @Test
-    void isComicBookFile_withRarExtension_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("archive.rar");
-        assertTrue(CbzUtils.isComicBookFile(file));
-    }
-
-    @Test
-    void isComicBookFile_withPdfExtension_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("document.pdf");
-        assertFalse(CbzUtils.isComicBookFile(file));
-    }
-
-    @Test
-    void isComicBookFile_withNullFilename_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn(null);
-        assertFalse(CbzUtils.isComicBookFile(file));
-    }
-
-    @Test
-    void isComicBookFile_withUpperCaseCBR_returnsTrue() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("comic.CBR");
-        assertTrue(CbzUtils.isComicBookFile(file));
-    }
-
-    @Test
-    void isComicBookFile_withNoExtension_returnsFalse() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.getOriginalFilename()).thenReturn("noextension");
-        assertFalse(CbzUtils.isComicBookFile(file));
-    }
-
-    // --- convertCbzToPdf validation tests ---
-
-    @Test
-    void convertCbzToPdf_withNullFile_throwsException() {
-        assertThrows(Exception.class, () -> CbzUtils.convertCbzToPdf(null, null, null, false));
-    }
-
-    @Test
-    void convertCbzToPdf_withEmptyFile_throwsException() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.isEmpty()).thenReturn(true);
-        assertThrows(Exception.class, () -> CbzUtils.convertCbzToPdf(file, null, null, false));
-    }
-
-    @Test
-    void convertCbzToPdf_withNullFilename_throwsException() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.isEmpty()).thenReturn(false);
-        when(file.getOriginalFilename()).thenReturn(null);
-        assertThrows(Exception.class, () -> CbzUtils.convertCbzToPdf(file, null, null, false));
-    }
-
-    @Test
-    void convertCbzToPdf_withWrongExtension_throwsException() {
-        MultipartFile file = mock(MultipartFile.class);
-        when(file.isEmpty()).thenReturn(false);
-        when(file.getOriginalFilename()).thenReturn("file.pdf");
-        assertThrows(Exception.class, () -> CbzUtils.convertCbzToPdf(file, null, null, false));
-    }
-}
@@ -1,210 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.Map;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class ChecksumUtilsAdditionalTest {
-
-    private static final byte[] HELLO = "hello".getBytes(StandardCharsets.UTF_8);
-
-    @TempDir Path tempDir;
-
-    private Path writeFile(byte[] data) throws IOException {
-        Path file = tempDir.resolve("testfile.bin");
-        Files.write(file, data);
-        return file;
-    }
-
-    // --- checksum(Path, String) ---
-
-    @Test
-    void testChecksumPath_sha256() throws IOException {
-        Path file = writeFile(HELLO);
-        String hex = ChecksumUtils.checksum(file, "SHA-256");
-        assertEquals("2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824", hex);
-    }
-
-    @Test
-    void testChecksumPath_md5() throws IOException {
-        Path file = writeFile(HELLO);
-        String hex = ChecksumUtils.checksum(file, "MD5");
-        assertEquals("5d41402abc4b2a76b9719d911017c592", hex);
-    }
-
-    @Test
-    void testChecksumPath_crc32() throws IOException {
-        Path file = writeFile(HELLO);
-        String hex = ChecksumUtils.checksum(file, "CRC32");
-        assertEquals("3610a686", hex);
-    }
-
-    // --- checksum(InputStream, String) ---
-
-    @Test
-    void testChecksumStream_adler32() throws IOException {
-        try (InputStream is = new ByteArrayInputStream(HELLO)) {
-            String hex = ChecksumUtils.checksum(is, "ADLER32");
-            assertNotNull(hex);
-            assertEquals(8, hex.length());
-        }
-    }
-
-    @Test
-    void testChecksumStream_sha1() throws IOException {
-        try (InputStream is = new ByteArrayInputStream(HELLO)) {
-            String hex = ChecksumUtils.checksum(is, "SHA-1");
-            assertEquals("aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d", hex);
-        }
-    }
-
-    @Test
-    void testChecksumStream_unsupportedAlgorithm() {
-        assertThrows(
-                IllegalStateException.class,
-                () -> {
-                    try (InputStream is = new ByteArrayInputStream(HELLO)) {
-                        ChecksumUtils.checksum(is, "FAKE-ALGO");
-                    }
-                });
-    }
-
-    // --- checksumBase64(Path, String) ---
-
-    @Test
-    void testChecksumBase64Path_md5() throws IOException {
-        Path file = writeFile(HELLO);
-        String b64 = ChecksumUtils.checksumBase64(file, "MD5");
-        assertEquals("XUFAKrxLKna5cZ2REBfFkg==", b64);
-    }
-
-    @Test
-    void testChecksumBase64Path_crc32() throws IOException {
-        Path file = writeFile(HELLO);
-        String b64 = ChecksumUtils.checksumBase64(file, "CRC32");
-        assertEquals("NhCmhg==", b64);
-    }
-
-    // --- checksumBase64(InputStream, String) ---
-
-    @Test
-    void testChecksumBase64Stream_adler32() throws IOException {
-        try (InputStream is = new ByteArrayInputStream(HELLO)) {
-            String b64 = ChecksumUtils.checksumBase64(is, "ADLER32");
-            assertNotNull(b64);
-            assertFalse(b64.isEmpty());
-        }
-    }
-
-    @Test
-    void testChecksumBase64Stream_sha256() throws IOException {
-        try (InputStream is = new ByteArrayInputStream(HELLO)) {
-            String b64 = ChecksumUtils.checksumBase64(is, "SHA-256");
-            assertNotNull(b64);
-            assertFalse(b64.isEmpty());
-        }
-    }
-
-    // --- checksums(Path, String...) ---
-
-    @Test
-    void testChecksumsPath_multipleAlgorithms() throws IOException {
-        Path file = writeFile(HELLO);
-        Map<String, String> results = ChecksumUtils.checksums(file, "MD5", "SHA-256", "CRC32");
-        assertEquals(3, results.size());
-        assertEquals("5d41402abc4b2a76b9719d911017c592", results.get("MD5"));
-        assertEquals(
-                "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
-                results.get("SHA-256"));
-        assertEquals("3610a686", results.get("CRC32"));
-    }
-
-    @Test
-    void testChecksumsPath_preservesOrder() throws IOException {
-        Path file = writeFile(HELLO);
-        // Digests are output first, then Checksums (CRC32/ADLER32), per implementation
-        Map<String, String> results = ChecksumUtils.checksums(file, "MD5", "SHA-1");
-        String[] keys = results.keySet().toArray(new String[0]);
-        assertEquals("MD5", keys[0]);
-        assertEquals("SHA-1", keys[1]);
-    }
-
-    @Test
-    void testChecksumsStream_unsupportedAlgorithm() {
-        assertThrows(
-                IllegalStateException.class,
-                () -> {
-                    try (InputStream is = new ByteArrayInputStream(HELLO)) {
-                        ChecksumUtils.checksums(is, "BOGUS");
-                    }
-                });
-    }
-
-    // --- matches(Path, String, String) ---
-
-    @Test
-    void testMatchesPath_correctHash() throws IOException {
-        Path file = writeFile(HELLO);
-        assertTrue(ChecksumUtils.matches(file, "MD5", "5d41402abc4b2a76b9719d911017c592"));
-    }
-
-    @Test
-    void testMatchesPath_wrongHash() throws IOException {
-        Path file = writeFile(HELLO);
-        assertFalse(ChecksumUtils.matches(file, "MD5", "0000000000000000000000000000000000"));
-    }
-
-    @Test
-    void testMatchesPath_caseInsensitive() throws IOException {
-        Path file = writeFile(HELLO);
-        assertTrue(ChecksumUtils.matches(file, "MD5", "5D41402ABC4B2A76B9719D911017C592"));
-    }
-
-    // --- matches(InputStream, String, String) ---
-
-    @Test
-    void testMatchesStream_correct() throws IOException {
-        try (InputStream is = new ByteArrayInputStream(HELLO)) {
-            assertTrue(
-                    ChecksumUtils.matches(is, "SHA-1", "aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d"));
-        }
-    }
-
-    @Test
-    void testMatchesStream_wrong() throws IOException {
-        try (InputStream is = new ByteArrayInputStream(HELLO)) {
-            assertFalse(
-                    ChecksumUtils.matches(is, "SHA-1", "0000000000000000000000000000000000000000"));
-        }
-    }
-
-    // --- empty input ---
-
-    @Test
-    void testChecksumEmptyInput() throws IOException {
-        byte[] empty = new byte[0];
-        try (InputStream is = new ByteArrayInputStream(empty)) {
-            String hex = ChecksumUtils.checksum(is, "MD5");
-            // MD5 of empty input is d41d8cd98f00b204e9800998ecf8427e
-            assertEquals("d41d8cd98f00b204e9800998ecf8427e", hex);
-        }
-    }
-
-    @Test
-    void testChecksumCrc32EmptyInput() throws IOException {
-        byte[] empty = new byte[0];
-        try (InputStream is = new ByteArrayInputStream(empty)) {
-            String hex = ChecksumUtils.checksum(is, "CRC32");
-            assertEquals("00000000", hex);
-        }
-    }
-}
@@ -1,93 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-
-class EmlParserTest {
-
-    @Nested
-    @DisplayName("safeMimeDecode")
-    class SafeMimeDecodeTests {
-
-        @Test
-        @DisplayName("should return empty string for null input")
-        void nullInput() {
-            assertEquals("", EmlParser.safeMimeDecode(null));
-        }
-
-        @Test
-        @DisplayName("should return empty string for empty input")
-        void emptyInput() {
-            assertEquals("", EmlParser.safeMimeDecode(""));
-        }
-
-        @Test
-        @DisplayName("should return empty string for blank input")
-        void blankInput() {
-            assertEquals("", EmlParser.safeMimeDecode("   "));
-        }
-
-        @Test
-        @DisplayName("should return plain text as-is")
-        void plainText() {
-            assertEquals("Hello World", EmlParser.safeMimeDecode("Hello World"));
-        }
-
-        @Test
-        @DisplayName("should trim surrounding whitespace")
-        void trimWhitespace() {
-            assertEquals("Hello", EmlParser.safeMimeDecode("  Hello  "));
-        }
-
-        @Test
-        @DisplayName("should decode base64 MIME encoded word")
-        void decodeBase64MimeWord() {
-            // =?UTF-8?B?SGVsbG8=?= is Base64 for "Hello"
-            assertEquals("Hello", EmlParser.safeMimeDecode("=?UTF-8?B?SGVsbG8=?="));
-        }
-
-        @Test
-        @DisplayName("should decode quoted-printable MIME encoded word")
-        void decodeQpMimeWord() {
-            // =?UTF-8?Q?Hello_World?= where _ means space in Q encoding
-            assertEquals("Hello World", EmlParser.safeMimeDecode("=?UTF-8?Q?Hello_World?="));
-        }
-
-        @Test
-        @DisplayName("should handle mixed text and encoded words")
-        void mixedTextAndEncoded() {
-            String input = "Re: =?UTF-8?B?SGVsbG8=?= test";
-            String result = EmlParser.safeMimeDecode(input);
-            assertEquals("Re: Hello test", result);
-        }
-    }
-
-    @Nested
-    @DisplayName("extractEmailContent")
-    class ExtractEmailContentTests {
-
-        @Test
-        @DisplayName("should throw on null input")
-        void nullInput() {
-            assertThrows(Exception.class, () -> EmlParser.extractEmailContent(null, null, null));
-        }
-
-        @Test
-        @DisplayName("should throw on empty input")
-        void emptyInput() {
-            assertThrows(
-                    Exception.class, () -> EmlParser.extractEmailContent(new byte[0], null, null));
-        }
-
-        @Test
-        @DisplayName("should throw on invalid content that is not EML or MSG")
-        void invalidContent() {
-            byte[] randomBytes = "This is not an email file at all.".getBytes();
-            assertThrows(
-                    Exception.class, () -> EmlParser.extractEmailContent(randomBytes, null, null));
-        }
-    }
-}
@@ -1,293 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-
-class EmlProcessingUtilsTest {
-
-    @Nested
-    @DisplayName("validateEmlInput")
-    class ValidateEmlInputTests {
-
-        @Test
-        @DisplayName("should throw on null input")
-        void nullInput() {
-            assertThrows(Exception.class, () -> EmlProcessingUtils.validateEmlInput(null));
-        }
-
-        @Test
-        @DisplayName("should throw on empty input")
-        void emptyInput() {
-            assertThrows(Exception.class, () -> EmlProcessingUtils.validateEmlInput(new byte[0]));
-        }
-
-        @Test
-        @DisplayName("should throw on invalid format with insufficient headers")
-        void invalidFormat() {
-            byte[] data = "Hello, this is just random text without email headers.".getBytes();
-            assertThrows(Exception.class, () -> EmlProcessingUtils.validateEmlInput(data));
-        }
-
-        @Test
-        @DisplayName("should accept valid EML with multiple headers")
-        void validEml() {
-            String emlContent =
-                    "From: sender@example.com\r\n"
-                            + "To: recipient@example.com\r\n"
-                            + "Subject: Test\r\n"
-                            + "Date: Mon, 1 Jan 2024 00:00:00 +0000\r\n"
-                            + "\r\n"
-                            + "Body text";
-            assertDoesNotThrow(() -> EmlProcessingUtils.validateEmlInput(emlContent.getBytes()));
-        }
-    }
-
-    @Nested
-    @DisplayName("isMsgFile")
-    class IsMsgFileTests {
-
-        @Test
-        @DisplayName("should return false for null")
-        void nullInput() {
-            assertFalse(EmlProcessingUtils.isMsgFile(null));
-        }
-
-        @Test
-        @DisplayName("should return false for short bytes")
-        void shortBytes() {
-            assertFalse(EmlProcessingUtils.isMsgFile(new byte[] {0x01, 0x02}));
-        }
-
-        @Test
-        @DisplayName("should return true for MSG magic bytes")
-        void msgMagicBytes() {
-            byte[] magic = {
-                (byte) 0xD0,
-                (byte) 0xCF,
-                (byte) 0x11,
-                (byte) 0xE0,
-                (byte) 0xA1,
-                (byte) 0xB1,
-                (byte) 0x1A,
-                (byte) 0xE1,
-                0x00,
-                0x00
-            };
-            assertTrue(EmlProcessingUtils.isMsgFile(magic));
-        }
-
-        @Test
-        @DisplayName("should return false for non-MSG bytes")
-        void nonMsgBytes() {
-            byte[] data = new byte[] {0x50, 0x4B, 0x03, 0x04, 0x00, 0x00, 0x00, 0x00};
-            assertFalse(EmlProcessingUtils.isMsgFile(data));
-        }
-    }
-
-    @Nested
-    @DisplayName("escapeHtml")
-    class EscapeHtmlTests {
-
-        @Test
-        @DisplayName("should return empty string for null")
-        void nullInput() {
-            assertEquals("", EmlProcessingUtils.escapeHtml(null));
-        }
-
-        @Test
-        @DisplayName("should escape all HTML special characters")
-        void escapeSpecialChars() {
-            String result = EmlProcessingUtils.escapeHtml("<div class=\"test\">'&'</div>");
-            assertEquals("&lt;div class=&quot;test&quot;&gt;&#39;&amp;&#39;&lt;/div&gt;", result);
-        }
-
-        @Test
-        @DisplayName("should not modify plain text")
-        void plainText() {
-            assertEquals("Hello World", EmlProcessingUtils.escapeHtml("Hello World"));
-        }
-    }
-
-    @Nested
-    @DisplayName("convertTextToHtml")
-    class ConvertTextToHtmlTests {
-
-        @Test
-        @DisplayName("should return empty string for null")
-        void nullInput() {
-            assertEquals("", EmlProcessingUtils.convertTextToHtml(null, null));
-        }
-
-        @Test
-        @DisplayName("should convert newlines to br tags")
-        void newlinesToBr() {
-            String result = EmlProcessingUtils.convertTextToHtml("Line1\nLine2", null);
-            assertTrue(result.contains("<br>"));
-        }
-
-        @Test
-        @DisplayName("should convert CRLF to br tags")
-        void crlfToBr() {
-            String result = EmlProcessingUtils.convertTextToHtml("Line1\r\nLine2", null);
-            assertTrue(result.contains("<br>"));
-            assertFalse(result.contains("\r"));
-        }
-
-        @Test
-        @DisplayName("should linkify URLs")
-        void linkifyUrls() {
-            String result =
-                    EmlProcessingUtils.convertTextToHtml("Visit https://example.com today", null);
-            assertTrue(result.contains("<a href=\"https://example.com\""));
-        }
-
-        @Test
-        @DisplayName("should linkify email addresses")
-        void linkifyEmails() {
-            String result = EmlProcessingUtils.convertTextToHtml("Contact test@example.com", null);
-            assertTrue(result.contains("mailto:test@example.com"));
-        }
-    }
-
-    @Nested
-    @DisplayName("decodeMimeHeader")
-    class DecodeMimeHeaderTests {
-
-        @Test
-        @DisplayName("should return null for null input")
-        void nullInput() {
-            assertNull(EmlProcessingUtils.decodeMimeHeader(null));
-        }
-
-        @Test
-        @DisplayName("should return empty string for empty input")
-        void emptyInput() {
-            assertEquals("", EmlProcessingUtils.decodeMimeHeader(""));
-        }
-
-        @Test
-        @DisplayName("should return plain text unchanged")
-        void plainText() {
-            assertEquals("Hello World", EmlProcessingUtils.decodeMimeHeader("Hello World"));
-        }
-
-        @Test
-        @DisplayName("should decode Base64 encoded header")
-        void decodeBase64() {
-            // "Hello" in Base64
-            String result = EmlProcessingUtils.decodeMimeHeader("=?UTF-8?B?SGVsbG8=?=");
-            assertEquals("Hello", result);
-        }
-
-        @Test
-        @DisplayName("should decode quoted-printable encoded header")
-        void decodeQuotedPrintable() {
-            String result = EmlProcessingUtils.decodeMimeHeader("=?UTF-8?Q?Hello_World?=");
-            assertEquals("Hello World", result);
-        }
-
-        @Test
-        @DisplayName("should decode concatenated encoded words")
-        void decodeConcatenated() {
-            String input = "=?UTF-8?B?SGVs?= =?UTF-8?B?bG8=?=";
-            String result = EmlProcessingUtils.decodeMimeHeader(input);
-            assertEquals("Hello", result);
-        }
-
-        @Test
-        @DisplayName("should handle unknown encoding gracefully")
-        void unknownEncoding() {
-            String input = "=?UTF-8?X?unknown?=";
-            String result = EmlProcessingUtils.decodeMimeHeader(input);
-            assertEquals("=?UTF-8?X?unknown?=", result);
-        }
-    }
-
-    @Nested
-    @DisplayName("detectMimeType")
-    class DetectMimeTypeTests {
-
-        @Test
-        @DisplayName("should return existing MIME type if provided")
-        void existingMimeType() {
-            assertEquals(
-                    "image/jpeg", EmlProcessingUtils.detectMimeType("photo.png", "image/jpeg"));
-        }
-
-        @Test
-        @DisplayName("should detect PNG from filename")
-        void detectPng() {
-            assertEquals("image/png", EmlProcessingUtils.detectMimeType("image.png", null));
-        }
-
-        @Test
-        @DisplayName("should detect JPEG from filename")
-        void detectJpeg() {
-            assertEquals("image/jpeg", EmlProcessingUtils.detectMimeType("photo.jpg", null));
-        }
-
-        @Test
-        @DisplayName("should default to image/png for unknown extension")
-        void defaultMimeType() {
-            assertEquals("image/png", EmlProcessingUtils.detectMimeType("file.xyz", null));
-        }
-
-        @Test
-        @DisplayName("should default to image/png for null filename and mime")
-        void nullFilenameAndMime() {
-            assertEquals("image/png", EmlProcessingUtils.detectMimeType(null, null));
-        }
-    }
-
-    @Nested
-    @DisplayName("sanitizeText")
-    class SanitizeTextTests {
-
-        @Test
-        @DisplayName("should escape HTML when no sanitizer provided")
-        void noSanitizer() {
-            String result = EmlProcessingUtils.sanitizeText("<script>", null);
-            assertEquals("&lt;script&gt;", result);
-        }
-    }
-
-    @Nested
-    @DisplayName("processEmailHtmlBody")
-    class ProcessEmailHtmlBodyTests {
-
-        @Test
-        @DisplayName("should return empty string for null body")
-        void nullBody() {
-            assertEquals("", EmlProcessingUtils.processEmailHtmlBody(null, null, null));
-        }
-
-        @Test
-        @DisplayName("should strip fixed position CSS")
-        void stripFixedPosition() {
-            String html = "<div style=\"position:fixed; top:0\">content</div>";
-            String result = EmlProcessingUtils.processEmailHtmlBody(html, null, null);
-            assertFalse(result.contains("position:fixed"));
-        }
-    }
-
-    @Nested
-    @DisplayName("decodeUrlEncoded")
-    class DecodeUrlEncodedTests {
-
-        @Test
-        @DisplayName("should decode URL-encoded string")
-        void decodeEncoded() {
-            assertEquals("hello world", EmlProcessingUtils.decodeUrlEncoded("hello%20world"));
-        }
-
-        @Test
-        @DisplayName("should return original on invalid encoding")
-        void invalidEncoding() {
-            String result = EmlProcessingUtils.decodeUrlEncoded("%ZZinvalid");
-            assertEquals("%ZZinvalid", result);
-        }
-    }
-}
@@ -1,114 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-import org.springframework.ui.Model;
-import org.springframework.web.servlet.ModelAndView;
-
-class ErrorUtilsTest {
-
-    @Nested
-    @DisplayName("exceptionToModel")
-    class ExceptionToModelTests {
-
-        @Test
-        @DisplayName("should add error message to model")
-        void addsErrorMessage() {
-            Model model = mock(Model.class);
-            Exception ex = new RuntimeException("test error");
-
-            ErrorUtils.exceptionToModel(model, ex);
-
-            verify(model).addAttribute("errorMessage", "test error");
-        }
-
-        @Test
-        @DisplayName("should add stack trace to model")
-        void addsStackTrace() {
-            Model model = mock(Model.class);
-            Exception ex = new RuntimeException("test error");
-
-            ErrorUtils.exceptionToModel(model, ex);
-
-            verify(model)
-                    .addAttribute(
-                            eq("stackTrace"),
-                            argThat(
-                                    arg ->
-                                            arg instanceof String s
-                                                    && s.contains("RuntimeException")
-                                                    && s.contains("test error")));
-        }
-
-        @Test
-        @DisplayName("should return the same model instance")
-        void returnsSameModel() {
-            Model model = mock(Model.class);
-            Exception ex = new RuntimeException("test");
-
-            Model result = ErrorUtils.exceptionToModel(model, ex);
-
-            assertSame(model, result);
-        }
-
-        @Test
-        @DisplayName("should handle exception with null message")
-        void nullExceptionMessage() {
-            Model model = mock(Model.class);
-            Exception ex = new RuntimeException((String) null);
-
-            ErrorUtils.exceptionToModel(model, ex);
-
-            verify(model).addAttribute("errorMessage", null);
-        }
-    }
-
-    @Nested
-    @DisplayName("exceptionToModelView")
-    class ExceptionToModelViewTests {
-
-        @Test
-        @DisplayName("should create ModelAndView with error message")
-        void addsErrorMessage() {
-            Model model = mock(Model.class);
-            Exception ex = new RuntimeException("view error");
-
-            ModelAndView result = ErrorUtils.exceptionToModelView(model, ex);
-
-            assertNotNull(result);
-            assertEquals("view error", result.getModel().get("errorMessage"));
-        }
-
-        @Test
-        @DisplayName("should create ModelAndView with stack trace")
-        void addsStackTrace() {
-            Model model = mock(Model.class);
-            Exception ex = new RuntimeException("view error");
-
-            ModelAndView result = ErrorUtils.exceptionToModelView(model, ex);
-
-            String stackTrace = (String) result.getModel().get("stackTrace");
-            assertNotNull(stackTrace);
-            assertTrue(stackTrace.contains("RuntimeException"));
-            assertTrue(stackTrace.contains("view error"));
-        }
-
-        @Test
-        @DisplayName("should handle nested exception")
-        void nestedException() {
-            Model model = mock(Model.class);
-            Exception cause = new IllegalArgumentException("root cause");
-            Exception ex = new RuntimeException("wrapper", cause);
-
-            ModelAndView result = ErrorUtils.exceptionToModelView(model, ex);
-
-            String stackTrace = (String) result.getModel().get("stackTrace");
-            assertTrue(stackTrace.contains("root cause"));
-            assertEquals("wrapper", result.getModel().get("errorMessage"));
-        }
-    }
-}
@@ -1,90 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-class ExecutorFactoryTest {
-
-    @Test
-    @DisplayName("newVirtualThreadExecutor should return non-null executor")
-    void virtualThreadExecutorNotNull() {
-        ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
-        assertNotNull(executor);
-        executor.shutdown();
-    }
-
-    @Test
-    @DisplayName("newVirtualThreadExecutor should execute tasks")
-    void virtualThreadExecutorExecutesTasks() throws Exception {
-        ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
-        AtomicBoolean ran = new AtomicBoolean(false);
-        CountDownLatch latch = new CountDownLatch(1);
-
-        executor.submit(
-                () -> {
-                    ran.set(true);
-                    latch.countDown();
-                });
-
-        assertTrue(latch.await(5, TimeUnit.SECONDS));
-        assertTrue(ran.get());
-        executor.shutdown();
-    }
-
-    @Test
-    @DisplayName("newVirtualThreadExecutor should run on virtual threads")
-    void virtualThreadExecutorUsesVirtualThreads() throws Exception {
-        ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
-        AtomicReference<Boolean> isVirtual = new AtomicReference<>();
-        CountDownLatch latch = new CountDownLatch(1);
-
-        executor.submit(
-                () -> {
-                    isVirtual.set(Thread.currentThread().isVirtual());
-                    latch.countDown();
-                });
-
-        assertTrue(latch.await(5, TimeUnit.SECONDS));
-        assertTrue(isVirtual.get());
-        executor.shutdown();
-    }
-
-    @Test
-    @DisplayName("newSingleVirtualThreadScheduledExecutor should return non-null")
-    void scheduledExecutorNotNull() {
-        ScheduledExecutorService executor =
-                ExecutorFactory.newSingleVirtualThreadScheduledExecutor();
-        assertNotNull(executor);
-        executor.shutdown();
-    }
-
-    @Test
-    @DisplayName("newSingleVirtualThreadScheduledExecutor should execute scheduled tasks")
-    void scheduledExecutorExecutesTasks() throws Exception {
-        ScheduledExecutorService executor =
-                ExecutorFactory.newSingleVirtualThreadScheduledExecutor();
-        AtomicBoolean ran = new AtomicBoolean(false);
-        CountDownLatch latch = new CountDownLatch(1);
-
-        executor.schedule(
-                () -> {
-                    ran.set(true);
-                    latch.countDown();
-                },
-                10,
-                TimeUnit.MILLISECONDS);
-
-        assertTrue(latch.await(5, TimeUnit.SECONDS));
-        assertTrue(ran.get());
-        executor.shutdown();
-    }
-}
@@ -1,110 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.function.Predicate;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import stirling.software.common.configuration.RuntimePathConfig;
-
-class FileMonitorTest {
-
-    @TempDir Path tempDir;
-
-    private FileMonitor createFileMonitor(Path watchDir) throws IOException {
-        Predicate<Path> acceptAll = path -> true;
-        RuntimePathConfig runtimePathConfig = mock(RuntimePathConfig.class);
-        when(runtimePathConfig.getPipelineWatchedFoldersPaths())
-                .thenReturn(List.of(watchDir.toString()));
-        return new FileMonitor(acceptAll, runtimePathConfig);
-    }
-
-    @Test
-    void testConstructor_withValidDirectory() throws IOException {
-        FileMonitor monitor = createFileMonitor(tempDir);
-        assertNotNull(monitor);
-    }
-
-    @Test
-    void testConstructor_withNonExistentDirectory() throws IOException {
-        Path nonExistent = tempDir.resolve("does_not_exist");
-        Predicate<Path> acceptAll = path -> true;
-        RuntimePathConfig config = mock(RuntimePathConfig.class);
-        when(config.getPipelineWatchedFoldersPaths()).thenReturn(List.of(nonExistent.toString()));
-
-        // Should not throw - just logs an error about non-existent path
-        FileMonitor monitor = new FileMonitor(acceptAll, config);
-        assertNotNull(monitor);
-    }
-
-    @Test
-    void testConstructor_withEmptyWatchedFolders() throws IOException {
-        Predicate<Path> acceptAll = path -> true;
-        RuntimePathConfig config = mock(RuntimePathConfig.class);
-        when(config.getPipelineWatchedFoldersPaths()).thenReturn(List.of());
-
-        FileMonitor monitor = new FileMonitor(acceptAll, config);
-        assertNotNull(monitor);
-    }
-
-    @Test
-    void testTrackFiles_noEventsDoesNotThrow() throws IOException {
-        FileMonitor monitor = createFileMonitor(tempDir);
-        // Should not throw even when no events have occurred
-        assertDoesNotThrow(() -> monitor.trackFiles());
-    }
-
-    @Test
-    void testIsFileReadyForProcessing_nonExistentFile() throws IOException {
-        FileMonitor monitor = createFileMonitor(tempDir);
-        Path nonExistent = tempDir.resolve("nonexistent.pdf");
-
-        // Non-existent file should not be ready (file lock check will fail)
-        boolean ready = monitor.isFileReadyForProcessing(nonExistent);
-        assertFalse(ready, "Non-existent file should not be ready for processing");
-    }
-
-    @Test
-    void testIsFileReadyForProcessing_existingFile() throws IOException, InterruptedException {
-        FileMonitor monitor = createFileMonitor(tempDir);
-        Path testFile = tempDir.resolve("test.pdf");
-        Files.writeString(testFile, "test content");
-
-        // Run trackFiles to process any events
-        monitor.trackFiles();
-
-        // The file might or might not be ready depending on timing,
-        // but calling the method should not throw
-        assertDoesNotThrow(() -> monitor.isFileReadyForProcessing(testFile));
-    }
-
-    @Test
-    void testTrackFiles_afterFileCreation() throws IOException {
-        FileMonitor monitor = createFileMonitor(tempDir);
-
-        // Create a file in the watched directory
-        Path testFile = tempDir.resolve("newfile.txt");
-        Files.writeString(testFile, "hello");
-
-        // Track files should process the creation event
-        assertDoesNotThrow(() -> monitor.trackFiles());
-    }
-
-    @Test
-    void testConstructor_withPathFilter() throws IOException {
-        // Filter that rejects all paths
-        Predicate<Path> rejectAll = path -> false;
-        RuntimePathConfig config = mock(RuntimePathConfig.class);
-        when(config.getPipelineWatchedFoldersPaths()).thenReturn(List.of(tempDir.toString()));
-
-        FileMonitor monitor = new FileMonitor(rejectAll, config);
-        assertNotNull(monitor);
-    }
-}
@@ -1,357 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Answers.CALLS_REAL_METHODS;
-import static org.mockito.Mockito.*;
-
-import java.io.IOException;
-import java.io.RandomAccessFile;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-import org.mockito.Mock;
-import org.mockito.MockedStatic;
-import org.mockito.MockitoAnnotations;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.AutoPipeline.FileReadiness;
-
-@DisplayName("FileReadinessChecker")
-class FileReadinessCheckerTest {
-
-    @TempDir Path tempDir;
-
-    @Mock ApplicationProperties applicationProperties;
-    @Mock ApplicationProperties.AutoPipeline autoPipeline;
-
-    /** Real config object — easier to tweak per test than chaining multiple stubs. */
-    FileReadiness config;
-
-    FileReadinessChecker checker;
-
-    @BeforeEach
-    void setUp() {
-        MockitoAnnotations.openMocks(this);
-
-        config = new FileReadiness();
-        config.setEnabled(true);
-        config.setSettleTimeMillis(0); // instant settle by default — individual tests override
-        config.setSizeCheckDelayMillis(1); // minimal pause keeps tests fast
-        config.setAllowedExtensions(new ArrayList<>());
-
-        when(applicationProperties.getAutoPipeline()).thenReturn(autoPipeline);
-        when(autoPipeline.getFileReadiness()).thenReturn(config);
-
-        checker = new FileReadinessChecker(applicationProperties);
-    }
-
-    // =========================================================================
-    // Master toggle
-    // =========================================================================
-
-    @Nested
-    @DisplayName("when enabled=false")
-    class WhenDisabled {
-
-        @Test
-        @DisplayName("always returns true regardless of file state")
-        void alwaysReady() throws IOException {
-            config.setEnabled(false);
-
-            // Non-existent path — would normally fail check #1
-            Path ghost = tempDir.resolve("does-not-exist.pdf");
-            assertTrue(checker.isReady(ghost));
-        }
-    }
-
-    // =========================================================================
-    // Check #1 + #2: existence and regular-file guard
-    // =========================================================================
-
-    @Nested
-    @DisplayName("existence and file-type checks")
-    class ExistenceChecks {
-
-        @Test
-        @DisplayName("non-existent path → not ready")
-        void fileDoesNotExist() {
-            Path ghost = tempDir.resolve("ghost.pdf");
-            assertFalse(checker.isReady(ghost));
-        }
-
-        @Test
-        @DisplayName("path is a directory → not ready")
-        void pathIsDirectory() throws IOException {
-            Path dir = tempDir.resolve("subdir");
-            Files.createDirectory(dir);
-            assertFalse(checker.isReady(dir));
-        }
-
-        @Test
-        @DisplayName("path is a regular file → passes existence checks")
-        void regularFilePassesExistenceCheck() throws IOException {
-            Path file = realFile("test.pdf", "content");
-            setLastModifiedInPast(file, 60_000);
-            assertTrue(checker.isReady(file));
-        }
-    }
-
-    // =========================================================================
-    // Check #3: extension filter
-    // =========================================================================
-
-    @Nested
-    @DisplayName("extension filter")
-    class ExtensionFilter {
-
-        @Test
-        @DisplayName("empty allow-list → all extensions accepted")
-        void emptyAllowListAcceptsAll() throws IOException {
-            config.setAllowedExtensions(new ArrayList<>()); // empty = no filter
-            Path file = realFile("report.docx", "data");
-            setLastModifiedInPast(file, 60_000);
-            assertTrue(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("extension in allow-list → passes")
-        void extensionInAllowList() throws IOException {
-            config.setAllowedExtensions(List.of("pdf", "tiff"));
-            Path file = realFile("scan.pdf", "data");
-            setLastModifiedInPast(file, 60_000);
-            assertTrue(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("extension not in allow-list → not ready")
-        void extensionNotInAllowList() throws IOException {
-            config.setAllowedExtensions(List.of("pdf", "tiff"));
-            Path file = realFile("document.docx", "data");
-            setLastModifiedInPast(file, 60_000);
-            assertFalse(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("extension matching is case-insensitive")
-        void extensionMatchIsCaseInsensitive() throws IOException {
-            config.setAllowedExtensions(List.of("PDF"));
-            Path file = realFile("scan.pdf", "data");
-            setLastModifiedInPast(file, 60_000);
-            assertTrue(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("file without extension and non-empty allow-list → not ready")
-        void fileWithNoExtension() throws IOException {
-            config.setAllowedExtensions(List.of("pdf"));
-            Path file = realFile("README", "data");
-            setLastModifiedInPast(file, 60_000);
-            assertFalse(checker.isReady(file));
-        }
-    }
-
-    // =========================================================================
-    // Check #4: settle-time (last-modified age)
-    // =========================================================================
-
-    @Nested
-    @DisplayName("settle-time check")
-    class SettleTime {
-
-        @Test
-        @DisplayName("recently modified file → not ready")
-        void recentlyModified_notReady() throws IOException {
-            config.setSettleTimeMillis(60_000); // require 1 minute of quiet
-            Path file = realFile("new.pdf", "data");
-            // last-modified is now (just created) — well within the threshold
-            assertFalse(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("file settled for longer than threshold → ready")
-        void settled_ready() throws IOException {
-            config.setSettleTimeMillis(5_000);
-            Path file = realFile("old.pdf", "data");
-            setLastModifiedInPast(file, 10_000); // 10 s ago — older than 5 s threshold
-            assertTrue(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("settle threshold of 0 ms passes any file")
-        void zeroThreshold_alwaysPasses() throws IOException {
-            config.setSettleTimeMillis(0);
-            Path file = realFile("instant.pdf", "data");
-            // last-modified is right now; 0 ms threshold means anything passes
-            assertTrue(checker.isReady(file));
-        }
-    }
-
-    // =========================================================================
-    // Check #5: size stability
-    // =========================================================================
-
-    @Nested
-    @DisplayName("size-stability check")
-    class SizeStability {
-
-        @Test
-        @DisplayName("size unchanged between two reads → ready")
-        void sizeStable_ready() throws IOException {
-            config.setSizeCheckDelayMillis(1);
-            Path file = realFile("stable.pdf", "fixed content");
-            setLastModifiedInPast(file, 60_000);
-            assertTrue(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("size changes between two reads → not ready")
-        void sizeChanging_notReady() throws IOException {
-            config.setSizeCheckDelayMillis(1);
-            Path file = realFile("growing.pdf", "initial");
-            setLastModifiedInPast(file, 60_000);
-
-            // Use MockedStatic to control what Files.size() returns on each call
-            // while leaving all other Files.* methods intact.
-            AtomicInteger sizeCallCount = new AtomicInteger(0);
-            try (MockedStatic<Files> mockedFiles = mockStatic(Files.class, CALLS_REAL_METHODS)) {
-                mockedFiles
-                        .when(() -> Files.size(file))
-                        .thenAnswer(
-                                inv ->
-                                        sizeCallCount.incrementAndGet() == 1
-                                                ? 100L // first read: 100 bytes
-                                                : 200L); // second read: 200 bytes — changed!
-                assertFalse(checker.isReady(file));
-            }
-        }
-    }
-
-    // =========================================================================
-    // Check #6: file-lock check
-    // =========================================================================
-
-    @Nested
-    @DisplayName("file-lock check")
-    class FileLockCheck {
-
-        @Test
-        @DisplayName("file held open with exclusive lock by another thread → not ready")
-        void fileLocked_notReady() throws IOException, InterruptedException {
-            Path file = realFile("locked.pdf", "data");
-            setLastModifiedInPast(file, 60_000);
-
-            CountDownLatch lockAcquired = new CountDownLatch(1);
-            CountDownLatch testDone = new CountDownLatch(1);
-            AtomicInteger lockThreadFailed = new AtomicInteger(0);
-
-            Thread lockHolder =
-                    new Thread(
-                            () -> {
-                                try (RandomAccessFile raf =
-                                                new RandomAccessFile(file.toFile(), "rw");
-                                        FileChannel channel = raf.getChannel();
-                                        FileLock lock = channel.lock()) {
-                                    lockAcquired.countDown();
-                                    testDone.await(10, TimeUnit.SECONDS);
-                                } catch (Exception e) {
-                                    lockThreadFailed.set(1);
-                                    lockAcquired.countDown();
-                                }
-                            });
-            lockHolder.setDaemon(true);
-            lockHolder.start();
-            lockAcquired.await(5, TimeUnit.SECONDS);
-
-            try {
-                if (lockThreadFailed.get() == 0) {
-                    // Lock was successfully held — the checker must see it as locked.
-                    // On JVM, tryLock() from a second thread in the same process throws
-                    // OverlappingFileLockException (or returns null on some platforms), both of
-                    // which isLocked() maps to true.
-                    assertFalse(checker.isReady(file));
-                }
-                // If locking failed on this platform we simply skip the assertion rather than
-                // failing the build — the logic path is still exercised by other tests.
-            } finally {
-                testDone.countDown();
-                lockHolder.join(5_000);
-            }
-        }
-
-        @Test
-        @DisplayName("file with no external lock and all checks passing → ready")
-        void noLock_ready() throws IOException {
-            Path file = realFile("unlocked.pdf", "data");
-            setLastModifiedInPast(file, 60_000);
-            assertTrue(checker.isReady(file));
-        }
-    }
-
-    // =========================================================================
-    // Full happy-path integration
-    // =========================================================================
-
-    @Nested
-    @DisplayName("full happy path")
-    class HappyPath {
-
-        @Test
-        @DisplayName("all checks pass → ready")
-        void allChecksPass_ready() throws IOException {
-            config.setSettleTimeMillis(5_000);
-            config.setSizeCheckDelayMillis(1);
-            config.setAllowedExtensions(List.of("pdf"));
-
-            Path file = realFile("invoice.pdf", "PDF content");
-            setLastModifiedInPast(file, 10_000);
-
-            assertTrue(checker.isReady(file));
-        }
-
-        @Test
-        @DisplayName("first failing check short-circuits evaluation")
-        void shortCircuitsOnFirstFailure() throws IOException {
-            // Extension filter will reject — settle / size / lock checks must never run
-            config.setAllowedExtensions(List.of("pdf"));
-            config.setSettleTimeMillis(0);
-            config.setSizeCheckDelayMillis(1);
-
-            Path file = realFile("archive.zip", "ZIP data");
-            setLastModifiedInPast(file, 60_000);
-
-            assertFalse(checker.isReady(file));
-        }
-    }
-
-    // =========================================================================
-    // Helpers
-    // =========================================================================
-
-    private Path realFile(String name, String content) throws IOException {
-        Path file = tempDir.resolve(name);
-        Files.writeString(file, content);
-        return file;
-    }
-
-    /**
-     * Back-dates the last-modified time of {@code path} by {@code millisAgo} so that settle-time
-     * checks pass without actually waiting.
-     */
-    private void setLastModifiedInPast(Path path, long millisAgo) throws IOException {
-        Files.setLastModifiedTime(
-                path, FileTime.fromMillis(System.currentTimeMillis() - millisAgo));
-    }
-}
@@ -1,76 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import org.junit.jupiter.api.Test;
-
-class FileToPdfTest {
-
-    @Test
-    void testSanitizeZipFilename_normalFilename() {
-        String result = FileToPdf.sanitizeZipFilename("document.html");
-        assertEquals("document.html", result);
-    }
-
-    @Test
-    void testSanitizeZipFilename_pathTraversal() {
-        String result = FileToPdf.sanitizeZipFilename("../../etc/passwd");
-        // Should remove ../ sequences
-        assertFalse(result.contains(".."), "Path traversal sequences should be removed");
-    }
-
-    @Test
-    void testSanitizeZipFilename_driveLetterRemoved() {
-        String result = FileToPdf.sanitizeZipFilename("C:\\Users\\test\\file.html");
-        assertFalse(result.startsWith("C:"), "Drive letter should be removed");
-    }
-
-    @Test
-    void testSanitizeZipFilename_backslashesNormalized() {
-        String result = FileToPdf.sanitizeZipFilename("path\\to\\file.html");
-        assertFalse(result.contains("\\"), "Backslashes should be normalized to forward slashes");
-        assertTrue(result.contains("/") || !result.contains("\\"));
-    }
-
-    @Test
-    void testSanitizeZipFilename_nullInput() {
-        String result = FileToPdf.sanitizeZipFilename(null);
-        assertEquals("", result, "Null input should return empty string");
-    }
-
-    @Test
-    void testSanitizeZipFilename_emptyInput() {
-        String result = FileToPdf.sanitizeZipFilename("");
-        assertEquals("", result, "Empty input should return empty string");
-    }
-
-    @Test
-    void testSanitizeZipFilename_whitespaceOnly() {
-        String result = FileToPdf.sanitizeZipFilename("   ");
-        assertEquals("", result, "Whitespace-only input should return empty string");
-    }
-
-    @Test
-    void testSanitizeZipFilename_leadingSlashes() {
-        String result = FileToPdf.sanitizeZipFilename("///path/to/file.html");
-        assertFalse(result.startsWith("/"), "Leading slashes should be removed");
-    }
-
-    @Test
-    void testSanitizeZipFilename_nestedDirectories() {
-        String result = FileToPdf.sanitizeZipFilename("dir1/dir2/file.html");
-        assertEquals("dir1/dir2/file.html", result, "Normal nested paths should be preserved");
-    }
-
-    @Test
-    void testSanitizeZipFilename_mixedTraversal() {
-        String result = FileToPdf.sanitizeZipFilename("dir/../../../etc/passwd");
-        assertFalse(result.contains(".."), "Mixed path traversal should be removed");
-    }
-
-    @Test
-    void testSanitizeZipFilename_backslashTraversal() {
-        String result = FileToPdf.sanitizeZipFilename("dir\\..\\..\\etc\\passwd");
-        assertFalse(result.contains(".."), "Backslash path traversal should be removed");
-    }
-}
--- a/Show More
+++ b/Show More